toolroll 0.9.76 → 0.9.78

package/dist/release-auto.d.ts

@@ -19,6 +19,10 @@ export type ObservedCheckRun = {
     suite?: number | null;
     head?: string | null;
     workflow?: number | null;
+    /** The workflow's file (GitHub's workflow-run `path`): a required check counts only from ci.yml. */
+    workflowPath?: string | null;
+    /** GitHub's job record shows this unsuccessful attempt ended before any workflow step ran (release-adapters.ts). */
+    beforeTests?: boolean | null;
 };
 /** The plane's own look at GitHub CI for one commit (release-adapters.ts makes it, right before the seal). */
 export type CiObservation = {
@@ -68,15 +72,15 @@ export declare function authorizeAutoCheck(store: Store, input: {
  * person. Null when the path may ship.
  */
 export declare function autoPathProblem(path: string): string | null;
-/** Flakes: how many failed attempts one CI job, and how many unsuccessful release-check runs, may have before a person
- * decides. The head and digest are pinned, so between attempts only nondeterminism differs. */
-export declare const MAX_FAILED_ATTEMPTS = 2;
-/** One CI attempt that failed before its job's latest attempt passed, as the evidence records it. */
+/** One CI attempt that failed before its job's latest attempt passed (GitHub showed its runner failing before the
+ * tests ran), as the evidence records it. */
 export type CiFailure = CheckFailure;
 /**
  * GitHub CI on the exact head, as the plane read it (every attempt): fresh, every run GitHub Actions, and the same
  * verdict every later release boundary uses (release.ts prChecksVerdict: exact head, each job by its latest attempt,
- * every required check present), with the flake cap. The tolerated failures are returned for the evidence.
+ * every required check present), where an earlier failure stands only as confirmed infrastructure (GitHub's job record
+ * shows it ended before any workflow step ran), at most INFRA_RERUNS_PER_CANDIDATE of them. The tolerated failures are
+ * returned for the evidence.
  */
 export declare function ciVerdict(observation: CiObservation, candidate: string, now: Date): {
     ok: true;
@@ -101,6 +105,8 @@ export declare function sealAutoGreen(store: Store, input: {
     ci: CiObservation;
     evidenceRoot: string;
     now: Date;
+    /** Whether main's protection holds for the account that merges (release-adapters.ts readMainProtection), as the plane's gh read it just now (null: unreadable). */
+    mainUpToDate: boolean | null;
 }): {
     ok: true;
     by: string;
@@ -117,8 +123,8 @@ export declare function giveUpAutoApproval(store: Store, input: {
     why: string;
     now: Date;
 }): void;
-/** A release check failed while checking automatically: tell the owner. The `auto-check` stays, so a regate of the same
- * commit and digest (a flake) may still approve itself, within MAX_FAILED_ATTEMPTS failed runs. */
+/** A release check failed while checking automatically: tell the owner. The `auto-check` stays: a rerun the release
+ * itself made after confirmed infrastructure may still approve itself; any other failure means a person decides. */
 export declare function noteAutoCheckFailed(store: Store, input: {
     taskId: string;
     why: string;
@@ -151,3 +157,28 @@ export declare function allowAutoPublish(store: Store, input: {
 }): {
     ok: true;
 } | Refusal;
+/**
+ * A release filed while its pull request's CI still ran (pipeline-speed.md D2): hold every approval but the automatic
+ * road's until the plane reads exact-head CI passing (Codex review round 1, finding 4). Recorded before the task is
+ * filed, so no moment exists where the filed task is approvable with CI pending. Idempotent.
+ */
+export declare function holdApprovalForCi(store: Store, input: {
+    taskId: string;
+    candidate: string;
+    now: Date;
+}): void;
+/**
+ * Lift a release's CI hold (an older coordinator's) or end its "CI still running" note on the plane's own reading of
+ * GitHub CI (never the coordinator's word): fresh, whole, every run GitHub Actions, on exactly the held candidate, and
+ * every required check passed (release.ts prChecksVerdict, as a person's road judges it: a person decides about earlier
+ * attempts). With `ask`, the owner of a held release is told it needs them now. Nothing held or noted is a pass.
+ */
+export declare function liftCiHold(store: Store, input: {
+    taskId: string;
+    candidate: string;
+    ci: CiObservation;
+    ask: boolean;
+    now: Date;
+}): {
+    ok: true;
+} | Refusal;

package/dist/release-auto.js

@@ -13,16 +13,19 @@
  * adapter. Any refusal unseals `auto-check`, so the task asks a person, its passing check kept.
  */
 import { assignmentOf } from "./assignment.js";
-import { projectGitDir } from "./check-report.js";
+import { fullCheckProblem, projectGitDir } from "./check-report.js";
+import { sealedRun } from "./release-recheck.js";
 import { runCheckLevel } from "./check-levels.js";
 import { readVerifiedCommit, verifiedBlobs, verifiedTreeDiff, verifiedTreeEntries } from "./commit-extract.js";
 import { mightName, testInfrastructure } from "./test-infra.js";
 import { chatControlHref } from "./chat-controls.js";
-import { AUTO_FLAKE_CAP, REQUIRED_PR_CHECKS, prChecksVerdict } from "./release.js";
+import { INFRA_RERUNS_PER_CANDIDATE, REQUIRED_PR_CHECKS, REQUIRED_PR_CHECKS_WORKFLOW, prChecksVerdict } from "./release.js";
+import { releaseCheckStanding } from "./check-failure.js";
 import { CARRY_RULES, rulePath } from "./release-carry.js";
 import { AUTO_EVIDENCE_ACTION, AUTO_WITHDRAWN_ACTION, LIVE_RELEASE_STATES, RELEASE_APPROVAL_ACTION, releaseAuthorityOfTask, releaseAutoApproves, releaseApprovalSetting } from "./release-authority.js";
 import { autoReleaseApprovalOf, personApprovalOf } from "./scope.js";
 import { releaseOperations, revokeRelease } from "./store.js";
+import { RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION, RELEASE_CI_RUNNING_WORDS, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { verificationEvidence } from "./verification-evidence.js";
 export { RELEASE_APPROVAL_ACTION, releaseApprovalSetting, releaseAutoApproves };
 /** The setting's words, one place. */
@@ -212,13 +215,12 @@ export function autoPathProblem(path) {
         return null;
     return "it's outside what a release approves itself for (product code, tests, docs, the changelog and a version bump)";
 }
-/** Flakes: how many failed attempts one CI job, and how many unsuccessful release-check runs, may have before a person
- * decides. The head and digest are pinned, so between attempts only nondeterminism differs. */
-export const MAX_FAILED_ATTEMPTS = AUTO_FLAKE_CAP;
 /**
  * GitHub CI on the exact head, as the plane read it (every attempt): fresh, every run GitHub Actions, and the same
  * verdict every later release boundary uses (release.ts prChecksVerdict: exact head, each job by its latest attempt,
- * every required check present), with the flake cap. The tolerated failures are returned for the evidence.
+ * every required check present), where an earlier failure stands only as confirmed infrastructure (GitHub's job record
+ * shows it ended before any workflow step ran), at most INFRA_RERUNS_PER_CANDIDATE of them. The tolerated failures are
+ * returned for the evidence.
  */
 export function ciVerdict(observation, candidate, now) {
     const no = (problem) => ({ ok: false, problem });
@@ -232,7 +234,7 @@ export function ciVerdict(observation, candidate, now) {
     const other = observation.runs.find(run => run.app !== "github-actions");
     if (other !== undefined)
         return no(`${other.name} was reported by ${other.app ?? "an unknown app"}, not GitHub Actions`);
-    const verdict = prChecksVerdict(observation.runs, candidate, REQUIRED_PR_CHECKS, { cap: MAX_FAILED_ATTEMPTS });
+    const verdict = prChecksVerdict(observation.runs, candidate, REQUIRED_PR_CHECKS, { auto: true, workflow: REQUIRED_PR_CHECKS_WORKFLOW });
     if (verdict.state === "failed")
         return no(verdict.failed.join(", "));
     if (verdict.state === "pending")
@@ -317,6 +319,19 @@ function changeProblem(repo, base, candidate) {
         // Taking a test away is never automatic, wherever it lives.
         if (change.kind === "deleted" && TEST_FILE.test(rulePath(change.path)))
             return `${change.path} was deleted (removing a test needs a person)`;
+        if (change.before !== null && TEST_FILE.test(rulePath(change.path))) {
+            // Counts cannot prove that an assertion survived: replacing it, commenting it out, or skipping its case can
+            // leave the counts unchanged. Only append-only additions preserve the existing code without interpretation.
+            // Both copies come from verified trees; no report or candidate-provided file list decides this permission.
+            const was = verifiedBlobs(gitDir, before.value.tree, [change.path]);
+            const now = verifiedBlobs(gitDir, after.value.tree, [change.path]);
+            if (!was.ok || !now.ok)
+                return `${change.path}'s existing test code couldn't be read (a person decides)`;
+            const original = was.value.get(change.path)?.bytes, revised = now.value.get(change.path)?.bytes;
+            if (original === undefined || revised === undefined || !revised.subarray(0, original.length).equals(original)) {
+                return `${change.path} changes existing test code (removing or rewriting tests needs a person)`;
+            }
+        }
         const why = autoPathProblem(change.path);
         if (why !== null)
             return `${change.path} changed (${why})`;
@@ -348,6 +363,12 @@ export function sealAutoGreen(store, input) {
         const facts = releaseTaskFacts(store, input);
         if (!facts.ok)
             return facts;
+        // Head-only CI is the merged tree only when GitHub itself refuses a branch behind main (eval-harness review 1,
+        // finding 4): without that setting nothing approves itself.
+        if (input.mainUpToDate !== true)
+            return refuse(input.mainUpToDate === null
+                ? "GitHub's branch protection for main couldn't be read, so whether it refuses a branch behind main is unknown"
+                : "main's branch protection doesn't hold for the account that merges: it must require branches to be up to date, require the release's checks, and allow no bypass (\"Do not allow bypassing the above settings\")");
         const checking = autoReleaseApprovalOf(store, input.taskId, "auto-check");
         if (!checking.ok)
             return refuse(`its check wasn't authorized automatically: ${checking.why}`);
@@ -362,15 +383,26 @@ export function sealAutoGreen(store, input) {
             return refuse(`run ${input.run} recorded no commit`);
         if (runCheckLevel(store, run.id) !== "full")
             return refuse("the release check wasn't Full");
-        // A flake: earlier builds of this task may have failed — every one that didn't finish built with a passed check
-        // counts (a failed check, a check that never ran, a build that failed or was interrupted) — but only re-runs of the
-        // same signed scope (the regate road keeps the candidate and digest), and at most MAX_FAILED_ATTEMPTS of them.
+        // Earlier builds of this task that didn't finish built with a passed check (a failed check, a check that never ran,
+        // a build that failed or was interrupted) stand only as confirmed infrastructure the release itself reran on the
+        // same signed scope, at most INFRA_RERUNS_PER_CANDIDATE (check-failure.ts): a failing test, an unexplained failure
+        // or a real-model journey before the pass means a person decides. So does anything that passed only on a retry.
         const failedRuns = store.handle.prepare(`SELECT r.id, r.scope_digest FROM run r LEFT JOIN run_check c ON c.run = r.id
         WHERE r.task_ref = ? AND r.role = 'builder' AND r.id <> ?
           AND NOT (COALESCE(r.outcome, '') IN ('built', 'no-change') AND COALESCE(c.status, '') = 'passed') ORDER BY r.id`).all(facts.taskRef, run.id);
         if (failedRuns.some(one => one["scope_digest"] !== input.digest))
             return refuse("an earlier check of this release ran on different scope text, so a person decides");
-        if (failedRuns.length > MAX_FAILED_ATTEMPTS)
+        if (failedRuns.some(one => Number(one["id"]) > run.id))
+            return refuse(`run ${input.run} isn't this task's newest build`);
+        const standing = releaseCheckStanding(store, input.evidenceRoot, { taskId: input.taskId, run: run.id });
+        if (!standing.ok)
+            return refuse(standing.why);
+        // Unknown is never "no retries" (eval-harness review 1, finding 3).
+        if (standing.retried === null)
+            return refuse("the release check's retry record can't be read (its report or receipt is missing or damaged), so whether anything passed only on a retry is unknown and a person decides");
+        if (standing.retried.length > 0)
+            return refuse(`the release check passed only on a retry (${standing.retried.slice(0, 3).join(", ")}${standing.retried.length > 3 ? ", …" : ""}), so a person decides`);
+        if (failedRuns.length > INFRA_RERUNS_PER_CANDIDATE)
             return refuse(`the release check failed ${failedRuns.length} times before it passed, so a person decides`);
         const checkFailures = failedRuns.map(one => Number(one["id"]));
         const newest = store.runsFor(facts.taskRef).find(one => one.role === "builder");
@@ -391,6 +423,22 @@ export function sealAutoGreen(store, input) {
         const command = gate["command"];
         if (gate["coverage"] !== undefined && gate["coverage"] !== "full")
             return refuse(`the release check didn't cover everything (${String(gate["coverage"])})`);
+        // A readable, valid report and inventory of a Full attempt, the receipt's own, every obligation accounted for, and
+        // the retry summary sealed in the receipt: an automatic approval never stands on evidence it can't read.
+        const check = gate["check"];
+        const sealed = sealedRun(store, input.evidenceRoot, run.id);
+        if (check === undefined || sealed === null || sealed.attempt.mode !== "full" || check.attempt !== "full" || sealed.report === null || sealed.inventory === null || sealed.reportDigest !== check.report) {
+            return refuse("the release check's sealed report or inventory can't be read, so what it ran and retried is unknown");
+        }
+        const incomplete = fullCheckProblem({ report: sealed.report, inventory: sealed.inventory, exitCode: typeof result?.exitCode === "number" ? result.exitCode : null });
+        if (incomplete !== null)
+            return refuse(`the release check has no complete result: ${incomplete}`);
+        if (!Array.isArray(check.retried))
+            return refuse("the release check's receipt has no sealed retry record, so a person decides");
+        // Belt to the retry record (finding 6): a check that passed only on a rerun after the recovery setup never approves
+        // itself — its first failure isn't confirmed infrastructure.
+        if (result?.setupReplayed === true)
+            return refuse("the release check passed only when it was run again after the approved setup, so a person decides");
         if (gate["run"] !== run.id || gate["head"] !== head || gate["scopeDigest"] !== input.digest || result?.ran !== true || result.exitCode !== 0 || live === null || command?.command !== live.command) {
             return refuse("the release check didn't pass this candidate under the approved command");
         }
@@ -442,14 +490,25 @@ export function giveUpAutoApproval(store, input) {
         unseal(store, input.taskId, input.now);
         const scope = store.getScope(input.taskId);
         const version = scope?.releaseTerms?.packageVersion ?? null;
+        // Still waiting for CI (round 1, finding 4): nobody is asked to approve yet; `liftCiHold` asks once CI passed.
+        const ciHold = releaseCiHoldOf(store, input.taskId);
+        if (ciHold !== null) {
+            store.enqueueNotification({ dedupeKey: `release-auto-stopped:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto",
+                subject: `Release${version === null ? "" : ` ${version}`} won't approve itself`,
+                body: `Not approved automatically: ${input.why}. GitHub CI is still running on ${ciHold.candidate?.slice(0, 7) ?? "its commit"}; you're asked to approve it once CI passes.`,
+                link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
+            return;
+        }
+        // Filed while CI runs (Alex, 2026-10-29): a person may approve now; nothing deploys until CI passes.
+        const running = releaseCiRunningOf(store, input.taskId) === null ? "" : ` ${RELEASE_CI_RUNNING_WORDS}`;
         store.enqueueNotification({ dedupeKey: `release-auto-stopped:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto", pushClass: "attention",
             subject: `Release${version === null ? "" : ` ${version}`} needs you`,
-            body: `Not approved automatically: ${input.why}. Approve it yourself, or fix the branch and release the new commit.`,
+            body: `Not approved automatically: ${input.why}. Approve it yourself, or fix the branch and release the new commit.${running}`,
             link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
     });
 }
-/** A release check failed while checking automatically: tell the owner. The `auto-check` stays, so a regate of the same
- * commit and digest (a flake) may still approve itself, within MAX_FAILED_ATTEMPTS failed runs. */
+/** A release check failed while checking automatically: tell the owner. The `auto-check` stays: a rerun the release
+ * itself made after confirmed infrastructure may still approve itself; any other failure means a person decides. */
 export function noteAutoCheckFailed(store, input) {
     const ref = store.lookupRef(input.taskId);
     if (ref === null)
@@ -457,7 +516,7 @@ export function noteAutoCheckFailed(store, input) {
     const version = store.getScope(input.taskId)?.releaseTerms?.packageVersion ?? null;
     store.enqueueNotification({ dedupeKey: `release-auto-check-failed:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto", pushClass: "attention",
         subject: `Release${version === null ? "" : ` ${version}`} check failed`,
-        body: `${input.why}. Rerun it on the same commit (a flake still approves itself, up to ${MAX_FAILED_ATTEMPTS} failed checks), or fix the branch and release the new commit.`,
+        body: `${input.why}. Only a failure Toolroll confirmed as its own infrastructure is checked again automatically; for anything else, approve it yourself or fix the branch and release the new commit.`,
         link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
 }
 /** "Released 0.9.x automatically": the release that approved itself finished. */
@@ -494,3 +553,60 @@ export function allowAutoPublish(store, input) {
         action: PUBLISH_ALLOWED_ACTION, outcome: "allowed", source: "request", detail: `${input.by} lets the release's tag, publication and Homebrew go on` });
     return { ok: true };
 }
+/**
+ * A release filed while its pull request's CI still ran (pipeline-speed.md D2): hold every approval but the automatic
+ * road's until the plane reads exact-head CI passing (Codex review round 1, finding 4). Recorded before the task is
+ * filed, so no moment exists where the filed task is approvable with CI pending. Idempotent.
+ */
+export function holdApprovalForCi(store, input) {
+    if (!/^[0-9a-f]{40}$/.test(input.candidate))
+        throw new Error("a CI hold needs the exact candidate commit");
+    const held = releaseCiHoldOf(store, input.taskId);
+    if (held !== null && held.candidate === input.candidate)
+        return;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: store.lookupRef(input.taskId)?.repo ?? null, taskId: input.taskId, runId: null,
+        action: RELEASE_CI_HELD_ACTION, outcome: "held", source: "work", detail: input.candidate });
+}
+/**
+ * Lift a release's CI hold (an older coordinator's) or end its "CI still running" note on the plane's own reading of
+ * GitHub CI (never the coordinator's word): fresh, whole, every run GitHub Actions, on exactly the held candidate, and
+ * every required check passed (release.ts prChecksVerdict, as a person's road judges it: a person decides about earlier
+ * attempts). With `ask`, the owner of a held release is told it needs them now. Nothing held or noted is a pass.
+ */
+export function liftCiHold(store, input) {
+    return store.transact(() => {
+        const held = releaseCiHoldOf(store, input.taskId);
+        const waiting = held ?? releaseCiRunningOf(store, input.taskId);
+        if (waiting === null)
+            return { ok: true };
+        if (waiting.candidate !== input.candidate)
+            return refuse(`the release waits for CI on ${waiting.candidate?.slice(0, 7) ?? "an unreadable commit"}, not ${input.candidate.slice(0, 7)}`);
+        const ci = input.ci;
+        if (ci.head !== input.candidate)
+            return refuse(`CI was read for ${ci.head.slice(0, 7)}, not ${input.candidate.slice(0, 7)}`);
+        const at = Date.parse(ci.observedAt);
+        if (!Number.isFinite(at) || at > input.now.getTime() + 60_000 || input.now.getTime() - at > CI_OBSERVATION_MS)
+            return refuse("the CI reading isn't fresh");
+        if (ci.complete !== true)
+            return refuse("GitHub's check history of this commit can't be read whole");
+        const other = ci.runs.find(run => run.app !== "github-actions");
+        if (other !== undefined)
+            return refuse(`${other.name} was reported by ${other.app ?? "an unknown app"}, not GitHub Actions`);
+        const verdict = prChecksVerdict(ci.runs, input.candidate, REQUIRED_PR_CHECKS, { workflow: REQUIRED_PR_CHECKS_WORKFLOW });
+        if (verdict.state === "failed")
+            return refuse(`CI failed: ${verdict.failed.join(", ")}`);
+        if (verdict.state === "pending")
+            return refuse(`CI hasn't finished: ${verdict.waiting.join(", ")}`);
+        const ref = store.lookupRef(input.taskId);
+        store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: ref?.repo ?? null, taskId: input.taskId, runId: null,
+            action: RELEASE_CI_PASSED_ACTION, outcome: "passed", source: "work", detail: input.candidate });
+        if (input.ask && held !== null && ref !== null) {
+            const version = store.getScope(input.taskId)?.releaseTerms?.packageVersion ?? null;
+            store.enqueueNotification({ dedupeKey: `release-ci-passed:${input.taskId}:${input.candidate}`, kind: "release-auto", pushClass: "attention",
+                subject: `Release${version === null ? "" : ` ${version}`} needs you`,
+                body: `GitHub CI passed on ${input.candidate.slice(0, 7)}. Approve it yourself, or fix the branch and release the new commit.`,
+                link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
+        }
+        return { ok: true };
+    });
+}

package/dist/release-card.d.ts

@@ -46,10 +46,22 @@ export type ChangeList = {
     }[] | null;
     source: "recorded" | "pull-request" | "unread";
     digest: string;
+    /** A release is on the record but its merge commit can't be read (eval-harness review 2, finding 4). */
+    baselineUnreadable?: true;
+};
+/**
+ * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
+ * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
+ * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
+ * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
+ */
+export declare function releaseBaselineRecord(store: Store, repo: string): {
+    recorded: false;
+} | {
+    recorded: true;
+    sha: string | null;
 };
-/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
-export declare function releaseBaseline(store: Store, repo: string): string | null;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own

package/dist/release-card.js

@@ -25,6 +25,7 @@ import { verifiedRange } from "./commit-extract.js";
 import { releaseTermsSchema } from "./contracts/release-terms.js";
 import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
+import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -152,13 +153,21 @@ export function approvalTermsOf(store, scope, words) {
 export const termsText = (lines) => lines.map(line => `${line.label}: ${line.value}`).join("\n");
 const SHA = /^[0-9a-f]{40}$/;
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
-/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
-export function releaseBaseline(store, repo) {
-    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a JOIN release_operation o ON o.authority = a.id
-    WHERE a.repo = ? AND a.state = 'merged' AND o.kind = 'merge' AND o.state = 'succeeded' AND o.external_ref IS NOT NULL ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
-    const ref = row === undefined ? null : String(row["external_ref"]);
-    return ref !== null && SHA.test(ref) ? ref : null;
+/**
+ * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
+ * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
+ * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
+ * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
+ */
+export function releaseBaselineRecord(store, repo) {
+    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a LEFT JOIN release_operation o
+    ON o.authority = a.id AND o.kind = 'merge' AND o.state = 'succeeded'
+    WHERE a.repo = ? AND a.state = 'merged' ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    if (row === undefined)
+        return { recorded: false };
+    const ref = row["external_ref"];
+    return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
 }
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
@@ -198,7 +207,12 @@ function pullRequestCommits(slug, pr) {
 }
 /** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
 export function releaseChangeList(store, terms) {
-    const baseline = releaseBaseline(store, terms.repo);
+    const record = releaseBaselineRecord(store, terms.repo);
+    // A release recorded with a merge commit that can't be read: the list couldn't be read (eval-harness review 2,
+    // finding 4) — never the pull request's commits, as if there were no previous release.
+    if (record.recorded && record.sha === null)
+        return { baseline: null, commits: null, source: "unread", baselineUnreadable: true, digest: sha256(`release-changes:${JSON.stringify({ baseline: null, source: "unread", commits: null, recorded: true })}`) };
+    const baseline = record.recorded ? record.sha : null;
     let commits;
     let source;
     if (baseline !== null) {
@@ -221,7 +235,7 @@ function changeWords(changes, terms, cap) {
     const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
         : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
     if (changes.commits === null)
-        return [head, changes.baseline === null ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+        return [head, changes.baseline === null && changes.baselineUnreadable !== true ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
     if (changes.commits.length === 0)
         return [head, "No commits."];
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
@@ -242,6 +256,8 @@ export function releaseCardOf(store, scope, formDigest, words) {
         terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
+        // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.
+        ...(releaseCiRunningOf(store, scope.taskId) === null ? [] : [RELEASE_CI_RUNNING_WORDS]),
         "",
         ...changeWords(changes, terms, 5),
         "",

package/dist/release-carry.d.ts

@@ -1,5 +1,5 @@
 import { type TreeChange, type VerifiedCommit } from "./commit-extract.js";
-import { type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms.js";
+import { type ReleaseCheckPurpose, type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms.js";
 import { type ExecResult } from "./exec.js";
 import { type ReleaseAuthority, type ReleaseCarry, type Store } from "./store.js";
 /** The journey scripts: tests, by Alex's decision (they carry). */
@@ -66,6 +66,26 @@ export declare function releaseTermsFor(store: Store, input: {
     ok: false;
     why: string;
 };
+/**
+ * A release check's purpose (docs/plans/pipeline-speed.md, P0), for a release whose terms can't be made (its checks run
+ * outside the sandbox, or carrying is off): from the plane's own records — the project's repository, the approved commit
+ * and its verified tree, the live release check grant and the check access. It never carries a later commit; it marks
+ * this exact candidate as a release's check (strict report rules, no CI stand-in, the plane's own rerun after confirmed
+ * infrastructure on the same candidate under the same approval). Null with why when even that can't be read.
+ */
+export declare function releaseCheckPurposeFor(store: Store, input: {
+    repo: string;
+    version: string;
+    branch: string;
+    pr: number;
+    candidate: string;
+}): {
+    ok: true;
+    purpose: ReleaseCheckPurpose;
+} | {
+    ok: false;
+    why: string;
+};
 /** One carried commit, as the summary and the merge message list it. */
 export type LandedCommit = {
     sha: string;

package/dist/release-carry.js

@@ -165,6 +165,28 @@ export function releaseTermsFor(store, input) {
             expiresAt: new Date(input.now.getTime() + 3 * 24 * 60 * 60_000).toISOString(),
         } };
 }
+/**
+ * A release check's purpose (docs/plans/pipeline-speed.md, P0), for a release whose terms can't be made (its checks run
+ * outside the sandbox, or carrying is off): from the plane's own records — the project's repository, the approved commit
+ * and its verified tree, the live release check grant and the check access. It never carries a later commit; it marks
+ * this exact candidate as a release's check (strict report rules, no CI stand-in, the plane's own rerun after confirmed
+ * infrastructure on the same candidate under the same approval). Null with why when even that can't be read.
+ */
+export function releaseCheckPurposeFor(store, input) {
+    const gitDir = projectGitDir(input.repo);
+    if (gitDir === null)
+        return { ok: false, why: "the project's Git directory can't be read" };
+    const commit = readVerifiedCommit(gitDir, input.candidate);
+    if (!commit.ok)
+        return { ok: false, why: commit.message };
+    const grant = store.liveVerifyCommand(input.repo);
+    if (grant === null)
+        return { ok: false, why: "the project has no approved release check" };
+    return { ok: true, purpose: {
+            version: 1, purpose: "release-check", repo: input.repo, packageVersion: input.version, branch: input.branch, pr: input.pr, base: "main",
+            approvedSha: input.candidate, approvedTree: commit.value.tree, grant: { id: grant.id, digest: grant.digest }, access: store.projectCheckAccess(input.repo),
+        } };
+}
 /**
  * Step 2, read-only: nothing from the candidate is installed, built or run here. Objects come from the project's own
  * Git directory as Toolroll records it, hashed here; the authority is read live.

package/dist/release-ci-hold.d.ts

@@ -0,0 +1,41 @@
+/** A release's approval held for its pull request's CI (Codex review round 1, finding 4). A leaf module: the seal
+ * primitive (store.ts), the person's ceremony (scope.ts), chat and release-auto.ts all read the same row. */
+import type { Store } from "./store.js";
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export declare const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export declare const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export declare function releaseCiHoldOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export declare function releaseCiHoldWords(hold: {
+    candidate: string | null;
+}): string;
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export declare const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export declare const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export declare function releaseCiRunningOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export declare function noteCiRunning(store: Store, input: {
+    taskId: string;
+    candidate: string;
+    now: Date;
+}): void;

package/dist/release-ci-hold.js

@@ -0,0 +1,53 @@
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export function releaseCiHoldOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_HELD_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export function releaseCiHoldWords(hold) {
+    const commit = hold.candidate === null ? "this release's commit" : hold.candidate.slice(0, 7);
+    return `GitHub CI is still running on ${commit}. This release can be approved once every pull request check passes; \`toolroll release\` asks you then.`;
+}
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export function releaseCiRunningOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_RUNNING_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_RUNNING_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export function noteCiRunning(store, input) {
+    if (!/^[0-9a-f]{40}$/.test(input.candidate))
+        throw new Error("a CI note needs the exact candidate commit");
+    const running = releaseCiRunningOf(store, input.taskId);
+    if (running !== null && running.candidate === input.candidate)
+        return;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: store.lookupRef(input.taskId)?.repo ?? null, taskId: input.taskId, runId: null,
+        action: RELEASE_CI_RUNNING_ACTION, outcome: "running", source: "work", detail: input.candidate });
+}

package/dist/release-cli.d.ts

@@ -7,6 +7,7 @@
  */
 import { type ReleaseAdapters } from "./release.js";
 import { type GateReleaseWorld } from "./release-gate.js";
+import { type RescueWorld } from "./deploy-rescue.js";
 export declare const RELEASE_HELP: string;
 /** A runner lease id (claim.ts mints randomUUID()). */
 export declare const LEASE_SHAPED: RegExp;
@@ -20,6 +21,8 @@ export type ReleaseCliDeps = {
     warn?: (line: string) => void;
     /** What --release-gate reads and changes (release-gate.ts); the installation's own by default. */
     gateWorld?: GateReleaseWorld;
+    /** What --recover-deploy reads and runs (deploy-rescue.ts); the installation's own by default. */
+    rescueWorld?: RescueWorld;
     /** The plane's database for the authority commands (default: this installation's). */
     database?: string;
     now?: () => Date;