toolroll 0.9.92 → 0.9.94

package/dist/release-card.js

@@ -20,13 +20,17 @@ import { createHash } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { checkAccessWords } from "./check-access.js";
+import { ranWords } from "./check-stamp.js";
 import { CHECK_LEVEL_WORDS, effectiveCheckLevel } from "./check-levels.js";
 import { verifiedRange } from "./commit-extract.js";
-import { releaseTermsSchema } from "./contracts/release-terms.js";
+import { releaseCheckPurposeSchema, releaseTermsSchema } from "./contracts/release-terms.js";
+import { readVerifiedCommit } from "./commit-extract.js";
+import { cleanTerminalLine } from "./terminal-text.js";
 import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
 import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+import { taskCheckStamp } from "./store.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -91,6 +95,30 @@ export const RELEASE_TERM_LABELS = {
     "policy.unsandboxedCarry": "Carry when checks aren't sandboxed",
     "grant.id": "Release check grant", "grant.digest": "Release check grant digest", access: "Release check access", expiresAt: "Expires",
 };
+/** Every field of a release check's purpose (contracts/release-terms.ts releaseCheckPurposeSchema): the sealed form
+ * Toolroll's own releases take while their checks run outside the sandbox. A contract test checks every leaf has one. */
+export const RELEASE_CHECK_LABELS = {
+    version: "Release check version", purpose: "Approved as", repo: "Repository", packageVersion: "Package version", branch: "Branch", pr: "Pull request",
+    base: "Base", approvedSha: "Approved commit", approvedTree: "Approved tree", "grant.id": "Release check grant", "grant.digest": "Release check grant digest",
+    access: "Release check access",
+};
+export function releaseSealOf(scope) {
+    if (scope === null)
+        return null;
+    if (scope.releaseTerms != null)
+        return { kind: "terms", terms: scope.releaseTerms, identity: scope.releaseTerms };
+    if (scope.releaseCheck != null)
+        return { kind: "check", purpose: scope.releaseCheck, identity: scope.releaseCheck };
+    return null;
+}
+/** What an unsandboxed (or sign-ins) release check means, said before anyone approves it. Null in the sandbox. */
+export function releaseAccessWords(access) {
+    if (access === "unsandboxed")
+        return "The release check runs this commit's code with full access to this computer.";
+    if (access === "sign-ins")
+        return "The release check runs this commit's code with your sign-ins on this computer.";
+    return null;
+}
 /** The leaf paths of a zod object schema (nested objects joined with dots). */
 export function schemaLeaves(schema, prefix = "") {
     const shape = schema.shape;
@@ -140,6 +168,15 @@ export function approvalTermsOf(store, scope, words) {
                 lines.push({ key: leaf.path, label: `Phase route ${leaf.path.slice("route.".length)}`, value: leaf.value });
     }
     const terms = scope.releaseTerms ?? null;
+    // A release check's purpose (the form Toolroll's own releases seal): every one of its fields, never "none".
+    if (terms === null && scope.releaseCheck != null) {
+        const purpose = scope.releaseCheck;
+        for (const path of schemaLeaves(releaseCheckPurposeSchema)) {
+            const value = path === "pr" ? `#${purpose.pr}` : path === "purpose" ? "a release check: every later commit asks again" : said(valueAt(purpose, path));
+            lines.push({ key: `releaseCheck.${path}`, label: RELEASE_CHECK_LABELS[path] ?? path, value });
+        }
+        return lines;
+    }
     for (const path of schemaLeaves(releaseTermsSchema)) {
         const label = RELEASE_TERM_LABELS[path] ?? path;
         const value = terms === null ? NONE : path === "pr" ? `#${terms.pr}`
@@ -195,20 +232,120 @@ export function commitsBetween(repo, from, to) {
     const range = verifiedRange(gitDir, from, to, { git: tools.git, env });
     if (!range.ok)
         return null;
-    return range.value.map(one => ({ sha: one.id, subject: one.message.split("\n")[0].trim() }));
+    return range.value.map(one => ({ sha: one.id, subject: subjectText(one.message) }));
 }
-/** A pull request's own commits from GitHub, for the recorded owner/name. Null when GitHub can't be read. */
-function pullRequestCommits(slug, pr) {
-    const tools = releaseTools();
-    const read = spawnSync(tools.gh, ["api", `repos/${slug}/pulls/${pr}/commits?per_page=100`, "--jq", '.[] | .sha + "\\t" + (.commit.message | split("\\n")[0])'], { cwd: "/", env: releaseGitEnv(), encoding: "utf8", timeout: 15_000 });
-    if (read.status !== 0)
+/** GitHub lists at most this many of a pull request's commits; a longer one is never shown as complete. */
+export const PULL_REQUEST_COMMITS_MAX = 250;
+/** A commit subject is someone else's text: one line, control-free (src/terminal-text.ts), bounded. The card digest
+ * binds this cleaned text, so every surface shows exactly what was bound (Codex round 2, finding 7). */
+export const subjectText = (subject) => cleanTerminalLine(subject.split("\n")[0] ?? "").trim().slice(0, 200);
+const ghRead = args => {
+    const read = spawnSync(releaseTools().gh, args, { cwd: "/", env: releaseGitEnv(), encoding: "utf8", timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+    return { status: read.status, stdout: String(read.stdout ?? "") };
+};
+/**
+ * A pull request's own commits from GitHub, for the recorded owner/name, complete and bound to the candidate (Codex
+ * round 2, finding 6): every page (`--paginate`), accepted only when the pull request's head is `head`, the newest
+ * listed commit is `head` and the count is the pull request's own count. Otherwise why, never a shortened list.
+ */
+export function pullRequestCommits(slug, pr, head, read = ghRead) {
+    const about = read(["api", `repos/${slug}/pulls/${pr}`, "--jq", '[.head.sha, (.commits|tostring)] | join("\\t")']);
+    if (about.status !== 0)
+        return { ok: false, why: "GitHub couldn't be read" };
+    const [prHead, countText] = about.stdout.trim().split("\t");
+    const total = Number(countText);
+    if (prHead !== head)
+        return { ok: false, why: `the pull request is at ${SHA.test(prHead ?? "") ? prHead.slice(0, 7) : "another commit"}, not ${head.slice(0, 7)}` };
+    if (!Number.isSafeInteger(total) || total < 1)
+        return { ok: false, why: "GitHub didn't say how many commits the pull request has" };
+    if (total > PULL_REQUEST_COMMITS_MAX)
+        return { ok: false, why: `incomplete: the pull request has ${total} commits and GitHub lists only ${PULL_REQUEST_COMMITS_MAX}` };
+    const listed = read(["api", "--paginate", `repos/${slug}/pulls/${pr}/commits?per_page=100`, "--jq", '.[] | .sha + "\\t" + ((.commit.message | split("\\n")[0]) | @json)']);
+    if (listed.status !== 0)
+        return { ok: false, why: "GitHub couldn't be read" };
+    const commits = [];
+    for (const line of listed.stdout.split("\n")) {
+        if (line === "")
+            continue;
+        const tab = line.indexOf("\t");
+        const sha = line.slice(0, tab);
+        let subject;
+        try {
+            subject = JSON.parse(line.slice(tab + 1));
+        }
+        catch {
+            return { ok: false, why: "GitHub's answer didn't parse" };
+        }
+        if (tab < 0 || !SHA.test(sha) || typeof subject !== "string")
+            return { ok: false, why: "GitHub's answer didn't parse" };
+        commits.push({ sha, subject: subjectText(subject) });
+    }
+    if (commits.length !== total)
+        return { ok: false, why: `incomplete: GitHub listed ${commits.length} of ${total} commits` };
+    if (commits[commits.length - 1].sha !== head)
+        return { ok: false, why: `the newest commit GitHub listed isn't ${head.slice(0, 7)}` };
+    if (new Set(commits.map(one => one.sha)).size !== commits.length)
+        return { ok: false, why: "GitHub listed a commit twice" };
+    return { ok: true, commits: commits.reverse() };
+}
+/** The ledger act that records a verified release (the merged tree proved equal to the approved one). */
+export const RELEASE_VERIFIED_ACTION = "release verified";
+/** The project's own Git directory: `<realpath(repo)>/.git`, a real directory. */
+function gitDirOf(repo) {
+    try {
+        const named = join(realpathSync(repo), ".git");
+        return lstatSync(named).isDirectory() ? realpathSync(named) : null;
+    }
+    catch {
         return null;
-    return read.stdout.split("\n").filter(line => line !== "").map(line => { const tab = line.indexOf("\t"); return { sha: line.slice(0, tab), subject: line.slice(tab + 1) }; })
-        .filter(one => SHA.test(one.sha)).reverse();
+    }
 }
-/** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
-export function releaseChangeList(store, terms) {
-    const record = releaseBaselineRecord(store, terms.repo);
+/**
+ * Record a verified release (Codex round 2, finding 1: verified release history apart from carrying). The coordinator
+ * calls it once main's merge commit was proved to hold the approved tree; the plane proves it again here, from its own
+ * records only: the task is a release scope of a project, and `merge` read as a verified Git object from the project's
+ * recorded Git directory has exactly the sealed approved tree. False when anything doesn't hold (nothing written).
+ */
+export function recordVerifiedRelease(store, input) {
+    if (!SHA.test(input.merge))
+        return false;
+    const repo = store.lookupRef(input.taskId)?.repo ?? null;
+    const seal = releaseSealOf(store.getScope(input.taskId));
+    if (repo === null || seal === null || seal.identity.repo !== repo)
+        return false;
+    const gitDir = gitDirOf(repo);
+    if (gitDir === null)
+        return false;
+    const commit = readVerifiedCommit(gitDir, input.merge);
+    if (!commit.ok || commit.value.tree !== seal.identity.approvedTree)
+        return false;
+    if (store.handle.prepare("SELECT 1 FROM action_ledger WHERE task_id = ? AND action = ? AND detail = ?").get(input.taskId, RELEASE_VERIFIED_ACTION, input.merge) !== undefined)
+        return true;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo, taskId: input.taskId, runId: null, action: RELEASE_VERIFIED_ACTION, outcome: seal.identity.packageVersion,
+        source: "work", detail: input.merge });
+    return true;
+}
+/**
+ * The last verified release of `repo`, from either record: a merged release authority's succeeded merge, or a verified
+ * release row (recordVerifiedRelease). The newer stands. Shaped as releaseBaselineRecord.
+ */
+export function verifiedReleaseBaseline(store, repo) {
+    const authority = store.handle.prepare(`SELECT o.external_ref, COALESCE(o.finished_at, '') AS at FROM release_authority a LEFT JOIN release_operation o
+    ON o.authority = a.id AND o.kind = 'merge' AND o.state = 'succeeded'
+    WHERE a.repo = ? AND a.state = 'merged' ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    const verified = store.handle.prepare("SELECT detail, at FROM action_ledger WHERE repo = ? AND action = ? ORDER BY id DESC LIMIT 1").get(repo, RELEASE_VERIFIED_ACTION);
+    const verifiedSha = typeof verified?.["detail"] === "string" && SHA.test(verified["detail"]) ? verified["detail"] : null;
+    if (verified !== undefined && verifiedSha !== null && (authority === undefined || String(verified["at"]) >= String(authority["at"])))
+        return { recorded: true, sha: verifiedSha };
+    if (authority === undefined)
+        return verified === undefined ? { recorded: false } : { recorded: true, sha: null };
+    const ref = authority["external_ref"];
+    return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
+}
+/** What changed since the last verified release, for a release's sealed identity (terms or a release check's purpose),
+ * from Toolroll's records only. */
+export function releaseChangeList(store, terms, read) {
+    const record = verifiedReleaseBaseline(store, terms.repo);
     // A release recorded with a merge commit that can't be read: the list couldn't be read (eval-harness review 2,
     // finding 4) — never the pull request's commits, as if there were no previous release.
     if (record.recorded && record.sha === null)
@@ -216,6 +353,7 @@ export function releaseChangeList(store, terms) {
     const baseline = record.recorded ? record.sha : null;
     let commits;
     let source;
+    let why;
     if (baseline !== null) {
         commits = commitsBetween(terms.repo, baseline, terms.approvedSha);
         source = commits === null ? "unread" : "recorded";
@@ -223,10 +361,14 @@ export function releaseChangeList(store, terms) {
     else {
         const remote = store.projectRemote(terms.repo);
         const parsed = remote === null ? null : releaseRemote(remote);
-        commits = parsed === null ? null : pullRequestCommits(parsed.slug, terms.pr);
+        const listed = parsed === null ? { ok: false, why: "the project has no GitHub remote on record" } : pullRequestCommits(parsed.slug, terms.pr, terms.approvedSha, read);
+        commits = listed.ok ? listed.commits : null;
+        if (!listed.ok)
+            why = listed.why;
         source = commits === null ? "unread" : "pull-request";
     }
-    return { baseline, commits, source, digest: sha256(`release-changes:${JSON.stringify({ baseline, source, commits })}`) };
+    return { baseline, commits, source, ...(why === undefined ? {} : { why }),
+        digest: sha256(`release-changes:${JSON.stringify(why === undefined ? { baseline, source, commits } : { baseline, source, commits, why })}`) };
 }
 /** The card digest: everything the person is shown that can change under them. */
 export function cardDigestOf(scopeDigest, formDigest, changes) {
@@ -236,25 +378,39 @@ function changeWords(changes, terms, cap) {
     const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
         : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
     if (changes.commits === null)
-        return [head, changes.baseline === null && changes.baselineUnreadable !== true ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+        return [head, changes.baseline === null && changes.baselineUnreadable !== true ? `The pull request's commits couldn't be read${changes.why === undefined ? "" : ` (${changes.why})`}; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
     if (changes.commits.length === 0)
         return [head, "No commits."];
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
 }
 /** The release card for a deploy gate, against the live records now. */
-export function releaseCardOf(store, scope, formDigest, words) {
+/** How this task's last check ran, when one did and it wasn't plainly sandboxed: the sealed level above is what will run;
+ * this is what did. Nothing for a release no check has run for. */
+function lastCheckWords(store, repo, taskId) {
+    const ran = repo === null ? null : taskCheckStamp(store, repo, taskId);
+    const words = ran === null ? null : ranWords(ran.reading);
+    return words === null ? [] : [`Last check: ${words}.`];
+}
+export function releaseCardOf(store, scope, formDigest, words, read) {
     const terms = scope.releaseTerms ?? null;
+    // Either sealed form (Codex round 2, finding 1): the identity both share, for the head lines and the change list.
+    const identity = releaseSealOf(scope)?.identity ?? null;
     const lines = approvalTermsOf(store, scope, words);
     const value = (key) => lines.find(line => line.key === key)?.value ?? NONE;
-    const changes = terms === null
+    const changes = identity === null
         ? { baseline: null, commits: null, source: "unread", digest: sha256("release-changes:none") }
-        : releaseChangeList(store, terms);
-    const version = terms?.packageVersion ?? null;
+        : releaseChangeList(store, identity, read);
+    const version = identity?.packageVersion ?? null;
     const fileName = `release-${version ?? scope.taskId.replace(/[^A-Za-z0-9._-]/g, "-")}-terms.txt`;
     const short = [
         version === null ? `Deploy gate: ${value("title")}` : `Release ${version}: ${value("title")}`,
-        terms === null ? `Candidate ${said(scope.candidate).slice(0, 12)} · ${value("project")}` : `${projectName(terms.repo)} · ${terms.branch} · pull request #${terms.pr} · commit ${terms.approvedSha.slice(0, 7)}`,
-        terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
+        identity === null ? `Candidate ${said(scope.candidate).slice(0, 12)} · ${value("project")}` : `${projectName(identity.repo)} · ${identity.branch} · pull request #${identity.pr} · commit ${identity.approvedSha.slice(0, 7)}`,
+        terms === null ? identity === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: no, every later commit asks again · checks: ${value("checks")}`
+            : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
+        // What an unsandboxed check means, before consent (Codex round 2, finding 1).
+        ...(identity === null || releaseAccessWords(identity.access) === null ? [] : [releaseAccessWords(identity.access)]),
+        // A check that already ran for this task, from its stamp (H2): never read as sandboxed when it can't be shown.
+        ...lastCheckWords(store, identity?.repo ?? null, scope.taskId),
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
         // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.
@@ -262,10 +418,10 @@ export function releaseCardOf(store, scope, formDigest, words) {
         // GitHub's nightly (nightly-github.ts): what holds this release, or why it can't be read. Not a signed term.
         ...(terms === null ? [] : nightlyReleaseLines(store, { repo: terms.repo, taskId: scope.taskId, candidate: scope.candidate ?? null, now: new Date() })),
         "",
-        ...changeWords(changes, terms, 5),
+        ...changeWords(changes, identity, 5),
         "",
         `Every term is in ${fileName}.`,
     ].join("\n");
-    const full = [`${version === null ? "Deploy gate" : `Release ${version}`}: every term`, "", termsText(lines), "", ...changeWords(changes, terms, 200)].join("\n");
+    const full = [`${version === null ? "Deploy gate" : `Release ${version}`}: every term`, "", termsText(lines), "", ...changeWords(changes, identity, 200)].join("\n");
     return { digest: cardDigestOf(scope.digest, formDigest, changes), short, full, fileName, changes };
 }

package/dist/release-carry.d.ts

@@ -44,8 +44,13 @@ export declare function stricterOf(a: ReleasePolicy | null, b: ReleasePolicy | n
  * the rules don't rely on that).
  */
 export declare function rulePath(path: string): string;
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy): string | null;
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy, fresh?: ReadonlySet<string>): string | null;
 /**
  * A release scope's terms, from the plane's own records: the project's repository, the approved commit and its
  * verified tree, the effective policy, the live release check grant and the check access (only the fence), and the

package/dist/release-carry.js

@@ -26,14 +26,17 @@ import { join, sep } from "node:path";
 import { execFileSync } from "node:child_process";
 import { checkLaunchRoot, fenceFor, linuxFenceAvailable, macosFenceAvailable, runFolders } from "./agent-fence.js";
 import { touchesProtected } from "./approval-policy.js";
-import { extractCommit, readVerifiedCommit, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { extractCommit, readVerifiedCommit, verifiedBlobs, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { testImportProblem } from "./test-infra.js";
 import { projectGitDir } from "./check-report.js";
+import { checkAccessOf } from "./check-access.js";
+import { stampRefusal } from "./check-stamp.js";
 import { CARRY_RULES_VERSION, readReleasePolicy, releasePolicyDigest } from "./contracts/release-terms.js";
 import { run } from "./exec.js";
 import { proxyEnv, startEgressProxy } from "./egress.js";
 import { liveReleaseOf } from "./scope.js";
 import { UNSANDBOXED_CARRY_ACTION, carriesUnsandboxed } from "./release-authority.js";
-import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, } from "./store.js";
+import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, taskCheckStamp, } from "./store.js";
 // ------------------------------------------------------------------ the rules
 /** The journey scripts: tests, by Alex's decision (they carry). */
 export const JOURNEY_SCRIPTS = Object.freeze(["scripts/app-e2e.mjs", "scripts/flows-e2e.mjs"]);
@@ -111,8 +114,15 @@ export function stricterOf(a, b) {
 export function rulePath(path) {
     return path.toLowerCase().split("/").map(part => part.replace(/[. ]+$/, "")).filter(part => part !== "" && part !== ".").join("/");
 }
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export function changeRefusal(change, policy) {
+/** Tests by the rules' classes: what the existing-test rule holds still. */
+const carriedTest = (normal) => CARRY_RULES.classes.some(one => (one.name === "unit tests" || one.name === "journey scripts") && one.matches(normal));
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export function changeRefusal(change, policy, fresh = new Set()) {
     const path = change.path;
     const normal = rulePath(path);
     if (change.kind === "deleted")
@@ -133,6 +143,8 @@ export function changeRefusal(change, policy) {
         return `${path} is protected in this project`;
     if (!CARRY_RULES.classes.some(one => one.matches(normal)))
         return `${path} isn't a test, a doc or the changelog`;
+    if (change.kind === "modified" && carriedTest(normal) && !fresh.has(path))
+        return `${path} changes an existing test, and new tests go in a new file`;
     return null;
 }
 // ------------------------------------------------------------------ release terms
@@ -211,6 +223,11 @@ export function preflightCarry(store, input) {
     if ((a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed") && policy.unsandboxedCarry !== true) {
         return refuse("rules", "This project's checks run outside the sandbox, and carrying release approvals then wasn't on when this release was approved, or is off now.");
     }
+    // A carry leans on the check the release already had: it must be shown to have stayed within what was approved (H2).
+    const ran = taskCheckStamp(store, a.repo, a.tipTask);
+    const unshown = ran === null ? null : stampRefusal(ran.reading, checkAccessOf(a.accessDigest));
+    if (unshown !== null)
+        return refuse("rules", `This release's approval can't carry: ${unshown}.`);
     if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(input.to))
         return refuse("ancestry", `${input.to} isn't a full commit id.`);
     if (input.to === a.tipSha)
@@ -234,6 +251,10 @@ export function preflightCarry(store, input) {
         treeOf.set(commit.id, commit.tree);
     const commits = [];
     let churn = 0;
+    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
+    if (!whole.ok)
+        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
+    const fresh = new Set(whole.value.filter(one => one.kind === "added").map(one => one.path));
     for (const commit of ordered) {
         const parentTree = treeOf.get(commit.parents[0]);
         if (parentTree === undefined)
@@ -242,21 +263,30 @@ export function preflightCarry(store, input) {
         if (!diff.ok)
             return refuse("shape", `${commit.id.slice(0, 7)} couldn't be read: ${diff.message}`);
         for (const change of diff.value) {
-            const why = changeRefusal(change, policy);
+            const why = changeRefusal(change, policy, fresh);
             if (why !== null)
                 return refuse("rules", `${commit.id.slice(0, 7)}: ${why}.`, change.path);
         }
         churn += diff.value.reduce((n, one) => n + one.added + one.deleted, 0);
         commits.push({ sha: commit.id, files: diff.value.map(one => ({ path: one.path, added: one.added, deleted: one.deleted })) });
     }
-    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
-    if (!whole.ok)
-        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
     for (const change of whole.value) {
-        const why = changeRefusal(change, policy);
+        const why = changeRefusal(change, policy, fresh);
         if (why !== null)
             return refuse("rules", `Since the approval: ${why}.`, change.path);
     }
+    // No new test may reach into another (H4). Read from the verified tree, never from a checkout.
+    // By the rules' own classifier, so everything that carries as a test is read (a new journey script too).
+    const newTests = whole.value.filter(one => one.kind === "added" && carriedTest(rulePath(one.path))).map(one => one.path);
+    const added = newTests.length === 0 ? null : verifiedBlobs(gitDir, chain[0].tree, newTests);
+    if (added !== null && !added.ok)
+        return refuse("shape", `The new tests couldn't be read: ${added.message}`);
+    for (const path of newTests) {
+        const bytes = added !== null && added.ok ? added.value.get(path)?.bytes : undefined;
+        const why = bytes === undefined ? `${path} couldn't be read` : testImportProblem(path, bytes.toString("utf8"));
+        if (why !== null)
+            return refuse("rules", `Since the approval: ${why}.`, path);
+    }
     const changedLines = whole.value.reduce((n, one) => n + one.added + one.deleted, 0);
     if (changedLines > policy.limits.lines)
         return refuse("limits", `${changedLines} lines changed since the approval; at most ${policy.limits.lines} carry.`);

package/dist/release-cli.d.ts

@@ -8,6 +8,7 @@
 import { type ReleaseAdapters } from "./release.js";
 import { type GateReleaseWorld } from "./release-gate.js";
 import { type RescueWorld } from "./deploy-rescue.js";
+import { type RunLockSeams, type SettleWorld } from "./release-next.js";
 export declare const RELEASE_HELP: string;
 /** A runner lease id (claim.ts mints randomUUID()). */
 export declare const LEASE_SHAPED: RegExp;
@@ -23,6 +24,9 @@ export type ReleaseCliDeps = {
     gateWorld?: GateReleaseWorld;
     /** What --recover-deploy reads and runs (deploy-rescue.ts); the installation's own by default. */
     rescueWorld?: RescueWorld;
+    /** What a stopped deployment left, settled before the release goes on (release-next.ts). Tests that inject adapters skip it. */
+    settle?: SettleWorld;
+    runLock?: RunLockSeams;
     /** The plane's database for the authority commands (default: this installation's). */
     database?: string;
     now?: () => Date;

package/dist/release-cli.js

@@ -16,6 +16,7 @@ import { RELEASE_LIMITS, runRelease } from "./release.js";
 import { processes, releaseAdapters } from "./release-adapters.js";
 import { journals, releaseGate } from "./release-gate.js";
 import { rescueDeployment } from "./deploy-rescue.js";
+import { settleDeployment, takeReleaseRun } from "./release-next.js";
 import { databasePath, elapsedSeconds, latestReleaseStepTask, openStore, releaseProgressFor, revokeRelease } from "./store.js";
 import { dur } from "./design/kit.js";
 import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit, setUnsandboxedCarry } from "./release-carry.js";
@@ -34,27 +35,22 @@ export const RELEASE_HELP = `toolroll release <branch> — release Toolroll itse
   squash-merges, deletes the matching remote branch, verifies the merged tree and tags. Both macOS legs gate npm
   publication; Homebrew waits for its checks to register and all pass before merging.
 
-  Run the same command to resume after a stop. Interrupted deployments recover their saved stage before retrying.
+  Run the same command to go on after any stop. It reads where the release got to and does the one thing that's next:
+  finishes a deployment forward, puts one back, lifts a pause left before a swap, waits for another run of the release
+  (naming its computer and process), or waits for your approval. It says what it did. A branch behind main is brought up
+  to date for you; that new commit needs its own approval, CI and check.
 
-  A branch whose name is one of this command's own words (status, nightly, carry…) is named with --branch <name>
+  A branch whose name is one of this command's own words (approve, status, nightly, carry…) is named with --branch <name>
   or after --: \`toolroll release --branch status\`.
 
+toolroll release approve [<branch>] [--repo <path>] — approve the release waiting for you: shows the release, GitHub CI
+  now, what approving does, what changed and every term, then asks for your password (or uses your remembered login
+  where Passwordless allows it). Names the waiting releases when more than one could be meant. With --json it never
+  prompts: --as <you> --token <password> --digest <card digest>
+
 toolroll release status [<task>] — the steps of a release (the newest one recorded, or the release task named): each
   step's state and how long it took, and where it stopped
 
-toolroll release --release-gate <id> [--yes] — lift the update pause a deployment left before its swap
-
-  Shows why it is safe first: the pause is that deployment's, its journal stopped before the swap, and the
-  database, service definition and running service are all still the previous build's. --yes lifts that one pause.
-  Any missing or contradicting evidence refuses and leaves the pause in place.
-
-toolroll release --recover-deploy [--stage <dir>] [--yes] — put back a deployment that stopped half way
-
-  Finds the one unfinished deployment (or the stage named) and shows what its recovery will do; --yes does it. When
-  the old service isn't proved stopped, it boots the service out and stops what it left running, but only processes
-  proved, by exact runtime path and arguments, to be that deployment's own; then it starts the previous service
-  again, waits for it, and lifts the update pause. Anything it can't prove refuses. Safe to run again.
-
 toolroll release carry <release> --to <commit> [--request <id>] — carry a person's release approval to a later commit
 
   Only tests, docs and the changelog may change after the approval, within the limits, with an identical production
@@ -95,10 +91,6 @@ Options
   --new                  release a new commit on the branch, setting the earlier unfinished release aside
   --limit <step>=<min>   change one step's time limit (${Object.entries(RELEASE_LIMITS).map(([step, minutes]) => `${step} ${minutes}`).join(", ")})
   --tap <owner/name>     the Homebrew tap (default ap9000/homebrew-toolroll)
-  --release-gate <id>    check (and with --yes, lift) one update pause left before a deployment's swap
-  --yes                  with --release-gate: lift the pause once it is proved safe; with --recover-deploy: recover
-  --recover-deploy       recover the unfinished deployment (see above)
-  --stage <dir>          with --recover-deploy: the deployment's staging folder, when more than one is unfinished
   --json                 answer with one machine envelope
 
 A runner's lease is returned with \`toolroll worker release <lease>\`.`;
@@ -233,6 +225,9 @@ export async function runReleaseCommand(args, write, deps = {}) {
             return refuse("usage", "`toolroll release status [<task>]` takes only --json.", 2);
         return runStatusCommand(positional[1], write, json, deps);
     }
+    // `release approve` is the toolroll command's own (cli.ts routes it to the operate commands); never a branch here.
+    if (!named && positional[0] === "approve")
+        return refuse("usage", "Run `toolroll release approve [<branch>]`. A branch named approve is released with `--branch approve`.", 2);
     if (!named && positional[0] === "nightly" && positional.length === 1)
         return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: bare.has("--start") }, write, json, deps);
     if (!named && ["carry", "revoke", "ask-every-commit", "unsandboxed-carry", "auto-approve", "publish-ok"].includes(positional[0] ?? "") && positional.length === 2) {
@@ -262,8 +257,23 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const adapters = deps.adapters === undefined
         ? releaseAdapters({ checkout, say, ...(tap === undefined ? {} : { tap }), ...(limits["deploy"] === undefined ? {} : { deployMinutes: limits["deploy"] }) })
         : { ...deps.adapters, say };
-    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
-    return report(outcome, write, json, lines);
+    // One command: wait out another run of this release, settle what a stopped deployment left, then go on from the journal.
+    const taken = await takeReleaseRun(stateDir, branch, say, deps.runLock);
+    if (!taken.ok)
+        return refuse("running", `Another release of ${branch} is still running on ${taken.holder.host} (process ${taken.holder.pid}). Nothing was changed.`, 3);
+    try {
+        const world = deps.settle ?? (deps.adapters === undefined ? { rescue: installedRescueWorld(checkout), gate: installedGateWorld() } : null);
+        if (world !== null) {
+            const settled = await settleDeployment(world, say);
+            if (!settled.ok)
+                return refuse("deployment", settled.message, 3);
+        }
+        const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
+        return report(outcome, write, json, lines);
+    }
+    finally {
+        taken.release();
+    }
 }
 function report(outcome, write, json, lines) {
     const release = outcome.journal === null ? null : {
@@ -582,10 +592,15 @@ async function runStatusCommand(task, write, json, deps) {
         }
         const word = { running: "running", waiting: "waiting", done: "done", failed: "failed" };
         write(`Release ${progress.version} (${progress.tag})${progress.pr === null ? "" : ` · pull request #${progress.pr}`} · task ${taskId}`);
-        for (const one of steps)
-            write(`  ${one.step.padEnd(9)} ${word[one.state].padEnd(8)} ${one.seconds === null ? "–" : dur(one.seconds)}${one.detail === null ? "" : `  ${one.detail}`}`);
+        for (const one of steps) {
+            // A failure the release has gone on from is history, as on the task page.
+            const passed = one.state === "failed" && progress.stopped === null;
+            write(`  ${one.step.padEnd(9)} ${(passed ? "went on" : word[one.state]).padEnd(8)} ${one.seconds === null ? "–" : dur(one.seconds)}${one.detail === null ? "" : `  ${one.detail}`}`);
+        }
         if (progress.stopped !== null)
             write(`Stopped at ${progress.stopped.step}: ${progress.stopped.message}`);
+        if (progress.building !== null)
+            write(`Build #${progress.building.run} is running the check.`);
         return 0;
     }
     finally {

package/dist/release-coverage.js

@@ -26,7 +26,7 @@ export const gitIsAncestor = (repo, ancestor, descendant) => {
     let answer;
     try {
         // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
-        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000 }).status;
+        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000, binding: { repo } }).status;
         if (status !== 0)
             throw Object.assign(new Error("git merge-base"), { status });
         answer = true;

package/dist/release-next.d.ts

@@ -0,0 +1,48 @@
+import { type RescueWorld } from "./deploy-rescue.js";
+import { type GateReleaseWorld } from "./release-gate.js";
+import { type ReleaseJournal } from "./release.js";
+import type { Store } from "./store.js";
+/** How long a run waits for another before it says so and stops. */
+export declare const RELEASE_WAIT_MS: number;
+export type RunHolder = {
+    host: string;
+    pid: number;
+};
+export type RunLockSeams = {
+    host?: string;
+    pid?: number;
+    alive?: (pid: number) => boolean;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    waitMs?: number;
+    pollMs?: number;
+};
+/** Take this branch's run lock, waiting for a live holder. Answers how to give it back, or who kept it. */
+export declare function takeReleaseRun(stateDir: string, branch: string, say: (line: string) => void, seams?: RunLockSeams): Promise<{
+    ok: true;
+    release: () => void;
+} | {
+    ok: false;
+    holder: RunHolder;
+}>;
+export type SettleWorld = {
+    rescue: RescueWorld;
+    gate: GateReleaseWorld;
+};
+export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
+/** The one action a deployment's journal calls for. */
+export declare function deployActionOf(phase: unknown): DeployAction;
+/** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
+export declare function settleDeployment(world: SettleWorld, say: (line: string) => void): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+}>;
+export declare const RELEASE_RESUMED_ACTION = "release resumed";
+/**
+ * A person let a held release go on (release-auto.ts allowAutoPublish; the Release sheet's button or `publish-ok`): each
+ * sweep, its journal goes on from where it stopped, once per that person's act, under the same run lock. It was merged
+ * already, so only the tag, publication and Homebrew are left, and each re-proves itself.
+ */
+export declare function resumeAllowedReleases(store: Store, stateDir: string, run: (journal: ReleaseJournal) => Promise<unknown>, now: Date): Promise<number>;