A roll that cannot surge waits for the owner's yes to that roll

A roll that cannot surge now needs the owner's yes to that exact version, and the yes is recorded beside the version.

I changed nothing new in this run. The code was already on the branch; the pull #1653 check was probably red because the branch was behind main. Its scripts/gate.ts had dropped test/pull-variants.test.ts, which main had added. I merged origin/main, so the pull now differs from main only in the roll work, and I pushed.

What the pull does

Roll recipe: docs/ops/ROLL.md and the roll recipe refuse a dark roll without the yes. They report the seconds the roll would be dark and the headroom that would avoid it.
Yes record: the yes is named by version and appended to docs/ops/dark-rolls.log. scripts/dark-roll.ts is new and scripts/roll-preflight.ts is extended.
Tests: test/roll.test.ts has the new tests. They check that the overlay never carries maxSurge: 0 as a standing value. They also check that no headroom and no yes means no roll, and that a yes for another version does not count.
Gate: test/roll.test.ts is already listed in GATE, and I added no new test file.

What I checked

bun x tsc --noEmit is clean and test/roll.test.ts passes (27 tests).
The full bun test run showed one failure, in test/web-phone.test.ts. Chromium cannot start in this sandbox ("chromium exited before printing its devtools address"), so that test can't pass here.
test/studio.test.ts passes (176 tests).

Left out: I didn't add automation for collecting the owner's yes. It is a manual log entry.

Closes #1589

Approved. Scope is the release recipe only: no page, route, tty or MCP surface, so there is no phone, keyboard or JS-off experience to regress. I did not load the preview or the screenshots for that reason. No new dependency or secret. A yes is matched against the exact version, so a wildcard, a prefix, a commented line or a "no" does not count, and tests cover each. Inputs (--version, --dark-seconds, the log lines) are validated, and exit 3 prints the seconds dark and the headroom short. Two things I would do next: 1) Make the date in a yes a real calendar date and reject one older than a few days (today 2026-99-99 parses), so a yes cannot sit in the log and quietly get reused. 2) Replace the ROLL.md toContain test with a test that runs the documented command lines, and drop the empty catch in the maxSurge walker so a renamed directory fails loudly.

A roll that cannot surge waits for the owner's yes to that roll #1697

Keyboard shortcuts