@bensandee/tooling 0.86.1 → 0.87.1

package/dist/bin.mjs

@@ -269,7 +269,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 */
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.86.1"
+	version: "0.87.1"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -1132,7 +1132,7 @@ const AsciiConfigSchema = z.strictObject({
 	allow: z.array(z.string()).optional().meta({ description: "Codepoints (as U+XXXX) to drop from the effective deny-list" }),
 	treatAsProse: z.array(z.string()).optional().meta({ description: "Path globs (matched the same way as exclude) whose files --fix classifies as prose wholesale regardless of extension, flattening rather than flagging. The opt-back-in for an extension with no dedicated lexical-context classifier where blind flattening is known safe. No built-in defaults." })
 });
-const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional().meta({ description: "Make `bst lint:types` (the type-aware oxlint gate, backed by oxlint-tsgolint) exit non-zero on any finding while the tooling is still in its report phase (default false; the enforce phase, a later tooling release, exits non-zero unconditionally). A missing oxlint-tsgolint binary is also a hard failure rather than a notice while this is set: arming the gate is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it." }) });
+const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional().meta({ description: "Make a missing oxlint-tsgolint binary a hard failure for `bst lint:types` (the type-aware oxlint gate) rather than a notice (default false): arming it is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it. Findings block in every repo regardless of this setting." }) });
 const ChecksConfigSchema = z.strictObject({
 	add: z.array(z.string()).optional().meta({ description: "Extra package.json scripts to run as first-class check steps, appended to the built-in list (e.g. ['lint:php']). An added step with no matching script is a hard failure." }),
 	skip: z.array(z.string()).optional().meta({ description: "Check steps to skip, unioned with the built-in CI defaults (never replacing them). Supports glob patterns." }),
@@ -2310,6 +2310,18 @@ const LintSweepConfigSchema = z.strictObject({
 	minWarnings: z.number().int().nonnegative().optional().meta({ description: "How many oxlint warnings the default branch must carry before the sweep opens a pull request (default 5). Below the floor the warn marker on checks:run is the whole response." }),
 	cooldownDays: z.number().int().nonnegative().optional().meta({ description: "Days after a lint-sweep pull request merged or closed before the sweep may open another (default 7): a merged sweep whose declined warnings survive must not re-file them the next morning." })
 });
+/**
+* `.tooling.json#agent.egress`: the extra egress hosts this repo's agent containers may reach.
+*
+* Only the browse lane (GET and HEAD) is repo-declarable. The passthrough allows every method,
+* so it stays agent-owned -- see the non-goals of the per-repo egress spec.
+*
+* The list is validated as a list of non-empty strings here, not against the pattern grammar:
+* that grammar lives in the agent package and the dependency edge runs agent -> tooling, never
+* back. The agent checks every pattern when it reads the key and refuses the run with the bad
+* pattern named, so `repo:sync` deliberately accepts a malformed pattern.
+*/
+const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
@@ -2322,6 +2334,7 @@ const AgentConfigSchema = z.strictObject({
 		"low"
 	])).optional().meta({ description: "Map this repo's own issue-label names onto the agent's four priority levels, e.g. {\"P1\": \"critical\", \"P4\": \"low\"}. The map UNIONS with the built-in priority/<level> names rather than replacing them, and the agent does not create aliased labels -- the repo owns names the agent did not choose. Priority affects claim order only: it never changes a run's model, effort, or any budget." }),
 	triageAnalysis: z.boolean().optional().meta({ description: "Whether the agent may route its own agent-note/human-triage-needed issues through the agent/analyze stage (default: off). Unlike agent.backlog, which defaults on, this defaults off: a backlog run batches every pending finding into one container, while triage routing spends one container per issue -- arming it is the reversible direction, not disarming it." }),
+	egress: AgentEgressConfigSchema.optional().meta({ description: "Extra egress hosts this repo's agent containers may reach. `browseHosts` joins the agent's browse lane (GET and HEAD only) on top of the hosts every run needs; the passthrough lane stays agent-owned. Each entry is a host pattern -- an exact host or a *.host wildcard, never a port. Read from the repo's DEFAULT BRANCH, never off a pull request's own tree, so a run can never widen its own egress: the declaration takes effect on the first container started after a human merges it. An entry whose pattern the agent cannot parse refuses the run rather than being dropped. Changing this block holds the pull request from automerge." }),
 	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." })
 });
 /**
@@ -2345,7 +2358,8 @@ const AgentConfigSchema = z.strictObject({
 const TolerantAgentConfigSchema = z.object({
 	...AgentConfigSchema.shape,
 	lintSweep: tolerantBlock(LintSweepConfigSchema).optional(),
-	findingHolds: z.unknown().optional()
+	findingHolds: z.unknown().optional(),
+	egress: z.unknown().optional()
 });
 const BranchPruneConfigSchema = z.strictObject({
 	mergedDays: z.number().int().nonnegative().optional().meta({ description: "Days after a work branch's PR merged before bst branch:prune deletes it (default 7). Zero is valid on purpose (an explicit 'delete everything merged already'), matching the --merged-days CLI flag's contract." }),
@@ -3036,57 +3050,6 @@ function loadRegistryHostOverride(cwd) {
 	}
 }
 //#endregion
-//#region src/utils/generated-header.ts
-/**
-* Leading comment headers for fully generated files.
-*
-* These mark a file as managed by `@bensandee/tooling` so a reader knows that
-* `bst repo:sync` may overwrite it, and points at the supported ways to keep
-* custom content. Only used for files that are largely (re)generated wholesale
-* -- not for files that are merged into (package.json, tsconfig.json, etc.).
-*/
-/**
-* Stable substring present in every managed-file header. Used to detect whether an
-* existing file already carries the *current* header -- a comment-only difference is
-* invisible to `normalizeWorkflow()` (it strips comments before comparing), so generators
-* check for this marker to know a one-time header upgrade is still needed.
-*
-* The trailing `--` is load-bearing: it is what made the 2026-07-27 ASCII fix reach files
-* that were already synced. Widen this marker whenever the header's leading text changes,
-* or the change lands in the template and never in anyone's repo.
-*/
-const MANAGED_HEADER_MARKER = "Managed by @bensandee/tooling --";
-/** Render a comment block: each line is prefixed with `comment`; empty lines stay bare. */
-function managedFileHeader(comment, lines) {
-	return lines.map((line) => line === "" ? comment : `${comment} ${line}`).join("\n") + "\n";
-}
-/**
-* Header for generated CI workflow files (`ci.yml`, `release.yml`, `publish.yml`).
-*
-* The literal `@bensandee/tooling:ignore` directive is kept mid-line on purpose so
-* `isToolingIgnored()` (which looks for the directive at the start of a comment) does
-* not mistake this header for an opt-out.
-*/
-const WORKFLOW_MANAGED_HEADER = managedFileHeader("#", [
-	"Managed by @bensandee/tooling -- `bst repo:sync` regenerates this workflow,",
-	"so direct edits are overwritten on the next sync.",
-	"To preserve changes, wrap them between `# @tooling:custom` and",
-	"`# @tooling:endcustom` markers, or stop managing this file by making",
-	"`# @bensandee/tooling:ignore` the first line."
-]);
-/** Header for the generated `lefthook.yml` pre-commit config. */
-const LEFTHOOK_MANAGED_HEADER = managedFileHeader("#", [
-	"Managed by @bensandee/tooling -- `bst repo:sync` keeps the `lint` and",
-	"`format` pre-commit commands current. Other commands you add are preserved.",
-	"To stop managing this file, make `# @bensandee/tooling:ignore` the first line."
-]);
-/**
-* Header for a generated agent guide (`.agent/guides/*.md`). One line, because guide ownership
-* is decided by the marker on the first line alone. It spells the ignore directive out in words
-* rather than as the literal comment, which would close this one early.
-*/
-const GUIDE_MANAGED_HEADER = "<!-- Managed by @bensandee/tooling -- `bst repo:sync` rewrites this guide and archives local edits. To keep your own version, make the first line an HTML comment reading @bensandee/tooling:ignore. -->\n";
-//#endregion
 //#region src/utils/debug.ts
 const verboseLogger = createLogger({ level: "trace" });
 /** Check if verbose/debug mode is enabled via environment variables. */
@@ -4077,6 +4040,77 @@ function tracedRunners(logger) {
 function fileErrorCode(error) {
 	if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
 }
+function listWorkspacePackages(cwd) {
+	const packagesDir = path.join(cwd, "packages");
+	const packages = [];
+	try {
+		for (const entry of readdirSync(packagesDir)) {
+			const pkgPath = path.join(packagesDir, entry, "package.json");
+			try {
+				const pkg = parsePackageJson(readFileSync(pkgPath, "utf-8"));
+				if (pkg?.name && pkg.version) packages.push({
+					name: pkg.name,
+					version: pkg.version,
+					dir: entry
+				});
+			} catch (_error) {}
+		}
+	} catch (_error) {}
+	return packages;
+}
+function readRegularFile(filePath, maxBytes) {
+	let fd;
+	try {
+		fd = openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+	} catch (error) {
+		const code = fileErrorCode(error);
+		if (code === "ENOENT") return { kind: "absent" };
+		if (code === "ELOOP") return {
+			kind: "refused",
+			reason: "symlink"
+		};
+		return {
+			kind: "refused",
+			reason: "unreadable"
+		};
+	}
+	try {
+		const stat = fstatSync(fd);
+		if (!stat.isFile()) return {
+			kind: "refused",
+			reason: "not-regular"
+		};
+		if (stat.size > maxBytes) return {
+			kind: "refused",
+			reason: "too-large"
+		};
+		const buffer = Buffer.alloc(maxBytes + 1);
+		let bytesRead;
+		try {
+			bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
+		} catch {
+			return {
+				kind: "refused",
+				reason: "unreadable"
+			};
+		}
+		if (bytesRead > maxBytes) return {
+			kind: "refused",
+			reason: "too-large"
+		};
+		return {
+			kind: "ok",
+			content: buffer.toString("utf8", 0, bytesRead)
+		};
+	} catch {
+		return {
+			kind: "refused",
+			reason: "unreadable"
+		};
+	} finally {
+		closeSync(fd);
+	}
+}
 /**
 * Create an executor that runs real commands, fetches, and reads the filesystem. Subprocess and
 * network calls are traced through `logger` (default: the {@link rootLogger}); see
@@ -4093,24 +4127,7 @@ function createRealExecutor$1(logger = rootLogger) {
 				return [];
 			}
 		},
-		listWorkspacePackages(cwd) {
-			const packagesDir = path.join(cwd, "packages");
-			const packages = [];
-			try {
-				for (const entry of readdirSync(packagesDir)) {
-					const pkgPath = path.join(packagesDir, entry, "package.json");
-					try {
-						const pkg = parsePackageJson(readFileSync(pkgPath, "utf-8"));
-						if (pkg?.name && pkg.version) packages.push({
-							name: pkg.name,
-							version: pkg.version,
-							dir: entry
-						});
-					} catch (_error) {}
-				}
-			} catch (_error) {}
-			return packages;
-		},
+		listWorkspacePackages,
 		listPackageDirs(cwd) {
 			const packagesDir = path.join(cwd, "packages");
 			try {
@@ -4140,59 +4157,7 @@ function createRealExecutor$1(logger = rootLogger) {
 				return null;
 			}
 		},
-		readRegularFile(filePath, maxBytes) {
-			let fd;
-			try {
-				fd = openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-			} catch (error) {
-				const code = fileErrorCode(error);
-				if (code === "ENOENT") return { kind: "absent" };
-				if (code === "ELOOP") return {
-					kind: "refused",
-					reason: "symlink"
-				};
-				return {
-					kind: "refused",
-					reason: "unreadable"
-				};
-			}
-			try {
-				const stat = fstatSync(fd);
-				if (!stat.isFile()) return {
-					kind: "refused",
-					reason: "not-regular"
-				};
-				if (stat.size > maxBytes) return {
-					kind: "refused",
-					reason: "too-large"
-				};
-				const buffer = Buffer.alloc(maxBytes + 1);
-				let bytesRead;
-				try {
-					bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
-				} catch {
-					return {
-						kind: "refused",
-						reason: "unreadable"
-					};
-				}
-				if (bytesRead > maxBytes) return {
-					kind: "refused",
-					reason: "too-large"
-				};
-				return {
-					kind: "ok",
-					content: buffer.toString("utf8", 0, bytesRead)
-				};
-			} catch {
-				return {
-					kind: "refused",
-					reason: "unreadable"
-				};
-			} finally {
-				closeSync(fd);
-			}
-		},
+		readRegularFile,
 		writeFile(filePath, content) {
 			mkdirSync(path.dirname(filePath), { recursive: true });
 			writeFileSync(filePath, content);
@@ -5536,6 +5501,24 @@ function readPublishedImageVersion(executor, config, ref) {
 	debug(config, `Unexpected manifest shape for ${ref}; no version label read`);
 }
 /**
+* Name every check-only image this run is about to publish or has just left out -- one line
+* per image with no explicit `publish` setting, since an explicit value either way is the
+* repo having answered the question already. Under `warn` the image still goes out and the
+* line is the notice that a later tooling release stops doing that; under `enforce` it did
+* not go out and the line says so. A dry run takes both lines verbatim: it is the run a
+* release rehearses, so a rehearsed phase has to read like the real one.
+*/
+function reportCheckOnlyImages(packages, phase) {
+	for (const pkg of packages) {
+		if (pkg.checkOnlyIn === void 0 || pkg.docker.publish !== void 0) continue;
+		if (phase === "warn") {
+			log$1.warn(`Image "${pkg.imageName}" is declared only in ${pkg.checkOnlyIn}, the check overlay, so a later tooling release stops publishing it by default. Keep it: set publish to true for "${pkg.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
+			continue;
+		}
+		log$1.info(`Skipped "${pkg.imageName}": it is declared only in ${pkg.checkOnlyIn}, the check overlay, so it was not pushed. Set publish to true for "${pkg.imageName}" under .tooling.json#docker to publish it anyway.`);
+	}
+}
+/**
 * Run the full Docker publish pipeline:
 * 1. Build all images via runDockerBuild
 * 2. Login to registry
@@ -5555,24 +5538,6 @@ function readPublishedImageVersion(executor, config, ref) {
 * overlapping runs that both read a ref before either writes can still finish in the wrong order --
 * seconds wide, where an unconditional push was open for a whole run.
 */
-/**
-* Name every check-only image this run is about to publish or has just left out -- one line
-* per image with no explicit `publish` setting, since an explicit value either way is the
-* repo having answered the question already. Under `warn` the image still goes out and the
-* line is the notice that a later tooling release stops doing that; under `enforce` it did
-* not go out and the line says so. A dry run takes both lines verbatim: it is the run a
-* release rehearses, so a rehearsed phase has to read like the real one.
-*/
-function reportCheckOnlyImages(packages, phase) {
-	for (const pkg of packages) {
-		if (pkg.checkOnlyIn === void 0 || pkg.docker.publish !== void 0) continue;
-		if (phase === "warn") {
-			log$1.warn(`Image "${pkg.imageName}" is declared only in ${pkg.checkOnlyIn}, the check overlay, so a later tooling release stops publishing it by default. Keep it: set publish to true for "${pkg.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
-			continue;
-		}
-		log$1.info(`Skipped "${pkg.imageName}": it is declared only in ${pkg.checkOnlyIn}, the check overlay, so it was not pushed. Set publish to true for "${pkg.imageName}" under .tooling.json#docker to publish it anyway.`);
-	}
-}
 function runDockerPublish(executor, config) {
 	const checkOnlyPhase = config.checkOnlyPhase ?? "warn";
 	const { packages } = runDockerBuild(executor, {
@@ -5668,6 +5633,136 @@ function contextAsDockerReader(ctx) {
 	};
 }
 //#endregion
+//#region src/release/publish/publish-config-lint.ts
+const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
+/**
+* Whether a value can serve as a publish destination: an absolute http(s) URL.
+* Presence alone is not the test -- a relative or empty registry is as silently
+* wrong as an absent one, and npm resolves neither to the place the author meant.
+*/
+function isUsableRegistry(value) {
+	if (typeof value !== "string" || value.trim() === "") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" || url.protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Require every package this repo would publish to declare where it publishes.
+*
+* npm and pnpm use one `registry` key for reads and writes alike, so a project
+* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
+* package that never declares its destination inherits one, and an inherited
+* destination can be changed by a file that never mentions publishing.
+*
+* Reports rather than repairs: the correct registry is not derivable here, and
+* writing a guess would redirect a working release exactly the way this gate
+* exists to prevent.
+*/
+function lintPublishConfig(targetDir, structure) {
+	const issues = [];
+	for (const pkg of getPublishablePackages(targetDir, structure)) {
+		const manifest = readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (registry === void 0) {
+			issues.push({
+				kind: "missing",
+				package: pkg.name,
+				file,
+				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
+			});
+			continue;
+		}
+		if (!isUsableRegistry(registry)) issues.push({
+			kind: "malformed",
+			package: pkg.name,
+			file,
+			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
+		});
+	}
+	return issues;
+}
+/**
+* The registries this repo's publishable packages actually declare, distinct and in
+* first-seen order.
+*
+* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
+* than re-deriving it -- a registry this misses here would fail that gate first, so
+* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
+* caller that invokes a generator directly (or a repo whose publishable set is empty,
+* e.g. every package private) still gets a safe empty result.
+*/
+function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
+	const registries = [];
+	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
+		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
+	}
+	return registries;
+}
+//#endregion
+//#region src/utils/generated-header.ts
+/**
+* Leading comment headers for fully generated files.
+*
+* These mark a file as managed by `@bensandee/tooling` so a reader knows that
+* `bst repo:sync` may overwrite it, and points at the supported ways to keep
+* custom content. Only used for files that are largely (re)generated wholesale
+* -- not for files that are merged into (package.json, tsconfig.json, etc.).
+*/
+/**
+* Stable substring present in every managed-file header. Used to detect whether an
+* existing file already carries the *current* header -- a comment-only difference is
+* invisible to `normalizeWorkflow()` (it strips comments before comparing), so generators
+* check for this marker to know a one-time header upgrade is still needed.
+*
+* The trailing `--` is load-bearing: it is what made the 2026-07-27 ASCII fix reach files
+* that were already synced. Widen this marker whenever the header's leading text changes,
+* or the change lands in the template and never in anyone's repo.
+*/
+const MANAGED_HEADER_MARKER = "Managed by @bensandee/tooling --";
+/** Render a comment block: each line is prefixed with `comment`; empty lines stay bare. */
+function managedFileHeader(comment, lines) {
+	return lines.map((line) => line === "" ? comment : `${comment} ${line}`).join("\n") + "\n";
+}
+/**
+* Header for generated CI workflow files (`ci.yml`, `release.yml`).
+*
+* The literal `@bensandee/tooling:ignore` directive is kept mid-line on purpose so
+* `isToolingIgnored()` (which looks for the directive at the start of a comment) does
+* not mistake this header for an opt-out.
+*/
+const WORKFLOW_MANAGED_HEADER = managedFileHeader("#", [
+	"Managed by @bensandee/tooling -- `bst repo:sync` regenerates this workflow,",
+	"so direct edits are overwritten on the next sync.",
+	"To preserve changes, wrap them between `# @tooling:custom` and",
+	"`# @tooling:endcustom` markers, or stop managing this file by making",
+	"`# @bensandee/tooling:ignore` the first line."
+]);
+/** Header for the generated `lefthook.yml` pre-commit config. */
+const LEFTHOOK_MANAGED_HEADER = managedFileHeader("#", [
+	"Managed by @bensandee/tooling -- `bst repo:sync` keeps the `lint` and",
+	"`format` pre-commit commands current. Other commands you add are preserved.",
+	"To stop managing this file, make `# @bensandee/tooling:ignore` the first line."
+]);
+/**
+* Header for a generated agent guide (`.agent/guides/*.md`). One line, because guide ownership
+* is decided by the marker on the first line alone. It spells the ignore directive out in words
+* rather than as the literal comment, which would close this one early.
+*/
+const GUIDE_MANAGED_HEADER = "<!-- Managed by @bensandee/tooling -- `bst repo:sync` rewrites this guide and archives local edits. To keep your own version, make the first line an HTML comment reading @bensandee/tooling:ignore. -->\n";
+//#endregion
 //#region src/utils/yaml-merge.ts
 const IGNORE_PATTERN = "@bensandee/tooling:ignore";
 const CUSTOM_START = "# @tooling:custom";
@@ -5930,129 +6025,50 @@ function extractPinnedActions(existing) {
 * generator's step objects cannot carry. Preserving them would leave every repo on the commit it
 * first received.
 */
-function preservePinnedActions(generated, existing, owned = []) {
-	let result = generated;
-	for (const { name, comment } of owned) {
-		const pattern = new RegExp(String.raw`^(\s*(?:-\s+)?uses:\s*)${escapeRegex(name)}@(\S+)(?:[ \t]+#[^\n]*)?$`, "gm");
-		result = result.replace(pattern, `$1${name}@$2 # ${comment}`);
-	}
-	if (!existing) return result;
-	const pins = extractPinnedActions(existing);
-	if (pins.size === 0) return result;
-	for (const [name, tail] of pins) {
-		if (owned.some((action) => action.name === name)) continue;
-		const pattern = new RegExp(String.raw`^(\s*(?:-\s+)?uses:\s*)${escapeRegex(name)}@\S+(?:[ \t]+#[^\n]*)?$`, "gm");
-		result = result.replace(pattern, `$1${name}@${tail}`);
-	}
-	return result;
-}
-/** Build a complete workflow YAML string from structured options. Single source of truth for workflow files. */
-function buildWorkflowYaml(options) {
-	const doc = { name: options.name };
-	if (options.enableEmailNotifications) doc["enable-email-notifications"] = true;
-	doc["on"] = options.on;
-	if (options.permissions) doc["permissions"] = options.permissions;
-	if (options.concurrency) doc["concurrency"] = options.concurrency;
-	const jobs = { [options.jobName]: {
-		...options.jobIf && { if: options.jobIf },
-		"runs-on": options.runsOn ?? "ubuntu-latest",
-		...options.jobEnv && { env: options.jobEnv },
-		...options.jobOutputs && { outputs: options.jobOutputs },
-		steps: options.steps.map((s) => s.step)
-	} };
-	for (const [name, def] of Object.entries(options.extraJobs ?? {})) jobs[name] = {
-		...def.needs && { needs: def.needs },
-		...def.if && { if: def.if },
-		...def["continue-on-error"] && { "continue-on-error": true },
-		"runs-on": def.runsOn ?? "ubuntu-latest",
-		...def.env && { env: def.env },
-		steps: def.steps.map((s) => s.step)
-	};
-	doc["jobs"] = jobs;
-	const readable = stringify(doc, {
-		lineWidth: 0,
-		nullStr: ""
-	}).replace(/^(?=\S)/gm, (match, offset) => offset === 0 ? match : `\n${match}`);
-	return ensureSchemaComment(WORKFLOW_MANAGED_HEADER + "\n" + readable, options.ci);
-}
-//#endregion
-//#region src/release/publish/publish-config-lint.ts
-const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
-/**
-* Whether a value can serve as a publish destination: an absolute http(s) URL.
-* Presence alone is not the test -- a relative or empty registry is as silently
-* wrong as an absent one, and npm resolves neither to the place the author meant.
-*/
-function isUsableRegistry(value) {
-	if (typeof value !== "string" || value.trim() === "") return false;
-	try {
-		const url = new URL(value);
-		return url.protocol === "https:" || url.protocol === "http:";
-	} catch {
-		return false;
-	}
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Require every package this repo would publish to declare where it publishes.
-*
-* npm and pnpm use one `registry` key for reads and writes alike, so a project
-* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
-* package that never declares its destination inherits one, and an inherited
-* destination can be changed by a file that never mentions publishing.
-*
-* Reports rather than repairs: the correct registry is not derivable here, and
-* writing a guess would redirect a working release exactly the way this gate
-* exists to prevent.
-*/
-function lintPublishConfig(targetDir, structure) {
-	const issues = [];
-	for (const pkg of getPublishablePackages(targetDir, structure)) {
-		const manifest = readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (registry === void 0) {
-			issues.push({
-				kind: "missing",
-				package: pkg.name,
-				file,
-				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
-			});
-			continue;
-		}
-		if (!isUsableRegistry(registry)) issues.push({
-			kind: "malformed",
-			package: pkg.name,
-			file,
-			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
-		});
-	}
-	return issues;
-}
-/**
-* The registries this repo's publishable packages actually declare, distinct and in
-* first-seen order.
-*
-* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
-* than re-deriving it -- a registry this misses here would fail that gate first, so
-* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
-* caller that invokes a generator directly (or a repo whose publishable set is empty,
-* e.g. every package private) still gets a safe empty result.
-*/
-function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
-	const registries = [];
-	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
-		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
+function preservePinnedActions(generated, existing, owned = []) {
+	let result = generated;
+	for (const { name, comment } of owned) {
+		const pattern = new RegExp(String.raw`^(\s*(?:-\s+)?uses:\s*)${escapeRegex(name)}@(\S+)(?:[ \t]+#[^\n]*)?$`, "gm");
+		result = result.replace(pattern, `$1${name}@$2 # ${comment}`);
 	}
-	return registries;
+	if (!existing) return result;
+	const pins = extractPinnedActions(existing);
+	if (pins.size === 0) return result;
+	for (const [name, tail] of pins) {
+		if (owned.some((action) => action.name === name)) continue;
+		const pattern = new RegExp(String.raw`^(\s*(?:-\s+)?uses:\s*)${escapeRegex(name)}@\S+(?:[ \t]+#[^\n]*)?$`, "gm");
+		result = result.replace(pattern, `$1${name}@${tail}`);
+	}
+	return result;
+}
+/** Build a complete workflow YAML string from structured options. Single source of truth for workflow files. */
+function buildWorkflowYaml(options) {
+	const doc = { name: options.name };
+	if (options.enableEmailNotifications) doc["enable-email-notifications"] = true;
+	doc["on"] = options.on;
+	if (options.permissions) doc["permissions"] = options.permissions;
+	if (options.concurrency) doc["concurrency"] = options.concurrency;
+	const jobs = { [options.jobName]: {
+		...options.jobIf && { if: options.jobIf },
+		"runs-on": options.runsOn ?? "ubuntu-latest",
+		...options.jobEnv && { env: options.jobEnv },
+		...options.jobOutputs && { outputs: options.jobOutputs },
+		steps: options.steps.map((s) => s.step)
+	} };
+	for (const [name, def] of Object.entries(options.extraJobs ?? {})) jobs[name] = {
+		...def.needs && { needs: def.needs },
+		...def.if && { if: def.if },
+		...def["continue-on-error"] && { "continue-on-error": true },
+		"runs-on": def.runsOn ?? "ubuntu-latest",
+		...def.env && { env: def.env },
+		steps: def.steps.map((s) => s.step)
+	};
+	doc["jobs"] = jobs;
+	const readable = stringify(doc, {
+		lineWidth: 0,
+		nullStr: ""
+	}).replace(/^(?=\S)/gm, (match, offset) => offset === 0 ? match : `\n${match}`);
+	return ensureSchemaComment(WORKFLOW_MANAGED_HEADER + "\n" + readable, options.ci);
 }
 //#endregion
 //#region src/generators/mise-pin.ts
@@ -6068,8 +6084,8 @@ function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
 * shape of custom regex manager in the root `renovate.json` can rewrite both this version and this
 * digest (`customManagers` entries scoped to this file).
 */
-const MISE_VERSION = "2026.10.2";
-const MISE_LINUX_X64_SHA256 = "8f5f6660336f572830e33cd9b378d3131e529a0d4c4f0c553776be90a1ba302a";
+const MISE_VERSION = "2026.10.3";
+const MISE_LINUX_X64_SHA256 = "8d48bc510b7d844fad0bc7156c0855c2a1e7230c51e498a7f6b63b021f8b57c5";
 /** Where generated Forgejo workflows fetch the shared mise setup action: a composite action in
 * `bensandee/common`, on the forge every fleet repo lives on. GitHub cannot reach it; the
 * generators keep inline steps there. */
@@ -6077,7 +6093,7 @@ const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/
 /** The tag in `bensandee/common` that marks the current release of the action. Generated `uses:`
 * lines carry it as their comment, and Renovate moves the SHA below to wherever it points. */
 const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
-const SETUP_MISE_ACTION_SHA = "13f60e0f19ad57b5616f94c9bc18bf214bbe91fe";
+const SETUP_MISE_ACTION_SHA = "db99e4e9ee46bfeaca2146e7ae55cc700b4c23bf";
 //#endregion
 //#region src/generators/ci-utils.ts
 /** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
@@ -6125,30 +6141,6 @@ const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
 /** `if:` condition referencing the job-level `IS_MAIN` env var (see {@link IS_MAIN_JOB_ENV}). */
 const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
 /**
-* Job-level default for the npm auth token, declared as the empty string.
-*
-* This repo's own `Configure npm auth` step (see {@link npmAuthWiring}) appends
-* `//<registry>/:_authToken=${NODE_AUTH_TOKEN}` lines to `~/.npmrc` for each
-* declared `publishConfig.registry`. Only the publishing step defines that
-* variable, so every earlier pnpm invocation -- install, and each nested pnpm
-* inside `ci:check` -- hits an undefined var and prints
-* `[WARN] Failed to replace env in config: ${NODE_AUTH_TOKEN}`. Declaring it
-* empty at job level makes the interpolation succeed and the warning vanish; an
-* empty token is not sent as credentials, so anonymous registry reads are
-* unaffected.
-*
-* Deliberately empty rather than the real secret: the publishing step overrides
-* it with `secrets.NPM_TOKEN` via step-level `env`, which keeps the token out of
-* `pnpm install` (and any dependency's postinstall script) the way it is today.
-* The empty default also has to survive steps *after* the publish step
-* (`release:assets`, `docker:publish`, deploy dispatch): those shell out to pnpm
-* again without the secret in scope, so without this default they would warn too.
-*
-* Emit this in lockstep with the `Configure npm auth` step -- both come from the
-* same {@link npmAuthWiring} call, so a job that gets one gets the other.
-*/
-const NPM_AUTH_JOB_ENV = { NODE_AUTH_TOKEN: "" };
-/**
 * npm's own registry-key rule for an `.npmrc` auth line: strip the scheme, keep
 * host/port/path, and end with exactly one slash. `actions/setup-node` derives the
 * same key from a registry URL; this mirrors that so a hand-written line matches
@@ -6160,26 +6152,38 @@ function npmrcAuthKey(registryUrl) {
 }
 const NODE_AUTH_TOKEN_VAR = ["$", "{NODE_AUTH_TOKEN}"].join("");
 /**
-* Build every half of a job's npm auth wiring together, so one value decides all
-* three: the `Configure npm auth` step, the job-level `NODE_AUTH_TOKEN` default,
-* and the step-level `NODE_AUTH_TOKEN` the publish step should carry. A job that
-* gets none of the declared registries gets none of the three -- including a
-* `publishes: true` job whose publishable set is empty (every package private),
-* since there is then no npmrc line for a real secret to pair with.
+* Build both halves of a job's npm auth wiring together, so one value decides
+* them: the auth lines the publishing step writes, and the step-level
+* `NODE_AUTH_TOKEN` it carries. A job that gets none of the declared registries
+* gets neither -- including a `publishes: true` job whose publishable set is
+* empty (every package private), since there is then no npmrc line for a real
+* secret to pair with.
+*
+* The lines go into a temp userconfig exported only inside the publishing
+* step's shell, never `~/.npmrc` or `$GITHUB_ENV`: pnpm 11 warns
+* `Failed to replace env in config` on every call that reads the placeholder
+* while the token is unset or empty, so a line in a shared file makes install, `ci:check`,
+* and every step after the publish warn. An empty job-level default does not
+* silence it, and `${NODE_AUTH_TOKEN:-}` is rejected as an empty fallback and
+* warns in every case. The `-n` guard keeps a run without the secret quiet; the
+* single quotes keep the token itself off disk, since npm expands it at read time.
 */
 function npmAuthWiring(ctx, publishes) {
 	const registries = publishes ? declaredPublishRegistries(ctx.targetDir, ctx.config.structure, ctx.packageJson) : [];
 	if (registries.length === 0) return {
-		steps: [],
-		jobEnv: {},
+		publishRun: (command) => command,
 		tokenEnv: {}
 	};
+	const setup = [
+		"if [ -n \"$NODE_AUTH_TOKEN\" ]; then",
+		"  NPM_CONFIG_USERCONFIG=\"$(mktemp)\"",
+		"  export NPM_CONFIG_USERCONFIG",
+		"  if [ -f ~/.npmrc ]; then cat ~/.npmrc > \"$NPM_CONFIG_USERCONFIG\"; fi",
+		...registries.map((registry) => `  printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> "$NPM_CONFIG_USERCONFIG"`),
+		"fi"
+	];
 	return {
-		steps: [{ step: {
-			name: "Configure npm auth",
-			run: registries.map((registry) => `printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> ~/.npmrc`).join("\n")
-		} }],
-		jobEnv: NPM_AUTH_JOB_ENV,
+		publishRun: (command) => [...setup, command].join("\n"),
 		tokenEnv: { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
 	};
 }
@@ -6304,6 +6308,37 @@ function dockerPublishEnv(host) {
 		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 	};
 }
+/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
+const ARCHIVE_DIR$1 = ".tooling-archived";
+/**
+* Retire a workflow file tooling used to generate and no longer writes.
+*
+* Returns `undefined` when there is no file at `workflowPath` -- nothing to report. A file
+* tooling does not manage (it carries the ignore comment, or no managed header) is left in
+* place with a `skipped` result naming it, so a plain `repo:sync` tells the human why the
+* leftover is still there. Any other file is removed: `ctx.remove()` archives before deleting
+* (see createContext), so no manual copy is needed.
+*
+* The result is `removed`, not `archived`: `repo:sync --check` counts only the former as drift,
+* and the agent's workflow sync sweep acts only on drift the check reports.
+*/
+function retireManagedWorkflow(ctx, workflowPath, reason) {
+	const existing = ctx.read(workflowPath);
+	if (existing === void 0) return void 0;
+	if (isToolingIgnored(existing) || !existing.includes("Managed by @bensandee/tooling --")) return {
+		filePath: workflowPath,
+		action: "skipped",
+		description: `${workflowPath} is not managed by tooling, so it was left in place`
+	};
+	ctx.remove(workflowPath);
+	let description = `Moved to ${ARCHIVE_DIR$1}/${workflowPath} (${reason})`;
+	if (extractCustomBlocks(existing).length > 0) description += "; its # @tooling:custom blocks are kept only in the archive";
+	return {
+		filePath: workflowPath,
+		action: "removed",
+		description
+	};
+}
 //#endregion
 //#region src/generators/publish-ci.ts
 const RegistryHostSchema = z.object({ registryHost: z.string().optional() });
@@ -6342,18 +6377,6 @@ function resolveGenTimeHost(ctx) {
 	if (!parsed) return null;
 	return registryHostFromHostname(parsed.hostname);
 }
-function publishSteps(ci, host) {
-	return [
-		{ step: { uses: "actions/checkout@v6" } },
-		...miseSetupSteps(ci),
-		{ step: { run: "pnpm install --frozen-lockfile" } },
-		{ step: {
-			name: "Publish Docker images",
-			env: dockerPublishEnv(host),
-			run: "pnpm exec bst docker:publish"
-		} }
-	];
-}
 const PostReleaseHookSchema = z.object({
 	postReleaseHook: z.string().optional(),
 	postReleaseHookSecrets: z.array(z.string()).optional()
@@ -6472,63 +6495,24 @@ function hasVersionStamp(ctx) {
 		return false;
 	}
 }
-/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR$2 = ".tooling-archived";
+/**
+* Archive the manual `publish.yml` this generator used to write; it writes nothing. Docker
+* images publish from the release workflow, and the manual workflow was a thin wrapper around
+* `bst docker:publish` that nobody ran -- run that command instead. Only a file carrying the
+* managed header is removed: a hand-written `publish.yml`, or one opted out with the ignore
+* comment, belongs to the repo.
+*/
 async function generateDeployCi(ctx) {
 	const filePath = "deploy-ci";
-	if (!ctx.config.publishDocker || ctx.config.ci === "none") return {
+	if (ctx.config.ci === "none") return {
 		filePath,
 		action: "skipped",
-		description: "Deploy CI workflow not applicable"
+		description: "Publish workflow not applicable"
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	if (ctx.config.releaseStrategy === "simple") {
-		if (ctx.read(workflowPath) !== void 0) {
-			ctx.remove(workflowPath);
-			return {
-				filePath: workflowPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR$2}/${workflowPath} (docker publish runs in release.yml for simple strategy)`
-			};
-		}
-		return {
-			filePath,
-			action: "skipped",
-			description: "Publish workflow not generated for simple release strategy"
-		};
-	}
-	const host = resolveGenTimeHost(ctx);
-	const steps = publishSteps(ctx.config.ci, host);
-	const content = buildWorkflowYaml({
-		ci: ctx.config.ci,
-		name: "Publish",
-		on: { workflow_dispatch: null },
-		jobName: "publish",
-		steps
-	});
-	const alreadyExists = ctx.exists(workflowPath);
-	const existing = alreadyExists ? ctx.read(workflowPath) : void 0;
-	const withDevPath = applyWorkspaceToolingBuild(content, ctx.packageJson);
-	if (existing) {
-		if (isToolingIgnored(existing)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Publish workflow has ignore comment"
-		};
-		if (existing.includes("Managed by @bensandee/tooling --") && normalizeWorkflow(existing) === normalizeWorkflow(withDevPath)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Publish workflow already up to date"
-		};
-	}
-	const withPinnedActions = preservePinnedActions(withDevPath, existing, GENERATOR_OWNED_ACTIONS);
-	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
-	ctx.write(workflowPath, final);
-	return {
-		filePath: workflowPath,
-		action: alreadyExists ? "updated" : "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions publish workflow`
+	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `bst docker:publish` to publish by hand") ?? {
+		filePath,
+		action: "skipped",
+		description: "No publish workflow to retire"
 	};
 }
 //#endregion
@@ -6758,7 +6742,8 @@ function diagnoseCheckScriptForwardingAt(targetDir) {
 * Single source of truth for the supported Node floor: `engines.node` (`>=<floor>`) is the
 * honest minimum this package declares. `mise.toml`'s `tools.node` (`generators/mise.ts`) is the
 * exact pin every consumer -- the agent's containers, generated CI, a developer's shell -- now
-* installs and runs, seeded from this same floor on first generation.
+* installs and runs, seeded on first generation from the highest of this floor, `engines.node`,
+* and the `devEngines.runtime` range removed below.
 *
 * `devEngines.runtime` used to carry a caret form of this floor for `actions/setup-node` and
 * pnpm's runtime-download check to read; both are retired by the shared "Install mise" workflow
@@ -6923,7 +6908,7 @@ function perPackageDevDeps(config) {
 		deps["typescript"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -6937,12 +6922,12 @@ function perPackageDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["typescript"];
 		deps["@types/node"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -6956,13 +6941,13 @@ function perPackageDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@types/node"];
 	}
 	if (config.builder === "tsdown") deps["tsdown"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -6976,7 +6961,7 @@ function perPackageDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["tsdown"];
 	return deps;
 }
@@ -6993,7 +6978,7 @@ function vitestDevDeps() {
 		vitest: {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7007,12 +6992,12 @@ function vitestDevDeps() {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["vitest"],
 		"@vitest/coverage-v8": {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7026,7 +7011,7 @@ function vitestDevDeps() {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@vitest/coverage-v8"]
 	};
 }
@@ -7040,7 +7025,7 @@ function rootDevDeps(config) {
 	const deps = { lefthook: {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7054,13 +7039,13 @@ function rootDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["lefthook"] };
 	if (config.stack !== "none") {
 		deps["knip"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7074,12 +7059,12 @@ function rootDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["knip"];
 		deps["oxlint"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7093,14 +7078,14 @@ function rootDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["oxlint"];
 		Object.assign(deps, vitestDevDeps());
 	}
 	if (config.stack === "typescript") deps["oxlint-tsgolint"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7114,7 +7099,7 @@ function rootDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["oxlint-tsgolint"];
 	return deps;
 }
@@ -7145,7 +7130,7 @@ function addReleaseDeps(deps, config) {
 			deps["release-it"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7159,12 +7144,12 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["release-it"];
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7178,14 +7163,14 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["@release-it/bumper"];
 			break;
 		case "simple":
 			deps["commit-and-tag-version"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7199,13 +7184,13 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["commit-and-tag-version"];
 			break;
 		case "changesets": deps["@changesets/cli"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7219,7 +7204,7 @@ function addReleaseDeps(deps, config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@changesets/cli"];
 	}
 }
@@ -7413,7 +7398,7 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 	const pinnedPnpm = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7427,7 +7412,7 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["pnpm"];
 	const desiredPm = pinnedPnpm ? `pnpm@${pinnedPnpm}` : void 0;
 	if (desiredPm) {
@@ -7468,12 +7453,12 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.14.5";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.86.1";
-	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.15.2";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.87.1";
+	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.16.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7487,12 +7472,12 @@ function buildManagedDevDeps(ctx) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["oxfmt"];
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7506,7 +7491,7 @@ function buildManagedDevDeps(ctx) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["prettier"];
 	addReleaseDeps(devDeps, ctx.config);
 	return devDeps;
@@ -7562,7 +7547,7 @@ async function generatePackageJson(ctx) {
 		packageManager: `pnpm@${{
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7576,7 +7561,7 @@ async function generatePackageJson(ctx) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["pnpm"]}`
 	};
 	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
@@ -8394,6 +8379,17 @@ const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlin
 import bensandee from "@bensandee/eslint-plugin/recommended";
 import { defineConfig } from "oxlint";
 
+export default defineConfig({
+  extends: [recommended],
+  jsPlugins: bensandee.jsPlugins ?? [],
+  rules: bensandee.rules ?? {},
+  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
+});
+`;
+const LEGACY_CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
+import bensandee from "@bensandee/eslint-plugin/recommended";
+import { defineConfig } from "oxlint";
+
 // Report phase: every plugin rule runs and reports, none blocks. The severities are derived
 // from the plugin's own rule names rather than listed, so a rule the plugin adds arrives the
 // day it publishes -- enumerating them is how the plugin came to be installed and never
@@ -8426,7 +8422,11 @@ function addIgnorePatterns(content) {
 	return content.slice(0, insertPos) + `  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],\n` + content.slice(insertPos);
 }
 const PLUGIN_IMPORT = "import bensandee from \"@bensandee/eslint-plugin/recommended\";\n";
-const REPORT_SPREAD = "    ...Object.fromEntries(Object.keys(bensandee.rules ?? {}).map((name) => [name, \"warn\"])),\n";
+const TIER_SPREAD = "    ...bensandee.rules,\n";
+const LEGACY_REPORT_SPREAD = "    ...Object.fromEntries(Object.keys(bensandee.rules ?? {}).map((name) => [name, \"warn\"])),\n";
+/** The text every report-phase severity map carries, whatever its shape -- in either quote
+* style, since the merged spread went through the repo's own formatter. */
+const REPORT_PHASE_MARKER = /\[name, (["'])warn\1\]/;
 const RULES_KEY = /^ {2}"?rules"?: \{/m;
 const RULES_KEY_INLINE = /^ {2}"?rules"?\s*[,:]/m;
 const JS_PLUGINS_KEY = /^ {2}"?jsPlugins"?: \[/m;
@@ -8473,28 +8473,29 @@ function addBensandeePlugin(content) {
 	const rulesKey = RULES_KEY.exec(rulesRegion);
 	if (rulesKey) {
 		const at = insertPos + rulesKey.index + rulesKey[0].length;
-		return withPlugins.slice(0, at) + `\n${REPORT_SPREAD}` + withPlugins.slice(at);
+		return withPlugins.slice(0, at) + `\n${TIER_SPREAD}` + withPlugins.slice(at);
 	}
 	if (RULES_KEY_INLINE.test(rulesRegion)) return UNRECOGNIZED_SHAPE;
-	return withPlugins.slice(0, afterJsPlugins) + `  rules: {\n${REPORT_SPREAD}  },\n` + withPlugins.slice(afterJsPlugins);
-}
-/** The exact literal `addBensandeePlugin` splices in when it creates a `rules` key from
-* scratch -- checked before {@link REPORT_SPREAD}'s own merged-in-place form below, since that
-* one is a substring of this one and would otherwise match first and leave the empty `rules: {
-* },` shell behind. */
-const CREATED_RULES_BLOCK = `  rules: {\n${REPORT_SPREAD}  },\n`;
+	return withPlugins.slice(0, afterJsPlugins) + `  rules: {\n${TIER_SPREAD}  },\n` + withPlugins.slice(afterJsPlugins);
+}
+/** The exact literals `addBensandeePlugin` splices in when it creates a `rules` key from
+* scratch, current and legacy -- checked before the merged-in-place spreads below, since each
+* spread is a substring of its block and would otherwise match first and leave the empty `rules:
+* { },` shell behind. */
+const CREATED_RULES_BLOCKS = [`  rules: {\n${TIER_SPREAD}  },\n`, `  rules: {\n${LEGACY_REPORT_SPREAD}  },\n`];
+const MERGED_RULES_SPREADS = [`\n${TIER_SPREAD}`, `\n${LEGACY_REPORT_SPREAD}`];
 const CREATED_JS_PLUGINS_LINE = "  jsPlugins: bensandee.jsPlugins ?? [],\n";
 const MERGED_JS_PLUGINS_SPREAD = /\.\.\.\(bensandee\.jsPlugins \?\? \[\]\),\s+/;
 /**
 * The exact inverse of {@link addBensandeePlugin}: strips the import line and whichever of the
-* two `jsPlugins` and two `rules` shapes it spliced in, by removing those same literals rather
-* than re-deriving positions. Returns `undefined` when there is nothing to remove (the content
-* does not name the plugin -- keeps a re-sync a no-op), and {@link UNRECOGNIZED_SHAPE} when it
-* does but none of the expected literals are present -- a hand-edit since injection, a shape
-* this tool never injected, or (for the merged `jsPlugins` spread only) a formatter reflow
-* wider than {@link MERGED_JS_PLUGINS_SPREAD} tolerates -- declined whole, the same rule
-* `addBensandeePlugin` itself follows, rather than guessing at a partial removal that could
-* corrupt the file.
+* two `jsPlugins` and two `rules` shapes it spliced in, the legacy `rules` literals included, by
+* removing those same literals rather than re-deriving positions. Returns `undefined` when
+* there is nothing to remove (the content does not name the plugin -- keeps a re-sync a no-op),
+* and {@link UNRECOGNIZED_SHAPE} when it does but none of the expected literals are present --
+* a hand-edit since injection, a shape this tool never injected, or (for the merged
+* `jsPlugins` spread only) a formatter reflow wider than {@link MERGED_JS_PLUGINS_SPREAD}
+* tolerates -- declined whole, the same rule `addBensandeePlugin` itself follows, rather than
+* guessing at a partial removal that could corrupt the file.
 */
 function removeBensandeePlugin(content) {
 	if (!content.includes("@bensandee/eslint-plugin")) return void 0;
@@ -8503,10 +8504,17 @@ function removeBensandeePlugin(content) {
 	if (result.includes(CREATED_JS_PLUGINS_LINE)) result = result.replace(CREATED_JS_PLUGINS_LINE, "");
 	else if (MERGED_JS_PLUGINS_SPREAD.test(result)) result = result.replace(MERGED_JS_PLUGINS_SPREAD, "");
 	else return UNRECOGNIZED_SHAPE;
-	if (result.includes(CREATED_RULES_BLOCK)) result = result.replace(CREATED_RULES_BLOCK, "");
-	else if (result.includes(`\n${REPORT_SPREAD}`)) result = result.replace(`\n${REPORT_SPREAD}`, "");
-	else return UNRECOGNIZED_SHAPE;
-	return result;
+	const rulesLiteral = CREATED_RULES_BLOCKS.find((block) => result.includes(block)) ?? MERGED_RULES_SPREADS.find((spread) => result.includes(spread));
+	if (rulesLiteral === void 0) return UNRECOGNIZED_SHAPE;
+	return result.replace(rulesLiteral, "");
+}
+/**
+* Swap the report-phase spread an earlier release merged in for {@link TIER_SPREAD}. Only the
+* byte-exact literal is replaced: a map the repo has reflowed or edited is left for the caller
+* to report, since rewriting a shape this tool did not write could drop the repo's own rules.
+*/
+function migrateReportSpread(content) {
+	return content.replace(`\n${LEGACY_REPORT_SPREAD}`, `\n${TIER_SPREAD}`);
 }
 async function generateOxlint(ctx) {
 	const filePath = "oxlint.config.ts";
@@ -8524,7 +8532,7 @@ async function generateOxlint(ctx) {
 			action: "skipped",
 			description: "Already configured"
 		};
-		if (isGeneratedTemplate(ctx, filePath, ctx.config.useEslintPlugin ? CONFIG_PRESET_ONLY : CONFIG_WITH_LINT_RULES)) {
+		if ((ctx.config.useEslintPlugin ? [CONFIG_PRESET_ONLY, LEGACY_CONFIG_WITH_LINT_RULES] : [CONFIG_WITH_LINT_RULES, LEGACY_CONFIG_WITH_LINT_RULES]).some((template) => isGeneratedTemplate(ctx, filePath, template))) {
 			ctx.write(filePath, content);
 			return {
 				filePath,
@@ -8537,8 +8545,14 @@ async function generateOxlint(ctx) {
 			let pluginResult;
 			let withPlugin;
 			if (ctx.config.useEslintPlugin) {
-				pluginResult = addBensandeePlugin(withIgnores);
-				withPlugin = typeof pluginResult === "string" ? pluginResult : withIgnores;
+				const migrated = migrateReportSpread(withIgnores);
+				pluginResult = addBensandeePlugin(migrated);
+				withPlugin = typeof pluginResult === "string" ? pluginResult : migrated;
+				if (pluginResult === void 0 && REPORT_PHASE_MARKER.test(migrated)) return {
+					filePath,
+					action: "failed",
+					description: "Plugin severities not migrated: unrecognized config shape -- replace the all-\"warn\" rule map with \"...bensandee.rules,\""
+				};
 			} else {
 				pluginResult = removeBensandeePlugin(withIgnores);
 				withPlugin = typeof pluginResult === "string" ? pluginResult : withIgnores;
@@ -8821,20 +8835,30 @@ function toolsRange(source) {
 function pnpmVersionFromPackageManager(packageManager) {
 	return /^pnpm@(\S+)$/.exec(packageManager ?? "")?.[1];
 }
-/** The exact pin to seed `tools.node` with: the higher of `enginesNode`'s own floor (e.g. a repo
-* whose `package.json` already declares `>=24.14.0`) and {@link NODE_ENGINES_FLOOR}, so a loose
-* `engines.node` (`>=24`, `24.x`) can never seed a pin below the supported floor -- the same
-* derive-from-engines discipline the retired `devEngines.runtime` generator used. */
-function nodePinFor(enginesNode) {
-	const tuple = enginesNode ? minVersionTuple(enginesNode) : void 0;
-	const floorTuple = minVersionTuple(NODE_ENGINES_FLOOR);
-	if (!tuple || !floorTuple) return NODE_ENGINES_FLOOR;
-	return compareTuples(tuple, floorTuple) > 0 ? tuple.join(".") : NODE_ENGINES_FLOOR;
+/** The `version` range of the `node` entry in `devEngines.runtime`, which may be one entry or an
+* array of them. */
+function devEnginesNodeVersion(devEngines) {
+	const runtime = devEngines?.runtime;
+	if (!runtime) return void 0;
+	return (Array.isArray(runtime) ? runtime : [runtime]).find((entry) => entry.name === "node")?.version;
+}
+/** The exact pin to seed `tools.node` with: the highest floor among `devEngines.runtime`'s node
+* range, `engines.node`, and {@link NODE_ENGINES_FLOOR}. Renovate's shared preset never raises
+* `engines.node`, so on its own it can seed a pin below the Node the repo actually runs;
+* `devEngines.runtime` is the range Renovate does raise, which is why it is read here even though
+* `generatePackageJson` removes it. An unparseable range is ignored. */
+function nodePinFor(enginesNode, devEnginesNode) {
+	let pin = minVersionTuple(NODE_ENGINES_FLOOR);
+	for (const range of [enginesNode, devEnginesNode]) {
+		const tuple = range ? minVersionTuple(range) : void 0;
+		if (tuple && (!pin || compareTuples(tuple, pin) > 0)) pin = tuple;
+	}
+	return pin ? pin.join(".") : NODE_ENGINES_FLOOR;
 }
 /** The two owned lines, in order, for a file created from scratch (or a `[tools]` table added to
 * one that had none). */
-function ownedLines(pnpmVersion, enginesNode) {
-	const lines = [`[tools]`, `node = "${nodePinFor(enginesNode)}"`];
+function ownedLines(pnpmVersion, nodePin) {
+	const lines = [`[tools]`, `node = "${nodePin}"`];
 	if (pnpmVersion) lines.push(`pnpm = "${pnpmVersion}"`);
 	return lines;
 }
@@ -8878,19 +8902,19 @@ function readPackageJsonFacts(ctx) {
 	const pkg = pkgRaw ? parsePackageJson(pkgRaw) : void 0;
 	return {
 		enginesNode: pkg?.engines?.["node"],
+		devEngines: pkg?.devEngines,
 		pnpmVersion: pnpmVersionFromPackageManager(pkg?.packageManager)
 	};
 }
 /** Edit an existing `[tools]` body in place: add `node` only when absent, rewrite `pnpm` only on
 * drift. Returns the new body and the change descriptions, or `undefined` for the body when
 * nothing changed. */
-function editToolsBody(body, existingNode, existingPnpm, pnpmVersion, enginesNode) {
+function editToolsBody(body, existingNode, existingPnpm, pnpmVersion, nodePin) {
 	let newBody = body;
 	const changes = [];
 	if (existingNode === void 0) {
-		const pin = nodePinFor(enginesNode);
-		newBody = appendLine(newBody, `node = "${pin}"`);
-		changes.push(`added tools.node = "${pin}"`);
+		newBody = appendLine(newBody, `node = "${nodePin}"`);
+		changes.push(`added tools.node = "${nodePin}"`);
 	}
 	if (pnpmVersion && existingPnpm !== pnpmVersion) {
 		if (existingPnpm === void 0) {
@@ -8908,12 +8932,18 @@ function editToolsBody(body, existingNode, existingPnpm, pnpmVersion, enginesNod
 		changes
 	};
 }
-async function generateMise(ctx) {
+/**
+* `priorDevEngines` is `package.json`'s `devEngines` as it stood before this sync: the pipeline
+* reads it before `generatePackageJson` removes `devEngines.runtime`, because by the time this
+* generator re-reads `package.json` the field is gone. Without it, the file read now is used.
+*/
+async function generateMise(ctx, priorDevEngines) {
 	const filePath = "mise.toml";
-	const { enginesNode, pnpmVersion } = readPackageJsonFacts(ctx);
+	const { enginesNode, devEngines, pnpmVersion } = readPackageJsonFacts(ctx);
+	const nodePin = nodePinFor(enginesNode, devEnginesNodeVersion(priorDevEngines ?? devEngines));
 	const existing = ctx.read(filePath);
 	if (!existing) {
-		ctx.write(filePath, ownedLines(pnpmVersion, enginesNode).join("\n") + "\n");
+		ctx.write(filePath, ownedLines(pnpmVersion, nodePin).join("\n") + "\n");
 		return {
 			filePath,
 			action: "created",
@@ -8952,11 +8982,11 @@ async function generateMise(ctx) {
 			action: "failed",
 			description: `mise.toml: tools.* is declared with dotted keys; repo:sync only manages a [tools] table`
 		};
-		text = ownedLines(pnpmVersion, enginesNode).join("\n") + "\n\n" + existing;
+		text = ownedLines(pnpmVersion, nodePin).join("\n") + "\n\n" + existing;
 		changes = ["added [tools] table"];
 	} else {
 		const body = existing.slice(range.start, range.end);
-		const edited = editToolsBody(body, existingNode, existingPnpm, pnpmVersion, enginesNode);
+		const edited = editToolsBody(body, existingNode, existingPnpm, pnpmVersion, nodePin);
 		changes = edited.changes;
 		text = edited.body === body ? existing : existing.slice(0, range.start) + edited.body + existing.slice(range.end);
 	}
@@ -9813,7 +9843,7 @@ function postReleaseHookJob(opts) {
 		needs: opts.needsJob,
 		if: opts.publishCondition,
 		"continue-on-error": true,
-		steps: [...commonSteps(opts.ci, []), { step: {
+		steps: [...commonSteps(opts.ci), { step: {
 			name: "Post-release hook",
 			env: {
 				...hookSecretEnv(opts.secrets),
@@ -9852,21 +9882,20 @@ function deployDispatchStep(opts) {
 	} };
 }
 /** Common setup steps shared by release-it and simple strategies. */
-function commonSteps(ci, authSteps) {
+function commonSteps(ci) {
 	return [
 		{ step: {
 			uses: "actions/checkout@v6",
 			with: { "fetch-depth": 0 }
 		} },
 		...miseSetupSteps(ci),
-		...authSteps,
 		{ step: { run: "pnpm install --frozen-lockfile" } }
 	];
 }
 function releaseItSteps(ci, npmAuth) {
 	const tokenEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") } : { RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") };
-	return [...commonSteps(ci, npmAuth.steps), { step: {
-		run: "pnpm release-it --ci",
+	return [...commonSteps(ci), { step: {
+		run: npmAuth.publishRun("pnpm release-it --ci"),
 		env: {
 			...tokenEnv,
 			...npmAuth.tokenEnv,
@@ -9917,7 +9946,7 @@ function simpleReleaseEnv() {
 	};
 }
 function simpleReleaseSteps(ctx) {
-	const { ci, npmAuth, hasDocker, hasAssets, host } = ctx;
+	const { ci, hasDocker, hasAssets, host } = ctx;
 	const releaseEnv = connectionEnv(ci);
 	const pushedIf = "steps.release.outputs.pushed == 'true'";
 	const releaseStep = { step: {
@@ -9943,7 +9972,7 @@ function simpleReleaseSteps(ctx) {
 		run: "pnpm exec bst docker:publish"
 	} };
 	return [
-		...commonSteps(ci, npmAuth.steps),
+		...commonSteps(ci),
 		releaseStep,
 		...hasAssets ? [assetsStep] : [],
 		...hasDocker ? [dockerStep] : []
@@ -9956,21 +9985,36 @@ function buildSteps(strategy, ctx) {
 		default: return null;
 	}
 }
+/**
+* Whether this release strategy gets its own `release.yml`.
+*
+* `changesets` releases from the CI workflow (`generateCi` writes that step inline) and `none`
+* releases nothing. Exported for `generateStaleCiWorkflows`, which asks the same question to
+* decide whether a `release.yml` on disk is still current -- the two must not answer it
+* differently or the retirer deletes a file this generator has just written.
+*/
+function hasReleaseWorkflow(strategy) {
+	return strategy === "simple" || strategy === "release-it";
+}
+/** Where this platform's release workflow lives. */
+function releaseWorkflowPath(ci) {
+	return ci === "github" ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+}
 async function generateReleaseCi(ctx) {
 	const filePath = "release-ci";
-	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
+	const isGitHub = ctx.config.ci === "github";
+	if (ctx.config.ci === "none" || ctx.config.releaseStrategy === "none") return {
 		filePath,
 		action: "skipped",
 		description: "Release CI workflow not applicable"
 	};
-	const publishesNpm = ctx.config.publishNpm === true;
-	if (ctx.config.releaseStrategy === "changesets") return {
+	if (!hasReleaseWorkflow(ctx.config.releaseStrategy)) return {
 		filePath,
 		action: "skipped",
 		description: "Release step included in CI workflow"
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+	const publishesNpm = ctx.config.publishNpm === true;
+	const workflowPath = releaseWorkflowPath(ctx.config.ci);
 	const hasDocker = hasDockerPackages(ctx) && ctx.config.publishDocker;
 	const hasAssets = hasReleaseAssets(ctx) || hasVersionStamp(ctx);
 	const host = resolveGenTimeHost(ctx);
@@ -10026,7 +10070,6 @@ async function generateReleaseCi(ctx) {
 		on,
 		...isGitHub && { permissions: { contents: "write" } },
 		jobName: "release",
-		...Object.keys(npmAuth.jobEnv).length > 0 && { jobEnv: npmAuth.jobEnv },
 		...jobOutputs && { jobOutputs },
 		steps,
 		...extraJobs && { extraJobs }
@@ -10099,7 +10142,7 @@ function healthSteps(includeHistory) {
 	} }];
 }
 /** Build the release step for the check job (changesets strategy). */
-function changesetsReleaseStep(ci, publishesNpm, tokenEnv) {
+function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 	if (ci === "github") {
 		const changesetsEnv = {
 			GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
@@ -10123,10 +10166,10 @@ function changesetsReleaseStep(ci, publishesNpm, tokenEnv) {
 			FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
 			FORGEJO_REPOSITORY: actionsExpr("github.repository"),
 			RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
-			...tokenEnv,
+			...npmAuth.tokenEnv,
 			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 		},
-		run: "pnpm exec bst release:changesets"
+		run: npmAuth.publishRun("pnpm exec bst release:changesets")
 	} };
 }
 /**
@@ -10159,7 +10202,7 @@ function ciConcurrency(ci) {
 		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
 	};
 }
-function checkSteps(ci, authSteps, coverageEnabled, emitDockerSweepStep) {
+function checkSteps(ci, coverageEnabled, emitDockerSweepStep) {
 	const checkCommand = coverageEnabled ? "pnpm ci:check" : "pnpm ci:check --no-coverage";
 	return [
 		{ step: {
@@ -10167,7 +10210,6 @@ function checkSteps(ci, authSteps, coverageEnabled, emitDockerSweepStep) {
 			with: { "fetch-depth": 0 }
 		} },
 		...miseSetupSteps(ci),
-		...authSteps,
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		...emitDockerSweepStep ? [{ step: {
 			name: "Sweep leaked Docker resources",
@@ -10179,7 +10221,13 @@ function checkSteps(ci, authSteps, coverageEnabled, emitDockerSweepStep) {
 		} }
 	];
 }
-/** Resolve the CI workflow filename based on release strategy. */
+/**
+* Resolve the CI workflow filename based on release strategy.
+*
+* Exported for `generateStaleCiWorkflows`, which derives the file the current strategy keeps
+* from this one function rather than a second copy of the mapping -- if the two could drift
+* apart, the retirer would delete a file this generator has just written.
+*/
 function ciWorkflowPath(ci, releaseStrategy) {
 	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
 }
@@ -10220,10 +10268,10 @@ async function generateCi(ctx) {
 	}
 	const npmAuth = npmAuthWiring(ctx, isChangesets && publishesNpm && !isGitHub);
 	const steps = [
-		...checkSteps(ctx.config.ci, npmAuth.steps, coverage.enabled, hasDockerPackages(ctx)),
+		...checkSteps(ctx.config.ci, coverage.enabled, hasDockerPackages(ctx)),
 		...emitCoverageSteps ? coverageHistorySteps() : [],
 		...healthSteps(emitHealthHistory),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth.tokenEnv)] : [],
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth)] : [],
 		...isChangesets && isGitHub ? [githubChangesetsDeriveTagStep] : [],
 		...hasAssets ? [{ step: {
 			name: "Upload Release Assets",
@@ -10261,10 +10309,7 @@ async function generateCi(ctx) {
 			secrets: hookSecrets
 		}) };
 	}
-	const checkJobEnv = {
-		...emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {},
-		...npmAuth.jobEnv
-	};
+	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {};
 	const checksSlice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ checks: ChecksConfigSchema.optional() }), { block: "checks" });
 	const skipOnVersionPr = isChangesets && checksSlice?.checks?.runOnVersionPr !== true;
 	const content = buildWorkflowYaml({
@@ -11181,7 +11226,7 @@ function buildConfig$1(config) {
 	].join("\n");
 }
 /** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR$1 = ".tooling-archived";
+const ARCHIVE_DIR = ".tooling-archived";
 /** Common client-side git hooks that husky may have configured. */
 const HUSKY_HOOK_NAMES = [
 	"pre-commit",
@@ -11215,7 +11260,7 @@ function archiveHuskyHooks(ctx, results) {
 			results.push({
 				filePath: huskyPath,
 				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR$1}/${huskyPath}`
+				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
 			});
 			found = true;
 		}
@@ -11230,7 +11275,7 @@ function archiveLintStagedConfigs(ctx, results) {
 		results.push({
 			filePath: lsPath,
 			action: "archived",
-			description: `Moved to ${ARCHIVE_DIR$1}/${lsPath}`
+			description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
 		});
 		found = true;
 	}
@@ -11438,12 +11483,17 @@ async function generateVscodeSettings(ctx) {
 }
 //#endregion
 //#region src/generators/coverage-ci.ts
-/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR = ".tooling-archived";
 /**
-* Cleanup-only generator: coverage steps now run inline in ci.yml (see
-* generateCi). Any legacy coverage.yml left over from a previous version is
-* archived to .tooling-archived/ on the next repo:sync.
+* Cleanup-only generator: coverage steps now run inline in the CI workflow (see generateCi), so
+* any legacy `coverage.yml` left over from an older sync is removed.
+*
+* The result is `removed`, not `archived`: `repo:sync --check` counts only the former as drift,
+* and the agent's workflow sync sweep acts only on drift the check reports. An `archived` result
+* let a plain `repo:sync` delete a file while `--check` called the repo up to date.
+*
+* The ignore comment is the only opt-out here, and there is deliberately no managed-header guard:
+* this file predates the header, so no legacy `coverage.yml` in a synced repo carries one. Requiring
+* it would leave every file this generator exists to remove exactly where it is.
 */
 async function generateCoverageCi(ctx) {
 	const filePath = "coverage-ci";
@@ -11453,19 +11503,23 @@ async function generateCoverageCi(ctx) {
 		description: "CI workflow not requested"
 	};
 	const workflowPath = ctx.config.ci === "github" ? ".github/workflows/coverage.yml" : ".forgejo/workflows/coverage.yml";
-	if (ctx.read(workflowPath) !== void 0) {
-		ctx.remove(workflowPath);
-		return {
-			filePath: workflowPath,
-			action: "archived",
-			description: `Moved to ${ARCHIVE_DIR}/${workflowPath} (coverage now runs inline in ci.yml)`
-		};
-	}
-	return {
+	const existing = ctx.read(workflowPath);
+	if (existing === void 0) return {
 		filePath,
 		action: "skipped",
 		description: "Coverage runs inline in ci.yml"
 	};
+	if (isToolingIgnored(existing)) return {
+		filePath: workflowPath,
+		action: "skipped",
+		description: "coverage.yml has ignore comment"
+	};
+	ctx.remove(workflowPath);
+	return {
+		filePath: workflowPath,
+		action: "removed",
+		description: `Moved to ${ARCHIVE_DIR$1}/${workflowPath} (coverage now runs inline in ci.yml)`
+	};
 }
 //#endregion
 //#region src/docs-check/blocks.ts
@@ -12381,7 +12435,7 @@ function webUiGuideBody() {
 	const mwg = `pnpm dlx modern-web-guidance@${{
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -12395,7 +12449,7 @@ function webUiGuideBody() {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["modern-web-guidance"]}`;
 	return [
 		"# Web UI",
@@ -12946,12 +13000,74 @@ async function generateVersionrc(ctx) {
 	};
 }
 //#endregion
+//#region src/generators/stale-ci-workflows.ts
+/**
+* Cleanup-only generator: retire the strategy-dependent CI workflow that the repo's current
+* `releaseStrategy` no longer writes.
+*
+* `generateCi` names its file after the release strategy (`ci.yml` for changesets, `check.yml`
+* for every other strategy), and `generateReleaseCi` writes `release.yml` for two of the four.
+* Changing `.tooling.json#releaseStrategy` therefore leaves the previous file on disk, where it
+* keeps running the check pipeline or a release job beside the new one. Nothing else removes it:
+* no generator names a file the current strategy does not use, so no generator reports it.
+*
+* The kept set comes from the two generators' own functions -- `ciWorkflowPath` for the CI file
+* and `hasReleaseWorkflow` for `release.yml` -- never from a table copied here. That is the whole
+* safety argument: this retirer cannot delete a file the generator has just written, because both
+* read one mapping.
+*
+* `ci: "none"` retires nothing. A repo that switched CI off is not claiming these files are
+* stale, and emptying a workflow directory a human chose to manage by hand is not this
+* generator's call.
+*/
+async function generateStaleCiWorkflows(ctx) {
+	const ci = ctx.config.ci;
+	if (ci === "none") return [];
+	const strategy = ctx.config.releaseStrategy;
+	const keptCiPath = ciWorkflowPath(ci, strategy);
+	const candidates = [
+		ciWorkflowPath(ci, "changesets"),
+		ciWorkflowPath(ci, "none"),
+		releaseWorkflowPath(ci)
+	];
+	const kept = /* @__PURE__ */ new Set([keptCiPath]);
+	if (hasReleaseWorkflow(strategy)) kept.add(releaseWorkflowPath(ci));
+	const results = [];
+	for (const candidate of candidates) {
+		if (kept.has(candidate)) continue;
+		const result = retireManagedWorkflow(ctx, candidate, retireReason(strategy, candidate, keptCiPath, ci));
+		if (result !== void 0) results.push(result);
+	}
+	return results;
+}
+/** Last path segment. `node:path` has no opinion about workflow separators, and these are
+* always POSIX paths, so this stays here rather than pulling in a platform-aware helper. */
+function baseName(workflowPath) {
+	return workflowPath.slice(workflowPath.lastIndexOf("/") + 1);
+}
+/**
+* Why this file is stale, naming the strategy that made it so, so the sync sweep's pull request
+* and the `--check` output explain the deletion without the reader opening a generator.
+*
+* Every branch reads the kept path, never a strategy literal: a changesets repo runs its release
+* step inside `ci.yml`, so a retired `release.yml` there says the release moved there, and
+* anywhere else the strategy has no release workflow at all.
+*/
+function retireReason(strategy, retiredPath, keptCiPath, ci) {
+	const keptCiBaseName = baseName(keptCiPath);
+	const prefix = `releaseStrategy "${strategy}"`;
+	if (retiredPath !== releaseWorkflowPath(ci)) return `${prefix} runs checks in ${keptCiBaseName}`;
+	if (keptCiPath === ciWorkflowPath(ci, "changesets")) return `${prefix} releases from ${keptCiBaseName}`;
+	return `${prefix} has no release workflow`;
+}
+//#endregion
 //#region src/generators/pipeline.ts
 /** Run all generators sequentially and return their results. */
 async function runGenerators(ctx) {
 	const results = [];
+	const priorDevEngines = ctx.packageJson?.devEngines;
 	results.push(await generatePackageJson(ctx));
-	results.push(await generateMise(ctx));
+	results.push(await generateMise(ctx, priorDevEngines));
 	results.push(...await generateWorkspaceEngines(ctx));
 	results.push(await generatePnpmWorkspace(ctx));
 	results.push(...await generateTsconfig(ctx));
@@ -12970,6 +13086,7 @@ async function runGenerators(ctx) {
 	results.push(await generateVersionrc(ctx));
 	results.push(await generateChangesets(ctx));
 	results.push(await generateReleaseCi(ctx));
+	results.push(...await generateStaleCiWorkflows(ctx));
 	results.push(await generateDeployCi(ctx));
 	results.push(await generateCoverageCi(ctx));
 	results.push(...await generateClaudeMd(ctx));
@@ -13002,7 +13119,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.86.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.87.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -13988,7 +14105,9 @@ function createFileReader() {
 * (`commands/sync-gates.ts`) -- see that gate's doc comment for why an absent mise warns rather
 * than fails -- plus, when `publishDocker` is on, one more per image only the check overlay
 * declares (`runCheckOnlyImageGate`, same file): an advisory that a later tooling release stops
-* publishing it, counted rather than failed for the same reason the other two are.
+* publishing it, counted rather than failed for the same reason the other two are -- plus one
+* more per workflow file whose custom block installs packages with apt (`runWorkflowAptGate`,
+* same file), which the agent's containers cannot run.
 */
 const CHECKS_MARKER = "::bst-checks::";
 const WARN_LINE = new RegExp(`^${CHECKS_MARKER} warn (\\d+)\\s*$`);
@@ -15560,6 +15679,113 @@ const runChecksCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/utils/workflow-paths.ts
+/**
+* The single definition of "workflow dir", shared by `repo:sync --check`'s advisory
+* classification and the workflow sync sweep's path allowlist -- so the two halves cannot
+* disagree about what counts as workflow output. Each prefix carries its trailing slash so a
+* file named e.g. `.github/workflowsX` never matches.
+*/
+const WORKFLOW_DIR_PREFIXES = [".forgejo/workflows/", ".github/workflows/"];
+/** True when `filePath` (repo-relative) lives under one of the workflow directories. */
+function isWorkflowDirPath(filePath) {
+	return WORKFLOW_DIR_PREFIXES.some((prefix) => filePath.startsWith(prefix));
+}
+//#endregion
+//#region src/commands/workflow-apt-steps.ts
+/** `apt-get install`, `apt install`, and either with options before the verb (`apt-get -y
+* install`). */
+const APT_INSTALL = /\bapt(?:-get)?(?:\s+-\S+)*\s+install\b/g;
+const COMMAND_END = /&&|\|\||;|\|/;
+/** Every readable `.yml`/`.yaml` file in the two workflow directories, as repo-relative paths. */
+function workflowFiles(targetDir) {
+	const files = [];
+	for (const prefix of WORKFLOW_DIR_PREFIXES) {
+		let names;
+		try {
+			names = readdirSync(path.join(targetDir, prefix));
+		} catch {
+			continue;
+		}
+		for (const name of names) {
+			if (!/\.ya?ml$/.test(name)) continue;
+			const relative = `${prefix}${name}`;
+			if (isReadableFile$1(path.join(targetDir, relative))) files.push(relative);
+		}
+	}
+	return files;
+}
+/** False for a directory, a dangling symlink, or anything `stat` refuses: an advisory never fails
+* the run it advises, so a file it cannot look at is skipped, not thrown on. */
+function isReadableFile$1(file) {
+	try {
+		return statSync(file).isFile();
+	} catch {
+		return false;
+	}
+}
+/** A file's text, or null when it cannot be read -- skipped for the same reason. */
+function readText(file) {
+	try {
+		return readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+}
+/** A custom block's content lines, with the markers and every other comment line dropped (a
+* commented-out apt step has been removed) and `\`-continued lines joined. */
+function logicalLines(blockLines) {
+	const lines = [];
+	let pending = "";
+	for (const line of blockLines) {
+		if (line.trim().startsWith("#")) continue;
+		const trimmed = line.trimEnd();
+		if (trimmed.endsWith("\\")) {
+			pending += `${trimmed.slice(0, -1)} `;
+			continue;
+		}
+		lines.push(pending + line);
+		pending = "";
+	}
+	if (pending !== "") lines.push(pending);
+	return lines;
+}
+/** The packages one line installs, or none when it runs no apt install. */
+function packagesIn(line) {
+	const packages = [];
+	for (const match of line.matchAll(APT_INSTALL)) {
+		const command = line.slice(match.index + match[0].length).split(COMMAND_END)[0] ?? "";
+		for (const token of command.split(/\s+/)) {
+			if (token === "" || token.startsWith("-")) continue;
+			packages.push(token);
+		}
+	}
+	return packages;
+}
+/** True when `line` runs an apt install at all, packages or not. */
+function installsWithApt(line) {
+	return line.search(APT_INSTALL) !== -1;
+}
+function findWorkflowAptSteps(targetDir) {
+	const steps = [];
+	for (const file of workflowFiles(targetDir)) {
+		const content = readText(path.join(targetDir, file));
+		if (content === null || isToolingIgnored(content)) continue;
+		let matched = false;
+		const packages = /* @__PURE__ */ new Set();
+		for (const block of extractCustomBlocks(content)) for (const line of logicalLines(block.lines)) {
+			if (!installsWithApt(line)) continue;
+			matched = true;
+			for (const name of packagesIn(line)) packages.add(name);
+		}
+		if (matched) steps.push({
+			file,
+			packages: [...packages]
+		});
+	}
+	return steps.toSorted((a, b) => a.file.localeCompare(b.file));
+}
+//#endregion
 //#region src/commands/sync-gates.ts
 /**
 * The pre-generator gates and config diagnostics every `repo:sync` mode runs -- split out of
@@ -15619,6 +15845,23 @@ function runCheckOnlyImageGate(config, targetDir) {
 	return images;
 }
 /**
+* Warn, once per workflow file, when a `@tooling:custom` block installs packages with apt. CI's
+* job runs as root and can do that; the agent's containers run without root and cannot, so the
+* package is present in CI and missing in the agent's measurement of the same tree. Advisory like
+* {@link runCheckOnlyImageGate}, and for the same reason it returns the entries: `repo:sync
+* --check` folds their count into the `::bst-checks:: warn` marker. It never fails a run and never
+* edits the block -- not every Debian package has a conda equivalent under the same name, so moving
+* it is a human's call.
+*/
+function runWorkflowAptGate(targetDir) {
+	const steps = findWorkflowAptSteps(targetDir);
+	for (const step of steps) {
+		const packages = step.packages.length > 0 ? step.packages.join(", ") : "packages";
+		log$1.warn(`${step.file} installs ${packages} with apt in a custom block. The agent's containers cannot run that step, so its runs lack what CI has. Declare each tool in mise.toml as conda:<name> (both CI and the agent install from it), then remove the apt step.`);
+	}
+	return steps;
+}
+/**
 * Require a declared publish destination before any generator or apply step runs.
 * Returns the number of offenders (0 = clean). Each is emitted via `log.error` so
 * the user sees the full message and the fix.
@@ -15906,19 +16149,6 @@ function runToolchainGate(targetDir) {
 	};
 }
 //#endregion
-//#region src/utils/workflow-paths.ts
-/**
-* The single definition of "workflow dir", shared by `repo:sync --check`'s advisory
-* classification and the workflow sync sweep's path allowlist -- so the two halves cannot
-* disagree about what counts as workflow output. Each prefix carries its trailing slash so a
-* file named e.g. `.github/workflowsX` never matches.
-*/
-const WORKFLOW_DIR_PREFIXES = [".forgejo/workflows/", ".github/workflows/"];
-/** True when `filePath` (repo-relative) lives under one of the workflow directories. */
-function isWorkflowDirPath(filePath) {
-	return WORKFLOW_DIR_PREFIXES.some((prefix) => filePath.startsWith(prefix));
-}
-//#endregion
 //#region src/commands/repo-sync.ts
 const rawLog$1 = (msg) => console.log(msg);
 const syncCommand = defineCommand({
@@ -15958,7 +16188,7 @@ const syncCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
+			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
 		}
 	},
 	async run({ args }) {
@@ -16035,6 +16265,7 @@ function gateFailure(toolchainWarned = false) {
 		failed: [],
 		toolchain: { warned: toolchainWarned },
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -16045,8 +16276,8 @@ function gateFailure(toolchainWarned = false) {
 * withheld -- the same number rides in `warnCount`, and printing both would put a second thing on
 * the stream beside the payload.
 */
-function upToDateReport(toolchain, checkOnlyImages) {
-	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length;
+function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
+	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
 	if (warnCount > 0) {
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 	} else log$1.success("Repository is up to date.");
@@ -16056,6 +16287,7 @@ function upToDateReport(toolchain, checkOnlyImages) {
 		failed: [],
 		toolchain,
 		checkOnlyImages,
+		aptSteps,
 		warnCount,
 		exitCode: 0
 	};
@@ -16091,28 +16323,30 @@ async function runCheckReport(targetDir) {
 		toolchain: { warned: toolchain.warned }
 	};
 	const checkOnlyImages = runCheckOnlyImageGate(config, targetDir);
+	const aptSteps = runWorkflowAptGate(targetDir);
 	const { ctx, pendingWrites } = createDryRunContext(config);
 	logDetectionSummary(ctx);
 	const results = await runGenerators(ctx);
 	const failed = failedResults(results);
 	reportFailures(failed, "repo:sync");
 	const actionable = actionableResults(results, pendingWrites, targetDir);
-	const toolchainWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length;
+	const advisoryWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
 	const toolchainState = { warned: toolchain.warned };
-	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages);
+	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages, aptSteps);
 	if (actionable.length === 0) return {
 		status: "failed",
 		actionable: [],
 		failed,
 		toolchain: toolchainState,
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 	log$1.warn(`${actionable.length} file(s) would be changed by repo:sync`);
 	for (const r of actionable) logActionableChange(r, targetDir, pendingWrites);
 	if (failed.length === 0 && actionable.every((r) => isWorkflowDirPath(r.filePath))) {
-		const warnCount = actionable.length + toolchainWarnCount;
+		const warnCount = actionable.length + advisoryWarnCount;
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 		return {
 			status: "workflow-drift",
@@ -16120,6 +16354,7 @@ async function runCheckReport(targetDir) {
 			failed: [],
 			toolchain: toolchainState,
 			checkOnlyImages,
+			aptSteps,
 			warnCount,
 			exitCode: 0
 		};
@@ -16130,6 +16365,7 @@ async function runCheckReport(targetDir) {
 		failed,
 		toolchain: toolchainState,
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -16324,6 +16560,9 @@ const PullListItemSchema = z.object({
 	updated_at: z.string().nullish(),
 	labels: z.array(z.object({ name: z.string() })).nullish()
 });
+function updatedBefore(since) {
+	return (pr) => pr.updatedAt !== null && Date.parse(pr.updatedAt) < since;
+}
 /**
 * Every pull request -- open, merged, and closed-unmerged -- by default, via `state=all`; a caller
 * may narrow the read with {@link ListPullsOptions.state}. Paged to an empty page or to
@@ -16351,7 +16590,9 @@ async function listPulls(executor, conn, options = {}) {
 			limit: String(PULLS_PAGE_SIZE),
 			page: String(page)
 		});
-		if (options.sort !== void 0) params.set("sort", options.sort);
+		const sort = options.updatedSince === void 0 ? options.sort : "recentupdate";
+		if (sort !== void 0) params.set("sort", sort);
+		for (const id of options.labelIds ?? []) params.append("labels", String(id));
 		const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/pulls?${params.toString()}`;
 		const res = await executor.fetch(url, {
 			headers,
@@ -16380,6 +16621,7 @@ async function listPulls(executor, conn, options = {}) {
 		pulls.push(...items);
 		if (items.length === 0) break;
 		if (options.stopWhen !== void 0 && items.some(options.stopWhen)) break;
+		if (options.updatedSince !== void 0 && items.some(updatedBefore(options.updatedSince))) break;
 		if (options.limit !== void 0 && pulls.length >= options.limit) break;
 		if (page === PULLS_MAX_PAGES) {
 			log.warn(`PR listing on ${conn.repository} hit the ${String(PULLS_MAX_PAGES)}-page cap without an empty page; results may be truncated`);
@@ -21137,7 +21379,7 @@ function createRealLintTypesExecutor() {
 }
 //#endregion
 //#region src/lint-types/phase.ts
-const LINT_TYPES_PHASE = "report";
+const LINT_TYPES_PHASE = "enforce";
 //#endregion
 //#region src/lint-types/report.ts
 /** oxlint spells a rule code `plugin(rule)` (e.g. `typescript(no-base-to-string)`); the escape
@@ -21158,8 +21400,8 @@ function formatFindingLine(diagnostic) {
 	return `${span?.line !== void 0 && span.column !== void 0 ? `${diagnostic.filename}:${String(span.line)}:${String(span.column)}` : diagnostic.filename}  ${formatRuleCode(diagnostic.code)}  ${diagnostic.message}`;
 }
 /**
-* Names no date: the enforce release has none, and inventing one the fleet cannot meet is
-* worse than naming none.
+* Prints only when the phase is pinned to "report". Names no date: inventing one the fleet
+* cannot meet is worse than naming none.
 */
 const CONSEQUENCE_LINE = "These will block once a future release of the tooling flips lint:types from the report phase to the enforce phase.";
 const ESCAPE_HATCHES = ["  - Turn a rule off in this repo's own oxlint.config.ts (e.g. \"typescript/<rule>\": \"off\") -- plain `pnpm lint` ignores type-aware rules entirely, so this never weakens it.", "  - Skip the step entirely with .tooling.json#checks.skip: [\"lint:types\"]."];
@@ -21363,7 +21605,7 @@ function runLintTypes(executor, targetDir, extraArgs = []) {
 const lintTypesCommand = defineCommand({
 	meta: {
 		name: "lint:types",
-		description: "Run oxlint --type-aware (backed by oxlint-tsgolint) and report every type-aware finding, selected by subtracting a plain oxlint run. Report phase: prints findings, states they will block once a future tooling release flips to the enforce phase, exits 0 unless .tooling.json#lint.strictTypeAware is set. When findings do not block, the last stdout line is the ::bst-checks:: warn marker."
+		description: "Run oxlint --type-aware (backed by oxlint-tsgolint) and report every type-aware finding, selected by subtracting a plain oxlint run. Enforce phase: prints findings and exits 1 when there are any. .tooling.json#lint.strictTypeAware makes a missing oxlint-tsgolint binary a failure instead of a notice."
 	},
 	args: {
 		dir: {
@@ -21966,12 +22208,16 @@ const PROBE_TIMEOUT_SECONDS = "5";
 * Pinned by digest, not a tag: a tag-pinned probe image would re-pull (and
 * could silently change) on every check run, reintroducing this exact
 * issue's silent-timeout symptom on the very shared-agent CI runners it
-* targets, since registry egress is often restricted there. Resolved from
-* `curlimages/curl:8.21.0` (the latest stable tag as of 2026-07-16) via the
-* Docker Hub registry API -- this is the digest of the multi-arch manifest
-* list, so `docker run` still resolves the correct platform automatically.
+* targets, since registry egress is often restricted there. The digest is
+* the multi-arch manifest list's, so `docker run` still resolves the correct
+* platform automatically.
+*
+* The tag rides along only for Renovate: Docker resolves a `tag@digest`
+* reference by the digest alone, and the root `renovate.json` has a custom
+* manager that reads the tag as the current version and moves tag and digest
+* together.
 */
-const PROBE_IMAGE = "curlimages/curl@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
+const PROBE_IMAGE = "curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
 /** Look up the health status of a specific service from container info. */
 function getContainerHealth(containers, serviceName) {
 	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
@@ -32247,6 +32493,11 @@ function taskLabelNumber(text) {
 * statement speaks for every future slice, the progress note only for this one. `**Progress:**`
 * and `**Blocked:**` alone declare nothing.
 *
+* A box's **title** is the first sentence of its paragraph, not of its line: markdown joins a
+* wrapped box into one paragraph, and a title cut at the wrap read as a fragment on the control
+* panel. `**` markers are dropped from it. The title is the identity the agent's box diff pairs
+* on, so it must stay a pure function of the box's own text.
+*
 * A box is the **retire task** when its title starts with optional `**` or `__`, then the
 * literal `Retire this plan`, word-bounded (not followed by a letter or digit). That
 * classification carries no judgement about whether the task is done; `isOutstanding` reads a
@@ -32274,6 +32525,49 @@ function noteKind(label) {
 	if (label === "Blocked") return "blocked";
 	return "declined";
 }
+/** A line that ends a box's paragraph: another list item, or a `**Progress:**`-shaped note. */
+const PARAGRAPH_BREAK_REGEX = /^[ \t]*(?:[-*+][ \t]|[0-9]+[.)][ \t]|\*\*(?:Progress|Blocked|Declined):\*\*)/;
+/** A word whose trailing period abbreviates rather than ends a sentence. */
+const ABBREVIATION_REGEX = /(?:^|[^A-Za-z])(?:e\.g|i\.e|etc|vs|cf)$/i;
+/**
+* The box line's text joined with the lines that continue its paragraph, one space apart. Markdown
+* renders a wrapped box as one paragraph, so a line break says nothing about where the title ends.
+* The paragraph stops at a blank line, a heading, a fenced line, another list item, or a note.
+*/
+function boxParagraph(lines, fenced, start, end, first) {
+	const parts = [first];
+	for (let index = start + 1; index < end; index++) {
+		const line = lines[index] ?? "";
+		if (fenced[index] === true || line.trim() === "") break;
+		if (HEADING_REGEX.test(line) || PARAGRAPH_BREAK_REGEX.test(line)) break;
+		parts.push(line.trim());
+	}
+	return parts.join(" ").trim();
+}
+/**
+* The paragraph's first sentence: up to the first `.`, `!` or `?` outside an inline code span that
+* is followed by whitespace or the end, with any closing `*`, `_`, `)` or quote kept on it so a
+* bold span ending in a period stays whole. A common abbreviation (`e.g.`) does not end it. A
+* paragraph with no sentence end is returned whole.
+*/
+function firstSentence$1(paragraph) {
+	let inCode = false;
+	for (let index = 0; index < paragraph.length; index++) {
+		const char = paragraph[index];
+		if (char === "`") inCode = !inCode;
+		if (inCode || char !== "." && char !== "!" && char !== "?") continue;
+		let end = index + 1;
+		while (end < paragraph.length && /[*_)"']/.test(paragraph[end] ?? "")) end++;
+		if (end < paragraph.length && !/\s/.test(paragraph[end] ?? "")) continue;
+		if (char === "." && ABBREVIATION_REGEX.test(paragraph.slice(0, index))) continue;
+		return paragraph.slice(0, end);
+	}
+	return paragraph;
+}
+/** `**` markers outside inline code spans removed: the title is shown as plain text. */
+function stripStrong(text) {
+	return text.split(/(`[^`]*`)/).map((part) => part.startsWith("`") ? part : part.replaceAll("**", "")).join("").trim();
+}
 /**
 * The checkbox marker stripped, then a `**`/`__` span wrapping the whole title unwrapped (only
 * when the closing marker matches the opening one, so a title merely starting or ending with the
@@ -32310,7 +32604,7 @@ function parsePlanBoxes(planText) {
 				break;
 			}
 		}
-		const title = unwrapEmphasis(box.rawTitle);
+		const title = stripStrong(unwrapEmphasis(firstSentence$1(boxParagraph(lines, fenced, box.index, blockEnd, box.rawTitle))));
 		const retireTask = RETIRE_TASK_REGEX.test(title);
 		if (box.checked) return {
 			line: box.index,
@@ -32843,7 +33137,7 @@ setForgejoLogger(log$1);
 * `local <sha>[-dirty]` otherwise -- so an artifact built from the working tree
 * can't pass itself off as the published release whose version it carries.
 */
-const displayVersion = "0.86.1";
+const displayVersion = "0.87.1";
 /**
 * The registered `bst` subcommand map, exported so both the JSON entry path below (resolving a
 * command name before citty parses anything) and the coverage test (enumerating every