toolroll 0.9.93 → 0.9.95

package/dist/provider-capture.js

@@ -0,0 +1,53 @@
+/**
+ * What a provider said when an attempt failed, saved for a person (docs/plans/fleet-follow-through.md, part 5).
+ *
+ * Fallback between agents was removed in v115, and exhaustion.ts recognises only a dead sign-in. Telling a used-up
+ * subscription from any other failure needs a REAL response, so this saves them as they happen and nothing else. Nothing
+ * reads this table to route work: `hint` is a sort key for a person, never a recogniser, and a person's label decides
+ * nothing either. The text is the provider's, so it is data, scrubbed of secrets and bounded.
+ */
+import { readingFleet } from "./fleet-schema.js";
+import { cleanFindingText } from "./findings.js";
+export const CAPTURE_TEXT_LIMIT = 4_000;
+/** Kept per provider, newest first. A labelled capture is never pruned: it is the evidence a person kept. */
+const CAPTURES_KEPT = 40;
+/** Words worth a person's look. Only ever a sort key. */
+const LIMIT_WORDS = /\b(usage limit|rate limit|quota|credit|billing|exhaust|limit reached|too many requests|429|payment)/i;
+/** Save one failed attempt's last words. Bookkeeping: it never costs the run anything. */
+export function captureProviderFailure(store, input, now) {
+    try {
+        const text = cleanFindingText(input.texts.filter((one) => typeof one === "string" && one.trim() !== "").join("\n"), CAPTURE_TEXT_LIMIT);
+        if (text === "" && input.code === null)
+            return;
+        const run = store.getRun(input.run);
+        const repo = run === null ? null : store.refById(run.taskRef)?.repo ?? null;
+        store.handle.prepare(`INSERT INTO provider_capture (run, repo, provider, model, auth_mode, exit_code, code, text, hint, at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (run) DO NOTHING`)
+            .run(input.run, repo, input.provider, input.model, input.authMode, input.exitCode, input.code === null ? null : cleanFindingText(input.code, 120), text, LIMIT_WORDS.test(`${input.code ?? ""} ${text}`) ? 1 : 0, now.toISOString());
+        store.handle.prepare(`DELETE FROM provider_capture WHERE provider = ? AND label IS NULL AND id NOT IN (SELECT id FROM provider_capture WHERE provider = ? ORDER BY id DESC LIMIT ?)`).run(input.provider, input.provider, CAPTURES_KEPT);
+    }
+    catch { /* a capture is never worth a run */ }
+}
+const captureOf = (row) => ({
+    id: Number(row["id"]), run: Number(row["run"]), repo: row["repo"] === null ? null : String(row["repo"]), provider: String(row["provider"]), model: row["model"] === null ? null : String(row["model"]),
+    authMode: row["auth_mode"] === null ? null : String(row["auth_mode"]), exitCode: row["exit_code"] === null ? null : Number(row["exit_code"]), code: row["code"] === null ? null : String(row["code"]),
+    text: String(row["text"]), hint: Number(row["hint"]) === 1, label: row["label"] === null ? null : String(row["label"]), labelledBy: row["labelled_by"] === null ? null : String(row["labelled_by"]), at: String(row["at"]),
+});
+/** Newest first, the ones mentioning limits at the top. */
+export function providerCaptures(store, repos, limit = 50) {
+    return readingFleet(() => store.handle.prepare("SELECT * FROM provider_capture ORDER BY hint DESC, id DESC LIMIT 500").all().map(captureOf)
+        .filter(one => repos === null || (one.repo !== null && repos.includes(one.repo))).slice(0, limit), []);
+}
+export function providerCapture(store, id) {
+    return readingFleet(() => {
+        const row = store.handle.prepare("SELECT * FROM provider_capture WHERE id = ?").get(id);
+        return row === undefined ? null : captureOf(row);
+    }, null);
+}
+/** A person's reading of one capture. It marks it for keeping, and nothing routes on it. */
+export function labelProviderCapture(store, id, label, by) {
+    return Number(store.handle.prepare("UPDATE provider_capture SET label = ?, labelled_by = ? WHERE id = ?").run(label, by, id).changes) === 1;
+}
+/** What goes in a fixture file: the provider's response and which version of what produced it. */
+export function captureFixture(capture) {
+    return { version: 1, provider: capture.provider, model: capture.model, authMode: capture.authMode, exitCode: capture.exitCode, code: capture.code, text: capture.text, label: capture.label, labelledBy: capture.labelledBy, capturedAt: capture.at };
+}

package/dist/publish.js

@@ -21,6 +21,7 @@
  */
 import { createHash } from "node:crypto";
 import { protectedPublicationHold } from "./result-completion.js";
+import { fastPublishProblem } from "./fast-start.js";
 import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -142,6 +143,13 @@ export async function publishPass(store, options) {
                 report.problems.push(`publication ${publication.id}: ${held}`);
                 continue;
             }
+            // A fast start waits for a person's Accept, and for a change that stayed small (fast-start.ts).
+            const fastTask = store.externalIdFor(publication.taskRef);
+            const fast = fastTask === null ? null : fastPublishProblem(store, fastTask, publication.run);
+            if (fast !== null) {
+                report.problems.push(`publication ${publication.id}: held: ${fast}`);
+                continue;
+            }
         }
         if (publication.state === "intended") {
             // The exact SHA to the exact ref. A branch that moved since completion
@@ -525,7 +533,7 @@ export async function sweepMerges(store, options) {
         store.enqueueNotification({ source: { run: publication.run }, dedupeKey: key, kind: "merge", subject, body }, clock());
     };
     const pagePerson = (publication, suffix, subject, body) => {
-        store.enqueueEpisode(`merge-attn:${publication.id}`, { source: { run: publication.run }, kind: "merge", subject, body, pushClass: "merge", link: "/review" }, suffix, clock());
+        store.enqueueEpisode(`merge-attn:${publication.id}`, { source: { run: publication.run }, kind: "merge", subject, body, pushClass: "merge", link: "/tasks?view=ready" }, suffix, clock());
     };
     const grant = store.publicationGrantFor(options.repo);
     if (grant === null || grant.merge !== true || grant.mergeMethod == null)

package/dist/pull-request-flow.js

@@ -14,6 +14,7 @@
  * read must show the PR open, on the accepted commit, with checks passing; GitHub's head-commit match guards
  * the race; the branch is deleted; the merge commit and who merged are recorded in the ledger.
  */
+import { fastPublishProblem } from "./fast-start.js";
 import { createHash, randomUUID } from "node:crypto";
 import { run as execRun } from "./exec.js";
 import { bodyHashOf, publicationBody, publicationGrantOf } from "./publish.js";
@@ -411,6 +412,10 @@ export async function mergePullRequest(store, input) {
     // A release task the plane approved (or is checking) automatically (auto-approve-green.md) never merges here either.
     if (mergedTask !== null && autoReleaseSealed(store, mergedTask))
         return refuse("release", "This result was approved automatically for a release; it merges only through `toolroll release`.");
+    // A fast start merges only after a person accepted it, and only a change that stayed small (fast-start.ts).
+    const fastHold = mergedTask === null ? null : fastPublishProblem(store, mergedTask, input.runId);
+    if (fastHold !== null)
+        return refuse("fast-start", fastHold);
     const publication = store.publicationForRun(input.runId);
     const follow = publication === null ? null : followOf(store, publication.id);
     if (publication === null || follow === null || publication.prNumber === null)

package/dist/push.d.ts

@@ -69,10 +69,26 @@ export declare const PUSH_WORDS: Record<PushClass, {
     title: string;
     body: string;
 }>;
+/** The relative links a push may carry (docs/plans/plain-toolroll.md P1.4): every shape an older worker took, kept for
+ * good (/next and /review now redirect to Home and Tasks' Ready view; the rest keep their pages), then Home, Tasks'
+ * Ready and Board views, and a task by its stored number (/n/<n>, resolved under the viewer's own access). */
+export declare const LINK_SHAPES: readonly RegExp[];
 /** Static words and machine-minted numbers only — re-proved at send time. */
 export declare function safePushLink(pushClass: PushClass, link: string | null): string;
-/** `release`: the class and link the plane derived for this row at send time (releasePushOf); absent or null, the
- * row's stored class and link, revalidated. */
+/** One line per ping (docs/plans/plain-toolroll.md P1.5), built only from the task's stored number and fixed words: no
+ * title, no free text. A fact about a task opens that task (/n/<n>); anything else keeps its class's fixed words and
+ * its own allow-listed link. Rows are tried in order; the first that matches says the line. */
+export declare const PUSH_LINES: readonly {
+    when: (notification: Pick<Notification, "kind" | "pushClass">) => boolean;
+    say: (number: number) => string;
+}[];
+/** The one line a ping says, and where its tap lands. */
+export declare function pushLineOf(notification: Pick<Notification, "kind" | "pushClass" | "body" | "link" | "taskRef">): {
+    body: string;
+    url: string;
+};
+/** `release`: the class and link the plane derived for this row at send time (releasePushOf): fixed words and a release's
+ * own link, never the task line. Absent or null, the row's own line. */
 export declare function buildPushPayload(notification: Notification, waiting?: number | null, release?: {
     link: string;
 } | null): string;

package/dist/push.js

@@ -199,20 +199,24 @@ export const PUSH_WORDS = {
     decision: { title: "Toolroll", body: "a decision needs you" },
     pick: { title: "Toolroll", body: "agents finished — pick a winner" },
     merge: { title: "Toolroll", body: "a pull request needs a person" },
-    attention: { title: "Toolroll", body: "the plane needs attention" },
+    attention: { title: "Toolroll", body: "Toolroll needs your attention" },
     progress: { title: "Toolroll", body: "checks in progress" },
     release: { title: "Toolroll", body: RELEASE_PUSH_WORDS },
 };
 // `/approve/<n>`: a release's opaque locator (a task ref number: no version, commit or branch), resolved by the console.
 const RELEASE_LINK = /^\/approve\/[0-9]{1,15}$/;
-const LINK_SHAPES = [/^\/next$/, /^\/review$/, /^\/system$/, /^\/routines$/, /^\/routines\/[0-9]{1,15}$/, /^\/d\/[0-9]{1,15}$/, /^\/r\/[0-9]{1,15}$/, RELEASE_LINK];
+/** The relative links a push may carry (docs/plans/plain-toolroll.md P1.4): every shape an older worker took, kept for
+ * good (/next and /review now redirect to Home and Tasks' Ready view; the rest keep their pages), then Home, Tasks'
+ * Ready and Board views, and a task by its stored number (/n/<n>, resolved under the viewer's own access). */
+export const LINK_SHAPES = [/^\/next$/, /^\/review$/, /^\/system$/, /^\/routines$/, /^\/routines\/[0-9]{1,15}$/, /^\/d\/[0-9]{1,15}$/, /^\/r\/[0-9]{1,15}$/, RELEASE_LINK,
+    /^\/$/, /^\/tasks\?view=ready$/, /^\/tasks\?view=board$/, /^\/n\/[1-9][0-9]{0,14}$/];
 const CLASS_FALLBACK = {
-    decision: "/next",
-    pick: "/next",
-    merge: "/review",
-    attention: "/next",
-    progress: "/next",
-    release: "/next",
+    decision: "/",
+    pick: "/",
+    merge: "/tasks?view=ready",
+    attention: "/",
+    progress: "/",
+    release: "/",
 };
 /** Static words and machine-minted numbers only — re-proved at send time. */
 export function safePushLink(pushClass, link) {
@@ -223,17 +227,37 @@ export function safePushLink(pushClass, link) {
         return link;
     return CLASS_FALLBACK[pushClass];
 }
-/** `release`: the class and link the plane derived for this row at send time (releasePushOf); absent or null, the
- * row's stored class and link, revalidated. */
+/** One line per ping (docs/plans/plain-toolroll.md P1.5), built only from the task's stored number and fixed words: no
+ * title, no free text. A fact about a task opens that task (/n/<n>); anything else keeps its class's fixed words and
+ * its own allow-listed link. Rows are tried in order; the first that matches says the line. */
+export const PUSH_LINES = [
+    { when: one => one.kind === "plan-ready", say: number => `#${number}: plan ready` },
+    { when: one => one.pushClass === "decision" || one.kind === "task-ask" || one.kind === "decision", say: number => `#${number} has a question` },
+    { when: one => one.pushClass === "merge" || one.pushClass === "pick" || one.kind === "pull-request-ready" || one.kind === "acceptance-ready", say: number => `#${number} is ready to review` },
+    { when: () => true, say: number => `#${number} needs you` },
+];
+/** The one line a ping says, and where its tap lands. */
+export function pushLineOf(notification) {
+    const pushClass = notification.pushClass;
+    if (pushClass === "progress" && isCheckProgressLine(notification.body))
+        return { body: notification.body, url: safePushLink(pushClass, notification.link) };
+    const number = notification.taskRef;
+    if (typeof number === "number" && Number.isSafeInteger(number) && number > 0) {
+        const row = PUSH_LINES.find(one => one.when(notification));
+        return { body: row.say(number), url: `/n/${number}` };
+    }
+    return { body: PUSH_WORDS[pushClass].body, url: safePushLink(pushClass, notification.link) };
+}
+/** `release`: the class and link the plane derived for this row at send time (releasePushOf): fixed words and a release's
+ * own link, never the task line. Absent or null, the row's own line. */
 export function buildPushPayload(notification, waiting = null, release = null) {
-    const pushClass = release !== null ? "release" : notification.pushClass;
-    const words = PUSH_WORDS[pushClass];
+    const line = release !== null ? { body: PUSH_WORDS.release.body, url: safePushLink("release", release.link) } : pushLineOf(notification);
     return JSON.stringify({
-        title: words.title,
-        body: pushClass === "progress" && isCheckProgressLine(notification.body) ? notification.body : words.body,
-        url: safePushLink(pushClass, release !== null ? release.link : notification.link),
+        title: "Toolroll",
+        body: line.body,
+        url: line.url,
         // The opaque tag collapses a crash-duplicate on the lock screen.
-        tag: pushClass === "progress" && notification.run !== null ? `so-run-${notification.run}` : `so-${notification.id}`,
+        tag: release === null && notification.pushClass === "progress" && notification.run !== null ? `so-run-${notification.run}` : `so-${notification.id}`,
         // The app-icon badge (Phase 2E, v2 S4): the server-computed
         // waiting-on-you COUNT at send time — a number, never content, so the
         // closed-class discipline holds. The console page recomputes and

package/dist/release-adapters.d.ts

@@ -131,6 +131,8 @@ export type AutoObservers = {
     /** Whether main's protection holds for the account that merges (readMainProtection); null when unreadable. */
     upToDateRequired: () => Promise<boolean | null>;
     evidenceRoot: string;
+    /** The cases that ran in `sha`'s macOS CI (fenced-check-coverage.ts); null when they can't be read. Absent: never read. */
+    macosCases?: (sha: string) => Promise<ReadonlyMap<string, boolean> | null>;
 };
 /**
  * Every check run GitHub holds for one commit — every attempt, not only the latest (`filter=all`; GitHub's default
@@ -169,6 +171,13 @@ export declare function readMergeBase(run: Exec, gh: string, repo: string, base:
  * never from a ref in a checkout a build can write.
  */
 export declare function readMainHead(run: Exec, gh: string, repo: string, branch?: string): Promise<string>;
+/** GitHub's own "Update branch", with its expected head: a push that got there first refuses. */
+export declare function updatePullRequestBranch(run: Exec, gh: string, repo: string, pr: number, expectedHead: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    why: string;
+}>;
 /** Whether `sha` already holds `ancestor` (GitHub's compare: `sha` is not behind it), as GitHub answers now. */
 export declare function readContains(run: Exec, gh: string, repo: string, sha: string, ancestor: string): Promise<boolean>;
 /**

package/dist/release-adapters.js

@@ -24,6 +24,10 @@ import { databasePath, finishReleaseOperation, requireFreshReleaseApproval, open
 import { acquireDeploymentLock } from "./deploy-lock.js";
 import { autoReleaseApprovalOf, liveReleaseOf } from "./scope.js";
 import { recheckReleaseTask, releaseCheckStanding } from "./check-failure.js";
+import { CHECK_REPORT_CAPTURE, readSealedJson } from "./check-report.js";
+import { readCheckReport } from "./contracts/release-check.js";
+import { macosCases, skipCoverage, skippedCases, uncoveredWords } from "./fenced-check-coverage.js";
+import { runCheckStamp } from "./store.js";
 import { noteCiRunning, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { autoPublishHeld, holdAutoPublish, liftCiHold, authorizeAutoCheck, giveUpAutoApproval, noteAutoCheckFailed, noteAutoRelease, releaseAutoApproves, sealAutoGreen } from "./release-auto.js";
 import { proveCarry } from "./release-carry.js";
@@ -436,6 +440,7 @@ export function releaseAdapters(options) {
     };
     const release = storeReleaseAdapter(() => openStore(database), store => store.close(), options.now ?? (() => new Date()), undefined, { observe: sha => observeCi(sha), mergeBase: (base, sha) => readMergeBase(reads, ciGh, releaseRepo().slug, base, sha),
         upToDateRequired: () => readUpToDateRequired(reads, ciGh, releaseRepo().slug), evidenceRoot: join(dirname(database), "evidence"),
+        macosCases: sha => macosCasesOf(run, ciGh, releaseRepo().slug, sha),
         // A successful Actions job authenticates the job, not the candidate-writable JSON it uploads. Until the
         // executor protects that reporting channel, production releases must take the person's approval road.
         reportsProtected: false }, 
@@ -660,6 +665,7 @@ export function releaseAdapters(options) {
             async complete(repo, sha) { return readSuitesComplete(reads, ciGh, repo, sha); },
             async mainHead(repo) { return readMainHead(reads, ciGh, repo); },
             async contains(repo, sha, ancestor) { return readContains(reads, ciGh, repo, sha, ancestor); },
+            async updateBranch(repo, pr, expectedHead) { return updatePullRequestBranch(reads, ciGh, repo, pr, expectedHead); },
             async upToDateRequired(repo) { return readMainProtection(reads, ciGh, repo); },
             async merge(repo, pr, head, message) {
                 // The squash commit's message lists every commit that landed after the approval (release-once.md). Never asked
@@ -989,6 +995,33 @@ nightlyReads) {
                     return answer.action === "rerun" ? { action: "rerun", why: answer.why } : answer.action === "pending" ? { action: "pending" } : { action: "stop", class: answer.class, why: answer.why };
                 });
             },
+            async fencedCoverage(_taskId, run, candidate) {
+                // Today's road, read first and answered at once: a check that ran unsandboxed skips nothing for this reason. A run
+                // from before stamps (a release resumed across an update) is judged by the level its dispatch recorded.
+                const asked = withStore(store => {
+                    if (store.runCheckAccess(run) === "unsandboxed")
+                        return null;
+                    const reading = runCheckStamp(store, run);
+                    if (reading.state !== "current")
+                        return { refused: "how its check ran wasn't recorded, so what it skipped can't be judged" };
+                    if (reading.stamp.level === "unsandboxed")
+                        return null;
+                    const sealed = readSealedJson(store, auto.evidenceRoot, run, CHECK_REPORT_CAPTURE);
+                    const report = sealed === null ? null : readCheckReport(sealed.value);
+                    return report?.ok === true ? { skipped: skippedCases(report.value) } : { refused: "its report can't be read, so what it skipped can't be judged" };
+                });
+                if (asked === null)
+                    return { ok: true, covered: 0 };
+                if ("refused" in asked)
+                    return { ok: false, why: asked.refused };
+                if (asked.skipped.length === 0)
+                    return { ok: true, covered: 0 };
+                const macos = await auto.macosCases?.(candidate) ?? null;
+                if (macos === null)
+                    return { ok: false, why: "this commit's macOS CI reports couldn't be read, so what the sandboxed check skipped isn't covered" };
+                const coverage = skipCoverage(asked.skipped, macos);
+                return coverage.uncovered.length > 0 ? { ok: false, why: uncoveredWords(coverage.uncovered) } : { ok: true, covered: coverage.covered.length };
+            },
             async standing(taskId, run) {
                 return withStore(store => {
                     const standing = releaseCheckStanding(store, auto.evidenceRoot, { taskId, run });
@@ -1317,6 +1350,13 @@ export async function readMainHead(run, gh, repo, branch = "main") {
         throw new Error(`GitHub named no commit for ${branch}`);
     return match[1];
 }
+/** GitHub's own "Update branch", with its expected head: a push that got there first refuses. */
+export async function updatePullRequestBranch(run, gh, repo, pr, expectedHead) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || !Number.isSafeInteger(pr) || pr < 1 || !/^[0-9a-f]{40}$/.test(expectedHead))
+        return { ok: false, why: "not a pull request GitHub can be asked to update" };
+    const ran = await run(gh, ["api", "--hostname", "github.com", "--method", "PUT", `repos/${repo}/pulls/${pr}/update-branch`, "-f", `expected_head_sha=${expectedHead}`], { cwd: "/", env: ciEnv() });
+    return ran.code === 0 ? { ok: true } : { ok: false, why: (ran.stderr.trim().split("\n")[0] ?? "").slice(0, 200) || `gh exited ${ran.code}` };
+}
 /** Whether `sha` already holds `ancestor` (GitHub's compare: `sha` is not behind it), as GitHub answers now. */
 export async function readContains(run, gh, repo, sha, ancestor) {
     if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) || !/^[0-9a-f]{40}$/.test(sha) || !/^[0-9a-f]{40}$/.test(ancestor))
@@ -1530,3 +1570,39 @@ export function releaseProgressRecorder(open, done) {
         }
     };
 }
+/** The macOS CI's cases on exactly `sha`: the newest pull-request run of ci.yml there, each shard's newest attempt. Null
+ * when they can't all be read. The folder is this function's own, removed before it returns. */
+async function macosCasesOf(run, gh, slug, sha) {
+    const folder = mkdtempSync(join(tmpdir(), "so-macos-ci-"));
+    try {
+        const listed = await run(gh, ["api", `repos/${slug}/actions/runs?head_sha=${sha}&event=pull_request&per_page=100`], { timeoutMs: 60_000 });
+        if (listed.code !== 0)
+            return null;
+        const runs = JSON.parse(listed.stdout).workflow_runs ?? [];
+        const newest = runs.filter(one => typeof one.id === "number" && one.head_sha === sha && (one.path === ".github/workflows/ci.yml" || String(one.path).startsWith(".github/workflows/ci.yml@"))).map(one => one.id).sort((a, b) => b - a)[0];
+        if (newest === undefined)
+            return null;
+        const got = await run(gh, ["run", "download", String(newest), "--repo", slug, "--pattern", "macos-shard-*", "--dir", folder], { timeoutMs: 180_000 });
+        if (got.code !== 0)
+            return null;
+        const shards = new Map();
+        for (const name of readdirSync(folder)) {
+            const match = /^macos-(shard-\d+-\d+)-a([1-9]\d*)$/.exec(name);
+            if (match === null)
+                return null;
+            const was = shards.get(match[1]);
+            if (was === undefined || Number(match[2]) > was.attempt)
+                shards.set(match[1], { attempt: Number(match[2]), name });
+        }
+        if (shards.size === 0)
+            return null;
+        const reports = [...shards.values()].map(one => JSON.parse(readFileSync(join(folder, one.name, "shard-report.json"), "utf8")));
+        return macosCases(reports, `/Users/runner/work/${slug.split("/")[1]}/${slug.split("/")[1]}`);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        rmSync(folder, { recursive: true, force: true });
+    }
+}

package/dist/release-auto.js

@@ -19,7 +19,7 @@ import { sealedRun } from "./release-recheck.js";
 import { runCheckLevel } from "./check-levels.js";
 import { readVerifiedCommit, verifiedBlobs, verifiedTreeDiff, verifiedTreeEntries } from "./commit-extract.js";
 import { EVAL_HOOK_FILES, evalHookProblem, LEARNING_HOOK_FILES, learningHookProblem, storeRewriteProblem } from "./eval-hooks.js";
-import { mightName, testInfrastructure } from "./test-infra.js";
+import { isTestPath, mightName, testImportProblem, testInfrastructure } from "./test-infra.js";
 import { chatControlHref } from "./chat-controls.js";
 import { INFRA_RERUNS_PER_CANDIDATE, REQUIRED_PR_CHECKS, REQUIRED_PR_CHECKS_WORKFLOW, prChecksVerdict } from "./release.js";
 import { releaseCheckStanding } from "./check-failure.js";
@@ -359,18 +359,18 @@ function changeProblem(repo, base, candidate) {
         // Taking a test away is never automatic, wherever it lives.
         if (change.kind === "deleted" && TEST_FILE.test(rulePath(change.path)))
             return `${change.path} was deleted (removing a test needs a person)`;
-        if (change.before !== null && TEST_FILE.test(rulePath(change.path))) {
-            // Counts cannot prove that an assertion survived: replacing it, commenting it out, or skipping its case can
-            // leave the counts unchanged. Only append-only additions preserve the existing code without interpretation.
-            // Both copies come from verified trees; no report or candidate-provided file list decides this permission.
-            const was = verifiedBlobs(gitDir, before.value.tree, [change.path]);
-            const now = verifiedBlobs(gitDir, after.value.tree, [change.path]);
-            if (!was.ok || !now.ok)
-                return `${change.path}'s existing test code couldn't be read (a person decides)`;
-            const original = was.value.get(change.path)?.bytes, revised = now.value.get(change.path)?.bytes;
-            if (original === undefined || revised === undefined || !revised.subarray(0, original.length).equals(original)) {
-                return `${change.path} changes existing test code (removing or rewriting tests needs a person)`;
-            }
+        // Counts cannot prove that an assertion survived, and an appended line can disarm what it follows (`vi.mock` hoists,
+        // a top-level hook reaches every case): a test file that was there stays exactly as it was (H4).
+        if (change.before !== null && TEST_FILE.test(rulePath(change.path)))
+            return `${change.path} changes existing test code (new tests go in a new file; rewriting tests needs a person)`;
+        // A new test may not reach into another: it would run that file's code, and its mocks, here. From the verified tree.
+        // Any test extension: `src/` passes autoPathProblem whatever the file is called, so `.test.ts` alone would miss `.test.tsx`.
+        if (change.kind === "added" && isTestPath(rulePath(change.path))) {
+            const read = verifiedBlobs(gitDir, after.value.tree, [change.path]);
+            const bytes = read.ok ? read.value.get(change.path)?.bytes : undefined;
+            const why = bytes === undefined ? `${change.path}'s test code couldn't be read` : testImportProblem(change.path, bytes.toString("utf8"));
+            if (why !== null)
+                return `${why} (a person decides)`;
         }
         const why = autoPathProblem(change.path);
         if (why !== null)

package/dist/release-card.d.ts

@@ -1,6 +1,6 @@
 import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
 import type { Scope } from "./scope.js";
-import type { Store } from "./store.js";
+import { type Store } from "./store.js";
 /** One signed term as the card says it. `key` names the scope field or the release term's path. */
 export type TermLine = {
     key: string;
@@ -151,7 +151,6 @@ export type ReleaseCard = {
 };
 /** The card digest: everything the person is shown that can change under them. */
 export declare function cardDigestOf(scopeDigest: string, formDigest: string, changes: Pick<ChangeList, "baseline" | "digest">): string;
-/** The release card for a deploy gate, against the live records now. */
 export declare function releaseCardOf(store: Store, scope: Scope, formDigest: string, words: {
     profile: (profile: Scope["profile"]) => string | null;
 }, read?: PullRequestReader): ReleaseCard;

package/dist/release-card.js

@@ -20,6 +20,7 @@ import { createHash } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import { checkAccessWords } from "./check-access.js";
+import { ranWords } from "./check-stamp.js";
 import { CHECK_LEVEL_WORDS, effectiveCheckLevel } from "./check-levels.js";
 import { verifiedRange } from "./commit-extract.js";
 import { releaseCheckPurposeSchema, releaseTermsSchema } from "./contracts/release-terms.js";
@@ -29,6 +30,7 @@ import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
 import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+import { taskCheckStamp } from "./store.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -382,6 +384,13 @@ function changeWords(changes, terms, cap) {
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
 }
 /** The release card for a deploy gate, against the live records now. */
+/** How this task's last check ran, when one did and it wasn't plainly sandboxed: the sealed level above is what will run;
+ * this is what did. Nothing for a release no check has run for. */
+function lastCheckWords(store, repo, taskId) {
+    const ran = repo === null ? null : taskCheckStamp(store, repo, taskId);
+    const words = ran === null ? null : ranWords(ran.reading);
+    return words === null ? [] : [`Last check: ${words}.`];
+}
 export function releaseCardOf(store, scope, formDigest, words, read) {
     const terms = scope.releaseTerms ?? null;
     // Either sealed form (Codex round 2, finding 1): the identity both share, for the head lines and the change list.
@@ -400,6 +409,8 @@ export function releaseCardOf(store, scope, formDigest, words, read) {
             : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
         // What an unsandboxed check means, before consent (Codex round 2, finding 1).
         ...(identity === null || releaseAccessWords(identity.access) === null ? [] : [releaseAccessWords(identity.access)]),
+        // A check that already ran for this task, from its stamp (H2): never read as sandboxed when it can't be shown.
+        ...lastCheckWords(store, identity?.repo ?? null, scope.taskId),
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
         // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.

package/dist/release-carry.d.ts

@@ -44,8 +44,13 @@ export declare function stricterOf(a: ReleasePolicy | null, b: ReleasePolicy | n
  * the rules don't rely on that).
  */
 export declare function rulePath(path: string): string;
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy): string | null;
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy, fresh?: ReadonlySet<string>): string | null;
 /**
  * A release scope's terms, from the plane's own records: the project's repository, the approved commit and its
  * verified tree, the effective policy, the live release check grant and the check access (only the fence), and the

package/dist/release-carry.js

@@ -19,6 +19,7 @@
  * read only Toolroll's records and verified objects. (Coverage, in release-recheck.ts, trusts test code by Alex's
  * explicit decision; nothing here does.)
  */
+import { prepareProtectedStorage, storageRefusalOf } from "./protected-storage.js";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -26,14 +27,17 @@ import { join, sep } from "node:path";
 import { execFileSync } from "node:child_process";
 import { checkLaunchRoot, fenceFor, linuxFenceAvailable, macosFenceAvailable, runFolders } from "./agent-fence.js";
 import { touchesProtected } from "./approval-policy.js";
-import { extractCommit, readVerifiedCommit, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { extractCommit, readVerifiedCommit, verifiedBlobs, verifiedFirstParentWalk, verifiedTreeDiff } from "./commit-extract.js";
+import { testImportProblem } from "./test-infra.js";
 import { projectGitDir } from "./check-report.js";
+import { checkAccessOf } from "./check-access.js";
+import { stampRefusal } from "./check-stamp.js";
 import { CARRY_RULES_VERSION, readReleasePolicy, releasePolicyDigest } from "./contracts/release-terms.js";
 import { run } from "./exec.js";
 import { proxyEnv, startEgressProxy } from "./egress.js";
 import { liveReleaseOf } from "./scope.js";
 import { UNSANDBOXED_CARRY_ACTION, carriesUnsandboxed } from "./release-authority.js";
-import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, } from "./store.js";
+import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, taskCheckStamp, } from "./store.js";
 // ------------------------------------------------------------------ the rules
 /** The journey scripts: tests, by Alex's decision (they carry). */
 export const JOURNEY_SCRIPTS = Object.freeze(["scripts/app-e2e.mjs", "scripts/flows-e2e.mjs"]);
@@ -111,8 +115,15 @@ export function stricterOf(a, b) {
 export function rulePath(path) {
     return path.toLowerCase().split("/").map(part => part.replace(/[. ]+$/, "")).filter(part => part !== "" && part !== ".").join("/");
 }
-/** Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. */
-export function changeRefusal(change, policy) {
+/** Tests by the rules' classes: what the existing-test rule holds still. */
+const carriedTest = (normal) => CARRY_RULES.classes.some(one => (one.name === "unit tests" || one.name === "journey scripts") && one.matches(normal));
+/**
+ * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
+ * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
+ * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
+ * appended line can disarm what it follows.
+ */
+export function changeRefusal(change, policy, fresh = new Set()) {
     const path = change.path;
     const normal = rulePath(path);
     if (change.kind === "deleted")
@@ -133,6 +144,8 @@ export function changeRefusal(change, policy) {
         return `${path} is protected in this project`;
     if (!CARRY_RULES.classes.some(one => one.matches(normal)))
         return `${path} isn't a test, a doc or the changelog`;
+    if (change.kind === "modified" && carriedTest(normal) && !fresh.has(path))
+        return `${path} changes an existing test, and new tests go in a new file`;
     return null;
 }
 // ------------------------------------------------------------------ release terms
@@ -211,6 +224,11 @@ export function preflightCarry(store, input) {
     if ((a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed") && policy.unsandboxedCarry !== true) {
         return refuse("rules", "This project's checks run outside the sandbox, and carrying release approvals then wasn't on when this release was approved, or is off now.");
     }
+    // A carry leans on the check the release already had: it must be shown to have stayed within what was approved (H2).
+    const ran = taskCheckStamp(store, a.repo, a.tipTask);
+    const unshown = ran === null ? null : stampRefusal(ran.reading, checkAccessOf(a.accessDigest));
+    if (unshown !== null)
+        return refuse("rules", `This release's approval can't carry: ${unshown}.`);
     if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(input.to))
         return refuse("ancestry", `${input.to} isn't a full commit id.`);
     if (input.to === a.tipSha)
@@ -234,6 +252,10 @@ export function preflightCarry(store, input) {
         treeOf.set(commit.id, commit.tree);
     const commits = [];
     let churn = 0;
+    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
+    if (!whole.ok)
+        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
+    const fresh = new Set(whole.value.filter(one => one.kind === "added").map(one => one.path));
     for (const commit of ordered) {
         const parentTree = treeOf.get(commit.parents[0]);
         if (parentTree === undefined)
@@ -242,21 +264,30 @@ export function preflightCarry(store, input) {
         if (!diff.ok)
             return refuse("shape", `${commit.id.slice(0, 7)} couldn't be read: ${diff.message}`);
         for (const change of diff.value) {
-            const why = changeRefusal(change, policy);
+            const why = changeRefusal(change, policy, fresh);
             if (why !== null)
                 return refuse("rules", `${commit.id.slice(0, 7)}: ${why}.`, change.path);
         }
         churn += diff.value.reduce((n, one) => n + one.added + one.deleted, 0);
         commits.push({ sha: commit.id, files: diff.value.map(one => ({ path: one.path, added: one.added, deleted: one.deleted })) });
     }
-    const whole = verifiedTreeDiff(gitDir, a.approvedTree, chain[0].tree);
-    if (!whole.ok)
-        return refuse("shape", `The change since the approval couldn't be read: ${whole.message}`);
     for (const change of whole.value) {
-        const why = changeRefusal(change, policy);
+        const why = changeRefusal(change, policy, fresh);
         if (why !== null)
             return refuse("rules", `Since the approval: ${why}.`, change.path);
     }
+    // No new test may reach into another (H4). Read from the verified tree, never from a checkout.
+    // By the rules' own classifier, so everything that carries as a test is read (a new journey script too).
+    const newTests = whole.value.filter(one => one.kind === "added" && carriedTest(rulePath(one.path))).map(one => one.path);
+    const added = newTests.length === 0 ? null : verifiedBlobs(gitDir, chain[0].tree, newTests);
+    if (added !== null && !added.ok)
+        return refuse("shape", `The new tests couldn't be read: ${added.message}`);
+    for (const path of newTests) {
+        const bytes = added !== null && added.ok ? added.value.get(path)?.bytes : undefined;
+        const why = bytes === undefined ? `${path} couldn't be read` : testImportProblem(path, bytes.toString("utf8"));
+        if (why !== null)
+            return refuse("rules", `Since the approval: ${why}.`, path);
+    }
     const changedLines = whole.value.reduce((n, one) => n + one.added + one.deleted, 0);
     if (changedLines > policy.limits.lines)
         return refuse("limits", `${changedLines} lines changed since the approval; at most ${policy.limits.lines} carry.`);
@@ -274,11 +305,19 @@ export function fencedBuildRunner(store) {
         if (!macosFenceAvailable() && !linuxFenceAvailable()) {
             return { code: 1, stdout: "", stderr: "This machine can't confine the build (no macOS sandbox, no working bubblewrap), so it didn't run.\n", timedOut: false, notFound: false };
         }
+        // The storage check, awaited off this thread (protected-storage.ts); its words are the build's when it can't finish.
+        let storage;
+        try {
+            storage = await prepareProtectedStorage();
+        }
+        catch (error) {
+            return { code: 1, stdout: "", stderr: `${storageRefusalOf(error)?.message ?? "The build's fence could not be prepared, so it didn't run."}\n`, timedOut: false, notFound: false };
+        }
         const egress = await startEgressProxy({ hosts: [] });
         try {
             const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: "proxy-only", socketRoots: [...options.writable], token: egress.secret };
             const launch = fenceFor("check", {
-                databaseFile: store.databaseFile(), worktree: options.cwd, boundary: null, binding: null, runFolders: runFolders(null), poolRoots: [],
+                databaseFile: store.databaseFile(), worktree: options.cwd, boundary: null, binding: null, runFolders: runFolders(null), poolRoots: [], storage,
                 writes: { writes: { subpaths: [...options.writable], prefixes: [] }, readOnly: [] }, network,
             });
             return await run(file, args, { cwd: options.cwd, env: { ...options.env, ...proxyEnv(egress, "proxy-only") }, timeoutMs: options.timeoutMs, processGroup: true,