toolroll 0.9.78 → 0.9.79

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.9.79 — 2026-10-29
+
+- **`toolroll release` rides out a short network failure instead of
+  stopping.** A read from GitHub or git (`gh api`, `gh pr list`,
+  `git ls-remote`, `git fetch`) that fails for a passing reason (no
+  connection, a name that didn't resolve, a timeout, a 5xx, an answer cut
+  short, GitHub's secondary rate limit) is asked again with backoff for up
+  to about three minutes, saying why once; then it stops with the original
+  error. A definitive answer (404, 401/403) is never asked again. A merge or
+  a tag is never sent twice blindly: after a lost answer the release reads
+  GitHub to learn whether it happened, and asks again only when it didn't.
+  When main's branch protection can't be read, the release now says
+  "Couldn't read GitHub's branch protection" instead of "main's protection
+  doesn't hold", and still stops.
+
 ## 0.9.78 — 2026-10-29
 
 - **Toolroll says when it is restarting.** The worker and console now record

package/dist/desktop-update.d.ts

@@ -97,7 +97,6 @@ export declare function sqliteLock(file: string, busyTimeoutMs?: number): Databa
 export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -111,6 +110,7 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/git-views.d.ts

@@ -17,4 +17,4 @@ export declare function lockCheckout(home: string, checkout: string, timeoutMs?:
  * another on the same checkout (teardown's git run through the builder's hardened runner, a view within a view) runs
  * under the lock its caller already holds instead of waiting on itself.
  */
-export declare function withCheckoutLock<T>(home: string, checkout: string, work: () => Promise<T>): Promise<T>;
+export declare function withCheckoutLock<T>(home: string, checkout: string, work: () => Promise<T>, timeoutMs?: number): Promise<T>;

package/dist/git-views.js

@@ -106,11 +106,11 @@ const heldHere = new AsyncLocalStorage();
  * another on the same checkout (teardown's git run through the builder's hardened runner, a view within a view) runs
  * under the lock its caller already holds instead of waiting on itself.
  */
-export async function withCheckoutLock(home, checkout, work) {
+export async function withCheckoutLock(home, checkout, work, timeoutMs) {
     const held = heldHere.getStore() ?? new Set();
     if (held.has(checkout))
         return work();
-    const release = await lockCheckout(home, checkout);
+    const release = await lockCheckout(home, checkout, timeoutMs);
     try {
         return await heldHere.run(new Set([...held, checkout]), work);
     }

package/dist/project-knowledge.d.ts

@@ -22,17 +22,20 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
+    title?: never;
+    history?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
-    title?: never;
     content?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    title?: never;
+    revision?: never;
+    history?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -49,28 +52,25 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
         id: number;
     };
     notice: string;
-    title?: never;
     content?: never;
-    revision?: never;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    history?: never;
     stale?: never;
     decision?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
-    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    title?: never;
     stale?: never;
     decision?: never;
-    title?: never;
     content?: never;
     revision: number;
     history: {

package/dist/release-adapters.d.ts

@@ -176,9 +176,16 @@ export declare function readContains(run: Exec, gh: string, repo: string, sha: s
  * can't be bypassed by that account:
  * classic protection with "Do not allow bypassing the above settings" (`enforce_admins`); an active ruleset whose
  * bypass list reads whole, names no role, team or organization admin, and says this account never bypasses it. Read
- * only — Toolroll never changes a repository's settings. A layer that can't be read never holds; null only when nothing
- * could be read at all.
+ * only — Toolroll never changes a repository's settings. A layer that can't be read never holds. When no layer holds
+ * and one couldn't be read (gh failed for a reason other than "not protected", or its answer didn't parse), the read
+ * throws ProtectionUnreadable: "couldn't read GitHub" is never reported as "protection doesn't hold", and never as
+ * holding. Null only for a repository or branch name GitHub can't be asked about.
  */
 export declare function readMainProtection(run: Exec, gh: string, repo: string, branch?: string): Promise<MainProtection | null>;
+/** Main's protection couldn't be read from GitHub (after the network retries): not "doesn't hold", and never "holds". */
+export declare class ProtectionUnreadable extends Error {
+    readonly unread: readonly string[];
+    constructor(unread: readonly string[]);
+}
 /** Whether main's protection holds, as a yes/no (release-auto.ts sealAutoGreen): null when it can't be read. */
 export declare function readUpToDateRequired(run: Exec, gh: string, repo: string, branch?: string): Promise<boolean | null>;

package/dist/release-adapters.js

@@ -12,6 +12,7 @@ import { basename, delimiter, dirname, join } from "node:path";
 import { createRequire } from "node:module";
 import { parse as parseYaml } from "yaml";
 import { sleep } from "./sleep.js";
+import { callLabel, readOnlyCall, retryCall, retryingExec, writeWithRecheck } from "./release-net.js";
 // Loaded on first use, like the store: a static import prints Node's SQLite warning before the CLI can quiet it.
 const sqlite = () => createRequire(import.meta.url)("node:sqlite");
 import { PROTECTION_MINIMUM_CHECKS, PROTECTION_REPORT_ONLY_CHECKS } from "./release.js";
@@ -28,7 +29,7 @@ import { proveCarry } from "./release-carry.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { deploymentGate } from "./deploy-gate.js";
 import { extractCommit } from "./commit-extract.js";
-import { checkoutIncludes } from "./teardown-git.js";
+import { teardownGit, refusal as gitRefusal } from "./teardown-git.js";
 import { RELEASE_REMOTE, releaseConfigProblem, releaseGitArgs, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 export { RELEASE_PATH, RELEASE_REMOTE, releaseConfigProblem, releaseGitArgs, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 /** A child process, its output kept whole; a missing program or a time limit is exit 127 or 124, never a throw. */
@@ -51,10 +52,12 @@ const cleanEnv = (extra = {}) => {
     delete env["NODE_OPTIONS"];
     return env;
 };
+/** A failed call, in the words every release stop uses: what, its exit code and the last lines it printed. */
+const failed = (result, what) => new Error(`${what} failed (exit ${result.code}): ${(result.stderr || result.stdout).trim().split("\n").slice(-3).join(" ")}`);
 const must = async (run, what) => {
     const result = await run;
     if (result.code !== 0)
-        throw new Error(`${what} failed (exit ${result.code}): ${(result.stderr || result.stdout).trim().split("\n").slice(-3).join(" ")}`);
+        throw failed(result, what);
     return result.stdout;
 };
 /** owner/name from an https or ssh GitHub remote. */
@@ -227,8 +230,16 @@ export function releaseAdapters(options) {
     const pause = options.sleep ?? ((ms) => new Promise(done => setTimeout(done, ms)));
     const tools = options.tools ?? releaseTools();
     const gitEnv = releaseGitEnv();
+    const say = options.say ?? ((line) => { process.stdout.write(`${line}\n`); });
+    /** A short network failure on the way to GitHub (release-net.ts): reads are asked again for up to ~3 minutes; a
+     * write never is, unless GitHub says it didn't happen (writeWithRecheck). */
+    const net = { say, sleep: options.sleep ?? sleep, ...(options.now === undefined ? {} : { now: options.now }) };
+    const reads = retryingExec(run, net);
     // Never a PATH lookup or the checkout's Git config: gh by its absolute path, from a neutral folder, naming the repo.
-    const gh = (...args) => run(tools.gh, args, { cwd: "/", env: gitEnv });
+    // Reads ride out a short network failure; anything that isn't provably a read passes straight through (readOnlyCall).
+    const gh = (...args) => reads(tools.gh, args, { cwd: "/", env: gitEnv });
+    /** A write by gh, never retried by itself. */
+    const ghWrite = (remainingMs, ...args) => run(tools.gh, args, { cwd: "/", env: gitEnv, timeoutMs: Math.min(120_000, remainingMs) });
     const ghJson = async (what, ...args) => JSON.parse(await must(gh(...args), what));
     const toolroll = async (...args) => {
         const result = await run("toolroll", [...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
@@ -245,9 +256,9 @@ export function releaseAdapters(options) {
     const ciGh = options.tools?.gh ?? releaseTools("").gh;
     const observeCi = async (sha) => {
         const observedAt = (options.now ?? (() => new Date()))().toISOString();
-        const runs = (await readCheckRuns(run, ciGh, releaseRepo().slug, sha)).map(one => ({ id: one.id ?? null, name: one.name, status: one.status, conclusion: one.conclusion, app: one.app ?? null, suite: one.suite ?? null, head: one.head ?? null, workflow: one.workflow ?? null, workflowPath: one.workflowPath ?? null,
+        const runs = (await readCheckRuns(reads, ciGh, releaseRepo().slug, sha)).map(one => ({ id: one.id ?? null, name: one.name, status: one.status, conclusion: one.conclusion, app: one.app ?? null, suite: one.suite ?? null, head: one.head ?? null, workflow: one.workflow ?? null, workflowPath: one.workflowPath ?? null,
             ...(one.beforeTests === undefined ? {} : { beforeTests: one.beforeTests }) }));
-        return { head: sha, observedAt, runs, complete: await readSuitesComplete(run, ciGh, releaseRepo().slug, sha) };
+        return { head: sha, observedAt, runs, complete: await readSuitesComplete(reads, ciGh, releaseRepo().slug, sha) };
     };
     const database = options.database ?? databasePath(process.env, homedir());
     let recorded = options.releaseRepo ?? null;
@@ -255,21 +266,55 @@ export function releaseAdapters(options) {
     const releaseRepo = () => recorded ??= recordedReleaseRepo(database, checkout);
     /**
      * The coordinator's one way to run Git (§0a.2): on the recorded Git directory, hardened, with an allowlisted
-     * environment and the absolute Git. Before every command the checkout's own config is read with includes off and
-     * as plain files; one that includes a file, names a command or redirects a remote stops the release, naming it.
+     * environment and the absolute Git. Every attempt uses the shared runner's private view: the audited config is
+     * the exact copy Git reads, so a build cannot redirect a command after its config was checked.
      */
     const git = async (...args) => {
         const repo = releaseRepo();
+        const full = [...releaseGitArgs(repo, tools), ...args];
         const stop = (why) => new Error(`Toolroll won't run Git in ${repo.checkout} for a release: ${why}. Remove it from the project's Git config, then rerun.`);
-        if (options.releaseRepo === undefined && checkoutIncludes(repo.checkout))
-            throw stop("its Git config includes another file, or couldn't be read as a plain file");
-        const listing = await run(tools.git, [`--git-dir=${repo.gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env: gitEnv });
-        if (listing.code !== 0)
-            throw stop("its Git config couldn't be read");
-        const setting = releaseConfigProblem(listing.stdout);
-        if (setting !== null)
-            throw stop(`its Git config sets ${setting}, which a release doesn't run with (it could run a command, or change where Git connects or what it sends)`);
-        return run(tools.git, [...releaseGitArgs(repo, tools), ...args], { cwd: repo.checkout, env: gitEnv });
+        // The checkout's config is read again right before EVERY attempt, a retried one included (checked at the moment of use).
+        const once = async (remainingMs = 120_000) => {
+            const now = () => (options.now ?? (() => new Date()))().getTime();
+            const started = now();
+            const left = () => Math.min(120_000, remainingMs - Math.max(0, now() - started));
+            const checkConfig = (listing) => {
+                if (listing.code !== 0)
+                    throw stop("its Git config couldn't be read");
+                const setting = releaseConfigProblem(listing.stdout);
+                if (setting !== null)
+                    throw stop(`its Git config sets ${setting}, which a release doesn't run with (it could run a command, or change where Git connects or what it sends)`);
+            };
+            if (options.releaseRepo === undefined) {
+                // The shared runner pins both Git directories and freezes config/info in the plane's fenced view folder.
+                // Its private paths replace releaseGitArgs' first two directory flags; the recorded remote stays fixed.
+                const viewed = teardownGit(async (_command, argv, runOptions) => {
+                    const timeoutMs = left();
+                    if (timeoutMs <= 0)
+                        return { code: 124, stdout: "", stderr: "the network retry budget ran out", timedOut: true, notFound: false };
+                    const env = { ...gitEnv, ...Object.fromEntries(["GIT_DIR", "GIT_COMMON_DIR", "GIT_WORK_TREE"].map(key => [key, runOptions?.env?.[key]])) };
+                    const result = await run(tools.git, argv, { cwd: repo.checkout, env, timeoutMs });
+                    if (argv.includes("config"))
+                        checkConfig(result);
+                    return { ...result, timedOut: result.code === 124, notFound: result.code === 127 };
+                }, { repo: repo.checkout }, Math.max(0, left()), tools.git);
+                const result = await viewed(repo.checkout, full.slice(2));
+                const why = gitRefusal(result);
+                if (why !== null)
+                    throw stop(why);
+                return result;
+            }
+            // Injected repository/exec fixtures have no on-disk checkout, but exercise the same config policy per attempt.
+            if (left() <= 0)
+                return { code: 124, stdout: "", stderr: "the network retry budget ran out" };
+            const listing = await run(tools.git, [`--git-dir=${repo.gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env: gitEnv, timeoutMs: left() });
+            checkConfig(listing);
+            if (left() <= 0)
+                return { code: 124, stdout: "", stderr: "the network retry budget ran out" };
+            return run(tools.git, full, { cwd: repo.checkout, env: gitEnv, timeoutMs: left() });
+        };
+        // ls-remote and fetch ride out a short network failure; a push or a local command is never retried (readOnlyCall).
+        return readOnlyCall(tools.git, full) === null ? once() : retryCall(once, callLabel(tools.git, full), net);
     };
     /** The remote every fetch, look and push names: the recorded URL, defined only on the command line. */
     const remoteUrl = () => RELEASE_REMOTE;
@@ -373,8 +418,8 @@ export function releaseAdapters(options) {
             rmSync(extracted.dir, { recursive: true, force: true });
         }
     };
-    const release = storeReleaseAdapter(() => openStore(database), store => store.close(), options.now ?? (() => new Date()), undefined, { observe: sha => observeCi(sha), mergeBase: (base, sha) => readMergeBase(run, ciGh, releaseRepo().slug, base, sha),
-        upToDateRequired: () => readUpToDateRequired(run, ciGh, releaseRepo().slug), evidenceRoot: join(dirname(database), "evidence"),
+    const release = storeReleaseAdapter(() => openStore(database), store => store.close(), options.now ?? (() => new Date()), undefined, { observe: sha => observeCi(sha), mergeBase: (base, sha) => readMergeBase(reads, ciGh, releaseRepo().slug, base, sha),
+        upToDateRequired: () => readUpToDateRequired(reads, ciGh, releaseRepo().slug), evidenceRoot: join(dirname(database), "evidence"),
         // A successful Actions job authenticates the job, not the candidate-writable JSON it uploads. Until the
         // executor protects that reporting channel, production releases must take the person's approval road.
         reportsProtected: false });
@@ -382,7 +427,7 @@ export function releaseAdapters(options) {
         ...(existsSync(database) ? { release } : {}),
         now: options.now ?? (() => new Date()),
         sleep: options.sleep ?? sleep,
-        say: options.say ?? (line => process.stdout.write(`${line}\n`)),
+        say,
         repo: {
             // The recorded owner/name, never the checkout's origin.
             async github() { return releaseRepo().slug; },
@@ -575,33 +620,38 @@ export function releaseAdapters(options) {
                 return prs.find(one => one.state === "open") ?? prs.filter(one => one.state === "merged").sort((a, b) => b.number - a.number)[0] ?? null;
             },
             // Every attempt (filter=all), with its app, check suite and commit: the release judges each job by its latest attempt.
-            async checks(repo, sha, options) { return readCheckRuns(run, ciGh, repo, sha, options); },
-            async complete(repo, sha) { return readSuitesComplete(run, ciGh, repo, sha); },
-            async mainHead(repo) { return readMainHead(run, ciGh, repo); },
-            async contains(repo, sha, ancestor) { return readContains(run, ciGh, repo, sha, ancestor); },
-            async upToDateRequired(repo) { return readMainProtection(run, ciGh, repo); },
+            async checks(repo, sha, options) { return readCheckRuns(reads, ciGh, repo, sha, options); },
+            async complete(repo, sha) { return readSuitesComplete(reads, ciGh, repo, sha); },
+            async mainHead(repo) { return readMainHead(reads, ciGh, repo); },
+            async contains(repo, sha, ancestor) { return readContains(reads, ciGh, repo, sha, ancestor); },
+            async upToDateRequired(repo) { return readMainProtection(reads, ciGh, repo); },
             async merge(repo, pr, head, message) {
-                // The squash commit's message lists every commit that landed after the approval (release-once.md).
-                const merged = object(await ghJson("gh api pulls merge", "api", "-X", "PUT", `repos/${repo}/pulls/${pr}/merge`, "-f", "merge_method=squash", "-f", `sha=${head}`, ...(message === undefined ? [] : ["-f", `commit_message=${message}`])));
-                if (typeof merged["sha"] !== "string")
-                    throw new Error(`GitHub did not merge #${pr}: ${String(merged["message"] ?? "no merge commit")}`);
-                return merged["sha"];
-            },
-            async tag(repo, tag) {
-                const result = await gh("api", `repos/${repo}/git/ref/tags/${tag}`);
-                if (result.code !== 0) {
-                    if (/Not Found|HTTP 404/.test(result.stderr + result.stdout))
-                        return null;
-                    throw new Error(`gh api git/ref/tags/${tag} failed: ${result.stderr.trim()}`);
-                }
-                const target = object(object(JSON.parse(result.stdout))["object"]);
-                if (target["type"] !== "tag")
-                    return String(target["sha"]);
-                // An annotated tag: the commit it names.
-                return String(object(object(await ghJson("gh api git/tags", "api", `repos/${repo}/git/tags/${String(target["sha"])}`))["object"])["sha"]);
+                // The squash commit's message lists every commit that landed after the approval (release-once.md). Never asked
+                // again under stale approval/lease/CI checks: reconcile a lost answer, but another write needs a fresh
+                // coordinator pass through those guards. A PR still being open proves none of them.
+                return writeWithRecheck(`merging #${pr}`, { ...net, maxAttempts: 1 }, {
+                    write: remaining => ghWrite(remaining, "api", "-X", "PUT", `repos/${repo}/pulls/${pr}/merge`, "-f", "merge_method=squash", "-f", `sha=${head}`, ...(message === undefined ? [] : ["-f", `commit_message=${message}`])),
+                    accept: result => {
+                        const merged = object(JSON.parse(result.stdout));
+                        if (merged["merged"] !== true || typeof merged["sha"] !== "string" || !/^[0-9a-f]{40}$/.test(merged["sha"]))
+                            throw new Error(`GitHub did not merge #${pr}: ${String(merged["message"] ?? "no merge commit")}`);
+                        return merged["sha"];
+                    },
+                    refuse: result => { throw failed(result, "gh api pulls merge"); },
+                    recheck: bounded => pullMergedAt(repo, pr, head, "main", bounded, message),
+                });
             },
+            async tag(repo, tag) { return readTag(repo, tag); },
             async createTag(repo, tag, sha) {
-                await must(gh("api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/tags/${tag}`, "-f", `sha=${sha}`), `creating ${tag}`);
+                await writeWithRecheck(`creating ${tag}`, net, {
+                    write: remaining => ghWrite(remaining, "api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/tags/${tag}`, "-f", `sha=${sha}`),
+                    accept: () => undefined,
+                    refuse: result => { throw failed(result, `creating ${tag}`); },
+                    recheck: async (bounded) => {
+                        const at = await readTag(repo, tag, bounded);
+                        return at === sha ? { state: "done", value: undefined } : at === null ? { state: "not-done" } : { state: "other", why: `${tag} now points at ${at.slice(0, 7)}` };
+                    },
+                });
             },
             async release(repo, tag) { return (await gh("release", "view", tag, "--repo", repo, "--json", "tagName")).code === 0; },
         },
@@ -713,12 +763,57 @@ export function releaseAdapters(options) {
                 return problem === null ? { ok: true } : { ok: false, why: problem };
             },
             async merge(pr, head) {
-                const merged = object(await ghJson(`merging ${tap} #${pr}`, "api", "-X", "PUT", `repos/${tap}/pulls/${pr}/merge`, "-f", "merge_method=squash", "-f", `sha=${head}`));
-                if (merged["merged"] !== true || typeof merged["sha"] !== "string")
-                    throw new Error(`GitHub did not merge ${tap} #${pr}: ${String(merged["message"] ?? "no merge commit")}`);
+                const base = await defaultBranch();
+                await writeWithRecheck(`merging ${tap} #${pr}`, { ...net, maxAttempts: 1 }, {
+                    write: remaining => ghWrite(remaining, "api", "-X", "PUT", `repos/${tap}/pulls/${pr}/merge`, "-f", "merge_method=squash", "-f", `sha=${head}`),
+                    accept: result => {
+                        const merged = object(JSON.parse(result.stdout));
+                        if (merged["merged"] !== true || typeof merged["sha"] !== "string" || !/^[0-9a-f]{40}$/.test(merged["sha"]))
+                            throw new Error(`GitHub did not merge ${tap} #${pr}: ${String(merged["message"] ?? "no merge commit")}`);
+                    },
+                    refuse: result => { throw failed(result, `merging ${tap} #${pr}`); },
+                    recheck: async (bounded) => { const state = await pullMergedAt(tap, pr, head, base, bounded); return state.state === "done" ? { state: "done", value: undefined } : state; },
+                });
             },
         },
     };
+    /** A tag's commit as GitHub answers now (an annotated tag: the commit it names), or null when there is no such tag. */
+    async function readTag(repo, tag, bounded = net) {
+        const read = (path) => retryingExec(run, bounded)(tools.gh, ["api", path], { cwd: "/", env: gitEnv });
+        const result = await read(`repos/${repo}/git/ref/tags/${tag}`);
+        if (result.code !== 0) {
+            if (/Not Found|HTTP 404/.test(result.stderr + result.stdout))
+                return null;
+            throw new Error(`gh api git/ref/tags/${tag} failed: ${result.stderr.trim()}`);
+        }
+        const target = object(object(JSON.parse(result.stdout))["object"]);
+        if (target["type"] !== "tag")
+            return String(target["sha"]);
+        return String(object(object(JSON.parse(await must(read(`repos/${repo}/git/tags/${String(target["sha"])}`), "gh api git/tags")))["object"])["sha"]);
+    }
+    /** Whether a pull request is merged from exactly `head` (its merge commit), still open at `head` (not merged), or
+     * anything else — read after a merge's answer was lost. */
+    async function pullMergedAt(repo, pr, head, base, bounded, message) {
+        const read = async (path) => object(JSON.parse(await must(retryingExec(run, bounded)(tools.gh, ["api", path], { cwd: "/", env: gitEnv }), "gh api merge recovery")));
+        const pull = await read(`repos/${repo}/pulls/${pr}`);
+        const at = object(pull["head"])["sha"], commit = pull["merge_commit_sha"];
+        if (at !== head || object(pull["base"])["ref"] !== base)
+            return { state: "other", why: `#${pr} is no longer open at ${head.slice(0, 7)} into ${base}` };
+        if (pull["merged"] === true && pull["state"] === "closed" && typeof commit === "string" && /^[0-9a-f]{40}$/.test(commit)) {
+            // Another caller may have merged it. Only the same squash result counts, never merely "merged=true".
+            const source = await read(`repos/${repo}/git/commits/${head}`);
+            const merged = await read(`repos/${repo}/git/commits/${commit}`);
+            const tree = object(source["tree"])["sha"], parents = merged["parents"];
+            if (typeof tree === "string" && /^[0-9a-f]{40}$/.test(tree) && object(merged["tree"])["sha"] === tree
+                && Array.isArray(parents) && parents.length === 1
+                && (message === undefined || (typeof merged["message"] === "string" && merged["message"].endsWith(`\n\n${message}`))))
+                return { state: "done", value: commit };
+            return { state: "other", why: `#${pr}'s merge is not the approved squash result` };
+        }
+        if (pull["merged"] === false && pull["state"] === "open")
+            return { state: "not-done" };
+        return { state: "other", why: `#${pr} is no longer open at ${head.slice(0, 7)}` };
+    }
     async function defaultBranch() {
         return (await must(gh("api", `repos/${tap}`, "--jq", ".default_branch"), `gh api repos/${tap}`)).trim();
     }
@@ -1173,15 +1268,19 @@ export async function readContains(run, gh, repo, sha, ancestor) {
  * can't be bypassed by that account:
  * classic protection with "Do not allow bypassing the above settings" (`enforce_admins`); an active ruleset whose
  * bypass list reads whole, names no role, team or organization admin, and says this account never bypasses it. Read
- * only — Toolroll never changes a repository's settings. A layer that can't be read never holds; null only when nothing
- * could be read at all.
+ * only — Toolroll never changes a repository's settings. A layer that can't be read never holds. When no layer holds
+ * and one couldn't be read (gh failed for a reason other than "not protected", or its answer didn't parse), the read
+ * throws ProtectionUnreadable: "couldn't read GitHub" is never reported as "protection doesn't hold", and never as
+ * holding. Null only for a repository or branch name GitHub can't be asked about.
  */
 export async function readMainProtection(run, gh, repo, branch = "main") {
     if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || !/^[A-Za-z0-9._/-]+$/.test(branch) || branch.includes(".."))
         return null;
     const missing = [];
     const held = [];
-    let read = 0;
+    /** What couldn't be read at all, and the words gh gave. */
+    const unread = [];
+    const words = (out) => (out.stderr || out.stdout).trim().split("\n").slice(-1)[0]?.slice(0, 160) || `exit ${out.code}`;
     const judge = (where, strict, checks, bound, bypass) => {
         const own = [];
         if (!strict)
@@ -1227,46 +1326,41 @@ export async function readMainProtection(run, gh, repo, branch = "main") {
         catch { /* unreadable below */ }
         const p = object(answer), checks = p["required_status_checks"];
         if (answer === null || typeof answer !== "object" || Array.isArray(answer))
-            missing.push("classic protection couldn't be read");
-        else if (checks === undefined || checks === null) {
-            read++;
+            unread.push("classic protection (its answer didn't parse)");
+        else if (checks === undefined || checks === null)
             missing.push("classic protection: \"Require status checks to pass before merging\" is off");
-        }
         else {
             const rsc = object(checks), contexts = names(rsc["contexts"] ?? [], ""), apps = names(rsc["checks"] ?? [], "context");
             const admins = p["enforce_admins"];
+            // GitHub answered, but without the settings this judges: read, and not holding.
             if (contexts === null || apps === null || typeof rsc["strict"] !== "boolean" || admins === undefined || admins === null || typeof object(admins)["enabled"] !== "boolean")
-                missing.push("classic protection couldn't be read");
+                missing.push("classic protection: GitHub's answer doesn't say which checks it requires or whether administrators can bypass it");
             else {
-                read++;
                 judge("classic protection", rsc["strict"] === true, [...new Set([...contexts, ...apps])], actionsChecks(rsc["checks"], "app_id"), object(admins)["enabled"] === true ? [] : ["\"Do not allow bypassing the above settings\" is off, so administrators can merge past it"]);
             }
         }
     }
-    else if (notProtected(classic))
-        read++;
-    else
-        missing.push("classic protection couldn't be read");
+    else if (!notProtected(classic))
+        unread.push(`classic protection (${words(classic)})`);
     // Rulesets: every active rule requiring status checks on the branch, then its ruleset's enforcement and bypass list.
     const rules = await run(gh, ["api", "--hostname", "github.com", "--paginate", `repos/${repo}/rules/branches/${branch}`,
         "--jq", ".[] | select(.type == \"required_status_checks\") | @json"], { cwd: "/", env: ciEnv() });
     if (rules.code !== 0)
-        missing.push("main's rulesets couldn't be read");
+        unread.push(`main's rulesets (${words(rules)})`);
     else {
-        read++;
         for (const line of rules.stdout.split("\n").filter(one => one.trim() !== "")) {
             let rule;
             try {
                 rule = object(JSON.parse(line));
             }
             catch {
-                missing.push("a ruleset rule couldn't be read");
+                unread.push("a ruleset rule (its answer didn't parse)");
                 continue;
             }
             const id = rule["ruleset_id"], params = object(rule["parameters"]);
             const checks = names(params["required_status_checks"], "context");
             if (!Number.isSafeInteger(id) || Number(id) <= 0 || checks === null) {
-                missing.push("a ruleset rule couldn't be read");
+                missing.push("a ruleset rule doesn't name its ruleset or required checks");
                 continue;
             }
             const where = `ruleset ${id}`;
@@ -1280,7 +1374,7 @@ export async function readMainProtection(run, gh, repo, branch = "main") {
                 set = null;
             }
             if (set === null) {
-                missing.push(`${where}: its settings couldn't be read`);
+                unread.push(`${where}: its settings (${got.code === 0 ? "its answer didn't parse" : words(got)})`);
                 continue;
             }
             const bypass = [];
@@ -1304,15 +1398,31 @@ export async function readMainProtection(run, gh, repo, branch = "main") {
         const required = new Set(held.flat());
         return { effective: true, missing: [], notYetRequired: PROTECTION_REPORT_ONLY_CHECKS.filter(name => !required.has(name)) };
     }
-    if (read === 0)
-        return null;
+    if (unread.length > 0)
+        throw new ProtectionUnreadable(unread);
     if (missing.length === 0)
         missing.push("main has no branch protection or ruleset requiring status checks");
     return { effective: false, missing, notYetRequired: [] };
 }
+/** Main's protection couldn't be read from GitHub (after the network retries): not "doesn't hold", and never "holds". */
+export class ProtectionUnreadable extends Error {
+    unread;
+    constructor(unread) {
+        super(`couldn't read GitHub's branch protection for main: ${unread.join("; ")}`);
+        this.unread = unread;
+    }
+}
 /** Whether main's protection holds, as a yes/no (release-auto.ts sealAutoGreen): null when it can't be read. */
 export async function readUpToDateRequired(run, gh, repo, branch = "main") {
-    const protection = await readMainProtection(run, gh, repo, branch);
+    let protection;
+    try {
+        protection = await readMainProtection(run, gh, repo, branch);
+    }
+    catch (error) {
+        if (error instanceof ProtectionUnreadable)
+            return null;
+        throw error;
+    }
     return protection === null ? null : protection.effective;
 }
 /** Whether a workflow run is the push of exactly this release tag (its workflow file is the tagged commit's own, on main). */

package/dist/release-net.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The release tool's one way through a short network failure on the way to GitHub (git or gh): a read that failed for a
+ * transient reason — a connection refused or reset, a name that didn't resolve, a time limit, a 5xx, a truncated or
+ * unparseable answer, GitHub's secondary rate limit — is asked again with backoff for up to about three minutes, then
+ * fails with its original error. A definitive answer (404, 401/403, bad credentials, a missing program) is never asked
+ * again. Nothing here ever turns "couldn't read" into an answer: the caller still sees the failure and fails closed.
+ *
+ * Only a read is retried blindly. A call that changes something (a merge, a tag, a branch push, a release, a tap
+ * change) goes through `writeWithRecheck`: after a transient failure it re-reads GitHub to learn whether the write
+ * happened, and asks again only when it provably didn't.
+ */
+import type { Exec } from "./release-adapters.js";
+export type ExecResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/** How long one call may keep asking, and how far apart. */
+export declare const NET_RETRY_BUDGET_MS = 180000;
+export declare const NET_RETRY_MAX_ATTEMPTS = 12;
+export declare const netBackoff: (retry: number) => number;
+type RetryBudget = {
+    remaining: () => number;
+    sleep: (ms: number) => Promise<void>;
+};
+declare const sharedBudget: unique symbol;
+export type RetryOptions = {
+    say: (line: string) => void;
+    sleep: (ms: number) => Promise<void>;
+    now?: () => Date;
+    budgetMs?: number;
+    maxAttempts?: number;
+    /** Recovery reads inherit their write's budget, including under an injected clock. */
+    [sharedBudget]?: RetryBudget;
+};
+/**
+ * Whether a failure (its words, and the exit code when it came from a program) is transient: the phrase worth saying,
+ * and how long GitHub asked to wait (Retry-After) when it said. Null for a definitive answer or anything unknown —
+ * an unknown failure is never retried.
+ */
+export declare function transientFailure(text: string, code?: number): {
+    words: string;
+    retryAfterMs: number | null;
+} | null;
+/** Whether one exec result failed transiently (exit 0 never did, unless its answer doesn't parse; see readOnlyCall). */
+export declare function transientResult(result: ExecResult): ReturnType<typeof transientFailure>;
+/**
+ * Whether a call only reads (and so may be asked again blindly): `git ls-remote` and `git fetch` (which only moves the
+ * coordinator's own remote-tracking refs); REST repository `gh api` reads with only the flags below (gh turns
+ * fields or input into a POST); `gh pr list|view|checks`, `gh release view`, `gh repo view`. Anything else is a write, or
+ * unknown, and is never retried by `retryingExec`.
+ */
+export declare function readOnlyCall(command: string, args: readonly string[]): {
+    kind: "git" | "gh-api" | "gh";
+    jsonBody: boolean;
+} | null;
+/** A short name for a call, said once when it is asked again: `gh api repos/…/check-runs`, `git ls-remote`. */
+export declare function callLabel(command: string, args: readonly string[]): string;
+/**
+ * An Exec that asks a read again after a transient failure, with backoff, for up to `budgetMs` (about three minutes)
+ * and `maxAttempts` calls; it says why once per call. When the budget runs out it answers the FIRST failure, exactly as
+ * the program gave it, so the caller stops with the original error. A definitive answer or a success is returned at
+ * once. A call that isn't provably a read (readOnlyCall) is passed straight through, never retried.
+ */
+export declare function retryingExec(run: Exec, options: RetryOptions): Exec;
+/** One read, asked again as retryingExec describes. `call` may do more than the read itself (the release's Git
+ * re-checks the checkout's config first); anything it throws ends the read at once. */
+export declare function retryCall(call: (remainingMs: number) => Promise<ExecResult>, label: string, options: RetryOptions, jsonBody?: boolean): Promise<ExecResult>;
+/**
+ * A write that may be asked again only once GitHub says it didn't happen (idempotency). `write` makes the call;
+ * `accept` reads a successful answer into the value (a SyntaxError there is an answer cut short: transient);
+ * `refuse` throws for a failure. After a transient failure, `recheck` reads the state (its own reads retried): `done`
+ * with the value when the write happened, `not-done` when it provably didn't (only then is it asked again), and
+ * anything else — or a recheck that can't read — stops with the write's original error.
+ */
+export declare function writeWithRecheck<T>(label: string, options: RetryOptions, steps: {
+    write: (remainingMs: number) => Promise<ExecResult>;
+    accept: (result: ExecResult) => T;
+    refuse: (result: ExecResult) => never;
+    recheck: (options: RetryOptions) => Promise<{
+        state: "done";
+        value: T;
+    } | {
+        state: "not-done";
+    } | {
+        state: "other";
+        why: string;
+    }>;
+}): Promise<T>;
+export {};

package/dist/release-net.js

@@ -0,0 +1,253 @@
+/** How long one call may keep asking, and how far apart. */
+export const NET_RETRY_BUDGET_MS = 180_000;
+export const NET_RETRY_MAX_ATTEMPTS = 12;
+const BACKOFF_MS = [2_000, 4_000, 8_000, 16_000, 30_000];
+export const netBackoff = (retry) => BACKOFF_MS[Math.min(retry, BACKOFF_MS.length - 1)];
+const sharedBudget = Symbol("release retry budget");
+function retryBudget(options) {
+    if (options[sharedBudget] !== undefined)
+        return options[sharedBudget];
+    const now = () => (options.now ?? (() => new Date()))().getTime();
+    let last = now(), left = Math.max(0, options.budgetMs ?? NET_RETRY_BUDGET_MS);
+    const remaining = () => {
+        const at = now();
+        left = Math.max(0, left - Math.max(0, at - last));
+        last = at;
+        return left;
+    };
+    return { remaining, sleep: async (ms) => {
+            const before = remaining();
+            await options.sleep(ms);
+            // A frozen/backward fake clock must not grant more backoff than a real clock.
+            const elapsed = before - remaining();
+            left = Math.max(0, left - Math.max(0, ms - elapsed));
+        } };
+}
+const exhausted = () => ({ code: 124, stdout: "", stderr: "the network retry budget ran out" });
+/** Secondary rate limit or 429: transient, and GitHub may say how long to wait. */
+const RATE_LIMITED = /secondary rate limit|abuse detection|HTTP 429|Too Many Requests/i;
+/** A definitive answer: GitHub (or git) answered, and the answer is no. Checked before the transient phrases. */
+const DEFINITIVE = /Toolroll won't run Git|Not Found|Unauthorized|Forbidden|Bad Request|Bad credentials|Requires authentication|authentication required|Authentication failed|Permission denied|Repository not found|Resource not accessible|Must have admin rights|could not read Username|not protected|not enabled|Reference already exists|Validation Failed|Head branch was modified|not mergeable|API rate limit exceeded|GH00[136]|protected branch update failed|\[rejected\]|updates were rejected|stale info|required status check|repository rule violations/i;
+/** Transport failures and server-side trouble: nothing was answered yet. */
+const TRANSIENT = new RegExp([
+    "error connecting to", "Could not resolve host", "no such host", "Temporary failure in name resolution", "nodename nor servname",
+    "Connection refused", "Connection reset", "connection reset by peer", "Failed to connect to", "Couldn't connect to server", "Network is unreachable", "No route to host",
+    "Recv failure", "Send failure", "TLS handshake timeout", "SSL_ERROR_SYSCALL", "SSL_read", "gnutls_handshake", "Operation timed out", "Connection timed out", "i/o timeout",
+    "timeout awaiting", "context deadline exceeded", "Client\\.Timeout", "unexpected EOF", "early EOF", "The remote end hung up unexpectedly", "RPC failed", "broken pipe",
+    "unexpected end of JSON input", "invalid character .{1,12} looking for beginning of value", "Unexpected end of JSON input",
+    "HTTP 5\\d\\d", "returned error: 5\\d\\d", "\\b50[0234] (?:Internal Server Error|Bad Gateway|Service Unavailable|Gateway Timeout)", "Server Error", "Bad Gateway", "Service Unavailable", "Gateway Timeout",
+].join("|"), "i");
+/**
+ * Whether a failure (its words, and the exit code when it came from a program) is transient: the phrase worth saying,
+ * and how long GitHub asked to wait (Retry-After) when it said. Null for a definitive answer or anything unknown —
+ * an unknown failure is never retried.
+ */
+export function transientFailure(text, code) {
+    if (code === 127)
+        return null;
+    if (DEFINITIVE.test(text))
+        return null;
+    const limited = RATE_LIMITED.exec(text);
+    // A rate-limit hint never overrides an independent refusal. Only 403/429 may
+    // describe a secondary limit; git prints HTTP errors differently from gh.
+    const statuses = [...text.matchAll(/(?:HTTP(?:\/[\d.]+)?\s+|returned error:\s*)(4\d\d)\b/gi)].map(match => Number(match[1]));
+    if (statuses.some(status => limited === null || (status !== 403 && status !== 429)))
+        return null;
+    if (limited !== null) {
+        const after = /Retry-After:\s*(\d{1,4})/i.exec(text) ?? /(?:try again|retry) in (\d{1,4}) ?s(?:econds?)?/i.exec(text);
+        return { words: limited[0], retryAfterMs: after === null ? null : Number(after[1]) * 1000 };
+    }
+    const found = TRANSIENT.exec(text);
+    // The phrase and the rest of its line ("Could not resolve host: github.com"), kept short.
+    if (found !== null)
+        return { words: text.slice(found.index).split("\n")[0].trim().slice(0, 80), retryAfterMs: null };
+    // The coordinator's own time limit on the child (exec answers 124 when it killed it).
+    if (code === 124)
+        return { words: "the call timed out", retryAfterMs: null };
+    return null;
+}
+const failureText = (result) => `${result.stderr}\n${result.stdout}`;
+/** Whether one exec result failed transiently (exit 0 never did, unless its answer doesn't parse; see readOnlyCall). */
+export function transientResult(result) {
+    return result.code === 0 ? null : transientFailure(failureText(result), result.code);
+}
+/** The git subcommand among the arguments: the first that isn't an option or an option's value. */
+function gitSubcommand(args) {
+    for (let at = 0; at < args.length; at++) {
+        const arg = args[at];
+        if (["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--config-env"].includes(arg)) {
+            if (args[++at] === undefined)
+                return null;
+            continue;
+        }
+        if (/^-[cC]./.test(arg) || /^--(?:git-dir|work-tree|namespace|config-env|attr-source)=/.test(arg))
+            continue;
+        if (["--no-optional-locks", "--no-replace-objects", "--no-pager", "--no-lazy-fetch", "--literal-pathspecs"].includes(arg))
+            continue;
+        if (arg.startsWith("-"))
+            return null;
+        return arg;
+    }
+    return null;
+}
+/**
+ * Whether a call only reads (and so may be asked again blindly): `git ls-remote` and `git fetch` (which only moves the
+ * coordinator's own remote-tracking refs); REST repository `gh api` reads with only the flags below (gh turns
+ * fields or input into a POST); `gh pr list|view|checks`, `gh release view`, `gh repo view`. Anything else is a write, or
+ * unknown, and is never retried by `retryingExec`.
+ */
+export function readOnlyCall(command, args) {
+    const name = command.split("/").pop() ?? command;
+    if (name === "git") {
+        const sub = gitSubcommand(args);
+        return sub === "ls-remote" || sub === "fetch" ? { kind: "git", jsonBody: false } : null;
+    }
+    if (name !== "gh")
+        return null;
+    if (args[0] === "api") {
+        let endpoint = null, shaped = false;
+        for (let at = 1; at < args.length; at++) {
+            const arg = args[at];
+            // Parse only spellings we know. In particular, pflag accepts -iXPOST and -ifbody=...;
+            // a blacklist of tokens beginning with -X/-f cannot prove those calls read-only.
+            if (arg === "--paginate" || arg === "--slurp") {
+                shaped = true;
+                continue;
+            }
+            const flag = /^(--(?:method|hostname|jq|template))(?:=(.*))?$/.exec(arg) ?? /^(-[Xqt])(.*)$/.exec(arg);
+            if (flag !== null) {
+                const value = flag[2] || args[++at];
+                if (value === undefined || value.startsWith("-"))
+                    return null;
+                if (flag[1] === "-X" || flag[1] === "--method") {
+                    if (value !== "GET")
+                        return null;
+                }
+                else if (flag[1] !== "--hostname")
+                    shaped = true;
+                continue;
+            }
+            if (arg.startsWith("-") || endpoint !== null || !/^\/?repos\/[^\s]+$/.test(arg))
+                return null;
+            endpoint = arg;
+        }
+        return endpoint === null ? null : { kind: "gh-api", jsonBody: !shaped };
+    }
+    const pair = `${args[0] ?? ""} ${args[1] ?? ""}`;
+    if (!["pr list", "pr view", "pr checks", "release view", "repo view"].includes(pair))
+        return null;
+    const shaped = args.some(arg => arg === "--jq" || arg === "-q" || arg === "--template" || arg === "-t" || /^--(?:jq|template)=/.test(arg));
+    return { kind: "gh", jsonBody: !shaped && args.some(arg => arg === "--json" || arg.startsWith("--json=")) };
+}
+/** A short name for a call, said once when it is asked again: `gh api repos/…/check-runs`, `git ls-remote`. */
+export function callLabel(command, args) {
+    const name = command.split("/").pop() ?? command;
+    if (name === "git")
+        return `git ${gitSubcommand(args) ?? ""}`.trim();
+    if (args[0] === "api") {
+        const path = args.find(one => one.startsWith("repos/")) ?? args.find((one, at) => at > 0 && !one.startsWith("-")) ?? "";
+        return `gh api ${path.split("?")[0].replace(/[0-9a-f]{40}/g, sha => sha.slice(0, 7))}`.trim();
+    }
+    return `gh ${args.slice(0, 2).join(" ")}`;
+}
+/**
+ * An Exec that asks a read again after a transient failure, with backoff, for up to `budgetMs` (about three minutes)
+ * and `maxAttempts` calls; it says why once per call. When the budget runs out it answers the FIRST failure, exactly as
+ * the program gave it, so the caller stops with the original error. A definitive answer or a success is returned at
+ * once. A call that isn't provably a read (readOnlyCall) is passed straight through, never retried.
+ */
+export function retryingExec(run, options) {
+    return async (command, args, execOptions) => {
+        const read = readOnlyCall(command, args);
+        if (read === null)
+            return run(command, args, execOptions);
+        return retryCall(remainingMs => run(command, args, { ...execOptions,
+            timeoutMs: Math.min((execOptions?.timeoutMs ?? 0) > 0 ? execOptions.timeoutMs : 120_000, remainingMs),
+        }), callLabel(command, args), options, read.jsonBody);
+    };
+}
+/** Whether a 0-exit plain JSON body parses; a truncated one is a transient failure. */
+const bodyParses = (stdout) => { try {
+    JSON.parse(stdout);
+    return true;
+}
+catch {
+    return false;
+} };
+/** One read, asked again as retryingExec describes. `call` may do more than the read itself (the release's Git
+ * re-checks the checkout's config first); anything it throws ends the read at once. */
+export async function retryCall(call, label, options, jsonBody = false) {
+    const budget = retryBudget(options);
+    const maxAttempts = options.maxAttempts ?? NET_RETRY_MAX_ATTEMPTS;
+    let first = null;
+    for (let attempt = 0;; attempt++) {
+        const remaining = budget.remaining();
+        if (remaining <= 0)
+            return first ?? exhausted();
+        const result = await call(remaining);
+        let why = transientResult(result);
+        if (why === null && result.code === 0 && jsonBody && !bodyParses(result.stdout))
+            why = { words: "an answer cut short", retryAfterMs: null };
+        if (why === null)
+            return result;
+        // The original failure is what the caller sees; a truncated 0-exit body becomes an explicit failure.
+        first ??= result.code !== 0 ? result : { code: 1, stdout: result.stdout, stderr: "unexpected end of JSON input (GitHub's answer was cut short)" };
+        const wait = why.retryAfterMs ?? netBackoff(attempt);
+        if (attempt + 1 >= maxAttempts || wait >= budget.remaining())
+            return first;
+        if (attempt === 0)
+            options.say(`  GitHub didn't answer ${label} (${why.words}); asking again for up to ${Math.round((options.budgetMs ?? NET_RETRY_BUDGET_MS) / 60_000)} min.`);
+        await budget.sleep(wait);
+    }
+}
+/**
+ * A write that may be asked again only once GitHub says it didn't happen (idempotency). `write` makes the call;
+ * `accept` reads a successful answer into the value (a SyntaxError there is an answer cut short: transient);
+ * `refuse` throws for a failure. After a transient failure, `recheck` reads the state (its own reads retried): `done`
+ * with the value when the write happened, `not-done` when it provably didn't (only then is it asked again), and
+ * anything else — or a recheck that can't read — stops with the write's original error.
+ */
+export async function writeWithRecheck(label, options, steps) {
+    const budget = retryBudget(options);
+    const maxAttempts = options.maxAttempts ?? NET_RETRY_MAX_ATTEMPTS;
+    let first = null;
+    for (let attempt = 0;; attempt++) {
+        const remaining = budget.remaining();
+        if (remaining <= 0)
+            return steps.refuse(first ?? exhausted());
+        const result = await steps.write(remaining);
+        let why = transientResult(result);
+        if (result.code === 0) {
+            try {
+                return steps.accept(result);
+            }
+            catch (error) {
+                if (!(error instanceof SyntaxError))
+                    throw error;
+                why = { words: "an answer cut short", retryAfterMs: null };
+            }
+        }
+        if (why === null)
+            return steps.refuse(result);
+        first ??= result.code !== 0 ? result : { code: 1, stdout: result.stdout, stderr: "unexpected end of JSON input (GitHub's answer was cut short)" };
+        if (budget.remaining() <= 0)
+            return steps.refuse(first);
+        if (attempt === 0)
+            options.say(`  GitHub didn't answer ${label} (${why.words}); reading GitHub to learn whether it happened.`);
+        let state;
+        try {
+            state = await steps.recheck({ ...options, maxAttempts: NET_RETRY_MAX_ATTEMPTS, [sharedBudget]: budget });
+        }
+        catch (error) {
+            return steps.refuse({ ...first, stderr: `${first.stderr.trim()} (and whether it happened couldn't be read: ${String(error?.message ?? error).slice(0, 200)})` });
+        }
+        if (state.state === "done")
+            return state.value;
+        if (state.state === "other")
+            return steps.refuse({ ...first, stderr: `${first.stderr.trim()} (${state.why})` });
+        const wait = why.retryAfterMs ?? netBackoff(attempt);
+        if (attempt + 1 >= maxAttempts || wait >= budget.remaining())
+            return steps.refuse(first);
+        await budget.sleep(wait);
+    }
+}

package/dist/release.d.ts

@@ -670,7 +670,9 @@ export declare function checksVerdict(runs: readonly CheckRun[], required: reado
 export declare function tagChecksVerdict(runs: readonly CheckRun[]): ReturnType<typeof checksVerdict>;
 /** Run the release from wherever its journal stopped. */
 export declare function runRelease(options: ReleaseOptions, adapters: ReleaseAdapters): Promise<ReleaseOutcome>;
-/** A probe's failure that is only the network to GitHub being slow, never a decision (a Stop) or another error. */
+/** A probe's failure that is only the network to GitHub failing for now (release-net.ts transientFailure: a timeout, a
+ * connection or name failure, a 5xx, an answer cut short, a secondary rate limit), never a decision (a Stop), a
+ * definitive answer or another error. */
 export declare function transientNetworkError(error: unknown): boolean;
 /**
  * The pull request's checks on exactly `head`, every attempt (the adapter asks GitHub for all of them, filter=all):

package/dist/release.js

@@ -37,6 +37,7 @@ import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { personProof } from "./person-proof.js";
 import { RELEASE_CI_RUNNING_WORDS as CI_RUNNING_WORDS } from "./release-ci-hold.js";
+import { transientFailure } from "./release-net.js";
 /** The pull-request checks a release waits for, by exact job name (.github/workflows/ci.yml). Every one must have
  * concluded `success` on the gated commit; src/ci-workflow.test.ts holds the workflow to this list. */
 export const REQUIRED_PR_CHECKS = [
@@ -1318,20 +1319,24 @@ async function containsMain(adapters, j, nothing) {
  * cannot make the final main read and merge atomic, so absent or unreadable protection stops that release too.
  */
 async function mainProtection(adapters, j, auto, nothing) {
-    let protection;
+    let protection, unread = null;
+    // Couldn't read (after the adapter's network retries) is its own stop, never "doesn't hold" and never "holds".
     try {
         protection = await adapters.github.upToDateRequired(j.github);
     }
-    catch {
+    catch (error) {
         protection = null;
+        unread = String(error?.message ?? error).slice(0, 400);
     }
     // The git lanes main's protection doesn't name yet are said, never refused (PROTECTION_REPORT_ONLY_CHECKS).
     if (protection !== null && protection.notYetRequired.length > 0)
         adapters.say(`  Note: main's protection doesn't require ${protection.notYetRequired.join(", ")} yet; add ${protection.notYetRequired.length === 1 ? "it" : "them"} to its required checks.`);
     if (protection?.effective === true)
         return;
-    const lacking = protection === null ? "GitHub's branch protection for main couldn't be read" : `main's protection doesn't hold: ${protection.missing.join("; ")}`;
-    throw new Stop("base-unprotected", `${lacking}, so this release can't merge${auto ? " automatically" : ""}. ${nothing}. Restore effective main protection and try again.`);
+    if (protection === null) {
+        throw new Stop("github-unreadable", `Couldn't read GitHub's branch protection for main${unread === null ? "" : ` (${unread.replace(/^couldn't read GitHub's branch protection for main: /, "")})`}, so this release can't merge${auto ? " automatically" : ""}. ${nothing}. Run the release again once GitHub answers.`);
+    }
+    throw new Stop("base-unprotected", `main's protection doesn't hold: ${protection.missing.join("; ")}, so this release can't merge${auto ? " automatically" : ""}. ${nothing}. Restore effective main protection and try again.`);
 }
 /**
  * Wait for every required pull request check on the candidate to pass; stop on one that failed. `pendingIsEnough` (the
@@ -1377,17 +1382,17 @@ async function earlyChecks(adapters, j, wait, options = {}) {
         throw new Stop("ci-missing", `Pull request checks on ${sha} didn't all finish in time${named === "" ? (unread ? " (GitHub didn't answer)" : "") : `: ${named}`}. ${nothing}. Start or rerun them on GitHub, then run this command again.`);
     }
 }
-/** The network failures a release's waits ride out: git or gh timing out (or cut off) on the way to GitHub. */
-const TRANSIENT_NETWORK = /Recv failure: (?:Operation timed out|Connection reset by peer)|TLS handshake timeout|Operation timed out|Connection timed out|i\/o timeout|Connection reset by peer|Failed to connect to [^\s]*github\.com port \d+/i;
-/** A probe's failure that is only the network to GitHub being slow, never a decision (a Stop) or another error. */
+/** A probe's failure that is only the network to GitHub failing for now (release-net.ts transientFailure: a timeout, a
+ * connection or name failure, a 5xx, an answer cut short, a secondary rate limit), never a decision (a Stop), a
+ * definitive answer or another error. */
 export function transientNetworkError(error) {
     if (error instanceof Stop || error instanceof Restart)
         return false;
-    return TRANSIENT_NETWORK.test(String(error?.message ?? error));
+    return transientFailure(String(error?.message ?? error)) !== null;
 }
 /** The part of a network failure worth saying: its matching phrase. */
 function networkWords(error) {
-    return TRANSIENT_NETWORK.exec(String(error?.message ?? error))?.[0] ?? "a network failure";
+    return transientFailure(String(error?.message ?? error))?.words ?? "a network failure";
 }
 /**
  * The pull request's checks on exactly `head`, every attempt (the adapter asks GitHub for all of them, filter=all):

package/dist/teardown-git.d.ts

@@ -23,7 +23,7 @@ export declare function refusal(result: ExecResult): string | null;
  * target is bound to the same repository as the folder it is removed from. A removal without --force runs under the
  * target's own view (its own config.worktree folded in), so git's last check of whether it is clean reads it as the
  * target itself would. `binding.repo`: the project's main checkout, from the plane's records, when the caller has it. */
-export declare function teardownGit(runner?: Runner, binding?: GitBinding): Git;
+export declare function teardownGit(runner?: Runner, binding?: GitBinding, lockTimeoutMs?: number, gitFile?: string): Git;
 /**
  * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
  * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic

package/dist/teardown-git.js

@@ -190,7 +190,7 @@ function nestedRepository(path) {
  * repository (boundDirs; `binding.repo` when the caller has the project's), is refused; so is a command whose
  * repository changed under it while git ran.
  */
-async function inView(cwd, binding, work, after = true) {
+async function inView(cwd, binding, work, after = true, lockTimeoutMs, gitFile = "git") {
     const root = checkoutRootOf(cwd);
     if (root === null)
         return NOT_A_REPOSITORY;
@@ -206,7 +206,7 @@ async function inView(cwd, binding, work, after = true) {
         return await withCheckoutLock(realpathSync(homedir()), key, async () => {
             let view;
             try {
-                view = gitView(root, "write", binding);
+                view = gitView(root, "write", binding, gitFile);
             }
             catch (error) {
                 return refused(error instanceof Error ? error.message : "the checkout couldn't be read");
@@ -221,7 +221,7 @@ async function inView(cwd, binding, work, after = true) {
             finally {
                 view.dispose();
             }
-        });
+        }, lockTimeoutMs);
     }
     catch (error) {
         return refused(error instanceof Error ? error.message : "the checkout is busy");
@@ -234,11 +234,11 @@ async function inView(cwd, binding, work, after = true) {
  * target is bound to the same repository as the folder it is removed from. A removal without --force runs under the
  * target's own view (its own config.worktree folded in), so git's last check of whether it is clean reads it as the
  * target itself would. `binding.repo`: the project's main checkout, from the plane's records, when the caller has it. */
-export function teardownGit(runner = run, binding = {}) {
+export function teardownGit(runner = run, binding = {}, lockTimeoutMs, gitFile = "git") {
     const options = (cwd, env) => ({ cwd, envAllowlist: ENV_ALLOWLIST, env: { ...ENV, ...env }, timeoutMs: WORKTREE_TIMEOUT_MS, maxBuffer: 512 * 1024 * 1024 });
     const configProblem = async (cwd, env) => {
         // git-lfs's own filters may stand only beside a .lfsconfig that names no extension (commandSetting's lfsChecked).
-        if (lfsExtensionIn(env["GIT_WORK_TREE"] ?? cwd))
+        if (lfsExtensionIn(env["GIT_WORK_TREE"] ?? cwd, gitFile))
             return refused("the checkout's .lfsconfig sets a git-lfs key that can run a command");
         const config = await runner("git", ["--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], options(cwd, env));
         if (config.code !== 0)
@@ -287,8 +287,8 @@ export function teardownGit(runner = run, binding = {}) {
             // the target's view, inspected above, so it judges the target by the target's own settings.
             return ran(removal && !forced ? { ...view.env, GIT_COMMON_DIR: targetView.env["GIT_COMMON_DIR"] } : view.env);
             // A removed target has no git directory left to prove: the folder it was removed from is proven instead.
-        }, !removal);
-    });
+        }, !removal, lockTimeoutMs, gitFile);
+    }, true, lockTimeoutMs, gitFile);
 }
 /**
  * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.78",
+  "version": "0.9.79",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"