toolroll 0.9.76 → 0.9.78

package/dist/browser-workspace.d.ts

@@ -804,6 +804,8 @@ export type BrowserResultView = {
         efficiency?: import("./run-efficiency.js").RunEfficiency | null;
         /** What its network was and what its proxy saw (egress.ts): display only. */
         network?: import("./egress.js").RunNetworkRecord | null;
+        /** Where the time went: its release check's parts and the task's deploys (latency-timeline.ts), display only. */
+        timing?: import("./latency-timeline.js").TimingView | null;
         /** Words for the result's Accept: Accept and finish when offered, else the Needs you acceptance. */
         decision: BrowserResultDecision | null;
         checks: {

package/dist/builder.d.ts

@@ -34,6 +34,20 @@ export declare function approvedCommandShell(command: string, platform?: NodeJS.
  * must not turn an ordinary product failure into environment recovery.
  */
 export declare function verificationExecutableMissing(result: ExecResult, platform?: NodeJS.Platform): boolean;
+/**
+ * The approved command's own program — its first word — when the plane, looking it up itself before the check starts,
+ * finds no such executable; null when it exists or can't be told (eval-harness review 2, finding 5): a first word with
+ * any quoting, expansion, assignment or redirection, a shell builtin, or Windows (cmd.exe's lookup isn't modelled).
+ * A path is looked up from the checkout; a bare name on `path`'s absolute folders.
+ */
+export declare function approvedProgramMissing(command: string, cwd: string, path: string | undefined, platform?: NodeJS.Platform): string | null;
+/**
+ * Whether a check's first attempt failed at its launch, so the approved recovery setup may run and the check run again
+ * (eval-harness review 1, finding 6; review 2, finding 5). Only a result the plane made without spawning qualifies.
+ * Any shell output, including a perfect "not found" line after a missing-program lookup, remains a check failure.
+ * A later passing check still counts as a retry (check-failure.ts), which an automatic release approval refuses.
+ */
+export declare function launchFailedBeforeCheck(result: ExecResult, nonce: string | null, missing: string | null, platform?: NodeJS.Platform): boolean;
 export type BuildRequest = {
     taskId: string;
     taskRef: number;
@@ -160,10 +174,11 @@ export declare const REPAIR_MAX_TURNS = 4;
 export declare const REPAIR_TIMEOUT_MS: number;
 /**
  * How often a running build says "still here" — extending its lease and its
- * runner's liveness in one beat. A minute against a three-minute liveness
- * window means two beats can be lost to load before anything looks dead.
+ * runner's liveness in one beat. Every 15 s against a one-minute liveness
+ * window (runner.ts) means three beats can be lost to load before anything
+ * looks dead.
  */
-export declare const DEFAULT_PULSE_MS = 60000;
+export declare const DEFAULT_PULSE_MS = 15000;
 /** Branches an unattended agent may never commit to, whatever it was asked. */
 export declare const PROTECTED: Set<string>;
 /**

package/dist/builder.js

@@ -8,14 +8,15 @@ import { queueBatchCheck } from "./batch-checks.js";
 import { batchesFullCheck } from "./batch-policy.js";
 import { skillsContext } from "./project-skills.js";
 import { failedVerificationEvidence, sealVerificationReceipt, verificationEvidence, reuseObservationVerification } from "./verification-evidence.js";
-import { CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, prepareCheckAttempt, sealCheckOutcome } from "./check-report.js";
+import { CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, CheckBaselineUnverifiable, prepareCheckAttempt, reportFromOutput, sealCheckOutcome } from "./check-report.js";
+import { retriedInside } from "./check-failure.js";
 import { planTargetedRecheck, settleCoverage } from "./release-recheck.js";
 import { effectiveCheckFacts } from "./verification-evidence.js";
 import { learningContext } from "./project-learning.js";
 import { knowledgeContext } from "./project-knowledge.js";
 import { flowGoalCuts } from "./flow-engine.js";
 import { readCodingHandoff, verifyCodingHandoffBase } from "./coding-handoff.js";
-import { PREPARED_EVIDENCE_FILE, PREPARED_EVIDENCE_GIT, preparedScreenshotMatches, readPreparedEvidence, writePreparedEvidence } from "./prepared-evidence.js";
+import { PREPARED_EVIDENCE_FILE, preparedEvidenceGit, preparedScreenshotMatches, readPreparedEvidence, writePreparedEvidence } from "./prepared-evidence.js";
 /**
  * The first thing here that runs an agent.
  *
@@ -46,21 +47,22 @@ import { PREPARED_EVIDENCE_FILE, PREPARED_EVIDENCE_GIT, preparedScreenshotMatche
  * watchdog and a high runaway-turn breaker still stop a pathological loop;
  * repair remains narrowly time-bounded because its job is narrowly scoped.
  */
-import { existsSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, constants as fsConstants, existsSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { delimiter, isAbsolute, join, resolve } from "node:path";
 import { run, runClaudeStreamJsonl, runOwnerTag, streamsInput } from "./exec.js";
 import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
 import { launchSandboxOf, protectedChanges, protectedLinks } from "./agent-fence.js";
-import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
+import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, releaseCheckScope, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
 import { currentClaim, heartbeat, SYNC_MAX_AGE_MS, finalize } from "./claim.js";
 import { missingCapability } from "./dispatch.js";
-import { heartbeat as runnerHeartbeat } from "./runner.js";
+import { heartbeat as runnerHeartbeat, RUNNER_HEARTBEAT_MS } from "./runner.js";
+import { keepCheckTimeline } from "./latency-timeline.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { parseDecision, parseHandoff, repairPrompt, HEADLESS_RULE, HANDOFF_CONCLUSION_CAP, HANDOFF_ITEM_CAP, HANDOFF_LIST_CAP, HANDOFF_PAYLOAD_CAP } from "./decision.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -74,7 +76,7 @@ import { closeSteerMailbox, openSteerMailbox, STEER_HANDLED } from "./steer-mail
 import { LiveInput } from "./live-input.js";
 import { LIVE_TICK_MS, tickLiveSteer } from "./steer-live.js";
 import { withRunActivity } from "./task-activity.js";
-import { CheckProgressTracker } from "./check-progress.js";
+import { CheckProgressTracker, coalescedProgressWriter } from "./check-progress.js";
 import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot, handoffName, isImagePath, WORKTREE_EVIDENCE_DIR, storeHandoffArtifact, looksLikeProtocolFile, mailboxName, progressFileName, steerFolderName, statusFileName, proofFileName, rubricFileName, proposalFileName, quarantineMailboxes, readMailbox, readVerifiedArtifact, scanForSecrets, redactSecretLines, storeEvidence, validateScreenshotBytes, imageDimensions, SCREENSHOT_BYTE_CAP, boundStreamHeadTail } from "./evidence.js";
 import { attemptKeyOf, closeRunQuestions, noteOpenTool, recordAgentTurn } from "./agent-board.js";
 import { openStatusFile, pulseAgentBoard, removeStatusFile, statusBrief } from "./agent-pulse.js";
@@ -125,6 +127,57 @@ export function verificationExecutableMissing(result, platform = process.platfor
         return false;
     return /^'[^'\r\n]+' is not recognized as an internal or external command,\s+operable program or batch file\.\s*$/i.test(result.stderr.trim());
 }
+/** Shell words that are never a program on PATH: a command starting with one has no program the plane can look up. */
+const SHELL_WORDS = new Set(["!", ".", ":", "[", "alias", "bg", "break", "case", "cd", "command", "continue", "eval", "exec", "exit", "export", "false", "fg", "for",
+    "function", "getopts", "hash", "if", "jobs", "kill", "local", "pwd", "read", "readonly", "return", "set", "shift", "source", "test", "times", "trap", "true", "type",
+    "ulimit", "umask", "unalias", "unset", "until", "wait", "while", "{", "time", "echo", "printf"]);
+/**
+ * The approved command's own program — its first word — when the plane, looking it up itself before the check starts,
+ * finds no such executable; null when it exists or can't be told (eval-harness review 2, finding 5): a first word with
+ * any quoting, expansion, assignment or redirection, a shell builtin, or Windows (cmd.exe's lookup isn't modelled).
+ * A path is looked up from the checkout; a bare name on `path`'s absolute folders.
+ */
+export function approvedProgramMissing(command, cwd, path, platform = process.platform) {
+    if (platform === "win32")
+        return null;
+    // Only a single plain invocation: shell expansion or another command could execute before a missing first word.
+    if (!/^[ \t]*[A-Za-z0-9._+/@-]+(?:[ \t]+[A-Za-z0-9._+/@,:=%-]+)*[ \t]*$/.test(command))
+        return null;
+    const first = /^\s*([A-Za-z0-9._+/@-]+)(?:\s|$)/.exec(command)?.[1];
+    if (first === undefined || SHELL_WORDS.has(first))
+        return null;
+    const runnable = (file) => { try {
+        accessSync(file, fsConstants.X_OK);
+        return statSync(file).isFile();
+    }
+    catch {
+        return false;
+    } };
+    if (first.includes("/"))
+        return runnable(resolve(cwd, first)) ? null : first;
+    if (path === undefined || path.split(delimiter).some(dir => !isAbsolute(dir)))
+        return null;
+    for (const dir of (path ?? "").split(delimiter))
+        if (isAbsolute(dir) && runnable(join(dir, first)))
+            return null;
+    return first;
+}
+// Only the plane can issue this evidence, and only when it never spawns the command. A lookup followed by a shell
+// launch is racy: the build can install a program between them and forge the shell's entire diagnostic.
+const unstartedChecks = new WeakMap();
+/**
+ * Whether a check's first attempt failed at its launch, so the approved recovery setup may run and the check run again
+ * (eval-harness review 1, finding 6; review 2, finding 5). Only a result the plane made without spawning qualifies.
+ * Any shell output, including a perfect "not found" line after a missing-program lookup, remains a check failure.
+ * A later passing check still counts as a retry (check-failure.ts), which an automatic release approval refuses.
+ */
+export function launchFailedBeforeCheck(result, nonce, missing, platform = process.platform) {
+    if (missing === null || unstartedChecks.get(result) !== missing || platform === "win32" || result.code !== 127 || !verificationExecutableMissing(result, platform))
+        return false;
+    if (result.stdout.trim() !== "" || (nonce !== null && reportFromOutput(result.stdout, nonce).ok))
+        return false;
+    return true;
+}
 /** Long enough for real work; short enough that a stuck build ends the same night. */
 export const DEFAULT_BUILD_TIMEOUT_MS = 30 * 60_000;
 export const DEFAULT_MAX_TURNS = 40;
@@ -139,10 +192,11 @@ export const REPAIR_MAX_TURNS = 4;
 export const REPAIR_TIMEOUT_MS = 5 * 60_000;
 /**
  * How often a running build says "still here" — extending its lease and its
- * runner's liveness in one beat. A minute against a three-minute liveness
- * window means two beats can be lost to load before anything looks dead.
+ * runner's liveness in one beat. Every 15 s against a one-minute liveness
+ * window (runner.ts) means three beats can be lost to load before anything
+ * looks dead.
  */
-export const DEFAULT_PULSE_MS = 60_000;
+export const DEFAULT_PULSE_MS = RUNNER_HEARTBEAT_MS;
 /** Branches an unattended agent may never commit to, whatever it was asked. */
 export const PROTECTED = new Set(["main", "master", "trunk", "develop", "release"]);
 const GIT = "git";
@@ -326,12 +380,13 @@ export function proveApprovedProfile(scope, given) {
                 acceptance: scope.acceptance, candidate: scope.candidate ?? null,
                 qualityMode: scope.qualityMode ?? "default",
                 releaseTerms: scope.releaseTerms ?? null,
+                releaseCheck: scope.releaseCheck ?? null,
             }, snapshot, 
             // v47: the SEALED route is part of the signed bytes whenever it
             // says more than the legacy resolution — re-derived here from
             // the seal's own snapshot, never from mutable configuration.
             routeFromJson(scope.approvedRouteJson ?? null))
-            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, releaseTerms: scope.releaseTerms ?? null });
+            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, releaseTerms: scope.releaseTerms ?? null, releaseCheck: scope.releaseCheck ?? null });
         if (rederived !== scope.approvedDigest) {
             return { ok: false, message: "the approval record does not verify against the stored terms — re-approve (stale-approval)" };
         }
@@ -647,7 +702,7 @@ export async function build(store, request) {
         if (refusal !== null)
             return { ok: false, reason: "no-op", message: refusal };
         // Check the exact candidate before setup or the full gate spends anything.
-        const listed = await git(GIT, [...PREPARED_EVIDENCE_GIT, "ls-tree", "-z", preparedCandidate, "--", PREPARED_EVIDENCE_FILE], { cwd: worktree, maxBuffer: 2048 });
+        const listed = await git(GIT, [...preparedEvidenceGit(), "ls-tree", "-z", preparedCandidate, "--", PREPARED_EVIDENCE_FILE], { cwd: worktree, maxBuffer: 2048 });
         if (listed.code !== 0)
             return { ok: false, reason: "no-op", message: "The committed screenshot inventory could not be inspected. Restore the saved candidate before review." };
         const required = scope?.acceptance.some(criterion => criterion.evidence.includes("screenshot")) ?? false;
@@ -1936,11 +1991,16 @@ export async function settleProviderOutcome(captured, result) {
                 store.setRunPhase(request.runId, "verifying-proof");
                 await settleProof(captured, diffEvidence.statId, head);
             }
-            catch {
+            catch (error) {
                 // Adjudication itself must never fail the attempt — if even the
                 // catch-all inside settleProof somehow throws, the build still
                 // stands; the run simply has no verdict, which every surface
-                // treats the same as "no proof was written".
+                // treats the same as "no proof was written". It is said, though:
+                // release check 3264 ended with no log and no word why.
+                try {
+                    store.addRunNote(request.runId, "Toolroll", `The check's result could not be saved: ${error instanceof Error ? error.message : String(error)}`.slice(0, 500), clock());
+                }
+                catch { /* the missing verdict still says enough */ }
             }
         }
     }
@@ -2226,9 +2286,12 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         const safe = hits.length > 0 ? redactSecretLines(value, hits) : value;
         return boundStreamHeadTail(safe, cap);
     };
-    const attemptOutcome = (label, result) => `${label}: (exit ${result.code}${result.notFound ? " · could not start" : ""}${result.timedOut ? " · timed out" : ""})`;
+    // How the command ended, each fact apart: a signal or the plane's own hard stop is never read as a plain exit
+    // (release check 3261 was recorded as "exit 1" when a signal had ended it).
+    const endedBy = (result, sep) => `${result.signal ? `${sep}ended by ${result.signal}` : ""}${result.stoppedByPlane === true ? `${sep}stopped by Toolroll's own shutdown` : ""}`;
+    const attemptOutcome = (label, result) => `${label}: (exit ${result.code}${result.notFound ? " · could not start" : ""}${result.timedOut ? " · timed out" : ""}${endedBy(result, " · ")})`;
     const attemptLog = (label, command, result) => {
-        const prefix = `=== ${label} ===\n$ ${command}\n(exit ${result.code}${result.notFound ? ", could not start" : ""}${result.timedOut ? ", timed out" : ""})\n\n--- stdout ---\n`;
+        const prefix = `=== ${label} ===\n$ ${command}\n(exit ${result.code}${result.notFound ? ", could not start" : ""}${result.timedOut ? ", timed out" : ""}${endedBy(result, ", ")})\n\n--- stdout ---\n`;
         const between = "\n\n--- stderr ---\n";
         checkLogSourceBodyBytes += Buffer.byteLength(prefix) + Buffer.byteLength(result.stdout) + Buffer.byteLength(between) + Buffer.byteLength(result.stderr);
         return `${prefix}${boundedAttemptStream(result.stdout)}${between}${boundedAttemptStream(result.stderr)}`;
@@ -2303,6 +2366,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     else {
         const verifyRunner = request.verify ?? run;
         const verifyShell = approvedCommandShell(configured.command);
+        let baselineUnverifiable = null;
         // A Full check of a prepared candidate (a release gate, the nightly check): its attempt is sealed before the command
         // runs — intended mode, nonce, inventory, context — and the handshake goes on its stdin (check-report.ts).
         // A release task's check is targeted when the release's last full check allows it (release-recheck.ts): its plan and
@@ -2310,36 +2374,55 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         if (repo !== null && chosenCheck?.level === "full" && (store.getScope(request.taskId)?.candidate ?? null) !== null) {
             const access = checkLaunchOf(store, runId, captured.effective.profile).access;
             const decision = planTargetedRecheck(store, root, { runId, taskId: request.taskId, repo, head: sealedHead, command: configured, access, now: now() });
-            checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority,
-                ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch }, now());
+            // A release's check (signed terms or an open authority): CI never stands in for its unit suite.
+            // A release's check: signed terms, a release check purpose (pipeline-speed.md, P0) or an open authority.
+            const release = decision.authority !== null || releaseCheckScope(store.getScope(request.taskId));
+            try {
+                checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority,
+                    ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch, release }, now());
+            }
+            catch (error) {
+                // A recorded last release that can't be verified (eval-harness review 2, finding 4): nothing runs.
+                if (!(error instanceof CheckBaselineUnverifiable))
+                    throw error;
+                checkAttempt = null;
+                baselineUnverifiable = error.message;
+                recordCheckNote(error.message);
+            }
             if (checkAttempt !== null && decision.mode === "targeted")
                 store.addRunNote(runId, "Toolroll", `Re-running only what failed at run #${decision.plan.base}: ${decision.plan.units.length} unit files, ${decision.plan.groups.reduce((n, one) => n + one.groups.length, 0)} journey groups, ${decision.plan.versions.length} upgrade versions${decision.plan.parts.length > 0 ? `, and in full: ${decision.plan.parts.join(", ")}` : ""}.`, now());
         }
         else
             checkAttempt = null;
-        const checkProgress = new CheckProgressTracker(snapshot => {
-            store.saveCheckProgress(runId, snapshot, now());
-        });
-        const runVerification = async (label) => {
+        // Live progress is advisory (release check 3264 lost its log to one refused snapshot): display snapshots are
+        // coalesced (at most one write a second), the final one is kept until it is written, and a failing save never
+        // throws out of the writer, so the check's log, report and receipt are always sealed.
+        const progressWrites = coalescedProgressWriter(snapshot => { store.saveCheckProgress(runId, snapshot, now()); });
+        const checkProgress = new CheckProgressTracker(snapshot => progressWrites.push(snapshot));
+        const runVerification = async (label, missing = null) => {
             const streamed = { stdout: false, stderr: false };
             // The check runs under the stop watch (v52), owned by this run.
-            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
-                cwd: worktree,
-                timeoutMs: configured.timeoutMs,
-                processGroup: true,
-                owner: runOwnerTag(store, runId),
-                beforeSpawn: () => !stopRequestedFor(store, runId, request.shouldStop),
-                onSpawn: pid => {
-                    request.onProviderSpawn?.(pid);
-                    if (stopRequestedFor(store, runId, request.shouldStop))
-                        throw new Error("the attempt was stopped before spawn custody completed");
-                },
-                envAllowlist: SETUP_ENV_ALLOWLIST,
-                omitEnv: SETUP_ENV_DENYLIST,
-                ...(checkAttempt === null ? {} : { stdin: checkAttempt.stdin }),
-                onStdout: chunk => { streamed.stdout = true; checkProgress.feed(chunk, "stdout"); },
-                onStderr: chunk => { streamed.stderr = true; checkProgress.feed(chunk, "stderr"); },
-            }));
+            const result = missing !== null
+                ? { code: 127, stdout: "", stderr: `Toolroll did not start the check: ${missing} wasn't found.`, timedOut: false, notFound: false }
+                : await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
+                    cwd: worktree,
+                    timeoutMs: configured.timeoutMs,
+                    processGroup: true,
+                    owner: runOwnerTag(store, runId),
+                    beforeSpawn: () => !stopRequestedFor(store, runId, request.shouldStop),
+                    onSpawn: pid => {
+                        request.onProviderSpawn?.(pid);
+                        if (stopRequestedFor(store, runId, request.shouldStop))
+                            throw new Error("the attempt was stopped before spawn custody completed");
+                    },
+                    envAllowlist: SETUP_ENV_ALLOWLIST,
+                    omitEnv: SETUP_ENV_DENYLIST,
+                    ...(checkAttempt === null ? {} : { stdin: checkAttempt.stdin }),
+                    onStdout: chunk => { streamed.stdout = true; checkProgress.feed(chunk, "stdout"); },
+                    onStderr: chunk => { streamed.stderr = true; checkProgress.feed(chunk, "stderr"); },
+                }));
+            if (missing !== null)
+                unstartedChecks.set(result, missing);
             if (!streamed.stdout)
                 checkProgress.feed(result.stdout, "stdout");
             if (!streamed.stderr)
@@ -2388,15 +2471,21 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 return "own-install-failed";
             return await sealedTreeState(buildCheckoutGit(request.git ?? run, worktree)) === "clean" ? null : "setup-changed-files";
         };
-        const ownInstall = await ownInstallIfChanged();
-        const first = ownInstall === null ? await runVerification("Project check · attempt 1") : null;
+        const ownInstall = baselineUnverifiable === null ? await ownInstallIfChanged() : null;
+        // A missing program short-circuits the first launch; never execute build code and then infer that nothing ran.
+        const missingProgram = configured.recoverySetupDigest === null ? null : approvedProgramMissing(configured.command, worktree, process.env["PATH"]);
+        const first = baselineUnverifiable === null && ownInstall === null ? await runVerification("Project check · attempt 1", missingProgram) : null;
         if (first === null) {
-            verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: ownInstall ?? "own-install-failed" };
+            verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: baselineUnverifiable !== null ? "baseline-unverifiable" : ownInstall ?? "own-install-failed" };
         }
         else if (first.notFound || first.timedOut) {
             verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: first.timedOut ? "timed-out" : "spawn-failed" };
         }
-        else if (!verificationExecutableMissing(first)) {
+        else if (first.stoppedByPlane === true) {
+            // This worker's own hard stop ended it (a shutdown): it never finished, and its exit says nothing about the code.
+            verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "stopped-by-toolroll" };
+        }
+        else if (!launchFailedBeforeCheck(first, checkAttempt?.nonce ?? null, missingProgram)) {
             verifyCommand = { configured: true, ran: true, exitCode: first.code };
         }
         else {
@@ -2511,7 +2600,8 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                                     verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "dependency-still-missing" };
                                 }
                                 else {
-                                    verifyCommand = { configured: true, ran: true, exitCode: retried.code, setupReplayed: true };
+                                    // The first attempt, classified on its own: it never started (its program was missing).
+                                    verifyCommand = { configured: true, ran: true, exitCode: retried.code, setupReplayed: true, firstAttempt: { class: "launch", program: missingProgram, exitCode: first.code } };
                                 }
                             }
                         }
@@ -2519,11 +2609,21 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 }
             }
         }
-        checkProgress.finish();
+        // The display's final snapshot (Codex review round 1, finding 6): the writer keeps it until a write succeeds and
+        // never throws; a display failure of any kind never keeps the check's outcome below from being sealed.
+        try {
+            checkProgress.finish();
+        }
+        catch { /* display only */ }
+        if (!progressWrites.flush())
+            progressWrites.flush();
         // The check's own report (the last line carrying the nonce), sealed beside what was sealed before it ran.
         const last = verification.last;
+        let sealedReport = null;
         if (checkAttempt !== null && last !== null && !last.notFound) {
-            sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
+            sealedReport = sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
+            // Where the check's time went (latency-timeline.ts): each part's start and end, display only.
+            keepCheckTimeline(store, { runId, taskId: request.taskId, report: sealedReport, stdout: last.stdout, now: now() });
         }
         // What the check covered (receipt version 3): full, composed from the release's last full check, partial, or
         // identity-removed (which stops the release carrying).
@@ -2532,10 +2632,15 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             const sha = (capture) => { const found = store.artifactsFor(runId).filter(a => a.kind === "structured-output" && a.capture === capture); return found.length === 1 ? found[0].sha256 : null; };
             // The one place coverage meets the outcome: a partial or identity-removed check is a failed attempt for every
             // reader from here on (the verdict, the run's check, the receipt, reuse, the deploy gates).
-            const effective = effectiveCheckFacts(verifyCommand, { coverage: settled.coverage, check: { attempt: checkAttempt.mode, report: sha(CHECK_REPORT_CAPTURE), inventory: sha(CHECK_INVENTORY_CAPTURE) }, composed: settled.composed });
+            const effective = effectiveCheckFacts(verifyCommand, { coverage: settled.coverage, check: { attempt: checkAttempt.mode, report: sha(CHECK_REPORT_CAPTURE), inventory: sha(CHECK_INVENTORY_CAPTURE), retried: retriedInside(sealedReport) }, composed: settled.composed });
             verifyCommand = effective.result;
             releaseFacts = effective.facts;
         }
+        else if (verifyCommand.configured && verifyCommand.ran && chosenCheck?.level === "full" && releaseCheckScope(store.getScope(request.taskId))) {
+            // A release's Full check that couldn't be sealed before it ran (no nonce, no inventory) has no result it can count.
+            verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "no-result" };
+            recordCheckNote("The release check ran without a sealed attempt (its commit couldn't be read before it ran), so it has no result that can count.");
+        }
     }
     if (configured !== null && checkLog.length > 0) {
         const summary = `=== Attempt summary ===\n${checkOutcomes.length === 0 ? "No command started." : checkOutcomes.map(one => `- ${one}`).join("\n")}`;

package/dist/chat-decide.js

@@ -30,6 +30,7 @@ import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
 import { APPROVAL_PROOF, approvalOf, approvalProofDetail, deployGateScope, quarantinedAuthor } from "./scope.js";
 import { releaseCardOf } from "./release-card.js";
+import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { phoneText } from "./telegram-status.js";
 /** The words, said once. */
 export const DECIDE_LABELS = {
@@ -662,6 +663,9 @@ export function applyDecideTap(store, seat, input) {
         }
         case "approve": {
             if (row.digest.startsWith(RELEASE_DIGEST)) {
+                const ciHold = releaseCiHoldOf(store, row.taskId);
+                if (ciHold !== null)
+                    return notDone(releaseCiHoldWords(ciHold));
                 const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
                 if (!release.ok)
                     return notDone(release.why);

package/dist/check-failure.d.ts

@@ -0,0 +1,92 @@
+import { type CheckReport } from "./contracts/release-check.js";
+import { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT, type FailureClassName } from "./release.js";
+import type { Store } from "./store.js";
+export type FailureClass = FailureClassName;
+export type ClassifiedFailure = {
+    class: FailureClass;
+    why: string;
+};
+/** The plane's limits for confirmed infrastructure failures (one rerun per incident, two per candidate). */
+export { INFRA_RERUNS_PER_CANDIDATE, INFRA_RERUNS_PER_INCIDENT };
+/** The ledger action that records each rerun the release asked for, and why. */
+export declare const RELEASE_RECHECK_ACTION = "release check rerun";
+/** What a sealed verification receipt says about the check (receipt.result, and its coverage). */
+export type CheckFacts = {
+    result: {
+        configured: boolean;
+        ran?: boolean;
+        exitCode?: number;
+        attemptFailed?: boolean;
+        failure?: string;
+    };
+    coverage?: string | undefined;
+};
+/**
+ * One failed check, classified. `facts` come from the plane's sealed receipt; `report` (the check's own report, sealed
+ * when valid) only ever picks among the classes that block. Null when the check passed.
+ */
+export declare function classifyCheckFailure(facts: CheckFacts, report: CheckReport | null): ClassifiedFailure | null;
+/** What passed only on a retry inside a passing check (a real-model journey group, a unit file): counted and reported,
+ * never silently part of a pass. Null when there is no valid report to read it from: unknown, never "no retries". */
+export declare function retriedInside(report: CheckReport | null): string[] | null;
+/** A run's check, classified from its sealed receipt and sealed report; null when it passed, or can't be read (then
+ * `unreadable` says why — an unreadable receipt is itself unknown). */
+export declare function classifyRunCheck(store: Store, root: string, runId: number): ClassifiedFailure | null;
+/**
+ * What passed only on a retry inside a run's check (eval-harness review 1, finding 3): the summary sealed into its
+ * protected receipt, which a damaged or lost report can't take away; for an older receipt without one, read from the
+ * sealed report. Null — unknown — when neither can be read, or when a readable report disagrees with the receipt.
+ */
+export declare function retriedOfRun(store: Store, root: string, runId: number): string[] | null;
+/** How a check rerun after the approved recovery setup reads among the retries. */
+export declare const SETUP_REPLAY_RETRY = "the whole check, rerun after the approved setup";
+/**
+ * The rerun's words with its first attempt's own class (eval-harness review 2, finding 5): a launch failure names the
+ * missing program; a receipt that doesn't classify it (an older one) says so, never that it was a launch failure.
+ */
+export declare function setupReplayWords(first: unknown): string;
+/**
+ * Whether a passing check of a release task stands, given every earlier attempt on the same candidate and signed scope:
+ * each earlier failure must be confirmed infrastructure the release itself reran (at most two), and nothing in the
+ * passing run may have passed only on a retry. A deterministic, unknown or agent failure before it isn't erased by a
+ * later pass: a person decides. `retried` is reported even when it stands (a person's approval reads it; an automatic
+ * one refuses on it).
+ */
+export declare function releaseCheckStanding(store: Store, root: string, input: {
+    taskId: string;
+    run: number;
+}): {
+    ok: true;
+    earlier: {
+        run: number;
+        why: string;
+    }[];
+    retried: string[] | null;
+} | {
+    ok: false;
+    why: string;
+    retried: string[] | null;
+};
+export declare const classWords: (kind: FailureClass) => string;
+export type RecheckAnswer = {
+    action: "rerun";
+    class: "infrastructure";
+    why: string;
+    source: number;
+    run: number;
+} | {
+    action: "pending";
+    source: number;
+} | {
+    action: "stop";
+    class: FailureClass | null;
+    why: string;
+    source: number | null;
+};
+/**
+ * After a failed release check: the plane classifies the task's newest attempt from its own records and, only for
+ * confirmed infrastructure within its limits (one rerun per incident, two per candidate), runs the check again on the
+ * same candidate under the same approval (dispose.ts regateTask keeps candidate, scope and approval). Every attempt
+ * stays in the evidence; each rerun is in the ledger with its class. Anything else stops, saying which class and why.
+ */
+export declare function recheckReleaseTask(store: Store, root: string, taskId: string, now: Date): RecheckAnswer;