toolroll 0.9.74 → 0.9.76

package/dist/storage-ui.d.ts

@@ -13,6 +13,8 @@ export type StorageView = {
         schedule?: SweepSchedule;
     };
     landed?: LandedSummary;
+    /** When the checkouts were last measured, and its Check now (docs/plans/get-side-effects.md). */
+    measured?: Html;
 };
 export declare function storageHtml(view: StorageView, notice: {
     said?: string | null;

package/dist/storage-ui.js

@@ -85,5 +85,5 @@ export function storageHtml(view, notice) {
     const preview = html `<details class="clean-up" data-clean-up${notice.problem?.startsWith("Enter your Toolroll password to clean") ? html ` open` : ""}><summary>Clean up</summary><div class="preview">${plan.go.length === 0 ? html `<p>Nothing to remove now.</p>` :
         html `<h3>Removes ${plural(plan.go.length, "checkout")}, about ${bytesWords(plan.freeBytes)}</h3><p class="meta">Their branches stay, so nothing committed is lost.</p><ul class="checkouts" data-goes>${plan.go.map(one => item(one))}</ul>`}${plan.stay.length === 0 ? "" : html `<h3>Stays (${plan.stay.length})</h3><ul class="checkouts" data-stays>${plan.stay.map(one => item(one))}</ul>`}${remove}</div></details>`;
     const options = CLEANUP_CHOICES.map(one => html `<option value="${one.value}"${one.value === plan.cleanup ? html ` selected` : ""}>${one.label}</option>`);
-    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p><p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
+    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p>${view.measured ?? ""}<p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
 }

package/dist/storage.js

@@ -101,7 +101,8 @@ export function diskBytes(paths) {
     if (process.platform !== "win32") {
         for (let at = 0; at < paths.length; at += 200) {
             const batch = paths.slice(at, at + 200);
-            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+            // Bounded: a slow disk leaves the rest unmeasured rather than holding everything up.
+            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 60_000 });
             for (const line of (du.stdout ?? "").split("\n")) {
                 const match = /^(\d+)\t(.+)$/.exec(line);
                 if (match !== null && batch.includes(match[2]))

package/dist/store.d.ts

@@ -2355,7 +2355,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode" | "chat" | "grant" | "schedule";
+        kind: "mode" | "chat" | "grant" | "schedule" | "auto-check" | "auto-green";
         modeDigest: string;
         /** A chat seal of a deploy gate: the release card it came from (chat-management.md §0a.5). */
         card?: "release";
@@ -2397,6 +2397,9 @@ export declare class Store {
         signedBy: string;
         absoluteExpiry: string;
     } | null;
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now: Date): number;
+    private closeExpiredMode;
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */

package/dist/store.js

@@ -97,6 +97,7 @@ import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, subagentFilers, usd } from "./spend.js";
 import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
 import { CHECKOUT_CLEANUP_SCHEMA, LANDED_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
 import { configBase, envValue, namedPath } from "./names.js";
@@ -7013,7 +7014,17 @@ export class Store {
             const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
-            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
+            // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
+            // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
+            const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
+            if (automatic) {
+                if (terms.terms === null || typeof working["candidate"] !== "string" || working["candidate"] === "")
+                    return false;
+                const evidence = autoEvidenceOf(this, taskId, basis.modeDigest, basis.kind);
+                if (evidence === null || evidence.digest !== String(working["digest"]) || evidence.candidate !== working["candidate"] || evidence.by !== by)
+                    return false;
+            }
+            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat" && !automatic)
                 return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
                 return false;
@@ -7032,7 +7043,8 @@ export class Store {
                     approved_route_json = proposed_route_json
               WHERE task_id = ?`)
                 .run(now.toISOString(), by, basis === undefined ? "password" : basis.kind, basis === undefined ? null : basis.modeDigest, taskId);
-            if (changed.changes > 0 && terms.ok && terms.terms !== null) {
+            // `auto-check` only lets the check run: it opens no release authority (only `auto-green` and a person's yes do).
+            if (changed.changes > 0 && terms.ok && terms.terms !== null && basis?.kind !== "auto-check") {
                 if (openReleaseAuthority(this, { taskId, digest: String(working["digest"]), terms: terms.terms, by, now }) === null)
                     throw new ReleaseSealRefused();
             }
@@ -7065,7 +7077,11 @@ export class Store {
                                         ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
                                         : basis.kind === "schedule"
                                             ? "Approved by its standing order. A connected worker can take it next."
-                                            : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                            : basis.kind === "auto-check"
+                                                ? "Checking automatically: it approves itself once CI and the release check pass."
+                                                : basis.kind === "auto-green"
+                                                    ? "Approved automatically: CI and the release check passed."
+                                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -7163,15 +7179,10 @@ export class Store {
         if (row === undefined)
             return null;
         if (Date.parse(String(row["absolute_expiry"])) <= now.getTime()) {
-            this.transact(() => {
-                this.db
-                    .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
-                    .run(now.toISOString(), "the-clock", Number(row["id"]));
-                this.db
-                    .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
-                    .run(Number(row["id"]), now.toISOString());
-                this.reconcileIntentsForMode(String(row["repo"]), null, now);
-            });
+            // A page visit only reads (docs/plans/get-side-effects.md): it sees no mode, and the background pass or the
+            // next path that acts closes it.
+            if (!inReadOnlyRequest())
+                this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
             return null;
         }
         return {
@@ -7183,6 +7194,34 @@ export class Store {
             absoluteExpiry: String(row["absolute_expiry"]),
         };
     }
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now) {
+        // The same rows activeMode would close: unrevoked, signed by a standing approver, past their expiry.
+        const rows = this.db.prepare(`SELECT operating_mode.id, operating_mode.repo, operating_mode.absolute_expiry FROM operating_mode
+      JOIN approver ON approver.name = operating_mode.signed_by AND approver.revoked_at IS NULL AND approver.role = 'approver'
+     WHERE operating_mode.revoked_at IS NULL`).all();
+        let closed = 0;
+        for (const row of rows) {
+            if (Date.parse(String(row["absolute_expiry"])) > now.getTime())
+                continue;
+            this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
+            closed++;
+        }
+        return closed;
+    }
+    closeExpiredMode(id, repo, now) {
+        this.transact(() => {
+            const closed = this.db
+                .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
+                .run(now.toISOString(), "the-clock", id);
+            if (Number(closed.changes) !== 1)
+                return;
+            this.db
+                .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
+                .run(id, now.toISOString());
+            this.reconcileIntentsForMode(repo, null, now);
+        });
+    }
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */
@@ -20398,7 +20437,7 @@ export function serializeReleaseTerms(terms) {
 }
 // ---- one approval per release: the authority record (release-once.md, part 1) --------------------------------------
 export { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseAuthorityOfTask, releaseCarries, releaseCarryTo, releaseOperation, releaseOperations, releaseSealProblem, } from "./release-authority.js";
-import { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
+import { LIVE_RELEASE_STATES, autoEvidenceOf, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
 /**
  * Open a release's authority for a person's seal of its terms (inside the seal's transaction): the next generation,
  * superseding the live one. False when it can't (releaseSealProblem), which refuses the seal.

package/dist/subagent-work.js

@@ -235,6 +235,9 @@ function carryOut(store, flow, definition, stage, card, mate, context, answer, n
     }
     if (answer.action === "cant") {
         event("handled", `Couldn't handle “${card.title}”: ${answer.note}`);
+        // A zone that answers whoever asked tells them it couldn't, in its own words when it gave some: they always hear back.
+        if (stage.reply === true)
+            replyToAsker(store, flow, card, mate, answer.note || (answer.reason === "" ? `${context.name} couldn't handle this.` : `${context.name} couldn't handle this: ${answer.reason}`), now);
         if (stage.onFail !== null)
             store.moveFlowCard(card.id, { to: stage.onFail, outcome: "fail", actor, note: answer.note === "" ? null : note(answer.note), expectEntry: card.entry }, now);
         else

package/dist/task-base.js

@@ -7,7 +7,7 @@
 import { execFileSync } from "node:child_process";
 export const readGit = (cwd, args) => {
     try {
-        return execFileSync("git", ["--no-optional-locks", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+        return execFileSync("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
     }
     catch {
         return null;

package/dist/task-status.d.ts

@@ -43,6 +43,8 @@ export type TaskStatus = {
         key: NeedKey;
         action: NeedAction;
     } | null;
+    /** The approved check as the Checks row shows it (`approvedCheckStateOf`): the road reads this, never the row's words. */
+    check?: ApprovedCheckState | null;
 };
 /** `reviewing`: the one automatic review (build-review.ts) is reading a finished build; it reads Building, not a headline of its own. */
 export type TaskStage = "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
@@ -61,6 +63,8 @@ export type ChecksFact = {
         run: number;
         head: string;
     } | null;
+    /** Why it can't be read, when that is the project's check command approved again since it ran. */
+    cause?: "command-changed" | null;
 };
 /** What checks Off leaves for a release: `pending` until a passing full release check contains the commit, then
  * `covered`. `running`: a check is waiting for its batch or running on this commit. */
@@ -70,6 +74,25 @@ export declare function releaseStateOf(checks: Pick<ChecksFact, "status" | "leve
 /** How the project check stands for requirements that rest on it, read now: `covered` once a check passed on this
  * commit (its own, a follow-up, or a release check containing it), `pending` while checks Off wait for a release. */
 export declare function checkBackingOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ReleaseState | undefined;
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export declare function approvedCheckOf(verdict: string | null | undefined, reasons: readonly string[], checks: ChecksFact | null | undefined): ChecksFact | null;
+/** How the approved check reads, in one word every surface shares (from `approvedCheckOf`'s answer): `running` while a
+ * check is underway on the commit, else what it recorded. `unreadable`: it couldn't be read or the records disagree. */
+export type ApprovedCheckState = "passed" | "failed" | "running" | "not-run" | "off" | "unreadable";
+export declare function approvedCheckStateOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ApprovedCheckState | null;
+/** A saved check that can't be read, in the words every surface uses. */
+export declare const CHECK_UNREADABLE = "The check result couldn't be read.";
+export declare const CHECK_UNREADABLE_ASK = "The check result couldn't be read. Run checks on it, or open the result to see why.";
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export declare const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
 /** What stands between a finished result and Complete (`completionBlockersOf`): each with the exact next step. */
 export type CompletionBlocker = {
     key: "check-failed" | "check-missing" | "criteria" | "high";
@@ -224,7 +247,7 @@ export declare function requirementsOf(matrix: readonly RequirementRow[] | null
  * the rest); an unresolved HIGH review finding. A release check that covers the commit counts as passed. */
 export declare function completionBlockersOf(f: {
     report: boolean;
-    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch"> | null;
+    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch" | "cause"> | null;
     checkRequired: boolean;
     matrix: readonly RequirementRow[] | null | undefined;
     verdict: string | null | undefined;
@@ -235,6 +258,10 @@ export declare function completionBlockersOf(f: {
 export declare function unverifiedWhenRefuted(requirements: NonNullable<TaskStatusFacts["requirements"]> | null, verdict: string | null | undefined): NonNullable<TaskStatusFacts["requirements"]> | null;
 /** Saved evidence health from the receipt's artifact list and its caveats. */
 export declare function evidenceOf(receipt: AssignmentSnapshot["receipt"], problems?: readonly string[]): NonNullable<TaskStatusFacts["evidence"]> | null;
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export declare function checksFactOf(checks: NonNullable<AssignmentSnapshot["receipt"]>["checks"], head: string | null): ChecksFact;
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export declare function receiptChecksOf(receipt: NonNullable<AssignmentSnapshot["receipt"]>): ChecksFact | null;
 /** The status facts of one assignment, as every surface reads them. */
 export declare function assignmentStatusFacts(assignment: AssignmentSnapshot, options?: {
     work?: {

package/dist/task-status.js

@@ -12,6 +12,7 @@
  * technical reason stays one tap away in `why`. */
 import { DEFAULT_LEAD_NAME } from "./lead-identity.js";
 import { html } from "./html.js";
+import { FAILED_CHECK } from "./result-acts.js";
 import { CODE_NEED, NEEDS, needSentence, waitSentence } from "./needs-you.js";
 /** A cancelled task with a successor reads "Replaced by <id>" everywhere, never "Cancelled". */
 export const replacedWords = (successor) => `Replaced by ${successor}`;
@@ -38,6 +39,67 @@ export function releaseStateOf(checks) {
 export function checkBackingOf(checks) {
     return checks?.status === "passed" ? "covered" : checksUnderway(checks) ? "running" : releaseStateOf(checks);
 }
+/**
+ * Did the approved check pass for this result? The ONE answer the status headline and sentence, the Project checks
+ * row, the road's Checks step and the result page all read, so none of them can say "passed" while another says the
+ * check couldn't be read. Two records speak to it: the machine verdict sealed when the build finished, and the saved
+ * check receipt read now (with any follow-up check on the same commit). Fail closed: the check passed only when the
+ * receipt read now says so. A verdict that recorded a pass whose receipt is missing, says nothing ran, or can't be
+ * read is unreadable; a verdict that recorded a failure stays failed unless a later check on the same commit passed.
+ * `checks` undefined or null: nothing was read. Returns the check as every surface shows it (null: nothing to show).
+ */
+export function approvedCheckOf(verdict, reasons, checks) {
+    let failedExit = null;
+    for (const reason of reasons) {
+        const found = FAILED_CHECK.exec(reason);
+        if (found !== null) {
+            failedExit = Number(found[1]);
+            break;
+        }
+    }
+    const recordedFail = verdict === "refuted" && failedExit !== null;
+    const recordedPass = verdict === "verified";
+    const read = checks ?? null;
+    if (read === null) {
+        if (recordedFail)
+            return { status: "failed", exitCode: failedExit, head: null };
+        return recordedPass ? { status: "unavailable", exitCode: null, head: null } : null;
+    }
+    if (read.status === "passed" || read.status === "failed" || read.status === "running")
+        return read;
+    // Checks Off covered by a passing release check read as passed (the row says on which commit); nothing to correct.
+    if (read.level === "off" && read.release != null && !recordedFail)
+        return read;
+    if (recordedFail)
+        return { ...read, status: "failed", exitCode: failedExit };
+    // The verdict says the check passed, the receipt read now can't show it: the two disagree, so it doesn't count.
+    if (recordedPass)
+        return { ...read, status: "unavailable", exitCode: null };
+    return read;
+}
+export function approvedCheckStateOf(checks) {
+    if (checks == null)
+        return null;
+    // A failure stands while a new check runs: only its result can change the answer. A check that couldn't be read (a
+    // result waiting for its batch check has none yet) reads running while one is underway, and never passed.
+    if (checks.status === "failed")
+        return "failed";
+    if (checksUnderway(checks) || checks.status === "running")
+        return "running";
+    if (checks.status === "unavailable")
+        return "unreadable";
+    if (checks.status === "passed")
+        return "passed";
+    if (checks.level === "off")
+        return checks.release != null ? "passed" : "off";
+    return "not-run";
+}
+/** A saved check that can't be read, in the words every surface uses. */
+export const CHECK_UNREADABLE = "The check result couldn't be read.";
+export const CHECK_UNREADABLE_ASK = `${CHECK_UNREADABLE} Run checks on it, or open the result to see why.`;
+/** A saved check whose files are intact but whose command was approved again since it ran. */
+export const CHECK_COMMAND_CHANGED = "The check command changed since this check; run checks again.";
+const unreadableAsk = (checks) => checks?.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE_ASK;
 /** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
 export function peerWords(peers, shown = 2) {
     if (peers.length <= shown)
@@ -65,10 +127,11 @@ function resultAsk(facts) {
     if (blocker !== undefined)
         return blocker.message;
     const req = facts.requirements;
-    if (req == null || facts.accepted === true || req.unverified === true)
-        return null;
-    if ((req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
+    if (req != null && facts.accepted !== true && req.unverified !== true && (req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
         return req.ask;
+    // A check that can't be read is never a pass: a person runs it again or looks at why, unless they already accepted.
+    if (facts.accepted !== true && approvedCheckStateOf(facts.checks) === "unreadable")
+        return unreadableAsk(facts.checks);
     return null;
 }
 export function headlineOf(facts) {
@@ -122,6 +185,8 @@ function sentenceOf(headline, facts) {
             }
             if (facts.checks?.batch?.state === "waiting")
                 return "Its full check runs with other results within 10 minutes. Review the change, then mark it complete.";
+            if (facts.checks?.status === "unavailable")
+                return `${facts.checks.cause === "command-changed" ? CHECK_COMMAND_CHANGED : CHECK_UNREADABLE} Review the change, then mark it complete.`;
             // Never claim a check that isn't known to have passed.
             if (facts.checks == null)
                 return "Review the change, then mark it complete.";
@@ -155,7 +220,11 @@ function detailsOf(headline, facts) {
         const batch = checks.batch ?? null;
         const together = batch === null ? null : checkedTogetherWords(batch);
         const batchWhy = batch === null ? null : BATCH_WHY[batch.state] ?? null;
-        if (batch?.state === "waiting")
+        // A failure or an unreadable check keeps its words while a new check runs, so the row never reads better than the answer.
+        const again = checksUnderway(checks) && checks.status === "failed" ? " · running again" : "";
+        if (again !== "")
+            row("checks", CHECKS_LABEL, `${quick ? "Quick checks failed" : "Failed"}${checks.exitCode === null ? "" : ` (exit ${checks.exitCode})`}${again}`, problem(headline), headline === "Failed" ? { href: checksHref } : { action: { label: "See what failed", href: checksHref } });
+        else if (batch?.state === "waiting")
             row("checks", CHECKS_LABEL, "Waiting to check with other results", "running", { href: checksHref });
         else if (checks.running != null)
             row("checks", CHECKS_LABEL, `${checks.running === "quick" ? "Quick" : "Full"} checks running`, "running", { href: checksHref });
@@ -178,6 +247,8 @@ function detailsOf(headline, facts) {
         else if (checks.status === "not-run")
             row("checks", CHECKS_LABEL, "Didn't run", "none", runChecks === null ? {} : { action: runChecks });
         // A saved check that can't be read is run again where that is possible.
+        else if (checks.cause === "command-changed")
+            row("checks", CHECKS_LABEL, "Check command changed since", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null }, why: CHECK_COMMAND_CHANGED });
         else
             row("checks", CHECKS_LABEL, "Couldn't be read", "note", { action: runChecks ?? { label: OPEN_RESULT, href: facts.links?.result ?? null } });
     }
@@ -255,7 +326,7 @@ export function statusOf(facts) {
     const primaryAction = need === null || ownWords ? facts.action ?? null : { label: need.action.label, href: facts.action?.href ?? null };
     const sentence = lead === "on-it" ? leadSentence(headline, facts) : lead === "lapsed" ? `${leadLapsed(facts.leadName)} ${sentenceOf(headline, facts)}` : sentenceOf(headline, facts);
     return { headline, tone: HEADLINE_TONE[headline], sentence, details: detailsOf(headline, facts),
-        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need };
+        primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need, check: facts.report ? null : approvedCheckStateOf(facts.checks) };
 }
 /** The name most surfaces already import. */
 export const taskStatusOf = statusOf;
@@ -267,7 +338,7 @@ const CODE_STAGE = {
     "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"],
     // A request the planner cannot be given (too long to hand back, say) waits on a person to shorten it.
     "planner-source": ["needs-you", "fix-request"],
-    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"],
+    running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"], "checks-running": ["checking"],
     "signed-out": ["needs-you", "sign-in"],
     "needs-approval": ["needs-you", "approval"],
     "waiting-decision": ["needs-you", "answer"], "decision-queue": ["needs-you", "answer"],
@@ -432,7 +503,8 @@ export function completionBlockersOf(f) {
     }
     else if (!f.report && f.checkRequired && f.checks?.status !== "passed" && release === undefined) {
         blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Mark it complete once it passes."
-                : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
+                : f.checks?.status === "unavailable" ? f.checks.cause === "command-changed" ? `${CHECK_COMMAND_CHANGED.replace(/; run checks again\.$/, ".")} Run checks again, then mark it complete.` : `${CHECK_UNREADABLE} Run checks on it, then mark it complete.`
+                    : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
     }
     if (!f.accepted && f.checks?.status !== "failed") {
         const refuted = f.verdict === "refuted";
@@ -457,11 +529,24 @@ export function unverifiedWhenRefuted(requirements, verdict) {
 export function evidenceOf(receipt, problems = receipt?.caveats ?? []) {
     if (receipt === null)
         return null;
+    // The check's own reading is the Project checks row's to say (a changed command is not a missing file).
+    problems = problems.filter(one => one !== receipt.checks.detail);
     const shortened = receipt.artifacts.filter(one => !one.complete).length + problems.filter(one => /shortened|cut short/.test(one)).length;
     const damaged = problems.filter(one => /unavailable or changed|no longer verif|cannot be read|could not be read|failed capture|altered|damaged/i.test(one)).length;
     const missing = problems.filter(one => /missing|ambiguous|no longer exists/i.test(one) && !/unavailable or changed/.test(one)).length;
     return { shortened, missing, damaged };
 }
+/** A saved check reading as the shared fact (head, level, a follow-up running, a batch, release coverage). */
+export function checksFactOf(checks, head) {
+    return { status: checks.status, exitCode: checks.exitCode, head,
+        ...(checks.level == null ? {} : { level: checks.level }), ...(checks.running == null ? {} : { running: checks.running }),
+        ...(checks.batch == null ? {} : { batch: checks.batch }), ...(checks.release == null ? {} : { release: checks.release }),
+        ...(checks.cause == null ? {} : { cause: checks.cause }) };
+}
+/** A receipt's approved check, as every surface reads it (`approvedCheckOf` over its verdict and its saved check). */
+export function receiptChecksOf(receipt) {
+    return approvedCheckOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], checksFactOf(receipt.checks, receipt.head));
+}
 /** The status facts of one assignment, as every surface reads them. */
 export function assignmentStatusFacts(assignment, options = {}) {
     const { stage, need, wait } = assignmentStageOf(assignment, options.work ?? null, options.planning ?? false);
@@ -471,10 +556,7 @@ export function assignmentStatusFacts(assignment, options = {}) {
     // A saved result's rows show whenever it is the reason a person is needed, too.
     const withResult = finished || stage === "failed" || ((stage === "needs-you" || stage === "waiting") && receipt !== null);
     const report = receipt?.completionKind === "research-report";
-    const checks = receipt === null || !withResult ? null
-        : { status: receipt.checks.status, exitCode: receipt.checks.exitCode, head: receipt.head,
-            ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }),
-            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }), ...(receipt.checks.release == null ? {} : { release: receipt.checks.release }) };
+    const checks = receipt === null || !withResult ? null : receiptChecksOf(receipt);
     const publication = assignment.publication;
     const pullRequest = options.pullRequest !== undefined ? options.pullRequest
         : publication === null ? (withResult && !report ? { state: "none", number: null, url: null, ci: null, error: null } : null)

package/dist/teardown-git.d.ts

@@ -6,14 +6,24 @@ export declare const TEARDOWN_FLAGS: readonly string[];
 /** Exit code of a refused command (git's own fatal code, so no caller reads it as "not found" or "no"). */
 export declare const REFUSED_CODE = 128;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
- * scope count: teardown commands never read system or global config. */
-export declare function commandSetting(listing: string): string | null;
+ * scope count: teardown commands never read system or global config. `lfsChecked`: the caller refuses a checkout whose
+ * `.lfsconfig` names a git-lfs extension (lfsExtensionIn), so git-lfs's own exact filters may stand (runsCommand).
+ * Fails closed: a listing that can't be classified names a setting. */
+export declare function commandSetting(listing: string, options?: {
+    lfsChecked?: boolean;
+}): string | null;
 /** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
 export declare function carriedSettings(listing: string): string[];
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export declare function refusal(result: ExecResult): string | null;
-/** The one way teardown runs git, including the target checkout immediately before removal. */
-export declare function teardownGit(runner?: Runner): Git;
+/** The one way teardown runs git, including the target checkout immediately before removal. Every command runs
+ * against a write view of its repository (gitView), whose config is the one inspected and whose info is a copy, so a
+ * setting or attributes file an agent adds after the inspection is never read (a build's process can outlive its turn:
+ * on macOS containment is observational, src/containment.ts, and a sibling build shares the repository). A removal's
+ * target is bound to the same repository as the folder it is removed from. A removal without --force runs under the
+ * target's own view (its own config.worktree folded in), so git's last check of whether it is clean reads it as the
+ * target itself would. `binding.repo`: the project's main checkout, from the plane's records, when the caller has it. */
+export declare function teardownGit(runner?: Runner, binding?: GitBinding): Git;
 /**
  * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
  * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
@@ -29,8 +39,52 @@ export declare function teardownGit(runner?: Runner): Git;
  * that can't be read so counts as including.
  */
 export declare function checkoutIncludes(checkout: string): boolean;
+export type GitBinding = {
+    repo?: string | null;
+};
+/** Settings fixed on every write through a view: `worktree add` records absolute paths (relative ones would need a
+ * config write, which a view keeps); no transport at all (a caller that fetches allows its one protocol by name, as the
+ * nightly check's local fetch does with protocol.file.allow); and no split index (its shared index files would be
+ * written in the plane's GIT_DIR). */
+export declare const WRITE_VIEW_FLAGS: readonly string[];
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
 export declare function lfsExtensionIn(checkout: string): boolean;
-export declare function checkoutGit(inner?: Runner): Runner;
+/** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
+ * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
+ * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
+ * no info/attributes. "build" is the plane's staging and committing of a build's work, which writes the repository
+ * through the view (gitView). */
+export declare function checkoutGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
+/**
+ * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
+ * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
+ * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
+ * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
+ */
+export declare const PAGE_READ_FLAGS: readonly string[];
+/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
+ * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
+ * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
+ * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
+export declare function readFlags(): readonly string[];
+/**
+ * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
+ * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
+ * config, the operator's own values carried, PAGE_READ_FLAGS and a view of the checkout's repository (gitView: they hold even if its config
+ * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
+ */
+export declare function checkoutGitSync(cwd: string, args: readonly string[], options?: {
+    timeoutMs?: number;
+    maxBuffer?: number;
+    binding?: GitBinding;
+}): string;
+/**
+ * checkoutGit ("build": the repository written through its view) for callers that name the repository with a leading
+ * `git -C <dir>` instead of a cwd: worktree add and remove in a project's repository, a merge in a checkout of it.
+ * The project's repository is shared with every build, which can write its config, info and hooks; nothing here runs
+ * what they name. Anything but git goes to `inner` as given.
+ */
+export declare function hardenedGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;