toolroll 0.9.76 → 0.9.78

package/dist/controller-supervisor.js

@@ -56,13 +56,23 @@ export async function superviseController(args) {
             if (args.signal.aborted)
                 break;
             const exited = await new Promise(done => {
+                const output = args.label === undefined ? "inherit" : "pipe";
                 const owned = spawn(args.file, [...args.argv], {
                     ...(args.cwd === undefined ? {} : { cwd: args.cwd }),
                     ...(args.env === undefined ? {} : { env: args.env }),
-                    stdio: "inherit",
+                    stdio: args.ipc === true ? ["ignore", output, output, "ipc"] : args.label === undefined ? "inherit" : ["ignore", "pipe", "pipe"],
                     windowsHide: true,
                 });
                 child = owned;
+                if (args.label !== undefined)
+                    for (const stream of [owned.stdout, owned.stderr])
+                        labelLines(stream, args.label);
+                try {
+                    args.onSpawn?.(owned, generation);
+                }
+                catch {
+                    process.stderr.write("Controller supervisor could not attach to its controller.\n");
+                }
                 owned.once("spawn", () => {
                     emit({ phase: "running", generation, controllerPid: owned.pid ?? null });
                     if (args.signal.aborted)
@@ -102,3 +112,25 @@ export async function superviseController(args) {
         emit({ phase: "stopped", generation, controllerPid: null });
     }
 }
+/** Each whole line of a controller's output, prefixed with its label, on this process's stderr. */
+function labelLines(stream, label) {
+    if (stream === null)
+        return;
+    const prefix = label === "" ? "" : `${label} `;
+    let pending = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+        const lines = (pending + chunk).split("\n");
+        pending = lines.pop() ?? "";
+        // Bounded: a controller that never ends a line still reaches the log.
+        if (pending.length > 64 * 1024) {
+            lines.push(pending);
+            pending = "";
+        }
+        for (const line of lines)
+            process.stderr.write(`${prefix}${line}\n`);
+    });
+    stream.on("end", () => { if (pending !== "")
+        process.stderr.write(`${prefix}${pending}\n`); pending = ""; });
+    stream.on("error", () => { });
+}

package/dist/demo.js

@@ -989,11 +989,12 @@ export function makeDemoRepos(root) {
             writeFileSync(join(dir, file), content);
         }
         try {
-            execFileSync("git", ["init", "-q", "-b", "main"], { cwd: dir, stdio: "ignore" });
-            execFileSync("git", ["add", "-A"], { cwd: dir, stdio: "ignore" });
+            execFileSync("git", ["init", "-q", "-b", "main"], { cwd: dir, stdio: "ignore", timeout: 30_000 });
+            execFileSync("git", ["add", "-A"], { cwd: dir, stdio: "ignore", timeout: 30_000 });
             execFileSync("git", ["-c", "user.email=demo@localhost", "-c", "user.name=demo", "commit", "-q", "-m", "seed"], {
                 cwd: dir,
                 stdio: "ignore",
+                timeout: 30_000,
             });
         }
         catch {

package/dist/deploy-gate.js

@@ -8,6 +8,7 @@
 import { assignmentOf } from "./assignment.js";
 import { liveReleaseOf, personApprovalOf, releaseApprovalOf } from "./scope.js";
 import { verificationEvidence } from "./verification-evidence.js";
+import { releaseCiRunningOf } from "./release-ci-hold.js";
 /** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
 export function deploymentGate(store, input) {
     const refuse = (message) => ({ ok: false, message });
@@ -27,6 +28,10 @@ export function deploymentGate(store, input) {
         return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
     if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)
         return refuse("The run's signed scope is no longer the approved one.");
+    // A person may approve during CI, including a release without carry terms. Every deployment road must wait
+    // for the plane's exact-head observation, not only the release coordinator's polling loop.
+    if (releaseCiRunningOf(store, ref.externalId) !== null)
+        return refuse("This release still waits for GitHub CI. Resume it with `toolroll release`.");
     // One approval per release (release-once.md): a release's task deploys only while its authority stands for it — the
     // live predicate proves the anchor's person approval (a carried commit's own seal is never a person's). Any other task
     // needs a person's approval of its own.

package/dist/deploy-rescue.d.ts

@@ -0,0 +1,41 @@
+/** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
+export declare const FORWARD_ONLY: readonly string[];
+export type RescueWorld = {
+    /** The live database. */
+    database: string;
+    /** The installation's state folder: deployments stage under staged-upgrades/ there. */
+    stateDir: string;
+    /** Every deployment journal under staged-upgrades/: its stage and contents, null when unreadable. */
+    journals(): {
+        stage: string;
+        journal: Record<string, unknown> | null;
+    }[];
+    /** The builder run's worktree, from the plane's records (the deploy script's --source), or null. */
+    runWorktree(run: number): string | null;
+    /** The deployment's own recovery for that stage (release-adapters.ts recoverDeploy). */
+    recover(input: {
+        run: number;
+        worktree: string;
+        stage: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        message: string;
+    }>;
+};
+export type RescueOutcome = {
+    ok: true;
+    acted: boolean;
+    stage: string | null;
+    phase: string | null;
+    words: string[];
+} | {
+    ok: false;
+    reason: "usage" | "conflict" | "damaged" | "forward" | "failed";
+    message: string;
+};
+/** What recovery will do from a phase, in a few words. */
+export declare function rescuePlan(phase: string, journal: Record<string, unknown>): string[];
+/** Find the one unfinished deployment (or the named stage), verify its journal, and recover it (with `yes`). */
+export declare function rescueDeployment(stageArg: string | undefined, yes: boolean, world: RescueWorld): Promise<RescueOutcome>;

package/dist/deploy-rescue.js

@@ -0,0 +1,94 @@
+/**
+ * `toolroll release --recover-deploy [--stage <dir>] [--yes]`: one command for a browser deployment that stopped half
+ * way and could not put itself back (the 2026-10-29 deploy stuck at "stopping": an `up` left running under launchd
+ * that ignored SIGTERM, a restart refused while its stale heartbeat lapsed, and every resume refusing "not proved
+ * stopped"). It does what was done by hand, through the deployment's own recovery (scripts/deploy-browser.mjs
+ * --phase recover, run from the recorded commit's pristine extraction exactly as `toolroll release` resumes one):
+ *
+ *   - the journal is verified (one unfinished deployment of this database, its run recorded) under the deployment lock
+ *   - when the journal says the old service must be stopped, recovery requires proof it already exited; historical
+ *     PIDs and argv never authorize signals or booting out a currently loaded service. Remaining processes must be
+ *     stopped through their owner before recovery can resume.
+ *   - the previous service is started again (the verified backup first when the database was migrated past it) and
+ *     waited for past a stale worker heartbeat's window, then the deployment's update pause is lifted
+ *
+ * A journal at or past the new service's start is never touched here: the new service may be running, and the
+ * release resumes it forward. Finished journals need nothing. Run again after a refusal or a failure: every step
+ * re-proves itself, so a rerun does only what is still left.
+ */
+import { realpathSync } from "node:fs";
+import { join } from "node:path";
+import { BEFORE_SWAP } from "./release-gate.js";
+/** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
+export const FORWARD_ONLY = Object.freeze(["starting", "started", "healthy"]);
+const FINISHED = Object.freeze(["released", "deployed"]);
+const real = (path) => { try {
+    return realpathSync(path);
+}
+catch {
+    return path;
+} };
+/** What recovery will do from a phase, in a few words. */
+export function rescuePlan(phase, journal) {
+    const id = String(journal["id"] ?? "?"), prior = String(journal["priorRuntime"] ?? "?");
+    if (BEFORE_SWAP.includes(phase))
+        return [`The service was never stopped. Lifts update pause ${id}, if this deployment holds it.`];
+    if (phase === "restored")
+        return [`The previous service is already running again. Lifts update pause ${id}.`];
+    const words = [];
+    if (phase === "stopping") {
+        words.push("The old service must already be stopped. Recovery checks for remaining processes and refuses while any may still be running. Stop them through the service owner, then rerun recovery.");
+    }
+    if (["stopping", "stopped", "migrating", "migrated", "start-failed", "backup-restored"].includes(phase)) {
+        if (["migrating", "migrated", "start-failed"].includes(phase))
+            words.push("Puts the verified backup back first when the previous runtime can't read the migrated database.");
+        words.push(`Starts the previous service (${prior}) again and waits for it to answer, past a stopped worker's heartbeat window; then lifts update pause ${id}.`);
+    }
+    return words.length > 0 ? words : [`Journal phase ${phase}: the deployment's own recovery decides; it refuses anything it can't prove.`];
+}
+/** Find the one unfinished deployment (or the named stage), verify its journal, and recover it (with `yes`). */
+export async function rescueDeployment(stageArg, yes, world) {
+    const all = world.journals();
+    let chosen;
+    if (stageArg !== undefined) {
+        chosen = all.find(one => real(one.stage) === real(stageArg));
+        if (chosen === undefined)
+            return { ok: false, reason: "usage", message: `${stageArg} is not a deployment stage of this installation (under ${join(world.stateDir, "staged-upgrades")}).` };
+    }
+    else {
+        const open = all.filter(one => one.journal === null || !FINISHED.includes(String(one.journal["phase"])));
+        if (open.length === 0)
+            return { ok: true, acted: false, stage: null, phase: null, words: ["Nothing to recover: every deployment finished or was already put back."] };
+        if (open.length > 1)
+            return { ok: false, reason: "conflict", message: `${open.length} deployments are unfinished: ${open.map(one => one.stage).join(", ")}. Name one with --stage <dir>.` };
+        chosen = open[0];
+    }
+    const { stage, journal } = chosen;
+    if (journal === null)
+        return { ok: false, reason: "damaged", message: `${join(stage, "deployment.json")} can't be read; nothing was changed.` };
+    const phase = journal["phase"], run = journal["builder"];
+    if (typeof phase !== "string" || typeof journal["priorRuntime"] !== "string" || typeof journal["nextRuntime"] !== "string" || typeof journal["id"] !== "string") {
+        return { ok: false, reason: "damaged", message: `${join(stage, "deployment.json")} is missing its phase, runtimes or update id; nothing was changed.` };
+    }
+    if (journal["database"] !== world.database)
+        return { ok: false, reason: "conflict", message: `That deployment ran on ${String(journal["database"])}, not ${world.database}; nothing was changed.` };
+    if (!Number.isSafeInteger(run) || run < 1)
+        return { ok: false, reason: "damaged", message: `${join(stage, "deployment.json")} names no builder run, so its commit's recovery can't be found; nothing was changed.` };
+    if (FINISHED.includes(phase))
+        return { ok: true, acted: false, stage, phase, words: [`Nothing to recover: that deployment is ${phase}.`] };
+    if (FORWARD_ONLY.includes(phase)) {
+        return { ok: false, reason: "forward", message: `That deployment is at ${phase}: the new service may be running, so nothing was stopped. Continue it forward with \`toolroll release <branch>\` (it resumes the deployment's finish).` };
+    }
+    const plan = rescuePlan(phase, journal);
+    if (!yes)
+        return { ok: true, acted: false, stage, phase, words: [`Deployment ${String(journal["id"])} stopped at ${phase} (${stage}).`, ...plan, "Run it: toolroll release --recover-deploy --yes"] };
+    const worktree = world.runWorktree(run);
+    if (worktree === null)
+        return { ok: false, reason: "damaged", message: `Run ${String(run)} has no recorded worktree, so its commit's recovery can't run; nothing was changed.` };
+    const recovered = await world.recover({ run: run, worktree, stage });
+    const after = world.journals().find(one => one.stage === stage)?.journal ?? null;
+    const now = typeof after?.["phase"] === "string" ? after["phase"] : null;
+    if (!recovered.ok)
+        return { ok: false, reason: "failed", message: `${recovered.message}${now === null ? "" : ` The journal is at ${now}.`} Fix what it names, then run \`toolroll release --recover-deploy --yes\` again.` };
+    return { ok: true, acted: true, stage, phase: now, words: [now === "released" ? "The previous service is running and new work can start again." : `The deployment's recovery finished; its journal is at ${now ?? "an unreadable phase"}.`] };
+}

package/dist/desktop-update.d.ts

@@ -97,6 +97,7 @@ export declare function sqliteLock(file: string, busyTimeoutMs?: number): Databa
 export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -110,7 +111,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/dispose.d.ts

@@ -132,6 +132,9 @@ export declare function regateTask(store: Store, taskId: string, now: Date, appr
     kind: "mode";
     name: string;
     modeDigest: string;
+} | {
+    kind: "release";
+    name: string;
 }): {
     ok: true;
     run: number;

package/dist/dispose.js

@@ -23,7 +23,7 @@ import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
-import { propose, approve, liveReleaseOf } from "./scope.js";
+import { propose, approve, liveReleaseOf, releaseCheckScope } from "./scope.js";
 import { headWithin } from "./names.js";
 /** The reasons tick classifies as the attempt itself breaking. */
 const TICK_FAILURE_REASONS = new Set([
@@ -455,12 +455,16 @@ export function regateTask(store, taskId, now, approval) {
     if (scope === null)
         return { ok: false, reason: "no-attempt", message: `${taskId} has no scope` };
     const head = last.headRevision;
-    const actor = approval.kind === "operator" ? approval.name : `mode ${approval.name}`;
+    const actor = approval.kind === "operator" ? approval.name : approval.kind === "release" ? approval.name : `mode ${approval.name}`;
+    // A release task: signed terms or a release check purpose (pipeline-speed.md, P0), each sealed with the approval.
+    if (approval.kind === "release" && ((scope.candidate ?? null) === null || !releaseCheckScope(scope))) {
+        return { ok: false, reason: "not-approved", message: `${taskId} isn't a release candidate; only a release reruns under its own approval` };
+    }
     // A prepared candidate (a release gate, the nightly check) already names the approved commit, and the builder loads
     // exactly its tree on every attempt. The rerun keeps that scope and its approval as they are: nothing is proposed or
     // sealed again, so a regate can never swap the approved commit, its release terms or the person's yes for others
     // (2026-10-27: a regate rewrote release-0.9.73's candidate to its own build commit and the release refused it).
-    if ((scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null) {
+    if ((scope.candidate ?? null) !== null || releaseCheckScope(scope)) {
         const candidate = scope.candidate ?? null;
         if (candidate === null || scope.approvedDigest !== scope.digest || last.scopeDigest !== scope.digest) {
             return { ok: false, reason: "not-approved", message: `${taskId}'s approved commit or scope changed since attempt #${last.id}, or its approval no longer stands; approve its scope again instead` };
@@ -481,7 +485,7 @@ export function regateTask(store, taskId, now, approval) {
                     return { ok: false, reason: why[queued.reason] ?? "not-rejected", message: `${taskId} could not be queued again: ${queued.reason}` };
                 }
             }
-            store.addRunNote(last.id, "Toolroll", `The check will run again on the approved commit ${candidate.slice(0, 7)}, under the same approval, as a new attempt, ${approval.kind === "operator" ? `on ${approval.name}'s say-so` : "automatically once, because the failure was outside this change"}.`, now);
+            store.addRunNote(last.id, "Toolroll", `The check will run again on the approved commit ${candidate.slice(0, 7)}, under the same approval, as a new attempt, ${approval.kind === "operator" ? `on ${approval.name}'s say-so` : approval.kind === "release" ? "because Toolroll confirmed the failure was its own infrastructure, not the code" : "automatically once, because the failure was outside this change"}.`, now);
             return { ok: true, run: last.id, head: candidate };
         });
     }
@@ -494,7 +498,7 @@ export function regateTask(store, taskId, now, approval) {
         let sealed = false;
         if (approval.kind === "operator")
             sealed = approve(store, taskId, approval.name, now, proposed.digest, approval.token).ok;
-        else
+        else if (approval.kind === "mode")
             sealed = store.sealScopeApproval(taskId, actor, now, {}, { kind: "mode", modeDigest: approval.modeDigest });
         if (!sealed)
             return { ok: false, reason: "not-approved", message: `${taskId}'s rerun scope could not be approved` };

package/dist/doctor.d.ts

@@ -24,6 +24,11 @@ export type DoctorReport = {
         version: string;
         problem: string | null;
     };
+    /** The installed git against Toolroll's floor (git-floor.ts): null when it is new enough (or unreadable). */
+    git?: {
+        floor: string;
+        problem: string | null;
+    };
 };
 export type DoctorDeps = {
     platform?: NodeJS.Platform;
@@ -35,6 +40,8 @@ export type DoctorDeps = {
     procRoot?: string;
     /** The doctor's own environment: the terminal a `toolroll up` would start from. */
     env?: NodeJS.ProcessEnv;
+    /** The installed git's floor problem (a test's stand-in for git-floor.ts installedGitFloorProblem). */
+    gitFloorProblem?: string | null;
 };
 /** The names among `pairs` that hold a credential: a provider key, a credential-looking name, or a key-shaped value.
  * Values are only tested here and never leave. */

package/dist/doctor.js

@@ -21,6 +21,7 @@ import { join } from "node:path";
 import { daemonStatus, installedServiceDefinition, planDaemon } from "./daemon.js";
 import { scanForSecrets } from "./evidence.js";
 import { envelopeJson } from "./envelope.js";
+import { GIT_FLOOR_WORDS, installedGitFloorProblem } from "./git-floor.js";
 import { run as runCommand } from "./exec.js";
 import { OWN_KEY_ENV } from "./keys.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
@@ -123,7 +124,8 @@ function reinstallCommand(args) {
         const flag = equal < 0 ? arg : arg.slice(0, equal);
         const value = equal < 0 ? args[index + 1] : arg.slice(equal + 1);
         const known = freeform.has(flag) || numeric.has(flag) || Object.hasOwn(enums, flag);
-        if (equal < 0 && (known || CREDENTIAL_FLAG.test(flag)) && value !== undefined && !value.startsWith("-"))
+        // A credential's value is the next argument even when it starts with "-" (random base64url can).
+        if (equal < 0 && value !== undefined && (CREDENTIAL_FLAG.test(flag) || (known && !value.startsWith("-"))))
             index += 1;
         if (flag === "--token") {
             kept.push("--token-file", "<set-again>");
@@ -386,7 +388,9 @@ export async function auditServiceEnvironment(deps = {}) {
 /** The report as the owner reads it: one state, then each finding with its steps; detail after. */
 export function doctorLines(report) {
     const lines = [];
-    if (report.ok)
+    if (report.git?.problem != null)
+        lines.push(`Git: ${report.git.problem}`, "");
+    if (report.findings.length === 0 && report.unreadable.length === 0)
         lines.push("No secrets found in Toolroll's service. A build can't read a key from it.");
     else if (report.findings.length > 0)
         lines.push(`Toolroll's service holds ${report.findings.length === 1 ? "a secret" : "secrets"} a build could read. Nothing was changed; follow these steps.`);
@@ -422,6 +426,10 @@ export async function runDoctorCommand(argv, write, deps = {}) {
     }
     const report = await auditServiceEnvironment(deps);
     report.sandbox = { engine: SANDBOX_RUNTIME.name, version: SANDBOX_RUNTIME.version, problem: sandboxRuntimeProblem() };
+    // A git older than the floor: named here too, and the console and worker won't start on it.
+    report.git = { floor: GIT_FLOOR_WORDS, problem: deps.gitFloorProblem === undefined ? installedGitFloorProblem() : deps.gitFloorProblem };
+    if (report.git.problem !== null)
+        report.ok = false;
     if (json)
         write(envelopeJson({ command: "doctor", ...report }));
     else

package/dist/envelope.js

@@ -74,7 +74,8 @@ export const DOCUMENTED_REASONS = [
     "drift", //             the branch, pull request or result moved from the gated commit
     "check-failed", //      the release check failed; it stays visible and nothing reruns it
     "ci-failed", //         a required pull-request check failed or is missing — nothing merged
-    "base-moved", //        main gained a commit the release branch lacks — nothing merged
+    "git-too-old", //       the installed git is older than Toolroll's floor (git-floor.ts) — serve, watch and up don't start
+    "base-moved", //        the release branch lacks main's head — nothing filed (gate) or merged
     "tree-mismatch", //     main's merge commit has a different tree than the gated commit — nothing tagged
     "conflict", //          a task or tag exists for a different commit
     "mixed-runtime", //     the console, worker and CLI names don't run one build

package/dist/evidence.d.ts

@@ -73,6 +73,15 @@ export declare function isBinaryAssetPath(path: string): boolean;
 export declare const SHORTENED_MARKER = "\n\u2026 output shortened; ending follows \u2026\n";
 export declare function boundStreamHeadTail(value: string, cap: number, headShare?: number): string;
 export declare const EVIDENCE_CAPS: Record<Artifact["kind"], number>;
+/**
+ * The bound a writer may seal a kind at with storeEvidence's `cap`, above its default: a release check's sealed report and
+ * inventory (check-report.ts CHECK_ARTIFACT_CAP, 256 KiB). Readers accept exactly what writers may seal: 0.9.77 sealed
+ * reports up to 256 KiB but read structured output back only to 64 KiB, so every full report over that (~85 KiB for a
+ * 585-file suite) read as "no longer verifies" and the release's check as unavailable.
+ */
+export declare const SEALED_EVIDENCE_CAPS: Partial<Record<Artifact["kind"], number>>;
+/** The most a stored artifact of this kind may hold: its default cap, or the larger bound a sealed payload may use. */
+export declare function evidenceReadCap(kind: Artifact["kind"]): number;
 export declare function evidenceRoot(home: string): string;
 /**
  * Unpredictable per attempt, so nothing on disk before this build can already

package/dist/evidence.js

@@ -23,6 +23,7 @@ import { parseReport, REPORT_LIMITS } from "./scout-report.js";
 import { parseProof, PROOF_LIMITS } from "./proof.js";
 import { HANDOFF_VERSION, readHandoffArtifact } from "./contracts/handoff.js";
 import { encodeBaseTreeSnapshot, parseBaseTreeSnapshot } from "./peek.js";
+import { noLazyFetch } from "./teardown-git.js";
 /** The park mailbox pattern. Each run's actual name carries a nonce; see `mailboxName`. */
 export const MAILBOX_PREFIX = "STANDING-ORDERS-PARK-";
 /** The terminal handoff: how every non-parking attempt says how it ended. */
@@ -115,6 +116,17 @@ export const EVIDENCE_CAPS = {
     // to hold the JSON-escaped form of that bounded content plus provenance.
     "review-context": 200 * 1024 * 1024,
 };
+/**
+ * The bound a writer may seal a kind at with storeEvidence's `cap`, above its default: a release check's sealed report and
+ * inventory (check-report.ts CHECK_ARTIFACT_CAP, 256 KiB). Readers accept exactly what writers may seal: 0.9.77 sealed
+ * reports up to 256 KiB but read structured output back only to 64 KiB, so every full report over that (~85 KiB for a
+ * 585-file suite) read as "no longer verifies" and the release's check as unavailable.
+ */
+export const SEALED_EVIDENCE_CAPS = { "structured-output": 256 * 1024 };
+/** The most a stored artifact of this kind may hold: its default cap, or the larger bound a sealed payload may use. */
+export function evidenceReadCap(kind) {
+    return Math.max(EVIDENCE_CAPS[kind], SEALED_EVIDENCE_CAPS[kind] ?? 0);
+}
 export function evidenceRoot(home) {
     // Same continuity rule as the database: evidence recorded under an older
     // name keeps verifying until a new-name root exists.
@@ -397,8 +409,9 @@ export function imageDimensions(bytes, kind) {
  * store the caller passed — inside whatever transaction the caller holds.
  */
 export function storeEvidence(store, root, runId, kind, name, content, capture, now, options = {}) {
-    // `cap`: a sealed structured payload with its own documented bound (a release check's report: 256 KiB), never above 1 MiB.
-    const cap = options.cap === undefined ? EVIDENCE_CAPS[kind] : Math.min(options.cap, 1024 * 1024);
+    // `cap`: a sealed structured payload with its own documented bound (a release check's report: 256 KiB), never above what
+    // a reader of this kind accepts (evidenceReadCap): a record written larger would never verify again.
+    const cap = options.cap === undefined ? EVIDENCE_CAPS[kind] : Math.min(options.cap, evidenceReadCap(kind));
     const stored = content.subarray(0, cap);
     // Some callers that deliberately summarize/bound a source before storage
     // may still report its true original size. This keeps `truncated` honest
@@ -468,7 +481,7 @@ function withArtifactFile(root, artifact, use) {
             !/[\u0000-\u001f\u007f:]/.test(segment));
     if (!wellFormed)
         return { ok: false, problem: "the key is not a normalized relative path" };
-    const cap = EVIDENCE_CAPS[artifact.kind];
+    const cap = evidenceReadCap(artifact.kind);
     if (artifact.bytesStored > cap) {
         return { ok: false, problem: "the record claims more bytes than its kind may store" };
     }
@@ -929,7 +942,9 @@ export async function captureBaseTree(store, git, repoRoot, repo, base, root, ru
     }
 }
 async function captureBaseTreeInner(store, git, repoRoot, repo, base, root, runId, now) {
-    const args = ["--no-lazy-fetch", "--no-replace-objects", "--no-optional-locks", "ls-tree", "-r", "-l", "-z", base];
+    const args = [...noLazyFetch(), "-c", "protocol.allow=never", "--no-replace-objects", "--no-optional-locks", "ls-tree", "-r", "-l", "-z", base];
+    // `git` is the builder's hardened checkout git (a frozen view): on a git without --no-lazy-fetch it refuses a partial
+    // clone from the same config it runs with (teardown-git.ts lazyFetchSetting).
     const listed = await git("git", args, { cwd: repoRoot, envAllowlist: ["PATH", "HOME"] });
     const command = `git ls-tree -r -l -z ${base} (exit ${listed.code})`;
     const refuse = () => {

package/dist/exec.d.ts

@@ -28,6 +28,13 @@ export type ExecResult = {
      * returned — a transport exit alone never proves that.
      */
     containment?: ContainmentOutcome;
+    /** The signal that ended the process, when one did (its `code` then reads 1, as it always has): kept apart so a
+     * killed command is never mistaken for one that exited 1 on its own (release check 3261). Only the buffered
+     * process-group transport says. */
+    signal?: NodeJS.Signals | null;
+    /** This process (the plane) ended it with its hard stop (terminateLiveProviders: a worker shutting down), not
+     * anything the command or another process did. */
+    stoppedByPlane?: boolean;
 };
 export type ContainmentOutcome = {
     refused: string;
@@ -245,6 +252,8 @@ export type SpawnAttempt = {
  */
 export declare function retryTransientSpawn(attempt: () => Promise<SpawnAttempt>, delays?: readonly number[], sleep?: (ms: number) => Promise<void>): Promise<ExecResult>;
 export declare function run(file: string, args: readonly string[], options?: RunOptions): Promise<ExecResult>;
+/** How long a timed-out plain command has to exit after SIGTERM before it is killed outright. */
+export declare const TERM_GRACE_MS = 2000;
 /**
  * Provider replies are nested inside their JSONL envelope. A 64 KiB reply
  * therefore needs appreciably more than 64 KiB on the wire once quotes,

package/dist/exec.js

@@ -21,6 +21,8 @@ import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 export const CONTAINMENT_REFUSED_CODE = 126;
 /** Live provider children, for the deterministic stop. Registered only when `processGroup` was set. */
 const liveProviders = new Set();
+/** Children this process's own hard stop ended: their results say so (`stoppedByPlane`). */
+const hardStopped = new WeakSet();
 /** Live children by owner tag (v52): the exact-attempt stop's handle. A
  * child is registered here beside liveProviders when its options named an
  * owner, and dropped the moment it closes. */
@@ -370,6 +372,7 @@ function killGroup(child) {
 export function terminateLiveProviders() {
     let terminated = 0;
     for (const child of liveProviders) {
+        hardStopped.add(child);
         killGroup(child);
         terminated += 1;
     }
@@ -581,7 +584,10 @@ export function run(file, args, options = {}) {
         return Promise.resolve({ code: CONTAINMENT_REFUSED_CODE, stdout: "", stderr: error.message, timedOut: false, notFound: false, containment: { refused: error.message } });
     }
     return retryTransientSpawn(() => new Promise(resolve => {
-        execFile(wrapped.file, wrapped.args, {
+        // execFile's timeout sends SIGTERM and nothing more: a process that survives it (one that ignores or blocks
+        // it) never exits, and its caller would wait forever. SIGKILL follows a short grace later.
+        let hardKill;
+        const child = execFile(wrapped.file, wrapped.args, {
             cwd,
             timeout: timeoutMs,
             maxBuffer,
@@ -590,6 +596,8 @@ export function run(file, args, options = {}) {
             windowsHide: true,
             ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env, (options.fence?.length ?? 0) > 0)),
         }, (error, stdout, stderr) => {
+            if (hardKill !== undefined)
+                clearTimeout(hardKill);
             if (error === null) {
                 resolve({ result: { code: 0, stdout, stderr, timedOut: false, notFound: false }, transient: false });
                 return;
@@ -599,8 +607,17 @@ export function run(file, args, options = {}) {
                 transient: isTransientSpawnFailure(error),
             });
         });
+        if (timeoutMs > 0) {
+            hardKill = setTimeout(() => { try {
+                child.kill("SIGKILL");
+            }
+            catch { /* gone */ } }, timeoutMs + TERM_GRACE_MS);
+            hardKill.unref?.();
+        }
     }));
 }
+/** How long a timed-out plain command has to exit after SIGTERM before it is killed outright. */
+export const TERM_GRACE_MS = 2_000;
 /**
  * The buffered transport for process-group providers (claude): spawn
  * detached so the harness and everything it launches share one killable
@@ -677,6 +694,7 @@ function runBufferedGroup(file, args, bag) {
         });
         let settled = false;
         let transient = false;
+        let endSignal = null;
         const finish = (code) => {
             if (settled)
                 return;
@@ -697,6 +715,8 @@ function runBufferedGroup(file, args, bag) {
                         timedOut: timedOut && !overflowed,
                         notFound,
                         ...containmentOf(container, empty, attachFailure),
+                        ...(endSignal === null ? {} : { signal: endSignal }),
+                        ...(hardStopped.has(child) ? { stoppedByPlane: true } : {}),
                     },
                     transient,
                 });
@@ -709,7 +729,7 @@ function runBufferedGroup(file, args, bag) {
                 stderr = String(error);
             finish(null);
         });
-        child.on("close", code => finish(code));
+        child.on("close", (code, signal) => { endSignal = code === null ? signal ?? null : null; finish(code); });
         if (bag.stdin !== undefined && child.stdin !== null) {
             child.stdin.on("error", () => {
                 inputFailed = true;

package/dist/git-floor.d.ts

@@ -0,0 +1,16 @@
+export declare const GIT_FLOOR: {
+    readonly major: 2;
+    readonly minor: 41;
+};
+export declare const GIT_FLOOR_WORDS: string;
+/** The version `git --version` names ("git version 2.50.1 (Apple Git-155)" → 2.50.1), or null when it names none. */
+export declare function parseGitVersion(text: string): {
+    major: number;
+    minor: number;
+    words: string;
+} | null;
+/** Why `version` (`git --version`'s answer) is below the floor, in one sentence, or null when it isn't (or can't be read). */
+export declare function gitFloorWords(versionText: string): string | null;
+/** The installed git's floor problem, asked once per process with no system or global config; null when git is new
+ * enough, or when no version could be read (a missing git is reported where it is used). */
+export declare function installedGitFloorProblem(): string | null;

package/dist/git-floor.js

@@ -0,0 +1,36 @@
+/**
+ * The oldest git Toolroll runs on (README, Requirements): the global `git --attr-source` option every hardened read
+ * takes arrived in git 2.41 (others in use are older: `worktree list -z` 2.36, GIT_CONFIG_COUNT and `--path-format`
+ * 2.31). On git older than 2.45, which lacks `--no-lazy-fetch`, partial clones are refused for protected reads
+ * (teardown-git.ts lazyFetchSupported), every protected read runs through a frozen view and refuses every transport,
+ * and nothing leans on GIT_NO_LAZY_FETCH, which 2.41.0 ignores. The CI git lanes test this floor's oldest release
+ * exactly, 2.41.0, and 2.47 (.github/workflows/ci.yml, scripts/ci-git.sh).
+ */
+import { spawnSync } from "node:child_process";
+export const GIT_FLOOR = { major: 2, minor: 41 };
+export const GIT_FLOOR_WORDS = `${GIT_FLOOR.major}.${GIT_FLOOR.minor}`;
+/** The version `git --version` names ("git version 2.50.1 (Apple Git-155)" → 2.50.1), or null when it names none. */
+export function parseGitVersion(text) {
+    const found = /^git version (\d+)\.(\d+)(?:\.(\d+))?/.exec(text.trim());
+    return found === null ? null : { major: Number(found[1]), minor: Number(found[2]), words: `${found[1]}.${found[2]}${found[3] === undefined ? "" : `.${found[3]}`}` };
+}
+/** Why `version` (`git --version`'s answer) is below the floor, in one sentence, or null when it isn't (or can't be read). */
+export function gitFloorWords(versionText) {
+    const version = parseGitVersion(versionText);
+    if (version === null)
+        return null;
+    if (version.major > GIT_FLOOR.major || (version.major === GIT_FLOOR.major && version.minor >= GIT_FLOOR.minor))
+        return null;
+    return `Toolroll needs git ${GIT_FLOOR_WORDS} or newer, and this machine's git is ${version.words}. Install a newer git (and put it first on PATH), then start Toolroll again.`;
+}
+let probed;
+/** The installed git's floor problem, asked once per process with no system or global config; null when git is new
+ * enough, or when no version could be read (a missing git is reported where it is used). */
+export function installedGitFloorProblem() {
+    if (probed === undefined) {
+        const answer = spawnSync("git", ["--version"], { cwd: "/", encoding: "utf8", timeout: 5_000, stdio: ["ignore", "pipe", "ignore"],
+            env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+        probed = answer.status === 0 ? gitFloorWords(answer.stdout ?? "") : null;
+    }
+    return probed;
+}

package/dist/grant.js

@@ -30,6 +30,7 @@
  * the same reason an unknown lease is: silence is not consent.
  */
 import { run } from "./exec.js";
+import { lazyFetchSafeGit, noLazyFetch } from "./teardown-git.js";
 export const MUTATION_CLASSES = [
     "create",
     "transition",
@@ -175,12 +176,15 @@ async function observedByGit(repo, paths, runner) {
     const local = paths.filter(path => !isRemoteRef(path));
     if (local.length === 0)
         return false;
+    // On a git without --no-lazy-fetch, through a frozen read view (teardown-git.ts lazyFetchSafeGit): a partial clone is
+    // refused there, and a refusal reads as "not ignored", so observed.
+    const git = lazyFetchSafeGit(runner);
     for (const path of local) {
         const asked = [path, `${normalise(path)}/`];
         const ignored = await Promise.all(asked.map(async (candidate) => {
             // check-ignore reads the index, so a planted fsmonitor would run: off (and hooks, lazy fetch) on the command line,
             // which wins over any config the repository's builds can write.
-            const result = await runner("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "check-ignore", "-q", candidate], {
+            const result = await git("git", ["--no-optional-locks", ...noLazyFetch(), "-c", "protocol.allow=never", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "check-ignore", "-q", candidate], {
                 cwd: repo,
             });
             return result.code === 0;