kettle-jem 7.1.39 → 7.1.41

data/lib/kettle/jem.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "find"
 require "English"
 require "digest"
+require "date"
 require "json"
 require "net/http"
 require "open3"
@@ -25,6 +26,7 @@ require "kettle/dev"
 require "kettle/changelog"
 require "kettle/rb/compat_matrix"
 require "kettle/rb/gem_floors"
+require "kettle/rb/ruby_series_buckets"
 require "kettle/rb/platform_support"
 require_relative "jem/version"
 require_relative "jem/license_txt_migrator"
@@ -44,7 +46,7 @@ module Kettle
     PACKAGE_NAME = "kettle-jem"
     CONTENT_RECIPE_TRANSPORT_VERSION = Ast::Merge::STRUCTURED_EDIT_TRANSPORT_VERSION
     TEMPLATE_SOURCE_APPLICATION_FINGERPRINT_VERSION = 1
-    APPRAISALS_TEMPLATE_POLICY_FINGERPRINT_VERSION = 2
+    APPRAISALS_TEMPLATE_POLICY_FINGERPRINT_VERSION = 3
     GEMSPEC_TEMPLATE_POLICY_FINGERPRINT_VERSION = 2
     SPEC_HELPER_TEMPLATE_POLICY_FINGERPRINT_VERSION = 1
     VERSION_NAMESPACE_TEMPLATE_POLICY_FINGERPRINT_VERSION = 2
@@ -62,11 +64,11 @@ module Kettle
     # set in place before Bundler is allowed to evaluate that destination.
     TEMPLATE_MANAGED_DEPENDENCIES = [
       {name: PACKAGE_NAME, requirements: ["~> 7.1", ">= 7.1.28"], bootstrap: false},
-      {name: "nomono", requirements: ["~> 1.1", ">= 1.1.14"], bootstrap: true},
-      {name: "kettle-dev", requirements: ["~> 3.1", ">= 3.1.21"], bootstrap: true},
+      {name: "nomono", requirements: ["~> 1.1", ">= 1.1.17"], bootstrap: true},
+      {name: "kettle-dev", requirements: ["~> 3.1", ">= 3.1.26"], bootstrap: true},
       {
         name: "kettle-changelog",
-        requirements: ["~> 1.0", ">= 1.0.13"],
+        requirements: ["~> 1.0", ">= 1.0.15"],
         bootstrap: true,
         ruby_requirement: ">= 4.0.0"
       }
@@ -88,6 +90,12 @@ module Kettle
     ].freeze
     OPENCOLLECTIVE_DISABLED_FILES = %w[.opencollective.yml .github/workflows/opencollective.yml].freeze
     OPT_IN_GITHUB_WORKFLOWS = %w[.github/workflows/discord-notifier.yml].freeze
+    # Templates that exist only for projects that set `workflows.duel: true`.
+    # While Duel is off, kettle-jem neither writes nor removes these paths, so a
+    # project's own files at them stay exactly as they are.
+    DUEL_TEMPLATE_PATHS = %w[.duel.rb .github/workflows/perf.yml gemfiles/modular/duel.gemfile].freeze
+    DUEL_MAIN_GEMFILE_EVAL_PATH = "gemfiles/modular/duel.gemfile"
+    DUEL_APPRAISAL_NAME = "perf"
     OBSOLETE_APPRAISAL_SPEC_EXEC_CMDS = [
       "env KETTLE_TEST_RUNNER=rspec kettle-test -I ../spec --options ../.rspec ../spec",
       "KETTLE_TEST_RUNNER=rspec kettle-test -I ../spec --options ../.rspec ../spec",
@@ -228,9 +236,10 @@ module Kettle
       "feature.dedicated_version_gem" => :boolean,
       "workflow.dep_heads" => :boolean,
       "workflow.jruby_94" => :boolean,
+      "workflow.duel" => :boolean,
       "version_gem.mode" => :enum
     }.freeze
-    COPY_ONLY_WHEN_MISSING_TEMPLATE_PATHS = %w[REEK bin/setup].freeze
+    COPY_ONLY_WHEN_MISSING_TEMPLATE_PATHS = %w[REEK bin/setup .duel.rb].freeze
     MONOREPO_ROOT_TEMPLATE_PROFILE = "monorepo-root"
     MONOREPO_SUBGEM_PACKAGE_TEMPLATE_PROFILE = "monorepo-subgem-package"
     MONOREPO_SUBGEM_RELEASE_TEMPLATE_PROFILE = "monorepo-subgem-release"
@@ -574,14 +583,18 @@ module Kettle
       KJ|MIN_RUBY
       KJ|KETTLE_CHANGELOG_GEMFILE_DEPENDENCY
       KJ|OPENCOLLECTIVE_ORG
+      KJ|RAKE:DUEL_TASK
       KJ|RAKE:TOP_LEVEL_DOCS_TASK
       KJ|README:COPYRIGHT_NOTICE
       KJ|README:CORPORATE_SPONSORS
+      KJ|README:CORPORATE_SPONSORS_DETAIL
       KJ|README:FAMILY_INTRO_BACKEND_MATRIX
       KJ|README:LICENSE_BADGE
       KJ|README:LICENSE_COMPAT_BADGE
       KJ|README:LICENSE_EYE_WORKFLOW_BADGE
       KJ|README:DEV_TEST_STACK_TABLE
+      KJ|README:DUEL_BADGE
+      KJ|README:DUEL_REFS
       KJ|README:FOSSA_BADGE
       KJ|README:FOSSA_REFS
       KJ|README:H2_SYNOPSIS_LOGO_ROW
@@ -1493,6 +1506,7 @@ module Kettle
     README_LICENSE_EYE_WORKFLOW_LINK_LABELS = ["🚎15-🪪-wf", "🚎15-🪪-wfi"].freeze
     README_FOSSA_BADGE = "[![FOSSA Status][🧪fossa-img]][🧪fossa]"
     README_FOSSA_LINK_LABELS = ["🧪fossa", "🧪fossa-img"].freeze
+    README_DUEL_BADGE = "[![Duel][⚔️duel-img]][⚔️duel]"
     LICENSE_EYE_COMPATIBILITY_LICENSES = %w[MIT].freeze
     SKYWALKING_EYES_INTEGRATION = "skywalking-eyes"
     README_OPEN_COLLECTIVE_FUNDING_BADGES = "[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors]"
@@ -1519,9 +1533,9 @@ module Kettle
       patreon
       polar
       thanks_dev
-      tidelift
     ].freeze
-    FUNDING_README_PLATFORMS = (FUNDING_YML_PLATFORMS + ["paypal"]).freeze
+    # Tidelift remains supported for legacy funding configuration and cleanup.
+    FUNDING_README_PLATFORMS = (FUNDING_YML_PLATFORMS + %w[paypal tidelift]).freeze
     FUNDING_DEFAULT_DISABLED_PLATFORMS = %w[issuehunt patreon polar].freeze
     README_FUNDING_BADGE_POLICIES = {
       "github" => {
@@ -1559,9 +1573,7 @@ module Kettle
         labels: ["🖇kofi", "🖇kofi-img"]
       },
       "tidelift" => {
-        badges: [
-          "[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]"
-        ],
+        badges: ["[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]"],
         labels: ["🏙️entsup-tidelift", "🏙️entsup-tidelift-img"]
       }
     }.freeze
@@ -3201,6 +3213,7 @@ module Kettle
         custom_workflows: github_actions_custom_workflows(project_root, template_config, opencollective_disabled: opencollective_disabled)
       }
       standard_appraisal_gemfiles = github_actions_standard_appraisal_gemfiles(kettle_config)
+      facts[:ci][:duel] = true if template_config["resolved_duel"]
       facts[:ci][:standard_appraisal_gemfiles] = standard_appraisal_gemfiles unless standard_appraisal_gemfiles.empty?
       facts[:ci][:opt_in_workflow_cleanups] = opt_in_workflows unless opt_in_workflows.empty?
       facts[:ci][:inactive_packaged_workflow_cleanups] = inactive_workflows unless inactive_workflows.empty?
@@ -3289,7 +3302,13 @@ module Kettle
             "yaml",
             "supplied_github_funding_yaml_synchronization",
             facts: %w[package funding]
-          )
+          ).tap do |recipe|
+            # Cold-start only: on a bootstrap run (no config yet, hence no
+            # template source preferences) this recipe materializes a first
+            # FUNDING.yml. Configured runs get FUNDING.yml from
+            # template_source_application instead.
+            recipe[:seed_if_empty] = true if facts[:kettle_config_bootstrap]
+          end
         ]
       end
       if facts[:kettle_config_bootstrap]
@@ -3627,6 +3646,13 @@ module Kettle
       changed_files = changed_files_from_recipe_reports(recipe_reports)
       file_outcomes = template_file_outcomes(recipe_reports)
       diagnostics = recipe_reports.flat_map { |report| report[:diagnostics] }
+      legacy_config_migration = legacy_kettle_config_migration(project_root)
+      if legacy_config_migration
+        diagnostics << {
+          severity: "advisory",
+          message: "kettle:jem legacy config #{LEGACY_KETTLE_CONFIG_PATH} will be moved to #{KETTLE_CONFIG_PATH} on apply"
+        }
+      end
       phase_reports = phase_reports_for(recipe_reports)
       decision_evaluations = recipe_reports.map { |report| report.fetch(:decision_evaluation) }
       prompt_requests = decision_evaluations.filter_map { |decision| decision[:prompt] if decision[:prompt_required] }
@@ -3670,6 +3696,7 @@ module Kettle
         }
       end
       emit_summary_event(events, report)
+      report[:legacy_config_migration] = legacy_config_migration.merge(applied: false) if legacy_config_migration
       report
     end
 
@@ -4300,8 +4327,10 @@ module Kettle
     end
 
     def apply_project(project_root, env: ENV, run_options: {})
+      legacy_config_migration = apply_legacy_kettle_config_migration!(project_root)
       events = event_stream_from_options(run_options)
       report = plan_project(project_root, env: env, run_options: run_options).merge(mode: "apply")
+      report[:legacy_config_migration] = legacy_config_migration if legacy_config_migration
       file_work_workers = with_event_phase(events, "file_work_workers") { file_work_workers_for(env, run_options) }
       file_work_thread_workers = with_event_phase(events, "file_work_thread_workers") { file_work_thread_workers_for(env, run_options) }
       report[:file_work_workers] = file_work_workers
@@ -4333,6 +4362,9 @@ module Kettle
       report[:changed_files] = (report.fetch(:changed_files, []) + report.fetch(:post_apply_steps).flat_map do |step|
         reported_post_apply_changed_files(step)
       end).uniq.sort
+      if legacy_config_migration
+        report[:changed_files] = (report.fetch(:changed_files, []) + [LEGACY_KETTLE_CONFIG_PATH, KETTLE_CONFIG_PATH]).uniq.sort
+      end
       report[:duplicate_drift] = if DecisionPolicy.value_to_boolean((run_options || {})[:defer_drift_check])
         {available: false, skipped: true, reason: "deferred_until_postprocessing"}
       else
@@ -5120,11 +5152,11 @@ module Kettle
       [
         {name: "appraisal2", source: %(gem "appraisal2", "~> 3.2", ">= 3.2.6"\n)},
         {name: "bundler-audit", source: %(gem "bundler-audit", "~> 0.9.3"\n)},
-        {name: "kettle-dev", source: %(gem "kettle-dev", "~> 3.1", ">= 3.1.21"\n)},
-        {name: "kettle-drift", source: %(gem "kettle-drift", "~> 1.0", ">= 1.0.17"\n)},
-        {name: "kettle-family", source: %(gem "kettle-family", "~> 1.3", ">= 1.3.29"\n)},
+        {name: "kettle-dev", source: %(gem "kettle-dev", "~> 3.1", ">= 3.1.26"\n)},
+        {name: "kettle-drift", source: %(gem "kettle-drift", "~> 1.0", ">= 1.0.19"\n)},
+        {name: "kettle-family", source: %(gem "kettle-family", "~> 1.3", ">= 1.3.36"\n)},
         {name: PACKAGE_NAME, source: kettle_jem_dependency_source},
-        {name: "kettle-test", source: %(gem "kettle-test", "~> 2.0", ">= 2.0.27"\n)},
+        {name: "kettle-test", source: %(gem "kettle-test", "~> 2.0", ">= 2.0.29"\n)},
         {name: "rake", source: %(gem "rake", "~> 13.0"\n)},
         {name: "rspec", source: %(gem "rspec", "~> 3.0"\n)},
         {name: "stone_checksums", source: %(gem "stone_checksums", "~> 1.0", ">= 1.0.9"\n)},
@@ -5638,6 +5670,7 @@ module Kettle
         "KJ|PROJECT_EMOJI" => "💎",
         "KJ|README:COPYRIGHT_NOTICE" => "",
         "KJ|README:CORPORATE_SPONSORS" => "",
+        "KJ|README:CORPORATE_SPONSORS_DETAIL" => "",
         "KJ|README:LICENSE_BADGE" => "",
         "KJ|README:LICENSE_COMPAT_BADGE" => "",
         "KJ|README:DEV_TEST_STACK_TABLE" => "",
@@ -6025,6 +6058,7 @@ module Kettle
         "feature.dedicated_version_gem" => version_gem_mode == "dedicated" || File.file?(File.join(project_root, "lib", entrypoint, "version_gem.rb")),
         "workflow.dep_heads" => File.file?(File.join(project_root, ".github", "workflows", "dep-heads.yml")),
         "workflow.jruby_94" => File.file?(File.join(project_root, ".github", "workflows", "jruby-9.4.yml")),
+        "workflow.duel" => duel_configured?(config) && duel_template_profile?(profile),
         "version_gem.mode" => version_gem_mode
       }
     end
@@ -6419,7 +6453,7 @@ module Kettle
         when "generated_block_sync"
           synchronize_managed_block(original, facts)
         when "github_funding_yml"
-          synchronize_github_funding_yml(original, facts)
+          synchronize_github_funding_yml(original, facts, seed_if_empty: recipe[:seed_if_empty])
         when "github_actions_ci"
           synchronize_github_actions_ci(original, facts)
         when "github_actions_framework_ci"
@@ -6827,7 +6861,7 @@ module Kettle
 
       content = recipe_template_content(project_root, recipe, template_contents: template_contents)
       return finalize_github_workflow_template(content, facts) if strategy == "raw_copy" && github_workflow_template_recipe?(recipe)
-      return finalize_template_source_content(recipe, content) if strategy == "raw_copy"
+      return finalize_template_source_content(recipe, content, facts: facts) if strategy == "raw_copy"
 
       resolved = recipe.fetch(:resolved_template_content) do
         resolve_template_tokens(
@@ -6882,7 +6916,7 @@ module Kettle
           return preserve_newer_github_workflow_action_pins(merged, original)
         end
 
-        return finalize_template_source_content(recipe, merged)
+        return finalize_template_source_content(recipe, merged, facts: facts)
       end
       if strategy == "accept_template"
         accepted = finalize_accepted_template_source(recipe, resolved, original, facts: facts, project_root: project_root)
@@ -6902,7 +6936,7 @@ module Kettle
           )
         end
 
-        return finalize_template_source_content(recipe, accepted)
+        return finalize_template_source_content(recipe, accepted, facts: facts)
       end
 
       resolved = finalize_github_workflow_template(resolved, facts) if github_workflow_template_recipe?(recipe)
@@ -6916,11 +6950,11 @@ module Kettle
         )
       end
 
-      finalize_template_source_content(recipe, resolved)
+      finalize_template_source_content(recipe, resolved, facts: facts)
     end
 
-    def finalize_template_source_content(recipe, content)
-      return finalize_rubocop_config(content) if recipe.fetch(:target_path).to_s == ".rubocop.yml"
+    def finalize_template_source_content(recipe, content, facts: nil)
+      return finalize_rubocop_config(content, facts) if recipe.fetch(:target_path).to_s == ".rubocop.yml"
       return finalize_kettle_config_template_source(recipe, content) if recipe.fetch(:target_path).to_s == KETTLE_CONFIG_PATH
       return normalize_simplecov_template_source(content) if recipe.fetch(:target_path).to_s == ".simplecov"
       return normalize_spec_helper_simplecov_template_source(content) if recipe.fetch(:target_path).to_s == "spec/spec_helper.rb"
@@ -6934,9 +6968,77 @@ module Kettle
       assert_no_unresolved_template_tokens_in_yaml_values(resolved, KETTLE_CONFIG_PATH)
     end
 
-    def finalize_rubocop_config(content)
+    def finalize_rubocop_config(content, facts = nil)
       finalized = remove_yaml_scalar_path(content, %w[AllCops TargetRubyVersion])
-      ensure_yaml_top_level_sequence_items(finalized, "plugins", ["rubocop-rspec"])
+      finalized = ensure_yaml_top_level_sequence_items(finalized, "plugins", ["rubocop-rspec"])
+      return finalized unless facts.to_h.dig(:ci, :duel)
+
+      ensure_rubocop_duel_config(finalized)
+    end
+
+    # Duel's configuration is a dotfile, which RuboCop skips unless it is
+    # included. Merging Include, as Exclude is, keeps RuboCop's own patterns.
+    def ensure_rubocop_duel_config(content)
+      merged = ensure_yaml_child_sequence_items(
+        content,
+        "inherit_mode",
+        "merge",
+        ["Include"],
+        comment: "# Merge Include too, so .duel.rb (a dotfile) is added to the defaults"
+      )
+      ensure_yaml_child_sequence_items(
+        merged,
+        "AllCops",
+        "Include",
+        [".duel.rb"],
+        comment: "# Duel's configuration is a dotfile, which RuboCop skips unless included"
+      )
+    end
+
+    # Ensures that the block sequence at parent_key.key holds items, adding
+    # the parent mapping or the key when missing. The comment goes above the
+    # added key, or above the added items when the key exists. A flow
+    # sequence or mapping is left alone.
+    def ensure_yaml_child_sequence_items(content, parent_key, key, items, comment:)
+      document = Psych.parse_stream(content.to_s).children.first
+      root = document&.root
+      return content unless root.is_a?(Psych::Nodes::Mapping)
+
+      lines = content.to_s.lines
+      parent_key_node, parent_node = root.children.each_slice(2).find do |candidate_key, _candidate_value|
+        candidate_key.is_a?(Psych::Nodes::Scalar) && candidate_key.value.to_s == parent_key.to_s
+      end
+      unless parent_key_node
+        lines << "\n" unless lines.empty? || lines.last.strip.empty?
+        lines << "#{parent_key}:\n" << "  #{comment}\n" << "  #{key}:\n"
+        items.each { |item| lines << "    - #{item}\n" }
+        return lines.join
+      end
+      return content unless parent_node.is_a?(Psych::Nodes::Mapping) && parent_node.style == Psych::Nodes::Mapping::BLOCK
+      return content if parent_node.children.empty?
+
+      key_node, value_node = parent_node.children.each_slice(2).find do |candidate_key, _candidate_value|
+        candidate_key.is_a?(Psych::Nodes::Scalar) && candidate_key.value.to_s == key.to_s
+      end
+      unless key_node
+        indent = lines.fetch(parent_node.children.first.start_line)[/\A\s*/]
+        added = ["#{indent}#{comment}\n", "#{indent}#{key}:\n", *items.map { |item| "#{indent}  - #{item}\n" }]
+        lines.insert(parent_key_node.start_line + 1, *added)
+        return lines.join
+      end
+      return content unless value_node.is_a?(Psych::Nodes::Sequence) && value_node.style == Psych::Nodes::Sequence::BLOCK
+      return content if value_node.children.empty?
+
+      existing = value_node.children.filter_map { |child| child.value.to_s if child.is_a?(Psych::Nodes::Scalar) }
+      missing = items.map(&:to_s) - existing
+      return content if missing.empty?
+
+      last = value_node.children.last
+      indent = lines.fetch(last.start_line)[/\A\s*/]
+      lines.insert(last.end_line + 1, "#{indent}#{comment}\n", *missing.map { |item| "#{indent}- #{item}\n" })
+      lines.join
+    rescue Psych::Exception
+      content
     end
 
     def finalize_accepted_template_source(recipe, content, destination_content, facts:, project_root: nil)
@@ -6944,7 +7046,7 @@ module Kettle
       when :gemfile
         finalize_gemfile_template_source(recipe, content, destination_content, facts: facts, template_content: content)
       when :appraisals
-        merged = merge_appraisals_template_policy(content, facts: facts)
+        merged = merge_appraisals_template_policy(content, facts: facts, target_path: recipe.fetch(:target_path))
         if recipe.fetch(:target_path).to_s == "Appraisal.root.gemfile"
           normalize_appraisal_root_templating_gate(merged, facts)
         else
@@ -7236,6 +7338,7 @@ module Kettle
         "FUNDING_TIDELIFT",
         keep: funding_platform_enabled?(facts.dig(:funding, :platforms), "tidelift")
       )
+      processed = processed.gsub(/<!-- KJ:FUNDING_TIDELIFT:(?:START|END) -->\n?/, "")
       star_history_enabled = facts.dig(:repository, :star_history, :enabled) == true
       return processed if star_history_enabled
 
@@ -7252,6 +7355,12 @@ module Kettle
       open_collective_enabled = !facts.dig(:funding, :open_collective_disabled)
       processed = apply_markdown_conditional_block(content, "OPEN_COLLECTIVE", keep: open_collective_enabled)
       processed = apply_markdown_conditional_block(processed, "NO_OPEN_COLLECTIVE", keep: !open_collective_enabled)
+      processed = apply_markdown_conditional_block(
+        processed,
+        "FUNDING_TIDELIFT",
+        keep: funding_platform_enabled?(facts.dig(:funding, :platforms), "tidelift")
+      )
+      processed = processed.gsub(/<!-- KJ:FUNDING_TIDELIFT:(?:START|END) -->\n?/, "")
       funding_platforms = facts.dig(:funding, :platforms)
       if facts.dig(:funding, :open_collective_disabled)
         processed = remove_readme_badge_and_refs(
@@ -7624,7 +7733,7 @@ module Kettle
         if file_type == :gemfile
           return finalize_gemfile_template_source(recipe, template_content, destination_content, facts: facts, template_content: template_content)
         end
-        return merge_appraisals_template_policy(template_content, facts: facts) if file_type == :appraisals
+        return merge_appraisals_template_policy(template_content, facts: facts, target_path: recipe.fetch(:target_path)) if file_type == :appraisals
         return finalize_github_workflow_template(prune_github_workflow_matrix_by_min_ruby(template_content, facts), facts) if github_workflow_template_recipe?(recipe)
 
         return template_content
@@ -7633,7 +7742,7 @@ module Kettle
         if file_type == :gemfile
           return finalize_gemfile_template_source(recipe, destination_content, destination_content, facts: facts, template_content: template_content)
         end
-        return merge_appraisals_template_policy(destination_content, facts: facts) if file_type == :appraisals
+        return merge_appraisals_template_policy(destination_content, facts: facts, target_path: recipe.fetch(:target_path)) if file_type == :appraisals
 
         return destination_content
       end
@@ -7680,7 +7789,7 @@ module Kettle
           output = merge_gemfile_eval_bucket_entries(template_content, output, destination_content: destination_content)
           return finalize_gemfile_template_source(recipe, output, destination_content, facts: facts, template_content: template_content)
         end
-        return merge_appraisals_template_policy(output, facts: facts) if file_type == :appraisals
+        return merge_appraisals_template_policy(output, facts: facts, target_path: recipe.fetch(:target_path)) if file_type == :appraisals
 
         output = finalize_github_workflow_template(prune_github_workflow_matrix_by_min_ruby(output, facts), facts) if github_workflow_template_recipe?(recipe)
         output = normalize_simplecov_template_source(output) if recipe.fetch(:target_path).to_s == ".simplecov"
@@ -7741,6 +7850,7 @@ module Kettle
           output = preserve_destination_gemfile_source(output, destination_content)
         end
         output = inject_main_gemfile_recording_eval(output, facts)
+        output = inject_main_gemfile_duel_eval(output, facts)
         output = inject_main_gemfile_default_test_bundle(output, facts)
         output = remove_stale_main_gemfile_tree_sitter_language_pack(output, template_content)
         output = remove_stale_main_gemfile_direct_sibling_block(output, template_content)
@@ -9394,6 +9504,34 @@ module Kettle
       ensure_trailing_newline(lines.join.gsub(/\n{3,}/, "\n\n"))
     end
 
+    # Duel for local development (`rake duel`), from its modular Gemfile, which
+    # installs nothing below Ruby 3.4. CI loads it from the perf appraisal.
+    def inject_main_gemfile_duel_eval(content, facts)
+      return content unless facts.to_h.dig(:ci, :duel)
+      return content if gemfile_eval_paths(content).include?(DUEL_MAIN_GEMFILE_EVAL_PATH)
+
+      lines = content.to_s.lines
+      insert_at = main_gemfile_duel_insertion_index(content)
+      unless insert_at
+        lines << "\n" unless lines.empty? || lines.last.strip.empty?
+        insert_at = lines.length
+      end
+      lines.insert(insert_at, "# Performance regression guards (Duel requires Ruby 3.4 or later)\n", %(eval_gemfile "#{DUEL_MAIN_GEMFILE_EVAL_PATH}"\n), "\n")
+      ensure_trailing_newline(lines.join.gsub(/\n{3,}/, "\n\n"))
+    end
+
+    # After the optional dependencies, before the extracted standard library
+    # gems.
+    def main_gemfile_duel_insertion_index(content)
+      lines = content.to_s.lines
+      call = ruby_call_records(content, :eval_gemfile).find do |candidate|
+        ruby_string_argument(candidate).to_s == "gemfiles/modular/x_std_libs.gemfile"
+      end
+      return unless call
+
+      gemfile_eval_comment_start_line(lines, call.location.start_line) - 1
+    end
+
     # The root Gemfile is the local-development bundle. Appraisals and CI use
     # their own Gemfiles, so a project that needs a framework or application
     # harness locally must declare that dependency separately in test_bundle.
@@ -10489,14 +10627,16 @@ module Kettle
       version.split(".", -1).all? { |part| !part.empty? && part.each_char.all? { |char| char.between?("0", "9") } }
     end
 
-    def merge_appraisals_template_policy(content, facts:)
+    def merge_appraisals_template_policy(content, facts:, target_path: nil)
       package_name = facts.dig(:package, :name).to_s if facts
       min_ruby = minimum_ruby_token(facts.dig(:ci, :test_min_ruby) || facts.dig(:rubygems, :min_ruby)) if facts
       with_framework_appraisals = merge_framework_matrix_appraisals(content, facts)
       with_standard_appraisal_gemfiles = inject_standard_appraisal_gemfiles(with_framework_appraisals, facts)
+      with_standard_appraisal_gemfiles = inject_duel_appraisal(with_standard_appraisal_gemfiles, facts) if target_path.to_s == "Appraisals"
       pruned = prune_appraisals_recording_entries(with_standard_appraisal_gemfiles, facts)
       pruned = prune_appraisals_below_min_ruby(pruned, min_ruby)
       pruned = remove_managed_stdlib_appraisal_gems(pruned)
+      pruned = remove_duplicate_runtime_heads_from_head_appraisal(pruned)
       pruned = migrate_legacy_byebug_appraisal_dependencies(pruned)
       pruned = remove_gemfile_dependency_lines(pruned, [package_name])
       remove_gemfile_percent_w_entries(pruned, [package_name])
@@ -10617,6 +10757,56 @@ module Kettle
       end
     end
 
+    # Older generated Appraisals put runtime dependency HEADs in the `head`
+    # appraisal alongside Ruby-version-compatible extracted stdlib versions.
+    # The template tests those separately: `head` uses compatible versions,
+    # while `dep-heads` tests runtime dependency HEADs. Remove the stale eval
+    # only when the separate dependency-head appraisal is present.
+    def remove_duplicate_runtime_heads_from_head_appraisal(content)
+      parsed = appraisal_blocks(content)
+      blocks = parsed.fetch(:blocks)
+      head = blocks["head"]
+      return content unless head && appraisal_x_stdlib_eval_gemfile_call(head)
+      return content unless blocks["dep-heads"] && runtime_heads_eval_gemfile_call(blocks["dep-heads"])
+
+      call = runtime_heads_eval_gemfile_call(head)
+      return content unless call
+
+      lines = head.lines
+      first = call.location.start_line - 1
+      last = ruby_node_source_end_line(call) - 1
+      first -= 1 while first.positive? && gemfile_comment_line?(lines[first - 1])
+      head = ensure_trailing_newline(lines.each_with_index.reject { |_line, index| (first..last).cover?(index) }.map(&:first).join.gsub(/\n{3,}/, "\n\n"))
+      blocks["head"] = head
+      ensure_trailing_newline(([parsed.fetch(:prelude).to_s.rstrip] + parsed.fetch(:order).map { |name| blocks.fetch(name).rstrip }).reject(&:empty?).join("\n\n"))
+    end
+
+    def runtime_heads_eval_gemfile_call(block)
+      ruby_call_records(block, :eval_gemfile).find do |call|
+        ruby_string_argument(call).to_s.end_with?("modular/runtime_heads.gemfile")
+      end
+    end
+
+    # The perf appraisal, whose generated gemfiles/perf.gemfile the Perf
+    # workflow bundles: the gemspec's dependencies and Duel. An existing perf
+    # appraisal is the project's, and is kept as it is.
+    def inject_duel_appraisal(content, facts)
+      return content unless facts.to_h.dig(:ci, :duel)
+      return content if appraisal_call_records(content).any? { |record| record.fetch(:name) == DUEL_APPRAISAL_NAME }
+
+      # (The comments are inside the block: Appraisals keeps no comment
+      # between blocks.)
+      block = <<~RUBY
+        appraise "#{DUEL_APPRAISAL_NAME}" do
+          # Performance regression guards, for .github/workflows/perf.yml
+          # (Duel requires Ruby 3.4 or later)
+          eval_gemfile "modular/duel.gemfile"
+          eval_gemfile "modular/x_std_libs.gemfile"
+        end
+      RUBY
+      ensure_trailing_newline([content.to_s.rstrip, block].reject(&:empty?).join("\n\n"))
+    end
+
     def prune_appraisals_recording_entries(content, facts)
       remove_indexes = Set.new
       lines = content.to_s.lines
@@ -11114,9 +11304,16 @@ module Kettle
     end
 
     def gemspec_standard_legacy_version_loader_block(entrypoint_require:, namespace:, min_ruby:)
-      legacy_require =
+      legacy_else =
         if min_ruby >= REQUIRE_RELATIVE_MIN_RUBY
-          %(require_relative "lib/#{entrypoint_require}/version")
+          <<~RUBY.chomp
+            # Ruby < 3.1: Kernel.load(path, module) is unavailable, but Module#module_eval with file
+            # metadata works on Ruby 2.2+. Anonymous loading matters beyond coverage: evaluating this
+            # gemspec (e.g. by bundler/setup in a subprocess) must not define top-level constants,
+            # which isolated-loading specs assert on.
+            version_path = "\#{__dir__}/lib/#{entrypoint_require}/version.rb"
+            Module.new.tap { |mod| mod.module_eval(File.read(version_path), version_path, 1) }::#{namespace}::Version::VERSION
+          RUBY
         else
           <<~RUBY.chomp
             # NOTE: Use __FILE__ or __dir__ until removal of Ruby 1.x support
@@ -11124,6 +11321,7 @@ module Kettle
             lib = File.expand_path("lib", File.dirname(__FILE__))
             $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
             require "#{entrypoint_require}/version"
+            #{namespace}::Version::VERSION
           RUBY
         end
 
@@ -11135,8 +11333,7 @@ module Kettle
             # See: https://github.com/panorama-ed/memo_wise/pull/397
             #{gemspec_modern_version_loader_expression(entrypoint_require: entrypoint_require, namespace: namespace)}
           else
-            #{legacy_require.gsub("\n", "\n    ")}
-            #{namespace}::Version::VERSION
+            #{legacy_else.gsub("\n", "\n    ")}
           end
       RUBY
     end
@@ -13934,9 +14131,6 @@ module Kettle
       if !opencollective_disabled && funding_platform_enabled?(enabled_platforms, "open_collective")
         urls << github_funding_platform_urls("open_collective", [open_collective_org]).first
       end
-      if funding_platform_enabled?(enabled_platforms, "tidelift")
-        urls << github_funding_platform_urls("tidelift", ["rubygems/#{package_name}"]).first
-      end
 
       urls.compact.uniq.sort
     end
@@ -13974,8 +14168,6 @@ module Kettle
           "https://opencollective.com/#{handle}"
         when "thanks_dev"
           "https://thanks.dev/#{handle}"
-        when "tidelift"
-          "https://tidelift.com/funding/github/#{handle}"
         end
       end
     end
@@ -13996,7 +14188,8 @@ module Kettle
         next if opencollective_disabled && opencollective_disabled_file?(relative_path)
         next if inactive_packaged_workflow?(relative_path, config)
         next if generated_or_obsolete_github_workflow?(relative_path) &&
-          !skip_packaged_workflow_template?(relative_path, config)
+          !skip_packaged_workflow_template?(relative_path, config) &&
+          !skip_duel_template?(relative_path, config)
 
         relative_path
       end.sort
@@ -14149,7 +14342,7 @@ module Kettle
       path = kettle_jem_config_path(project_root)
       return {} unless File.exist?(path)
 
-      config = YAML.safe_load_file(path, permitted_classes: [], aliases: false) || {}
+      config = YAML.safe_load_file(path, permitted_classes: [Date], aliases: false) || {}
       config = normalize_kettle_jem_config(config)
       validate_kettle_jem_config!(config)
       config
@@ -14175,9 +14368,38 @@ module Kettle
 
     def kettle_jem_config_path(project_root)
       canonical = File.join(project_root, KETTLE_CONFIG_PATH)
+      legacy = File.join(project_root, LEGACY_KETTLE_CONFIG_PATH)
+      if File.exist?(canonical) && File.exist?(legacy)
+        raise Error, "Invalid kettle-jem config: both #{KETTLE_CONFIG_PATH} and legacy #{LEGACY_KETTLE_CONFIG_PATH} exist in #{project_root}. " \
+          "The legacy file is silently ignored when both are present, so this combination is not supported. " \
+          "Merge any unique settings from #{LEGACY_KETTLE_CONFIG_PATH} into #{KETTLE_CONFIG_PATH}, then delete #{LEGACY_KETTLE_CONFIG_PATH}."
+      end
       return canonical if File.exist?(canonical)
 
-      File.join(project_root, LEGACY_KETTLE_CONFIG_PATH)
+      legacy
+    end
+
+    # Legacy-only projects are migrated to the canonical config path with MOVE
+    # semantics: the content lands at .structuredmerge/kettle-jem.yml and the
+    # legacy .kettle-jem.yml is removed, so there is never a stale second
+    # config that the loader silently ignores.
+    def legacy_kettle_config_migration(project_root)
+      canonical = File.join(project_root, KETTLE_CONFIG_PATH)
+      legacy = File.join(project_root, LEGACY_KETTLE_CONFIG_PATH)
+      return unless File.exist?(legacy)
+      return if File.exist?(canonical)
+
+      {from: LEGACY_KETTLE_CONFIG_PATH, to: KETTLE_CONFIG_PATH}
+    end
+
+    def apply_legacy_kettle_config_migration!(project_root)
+      migration = legacy_kettle_config_migration(project_root)
+      return unless migration
+
+      canonical = File.join(project_root, KETTLE_CONFIG_PATH)
+      FileUtils.mkdir_p(File.dirname(canonical))
+      FileUtils.mv(File.join(project_root, LEGACY_KETTLE_CONFIG_PATH), canonical)
+      migration.merge(applied: true)
     end
 
     def kettle_jem_config_relative_path(project_root)
@@ -14739,7 +14961,7 @@ module Kettle
         "KJ|CI:EXEC_CMD" => facts.dig(:ci, :exec_cmd).to_s,
         "KJ|CI:OS_MATRIX_ENTRIES" => github_actions_current_os_matrix_entries(facts),
         "KJ|CI:OS_TEST_STEPS" => github_actions_current_os_test_steps(facts),
-        "KJ|README:PLATFORM_SUPPORT_TABLE" => readme_platform_support_table(facts),
+        "KJ|README:CURRENT_MRI_PLATFORMS" => readme_current_mri_platforms(facts),
         "KJ|RAKE:TOP_LEVEL_DOCS_TASK" => rake_top_level_docs_task_token(facts).rstrip,
         "KJ|GITHUB_ACTIONS:COVERAGE_UPLOAD_STEPS" => github_actions_coverage_steps(disabled_integrations: facts.dig(:integrations, :disabled))
       }.merge(
@@ -14771,6 +14993,7 @@ module Kettle
         readme_family_intro_and_backend_matrix(facts.fetch(:readme_style, {}))
       tokens["KJ|README:DEV_TEST_STACK_TABLE"] = readme_dev_test_stack_table(package.fetch(:name).to_s)
       tokens.merge!(readme_fossa_template_tokens(facts.fetch(:readme_style, {})))
+      tokens.merge!(duel_template_tokens(facts))
       tokens.merge!(rubyforum_template_tokens(facts.fetch(:rubyforum, {})))
       tokens.merge!(version_gem_template_tokens(facts))
       tokens.merge!(shim_template_tokens(facts.fetch(:shim, {})))
@@ -14814,66 +15037,17 @@ module Kettle
       "#{package_name} / #{namespace}"
     end
 
-    # The README platform tier table, generated from the same facts that drive
-    # the workflows, so it cannot drift from CI again (spec slice 1038). Rows
-    # mirror the generated workflow set: versioned MRI workflows are Linux-only,
-    # the current.yml OS matrix covers the declared platforms for MRI current,
-    # and every engine lane outside current.yml is Linux-only. Engine capability
-    # notes come from Kettle::Rb::PlatformSupport and carry their citation.
-    def readme_platform_support_table(facts)
-      engines = facts.dig(:rubygems, :engines)
-      engines = DEFAULT_ENGINES if engines.nil? || engines.empty?
+    # Keep the platform detail within Compatibility. The compatibility badge
+    # table already carries engine/version detail; this adds the OS platforms
+    # exercised by the current MRI lane.
+    def readme_current_mri_platforms(facts)
       platforms = facts.dig(:ci, :platforms)
       platforms = DEFAULT_PLATFORMS if platforms.nil? || platforms.empty?
-      ruby_versions = facts.dig(:ci, :ruby_versions).to_a.map(&:to_s).reject(&:empty?)
+      platform_names = platforms.map { |platform| (platform == "macos") ? "macOS" : platform.capitalize }
+      return platform_names.first if platform_names.one?
+      return platform_names.join(" and ") if platform_names.length == 2
 
-      parallel = "Parallel support"
-      unsupported = "Unsupported"
-      rows = []
-
-      unless ruby_versions.empty?
-        rows << [
-          "MRI #{ruby_versions.first}-#{ruby_versions.last}",
-          parallel, unsupported, unsupported,
-          "Versioned Ruby workflows run on Linux."
-        ]
-      end
-      rows << [
-        "MRI current",
-        parallel,
-        platforms.include?("macos") ? parallel : unsupported,
-        platforms.include?("windows") ? parallel : unsupported,
-        "Current Ruby workflow covers the declared OS platforms."
-      ]
-      rows << [
-        "MRI head",
-        parallel, unsupported, unsupported,
-        "CI is allowed to fail while Ruby is in development."
-      ]
-
-      (engines - ["ruby"]).each do |engine|
-        label = (engine == "jruby") ? "JRuby" : "TruffleRuby"
-        windows_entry = Kettle::Rb::PlatformSupport.engine_os_entry(engine, "windows")
-        note = if windows_entry && windows_entry.support == "unsupported"
-          "#{windows_entry.note} ([source](#{windows_entry.citation}))"
-        else
-          "Engine workflows run on Linux; macOS and Windows are not exercised by CI."
-        end
-        rows << ["#{label} (all CI lanes)", parallel, unsupported, unsupported, note]
-      end
-
-      [
-        "Support tiers describe what this project's CI actually exercises, not what may",
-        "work in an untested environment:",
-        "",
-        "- **Parallel support**: CI runs the test suite with multiple workers available.",
-        "- **Unsupported**: the engine/platform combination is not covered by CI and is",
-        "  not a project compatibility claim.",
-        "",
-        "| Ruby engine/version | Linux | macOS | Windows | Notes |",
-        "|---------------------|-------|-------|---------|-------|",
-        *rows.map { |row| "| #{row.join(" | ")} |" }
-      ].join("\n")
+      platform_names[0...-1].join(", ") + ", and #{platform_names.last}"
     end
 
     def readme_dev_test_stack_table(package_name)
@@ -14911,6 +15085,41 @@ module Kettle
       }
     end
 
+    # The README badge and the Rake task, for a project with Duel on. They are
+    # empty otherwise, which leaves its README and Rakefile as they were.
+    def duel_template_tokens(facts)
+      unless facts.dig(:ci, :duel)
+        return {"KJ|RAKE:DUEL_TASK" => "", "KJ|README:DUEL_BADGE" => "", "KJ|README:DUEL_REFS" => ""}
+      end
+
+      {
+        "KJ|RAKE:DUEL_TASK" => rake_duel_task_token,
+        "KJ|README:DUEL_BADGE" => README_DUEL_BADGE,
+        "KJ|README:DUEL_REFS" => [
+          "[⚔️duel]: https://github.com/sferik/duel-ruby",
+          "[⚔️duel-img]: https://raw.githubusercontent.com/sferik/duel-ruby/main/assets/badge.svg"
+        ].join("\n")
+      }
+    end
+
+    def rake_duel_task_token
+      <<~RAKE
+        ### PERFORMANCE TASKS
+        # Duel's performance regression guards: rake duel compares this tree with
+        # the main branch (see .duel.rb and duel/). Duel requires Ruby 3.4 or
+        # later, so older Rubies get a stub task.
+        begin
+          require "duel/rake_task"
+          Duel::RakeTask.new
+        rescue LoadError
+          desc("(stub) duel is unavailable")
+          task("duel") do
+            warn("NOTE: duel isn't installed, or is disabled for \#{RUBY_VERSION} in the current environment")
+          end
+        end
+      RAKE
+    end
+
     def readme_fossa_template_tokens(readme_style)
       project = readme_style.fetch(:fossa_project, "").to_s
       return {"KJ|README:FOSSA_BADGE" => "", "KJ|README:FOSSA_REFS" => ""} if project.empty?
@@ -15944,7 +16153,7 @@ module Kettle
     end
 
     def kettle_dev_local_gems(config)
-      gems = %w[kettle-dev kettle-family kettle-rb kettle-test kettle-soup-cover kettle-changelog]
+      gems = %w[kettle-deps-floor kettle-dev kettle-family kettle-rb kettle-test kettle-soup-cover kettle-changelog]
       plugin_names = PluginLoader.normalize_plugin_names(plugin_names_from_config(config))
       gems.concat(plugin_names.select { |plugin_name| plugin_name.start_with?("kettle-") })
       gems.uniq.join(" ")
@@ -15953,7 +16162,7 @@ module Kettle
     def main_gemfile_kettle_family_gem(package_name)
       return "" if package_name.to_s == "kettle-family"
 
-      %(gem "kettle-family", "~> 1.3", ">= 1.3.29"\n)
+      %(gem "kettle-family", "~> 1.3", ">= 1.3.36"\n)
     end
 
     def main_gemfile_nomono_bootstrap(package_name)
@@ -15966,7 +16175,7 @@ module Kettle
     end
 
     def nomono_gemfile_declaration
-      %(gem "nomono", "~> 1.1", ">= 1.1.14", require: false # ruby >= 3.2.0)
+      %(gem "nomono", "~> 1.1", ">= 1.1.17", require: false # ruby >= 3.2.0)
     end
 
     def local_gemfile_nomono_bootstrap(_package_name)
@@ -15974,11 +16183,16 @@ module Kettle
     end
 
     def nomono_bundler_bootstrap(lockfile_path)
+      # Derive the activation floor from TEMPLATE_MANAGED_DEPENDENCIES (the same
+      # source of truth as the main-Gemfile declaration) so the two can never
+      # drift apart when the floor is bumped.
+      nomono_managed = TEMPLATE_MANAGED_DEPENDENCIES.find { |dependency| dependency.fetch(:name) == "nomono" }
+      nomono_floor_requirements = nomono_managed.fetch(:requirements).inspect
       <<~RUBY.rstrip
         # Bootstrapping nomono here cannot rely on a plain `gem "nomono", ...` line.
         # Bundler records that dependency during Gemfile evaluation, but it does not
         # activate that exact version before the immediate `require "nomono/bundler"`.
-        nomono_activation_requirements = ["~> 1.1", ">= 1.1.14"]
+        nomono_activation_requirements = #{nomono_floor_requirements}
         nomono_requirement = Gem::Requirement.new(nomono_activation_requirements)
         nomono_already_activated = Gem.loaded_specs["nomono"]
         nomono_lockfile = File.expand_path(#{lockfile_path.inspect}, __dir__)
@@ -17503,7 +17717,8 @@ module Kettle
       sponsors = readme_corporate_sponsors(config, env)
       compact_hash(
         entries: sponsors,
-        row: readme_corporate_sponsors_row(sponsors)
+        row: readme_corporate_sponsors_row(sponsors),
+        detail: readme_corporate_sponsors_detail(sponsors)
       )
     end
 
@@ -17513,7 +17728,25 @@ module Kettle
         readme_config["corporate_sponsors"] || readme_config["sponsors"]
       )
       inherited = normalize_readme_corporate_sponsors_json(env["KETTLE_JEM_CORPORATE_SPONSORS_JSON"])
-      deduplicate_readme_corporate_sponsors(configured + inherited)
+      sponsors = deduplicate_readme_corporate_sponsors(configured + inherited)
+      today = Date.today
+      sponsors
+        .select { |sponsor| readme_corporate_sponsor_active?(sponsor, today) }
+        .map do |sponsor|
+          next sponsor unless sponsor[:members]
+
+          sponsor.merge(members: sponsor[:members].select { |member| readme_corporate_sponsor_active?(member, today) })
+        end
+    end
+
+    def readme_corporate_sponsor_active?(sponsor, today)
+      since = sponsor[:since]
+      return false if since && since > today
+
+      until_date = sponsor[:until]
+      return false if until_date && until_date < today
+
+      true
     end
 
     def normalize_readme_corporate_sponsors_json(value)
@@ -17529,24 +17762,68 @@ module Kettle
     def normalize_readme_corporate_sponsors(value)
       Array(value).filter_map do |entry|
         unless entry.is_a?(Hash)
-          raise ArgumentError, "corporate sponsor entries must be mappings with name, url, and img_src"
+          raise ArgumentError, "corporate sponsor entries must be mappings with name, target_href, and image_src (legacy url and img_src are also accepted)"
         end
 
         name = entry["name"].to_s.strip
-        url = entry["url"].to_s.strip
-        img_src = entry["img_src"].to_s.strip
+        url = (entry["target_href"] || entry["url"]).to_s.strip
+        img_src = (entry["image_src"] || entry["img_src"]).to_s.strip
         if name.empty? || url.empty? || img_src.empty?
-          raise ArgumentError, "corporate sponsor entries require name, url, and img_src"
+          raise ArgumentError, "corporate sponsor entries require name, target_href, and image_src (legacy url and img_src are also accepted)"
         end
 
         {
           name: name,
           url: url,
-          img_src: img_src
-        }
+          img_src: img_src,
+          since: normalize_readme_corporate_sponsor_date(entry["since"], "since", name),
+          until: normalize_readme_corporate_sponsor_date(entry["until"], "until", name),
+          members: normalize_readme_corporate_sponsor_members(entry["members"], name)
+        }.compact
+      end
+    end
+
+    # Members of an umbrella sponsor (e.g. the companies behind Alpha-Omega).
+    # Members require name and url; img_src is optional because members render
+    # as linked names in a caption, not as logos. Members may not themselves
+    # have members — nesting stops at one level.
+    def normalize_readme_corporate_sponsor_members(value, sponsor_name)
+      return nil if value.nil?
+
+      Array(value).filter_map do |entry|
+        unless entry.is_a?(Hash)
+          raise ArgumentError, "corporate sponsor #{sponsor_name.inspect} members must be mappings with name and target_href (legacy url is also accepted)"
+        end
+        unless entry["members"].nil?
+          raise ArgumentError, "corporate sponsor #{sponsor_name.inspect} members cannot themselves have members"
+        end
+
+        name = entry["name"].to_s.strip
+        url = (entry["target_href"] || entry["url"]).to_s.strip
+        img_src = (entry["image_src"] || entry["img_src"]).to_s.strip
+        if name.empty? || url.empty?
+          raise ArgumentError, "corporate sponsor #{sponsor_name.inspect} members require name and target_href (legacy url is also accepted)"
+        end
+
+        {
+          name: name,
+          url: url,
+          img_src: img_src.empty? ? nil : img_src,
+          since: normalize_readme_corporate_sponsor_date(entry["since"], "since", name),
+          until: normalize_readme_corporate_sponsor_date(entry["until"], "until", name)
+        }.compact
       end
     end
 
+    def normalize_readme_corporate_sponsor_date(value, key, name)
+      clean = value.to_s.strip
+      return nil if clean.empty?
+
+      Date.iso8601(clean)
+    rescue ArgumentError, TypeError
+      raise ArgumentError, "corporate sponsor #{name.inspect} has invalid #{key} date #{clean.inspect} (expected ISO 8601, e.g. 2026-01-31)"
+    end
+
     def deduplicate_readme_corporate_sponsors(sponsors)
       sponsors
         .group_by { |sponsor| [sponsor[:name], sponsor[:url], sponsor[:img_src]] }
@@ -17569,6 +17846,32 @@ module Kettle
       %(<p><sub>#{label} #{logos} <a href="#-floss-funding">Become a sponsor</a></sub></p>)
     end
 
+    # Markdown detail block for the FLOSS Funding section: one bullet per
+    # active sponsor with its logo and linked name. Umbrella sponsors append a
+    # "backed by" caption of linked member names (text links, not logos, so
+    # the backing relationship stays explicit in every rendering context).
+    def readme_corporate_sponsors_detail(sponsors)
+      return "" if sponsors.empty?
+
+      lines = sponsors.map do |sponsor|
+        name = sponsor.fetch(:name)
+        url = sponsor.fetch(:url)
+        img_src = sponsor.fetch(:img_src)
+        line = [
+          %(- <a href="#{html_attribute_escape(url)}">),
+          %(<img alt="#{html_attribute_escape(name)}" src="#{html_attribute_escape(img_src)}" height="32"/>),
+          %(</a> [#{name}](#{url}))
+        ].join
+        members = Array(sponsor[:members])
+        unless members.empty?
+          member_links = members.map { |member| "[#{member.fetch(:name)}](#{member.fetch(:url)})" }.join(", ")
+          line = "#{line} — backed by #{member_links}"
+        end
+        line
+      end
+      lines.join("\n")
+    end
+
     def readme_top_logo_options(config)
       readme_logo_options_from_config(config, "top_logos", "top_logo_options", README_TOP_LOGO_DEFAULTS)
     end
@@ -17869,7 +18172,8 @@ module Kettle
 
     def readme_corporate_sponsor_template_tokens(readme_sponsors)
       {
-        "KJ|README:CORPORATE_SPONSORS" => readme_sponsors[:row].to_s
+        "KJ|README:CORPORATE_SPONSORS" => readme_sponsors[:row].to_s,
+        "KJ|README:CORPORATE_SPONSORS_DETAIL" => readme_sponsors[:detail].to_s
       }
     end
 
@@ -18946,6 +19250,7 @@ module Kettle
       result["ruby"] = {} unless result["ruby"].is_a?(Hash)
       result["ruby"]["test_minimum"] = config_test_min_ruby(result, facts.dig(:rubygems, :min_ruby)).to_s
       result["resolved_licenses"] = license[:spdx]
+      result["resolved_duel"] = true if duel_configured?(config) && duel_template_profile?(facts[:template_profile])
       if facts[:template_profile].to_s == SHIM_TEMPLATE_PROFILE
         result["templates"] = default_template_config.merge(result["templates"].is_a?(Hash) ? result["templates"] : {})
         result["templates"]["profile"] = SHIM_TEMPLATE_PROFILE
@@ -19083,7 +19388,7 @@ module Kettle
         relative_path = path.delete_prefix("#{project_root}/")
         next unless preferred_template_source(PACKAGED_TEMPLATE_ROOT, relative_path)
 
-        {target_path: relative_path} if skip_packaged_gemfile_template?(relative_path, config, project_root: project_root)
+        {target_path: relative_path} if skip_packaged_gemfile_template?(relative_path, config)
       end
       (gemfile_cleanups + disabled_integration_config_cleanups(project_root, config)).sort_by { |cleanup| cleanup.fetch(:target_path) }
     end
@@ -19167,8 +19472,9 @@ module Kettle
       end
       return if source_path.to_s.empty? || target_path.to_s.empty?
       return if skip_packaged_workflow_template?(target_path, config, include_patterns: include_patterns)
+      return if skip_duel_template?(target_path, config)
       return if skip_disabled_integration_template?(target_path, config)
-      return if skip_packaged_gemfile_template?(target_path, config, project_root: project_root, template_root_path: template_root.fetch(:path))
+      return if skip_packaged_gemfile_template?(target_path, config, template_root_path: template_root.fetch(:path))
       return if skip_packaged_license_template?(target_path, config)
       return if skip_packaged_version_gem_entrypoint_template?(project_root, source_path, target_path, config)
       return if template_root.fetch(:kind) == "packaged" && opencollective_disabled && opencollective_disabled_file?(target_path)
@@ -19404,10 +19710,18 @@ module Kettle
       Gem::Version.new(version) < min_ruby
     end
 
-    def skip_packaged_gemfile_template?(target_path, config, project_root: nil, template_root_path: PACKAGED_TEMPLATE_ROOT)
+    def skip_packaged_gemfile_template?(target_path, config, template_root_path: PACKAGED_TEMPLATE_ROOT)
       return true if target_path.to_s.include?("gemfiles/modular/recording/") && !appraisal_recording_enabled?(config)
 
-      return false if packaged_gemfile_referenced_by_x_std_libs?(target_path, project_root: project_root, template_root_path: template_root_path)
+      inventory = packaged_x_std_lib_template_inventory(template_root_path)
+      x_std_bucket = inventory.fetch(:targets)[target_path.to_s.delete_prefix("gemfiles/modular/")]
+      if x_std_bucket
+        min_ruby = config_test_min_ruby(config)
+        return false unless min_ruby
+
+        relevant = Kettle::Rb::RubySeriesBuckets.relevant_buckets(inventory.fetch(:buckets), minimum: min_ruby)
+        return !relevant.include?(x_std_bucket)
+      end
 
       version = packaged_gemfile_template_ruby_floor(target_path)
       return false unless version
@@ -19418,19 +19732,50 @@ module Kettle
       Gem::Version.new(version) < min_ruby
     end
 
-    def packaged_gemfile_referenced_by_x_std_libs?(target_path, project_root:, template_root_path:)
-      relative_path = target_path.to_s.delete_prefix("gemfiles/modular/")
-      return false unless relative_path.start_with?("x_std_libs/")
+    def packaged_x_std_lib_template_inventory(template_root_path)
+      root_key = File.expand_path(template_root_path.to_s)
+      if root_key == File.expand_path(PACKAGED_TEMPLATE_ROOT)
+        # Process-lifetime memo of an immutable inventory; recomputation is
+        # idempotent, so a racing rebuild is harmless.
+        # rubocop:disable ThreadSafety/ClassInstanceVariable
+        @packaged_x_std_lib_template_inventory ||= build_packaged_x_std_lib_template_inventory(root_key)
+        return @packaged_x_std_lib_template_inventory
+        # rubocop:enable ThreadSafety/ClassInstanceVariable
+      end
+
+      build_packaged_x_std_lib_template_inventory(root_key)
+    end
+
+    def build_packaged_x_std_lib_template_inventory(template_root_path)
+      modular_root = File.join(template_root_path.to_s, "gemfiles/modular")
+      seeds = Dir.glob(File.join(modular_root, "x_std_libs/**/*.gemfile.example"))
+      aggregate = File.join(modular_root, "x_std_libs.gemfile.example")
+      seeds << aggregate if File.file?(aggregate)
 
-      aggregate_paths = [
-        File.join(template_root_path.to_s, "gemfiles/modular/x_std_libs.gemfile.example"),
-        File.join(project_root.to_s, "gemfiles/modular/x_std_libs.gemfile")
-      ].select { |path| File.file?(path) }
-      aggregate_paths.any? do |path|
-        gemfile_eval_paths(File.read(path)).include?(relative_path)
+      queue = seeds
+      visited = Set.new
+      targets = {}
+      buckets = Set.new
+      until queue.empty?
+        source = queue.pop
+        next unless File.file?(source)
+        next unless visited.add?(source)
+
+        relative = source.delete_prefix("#{modular_root}/").delete_suffix(".example")
+        bucket = relative.split("/").find { |segment| segment.match?(/\Ar\d+(?:\.\d+)?\z/) }
+        if bucket
+          targets[relative] = bucket
+          buckets << bucket
+        end
+
+        gemfile_eval_paths(File.read(source)).each do |reference|
+          resolved = File.expand_path(reference, File.dirname(source))
+          candidate = "#{resolved}.example"
+          queue << candidate if candidate.start_with?("#{modular_root}/") && File.file?(candidate)
+        end
       end
-    rescue
-      false
+
+      {targets: targets, buckets: buckets.to_a}
     end
 
     def skip_disabled_integration_template?(target_path, config)
@@ -19869,6 +20214,27 @@ module Kettle
       DecisionPolicy.value_to_boolean(workflows["recording"]) == true
     end
 
+    # Whether the project opts in to Duel's performance regression guards
+    # with `workflows.duel: true`. Duel is off by default.
+    def duel_configured?(config)
+      workflows = config["workflows"]
+      workflows = {} unless workflows.is_a?(Hash)
+
+      DecisionPolicy.value_to_boolean(workflows["duel"]) == true
+    end
+
+    # Duel's templates belong to a gem's full template: the monorepo and shim
+    # profiles have no Perf workflow to compare it in.
+    def duel_template_profile?(template_profile)
+      ["", FULL_TEMPLATE_PROFILE].include?(normalize_template_profile(template_profile))
+    end
+
+    # While Duel is off, its templates are neither written nor cleaned up, so
+    # a project's own .duel.rb, perf.yml, or duel.gemfile is left as it is.
+    def skip_duel_template?(target_path, config)
+      DUEL_TEMPLATE_PATHS.include?(target_path.to_s) && config["resolved_duel"] != true
+    end
+
     def project_recording_enabled?(project_root, config)
       return true if appraisal_recording_enabled?(config)
 
@@ -19954,8 +20320,9 @@ module Kettle
       end
     end
 
-    def synchronize_github_funding_yml(content, facts)
+    def synchronize_github_funding_yml(content, facts, seed_if_empty: false)
       output = content.to_s
+      output = github_funding_yml_seed(facts) if seed_if_empty && output.strip.empty?
       enabled_platforms = facts.fetch(:funding, {}).fetch(:platforms, {})
       enabled_platforms = enabled_platforms.merge("open_collective" => false) if facts.fetch(:funding, {})[:open_collective_disabled]
       FUNDING_YML_PLATFORMS.each do |platform|
@@ -19963,16 +20330,35 @@ module Kettle
 
         output = remove_top_level_yaml_key_lines(output, platform)
       end
-      tidelift_value = "rubygems/#{facts.fetch(:package).fetch(:name)}"
-      if funding_platform_enabled?(enabled_platforms, "tidelift") && !yaml_top_level_key_lines(output).key?("tidelift")
-        lines = output.lines
-        lines << "\n" unless lines.empty? || lines.last.to_s.strip.empty?
-        lines << "tidelift: #{tidelift_value}\n"
-        output = lines.join
-      end
+      # Tidelift is in limbo post-Sonar acquisition with no URLs to direct
+      # people to, so the platform is no longer emitted. Strip any lingering
+      # tidelift key from previously templated destinations.
+      output = remove_top_level_yaml_key_lines(output, "tidelift")
       ensure_trailing_newline(output)
     end
 
+    # Build first-run FUNDING.yml content structurally from facts (Psych dump
+    # of the known platform keys), so cold-start scaffolds get a valid file
+    # without line-munging the commented packaged template — that template
+    # still reaches destinations unchanged via template_source_application on
+    # configured runs, comments intact.
+    def github_funding_yml_seed(facts)
+      funding = facts.fetch(:funding, {})
+      platform_tokens = funding.fetch(:platform_tokens, {})
+      github_user = github_org_from_url(facts.dig(:package, :source_url)).to_s
+      values = {
+        "buy_me_a_coffee" => platform_tokens[:buymeacoffee].to_s,
+        "github" => github_user.empty? ? nil : [github_user],
+        "ko_fi" => platform_tokens[:kofi].to_s,
+        "liberapay" => platform_tokens[:liberapay].to_s,
+        "open_collective" => funding[:open_collective_org].to_s,
+        "thanks_dev" => github_user.empty? ? nil : "u/gh/#{github_user}"
+      }.reject { |_key, value| value.nil? || (value.respond_to?(:empty?) && value.empty?) }
+      return "" if values.empty?
+
+      "# These are supported funding model platforms\n\n#{Psych.dump(values)}"
+    end
+
     def remove_top_level_yaml_key_lines(content, key)
       lines = content.to_s.lines
       document = Psych.parse_stream(content.to_s).children.first
@@ -20606,7 +20992,7 @@ module Kettle
         steps << <<~YAML
           - name: Upload coverage to QLTY
             if: ${{ !env.ACT }}
-            uses: qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0
+            uses: qltysh/qlty-action/coverage@ebcd284bf32e36a030afe15f1e136c7be08b9506 # v2.5.0
             with:
               oidc: true
               files: coverage/lcov.info
@@ -20649,7 +21035,7 @@ module Kettle
 
         - name: Add Coverage PR Comment
           uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
-          if: ${{ !env.ACT && github.event_name == 'pull_request' }}
+          if: ${{ !env.ACT && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
           with:
             recreate: true
             path: code-coverage-results.md
@@ -20901,19 +21287,20 @@ module Kettle
         "actions/checkout" => "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1",
         "actions/cache" => "actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0",
         "appraisal-rb/setup-ruby-flash" => "appraisal-rb/setup-ruby-flash@6f8ad36ba7488db591541483afb5464d01e8861b # v2.14",
-        "ruby/setup-ruby" => "ruby/setup-ruby@b1da4809b005e0178fe08a1d57317bffc00b7b4c # v1.332.0",
+        "ruby/setup-ruby" => "ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1.336.0",
         "coverallsapp/github-action" => "coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8",
-        "qltysh/qlty-action/coverage" => "qltysh/qlty-action/coverage@c9b09987143d1e4ac955f4803c7bea742102feb5 # v2.4.0",
+        "qltysh/qlty-action/coverage" => "qltysh/qlty-action/coverage@ebcd284bf32e36a030afe15f1e136c7be08b9506 # v2.5.0",
         "codecov/codecov-action" => "codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1",
         "irongut/CodeCoverageSummary" => "irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0",
         "marocchino/sticky-pull-request-comment" => "marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5",
         "actions/upload-artifact" => "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2",
+        "actions/download-artifact" => "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2",
         "amancevice/setup-code-climate" => "amancevice/setup-code-climate@0daf2985a225e8ac15975b4d233010e94d65b76a # v2",
         "actions/dependency-review-action" => "actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0",
         "github/codeql-action/init" => "github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1",
         "github/codeql-action/autobuild" => "github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1",
         "github/codeql-action/analyze" => "github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1",
-        "pozil/auto-assign-issue" => "pozil/auto-assign-issue@bec9ebf443592887b8f9bed643afafdfd3f62f1d # v4.0.2",
+        "pozil/auto-assign-issue" => "pozil/auto-assign-issue@d6e511896e5f1d2408e74db74416647d8ff80c8c # v4.1.0",
         "apache/skywalking-eyes/dependency" => "apache/skywalking-eyes/dependency@a196742f472feaffafea537ce5a2a4c3c53a8de4 # v0.9.0",
         "sarisia/actions-status-discord" => "sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0"
       }