[vishr]

What this changes

Fixes #228.

Saved-plan human deploys now print the existing interactive no-op completion line. No-op plans state that the current release remains current and put the fresh-roll graph and commands under an explicit --redeploy condition, including in the sealed JSON artifact.

- release temporal (recreate): ... --force-recreate
+ without --redeploy: no changes — R0 remains current
+ with --redeploy only:
+   release temporal (recreate): ... --force-recreate

Why this is correct

Both planning and execution already use the same Compose/payload equality decision. planWorkloadActions deliberately seals fresh-roll actions with reason redeploy_only when that decision is a no-op, so --redeploy cannot widen approved retain actions. The command list and human graph omitted that condition, making an optional fresh roll look unconditional. Separately, the saved-plan adapter never rendered the successful no-op result.

Preserving the default no-op follows the shipped capabilities contract for retaining unchanged workloads and the policies contract for no_op with exit 0. Showing both branches follows the plan-fidelity contract that runtime branches are shown as branches. docs/product.md describes the product direction; the shipped capabilities and executable-plan policies govern this correction.

• Before the fix, TestNoOpDeployReportsOutcome/saved_human failed with only the runner/applying-plan line, and TestNoOpPlanShowsRedeployAsConditional failed on unconditional recreate commands for temporal and ui.
• After the fix, go test ./cmd/ob ./internal/onebox -run 'TestNoOp|TestExecuteNoOp|TestPlanWorkloadActionsSealsNoOp' -count=1 passes. Coverage includes human saved/interactive output, JSON/NDJSON parity, no workload/job execution or activation, and existing under-lock drift rejection.
• just check passes: module/format checks, vet, the full Go suite, generated documentation, and site build. The site build emits Astro deprecation/content warnings. Opt-in Docker/SSH suites were not run.

Effect on the safety envelope

None. This corrects the plan and outcome presentation. The sealed fresh-roll actions, approval requirements, binding checks, and execution decisions are preserved.

Checklist

• just check passes locally.
• Tests cover the new behaviour, including the failure paths.
• Generated documentation is current (just check verifies this).
• I have accepted the CLA, or will when the bot asks on my first pull request.

https://claude.ai/code/session_01AATfNEixcF8BQWkWJNDExs