toolroll 0.9.75 → 0.9.77

package/dist/check-failure.js

@@ -0,0 +1,267 @@
+/**
+ * Why a release check failed, in one of four classes (docs/plans/eval-harness.md, phase 1 C), and what each class
+ * allows. This replaces the flat "two flakes" allowance (AUTO_FLAKE_CAP) for release checks and for GitHub CI.
+ *
+ *   deterministic    typecheck, build, a failing test, a scripted journey, an upgrade, a required test gone:
+ *                    nothing tolerated, never rerun to pass; the branch is fixed and the new commit released.
+ *   infrastructure   independently confirmed by the plane itself: the check never started, this worker lost the
+ *                    build, Toolroll's own shutdown stopped it — or, on GitHub, a job that failed before any of the
+ *                    workflow's own steps ran. At most one rerun per incident and two per candidate, under the same
+ *                    approval; a pass after them counts.
+ *   unknown          exit 1 with no failing test named, an unexplained timeout or signal, no result at all: an error
+ *                    that blocks. A diagnostic rerun may run, but its pass doesn't erase the failure: a person decides.
+ *   agent-behaviour  a real-model journey failed (or passed only on its retry): counted, never rerun to pass.
+ *
+ * Only plane-side facts can make a failure "infrastructure": the sealed receipt's own result (which the builder writes
+ * from the process it ran), and GitHub's own job and step records read by the plane's gh. Nothing the candidate writes —
+ * its output, a label it prints, its report — can. The report is candidate-written: it is read only to choose among
+ * the classes that block (deterministic, agent-behaviour, unknown), never to allow a rerun. gate-failure.ts's
+ * classifyGateFailure reads the log and is never evidence that a release failure is harmless.
+ */
+import { CHECK_REPORT_CAPTURE, readSealedJson } from "./check-report.js";
+import { readCheckReport } from "./contracts/release-check.js";
+import { regateTask } from "./dispose.js";
+import { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT } from "./release.js";
+import { verificationEvidence } from "./verification-evidence.js";
+/** The plane's limits for confirmed infrastructure failures (one rerun per incident, two per candidate). */
+export { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT };
+/** The ledger action that records each rerun the release asked for, and why. */
+export const RELEASE_RECHECK_ACTION = "release check rerun";
+/** The failures that mean the check never started or never finished for a reason the plane itself saw. */
+const PLANE_INFRA = {
+    "spawn-failed": "the check never started: the machine couldn't start its command",
+    "retry-spawn-failed": "the check's retry never started: the machine couldn't start its command",
+    "custody-lost": "this worker lost the build before the check could finish",
+    "stopped-by-toolroll": "Toolroll's own shutdown stopped the check before it finished",
+};
+/**
+ * One failed check, classified. `facts` come from the plane's sealed receipt; `report` (the check's own report, sealed
+ * when valid) only ever picks among the classes that block. Null when the check passed.
+ */
+export function classifyCheckFailure(facts, report) {
+    const result = facts.result;
+    const passedCoverage = facts.coverage === undefined || facts.coverage === "full" || facts.coverage === "composed";
+    if (result.configured && result.ran === true && result.exitCode === 0 && passedCoverage)
+        return null;
+    if (!result.configured)
+        return { class: "unknown", why: "no check is configured" };
+    if (result.ran !== true) {
+        const failure = result.failure ?? "";
+        const infra = PLANE_INFRA[failure];
+        if (infra !== undefined)
+            return { class: "infrastructure", why: infra };
+        if (failure === "timed-out" || failure === "retry-timed-out")
+            return { class: "unknown", why: "the check timed out, and nothing says why" };
+        if (failure === "baseline-unverifiable")
+            return { class: "unknown", why: "the last release Toolroll recorded couldn't be verified, so what the check owed is unknown and it wasn't run" };
+        if (failure === "no-result")
+            return { class: "unknown", why: "the check gave no complete result (no valid report, or a part, file or journey with no outcome)" };
+        if (failure === "coverage-incomplete")
+            return { class: "deterministic", why: facts.coverage === "identity-removed" ? "a required test was removed, renamed or newly skipped" : "the check didn't cover everything it owed" };
+        return { class: "unknown", why: `the check couldn't run to its end (${failure || "no reason recorded"})` };
+    }
+    // It ran and exited nonzero (or its coverage fell short): what failed, from its report — only among blocking classes.
+    if (report === null)
+        return { class: "unknown", why: `the check exited ${result.exitCode ?? "nonzero"} and gave no report naming what failed` };
+    const deterministic = [], agent = [], unexplained = [];
+    for (const part of report.parts) {
+        if (!part.selected || !part.ran || part.code === null)
+            continue;
+        if (part.timedOut || part.signal != null) {
+            unexplained.push(`${part.part} ${part.timedOut ? "timed out" : `was ended by ${part.signal}`}`);
+            continue;
+        }
+        if ((part.part === "typecheck" || part.part === "build") && part.code !== 0)
+            deterministic.push(`the ${part.part} failed`);
+    }
+    for (const file of report.units?.files ?? [])
+        if (file.state === "failed")
+            deterministic.push(`${file.file} failed`);
+    if ((report.units?.runErrors ?? 0) > 0 && !(report.units?.files ?? []).some(file => file.state === "failed"))
+        unexplained.push(`${report.units.runErrors} unit errors no test owned`);
+    for (const run of report.journeys)
+        for (const group of run.groups) {
+            if (group.state !== "failed")
+                continue;
+            (run.kind === "real" ? agent : deterministic).push(`${run.script}${run.kind === "real" ? " real-model" : ""} journey group ${group.group} failed`);
+        }
+    for (const version of report.upgrades?.versions ?? [])
+        if (version.state === "failed")
+            deterministic.push(`the upgrade from ${version.version} failed`);
+    const list = (items) => `${items.slice(0, 4).join("; ")}${items.length > 4 ? `; and ${items.length - 4} more` : ""}`;
+    if (deterministic.length > 0)
+        return { class: "deterministic", why: list(deterministic) };
+    if (agent.length > 0)
+        return { class: "agent-behaviour", why: list(agent) };
+    if (unexplained.length > 0)
+        return { class: "unknown", why: list(unexplained) };
+    return { class: "unknown", why: `the check exited ${result.exitCode ?? "nonzero"} with no failing test identified` };
+}
+/** What passed only on a retry inside a passing check (a real-model journey group, a unit file): counted and reported,
+ * never silently part of a pass. Null when there is no valid report to read it from: unknown, never "no retries". */
+export function retriedInside(report) {
+    if (report === null)
+        return null;
+    return [
+        ...report.journeys.flatMap(run => run.groups.filter(group => group.state === "passed" && group.retried).map(group => `${run.script}${run.kind === "real" ? " real-model" : ""} journey group ${group.group}`)),
+        ...(report.units?.files ?? []).filter(file => file.flaky).map(file => `${file.file}`),
+    ];
+}
+/** A run's check, classified from its sealed receipt and sealed report; null when it passed, or can't be read (then
+ * `unreadable` says why — an unreadable receipt is itself unknown). */
+export function classifyRunCheck(store, root, runId) {
+    const gate = verificationEvidence(store, root, runId);
+    if (!gate.ok)
+        return { class: "unknown", why: `the check's receipt can't be read: ${gate.problem}` };
+    if (gate.bytes === null)
+        return { class: "unknown", why: "no machine check is recorded" };
+    let receipt;
+    try {
+        receipt = JSON.parse(gate.bytes.toString());
+    }
+    catch {
+        return { class: "unknown", why: "the check's receipt can't be read" };
+    }
+    if (receipt.result === undefined || typeof receipt.result !== "object")
+        return { class: "unknown", why: "the check's receipt names no result" };
+    const sealed = readSealedJson(store, root, runId, CHECK_REPORT_CAPTURE);
+    const parsed = sealed === null ? null : readCheckReport(sealed.value);
+    return classifyCheckFailure({ result: receipt.result, coverage: receipt.coverage }, parsed?.ok === true ? parsed.value : null);
+}
+/**
+ * What passed only on a retry inside a run's check (eval-harness review 1, finding 3): the summary sealed into its
+ * protected receipt, which a damaged or lost report can't take away; for an older receipt without one, read from the
+ * sealed report. Null — unknown — when neither can be read, or when a readable report disagrees with the receipt.
+ */
+export function retriedOfRun(store, root, runId) {
+    const sealed = readSealedJson(store, root, runId, CHECK_REPORT_CAPTURE);
+    const parsed = sealed === null ? null : readCheckReport(sealed.value);
+    const fromReport = retriedInside(parsed?.ok === true ? parsed.value : null);
+    const gate = verificationEvidence(store, root, runId);
+    if (!gate.ok || gate.bytes === null)
+        return null;
+    let body;
+    try {
+        body = JSON.parse(gate.bytes.toString());
+    }
+    catch {
+        return null;
+    }
+    // The whole check rerun after the approved recovery setup (finding 6): its first attempt failed, and a missing
+    // executable is never confirmed infrastructure, so it counts as a retry like any other — reported, and an automatic
+    // approval refuses it.
+    const replayed = body.result?.setupReplayed === true ? [setupReplayWords(body.result.firstAttempt)] : [];
+    const receipt = body.check?.retried;
+    if (receipt === undefined)
+        return fromReport === null ? null : [...replayed, ...fromReport];
+    if (receipt === null || !Array.isArray(receipt) || receipt.some(one => typeof one !== "string"))
+        return null;
+    if (fromReport !== null && JSON.stringify([...fromReport].sort()) !== JSON.stringify([...receipt].sort()))
+        return null;
+    return [...replayed, ...receipt];
+}
+/** How a check rerun after the approved recovery setup reads among the retries. */
+export const SETUP_REPLAY_RETRY = "the whole check, rerun after the approved setup";
+/**
+ * The rerun's words with its first attempt's own class (eval-harness review 2, finding 5): a launch failure names the
+ * missing program; a receipt that doesn't classify it (an older one) says so, never that it was a launch failure.
+ */
+export function setupReplayWords(first) {
+    const one = first !== null && typeof first === "object" ? first : null;
+    if (one !== null && one.class === "launch" && typeof one.program === "string" && Number.isSafeInteger(one.exitCode)) {
+        return `${SETUP_REPLAY_RETRY} (its first attempt never started: ${one.program.slice(0, 200)} wasn't found, exit ${String(one.exitCode)})`;
+    }
+    return `${SETUP_REPLAY_RETRY} (its first attempt's failure isn't classified)`;
+}
+/** The task's finished builder runs under `digest`, oldest first, each with whether its check passed. */
+function builderRuns(store, taskRef, digest) {
+    return store.handle.prepare(`SELECT r.id, r.outcome, r.scope_digest, r.finished_at, c.status FROM run r LEFT JOIN run_check c ON c.run = r.id
+      WHERE r.task_ref = ? AND r.role = 'builder' AND r.finished_at IS NOT NULL AND r.scope_digest = ? ORDER BY r.id`).all(taskRef, digest)
+        .map(row => ({ id: Number(row["id"]), outcome: row["outcome"] === null ? null : String(row["outcome"]), scopeDigest: String(row["scope_digest"]), finishedAt: String(row["finished_at"]),
+        passed: (row["outcome"] === "built" || row["outcome"] === "no-change") && row["status"] === "passed" }));
+}
+/** The reruns the release asked for on this task (each source run once): run id → its class. */
+function reruns(store, taskId) {
+    const rows = store.handle.prepare("SELECT run_id, outcome FROM action_ledger WHERE task_id = ? AND action = ? AND run_id IS NOT NULL ORDER BY id").all(taskId, RELEASE_RECHECK_ACTION);
+    return new Map(rows.map(row => [Number(row["run_id"]), String(row["outcome"])]));
+}
+/**
+ * Whether a passing check of a release task stands, given every earlier attempt on the same candidate and signed scope:
+ * each earlier failure must be confirmed infrastructure the release itself reran (at most two), and nothing in the
+ * passing run may have passed only on a retry. A deterministic, unknown or agent failure before it isn't erased by a
+ * later pass: a person decides. `retried` is reported even when it stands (a person's approval reads it; an automatic
+ * one refuses on it).
+ */
+export function releaseCheckStanding(store, root, input) {
+    const ref = store.lookupRef(input.taskId);
+    const scope = store.getScope(input.taskId);
+    const run = store.getRun(input.run);
+    if (ref === null || scope === null || run === null || run.taskRef !== ref.id)
+        return { ok: false, why: `run ${input.run} isn't a build of ${input.taskId}`, retried: [] };
+    const retried = retriedOfRun(store, root, input.run);
+    const digest = run.scopeDigest ?? null;
+    if (digest === null)
+        return { ok: false, why: `run ${input.run} recorded no scope`, retried };
+    const asked = reruns(store, input.taskId);
+    const earlier = [];
+    for (const one of builderRuns(store, ref.id, digest)) {
+        if (one.id >= input.run || one.passed)
+            continue;
+        const classified = one.outcome === "built" || one.outcome === "no-change" ? classifyRunCheck(store, root, one.id) : { class: "unknown", why: `its build ended ${one.outcome ?? "without an outcome"}` };
+        if (classified === null)
+            continue;
+        if (classified.class !== "infrastructure")
+            return { ok: false, why: `an earlier check of this commit (run ${one.id}) failed: ${classified.why} (${classWords(classified.class)}). A later pass doesn't erase it, so a person decides`, retried };
+        if (asked.get(one.id) !== "infrastructure")
+            return { ok: false, why: `an earlier check of this commit (run ${one.id}) failed (${classified.why}) and wasn't rerun by the release, so a person decides`, retried };
+        earlier.push({ run: one.id, why: classified.why });
+    }
+    if (earlier.length > INFRA_RERUNS_PER_CANDIDATE)
+        return { ok: false, why: `infrastructure failed ${earlier.length} times on this commit (at most ${INFRA_RERUNS_PER_CANDIDATE} are rerun), so a person decides`, retried };
+    return { ok: true, earlier, retried };
+}
+export const classWords = (kind) => ({
+    deterministic: "a failure in the code or its tests: fix the branch",
+    infrastructure: "confirmed infrastructure",
+    unknown: "unexplained: a person decides",
+    "agent-behaviour": "a real-model journey: counted, never rerun to pass",
+}[kind]);
+/**
+ * After a failed release check: the plane classifies the task's newest attempt from its own records and, only for
+ * confirmed infrastructure within its limits (one rerun per incident, two per candidate), runs the check again on the
+ * same candidate under the same approval (dispose.ts regateTask keeps candidate, scope and approval). Every attempt
+ * stays in the evidence; each rerun is in the ledger with its class. Anything else stops, saying which class and why.
+ */
+export function recheckReleaseTask(store, root, taskId, now) {
+    const ref = store.lookupRef(taskId);
+    const scope = store.getScope(taskId);
+    if (ref === null || scope === null || (scope.releaseTerms ?? null) === null || (scope.candidate ?? null) === null)
+        return { action: "stop", class: null, why: `${taskId} isn't a release task`, source: null };
+    // One transaction: the rerun and its ledger row land together, or neither does.
+    return store.transact(() => recheckInside(store, root, taskId, ref.repo, String(scope.candidate), now));
+}
+function recheckInside(store, root, taskId, repo, candidate, now) {
+    const ref = store.lookupRef(taskId);
+    const last = store.lastBuilderRun(ref.id);
+    if (last === null)
+        return { action: "stop", class: null, why: `${taskId} has no finished attempt`, source: null };
+    const asked = reruns(store, taskId);
+    // Already rerun for this incident: the new attempt is queued or running.
+    if (asked.has(last.id))
+        return { action: "pending", source: last.id };
+    const classified = last.outcome === "built" || last.outcome === "no-change" ? classifyRunCheck(store, root, last.id) : { class: "unknown", why: `its build ended ${last.outcome ?? "without an outcome"}` };
+    if (classified === null)
+        return { action: "stop", class: null, why: `run ${last.id}'s check passed; there is nothing to rerun`, source: last.id };
+    if (classified.class !== "infrastructure")
+        return { action: "stop", class: classified.class, why: classified.why, source: last.id };
+    const digest = last.scopeDigest ?? null;
+    const before = [...asked.entries()].filter(([run, kind]) => kind === "infrastructure" && store.getRun(run)?.scopeDigest === digest).length;
+    if (before >= INFRA_RERUNS_PER_CANDIDATE)
+        return { action: "stop", class: "infrastructure", why: `${classified.why}, and the check was already rerun ${before} times on this commit for infrastructure, so a person decides`, source: last.id };
+    const rerun = regateTask(store, taskId, now, { kind: "release", name: "toolroll release" });
+    if (!rerun.ok)
+        return { action: "stop", class: "infrastructure", why: `${classified.why}, but it can't run again: ${rerun.message}`, source: last.id };
+    store.recordAction({ at: now.toISOString(), actor: "toolroll", repo, taskId, runId: last.id, action: RELEASE_RECHECK_ACTION, outcome: "infrastructure", source: "work",
+        detail: `${classified.why}; rerun ${before + 1} of at most ${INFRA_RERUNS_PER_CANDIDATE} on ${candidate.slice(0, 7)}, under the same approval` });
+    return { action: "rerun", class: "infrastructure", why: classified.why, source: last.id, run: last.id };
+}

package/dist/check-progress.d.ts

@@ -37,7 +37,9 @@ export declare class CheckProgressTracker {
     private readonly events;
     private last;
     private recognized;
-    private parallel;
+    /** Each part's parallel journey run (scripts/e2e-parallel.mjs), by its release-check tag ("" for untagged output):
+     * the scripted flows and app parts run at once, so one shared run would mix their groups. */
+    private readonly parallels;
     constructor(update: (snapshot: CheckProgressSnapshot) => void);
     feed(chunk: string, stream?: "stdout" | "stderr"): void;
     finish(): CheckProgressSnapshot | null;
@@ -49,3 +51,28 @@ export declare class CheckProgressTracker {
     /** The suite is the sum of its groups; its total is known once every group has reported one. */
     private summarize;
 }
+/** How often a running check's display snapshot may be written: the page and the phone read it, nobody needs more. */
+export declare const CHECK_PROGRESS_WRITE_MS = 1000;
+export type ProgressWriter = {
+    /** A display snapshot: written now if the last write is old enough, else kept (the newest wins) for one later write.
+     * Never throws: a display write that fails is kept (a final one until it is saved) for the next write or flush. */
+    push: (snapshot: CheckProgressSnapshot) => void;
+    /** Write a kept snapshot now (the final one again, when its write failed); nothing waits after. Never throws: true
+     * when nothing is left unsaved. */
+    flush: () => boolean;
+};
+/**
+ * Coalesced display writes for a running check (isolated-checks.md, stage 1): a test runner can print thousands of
+ * lines a second, and every changed snapshot was its own write transaction. Display snapshots are now written at most
+ * once per interval, the latest one winning; the final snapshot is written at once, exactly, and nothing older is ever
+ * written after it. A final snapshot whose write fails is kept until a write of it succeeds (the next flush, or a later
+ * final push replacing it): Codex review round 1, finding 6. A failing display store never throws out of the writer,
+ * so it can't keep the check's outcome from being sealed. The check's evidence (its log, exit and report) never passes
+ * through here.
+ */
+export declare function coalescedProgressWriter(save: (snapshot: CheckProgressSnapshot) => void, options?: {
+    intervalMs?: number;
+    now?: () => number;
+    setTimer?: (run: () => void, ms: number) => unknown;
+    clearTimer?: (timer: unknown) => void;
+}): ProgressWriter;

package/dist/check-progress.js

@@ -92,7 +92,9 @@ export class CheckProgressTracker {
     events = new Set();
     last = "";
     recognized = false;
-    parallel = null;
+    /** Each part's parallel journey run (scripts/e2e-parallel.mjs), by its release-check tag ("" for untagged output):
+     * the scripted flows and app parts run at once, so one shared run would mix their groups. */
+    parallels = new Map();
     constructor(update) {
         this.update = update;
     }
@@ -130,14 +132,26 @@ export class CheckProgressTracker {
     emit(final = false, force = false) {
         const snapshot = this.snapshot(final);
         const identity = JSON.stringify(snapshot);
-        if (force || identity !== this.last) {
+        // Live progress is advisory: a snapshot the store would refuse (output read in a way that counted past a total) is
+        // never handed on, so reading output can't break the check that prints it (release check 3264).
+        if ((force || identity !== this.last) && parseCheckProgressSnapshot(identity) !== null) {
             this.last = identity;
             this.update(snapshot);
         }
         return snapshot;
     }
     read(raw) {
-        const line = cleanLine(raw);
+        const cleaned = cleanLine(raw);
+        if (cleaned === "")
+            return;
+        // scripts/release-check.mjs streams each part's lines as they come, tagged `<part> | ` (partTag). The unit part and
+        // the scripted journeys are read as their own output; the other parts (the build, the real-model journeys, the
+        // upgrade path) count toward no suite here.
+        const tagged = /^(typecheck|build|unit|flows|app|flows-real|app-real|upgrade) \| ?(.*)$/.exec(cleaned);
+        if (tagged !== null && !["unit", "flows", "app"].includes(tagged[1]))
+            return;
+        const key = tagged === null ? "" : tagged[1];
+        const line = tagged === null ? cleaned : tagged[2].trim();
         if (line === "")
             return;
         const testFiles = /\bTest Files\b(.+)$/.exec(line);
@@ -153,6 +167,9 @@ export class CheckProgressTracker {
             }
             return;
         }
+        // The unit part speaks only through its Vitest summary; a test's own print is never a journey's.
+        if (key === "unit")
+            return;
         // scripts/e2e-parallel.mjs: "Running 7 groups, at most 4 at once (12.0 GB available, about 400 MB each): console,
         // task, …" (before: "Running 7 groups at once: …"), then every group's lines as "[group] [app] …", then
         // "✅ group  3.1 min" per group and "N of M groups passed …".
@@ -161,10 +178,10 @@ export class CheckProgressTracker {
             const total = safeCount(starting[1]);
             const names = starting[2].split(",").map(one => one.trim()).filter(one => one !== "");
             if (total !== null && names.length === total)
-                this.parallel = { suite: null, total, groups: new Map(names.map(one => [one, emptyGroup()])) };
+                this.parallels.set(key, { suite: null, total, groups: new Map(names.map(one => [one, emptyGroup()])) });
             return;
         }
-        const parallel = this.parallel;
+        const parallel = this.parallels.get(key) ?? null;
         if (parallel !== null) {
             const exited = /^(✅|❌)\s+(\S+)\s+[0-9.]+ min$/.exec(line);
             const group = exited === null ? undefined : parallel.groups.get(exited[2]);
@@ -177,7 +194,7 @@ export class CheckProgressTracker {
             if (summary !== null && parallel.suite !== null && safeCount(summary[2]) === parallel.total) {
                 const passed = safeCount(summary[1]) ?? 0;
                 this.summarize(parallel, passed === parallel.total);
-                this.parallel = null;
+                this.parallels.delete(key);
                 return;
             }
         }
@@ -289,3 +306,85 @@ export class CheckProgressTracker {
     }
 }
 const emptyGroup = () => ({ passed: 0, failed: 0, skipped: 0, total: null, result: null });
+/** How often a running check's display snapshot may be written: the page and the phone read it, nobody needs more. */
+export const CHECK_PROGRESS_WRITE_MS = 1_000;
+/**
+ * Coalesced display writes for a running check (isolated-checks.md, stage 1): a test runner can print thousands of
+ * lines a second, and every changed snapshot was its own write transaction. Display snapshots are now written at most
+ * once per interval, the latest one winning; the final snapshot is written at once, exactly, and nothing older is ever
+ * written after it. A final snapshot whose write fails is kept until a write of it succeeds (the next flush, or a later
+ * final push replacing it): Codex review round 1, finding 6. A failing display store never throws out of the writer,
+ * so it can't keep the check's outcome from being sealed. The check's evidence (its log, exit and report) never passes
+ * through here.
+ */
+export function coalescedProgressWriter(save, options = {}) {
+    const intervalMs = options.intervalMs ?? CHECK_PROGRESS_WRITE_MS;
+    const now = options.now ?? (() => Date.now());
+    const setTimer = options.setTimer ?? ((run, ms) => { const timer = setTimeout(run, ms); timer.unref?.(); return timer; });
+    const clearTimer = options.clearTimer ?? (timer => clearTimeout(timer));
+    let lastWrite = Number.NEGATIVE_INFINITY;
+    let pending = null;
+    let timer = null;
+    // Once a final snapshot arrives nothing older is written; `unsavedFinal` holds it until a write of it succeeds.
+    let finished = false;
+    let unsavedFinal = null;
+    const cancel = () => { if (timer !== null)
+        clearTimer(timer); timer = null; };
+    /** One display write; false when the store refused it (display only: never thrown). */
+    const write = (snapshot) => {
+        lastWrite = now();
+        try {
+            save(snapshot);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const writeFinal = () => {
+        if (unsavedFinal === null)
+            return true;
+        if (write(unsavedFinal))
+            unsavedFinal = null;
+        return unsavedFinal === null;
+    };
+    const later = () => {
+        timer = null;
+        const snapshot = pending;
+        pending = null;
+        // A display write that fails here only leaves the page one snapshot behind; the next one (or the final) follows.
+        if (snapshot !== null && !finished)
+            write(snapshot);
+    };
+    return {
+        push(snapshot) {
+            if (snapshot.final) {
+                finished = true;
+                cancel();
+                pending = null;
+                unsavedFinal = snapshot;
+                writeFinal();
+                return;
+            }
+            if (finished)
+                return;
+            const wait = lastWrite + intervalMs - now();
+            if (wait <= 0 && timer === null) {
+                pending = null;
+                write(snapshot);
+                return;
+            }
+            pending = snapshot;
+            if (timer === null)
+                timer = setTimer(later, Math.max(0, wait));
+        },
+        flush() {
+            cancel();
+            const snapshot = pending;
+            pending = null;
+            if (finished)
+                return writeFinal();
+            return snapshot === null || write(snapshot);
+        },
+    };
+}

package/dist/check-report.d.ts

@@ -1,5 +1,5 @@
 import { type VerifiedEntry } from "./commit-extract.js";
-import { CHECK_PARTS, type CheckContext, type CheckInventory, type CheckReport, type ObligationSnapshot, type TargetedPlan } from "./contracts/release-check.js";
+import { type CheckContext, type CheckPart, type CheckInventory, type CheckReport, type ObligationSnapshot, type SealedInventory, type TargetedPlan } from "./contracts/release-check.js";
 import { type Store, type VerifyCommand } from "./store.js";
 /** The sealed artifacts' capture labels: what a reader looks for, by exact name. */
 export declare const CHECK_REPORT_CAPTURE = "release check report v1";
@@ -46,11 +46,33 @@ export declare function treeFactsOf(gitDir: string, sha: string): {
 /** The execution context a check runs in: what must match for results to stand beside each other. The machine's load
  * budget is left out: it changes how fast a check runs, never what passes (scripts/release-check.mjs checkBudget). */
 export declare function checkContextOf(facts: TreeFacts, command: VerifyCommand, access: string): CheckContext;
-/** The parts a full check selects, as far as the plane knows them before it runs. */
-export declare const FULL_PARTS: readonly (typeof CHECK_PARTS[number])[];
+/** Every part a check can have. */
+export declare const FULL_PARTS: readonly CheckPart[];
+/** Changes no test reads: the plane's copy of scripts/release-check.mjs NOTHING (check-report.test.ts holds them equal). */
+export declare const NOTHING_PATHS: readonly RegExp[];
+/** Model-facing code, whose change runs the real-model journeys: the plane's copy of scripts/release-check.mjs MODEL. */
+export declare const MODEL_PATHS: readonly RegExp[];
+/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade, without its
+ * version-only exception (the plane counts a version bump as a change, so it owes more, never less). */
+export declare function upgradeRelevant(file: string): boolean;
+/** The paths that differ between two verified trees: added, removed, or with another mode or blob. */
+export declare function changedPaths(facts: TreeFacts, base: TreeFacts): string[];
+/**
+ * The parts a Full check owes, decided by the plane before it runs (eval-harness review 1, finding 2), never by the
+ * check's own report: the typecheck and the build always; the unit suite when anything a test reads changed since
+ * `base` (the plane's own record of the last release, both trees verified here) and the tree has unit files; the
+ * scripted journeys likewise when the tree has the journey scripts; the real-model journeys when model-facing code
+ * changed; the upgrade path when a change can affect an upgrade and the tree has it. With no base every one the tree
+ * can run is owed. The check is told these on its handshake and runs at least them.
+ */
+export declare function fullObligationsOf(facts: TreeFacts, base: TreeFacts | null): CheckPart[];
 /** What a check must account for, sealed before it runs: every unit file of the tree, whatever runs (a targeted
- * check accounts for the rest through its base), and the parts it selects. */
-export declare function inventoryOf(facts: TreeFacts, plan: TargetedPlan | null): CheckInventory;
+ * check accounts for the rest through its base), and the parts it owes (a full check's from fullObligationsOf), and
+ * whether CI may stand in for its unit suite. */
+export declare function inventoryOf(facts: TreeFacts, plan: TargetedPlan | null, full?: {
+    owed: readonly CheckPart[];
+    release: boolean;
+}): CheckInventory;
 /** A check about to run: its handshake (written on stdin, then closed) and the facts sealed with it. */
 export type PreparedAttempt = {
     runId: number;
@@ -64,10 +86,15 @@ export type PreparedAttempt = {
     /** The identities the check was asked to report one by one (required ones). */
     watch: string[];
 };
+/** A Full check's preparation refused (eval-harness review 2, finding 4): the plane recorded a release whose commit it
+ * can't verify now, so the check's obligations can't be decided. The check isn't run (builder.ts: `baseline-unverifiable`). */
+export declare class CheckBaselineUnverifiable extends Error {
+}
 /**
  * Seal a check's attempt row before its command is spawned: intended mode, nonce hash, inventory and context (and for a
  * targeted check its plan and obligation snapshot, sealed as artifacts first). Null when the plane can't read the
- * commit, which leaves the check running exactly as it always has, with no handshake.
+ * commit, which leaves the check running exactly as it always has, with no handshake. Throws CheckBaselineUnverifiable,
+ * having sealed nothing, when a recorded last release can't be verified.
  */
 export declare function prepareCheckAttempt(store: Store, root: string, input: {
     runId: number;
@@ -79,6 +106,9 @@ export declare function prepareCheckAttempt(store: Store, root: string, input: {
     plan?: TargetedPlan | null;
     snapshot?: ObligationSnapshot | null;
     watch?: readonly string[];
+    /** A release's check (signed release terms or a release authority): CI never stands in for its unit suite. Sealed in
+     * the inventory (whose digest the attempt row holds); only an explicit false lets CI stand in. */
+    release?: boolean;
 }, now: Date): PreparedAttempt | null;
 /** Seal one JSON payload as a structured-output artifact under its capture label. */
 export declare function sealJson(store: Store, root: string, runId: number, name: string, value: unknown, capture: string, now: Date): number;
@@ -107,3 +137,19 @@ export declare function readSealedJson(store: Store, root: string, runId: number
     value: unknown;
     digest: string;
 } | null;
+/**
+ * Why a Full release check has no result it can count — or null when it qualifies as one. The plane's own facts are the
+ * exit it saw (`exitCode`, null when the check didn't exit on its own: timed out or stopped) and the inventory it sealed
+ * before the check ran; the report must agree with both. A failed check (a nonzero exit) needs only a valid report: what
+ * it failed on is its result. A passing exit needs every obligation the plane sealed (the inventory's parts, never the
+ * report's own "selected") to have an outcome, and every part the report ran too: every part once, each run to its
+ * end; the unit suite finished with a result for every sealed unit file (CI stands in only when the sealed plan allowed
+ * it); every journey run finished, its groups listed before they ran, each passed group with a journey result; and the
+ * upgrade path finished, its versions listed, every one run. An explicitly empty inventory (no groups of that kind) is
+ * an outcome; a missing one is not. Missing, malformed, truncated or skipped-required results never read as a pass.
+ */
+export declare function fullCheckProblem(input: {
+    report: CheckReport | null;
+    inventory: SealedInventory | null;
+    exitCode: number | null;
+}): string | null;