toolroll 0.9.92 → 0.9.94

package/dist/repository-context.js

@@ -1,11 +1,12 @@
 /** Optional repository context. Callers admit project access; this module grants no authority.
  * The index is disposable. Every read hashes the current bounded tracked source set;
  * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
-import { checkoutGitSync } from './teardown-git.js';
+import { checkoutGitSync, viewedGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { scanForSecrets } from './evidence.js';
+import { compilerOptionsOf, extractFile, resolveAll } from './code-extract.js';
 const VERSION = 1;
 const MAX_FILES = 1200, MAX_FILE_BYTES = 256_000, MAX_SOURCE_BYTES = 12_000_000;
 const CODE = /\.(?:[cm]?[jt]sx?)$/i;
@@ -15,31 +16,23 @@ const sha = (value) => createHash('sha256').update(value).digest('hex');
 // Read-only and bounded, and always the hardened checkout git (a crew worktree is agent-written, and a page read or a
 // lead's refresh reads it alike): no filter, hook, program or network, its config and info frozen in a view of the
 // plane's own before they're inspected (teardown-git.ts checkoutGitSync).
-const git = (repo, args) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd();
+// Bound to the project's record, so a pointer or commondir can't turn the read to another repository.
+const git = (repo, args, binding) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000, binding }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
-function capture(request) {
-    const repo = realpathSync(request.repo);
-    if (repo !== resolve(request.repo))
-        throw Error('The project location changed.');
-    if (realpathSync(git(repo, ['rev-parse', '--show-toplevel'])) !== repo)
-        throw Error('Choose the project checkout root.');
-    const head = git(repo, ['rev-parse', '--verify', 'HEAD']);
-    const baseRevision = request.baseRevision ?? head;
-    if (!/^[a-f0-9]{40,64}$/.test(baseRevision) || git(repo, ['rev-parse', '--verify', `${baseRevision}^{commit}`]) !== baseRevision)
-        throw Error('The requested context base is unavailable.');
-    if (request.audience === 'crew' && baseRevision !== head)
-        throw Error('Crew context must start at its exact task base.');
-    const gitDir = realpathSync(git(repo, ['rev-parse', '--absolute-git-dir']));
-    if (request.project && realpathSync(git(repo, ['rev-parse', '--path-format=absolute', '--git-common-dir'])) !== realpathSync(git(request.project, ['rev-parse', '--path-format=absolute', '--git-common-dir'])))
-        throw Error('The worktree belongs to a different project.');
-    const files = git(repo, ['ls-files', '-z', '--cached']).split('\0').filter(Boolean).sort();
-    const sources = [], warnings = [];
+/** Whether a tracked path is one the index reads, by its name alone. */
+const skippedPath = (file) => !TEXT.test(file) || /(?:^|\/)(?:node_modules|vendor|dist|build|coverage|\.git)(?:\/|$)/.test(file);
+const unsafePath = (file) => file.split('/').some(p => p === '..') || /[\x00-\x1f]/.test(file);
+const unreadableText = (data, text) => data.length > MAX_FILE_BYTES || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(text) || scanForSecrets(text).length > 0;
+/** The working tree's tracked files, for a lead or a person looking at the project's own checkout. */
+function workingTreeSources(repo, binding) {
+    const files = git(repo, ['ls-files', '-z', '--cached'], binding).split('\0').filter(Boolean).sort();
+    const sources = [];
     let omitted = 0, omittedBytes = 0, bytes = 0;
     for (const file of [...new Set(files)]) {
-        if (!TEXT.test(file) || /(?:^|\/)(?:node_modules|vendor|dist|build|coverage|\.git)(?:\/|$)/.test(file))
+        if (skippedPath(file))
             continue;
         const path = resolve(repo, file);
-        if (!inside(repo, path) || file.split('/').some(p => p === '..') || /[\x00-\x1f]/.test(file)) {
+        if (!inside(repo, path) || unsafePath(file)) {
             omitted++;
             continue;
         }
@@ -57,7 +50,7 @@ function capture(request) {
             }
             const data = readFileSync(path);
             const text = data.toString('utf8');
-            if (data.length > MAX_FILE_BYTES || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\ufffd]/u.test(text) || scanForSecrets(text).length) {
+            if (unreadableText(data, text)) {
                 omitted++;
                 omittedBytes += data.length;
                 continue;
@@ -69,13 +62,91 @@ function capture(request) {
             omitted++;
         }
     }
-    if (git(repo, ['rev-parse', '--verify', 'HEAD']) !== head)
+    return { sources, omitted, omittedBytes };
+}
+/**
+ * A crew's sources: the task base's tree and raw blobs, never the working tree an agent writes. A dirty tracked file,
+ * a symlink swapped in or a replace ref is not read; no filter runs on a raw blob.
+ */
+function baseCommitSources(repo, base, binding) {
+    const read = (args, maxBuffer, input) => {
+        const ran = viewedGitSync(repo, ['--no-replace-objects', ...args], { timeoutMs: 10_000, maxBuffer, binding, buffer: true, ...(input === undefined ? {} : { input }) });
+        if (ran.status !== 0)
+            throw Error('The task base could not be read.');
+        return ran.stdout;
+    };
+    const wanted = [];
+    let omitted = 0, omittedBytes = 0, bytes = 0;
+    for (const entry of read(['ls-tree', '-r', '-l', '-z', base], 16_000_000).toString('utf8').split('\0')) {
+        const match = /^(\d{6}) (\w+) ([0-9a-f]{40,64}) +(\d+|-)\t(.+)$/s.exec(entry);
+        if (!match)
+            continue;
+        const [, mode, kind, oid, sized, file] = match;
+        if (skippedPath(file))
+            continue;
+        const size = sized === '-' ? 0 : Number(sized);
+        if (unsafePath(file) || kind !== 'blob' || (mode !== '100644' && mode !== '100755')) {
+            omitted++;
+            continue;
+        }
+        if (wanted.length >= MAX_FILES || size > MAX_FILE_BYTES || bytes + size > MAX_SOURCE_BYTES) {
+            omitted++;
+            omittedBytes += size;
+            continue;
+        }
+        wanted.push({ file, oid });
+        bytes += size;
+    }
+    wanted.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+    const sources = [];
+    if (wanted.length === 0)
+        return { sources, omitted, omittedBytes };
+    const out = read(['cat-file', '--batch'], MAX_SOURCE_BYTES + wanted.length * 128 + 4096, Buffer.from(wanted.map(w => w.oid).join('\n') + '\n'));
+    let at = 0;
+    for (const { file, oid } of wanted) {
+        const end = out.indexOf(0x0a, at);
+        const header = end < 0 ? null : /^([0-9a-f]{40,64}) blob (\d+)$/.exec(out.subarray(at, end).toString('latin1'));
+        if (end < 0 || header === null || header[1] !== oid)
+            throw Error('The task base could not be read.');
+        const size = Number(header[2]);
+        const data = out.subarray(end + 1, end + 1 + size);
+        at = end + 1 + size + 1;
+        const text = data.toString('utf8');
+        if (unreadableText(data, text)) {
+            omitted++;
+            omittedBytes += data.length;
+            continue;
+        }
+        sources.push({ file, text, sha256: sha(data) });
+    }
+    return { sources, omitted, omittedBytes };
+}
+function capture(request) {
+    const repo = realpathSync(request.repo);
+    if (repo !== resolve(request.repo))
+        throw Error('The project location changed.');
+    // The project's record, never the checkout's own pointer files: the admitted project, or the one a crew worktree
+    // belongs to. Only a person's local look at an unrecorded folder has none.
+    const binding = { repo: request.project ?? null };
+    if (realpathSync(git(repo, ['rev-parse', '--show-toplevel'], binding)) !== repo)
+        throw Error('Choose the project checkout root.');
+    const head = git(repo, ['rev-parse', '--verify', 'HEAD'], binding);
+    const baseRevision = request.baseRevision ?? head;
+    if (!/^[a-f0-9]{40,64}$/.test(baseRevision) || git(repo, ['rev-parse', '--verify', `${baseRevision}^{commit}`], binding) !== baseRevision)
+        throw Error('The requested context base is unavailable.');
+    if (request.audience === 'crew' && baseRevision !== head)
+        throw Error('Crew context must start at its exact task base.');
+    const gitDir = realpathSync(git(repo, ['rev-parse', '--absolute-git-dir'], binding));
+    const crew = request.audience === 'crew';
+    const { sources, omitted, omittedBytes } = crew ? baseCommitSources(repo, baseRevision, binding) : workingTreeSources(repo, binding);
+    if (git(repo, ['rev-parse', '--verify', 'HEAD'], binding) !== head)
         throw Error('The checkout changed while context was being read.');
+    const warnings = [];
     if (omitted)
         warnings.push(`${omitted} source files were omitted because they were unavailable, excluded, sensitive or beyond the read limits.`);
     warnings.push('Tracked files only. Static imports do not establish every runtime dependency or sufficient test coverage.');
     const sourceHash = sha(JSON.stringify(sources.map(({ file, sha256 }) => [file, sha256])));
-    return { checkout: { repo, gitDir, head, baseRevision, sourceHash, source: 'working-tree' }, sources, omitted, omittedBytes, warnings };
+    return { checkout: { repo, gitDir, head, baseRevision, sourceHash, source: crew ? 'base-commit' : 'working-tree' }, sources, omitted, omittedBytes, warnings };
 }
 function cacheFile(root, checkout) {
     const absolute = resolve(root);
@@ -135,62 +206,33 @@ async function buildIndex(snapshot) {
             dir = dirname(dir);
         }
     }
-    let options = { module: compiler.ModuleKind.NodeNext, moduleResolution: compiler.ModuleResolutionKind.NodeNext, allowJs: true, resolveJsonModule: true };
     const config = byPath.get(join(snapshot.checkout.repo, 'tsconfig.json'));
+    const { options, problem } = compilerOptionsOf(compiler, join(snapshot.checkout.repo, 'tsconfig.json'), config?.text, snapshot.checkout.repo);
     const warnings = [];
-    if (config) {
-        const parsed = compiler.parseConfigFileTextToJson(join(snapshot.checkout.repo, config.file), config.text);
-        if (!parsed.error && parsed.config?.compilerOptions) {
-            const converted = compiler.convertCompilerOptionsFromJson(parsed.config.compilerOptions, snapshot.checkout.repo);
-            options = { ...options, ...converted.options };
-            if (parsed.config.extends)
-                warnings.push('Inherited tsconfig settings are not indexed; unresolved aliases remain omitted.');
-        }
-        else
-            warnings.push('TypeScript configuration could not be read; relative imports still work.');
-    }
+    if (problem === 'extends')
+        warnings.push('Inherited tsconfig settings are not indexed; unresolved aliases remain omitted.');
+    else if (problem === 'unreadable')
+        warnings.push('TypeScript configuration could not be read; relative imports still work.');
+    const resolveOne = resolveAll(compiler, snapshot.checkout.repo, byPath, directories, options, resolve);
     const nodes = [], relationships = [];
     let unresolved = 0, parseFailures = 0;
-    const host = {
-        fileExists: file => byPath.has(resolve(file)),
-        readFile: file => byPath.get(resolve(file))?.text,
-        directoryExists: dir => directories.has(resolve(dir)),
-        getCurrentDirectory: () => snapshot.checkout.repo,
-        realpath: file => resolve(file),
-    };
     for (const source of snapshot.sources.filter(s => CODE.test(s.file))) {
         const fileName = resolve(snapshot.checkout.repo, source.file);
-        const tree = compiler.createSourceFile(fileName, source.text, compiler.ScriptTarget.Latest, true);
-        if (tree.parseDiagnostics?.length)
+        const read = extractFile(compiler, fileName, source.text);
+        if (read.parseFailed)
             parseFailures++;
-        const line = (pos) => tree.getLineAndCharacterOfPosition(Math.min(pos, source.text.length)).line + 1;
-        const relationship = (specifier, kind, at) => {
-            const resolved = compiler.resolveModuleName(specifier, fileName, options, host).resolvedModule?.resolvedFileName;
-            if (!resolved || !byPath.has(resolve(resolved))) {
+        for (const one of read.declarations)
+            if (nodes.length < MAX_NODES)
+                nodes.push({ file: source.file, name: one.name, line: one.line, endLine: one.endLine });
+        for (const one of read.specifiers) {
+            const resolved = resolveOne(one.specifier, fileName);
+            if (resolved === null) {
                 unresolved++;
-                return;
+                continue;
             }
             if (relationships.length < MAX_EDGES)
-                relationships.push({ from: source.file, to: byPath.get(resolve(resolved)).file, kind, file: source.file, line: line(at), provenance: 'explicit' });
-        };
-        const visit = (node) => {
-            if (nodes.length < MAX_NODES && (compiler.isFunctionDeclaration(node) || compiler.isClassDeclaration(node) || compiler.isInterfaceDeclaration(node) || compiler.isTypeAliasDeclaration(node) || compiler.isEnumDeclaration(node) || compiler.isMethodDeclaration(node) || compiler.isVariableDeclaration(node))) {
-                const name = node.name;
-                if (name && compiler.isIdentifier(name))
-                    nodes.push({ file: source.file, name: name.text, line: line(node.getStart(tree)), endLine: line(node.end) });
-            }
-            if (compiler.isImportDeclaration(node) && compiler.isStringLiteral(node.moduleSpecifier))
-                relationship(node.moduleSpecifier.text, 'imports', node.getStart(tree));
-            if (compiler.isExportDeclaration(node) && node.moduleSpecifier && compiler.isStringLiteral(node.moduleSpecifier))
-                relationship(node.moduleSpecifier.text, 're-exports', node.getStart(tree));
-            if (compiler.isCallExpression(node) && node.arguments.length === 1 && compiler.isStringLiteral(node.arguments[0])) {
-                if (node.expression.kind === compiler.SyntaxKind.ImportKeyword)
-                    relationship(node.arguments[0].text, 'dynamic-import', node.getStart(tree));
-                // require may be shadowed; do not present a guessed call as a proven relationship.
-            }
-            compiler.forEachChild(node, visit);
-        };
-        visit(tree);
+                relationships.push({ from: source.file, to: byPath.get(resolved).file, kind: one.kind, file: source.file, line: one.line, provenance: 'explicit' });
+        }
     }
     if (unresolved)
         warnings.push(`${unresolved} external or unresolved imports were omitted.`);

package/dist/restart-certification.d.ts

@@ -77,6 +77,7 @@ export type RestartBaseline = {
             bootId: string | null;
             containment: string | null;
             open: boolean;
+            machineId?: string | null;
         }[];
     };
     limits: readonly string[];

package/dist/restart-certification.js

@@ -25,6 +25,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync } from "node:fs";
 import { bootIdentity, provenDeadByBootChange } from "./boot-identity.js";
+import { sameMachineHost } from "./machine-identity.js";
 import { containmentStatus, currentContainment } from "./containment.js";
 import { daemonStatus } from "./daemon.js";
 import { isAlive } from "./runner.js";
@@ -70,8 +71,8 @@ export async function recordRestartBaseline(inputs) {
         .map(row => ({ run: Number(row["run"]), taskRef: Number(row["task_ref"]), requestedAt: String(row["requested_at"]), problem: store.stopQuiescenceProblem(Number(row["run"])) }));
     const openRuns = raw.prepare("SELECT id, task_ref, role, runner, lease_id FROM run WHERE outcome IS NULL ORDER BY id").all()
         .map(row => ({ id: Number(row["id"]), taskRef: Number(row["task_ref"]), role: String(row["role"]), runner: String(row["runner"]), leaseId: String(row["lease_id"]) }));
-    const witnesses = raw.prepare("SELECT run, pid, host, boot_id, containment, exited_at FROM run_process WHERE exited_at IS NULL ORDER BY id").all()
-        .map(row => ({ run: Number(row["run"]), pid: row["pid"] === null ? null : Number(row["pid"]), host: String(row["host"]), bootId: row["boot_id"] === null ? null : String(row["boot_id"]), containment: row["containment"] === null ? null : String(row["containment"]), open: true }));
+    const witnesses = raw.prepare("SELECT run, pid, host, boot_id, containment, exited_at, machine_id FROM run_process WHERE exited_at IS NULL ORDER BY id").all()
+        .map(row => ({ run: Number(row["run"]), pid: row["pid"] === null ? null : Number(row["pid"]), host: String(row["host"]), bootId: row["boot_id"] === null ? null : String(row["boot_id"]), containment: row["containment"] === null ? null : String(row["containment"]), open: true, machineId: row["machine_id"] == null ? null : String(row["machine_id"]) }));
     return {
         version: 2,
         runnerName: inputs.runnerName ?? null,
@@ -123,7 +124,8 @@ export async function verifyRestartRecovery(inputs) {
     const sameDatabase = baseline.version === 2 && baseline.database.identity === current.database.identity;
     checks.push({ name: "database", ok: sameDatabase, detail: sameDatabase ? "same database file identity" : "database identity differs or baseline predates identity verification; no recovery mutations performed" });
     // 1. Boot identity, as the OS reports it.
-    const sameHost = baseline.host === current.host;
+    // This machine under any of its own names (machine-identity.ts): a reboot onto another network can move the hostname.
+    const sameHost = sameMachineHost(baseline.host, current.host);
     const bootChanged = !sameHost || baseline.boot.id === null || current.boot.id === null
         ? null
         : provenDeadByBootChange({ host: current.host, bootId: baseline.boot.id }, { host: current.host, bootId: current.boot.id });
@@ -153,7 +155,7 @@ export async function verifyRestartRecovery(inputs) {
     }
     const baselineBeats = new Map(baseline.database.runners.map(one => [one.name, one.heartbeatAt]));
     const liveRunners = current.database.runners.filter(one => !one.retired);
-    const fresh = liveRunners.filter(one => one.host === current.host && one.alive && (baseline.runnerName === null || one.name === baseline.runnerName) && baselineBeats.has(one.name) && one.heartbeatAt > baselineBeats.get(one.name));
+    const fresh = liveRunners.filter(one => sameMachineHost(one.host, current.host) && one.alive && (baseline.runnerName === null || one.name === baseline.runnerName) && baselineBeats.has(one.name) && one.heartbeatAt > baselineBeats.get(one.name));
     checks.push({
         name: "heartbeat",
         ok: fresh.length > 0,
@@ -187,8 +189,8 @@ export async function verifyRestartRecovery(inputs) {
                 ? `every run open at the baseline has ended (${baseline.database.openRuns.map(run => `#${run.id}`).join(", ")})`
                 : `still open from before: ${staleOpen.map(run => `#${run.id} (${run.role}, ${run.runner})`).join(", ")} — recovery has not run, or its lease is still live`,
     });
-    const oldWitnesses = baseline.database.witnesses.filter(one => one.bootId !== null && current.boot.id !== null && one.host === current.host);
-    const survivors = oldWitnesses.filter(one => !provenDeadByBootChange({ host: one.host, bootId: one.bootId }, { host: current.host, bootId: current.boot.id }));
+    const oldWitnesses = baseline.database.witnesses.filter(one => one.bootId !== null && current.boot.id !== null && sameMachineHost(one.host, current.host, one.machineId));
+    const survivors = oldWitnesses.filter(one => !provenDeadByBootChange({ host: one.host, bootId: one.bootId }, { host: one.host, bootId: current.boot.id }));
     checks.push({
         name: "old-boot-custody",
         ok: bootChanged !== true || survivors.length === 0,

package/dist/result-acts.d.ts

@@ -1,26 +1,25 @@
-/** The result page's acts (2026-10-02), chosen in one place: exactly one ink
- * act, the one that resolves the result's state, and never navigation; at
- * most one outline act beside it. A result that can't be accepted says why
- * in one line before them.
+/** The result page's acts (2026-10-02; docs/plans/plain-toolroll.md P1.3), chosen in one place: three verbs, each a
+ * relabel over the post it has always made. Exactly one ink act at most, the one that resolves the result's state,
+ * and never navigation; at most one outline act beside it. A result that can't be accepted says why in one line
+ * before them. Run checks stays in the Checks row, and a person's own checks in the Checks list: neither is an act here.
  *
- *   everything met                      → Accept and finish
- *   a "You check this one" unanswered   → the next check, then Accept without your check
- *   a check you marked Not right        → Request changes, then Accept anyway
- *   checks queued or running            → Checks running (disabled), then Accept without checks
- *   checks didn't run, a check exists   → Run checks, then Accept without checks
+ *   everything met                      → Accept
+ *   a "You check this one" unanswered   → (the check itself, above), then Accept without your check
+ *   a check you marked Not right        → Send back, then Accept anyway
+ *   checks queued or running            → (Checks running, in its row), then Accept without checks
+ *   checks didn't run, a check exists   → (Run checks, in its row), then Accept without checks
  *   report and changes disagree,
- *   or the proof is refuted             → Request changes, then Accept (as allowed);
+ *   or the proof is refuted             → Send back, then Accept (as allowed);
  *                                         never Accept as ink, even with no form here
- *   a Needs you form resolves it        → that form (Build again, Confirm it stopped)
- *   saved notes or a failing PR         → Revise / Draft a repair task
- *   a failed build                      → Retry (its note starts with what to change), then Run checks when they
- *                                         didn't run; never Accept: a failed build is not a result to accept
+ *   a Needs you form resolves it        → that form (Retry: Build again; Check again)
+ *   saved notes or a failing PR         → Send back (the revision from the notes, or the repair of the PR)
+ *   a failed build                      → Retry (its note starts with what to change); never Accept: a failed build
+ *                                         is not a result to accept
  *   a failed task's delivered result    → Retry, then Accept anyway (in outline, with a reason) where it may be
- *                                         accepted; Run checks stays in its Checks row
+ *                                         accepted
  *
- * Accepting finishes the task in one request (Accept and finish): the person's
- * acceptance, when one is owed, and the completion together. This only decides
- * which act is ink; the page recomputes it as the person answers each check. */
+ * Accepting finishes the task in one request: the person's acceptance, when one is owed, and the completion
+ * together. This only decides which act is ink; the page recomputes it as the person answers each check. */
 import type { ProofVerdict } from "./proof.js";
 /** The words over the reason field an Accept of a refuted result requires. */
 export declare const ACCEPT_NEEDS_REASON = "Accepting needs a reason";
@@ -37,7 +36,7 @@ export declare function evidenceProblemOf(verdict: ProofVerdict | null, reasons:
  * when nothing refutes it (a person's acceptance settles it). The result page
  * shows it before Request changes, its one ink act. */
 export declare function cantAcceptYetOf(verdict: ProofVerdict | null, reasons: readonly string[], accepted: boolean): string | null;
-export type ResultActKind = "retry" | "accept" | "accept-anyway" | "next-check" | "checks-running" | "run-checks" | "request-changes" | "rebuild" | "confirm-stopped" | "revise" | "draft-repair";
+export type ResultActKind = "retry" | "accept" | "accept-anyway" | "next-check" | "checks-running" | "run-checks" | "request-changes" | "rebuild" | "recheck-stopped" | "revise" | "draft-repair";
 export type ResultActFacts = {
     /** An Accept this page can post (Accept and finish, or the person's acceptance alone); `ready`: every requirement met and checks passed. */
     accept: {
@@ -52,7 +51,7 @@ export type ResultActFacts = {
     /** The feedback form is on this page. */
     canRequest: boolean;
     /** A Needs you form that resolves it here. */
-    need: "rebuild" | "confirm-stopped" | null;
+    need: "rebuild" | "recheck-stopped" | null;
     /** Saved notes ready to become a revision, or a failing pull request's repair. */
     next: "revise" | "draft-repair" | null;
     /** A failed build: `retry` when the task can be retried from here; `acceptAnyway` when it delivered a result that
@@ -74,12 +73,21 @@ export type ResultActs = {
     /** The one line before the acts: why it can't be accepted yet. */
     line: string | null;
 };
+/** The three verbs, and the posts each one makes (docs/plans/plain-toolroll.md P1.3): Accept is today's Accept (and
+ * finish), or Accept anyway with a reason; Send back is today's request for changes and its revision from saved notes
+ * for an unpublished result, or the repair of a published one; Retry is today's Retry, or Build again. Check again
+ * keeps its own words (its act stands on the build, not on the result). */
+export type ResultVerb = "Accept" | "Send back" | "Retry";
+export declare const RESULT_VERB: Readonly<Record<ResultActKind, ResultVerb | null>>;
+/** What Send back does, said on its own confirm line: the rule is fixed by whether the result is already published. */
+export declare const SEND_BACK_UNPUBLISHED = "Sends it back with your notes. The same task builds again once you approve the revision.";
+export declare const SEND_BACK_PUBLISHED = "It's already published, so this files a fix as a new version for you to approve.";
 export declare function resultActsOf(facts: ResultActFacts): ResultActs;
 /** The words a result's Accept wears and the one line before it, given the
  * server's words for everything but the person's own checks (`base`) and how
  * those stand on this page: an unanswered check names itself; a check marked
  * Not right says so; otherwise the base words stand. */
-export type AcceptLabel = "Accept and finish" | "Accept without checks" | "Accept without your check" | "Accept anyway";
+export type AcceptLabel = "Accept" | "Accept without checks" | "Accept without your check" | "Accept anyway";
 export declare function acceptWithChecksOf(base: {
     label: AcceptLabel;
     ready: boolean;

package/dist/result-acts.js

@@ -1,26 +1,25 @@
-/** The result page's acts (2026-10-02), chosen in one place: exactly one ink
- * act, the one that resolves the result's state, and never navigation; at
- * most one outline act beside it. A result that can't be accepted says why
- * in one line before them.
+/** The result page's acts (2026-10-02; docs/plans/plain-toolroll.md P1.3), chosen in one place: three verbs, each a
+ * relabel over the post it has always made. Exactly one ink act at most, the one that resolves the result's state,
+ * and never navigation; at most one outline act beside it. A result that can't be accepted says why in one line
+ * before them. Run checks stays in the Checks row, and a person's own checks in the Checks list: neither is an act here.
  *
- *   everything met                      → Accept and finish
- *   a "You check this one" unanswered   → the next check, then Accept without your check
- *   a check you marked Not right        → Request changes, then Accept anyway
- *   checks queued or running            → Checks running (disabled), then Accept without checks
- *   checks didn't run, a check exists   → Run checks, then Accept without checks
+ *   everything met                      → Accept
+ *   a "You check this one" unanswered   → (the check itself, above), then Accept without your check
+ *   a check you marked Not right        → Send back, then Accept anyway
+ *   checks queued or running            → (Checks running, in its row), then Accept without checks
+ *   checks didn't run, a check exists   → (Run checks, in its row), then Accept without checks
  *   report and changes disagree,
- *   or the proof is refuted             → Request changes, then Accept (as allowed);
+ *   or the proof is refuted             → Send back, then Accept (as allowed);
  *                                         never Accept as ink, even with no form here
- *   a Needs you form resolves it        → that form (Build again, Confirm it stopped)
- *   saved notes or a failing PR         → Revise / Draft a repair task
- *   a failed build                      → Retry (its note starts with what to change), then Run checks when they
- *                                         didn't run; never Accept: a failed build is not a result to accept
+ *   a Needs you form resolves it        → that form (Retry: Build again; Check again)
+ *   saved notes or a failing PR         → Send back (the revision from the notes, or the repair of the PR)
+ *   a failed build                      → Retry (its note starts with what to change); never Accept: a failed build
+ *                                         is not a result to accept
  *   a failed task's delivered result    → Retry, then Accept anyway (in outline, with a reason) where it may be
- *                                         accepted; Run checks stays in its Checks row
+ *                                         accepted
  *
- * Accepting finishes the task in one request (Accept and finish): the person's
- * acceptance, when one is owed, and the completion together. This only decides
- * which act is ink; the page recomputes it as the person answers each check. */
+ * Accepting finishes the task in one request: the person's acceptance, when one is owed, and the completion
+ * together. This only decides which act is ink; the page recomputes it as the person answers each check. */
 /** The words over the reason field an Accept of a refuted result requires. */
 export const ACCEPT_NEEDS_REASON = "Accepting needs a reason";
 export const FAILED_CHECK = /^the repository's approved verification command exited (-?[0-9]+)/;
@@ -42,34 +41,46 @@ export function cantAcceptYetOf(verdict, reasons, accepted) {
         ? "Can't accept yet: the project's check failed on these changes."
         : ACCEPT_NEEDS_REASON;
 }
+export const RESULT_VERB = {
+    accept: "Accept", "accept-anyway": "Accept",
+    "request-changes": "Send back", revise: "Send back", "draft-repair": "Send back",
+    retry: "Retry", rebuild: "Retry",
+    "recheck-stopped": null,
+    // Never in the act row: Run checks lives in the Checks row, and a person's own checks in the Checks list.
+    "next-check": null, "checks-running": null, "run-checks": null,
+};
+/** What Send back does, said on its own confirm line: the rule is fixed by whether the result is already published. */
+export const SEND_BACK_UNPUBLISHED = "Sends it back with your notes. The same task builds again once you approve the revision.";
+export const SEND_BACK_PUBLISHED = "It's already published, so this files a fix as a new version for you to approve.";
 export function resultActsOf(facts) {
     const request = facts.canRequest ? "request-changes" : null;
     const accept = facts.accept === null ? null : "accept";
     if (facts.failed != null) {
-        const checks = facts.runChecks && !facts.checksRunning ? "run-checks" : facts.checksRunning ? "checks-running" : null;
         const anyway = facts.failed.acceptAnyway === true ? "accept-anyway" : null;
-        return facts.failed.retry ? { primary: "retry", secondary: anyway ?? checks, line: null } : { primary: checks, secondary: anyway, line: null };
+        return facts.failed.retry ? { primary: "retry", secondary: anyway, line: null } : { primary: null, secondary: anyway, line: null };
     }
     if (facts.need !== null)
         return { primary: facts.need, secondary: request, line: null };
+    // Saved notes or a failing pull request: Send back is ink, and Accept the quiet other way.
     if (facts.next !== null)
-        return { primary: facts.next, secondary: accept ?? request, line: null };
+        return { primary: facts.next, secondary: accept, line: null };
     // Can't be accepted yet: Accept is never the ink act, even when the feedback form isn't here.
     if (facts.blocked !== null)
         return { primary: request, secondary: accept, line: facts.blocked };
-    // The person's own checks come first: the next one is ink until each is answered.
+    // The person's own checks come first, in the Checks list above: nothing here is ink until each is answered.
     if (accept !== null && (facts.unanswered ?? 0) > 0)
-        return { primary: "next-check", secondary: accept, line: null };
+        return { primary: null, secondary: accept, line: null };
     if (accept !== null && (facts.notRight ?? 0) > 0)
         return { primary: request, secondary: accept, line: null };
+    // Checks running, or not run: their row says so and offers Run checks; Accept waits in outline.
     if (facts.checksRunning)
-        return { primary: "checks-running", secondary: accept ?? request, line: null };
+        return { primary: null, secondary: accept ?? request, line: null };
     if (facts.accept === null)
         return { primary: null, secondary: request, line: null };
     if (facts.accept.ready)
         return { primary: "accept", secondary: request, line: null };
     if (facts.runChecks)
-        return { primary: "run-checks", secondary: "accept", line: null };
+        return { primary: null, secondary: "accept", line: null };
     return { primary: "accept", secondary: request, line: null };
 }
 export function acceptWithChecksOf(base, checks) {

package/dist/result-follow-ups.d.ts

@@ -28,7 +28,7 @@ export type FollowUpCheck = {
     head: string;
     actor: string;
     at: string;
-    why: "person" | "pull-request" | "batch";
+    why: "person" | "pull-request" | "batch" | "recheck";
     /** The approved command's digest when checks were asked for: only that exact command runs. */
     digest: string;
     state: "waiting" | "running" | "passed" | "failed" | "not-run";
@@ -55,7 +55,7 @@ export declare function requestFollowUpChecks(store: Store, input: {
     runId: number;
     level: RunLevel;
     actor: string;
-    why?: "person" | "pull-request";
+    why?: "person" | "pull-request" | "recheck";
 }, now: Date): {
     ok: true;
     request: number;

package/dist/result-follow-ups.js

@@ -1,4 +1,6 @@
-import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
+import { widerThan } from "./check-access.js";
+import { recheckStanding } from "./check-only-standing.js";
+import { actualCheckAccess, checkoutLaunchOf, checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -72,7 +74,7 @@ export function followUpChecksOf(store, runId, now = new Date(), root) {
         const started = rows.find(row => row.action === CHECKS_STARTED && row.outcome === String(request.id)) ?? null;
         const finished = rows.find(row => row.action === CHECKS_FINISHED && row.outcome.startsWith(`${request.id}:`)) ?? null;
         const base = { request: request.id, runId, level: request.outcome, head, digest, actor: request.actor, at: request.at,
-            why: why === "pull-request" ? "pull-request" : why === "batch" ? "batch" : "person", exitCode: null, logArtifactId: null, note: null,
+            why: why === "pull-request" ? "pull-request" : why === "batch" ? "batch" : why === "recheck" ? "recheck" : "person", exitCode: null, logArtifactId: null, note: null,
             ...(why === "batch" ? { base: /^[a-f0-9]{40}$/.test(recordedBase) ? recordedBase : null } : {}) };
         if (finished !== null) {
             const status = finished.outcome.slice(String(request.id).length + 1);
@@ -200,6 +202,18 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
         finish("not-run", "The result's commit changed after checks were asked for.");
         return followUpChecksOf(store, runId, now(), root).find(one => one.request === request) ?? null;
     }
+    // An automatic recheck runs only on its check-only authorization, read again now (check-only.ts): no record, no run.
+    const authorized = wanted.why === "recheck" ? recheckStanding(store, { request, runId, head: target.head, digest: wanted.digest }) : null;
+    if (wanted.why === "recheck" && !authorized?.ok) {
+        finish("not-run", authorized?.problem ?? "Its authorization couldn't be read.");
+        return followUpChecksOf(store, runId, now(), root).find(one => one.request === request) ?? null;
+    }
+    /** Every command of an automatic recheck, refused at the moment it would run wider than the build's own access. */
+    const launched = (inner) => !authorized?.ok ? inner : (file, args, options) => {
+        if (widerThan(actualCheckAccess(store, checkoutLaunchOf(store, target.repo, [runId]).access), authorized.access))
+            return Promise.resolve({ code: 126, stdout: "", stderr: "", notFound: true, timedOut: false });
+        return inner(file, args, options);
+    };
     const folder = mkdtempSync(join(deps.scratch ?? tmpdir(), "toolroll-checks-"));
     const checkout = join(folder, "checkout");
     const log = [];
@@ -220,7 +234,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
             let ready = true;
             if (setup !== null) {
                 const shell = approvedCommandShell(setup.command);
-                const prepared = await runWithIsolatedDatabase(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level)), shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(launched(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level))), shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note("Approved project setup", setup.command, prepared);
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound) {
                     ready = false;
@@ -235,7 +249,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
                 }
                 else {
                     const shell = approvedCommandShell(live.command);
-                    const ran = await runWithIsolatedDatabase(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level)), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                    const ran = await runWithIsolatedDatabase(launched(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level))), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                     note(`${CHECK_LEVEL_WORDS[target.level]} check`, live.command, ran);
                     result = ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code };
                 }

package/dist/result-review.d.ts

@@ -129,7 +129,7 @@ export type SharedResultFacts = {
      * else from the run record — `headSource` says which. */
     base: string | null;
     head: string | null;
-    headSource: "sealed diff" | "run record" | null;
+    headSource: "saved diff" | "build record" | null;
     /** Signed criteria passed, from the machine's matrix; null = no rubric. */
     checks: {
         passed: number;

package/dist/route-change-check.d.ts

@@ -0,0 +1,4 @@
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+/** Whether a line on record for this exact plan describes some other route. An Approve under it is a yes to the wrong words. */
+export declare function routeChangeProblem(store: Store, taskId: string, scope: Scope): boolean;

package/dist/route-change-check.js

@@ -0,0 +1,13 @@
+/** The approval's one question about a "what changed" line (route-change.ts), apart so scope.ts loads it without the rest. */
+import { routeDigestOf, routeFromJson } from "./phase-routing.js";
+/** Whether a line on record for this exact plan describes some other route. An Approve under it is a yes to the wrong words. */
+export function routeChangeProblem(store, taskId, scope) {
+    const ref = store.lookupRef(taskId);
+    if (ref === null)
+        return false;
+    const row = store.handle.prepare("SELECT to_route_digest FROM route_change WHERE task_ref = ? AND scope_digest = ?").get(ref.id, scope.digest);
+    if (row === undefined)
+        return false;
+    const route = routeFromJson(scope.proposedRouteJson ?? null);
+    return route === null || routeDigestOf(route) !== row["to_route_digest"];
+}

package/dist/route-change.d.ts

@@ -0,0 +1,22 @@
+import { type PhaseRoute } from "./phase-routing.js";
+import { type Scope } from "./scope.js";
+import { type Store } from "./store.js";
+/** The sentence for what changed between the seal and the proposal. */
+export declare function routeChangeWords(sealed: {
+    route: PhaseRoute | null;
+    profile: Scope["approvedProfile"] | null | undefined;
+    authMode?: string | null;
+}, next: {
+    route: PhaseRoute;
+    authMode?: string | null;
+}): string;
+/** File the same words on today's route, and keep the line. Null: nothing to propose (a release, nothing changed, or no
+ * route Toolroll can name), and the task stays as it is. It seals nothing. */
+export declare function proposeNewRoute(store: Store, taskRef: number, taskId: string, now: Date): {
+    words: string;
+} | null;
+/** The line for this task's waiting plan, or null. Only while it describes exactly the plan up for approval. */
+export declare function routeChangeOf(store: Store, taskId: string): string | null;
+/** Each sweep: an unapproved row from before routing gets its route, and the same one Approve. A standing old approval
+ * is left alone (the stale check reaches it if its route ever differs). */
+export declare function routeLegacyPlans(store: Store, now: Date): number;