toolroll 0.9.93 → 0.9.94

package/dist/release-adapters.d.ts

@@ -131,6 +131,8 @@ export type AutoObservers = {
     /** Whether main's protection holds for the account that merges (readMainProtection); null when unreadable. */
     upToDateRequired: () => Promise<boolean | null>;
     evidenceRoot: string;
+    /** The cases that ran in `sha`'s macOS CI (fenced-check-coverage.ts); null when they can't be read. Absent: never read. */
+    macosCases?: (sha: string) => Promise<ReadonlyMap<string, boolean> | null>;
 };
 /**
  * Every check run GitHub holds for one commit — every attempt, not only the latest (`filter=all`; GitHub's default
@@ -169,6 +171,13 @@ export declare function readMergeBase(run: Exec, gh: string, repo: string, base:
  * never from a ref in a checkout a build can write.
  */
 export declare function readMainHead(run: Exec, gh: string, repo: string, branch?: string): Promise<string>;
+/** GitHub's own "Update branch", with its expected head: a push that got there first refuses. */
+export declare function updatePullRequestBranch(run: Exec, gh: string, repo: string, pr: number, expectedHead: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    why: string;
+}>;
 /** Whether `sha` already holds `ancestor` (GitHub's compare: `sha` is not behind it), as GitHub answers now. */
 export declare function readContains(run: Exec, gh: string, repo: string, sha: string, ancestor: string): Promise<boolean>;
 /**

package/dist/release-adapters.js

@@ -24,6 +24,10 @@ import { databasePath, finishReleaseOperation, requireFreshReleaseApproval, open
 import { acquireDeploymentLock } from "./deploy-lock.js";
 import { autoReleaseApprovalOf, liveReleaseOf } from "./scope.js";
 import { recheckReleaseTask, releaseCheckStanding } from "./check-failure.js";
+import { CHECK_REPORT_CAPTURE, readSealedJson } from "./check-report.js";
+import { readCheckReport } from "./contracts/release-check.js";
+import { macosCases, skipCoverage, skippedCases, uncoveredWords } from "./fenced-check-coverage.js";
+import { runCheckStamp } from "./store.js";
 import { noteCiRunning, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { autoPublishHeld, holdAutoPublish, liftCiHold, authorizeAutoCheck, giveUpAutoApproval, noteAutoCheckFailed, noteAutoRelease, releaseAutoApproves, sealAutoGreen } from "./release-auto.js";
 import { proveCarry } from "./release-carry.js";
@@ -436,6 +440,7 @@ export function releaseAdapters(options) {
     };
     const release = storeReleaseAdapter(() => openStore(database), store => store.close(), options.now ?? (() => new Date()), undefined, { observe: sha => observeCi(sha), mergeBase: (base, sha) => readMergeBase(reads, ciGh, releaseRepo().slug, base, sha),
         upToDateRequired: () => readUpToDateRequired(reads, ciGh, releaseRepo().slug), evidenceRoot: join(dirname(database), "evidence"),
+        macosCases: sha => macosCasesOf(run, ciGh, releaseRepo().slug, sha),
         // A successful Actions job authenticates the job, not the candidate-writable JSON it uploads. Until the
         // executor protects that reporting channel, production releases must take the person's approval road.
         reportsProtected: false }, 
@@ -660,6 +665,7 @@ export function releaseAdapters(options) {
             async complete(repo, sha) { return readSuitesComplete(reads, ciGh, repo, sha); },
             async mainHead(repo) { return readMainHead(reads, ciGh, repo); },
             async contains(repo, sha, ancestor) { return readContains(reads, ciGh, repo, sha, ancestor); },
+            async updateBranch(repo, pr, expectedHead) { return updatePullRequestBranch(reads, ciGh, repo, pr, expectedHead); },
             async upToDateRequired(repo) { return readMainProtection(reads, ciGh, repo); },
             async merge(repo, pr, head, message) {
                 // The squash commit's message lists every commit that landed after the approval (release-once.md). Never asked
@@ -989,6 +995,33 @@ nightlyReads) {
                     return answer.action === "rerun" ? { action: "rerun", why: answer.why } : answer.action === "pending" ? { action: "pending" } : { action: "stop", class: answer.class, why: answer.why };
                 });
             },
+            async fencedCoverage(_taskId, run, candidate) {
+                // Today's road, read first and answered at once: a check that ran unsandboxed skips nothing for this reason. A run
+                // from before stamps (a release resumed across an update) is judged by the level its dispatch recorded.
+                const asked = withStore(store => {
+                    if (store.runCheckAccess(run) === "unsandboxed")
+                        return null;
+                    const reading = runCheckStamp(store, run);
+                    if (reading.state !== "current")
+                        return { refused: "how its check ran wasn't recorded, so what it skipped can't be judged" };
+                    if (reading.stamp.level === "unsandboxed")
+                        return null;
+                    const sealed = readSealedJson(store, auto.evidenceRoot, run, CHECK_REPORT_CAPTURE);
+                    const report = sealed === null ? null : readCheckReport(sealed.value);
+                    return report?.ok === true ? { skipped: skippedCases(report.value) } : { refused: "its report can't be read, so what it skipped can't be judged" };
+                });
+                if (asked === null)
+                    return { ok: true, covered: 0 };
+                if ("refused" in asked)
+                    return { ok: false, why: asked.refused };
+                if (asked.skipped.length === 0)
+                    return { ok: true, covered: 0 };
+                const macos = await auto.macosCases?.(candidate) ?? null;
+                if (macos === null)
+                    return { ok: false, why: "this commit's macOS CI reports couldn't be read, so what the sandboxed check skipped isn't covered" };
+                const coverage = skipCoverage(asked.skipped, macos);
+                return coverage.uncovered.length > 0 ? { ok: false, why: uncoveredWords(coverage.uncovered) } : { ok: true, covered: coverage.covered.length };
+            },
             async standing(taskId, run) {
                 return withStore(store => {
                     const standing = releaseCheckStanding(store, auto.evidenceRoot, { taskId, run });
@@ -1317,6 +1350,13 @@ export async function readMainHead(run, gh, repo, branch = "main") {
         throw new Error(`GitHub named no commit for ${branch}`);
     return match[1];
 }
+/** GitHub's own "Update branch", with its expected head: a push that got there first refuses. */
+export async function updatePullRequestBranch(run, gh, repo, pr, expectedHead) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || !Number.isSafeInteger(pr) || pr < 1 || !/^[0-9a-f]{40}$/.test(expectedHead))
+        return { ok: false, why: "not a pull request GitHub can be asked to update" };
+    const ran = await run(gh, ["api", "--hostname", "github.com", "--method", "PUT", `repos/${repo}/pulls/${pr}/update-branch`, "-f", `expected_head_sha=${expectedHead}`], { cwd: "/", env: ciEnv() });
+    return ran.code === 0 ? { ok: true } : { ok: false, why: (ran.stderr.trim().split("\n")[0] ?? "").slice(0, 200) || `gh exited ${ran.code}` };
+}
 /** Whether `sha` already holds `ancestor` (GitHub's compare: `sha` is not behind it), as GitHub answers now. */
 export async function readContains(run, gh, repo, sha, ancestor) {
     if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || !/^[0-9a-f]{40}$/.test(sha) || !/^[0-9a-f]{40}$/.test(ancestor))
@@ -1530,3 +1570,39 @@ export function releaseProgressRecorder(open, done) {
         }
     };
 }
+/** The macOS CI's cases on exactly `sha`: the newest pull-request run of ci.yml there, each shard's newest attempt. Null
+ * when they can't all be read. The folder is this function's own, removed before it returns. */
+async function macosCasesOf(run, gh, slug, sha) {
+    const folder = mkdtempSync(join(tmpdir(), "so-macos-ci-"));
+    try {
+        const listed = await run(gh, ["api", `repos/${slug}/actions/runs?head_sha=${sha}&event=pull_request&per_page=100`], { timeoutMs: 60_000 });
+        if (listed.code !== 0)
+            return null;
+        const runs = JSON.parse(listed.stdout).workflow_runs ?? [];
+        const newest = runs.filter(one => typeof one.id === "number" && one.head_sha === sha && (one.path === ".github/workflows/ci.yml" || String(one.path).startsWith(".github/workflows/ci.yml@"))).map(one => one.id).sort((a, b) => b - a)[0];
+        if (newest === undefined)
+            return null;
+        const got = await run(gh, ["run", "download", String(newest), "--repo", slug, "--pattern", "macos-shard-*", "--dir", folder], { timeoutMs: 180_000 });
+        if (got.code !== 0)
+            return null;
+        const shards = new Map();
+        for (const name of readdirSync(folder)) {
+            const match = /^macos-(shard-\d+-\d+)-a([1-9]\d*)$/.exec(name);
+            if (match === null)
+                return null;
+            const was = shards.get(match[1]);
+            if (was === undefined || Number(match[2]) > was.attempt)
+                shards.set(match[1], { attempt: Number(match[2]), name });
+        }
+        if (shards.size === 0)
+            return null;
+        const reports = [...shards.values()].map(one => JSON.parse(readFileSync(join(folder, one.name, "shard-report.json"), "utf8")));
+        return macosCases(reports, `/Users/runner/work/${slug.split("/")[1]}/${slug.split("/")[1]}`);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        rmSync(folder, { recursive: true, force: true });
+    }
+}

package/dist/release-auto.js

@@ -19,7 +19,7 @@ import { sealedRun } from "./release-recheck.js";
 import { runCheckLevel } from "./check-levels.js";
 import { readVerifiedCommit, verifiedBlobs, verifiedTreeDiff, verifiedTreeEntries } from "./commit-extract.js";
 import { EVAL_HOOK_FILES, evalHookProblem, LEARNING_HOOK_FILES, learningHookProblem, storeRewriteProblem } from "./eval-hooks.js";
-import { mightName, testInfrastructure } from "./test-infra.js";
+import { isTestPath, mightName, testImportProblem, testInfrastructure } from "./test-infra.js";
 import { chatControlHref } from "./chat-controls.js";
 import { INFRA_RERUNS_PER_CANDIDATE, REQUIRED_PR_CHECKS, REQUIRED_PR_CHECKS_WORKFLOW, prChecksVerdict } from "./release.js";
 import { releaseCheckStanding } from "./check-failure.js";
@@ -359,18 +359,18 @@ function changeProblem(repo, base, candidate) {
         // Taking a test away is never automatic, wherever it lives.
         if (change.kind === "deleted" && TEST_FILE.test(rulePath(change.path)))
             return `${change.path} was deleted (removing a test needs a person)`;
-        if (change.before !== null && TEST_FILE.test(rulePath(change.path))) {
-            // Counts cannot prove that an assertion survived: replacing it, commenting it out, or skipping its case can
-            // leave the counts unchanged. Only append-only additions preserve the existing code without interpretation.
-            // Both copies come from verified trees; no report or candidate-provided file list decides this permission.
-            const was = verifiedBlobs(gitDir, before.value.tree, [change.path]);
-            const now = verifiedBlobs(gitDir, after.value.tree, [change.path]);
-            if (!was.ok || !now.ok)
-                return `${change.path}'s existing test code couldn't be read (a person decides)`;
-            const original = was.value.get(change.path)?.bytes, revised = now.value.get(change.path)?.bytes;
-            if (original === undefined || revised === undefined || !revised.subarray(0, original.length).equals(original)) {
-                return `${change.path} changes existing test code (removing or rewriting tests needs a person)`;
-            }
+        // Counts cannot prove that an assertion survived, and an appended line can disarm what it follows (`vi.mock` hoists,
+        // a top-level hook reaches every case): a test file that was there stays exactly as it was (H4).
+        if (change.before !== null && TEST_FILE.test(rulePath(change.path)))
+            return `${change.path} changes existing test code (new tests go in a new file; rewriting tests needs a person)`;
+        // A new test may not reach into another: it would run that file's code, and its mocks, here. From the verified tree.
+        // Any test extension: `src/` passes autoPathProblem whatever the file is called, so `.test.ts` alone would miss `.test.tsx`.
+        if (change.kind === "added" && isTestPath(rulePath(change.path))) {
+            const read = verifiedBlobs(gitDir, after.value.tree, [change.path]);
+            const bytes = read.ok ? read.value.get(change.path)?.bytes : undefined;
+            const why = bytes === undefined ? `${change.path}'s test code couldn't be read` : testImportProblem(change.path, bytes.toString("utf8"));
+            if (why !== null)
+                return `${why} (a person decides)`;
         }
         const why = autoPathProblem(change.path);
         if (why !== null)

package/dist/release-card.d.ts

@@ -1,6 +1,6 @@
 import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
 import type { Scope } from "./scope.js";
-import type { Store } from "./store.js";
+import { type Store } from "./store.js";
 /** One signed term as the card says it. `key` names the scope field or the release term's path. */
 export type TermLine = {
     key: string;
@@ -151,7 +151,6 @@ export type ReleaseCard = {
 };
 /** The card digest: everything the person is shown that can change under them. */
 export declare function cardDigestOf(scopeDigest: string, formDigest: string, changes: Pick<ChangeList, "baseline" | "digest">): string;
-/** The release card for a deploy gate, against the live records now. */
 export declare function releaseCardOf(store: Store, scope: Scope, formDigest: string, words: {
     profile: (profile: Scope["profile"]) => string | null;
 }, read?: PullRequestReader): ReleaseCard;

package/dist/release-card.js

@@ -20,6 +20,7 @@ import { createHash } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { checkAccessWords } from "./check-access.js";
+import { ranWords } from "./check-stamp.js";
 import { CHECK_LEVEL_WORDS, effectiveCheckLevel } from "./check-levels.js";
 import { verifiedRange } from "./commit-extract.js";
 import { releaseCheckPurposeSchema, releaseTermsSchema } from "./contracts/release-terms.js";
@@ -29,6 +30,7 @@ import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
 import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+import { taskCheckStamp } from "./store.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -382,6 +384,13 @@ function changeWords(changes, terms, cap) {
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
 }
 /** The release card for a deploy gate, against the live records now. */
+/** How this task's last check ran, when one did and it wasn't plainly sandboxed: the sealed level above is what will run;
+ * this is what did. Nothing for a release no check has run for. */
+function lastCheckWords(store, repo, taskId) {
+    const ran = repo === null ? null : taskCheckStamp(store, repo, taskId);
+    const words = ran === null ? null : ranWords(ran.reading);
+    return words === null ? [] : [`Last check: ${words}.`];
+}
 export function releaseCardOf(store, scope, formDigest, words, read) {
     const terms = scope.releaseTerms ?? null;
     // Either sealed form (Codex round 2, finding 1): the identity both share, for the head lines and the change list.
@@ -400,6 +409,8 @@ export function releaseCardOf(store, scope, formDigest, words, read) {
             : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
         // What an unsandboxed check means, before consent (Codex round 2, finding 1).
         ...(identity === null || releaseAccessWords(identity.access) === null ? [] : [releaseAccessWords(identity.access)]),
+        // A check that already ran for this task, from its stamp (H2): never read as sandboxed when it can't be shown.
+        ...lastCheckWords(store, identity?.repo ?? null, scope.taskId),
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
         // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.

package/dist/release-carry.d.ts

@@ -44,8 +44,13 @@ export declare function stricterOf(a: ReleasePolicy | null, b: ReleasePolicy | n
  * the rules don't rely on that).
  */
 export declare function rulePath(path: string): string;
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy): string | null;
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy, fresh?: ReadonlySet<string>): string | null;
 /**
  * A release scope's terms, from the plane's own records: the project's repository, the approved commit and its
  * verified tree, the effective policy, the live release check grant and the check access (only the fence), and the

package/dist/release-carry.js

@@ -26,14 +26,17 @@ import { join, sep } from "node:path";
 import { execFileSync } from "node:child_process";
 import { checkLaunchRoot, fenceFor, linuxFenceAvailable, macosFenceAvailable, runFolders } from "./agent-fence.js";
 import { touchesProtected } from "./approval-policy.js";
-import { extractCommit, readVerifiedCommit, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { extractCommit, readVerifiedCommit, verifiedBlobs, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { testImportProblem } from "./test-infra.js";
 import { projectGitDir } from "./check-report.js";
+import { checkAccessOf } from "./check-access.js";
+import { stampRefusal } from "./check-stamp.js";
 import { CARRY_RULES_VERSION, readReleasePolicy, releasePolicyDigest } from "./contracts/release-terms.js";
 import { run } from "./exec.js";
 import { proxyEnv, startEgressProxy } from "./egress.js";
 import { liveReleaseOf } from "./scope.js";
 import { UNSANDBOXED_CARRY_ACTION, carriesUnsandboxed } from "./release-authority.js";
-import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, } from "./store.js";
+import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, taskCheckStamp, } from "./store.js";
 // ------------------------------------------------------------------ the rules
 /** The journey scripts: tests, by Alex's decision (they carry). */
 export const JOURNEY_SCRIPTS = Object.freeze(["scripts/app-e2e.mjs", "scripts/flows-e2e.mjs"]);
@@ -111,8 +114,15 @@ export function stricterOf(a, b) {
 export function rulePath(path) {
     return path.toLowerCase().split("/").map(part => part.replace(/[. ]+$/, "")).filter(part => part !== "" && part !== ".").join("/");
 }
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export function changeRefusal(change, policy) {
+/** Tests by the rules' classes: what the existing-test rule holds still. */
+const carriedTest = (normal) => CARRY_RULES.classes.some(one => (one.name === "unit tests" || one.name === "journey scripts") && one.matches(normal));
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export function changeRefusal(change, policy, fresh = new Set()) {
     const path = change.path;
     const normal = rulePath(path);
     if (change.kind === "deleted")
@@ -133,6 +143,8 @@ export function changeRefusal(change, policy) {
         return `${path} is protected in this project`;
     if (!CARRY_RULES.classes.some(one => one.matches(normal)))
         return `${path} isn't a test, a doc or the changelog`;
+    if (change.kind === "modified" && carriedTest(normal) && !fresh.has(path))
+        return `${path} changes an existing test, and new tests go in a new file`;
     return null;
 }
 // ------------------------------------------------------------------ release terms
@@ -211,6 +223,11 @@ export function preflightCarry(store, input) {
     if ((a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed") && policy.unsandboxedCarry !== true) {
         return refuse("rules", "This project's checks run outside the sandbox, and carrying release approvals then wasn't on when this release was approved, or is off now.");
     }
+    // A carry leans on the check the release already had: it must be shown to have stayed within what was approved (H2).
+    const ran = taskCheckStamp(store, a.repo, a.tipTask);
+    const unshown = ran === null ? null : stampRefusal(ran.reading, checkAccessOf(a.accessDigest));
+    if (unshown !== null)
+        return refuse("rules", `This release's approval can't carry: ${unshown}.`);
     if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(input.to))
         return refuse("ancestry", `${input.to} isn't a full commit id.`);
     if (input.to === a.tipSha)
@@ -234,6 +251,10 @@ export function preflightCarry(store, input) {
         treeOf.set(commit.id, commit.tree);
     const commits = [];
     let churn = 0;
+    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
+    if (!whole.ok)
+        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
+    const fresh = new Set(whole.value.filter(one => one.kind === "added").map(one => one.path));
     for (const commit of ordered) {
         const parentTree = treeOf.get(commit.parents[0]);
         if (parentTree === undefined)
@@ -242,21 +263,30 @@ export function preflightCarry(store, input) {
         if (!diff.ok)
             return refuse("shape", `${commit.id.slice(0, 7)} couldn't be read: ${diff.message}`);
         for (const change of diff.value) {
-            const why = changeRefusal(change, policy);
+            const why = changeRefusal(change, policy, fresh);
             if (why !== null)
                 return refuse("rules", `${commit.id.slice(0, 7)}: ${why}.`, change.path);
         }
         churn += diff.value.reduce((n, one) => n + one.added + one.deleted, 0);
         commits.push({ sha: commit.id, files: diff.value.map(one => ({ path: one.path, added: one.added, deleted: one.deleted })) });
     }
-    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
-    if (!whole.ok)
-        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
     for (const change of whole.value) {
-        const why = changeRefusal(change, policy);
+        const why = changeRefusal(change, policy, fresh);
         if (why !== null)
             return refuse("rules", `Since the approval: ${why}.`, change.path);
     }
+    // No new test may reach into another (H4). Read from the verified tree, never from a checkout.
+    // By the rules' own classifier, so everything that carries as a test is read (a new journey script too).
+    const newTests = whole.value.filter(one => one.kind === "added" && carriedTest(rulePath(one.path))).map(one => one.path);
+    const added = newTests.length === 0 ? null : verifiedBlobs(gitDir, chain[0].tree, newTests);
+    if (added !== null && !added.ok)
+        return refuse("shape", `The new tests couldn't be read: ${added.message}`);
+    for (const path of newTests) {
+        const bytes = added !== null && added.ok ? added.value.get(path)?.bytes : undefined;
+        const why = bytes === undefined ? `${path} couldn't be read` : testImportProblem(path, bytes.toString("utf8"));
+        if (why !== null)
+            return refuse("rules", `Since the approval: ${why}.`, path);
+    }
     const changedLines = whole.value.reduce((n, one) => n + one.added + one.deleted, 0);
     if (changedLines > policy.limits.lines)
         return refuse("limits", `${changedLines} lines changed since the approval; at most ${policy.limits.lines} carry.`);

package/dist/release-cli.d.ts

@@ -8,6 +8,7 @@
 import { type ReleaseAdapters } from "./release.js";
 import { type GateReleaseWorld } from "./release-gate.js";
 import { type RescueWorld } from "./deploy-rescue.js";
+import { type RunLockSeams, type SettleWorld } from "./release-next.js";
 export declare const RELEASE_HELP: string;
 /** A runner lease id (claim.ts mints randomUUID()). */
 export declare const LEASE_SHAPED: RegExp;
@@ -23,6 +24,9 @@ export type ReleaseCliDeps = {
     gateWorld?: GateReleaseWorld;
     /** What --recover-deploy reads and runs (deploy-rescue.ts); the installation's own by default. */
     rescueWorld?: RescueWorld;
+    /** What a stopped deployment left, settled before the release goes on (release-next.ts). Tests that inject adapters skip it. */
+    settle?: SettleWorld;
+    runLock?: RunLockSeams;
     /** The plane's database for the authority commands (default: this installation's). */
     database?: string;
     now?: () => Date;

package/dist/release-cli.js

@@ -16,6 +16,7 @@ import { RELEASE_LIMITS, runRelease } from "./release.js";
 import { processes, releaseAdapters } from "./release-adapters.js";
 import { journals, releaseGate } from "./release-gate.js";
 import { rescueDeployment } from "./deploy-rescue.js";
+import { settleDeployment, takeReleaseRun } from "./release-next.js";
 import { databasePath, elapsedSeconds, latestReleaseStepTask, openStore, releaseProgressFor, revokeRelease } from "./store.js";
 import { dur } from "./design/kit.js";
 import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit, setUnsandboxedCarry } from "./release-carry.js";
@@ -34,7 +35,10 @@ export const RELEASE_HELP = `toolroll release <branch> — release Toolroll itse
   squash-merges, deletes the matching remote branch, verifies the merged tree and tags. Both macOS legs gate npm
   publication; Homebrew waits for its checks to register and all pass before merging.
 
-  Run the same command to resume after a stop. Interrupted deployments recover their saved stage before retrying.
+  Run the same command to go on after any stop. It reads where the release got to and does the one thing that's next:
+  finishes a deployment forward, puts one back, lifts a pause left before a swap, waits for another run of the release
+  (naming its computer and process), or waits for your approval. It says what it did. A branch behind main is brought up
+  to date for you; that new commit needs its own approval, CI and check.
 
   A branch whose name is one of this command's own words (approve, status, nightly, carry…) is named with --branch <name>
   or after --: \`toolroll release --branch status\`.
@@ -47,19 +51,6 @@ toolroll release approve [<branch>] [--repo <path>] — approve the release wait
 toolroll release status [<task>] — the steps of a release (the newest one recorded, or the release task named): each
   step's state and how long it took, and where it stopped
 
-toolroll release --release-gate <id> [--yes] — lift the update pause a deployment left before its swap
-
-  Shows why it is safe first: the pause is that deployment's, its journal stopped before the swap, and the
-  database, service definition and running service are all still the previous build's. --yes lifts that one pause.
-  Any missing or contradicting evidence refuses and leaves the pause in place.
-
-toolroll release --recover-deploy [--stage <dir>] [--yes] — put back a deployment that stopped half way
-
-  Finds the one unfinished deployment (or the stage named) and shows what its recovery will do; --yes does it. When
-  the old service isn't proved stopped, it boots the service out and stops what it left running, but only processes
-  proved, by exact runtime path and arguments, to be that deployment's own; then it starts the previous service
-  again, waits for it, and lifts the update pause. Anything it can't prove refuses. Safe to run again.
-
 toolroll release carry <release> --to <commit> [--request <id>] — carry a person's release approval to a later commit
 
   Only tests, docs and the changelog may change after the approval, within the limits, with an identical production
@@ -100,10 +91,6 @@ Options
   --new                  release a new commit on the branch, setting the earlier unfinished release aside
   --limit <step>=<min>   change one step's time limit (${Object.entries(RELEASE_LIMITS).map(([step, minutes]) => `${step} ${minutes}`).join(", ")})
   --tap <owner/name>     the Homebrew tap (default ap9000/homebrew-toolroll)
-  --release-gate <id>    check (and with --yes, lift) one update pause left before a deployment's swap
-  --yes                  with --release-gate: lift the pause once it is proved safe; with --recover-deploy: recover
-  --recover-deploy       recover the unfinished deployment (see above)
-  --stage <dir>          with --recover-deploy: the deployment's staging folder, when more than one is unfinished
   --json                 answer with one machine envelope
 
 A runner's lease is returned with \`toolroll worker release <lease>\`.`;
@@ -270,8 +257,23 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const adapters = deps.adapters === undefined
         ? releaseAdapters({ checkout, say, ...(tap === undefined ? {} : { tap }), ...(limits["deploy"] === undefined ? {} : { deployMinutes: limits["deploy"] }) })
         : { ...deps.adapters, say };
-    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
-    return report(outcome, write, json, lines);
+    // One command: wait out another run of this release, settle what a stopped deployment left, then go on from the journal.
+    const taken = await takeReleaseRun(stateDir, branch, say, deps.runLock);
+    if (!taken.ok)
+        return refuse("running", `Another release of ${branch} is still running on ${taken.holder.host} (process ${taken.holder.pid}). Nothing was changed.`, 3);
+    try {
+        const world = deps.settle ?? (deps.adapters === undefined ? { rescue: installedRescueWorld(checkout), gate: installedGateWorld() } : null);
+        if (world !== null) {
+            const settled = await settleDeployment(world, say);
+            if (!settled.ok)
+                return refuse("deployment", settled.message, 3);
+        }
+        const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
+        return report(outcome, write, json, lines);
+    }
+    finally {
+        taken.release();
+    }
 }
 function report(outcome, write, json, lines) {
     const release = outcome.journal === null ? null : {
@@ -590,10 +592,15 @@ async function runStatusCommand(task, write, json, deps) {
         }
         const word = { running: "running", waiting: "waiting", done: "done", failed: "failed" };
         write(`Release ${progress.version} (${progress.tag})${progress.pr === null ? "" : ` · pull request #${progress.pr}`} · task ${taskId}`);
-        for (const one of steps)
-            write(`  ${one.step.padEnd(9)} ${word[one.state].padEnd(8)} ${one.seconds === null ? "–" : dur(one.seconds)}${one.detail === null ? "" : `  ${one.detail}`}`);
+        for (const one of steps) {
+            // A failure the release has gone on from is history, as on the task page.
+            const passed = one.state === "failed" && progress.stopped === null;
+            write(`  ${one.step.padEnd(9)} ${(passed ? "went on" : word[one.state]).padEnd(8)} ${one.seconds === null ? "–" : dur(one.seconds)}${one.detail === null ? "" : `  ${one.detail}`}`);
+        }
         if (progress.stopped !== null)
             write(`Stopped at ${progress.stopped.step}: ${progress.stopped.message}`);
+        if (progress.building !== null)
+            write(`Build #${progress.building.run} is running the check.`);
         return 0;
     }
     finally {

package/dist/release-coverage.js

@@ -26,7 +26,7 @@ export const gitIsAncestor = (repo, ancestor, descendant) => {
     let answer;
     try {
         // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
-        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000 }).status;
+        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000, binding: { repo } }).status;
         if (status !== 0)
             throw Object.assign(new Error("git merge-base"), { status });
         answer = true;

package/dist/release-next.d.ts

@@ -0,0 +1,48 @@
+import { type RescueWorld } from "./deploy-rescue.js";
+import { type GateReleaseWorld } from "./release-gate.js";
+import { type ReleaseJournal } from "./release.js";
+import type { Store } from "./store.js";
+/** How long a run waits for another before it says so and stops. */
+export declare const RELEASE_WAIT_MS: number;
+export type RunHolder = {
+    host: string;
+    pid: number;
+};
+export type RunLockSeams = {
+    host?: string;
+    pid?: number;
+    alive?: (pid: number) => boolean;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    waitMs?: number;
+    pollMs?: number;
+};
+/** Take this branch's run lock, waiting for a live holder. Answers how to give it back, or who kept it. */
+export declare function takeReleaseRun(stateDir: string, branch: string, say: (line: string) => void, seams?: RunLockSeams): Promise<{
+    ok: true;
+    release: () => void;
+} | {
+    ok: false;
+    holder: RunHolder;
+}>;
+export type SettleWorld = {
+    rescue: RescueWorld;
+    gate: GateReleaseWorld;
+};
+export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
+/** The one action a deployment's journal calls for. */
+export declare function deployActionOf(phase: unknown): DeployAction;
+/** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
+export declare function settleDeployment(world: SettleWorld, say: (line: string) => void): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+}>;
+export declare const RELEASE_RESUMED_ACTION = "release resumed";
+/**
+ * A person let a held release go on (release-auto.ts allowAutoPublish; the Release sheet's button or `publish-ok`): each
+ * sweep, its journal goes on from where it stopped, once per that person's act, under the same run lock. It was merged
+ * already, so only the tag, publication and Homebrew are left, and each re-proves itself.
+ */
+export declare function resumeAllowedReleases(store: Store, stateDir: string, run: (journal: ReleaseJournal) => Promise<unknown>, now: Date): Promise<number>;