@edgehero/pi-dispatch-admin 1.3.0 → 1.5.0

package/dist/index.mjs

@@ -7886,6 +7886,462 @@ var init_budget = __esm({
   }
 });
 
+// ../worker/src/pause-windows.mjs
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function parseHHMM(value, label, at, path) {
+  const m = isNonEmptyString2(value) ? /^([0-9]{1,2}):([0-9]{2})$/.exec(value.trim()) : null;
+  if (!m) throw configError(`${at}: ${label} must be "HH:MM": ${JSON.stringify(value)} (${path})`);
+  const h = Number(m[1]);
+  const min = Number(m[2]);
+  if (h > 23 || min > 59) throw configError(`${at}: ${label} out of range 00:00-23:59: ${JSON.stringify(value)} (${path})`);
+  return h * 60 + min;
+}
+function assertDate(value, label, at, path) {
+  const m = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(String(value).trim());
+  const mo = m && Number(m[2]);
+  const d = m && Number(m[3]);
+  if (!m || mo < 1 || mo > 12 || d < 1 || d > 31) {
+    throw configError(`${at}: ${label} must be "YYYY-MM-DD": ${JSON.stringify(value)} (${path})`);
+  }
+}
+function validateTz(tz, at, path) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return tz;
+  } catch {
+    throw configError(`${at}: tz is not a valid IANA timezone: ${JSON.stringify(tz)} (${path})`);
+  }
+}
+function parsePauseWindows(text, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw configError(`pause-windows file is not valid JSON: ${path} (${error.message})`);
+  }
+  const windows = parsed?.windows;
+  if (!Array.isArray(windows)) {
+    throw configError(`pause-windows file must have a "windows" array: ${path}`);
+  }
+  return windows.map((w, index) => normalizeWindow(w, index, path));
+}
+function normalizeWindow(w, index, path) {
+  const at = `pause window at index ${index}`;
+  if (w === null || typeof w !== "object") throw configError(`${at}: must be an object: ${path}`);
+  if (!isNonEmptyString2(w.scope)) throw configError(`${at}: scope must be a non-empty string: ${path}`);
+  const fromMin = parseHHMM(w.from, "from", at, path);
+  const toMin = parseHHMM(w.to, "to", at, path);
+  if (fromMin === toMin) {
+    throw configError(`${at}: from and to must differ (a 24h pause is not expressible; remove the trigger): ${path}`);
+  }
+  const tz = w.tz === void 0 ? "UTC" : validateTz(w.tz, at, path);
+  let days = null;
+  if (w.days !== void 0) {
+    if (!Array.isArray(w.days) || w.days.length === 0) {
+      throw configError(`${at}: days must be a non-empty array of weekday names (mon..sun): ${path}`);
+    }
+    days = w.days.map((d) => {
+      const key = String(d).trim().toLowerCase().slice(0, 3);
+      if (!DAY_SET.has(key)) throw configError(`${at}: unknown weekday ${JSON.stringify(d)} (use mon..sun): ${path}`);
+      return key;
+    });
+  }
+  let dateFrom = null;
+  let dateTo = null;
+  if (w.dateFrom !== void 0) {
+    assertDate(w.dateFrom, "dateFrom", at, path);
+    dateFrom = String(w.dateFrom).trim();
+  }
+  if (w.dateTo !== void 0) {
+    assertDate(w.dateTo, "dateTo", at, path);
+    dateTo = String(w.dateTo).trim();
+  }
+  if (dateFrom && dateTo && dateFrom > dateTo) throw configError(`${at}: dateFrom must be <= dateTo: ${path}`);
+  const norm = { scope: w.scope.trim(), from: w.from.trim(), to: w.to.trim(), fromMin, toMin, tz };
+  if (days) norm.days = days;
+  if (dateFrom) norm.dateFrom = dateFrom;
+  if (dateTo) norm.dateTo = dateTo;
+  return norm;
+}
+function zonedParts(tz, ms) {
+  const fmt2 = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    weekday: "short"
+  });
+  const p = {};
+  for (const part of fmt2.formatToParts(new Date(ms))) p[part.type] = part.value;
+  let hh = Number(p.hour);
+  if (hh === 24) hh = 0;
+  return { y: Number(p.year), mo: Number(p.month), d: Number(p.day), hh, mi: Number(p.minute), dow: WEEKDAY_INDEX[p.weekday] };
+}
+function wallToMs(tz, y, mo, d, hh, mi) {
+  const guess = Date.UTC(y, mo - 1, d, hh, mi);
+  const shown = zonedParts(tz, guess);
+  const shownAsUtc = Date.UTC(shown.y, shown.mo - 1, shown.d, shown.hh, shown.mi);
+  return guess - (shownAsUtc - guess);
+}
+function shiftDay(tz, parts, delta) {
+  const noon = wallToMs(tz, parts.y, parts.mo, parts.d, 12, 0);
+  return zonedParts(tz, noon + delta * 864e5);
+}
+function ymd(parts) {
+  return `${String(parts.y).padStart(4, "0")}-${String(parts.mo).padStart(2, "0")}-${String(parts.d).padStart(2, "0")}`;
+}
+function qualifies(w, parts) {
+  if (w.days && !w.days.includes(DAYS[parts.dow])) return false;
+  const date = ymd(parts);
+  if (w.dateFrom && date < w.dateFrom) return false;
+  if (w.dateTo && date > w.dateTo) return false;
+  return true;
+}
+function windowEndAt(w, nowMs) {
+  const p = zonedParts(w.tz, nowMs);
+  const nowMin = p.hh * 60 + p.mi;
+  const endAt = (dateParts) => wallToMs(w.tz, dateParts.y, dateParts.mo, dateParts.d, Math.floor(w.toMin / 60), w.toMin % 60);
+  if (w.fromMin < w.toMin) {
+    if (nowMin >= w.fromMin && nowMin < w.toMin && qualifies(w, p)) return endAt(p);
+    return null;
+  }
+  if (nowMin >= w.fromMin && qualifies(w, p)) return endAt(shiftDay(w.tz, p, 1));
+  if (nowMin < w.toMin && qualifies(w, shiftDay(w.tz, p, -1))) return endAt(p);
+  return null;
+}
+var DAYS, DAY_SET, WEEKDAY_INDEX;
+var init_pause_windows = __esm({
+  "../worker/src/pause-windows.mjs"() {
+    init_config2();
+    DAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+    DAY_SET = new Set(DAYS);
+    WEEKDAY_INDEX = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
+  }
+});
+
+// ../worker/src/scoped-limits.mjs
+import { createHash } from "node:crypto";
+import { isAbsolute, resolve } from "node:path";
+function isNonEmptyString3(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function parseScopedLimits(text, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw configError(`scoped-limits file is not valid JSON: ${path} (${error.message})`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw configError(`scoped-limits file must be an object with "version" and "limits": ${path}`);
+  }
+  const version = parsed.version;
+  if (!Number.isInteger(version) || version < 1) {
+    throw configError(`scoped-limits file must have "version": 1 (an integer >= 1): ${path}`);
+  }
+  if (version > SCOPED_LIMITS_VERSION) {
+    throw configError(`scoped-limits file written by a newer pi-dispatch (version ${version}; this build understands ${SCOPED_LIMITS_VERSION}): ${path}`);
+  }
+  if (!Array.isArray(parsed.limits)) {
+    throw configError(`scoped-limits file must have a "limits" array: ${path}`);
+  }
+  const rows = parsed.limits.map((row, index) => normalizeLimit(row, index, path));
+  const seen = /* @__PURE__ */ new Map();
+  rows.forEach((row, index) => {
+    if (seen.has(row.scope)) {
+      throw configError(`scoped limit at index ${index}: duplicate scope ${JSON.stringify(row.scope)} (first at index ${seen.get(row.scope)}): ${path}`);
+    }
+    seen.set(row.scope, index);
+  });
+  return rows;
+}
+function normalizeLimit(row, index, path) {
+  const at = `scoped limit at index ${index}`;
+  if (row === null || typeof row !== "object" || Array.isArray(row)) {
+    throw configError(`${at}: must be an object: ${path}`);
+  }
+  if (!isNonEmptyString3(row.scope)) throw configError(`${at}: scope must be a non-empty string: ${path}`);
+  const trimmed = row.scope.trim().normalize("NFC");
+  if (trimmed === "*") {
+    throw configError(`${at}: "*" is not supported -- add one row per scope (a per-scope default may adopt "*" later): ${path}`);
+  }
+  if (trimmed.includes("*")) {
+    throw configError(`${at}: scopes match exactly; a scope containing "*" is refused (no globs): ${path}`);
+  }
+  const norm = {
+    // An absolute path is stored resolved so a `/srv/site/` row governs `/srv/site` jobs -- the same
+    // collapse canonicalScope applies on the job side. isAbsolute is PLATFORM-NATIVE on purpose, so a
+    // foreign-platform row (a windows drive path on a POSIX worker) stays verbatim and is inert here;
+    // the doctor's unreferenced-scope advisory names it. Resolving it instead would "work" only by
+    // both sides mangling into the same cwd-prefixed string -- a match by accident, not by contract.
+    scope: isAbsolute(trimmed) ? resolve(trimmed) : trimmed,
+    day: null,
+    week: null,
+    month: null,
+    concurrent: null
+  };
+  let any = false;
+  for (const field of LIMIT_FIELDS) {
+    const value = row[field];
+    if (value === void 0 || value === null) continue;
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw configError(`${at}: ${field} must be an integer >= 1: ${path}`);
+    }
+    norm[field] = value;
+    any = true;
+  }
+  if (!any) {
+    throw configError(`${at}: at least one of day, week, month, concurrent is required (a row that limits nothing is a row an operator sets and then trusts): ${path}`);
+  }
+  return norm;
+}
+function scopeKeyPrefix(scope) {
+  const h = createHash("sha256").update(String(scope)).digest("hex").slice(0, 16);
+  return `budget:s:${h}`;
+}
+var SCOPED_LIMITS_VERSION, LIMIT_FIELDS;
+var init_scoped_limits = __esm({
+  "../worker/src/scoped-limits.mjs"() {
+    init_config2();
+    init_pause_windows();
+    SCOPED_LIMITS_VERSION = 1;
+    LIMIT_FIELDS = ["day", "week", "month", "concurrent"];
+  }
+});
+
+// ../worker/src/subscriptions.mjs
+function isNonEmptyString4(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function normalizeGlobs(value, label, at, path) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw configError(`${at}: ${label} must be a non-empty array of model globs: ${path}`);
+  }
+  return value.map((glob) => {
+    if (typeof glob !== "string" || !MODEL_GLOB_RE.test(glob.trim())) {
+      throw configError(`${at}: ${label} glob ${JSON.stringify(glob)} must match ${MODEL_GLOB_RE} (model-id charset plus "*", max 64 chars): ${path}`);
+    }
+    return glob.trim();
+  });
+}
+function normalizeBool(value, label, at, path, fallback) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "boolean") throw configError(`${at}: ${label} must be a boolean: ${path}`);
+  return value;
+}
+function parseSubscriptions(text, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw configError(`subscriptions file is not valid JSON: ${path} (${error.message})`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw configError(`subscriptions file must be a JSON object: ${path}`);
+  }
+  const version = parsed.version;
+  if (!Number.isInteger(version) || version < 1) {
+    throw configError(`subscriptions file must declare an integer "version" >= 1 (got ${JSON.stringify(version)}): ${path}`);
+  }
+  if (version > SUBSCRIPTIONS_VERSION) {
+    throw configError(`subscriptions file written by a newer pi-dispatch (version ${version}; this build understands ${SUBSCRIPTIONS_VERSION}): ${path}`);
+  }
+  const entries = parsed.subscriptions;
+  if (!Array.isArray(entries)) {
+    throw configError(`subscriptions file must have a "subscriptions" array: ${path}`);
+  }
+  const seenIds = /* @__PURE__ */ new Map();
+  return { version, subscriptions: entries.map((entry, index) => normalizeSubscription(entry, index, path, seenIds)) };
+}
+function normalizeSubscription(entry, index, path, seenIds) {
+  const at = `subscription at index ${index}`;
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+    throw configError(`${at}: must be an object: ${path}`);
+  }
+  if (!isNonEmptyString4(entry.id)) throw configError(`${at}: id must be a non-empty string: ${path}`);
+  const id = entry.id.trim();
+  if (seenIds.has(id)) {
+    throw configError(`${at}: id ${JSON.stringify(id)} is already used by the subscription at index ${seenIds.get(id)}: ${path}`);
+  }
+  seenIds.set(id, index);
+  if (!isNonEmptyString4(entry.vendor)) throw configError(`${at}: vendor must be a non-empty string: ${path}`);
+  if (!isNonEmptyString4(entry.provider)) throw configError(`${at}: provider must be a non-empty string (the pi-ai provider id this plan covers): ${path}`);
+  const models = entry.models === void 0 ? ["*"] : normalizeGlobs(entry.models, "models", at, path);
+  const price = entry.price;
+  if (price === null || typeof price !== "object" || Array.isArray(price)) {
+    throw configError(`${at}: price must be an object { amount, currency, per }: ${path}`);
+  }
+  if (typeof price.amount !== "number" || !Number.isFinite(price.amount) || price.amount <= 0) {
+    throw configError(`${at}: price.amount must be a number > 0: ${path}`);
+  }
+  if (typeof price.currency !== "string" || !/^[A-Z]{3}$/.test(price.currency)) {
+    throw configError(`${at}: price.currency must be a 3-letter uppercase code (e.g. "USD"): ${path}`);
+  }
+  if (price.per !== "month") {
+    throw configError(`${at}: price.per must be "month" (got ${JSON.stringify(price.per)}): ${path}`);
+  }
+  const sharedWithOtherProducts = normalizeBool(entry.sharedWithOtherProducts, "sharedWithOtherProducts", at, path, false);
+  const hypothetical = normalizeBool(entry.hypothetical, "hypothetical", at, path, false);
+  let counterfactualModel = null;
+  if (entry.counterfactualModel !== void 0 && entry.counterfactualModel !== null) {
+    const cm = entry.counterfactualModel;
+    if (typeof cm !== "object" || Array.isArray(cm) || !isNonEmptyString4(cm.provider) || !isNonEmptyString4(cm.id)) {
+      throw configError(`${at}: counterfactualModel must be { provider, id } with non-empty strings (a PRICED pi-ai model to re-price covered runs at API rates): ${path}`);
+    }
+    counterfactualModel = { provider: cm.provider.trim(), id: cm.id.trim() };
+  }
+  let windows = [];
+  if (entry.windows !== void 0) {
+    if (!Array.isArray(entry.windows)) throw configError(`${at}: windows must be an array: ${path}`);
+    windows = entry.windows.map((w, windowIndex) => normalizeWindow2(w, windowIndex, index, path));
+  }
+  return {
+    id,
+    vendor: entry.vendor.trim(),
+    provider: entry.provider.trim(),
+    models,
+    price: { amount: price.amount, currency: price.currency, per: "month" },
+    sharedWithOtherProducts,
+    hypothetical,
+    counterfactualModel,
+    windows
+  };
+}
+function normalizeWindow2(w, windowIndex, subIndex, path) {
+  const at = `window at index ${windowIndex} of subscription at index ${subIndex}`;
+  if (w === null || typeof w !== "object" || Array.isArray(w)) {
+    throw configError(`${at}: must be an object: ${path}`);
+  }
+  if (!WINDOW_PERS.has(w.per)) {
+    throw configError(`${at}: per must be one of 5h|7d|30d|month (got ${JSON.stringify(w.per)}): ${path}`);
+  }
+  const rolling = normalizeBool(w.rolling, "rolling", at, path, false);
+  let unit = null;
+  if (w.unit !== void 0 && w.unit !== null) {
+    if (!WINDOW_UNITS.has(w.unit)) {
+      throw configError(`${at}: unit must be one of tokens|requests|prompts|credits, or null (vendor undisclosed): ${path}`);
+    }
+    unit = w.unit;
+  }
+  let limit = null;
+  if (w.limit !== void 0 && w.limit !== null) {
+    if (typeof w.limit === "number") {
+      if (!Number.isFinite(w.limit) || w.limit <= 0) throw configError(`${at}: limit must be a number > 0, [min, max], or null (vendor undisclosed): ${path}`);
+      limit = w.limit;
+    } else if (Array.isArray(w.limit)) {
+      const [min, max] = w.limit;
+      if (w.limit.length !== 2 || typeof min !== "number" || typeof max !== "number" || !Number.isFinite(min) || !Number.isFinite(max) || min <= 0 || max <= 0 || min >= max) {
+        throw configError(`${at}: limit range must be [min, max] with both > 0 and min < max: ${path}`);
+      }
+      limit = [min, max];
+    } else {
+      throw configError(`${at}: limit must be a number > 0, [min, max], or null (vendor undisclosed): ${path}`);
+    }
+  }
+  const scope = w.scope === void 0 || w.scope === null ? null : normalizeGlobs(w.scope, "scope", at, path);
+  return { per: w.per, rolling, unit, limit, scope };
+}
+var SUBSCRIPTIONS_VERSION, WINDOW_PERS, WINDOW_UNITS, MODEL_GLOB_RE;
+var init_subscriptions = __esm({
+  "../worker/src/subscriptions.mjs"() {
+    init_config2();
+    SUBSCRIPTIONS_VERSION = 1;
+    WINDOW_PERS = /* @__PURE__ */ new Set(["5h", "7d", "30d", "month"]);
+    WINDOW_UNITS = /* @__PURE__ */ new Set(["tokens", "requests", "prompts", "credits"]);
+    MODEL_GLOB_RE = /^[A-Za-z0-9*._:/-]{1,64}$/;
+  }
+});
+
+// ../worker/src/connection.mjs
+import { Redis } from "ioredis";
+function parseConnection(url, { failFast = false } = {}) {
+  const u = new URL(url);
+  return {
+    host: u.hostname || "127.0.0.1",
+    port: Number(u.port || 6379),
+    ...u.password ? { password: u.password } : {},
+    ...u.username ? { username: u.username } : {},
+    ...u.pathname && u.pathname !== "/" ? { db: Number(u.pathname.slice(1)) } : {},
+    maxRetriesPerRequest: null,
+    // required for BullMQ blocking connections
+    ...failFast ? {
+      connectTimeout: 2e3,
+      enableOfflineQueue: false,
+      // don't buffer commands while disconnected -- error now
+      retryStrategy: (attempts) => attempts > 2 ? null : 200
+      // give up after ~2 tries
+    } : {}
+  };
+}
+function makeRedisClient(url) {
+  return new Redis(url, { maxRetriesPerRequest: null });
+}
+var init_connection = __esm({
+  "../worker/src/connection.mjs"() {
+  }
+});
+
+// ../worker/src/job-id.mjs
+import { createHash as createHash2 } from "node:crypto";
+function localJobId({ folder, flow, task, minute }) {
+  const digest = createHash2("sha256").update([folder, flow ?? "", task ?? "", minute].join("\0")).digest("hex");
+  return `local-${digest.slice(0, 16)}`;
+}
+var init_job_id = __esm({
+  "../worker/src/job-id.mjs"() {
+    init_config2();
+    init_forges();
+  }
+});
+
+// ../worker/src/flow-gate.mjs
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+async function readFlowGate({ folder, flow, sha, git = defaultGit }) {
+  if (typeof sha !== "string" || sha.trim() === "") return { gate: "deny" };
+  if (typeof flow !== "string" || !SKILL_NAME_RE.test(flow)) return { gate: "deny" };
+  const path = `.pi/skills/${flow}/SKILL.md`;
+  try {
+    const lsTreeZ = await git(folder, ["ls-tree", "-z", sha, path]);
+    const record = lsTreeZ.split("\0").find((r) => r);
+    if (!record) return { gate: "no-skill" };
+    const tab = record.indexOf("	");
+    if (tab === -1) return { gate: "deny" };
+    const [mode, type, oid] = record.slice(0, tab).split(/\s+/);
+    if (mode !== "100644" || type !== "blob") return { gate: "deny" };
+    const content = await git(folder, ["cat-file", "blob", oid], { raw: true });
+    return { gate: aiTriggerAllows(content) ? "allow" : "deny" };
+  } catch {
+    return { gate: "deny" };
+  }
+}
+function aiTriggerAllows(buf) {
+  const text = buf.toString("utf8").replace(/^\uFEFF/, "").replace(/\r\n/g, "\n");
+  const block = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(text);
+  if (!block) return false;
+  return /^ai-trigger:\s*("?)allow\1\s*$/m.test(block[1]);
+}
+async function defaultGit(gitDir, args, { raw = false } = {}) {
+  const hardened = ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "--no-pager", "-C", gitDir, ...args];
+  const { stdout } = await exec("git", hardened, {
+    encoding: raw ? "buffer" : "utf8",
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return stdout;
+}
+var exec, SKILL_NAME_RE;
+var init_flow_gate = __esm({
+  "../worker/src/flow-gate.mjs"() {
+    exec = promisify(execFile);
+    SKILL_NAME_RE = /^[a-z0-9](?:[a-z0-9_-]{0,62}[a-z0-9])?$/;
+  }
+});
+
 // ../worker/src/reserved-env.mjs
 var CONTAINER_ENV_NAMES;
 var init_reserved_env = __esm({
@@ -7910,7 +8366,7 @@ var init_reserved_env = __esm({
 });
 
 // ../worker/src/triggers.mjs
-function isNonEmptyString2(value) {
+function isNonEmptyString5(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function parseTriggers(text, path) {
@@ -7940,7 +8396,7 @@ function normalizeTrigger(entry, index, path, state) {
     throw configError(`${at}: "run" must be an object: ${path}`);
   }
   if (!ON_TYPES.has(on.type)) {
-    throw configError(`${at}: on.type must be one of cron|label|comment|pull_request (got ${JSON.stringify(on.type)}): ${path}`);
+    throw configError(`${at}: on.type must be one of ${[...ON_TYPES].join("|")} (got ${JSON.stringify(on.type)}): ${path}`);
   }
   if (!RUN_KINDS.includes(run.kind)) {
     throw configError(`${at}: run.kind must be one of ${RUN_KINDS.join("|")} (got ${JSON.stringify(run.kind)}): ${path}`);
@@ -7954,14 +8410,18 @@ function normalizeTrigger(entry, index, path, state) {
   if (!isForgeKind(run.kind)) {
     throw configError(`${at}: a ${on.type} trigger is webhook-driven and produces a forge job; run.kind must be one of ${FORGE_KINDS.join("|")} (got ${JSON.stringify(run.kind)}): ${path}`);
   }
-  if (on.type === "label") return normalizeLabel(on, run, index, path);
-  if (on.type === "comment") return normalizeComment(on, run, index, path, state);
-  return normalizePullRequest(on, run, index, path);
+  let normalized;
+  if (on.type === "label") normalized = normalizeLabel(on, run, index, path);
+  else if (on.type === "comment") normalized = normalizeComment(on, run, index, path, state);
+  else if (on.type === "issue") normalized = normalizeIssue(on, run, index, path);
+  else normalized = normalizePullRequest(on, run, index, path);
+  if (on.disarmed !== void 0) return { on: { type: DISARMED_TYPE }, run: {} };
+  return normalized;
 }
 function normalizeCron(on, run, index, path, state) {
   const at = `trigger at index ${index}`;
   const id = on.id;
-  if (!isNonEmptyString2(id)) {
+  if (!isNonEmptyString5(id)) {
     throw configError(`${at}: cron on.id must be a non-empty string: ${path}`);
   }
   if (id.includes(":")) {
@@ -7975,7 +8435,7 @@ function normalizeCron(on, run, index, path, state) {
   }
   state.seenCronIds.add(id);
   const pattern = on.pattern;
-  if (!isNonEmptyString2(pattern)) {
+  if (!isNonEmptyString5(pattern)) {
     throw configError(`cron trigger "${id}": on.pattern must be a non-empty string: ${path}`);
   }
   const fieldCount = pattern.trim().split(/\s+/).length;
@@ -7983,13 +8443,13 @@ function normalizeCron(on, run, index, path, state) {
     throw configError(`cron trigger "${id}": on.pattern must have 5 or 6 space-separated fields, got ${fieldCount}: ${path}`);
   }
   const command = validateCommand(run, `cron trigger "${id}"`, path, { onType: "cron" });
-  if (!isNonEmptyString2(run.folder)) {
+  if (!isNonEmptyString5(run.folder)) {
     throw configError(`cron trigger "${id}": run.folder must be a non-empty string: ${path}`);
   }
-  if (command === void 0 && !isNonEmptyString2(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`cron trigger "${id}": run.flow must be a non-empty string (or use run.command): ${path}`);
   }
-  if (command === void 0 && !isNonEmptyString2(run.task)) {
+  if (command === void 0 && !isNonEmptyString5(run.task)) {
     throw configError(`cron trigger "${id}": run.task must be a non-empty string: ${path}`);
   }
   if (run.github !== void 0 && typeof run.github !== "boolean") {
@@ -8001,6 +8461,9 @@ function normalizeCron(on, run, index, path, state) {
   validateInstructions(run, `cron trigger "${id}"`, path, { cron: true });
   const resume = validateResumeFlag(run, `cron trigger "${id}"`, path);
   validateReplicas(run, `cron trigger "${id}"`, path);
+  validateNumber(on, `cron trigger "${id}"`, path, { onType: "cron" });
+  validateOnce(on, run, `cron trigger "${id}"`, path, { onType: "cron" });
+  validateDisarmed(on, `cron trigger "${id}"`, path, { onType: "cron" });
   const secrets = validateSecrets(run, `cron trigger "${id}"`, path);
   const secretsProfile = validateSecretsProfile(run, `cron trigger "${id}"`, path);
   return {
@@ -8070,7 +8533,7 @@ function validateCommand(run, at, path, { onType }) {
     throw configError(`${at}: exactly one of run.flow or run.command must be set -- a trigger dispatches either a flow or a registered command, and with both present the file does not say which one runs: ${path}`);
   }
   if (raw === void 0) return void 0;
-  if (!isNonEmptyString2(raw)) {
+  if (!isNonEmptyString5(raw)) {
     throw configError(`${at}: run.command must be a non-empty string -- the registered command name, optionally followed by its arguments: ${path}`);
   }
   if (raw !== raw.trim()) {
@@ -8107,6 +8570,72 @@ function validatePredicate(on, index, path, requirePositive) {
   }
   return { any: on.any, all: on.all, none: on.none };
 }
+function validateNumber(on, at, path, { capable = false, onType } = {}) {
+  const number = on.number;
+  if (number === void 0) return void 0;
+  if (!capable) {
+    if (onType === "cron") {
+      throw configError(`${at}: on.number is not available on a cron trigger -- a schedule fires on time, not on an item, so there is no delivery for a number to narrow: ${path}`);
+    }
+    throw configError(`${at}: on.number is not yet covered for ${onType} triggers here -- only the close routes read it, so on a rule they never serve it would sit in the file looking configured; narrowing labels, comments or non-close pull_request rules is a gap to close, not a limit: ${path}`);
+  }
+  if (!Number.isInteger(number) || number < 1) {
+    throw configError(`${at}: on.number must be an integer >= 1 when present -- the item number the forge itself assigns (on GitLab, the iid) (got ${JSON.stringify(number)}): ${path}`);
+  }
+  return number;
+}
+function validateOnce(on, run, at, path, { capable = false, onType } = {}) {
+  const once = on.once;
+  if (once === void 0) return void 0;
+  if (!capable) {
+    if (onType === "cron") {
+      throw configError(`${at}: on.once is not available on a cron trigger -- a one-shot that can re-arm is a schedule, and a cron job carries no matched delivery for the disarm to name; delete the entry when the work is done: ${path}`);
+    }
+    const closeWords = Object.entries(PR_CLOSE_ACTIONS).map(([k, w]) => `${k} has ${JSON.stringify(w)}`).join(", ");
+    throw configError(`${at}: on.once is not yet covered here -- the disarm writes back to the one entry a delivery matched, and only a close delivery names the single item that spends it; use on.type "issue", or a pull_request rule whose only action is the close word (${closeWords}; azure has no close trigger yet): ${path}`);
+  }
+  if (typeof once !== "boolean") {
+    throw configError(`${at}: on.once must be true or false when present -- a truthy string arming a one-shot is exactly the drift this validator exists to refuse (got ${JSON.stringify(once)}): ${path}`);
+  }
+  if (once === true && on.number === void 0) {
+    throw configError(`${at}: on.once requires on.number -- a one-shot without a named item is spent by whichever close arrives first, and two different items closing inside one dedup window would race for it; the number is also the identity the disarm re-checks before it writes: ${path}`);
+  }
+  if (once === true && run.replicas !== void 0) {
+    throw configError(`${at}: on.once and run.replicas cannot be combined -- "exactly one run" and "N sandboxes race" contradict, and with N run records the disarm no longer says which one spent the trigger: ${path}`);
+  }
+  return once;
+}
+function validateDisarmed(on, at, path, { capable = false, onType } = {}) {
+  const disarmed = on.disarmed;
+  if (disarmed === void 0) return void 0;
+  if (!capable) {
+    throw configError(`${at}: on.disarmed marks a spent one-shot, and on.once is not ${onType === "cron" ? "available on a cron trigger" : "yet covered here"}, so there is nothing this entry could have spent: ${path}`);
+  }
+  if (disarmed === null || typeof disarmed !== "object" || Array.isArray(disarmed)) {
+    throw configError(`${at}: on.disarmed must be an object with a non-empty string "at" (and optionally a non-empty string "jobId") -- the worker writes it when the one-shot fires, and a hand-written one disarms the entry deliberately (got ${JSON.stringify(disarmed)}): ${path}`);
+  }
+  for (const key of Object.keys(disarmed)) {
+    if (key !== "at" && key !== "jobId") {
+      throw configError(`${at}: on.disarmed has an unsupported key ${JSON.stringify(key)} (expected at|jobId): ${path}`);
+    }
+  }
+  if (!isNonEmptyString5(disarmed.at)) {
+    throw configError(`${at}: on.disarmed.at must be a non-empty string (the time the one-shot fired): ${path}`);
+  }
+  if (disarmed.jobId !== void 0 && !isNonEmptyString5(disarmed.jobId)) {
+    throw configError(`${at}: on.disarmed.jobId must be a non-empty string when present (the run record it joins to): ${path}`);
+  }
+  if (on.once !== true) {
+    throw configError(`${at}: on.disarmed is only meaningful beside on.once: true -- an entry that was never a one-shot has nothing to spend: ${path}`);
+  }
+  return disarmed;
+}
+function validateFlowName(run, at, path) {
+  if (run.flow === void 0) return;
+  if (!SKILL_NAME_RE.test(run.flow)) {
+    throw configError(`${at}: run.flow ${JSON.stringify(run.flow)} fails the skill-name charset (lowercase letters, digits, dash and underscore, 1-64 chars, starting and ending alphanumeric) -- a name outside it can never materialise, so this trigger could only ever fail after the budget slot was reserved: ${path}`);
+  }
+}
 function validateRepository(run, onType, at, path) {
   const needed = run.kind === "azure" && (onType === "label" || onType === "comment");
   const raw = run.repository;
@@ -8117,7 +8646,7 @@ function validateRepository(run, onType, at, path) {
   if (!needed) {
     throw configError(`${at}: run.repository is only meaningful on an azure label or comment trigger (a pull request names its own repository): ${path}`);
   }
-  if (!isNonEmptyString2(raw) || raw !== raw.trim() || raw.includes("/")) {
+  if (!isNonEmptyString5(raw) || raw !== raw.trim() || raw.includes("/")) {
     throw configError(`${at}: run.repository must be a non-empty repository NAME within the project, with no slashes and no surrounding whitespace (got ${JSON.stringify(raw)}): ${path}`);
   }
   return raw;
@@ -8157,7 +8686,7 @@ function validateSecrets(run, at, path) {
       throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is a variable the worker sets itself -- the job container would receive the worker's value, not this trigger's, and the trigger would look like it worked: ${path}`);
     }
     const reference = secrets[name];
-    if (!isNonEmptyString2(reference)) {
+    if (!isNonEmptyString5(reference)) {
       throw configError(`${at}: run.secrets.${name} must be a non-empty string reference for your resolver to read (got ${JSON.stringify(reference)}): ${path}`);
     }
     if (reference !== reference.trim()) {
@@ -8175,7 +8704,7 @@ function validateSecrets(run, at, path) {
 function validateSecretsProfile(run, at, path) {
   const profile = run.secretsProfile;
   if (profile === void 0) return void 0;
-  if (!isNonEmptyString2(profile)) {
+  if (!isNonEmptyString5(profile)) {
     throw configError(`${at}: run.secretsProfile must be a non-empty string naming one of the resolver profiles this deployment declares (got ${JSON.stringify(profile)}): ${path}`);
   }
   if (!ID_CHARSET.test(profile)) {
@@ -8189,10 +8718,14 @@ function validateSecretsProfile(run, at, path) {
 function normalizeLabel(on, run, index, path) {
   const at = `trigger at index ${index}`;
   const predicate = validatePredicate(on, index, path, true);
+  validateNumber(on, at, path, { onType: "label" });
+  validateOnce(on, run, at, path, { onType: "label" });
+  validateDisarmed(on, at, path, { onType: "label" });
   const command = validateCommand(run, at, path, { onType: "label" });
-  if (command === void 0 && !isNonEmptyString2(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: label trigger run.flow must be a non-empty string (or use run.command): ${path}`);
   }
+  validateFlowName(run, at, path);
   const packages = validatePackagesFlag(run, at, path);
   const image = validateImageRef(run, at, path);
   const skillsDir = validateSkillsDir(run, at, path);
@@ -8209,13 +8742,17 @@ function normalizeLabel(on, run, index, path) {
 }
 function normalizeComment(on, run, index, path, state) {
   const at = `trigger at index ${index}`;
-  if (!isNonEmptyString2(on.phrase)) {
+  if (!isNonEmptyString5(on.phrase)) {
     throw configError(`${at}: comment trigger on.phrase must be a non-empty string: ${path}`);
   }
+  validateNumber(on, at, path, { onType: "comment" });
+  validateOnce(on, run, at, path, { onType: "comment" });
+  validateDisarmed(on, at, path, { onType: "comment" });
   const command = validateCommand(run, at, path, { onType: "comment" });
-  if (command === void 0 && !isNonEmptyString2(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: comment trigger run.flow (the default flow) must be a non-empty string (or use run.command): ${path}`);
   }
+  validateFlowName(run, at, path);
   state.commentCounts[run.kind] = (state.commentCounts[run.kind] ?? 0) + 1;
   if (state.commentCounts[run.kind] > 1) {
     throw configError(`${at}: at most one ${run.kind} comment trigger is allowed: ${path}`);
@@ -8234,6 +8771,54 @@ function normalizeComment(on, run, index, path, state) {
     run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
 }
+function normalizeIssue(on, run, index, path) {
+  const at = `trigger at index ${index}`;
+  if (run.kind === "azure") {
+    throw configError(`${at}: an issue trigger is not yet covered for azure -- a work item's close is a System.State transition whose terminal names vary by process template (Agile "Closed", Scrum "Done"), and the projected subset carries only System.Tags, so nothing in the delivery says the item closed; widening the payload subset is the gap to close, not a limit: ${path}`);
+  }
+  const actions = on.action;
+  if (!Array.isArray(actions) || actions.length === 0) {
+    throw configError(`${at}: issue on.action must be a non-empty array: ${path}`);
+  }
+  const allowed = ISSUE_ACTIONS[run.kind];
+  const expected = [...allowed].join("|");
+  for (const a of actions) {
+    if (!allowed.has(a)) {
+      throw configError(`${at}: issue on.action has an unsupported ${run.kind} action ${JSON.stringify(a)} (expected ${expected}): ${path}`);
+    }
+  }
+  if (on.any !== void 0 || on.all !== void 0 || on.none !== void 0) {
+    throw configError(`${at}: an issue trigger cannot carry a label predicate -- it fires on a lifecycle action, not a label diff, so any/all/none could never match; a label-predicated rule is on.type "label": ${path}`);
+  }
+  const number = validateNumber(on, at, path, { capable: true, onType: "issue" });
+  const once = validateOnce(on, run, at, path, { capable: true, onType: "issue" });
+  validateDisarmed(on, at, path, { capable: true, onType: "issue" });
+  const command = validateCommand(run, at, path, { onType: "issue" });
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
+    throw configError(`${at}: issue trigger run.flow must be a non-empty string (or use run.command): ${path}`);
+  }
+  validateFlowName(run, at, path);
+  const packages = validatePackagesFlag(run, at, path);
+  const image = validateImageRef(run, at, path);
+  const skillsDir = validateSkillsDir(run, at, path);
+  const instructions = validateInstructions(run, at, path);
+  const resume = validateResumeFlag(run, at, path);
+  validateRepository(run, "issue", at, path);
+  const replicas = validateReplicas(run, at, path);
+  const secrets = validateSecrets(run, at, path);
+  const secretsProfile = validateSecretsProfile(run, at, path);
+  return {
+    on: {
+      type: "issue",
+      action: [...actions],
+      // Absent rather than present-and-undefined, reviewState's rule below: an unnarrowed rule's
+      // normalized shape must not grow keys.
+      ...number !== void 0 && { number },
+      ...once !== void 0 && { once }
+    },
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+  };
+}
 function normalizePullRequest(on, run, index, path) {
   const at = `trigger at index ${index}`;
   const actions = on.action;
@@ -8247,17 +8832,29 @@ function normalizePullRequest(on, run, index, path) {
       throw configError(`${at}: pull_request on.action has an unsupported ${run.kind} action ${JSON.stringify(a)} (expected ${expected}): ${path}`);
     }
   }
+  const closeWord = PR_CLOSE_ACTIONS[run.kind];
+  const isClose = closeWord !== void 0 && actions.includes(closeWord);
+  if (isClose && actions.some((a) => a !== closeWord)) {
+    throw configError(`${at}: pull_request on.action cannot mix ${JSON.stringify(closeWord)} with other actions -- a close rule is gated on the closer's write access and every other action on the author's, and one rule cannot gate on two different actors; split it into two entries: ${path}`);
+  }
   const reviewState = validateReviewState(on, actions, run, at, path);
   const labelAction = forgeSpec(run.kind)?.prLabelAction;
   const requirePositive = typeof labelAction === "string" && actions.includes(labelAction);
   if (run.kind === "azure" && (on.any !== void 0 || on.all !== void 0 || on.none !== void 0)) {
     throw configError(`${at}: an azure pull_request trigger cannot carry a label predicate -- Azure DevOps attaches tags to work items, never to pull requests, so any/all/none could never match: ${path}`);
   }
+  if (isClose && (on.any !== void 0 || on.all !== void 0 || on.none !== void 0)) {
+    throw configError(`${at}: a close pull_request rule cannot carry a label predicate -- the close route matches the action and on.number alone, so any/all/none would sit in the file looking configured and never match anything: ${path}`);
+  }
   const predicate = validatePredicate(on, index, path, requirePositive);
+  const number = validateNumber(on, at, path, { capable: isClose, onType: "pull_request" });
+  const once = validateOnce(on, run, at, path, { capable: isClose, onType: "pull_request" });
+  validateDisarmed(on, at, path, { capable: isClose, onType: "pull_request" });
   const command = validateCommand(run, at, path, { onType: "pull_request" });
-  if (command === void 0 && !isNonEmptyString2(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: pull_request trigger run.flow must be a non-empty string (or use run.command): ${path}`);
   }
+  validateFlowName(run, at, path);
   const packages = validatePackagesFlag(run, at, path);
   const image = validateImageRef(run, at, path);
   const skillsDir = validateSkillsDir(run, at, path);
@@ -8276,7 +8873,10 @@ function normalizePullRequest(on, run, index, path) {
       ...reviewState !== void 0 && { reviewState },
       any: predicate.any,
       all: predicate.all,
-      none: predicate.none
+      none: predicate.none,
+      // Same rule for the close-narrowing pair (issue #231): only a close-only rule can carry them.
+      ...number !== void 0 && { number },
+      ...once !== void 0 && { once }
     },
     run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
@@ -8300,30 +8900,41 @@ function validateReviewState(on, actions, run, at, path) {
   }
   return [...on.reviewState];
 }
-var ON_TYPES, PR_ACTIONS, REVIEW_STATES, REVIEW_ACTION, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX;
+var ON_TYPES, DISARMED_TYPE, PR_ACTIONS, PR_CLOSE_ACTIONS, ISSUE_ACTIONS, REVIEW_STATES, REVIEW_ACTION, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX;
 var init_triggers = __esm({
   "../worker/src/triggers.mjs"() {
     init_config2();
+    init_flow_gate();
     init_forges();
     init_reserved_env();
-    ON_TYPES = /* @__PURE__ */ new Set(["cron", "label", "comment", "pull_request"]);
+    ON_TYPES = /* @__PURE__ */ new Set(["cron", "label", "comment", "pull_request", "issue"]);
+    DISARMED_TYPE = "disarmed";
     PR_ACTIONS = {
-      github: /* @__PURE__ */ new Set(["labeled", "opened", "synchronize", "reopened", "review_submitted"]),
+      github: /* @__PURE__ */ new Set(["labeled", "opened", "synchronize", "reopened", "review_submitted", "closed"]),
       // GitLab's `approved` is its review gate (a member approved the MR). It is NOT github's
       // `review_submitted` renamed: `approved` is one verdict, `review_submitted` is every verdict, which is
-      // what `on.reviewState` below exists to narrow.
-      gitlab: /* @__PURE__ */ new Set(["open", "update", "reopen", "approved"]),
+      // what `on.reviewState` below exists to narrow. `close` is GitLab's own spelling of the close action.
+      gitlab: /* @__PURE__ */ new Set(["open", "update", "reopen", "approved", "close"]),
       // Forgejo's own spellings. `label_updated` is its `labeled` and `synchronized` its `synchronize` -- a
       // one-letter difference that an operator would otherwise discover as a trigger that loads clean and
       // never fires. `label_cleared` is deliberately ABSENT and always will be: REMOVING a label must never
       // start a paid run, and it has no GitHub counterpart to inherit that rule from.
-      forgejo: /* @__PURE__ */ new Set(["label_updated", "opened", "synchronized", "reopened"]),
+      forgejo: /* @__PURE__ */ new Set(["label_updated", "opened", "synchronized", "reopened", "closed"]),
       // Azure's Service Hook events reduced to the two that leave something to act on. `git.pullrequest.merged`
-      // is omitted for the same reason GitLab's `merge` and `close` are: a job started by a merge has nothing
-      // left to do. There is no label action at all -- Azure attaches tags to WORK ITEMS, never to pull
-      // requests -- which is why azure's `prLabelAction` is null and a predicated PR rule is refused below.
+      // is omitted for the reason the close words' own comment above records, and there is no close word here at
+      // all: an abandon arrives as `git.pullrequest.updated` with nothing in the projected subset to tell it from
+      // any other update, so an azure close rule could only ever fire on the wrong events or never. Widening
+      // INT-AZURE-PAYLOAD-SUBSET (a PR status field) is the gap to close before this set can grow. There is no
+      // label action either -- Azure attaches tags to WORK ITEMS, never to pull requests -- which is why azure's
+      // `prLabelAction` is null and a predicated PR rule is refused below.
       azure: /* @__PURE__ */ new Set(["created", "updated"])
     };
+    PR_CLOSE_ACTIONS = { github: "closed", gitlab: "close", forgejo: "closed" };
+    ISSUE_ACTIONS = {
+      github: /* @__PURE__ */ new Set(["closed"]),
+      gitlab: /* @__PURE__ */ new Set(["close"]),
+      forgejo: /* @__PURE__ */ new Set(["closed"])
+    };
     REVIEW_STATES = /* @__PURE__ */ new Set(["approved", "changes_requested", "commented"]);
     REVIEW_ACTION = "review_submitted";
     ID_CHARSET = /^[A-Za-z0-9._-]+$/;
@@ -8335,329 +8946,6 @@ var init_triggers = __esm({
   }
 });
 
-// ../worker/src/pause-windows.mjs
-function isNonEmptyString3(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-function parseHHMM(value, label, at, path) {
-  const m = isNonEmptyString3(value) ? /^([0-9]{1,2}):([0-9]{2})$/.exec(value.trim()) : null;
-  if (!m) throw configError(`${at}: ${label} must be "HH:MM": ${JSON.stringify(value)} (${path})`);
-  const h = Number(m[1]);
-  const min = Number(m[2]);
-  if (h > 23 || min > 59) throw configError(`${at}: ${label} out of range 00:00-23:59: ${JSON.stringify(value)} (${path})`);
-  return h * 60 + min;
-}
-function assertDate(value, label, at, path) {
-  const m = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(String(value).trim());
-  const mo = m && Number(m[2]);
-  const d = m && Number(m[3]);
-  if (!m || mo < 1 || mo > 12 || d < 1 || d > 31) {
-    throw configError(`${at}: ${label} must be "YYYY-MM-DD": ${JSON.stringify(value)} (${path})`);
-  }
-}
-function validateTz(tz, at, path) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return tz;
-  } catch {
-    throw configError(`${at}: tz is not a valid IANA timezone: ${JSON.stringify(tz)} (${path})`);
-  }
-}
-function parsePauseWindows(text, path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (error) {
-    throw configError(`pause-windows file is not valid JSON: ${path} (${error.message})`);
-  }
-  const windows = parsed?.windows;
-  if (!Array.isArray(windows)) {
-    throw configError(`pause-windows file must have a "windows" array: ${path}`);
-  }
-  return windows.map((w, index) => normalizeWindow(w, index, path));
-}
-function normalizeWindow(w, index, path) {
-  const at = `pause window at index ${index}`;
-  if (w === null || typeof w !== "object") throw configError(`${at}: must be an object: ${path}`);
-  if (!isNonEmptyString3(w.scope)) throw configError(`${at}: scope must be a non-empty string: ${path}`);
-  const fromMin = parseHHMM(w.from, "from", at, path);
-  const toMin = parseHHMM(w.to, "to", at, path);
-  if (fromMin === toMin) {
-    throw configError(`${at}: from and to must differ (a 24h pause is not expressible; remove the trigger): ${path}`);
-  }
-  const tz = w.tz === void 0 ? "UTC" : validateTz(w.tz, at, path);
-  let days = null;
-  if (w.days !== void 0) {
-    if (!Array.isArray(w.days) || w.days.length === 0) {
-      throw configError(`${at}: days must be a non-empty array of weekday names (mon..sun): ${path}`);
-    }
-    days = w.days.map((d) => {
-      const key = String(d).trim().toLowerCase().slice(0, 3);
-      if (!DAY_SET.has(key)) throw configError(`${at}: unknown weekday ${JSON.stringify(d)} (use mon..sun): ${path}`);
-      return key;
-    });
-  }
-  let dateFrom = null;
-  let dateTo = null;
-  if (w.dateFrom !== void 0) {
-    assertDate(w.dateFrom, "dateFrom", at, path);
-    dateFrom = String(w.dateFrom).trim();
-  }
-  if (w.dateTo !== void 0) {
-    assertDate(w.dateTo, "dateTo", at, path);
-    dateTo = String(w.dateTo).trim();
-  }
-  if (dateFrom && dateTo && dateFrom > dateTo) throw configError(`${at}: dateFrom must be <= dateTo: ${path}`);
-  const norm = { scope: w.scope.trim(), from: w.from.trim(), to: w.to.trim(), fromMin, toMin, tz };
-  if (days) norm.days = days;
-  if (dateFrom) norm.dateFrom = dateFrom;
-  if (dateTo) norm.dateTo = dateTo;
-  return norm;
-}
-function zonedParts(tz, ms) {
-  const fmt2 = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    hour12: false,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    weekday: "short"
-  });
-  const p = {};
-  for (const part of fmt2.formatToParts(new Date(ms))) p[part.type] = part.value;
-  let hh = Number(p.hour);
-  if (hh === 24) hh = 0;
-  return { y: Number(p.year), mo: Number(p.month), d: Number(p.day), hh, mi: Number(p.minute), dow: WEEKDAY_INDEX[p.weekday] };
-}
-function wallToMs(tz, y, mo, d, hh, mi) {
-  const guess = Date.UTC(y, mo - 1, d, hh, mi);
-  const shown = zonedParts(tz, guess);
-  const shownAsUtc = Date.UTC(shown.y, shown.mo - 1, shown.d, shown.hh, shown.mi);
-  return guess - (shownAsUtc - guess);
-}
-function shiftDay(tz, parts, delta) {
-  const noon = wallToMs(tz, parts.y, parts.mo, parts.d, 12, 0);
-  return zonedParts(tz, noon + delta * 864e5);
-}
-function ymd(parts) {
-  return `${String(parts.y).padStart(4, "0")}-${String(parts.mo).padStart(2, "0")}-${String(parts.d).padStart(2, "0")}`;
-}
-function qualifies(w, parts) {
-  if (w.days && !w.days.includes(DAYS[parts.dow])) return false;
-  const date = ymd(parts);
-  if (w.dateFrom && date < w.dateFrom) return false;
-  if (w.dateTo && date > w.dateTo) return false;
-  return true;
-}
-function windowEndAt(w, nowMs) {
-  const p = zonedParts(w.tz, nowMs);
-  const nowMin = p.hh * 60 + p.mi;
-  const endAt = (dateParts) => wallToMs(w.tz, dateParts.y, dateParts.mo, dateParts.d, Math.floor(w.toMin / 60), w.toMin % 60);
-  if (w.fromMin < w.toMin) {
-    if (nowMin >= w.fromMin && nowMin < w.toMin && qualifies(w, p)) return endAt(p);
-    return null;
-  }
-  if (nowMin >= w.fromMin && qualifies(w, p)) return endAt(shiftDay(w.tz, p, 1));
-  if (nowMin < w.toMin && qualifies(w, shiftDay(w.tz, p, -1))) return endAt(p);
-  return null;
-}
-var DAYS, DAY_SET, WEEKDAY_INDEX;
-var init_pause_windows = __esm({
-  "../worker/src/pause-windows.mjs"() {
-    init_config2();
-    DAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
-    DAY_SET = new Set(DAYS);
-    WEEKDAY_INDEX = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
-  }
-});
-
-// ../worker/src/subscriptions.mjs
-function isNonEmptyString4(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-function normalizeGlobs(value, label, at, path) {
-  if (!Array.isArray(value) || value.length === 0) {
-    throw configError(`${at}: ${label} must be a non-empty array of model globs: ${path}`);
-  }
-  return value.map((glob) => {
-    if (typeof glob !== "string" || !MODEL_GLOB_RE.test(glob.trim())) {
-      throw configError(`${at}: ${label} glob ${JSON.stringify(glob)} must match ${MODEL_GLOB_RE} (model-id charset plus "*", max 64 chars): ${path}`);
-    }
-    return glob.trim();
-  });
-}
-function normalizeBool(value, label, at, path, fallback) {
-  if (value === void 0) return fallback;
-  if (typeof value !== "boolean") throw configError(`${at}: ${label} must be a boolean: ${path}`);
-  return value;
-}
-function parseSubscriptions(text, path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (error) {
-    throw configError(`subscriptions file is not valid JSON: ${path} (${error.message})`);
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw configError(`subscriptions file must be a JSON object: ${path}`);
-  }
-  const version = parsed.version;
-  if (!Number.isInteger(version) || version < 1) {
-    throw configError(`subscriptions file must declare an integer "version" >= 1 (got ${JSON.stringify(version)}): ${path}`);
-  }
-  if (version > SUBSCRIPTIONS_VERSION) {
-    throw configError(`subscriptions file written by a newer pi-dispatch (version ${version}; this build understands ${SUBSCRIPTIONS_VERSION}): ${path}`);
-  }
-  const entries = parsed.subscriptions;
-  if (!Array.isArray(entries)) {
-    throw configError(`subscriptions file must have a "subscriptions" array: ${path}`);
-  }
-  const seenIds = /* @__PURE__ */ new Map();
-  return { version, subscriptions: entries.map((entry, index) => normalizeSubscription(entry, index, path, seenIds)) };
-}
-function normalizeSubscription(entry, index, path, seenIds) {
-  const at = `subscription at index ${index}`;
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
-    throw configError(`${at}: must be an object: ${path}`);
-  }
-  if (!isNonEmptyString4(entry.id)) throw configError(`${at}: id must be a non-empty string: ${path}`);
-  const id = entry.id.trim();
-  if (seenIds.has(id)) {
-    throw configError(`${at}: id ${JSON.stringify(id)} is already used by the subscription at index ${seenIds.get(id)}: ${path}`);
-  }
-  seenIds.set(id, index);
-  if (!isNonEmptyString4(entry.vendor)) throw configError(`${at}: vendor must be a non-empty string: ${path}`);
-  if (!isNonEmptyString4(entry.provider)) throw configError(`${at}: provider must be a non-empty string (the pi-ai provider id this plan covers): ${path}`);
-  const models = entry.models === void 0 ? ["*"] : normalizeGlobs(entry.models, "models", at, path);
-  const price = entry.price;
-  if (price === null || typeof price !== "object" || Array.isArray(price)) {
-    throw configError(`${at}: price must be an object { amount, currency, per }: ${path}`);
-  }
-  if (typeof price.amount !== "number" || !Number.isFinite(price.amount) || price.amount <= 0) {
-    throw configError(`${at}: price.amount must be a number > 0: ${path}`);
-  }
-  if (typeof price.currency !== "string" || !/^[A-Z]{3}$/.test(price.currency)) {
-    throw configError(`${at}: price.currency must be a 3-letter uppercase code (e.g. "USD"): ${path}`);
-  }
-  if (price.per !== "month") {
-    throw configError(`${at}: price.per must be "month" (got ${JSON.stringify(price.per)}): ${path}`);
-  }
-  const sharedWithOtherProducts = normalizeBool(entry.sharedWithOtherProducts, "sharedWithOtherProducts", at, path, false);
-  const hypothetical = normalizeBool(entry.hypothetical, "hypothetical", at, path, false);
-  let counterfactualModel = null;
-  if (entry.counterfactualModel !== void 0 && entry.counterfactualModel !== null) {
-    const cm = entry.counterfactualModel;
-    if (typeof cm !== "object" || Array.isArray(cm) || !isNonEmptyString4(cm.provider) || !isNonEmptyString4(cm.id)) {
-      throw configError(`${at}: counterfactualModel must be { provider, id } with non-empty strings (a PRICED pi-ai model to re-price covered runs at API rates): ${path}`);
-    }
-    counterfactualModel = { provider: cm.provider.trim(), id: cm.id.trim() };
-  }
-  let windows = [];
-  if (entry.windows !== void 0) {
-    if (!Array.isArray(entry.windows)) throw configError(`${at}: windows must be an array: ${path}`);
-    windows = entry.windows.map((w, windowIndex) => normalizeWindow2(w, windowIndex, index, path));
-  }
-  return {
-    id,
-    vendor: entry.vendor.trim(),
-    provider: entry.provider.trim(),
-    models,
-    price: { amount: price.amount, currency: price.currency, per: "month" },
-    sharedWithOtherProducts,
-    hypothetical,
-    counterfactualModel,
-    windows
-  };
-}
-function normalizeWindow2(w, windowIndex, subIndex, path) {
-  const at = `window at index ${windowIndex} of subscription at index ${subIndex}`;
-  if (w === null || typeof w !== "object" || Array.isArray(w)) {
-    throw configError(`${at}: must be an object: ${path}`);
-  }
-  if (!WINDOW_PERS.has(w.per)) {
-    throw configError(`${at}: per must be one of 5h|7d|30d|month (got ${JSON.stringify(w.per)}): ${path}`);
-  }
-  const rolling = normalizeBool(w.rolling, "rolling", at, path, false);
-  let unit = null;
-  if (w.unit !== void 0 && w.unit !== null) {
-    if (!WINDOW_UNITS.has(w.unit)) {
-      throw configError(`${at}: unit must be one of tokens|requests|prompts|credits, or null (vendor undisclosed): ${path}`);
-    }
-    unit = w.unit;
-  }
-  let limit = null;
-  if (w.limit !== void 0 && w.limit !== null) {
-    if (typeof w.limit === "number") {
-      if (!Number.isFinite(w.limit) || w.limit <= 0) throw configError(`${at}: limit must be a number > 0, [min, max], or null (vendor undisclosed): ${path}`);
-      limit = w.limit;
-    } else if (Array.isArray(w.limit)) {
-      const [min, max] = w.limit;
-      if (w.limit.length !== 2 || typeof min !== "number" || typeof max !== "number" || !Number.isFinite(min) || !Number.isFinite(max) || min <= 0 || max <= 0 || min >= max) {
-        throw configError(`${at}: limit range must be [min, max] with both > 0 and min < max: ${path}`);
-      }
-      limit = [min, max];
-    } else {
-      throw configError(`${at}: limit must be a number > 0, [min, max], or null (vendor undisclosed): ${path}`);
-    }
-  }
-  const scope = w.scope === void 0 || w.scope === null ? null : normalizeGlobs(w.scope, "scope", at, path);
-  return { per: w.per, rolling, unit, limit, scope };
-}
-var SUBSCRIPTIONS_VERSION, WINDOW_PERS, WINDOW_UNITS, MODEL_GLOB_RE;
-var init_subscriptions = __esm({
-  "../worker/src/subscriptions.mjs"() {
-    init_config2();
-    SUBSCRIPTIONS_VERSION = 1;
-    WINDOW_PERS = /* @__PURE__ */ new Set(["5h", "7d", "30d", "month"]);
-    WINDOW_UNITS = /* @__PURE__ */ new Set(["tokens", "requests", "prompts", "credits"]);
-    MODEL_GLOB_RE = /^[A-Za-z0-9*._:/-]{1,64}$/;
-  }
-});
-
-// ../worker/src/connection.mjs
-import { Redis } from "ioredis";
-function parseConnection(url, { failFast = false } = {}) {
-  const u = new URL(url);
-  return {
-    host: u.hostname || "127.0.0.1",
-    port: Number(u.port || 6379),
-    ...u.password ? { password: u.password } : {},
-    ...u.username ? { username: u.username } : {},
-    ...u.pathname && u.pathname !== "/" ? { db: Number(u.pathname.slice(1)) } : {},
-    maxRetriesPerRequest: null,
-    // required for BullMQ blocking connections
-    ...failFast ? {
-      connectTimeout: 2e3,
-      enableOfflineQueue: false,
-      // don't buffer commands while disconnected -- error now
-      retryStrategy: (attempts) => attempts > 2 ? null : 200
-      // give up after ~2 tries
-    } : {}
-  };
-}
-function makeRedisClient(url) {
-  return new Redis(url, { maxRetriesPerRequest: null });
-}
-var init_connection = __esm({
-  "../worker/src/connection.mjs"() {
-  }
-});
-
-// ../worker/src/job-id.mjs
-import { createHash } from "node:crypto";
-function localJobId({ folder, flow, task, minute }) {
-  const digest = createHash("sha256").update([folder, flow ?? "", task ?? "", minute].join("\0")).digest("hex");
-  return `local-${digest.slice(0, 16)}`;
-}
-var init_job_id = __esm({
-  "../worker/src/job-id.mjs"() {
-    init_config2();
-    init_forges();
-  }
-});
-
 // ../worker/src/queue.mjs
 import { Queue } from "bullmq";
 function makeQueue(connection) {
@@ -8701,59 +8989,18 @@ async function enqueueLocalJob(queue, { folder, flow, task, command, provider, m
   });
   return id;
 }
-var QUEUE, SEMANTIC_WINDOW_MS;
+var PR_CLOSE_WORDS, QUEUE, SEMANTIC_WINDOW_MS;
 var init_queue = __esm({
   "../worker/src/queue.mjs"() {
     init_job_id();
     init_forges();
+    init_triggers();
+    PR_CLOSE_WORDS = new Set(Object.values(PR_CLOSE_ACTIONS));
     QUEUE = "pi-jobs";
     SEMANTIC_WINDOW_MS = 10 * 60 * 1e3;
   }
 });
 
-// ../worker/src/flow-gate.mjs
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-async function readFlowGate({ folder, flow, sha, git = defaultGit }) {
-  if (typeof sha !== "string" || sha.trim() === "") return { gate: "deny" };
-  if (typeof flow !== "string" || !SKILL_NAME_RE.test(flow)) return { gate: "deny" };
-  const path = `.pi/skills/${flow}/SKILL.md`;
-  try {
-    const lsTreeZ = await git(folder, ["ls-tree", "-z", sha, path]);
-    const record = lsTreeZ.split("\0").find((r) => r);
-    if (!record) return { gate: "no-skill" };
-    const tab = record.indexOf("	");
-    if (tab === -1) return { gate: "deny" };
-    const [mode, type, oid] = record.slice(0, tab).split(/\s+/);
-    if (mode !== "100644" || type !== "blob") return { gate: "deny" };
-    const content = await git(folder, ["cat-file", "blob", oid], { raw: true });
-    return { gate: aiTriggerAllows(content) ? "allow" : "deny" };
-  } catch {
-    return { gate: "deny" };
-  }
-}
-function aiTriggerAllows(buf) {
-  const text = buf.toString("utf8").replace(/^\uFEFF/, "").replace(/\r\n/g, "\n");
-  const block = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(text);
-  if (!block) return false;
-  return /^ai-trigger:\s*("?)allow\1\s*$/m.test(block[1]);
-}
-async function defaultGit(gitDir, args, { raw = false } = {}) {
-  const hardened = ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "--no-pager", "-C", gitDir, ...args];
-  const { stdout } = await exec("git", hardened, {
-    encoding: raw ? "buffer" : "utf8",
-    maxBuffer: 16 * 1024 * 1024
-  });
-  return stdout;
-}
-var exec, SKILL_NAME_RE;
-var init_flow_gate = __esm({
-  "../worker/src/flow-gate.mjs"() {
-    exec = promisify(execFile);
-    SKILL_NAME_RE = /^[a-z0-9](?:[a-z0-9_-]{0,62}[a-z0-9])?$/;
-  }
-});
-
 // ../worker/src/git-dirty.mjs
 import { execFileSync } from "node:child_process";
 function gitDirty(folder, { exec: exec4 = execFileSync } = {}) {
@@ -8874,8 +9121,8 @@ var init_docker_run = __esm({
 
 // ../worker/src/packages.mjs
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { basename, dirname as dirname2, join, resolve } from "node:path";
-function isNonEmptyString5(value) {
+import { basename, dirname as dirname2, join, resolve as resolve2 } from "node:path";
+function isNonEmptyString6(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function readStageManifest({ globalPiDir, readFile = readFileSync, fileExists = existsSync } = {}) {
@@ -8889,7 +9136,7 @@ function readStageManifest({ globalPiDir, readFile = readFileSync, fileExists =
     for (const entry of parsed.packages) {
       if (entry === null || typeof entry !== "object") return null;
       const { name, version, dir } = entry;
-      if (!isNonEmptyString5(name) || !isNonEmptyString5(version) || !isNonEmptyString5(dir)) return null;
+      if (!isNonEmptyString6(name) || !isNonEmptyString6(version) || !isNonEmptyString6(dir)) return null;
       if (!ENTRY_NAME_RE.test(dir) || dir.length > MAX_DIR_LENGTH) return null;
       packages.push({ name, version, dir, from: entry.from === FROM_HOST ? FROM_HOST : FROM_DECLARED });
     }
@@ -8914,7 +9161,7 @@ function readStagedSkills({ globalPiDir, readFile = readFileSync, fileExists = e
           out.unenumerable.push(pkg.name);
           continue;
         }
-        sources = entries.filter((e) => !e.split(/[\\/]/).includes("..")).map((e) => resolve(root, e));
+        sources = entries.filter((e) => !e.split(/[\\/]/).includes("..")).map((e) => resolve2(root, e));
       } else {
         sources = [join(root, "skills")];
       }
@@ -9331,6 +9578,16 @@ function buildGraphModel({ triggers, schedulers, folderSkills, injectedSkills, o
       // (guarded on `typeof t.flow === "string"`) correctly draws nothing for it.
       command: t.command ?? null,
       replicas: t.replicas ?? null,
+      // The one-shot facts (issue #231), carried the way `cost` is: node FACTS, never new vocabulary
+      // -- the #188 rule, and GRAPH_FLAGS/GRAPH_NODE_KINDS are byte-unchanged by this issue too. A
+      // spent entry still arrives here because the display normalizer reads the RAW file (the spent
+      // row must stay visible), so the two states a renderer has to keep apart ride as one boolean
+      // and one mark: `once` is true only while ARMED -- a spent one-shot is not "a rule that will
+      // fire once", and letting both read true would ask every consumer to re-derive the difference
+      // -- and `disarmed` is the worker's mark verbatim ({ at, jobId? }), null like every absent
+      // fact on this literal.
+      once: t.once === true && !t.disarmed,
+      disarmed: t.disarmed !== null && typeof t.disarmed === "object" ? t.disarmed : null,
       folderKey: group?.key ?? null,
       runs: Number.isInteger(stats?.runs) ? stats.runs : 0,
       lastOutcome: stats?.lastOutcome ?? null,
@@ -9468,8 +9725,16 @@ function triggerMatchLabel(t) {
       return selectorLabel(t);
     case "comment":
       return `"${t.phrase ?? "-"}"`;
-    case "pull_request":
-      return `action[${(Array.isArray(t.action) ? t.action : []).join(",")}]`;
+    case "pull_request": {
+      const action = `action[${(Array.isArray(t.action) ? t.action : []).join(",")}]`;
+      const num = Number.isInteger(t.number) ? ` #${t.number}` : "";
+      return t.disarmed ? `${action}${num} (spent)` : `${action}${num}`;
+    }
+    case "issue": {
+      const action = `action[${(Array.isArray(t.action) ? t.action : []).join(",")}]`;
+      const base = Number.isInteger(t.number) ? `${action} #${t.number}` : action;
+      return t.disarmed ? `${base} (spent)` : base;
+    }
     default:
       return "(unknown)";
   }
@@ -10076,8 +10341,110 @@ var init_costs = __esm({
   }
 });
 
+// ../worker/src/triggers-file.mjs
+import nodeFs2 from "node:fs";
+function lockPathFor(triggersPath) {
+  return `${triggersPath}.lock`;
+}
+function takeLock(triggersPath, fs, log) {
+  const lock = lockPathFor(triggersPath);
+  let sweptAgeMs = null;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = fs.openSync(lock, "wx");
+      if (sweptAgeMs !== null) log("triggers_lock_stale_taken", { ageMs: sweptAgeMs });
+      return fd;
+    } catch (err) {
+      if (err?.code !== "EEXIST") throw err;
+      let mtimeMs;
+      try {
+        mtimeMs = fs.statSync(lock).mtimeMs;
+      } catch {
+        continue;
+      }
+      if (Date.now() - mtimeMs <= LOCK_STALE_MS) return null;
+      try {
+        fs.unlinkSync(lock);
+      } catch {
+      }
+      sweptAgeMs = Math.round(Date.now() - mtimeMs);
+    }
+  }
+  return null;
+}
+function releaseLock(fd, triggersPath, fs, log) {
+  fs.closeSync(fd);
+  try {
+    fs.unlinkSync(lockPathFor(triggersPath));
+  } catch {
+    log("triggers_lock_stuck", {});
+  }
+}
+function serialize(triggersArray) {
+  return `${JSON.stringify({ triggers: triggersArray }, null, 2)}
+`;
+}
+function renameIntoPlace(fs, tmp, dest) {
+  try {
+    fs.renameSync(tmp, dest);
+  } catch (err) {
+    if (err?.code !== "EPERM") throw err;
+    fs.renameSync(tmp, dest);
+  }
+}
+function tmpPathFor(triggersPath) {
+  return `${triggersPath}.${process.pid}.${tmpSeq++}.tmp`;
+}
+function discardTmp(fs, tmp) {
+  try {
+    fs.unlinkSync(tmp);
+  } catch {
+  }
+}
+function writeTriggers({ triggersPath, mutate, fs = nodeFs2, log = () => {
+} }) {
+  const fd = takeLock(triggersPath, fs, log);
+  if (fd === null) {
+    return { invalid: `triggers file locked (another write in progress): ${lockPathFor(triggersPath)}` };
+  }
+  try {
+    let current = [];
+    try {
+      const raw = JSON.parse(fs.readFileSync(triggersPath, "utf8"));
+      if (Array.isArray(raw?.triggers)) current = raw.triggers;
+    } catch {
+    }
+    const next = mutate(current.map((t) => ({ ...t })));
+    const text = serialize(next);
+    try {
+      parseTriggers(text, triggersPath);
+    } catch (e) {
+      return { invalid: e?.message ?? String(e) };
+    }
+    const tmp = tmpPathFor(triggersPath);
+    try {
+      fs.writeFileSync(tmp, text, { mode: 420 });
+      renameIntoPlace(fs, tmp, triggersPath);
+    } catch (err) {
+      discardTmp(fs, tmp);
+      throw err;
+    }
+    return { ok: true };
+  } finally {
+    releaseLock(fd, triggersPath, fs, log);
+  }
+}
+var LOCK_STALE_MS, tmpSeq;
+var init_triggers_file = __esm({
+  "../worker/src/triggers-file.mjs"() {
+    init_triggers();
+    LOCK_STALE_MS = 1e4;
+    tmpSeq = 0;
+  }
+});
+
 // src/read-model.mjs
-import * as nodeFs2 from "node:fs";
+import * as nodeFs3 from "node:fs";
 import { join as join2, delimiter, sep } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
 function resolvePaths(env = process.env) {
@@ -10091,6 +10458,7 @@ function resolvePaths(env = process.env) {
     // root, and silently wrong (demo triggers) everywhere else.
     triggersPath: env.PI_TRIGGERS_FILE ?? "./triggers.json",
     pauseWindowsPath: env.PI_PAUSE_WINDOWS_FILE ?? "./pause-windows.json",
+    scopedLimitsPath: env.PI_SCOPED_LIMITS_FILE ?? "./scoped-limits.json",
     subscriptionsPath: env.PI_SUBSCRIPTIONS_FILE ?? "./subscriptions.json",
     // The operator's global pi overlay dir (REQ-GLOBAL-PI-OVERLAY), where the staged third-party pi
     // packages live under `packages/`. `|| null` so unset AND empty both read as "no overlay" -- the
@@ -10250,14 +10618,14 @@ function folderUnderRoots(folder, roots) {
   if (!Array.isArray(roots) || roots.length === 0) return false;
   let realTarget;
   try {
-    realTarget = nodeFs2.realpathSync(folder);
+    realTarget = nodeFs3.realpathSync(folder);
   } catch {
     return false;
   }
   for (const root of roots) {
     let realRoot;
     try {
-      realRoot = nodeFs2.realpathSync(root);
+      realRoot = nodeFs3.realpathSync(root);
     } catch {
       continue;
     }
@@ -10268,7 +10636,7 @@ function folderUnderRoots(folder, roots) {
 function hourKey(nowMs) {
   return `dispatch-run:${new Date(nowMs).toISOString().slice(0, 13).replace("T", "-")}`;
 }
-function writeSettings({ settingsFile, mutate, fs = nodeFs2 }) {
+function writeSettings({ settingsFile, mutate, fs = nodeFs3 }) {
   const res = readOverlay(settingsFile, { fs });
   const base = res.overlay ?? {};
   const next = mutate({ ...base });
@@ -10276,60 +10644,114 @@ function writeSettings({ settingsFile, mutate, fs = nodeFs2 }) {
   if (w.invalid) return { invalid: w.invalid };
   return res.invalid ? { ok: true, overlay: next, rebuiltFrom: res.invalid } : { ok: true, overlay: next };
 }
-function writeTriggers({ triggersPath, mutate, fs = nodeFs2 }) {
+function readPauseWindows({ pauseWindowsPath, fs = nodeFs3 }) {
+  let text;
+  try {
+    text = fs.readFileSync(pauseWindowsPath, "utf8");
+  } catch {
+    return { missing: true };
+  }
+  try {
+    return { windows: parsePauseWindows(text, pauseWindowsPath) };
+  } catch (e) {
+    return { invalid: e?.message ?? String(e) };
+  }
+}
+function writePauseWindows({ pauseWindowsPath, mutate, fs = nodeFs3 }) {
   let current = [];
   try {
-    const raw = JSON.parse(fs.readFileSync(triggersPath, "utf8"));
-    if (Array.isArray(raw?.triggers)) current = raw.triggers;
+    const raw = JSON.parse(fs.readFileSync(pauseWindowsPath, "utf8"));
+    if (Array.isArray(raw?.windows)) current = raw.windows;
   } catch {
   }
-  const next = mutate(current.map((t) => ({ ...t })));
-  const text = `${JSON.stringify({ triggers: next }, null, 2)}
+  const next = mutate(current.map((w) => ({ ...w })));
+  const text = `${JSON.stringify({ windows: next }, null, 2)}
 `;
   try {
-    parseTriggers(text, triggersPath);
+    parsePauseWindows(text, pauseWindowsPath);
   } catch (e) {
     return { invalid: e?.message ?? String(e) };
   }
-  const tmp = `${triggersPath}.tmp`;
+  const tmp = `${pauseWindowsPath}.tmp`;
   fs.writeFileSync(tmp, text, { mode: 420 });
-  fs.renameSync(tmp, triggersPath);
+  fs.renameSync(tmp, pauseWindowsPath);
   return { ok: true };
 }
-function readPauseWindows({ pauseWindowsPath, fs = nodeFs2 }) {
+function readScopedLimits({ scopedLimitsPath, fs = nodeFs3 }) {
   let text;
   try {
-    text = fs.readFileSync(pauseWindowsPath, "utf8");
+    text = fs.readFileSync(scopedLimitsPath, "utf8");
   } catch {
     return { missing: true };
   }
   try {
-    return { windows: parsePauseWindows(text, pauseWindowsPath) };
+    return { limits: parseScopedLimits(text, scopedLimitsPath) };
   } catch (e) {
     return { invalid: e?.message ?? String(e) };
   }
 }
-function writePauseWindows({ pauseWindowsPath, mutate, fs = nodeFs2 }) {
+function writeScopedLimits({ scopedLimitsPath, mutate, fs = nodeFs3 }) {
   let current = [];
+  let existing = null;
   try {
-    const raw = JSON.parse(fs.readFileSync(pauseWindowsPath, "utf8"));
-    if (Array.isArray(raw?.windows)) current = raw.windows;
+    existing = fs.readFileSync(scopedLimitsPath, "utf8");
   } catch {
   }
-  const next = mutate(current.map((w) => ({ ...w })));
-  const text = `${JSON.stringify({ windows: next }, null, 2)}
+  if (existing !== null) {
+    try {
+      current = parseScopedLimits(existing, scopedLimitsPath);
+    } catch (e) {
+      return { invalid: e?.message ?? String(e) };
+    }
+  }
+  const next = mutate(current.map((l) => ({ ...l })));
+  const rows = next.map((l) => Object.fromEntries(Object.entries(l).filter(([, v]) => v !== null && v !== void 0)));
+  const text = `${JSON.stringify({ version: SCOPED_LIMITS_VERSION, limits: rows }, null, 2)}
 `;
   try {
-    parsePauseWindows(text, pauseWindowsPath);
+    parseScopedLimits(text, scopedLimitsPath);
   } catch (e) {
     return { invalid: e?.message ?? String(e) };
   }
-  const tmp = `${pauseWindowsPath}.tmp`;
+  const tmp = `${scopedLimitsPath}.tmp`;
   fs.writeFileSync(tmp, text, { mode: 420 });
-  fs.renameSync(tmp, pauseWindowsPath);
+  fs.renameSync(tmp, scopedLimitsPath);
   return { ok: true };
 }
-function readSubscriptions({ subscriptionsPath, fs = nodeFs2 }) {
+async function readScopedBudget({ url, limits, redisFn = makeRedisClient, timeoutMs = 2500 } = {}) {
+  if (!Array.isArray(limits) || limits.length === 0) return { rows: [] };
+  let redis;
+  try {
+    parseConnection(url, { failFast: true });
+    redis = redisFn(url);
+    const now = /* @__PURE__ */ new Date();
+    const settled = Promise.all(
+      limits.map(async (l) => {
+        const prefix = scopeKeyPrefix(l.scope);
+        const cell2 = async (key) => Number(await redis.get(key) ?? 0);
+        const row = {};
+        if (l.day !== null && l.day !== void 0) row.day = await cell2(dayKey(now, prefix));
+        if (l.week !== null && l.week !== void 0) row.week = await cell2(weekKey(now, prefix));
+        if (l.month !== null && l.month !== void 0) row.month = await cell2(monthKey(now, prefix));
+        return row;
+      })
+    ).then(
+      (rows) => ({ rows }),
+      (err) => ({ unreachable: err?.message ?? String(err) })
+    );
+    return await withTimeout(settled, timeoutMs, { unreachable: "timed out reaching the queue" });
+  } catch (err) {
+    return { unreachable: err?.message ?? String(err) };
+  } finally {
+    if (redis) {
+      try {
+        redis.disconnect();
+      } catch {
+      }
+    }
+  }
+}
+function readSubscriptions({ subscriptionsPath, fs = nodeFs3 }) {
   if (subscriptionsPath === null || subscriptionsPath === void 0) return { missing: true };
   let text;
   try {
@@ -10405,13 +10827,13 @@ async function readBudget({ url, redisFn = makeRedisClient, timeoutMs = 2500 } =
 }
 function withTimeout(promise, ms, fallback) {
   let timer;
-  const timeout = new Promise((resolve2) => {
-    timer = setTimeout(() => resolve2(fallback), ms);
+  const timeout = new Promise((resolve3) => {
+    timer = setTimeout(() => resolve3(fallback), ms);
     if (typeof timer?.unref === "function") timer.unref();
   });
   return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
-function listRuns({ logsDir, limit = 10, fs = nodeFs2 }) {
+function listRuns({ logsDir, limit = 10, fs = nodeFs3 }) {
   const cap = clampLimit(limit);
   let names;
   try {
@@ -10429,7 +10851,7 @@ function listRuns({ logsDir, limit = 10, fs = nodeFs2 }) {
   records.sort(byEndedAtDesc);
   return records.slice(0, cap);
 }
-function scanRunRecords({ logsDir, sinceMs, nowMs = Date.now(), fs = nodeFs2 }) {
+function scanRunRecords({ logsDir, sinceMs, nowMs = Date.now(), fs = nodeFs3 }) {
   const oldestMs = nowMs - SCAN_WINDOW_MAX_DAYS * 24 * 60 * 60 * 1e3;
   const cutoffMs = Math.max(Number.isFinite(sinceMs) ? sinceMs : oldestMs, oldestMs);
   let names;
@@ -10450,27 +10872,26 @@ function scanRunRecords({ logsDir, sinceMs, nowMs = Date.now(), fs = nodeFs2 })
   }
   return records;
 }
-function readRun({ logsDir, jobId, fs = nodeFs2 }) {
+function readRun({ logsDir, jobId, fs = nodeFs3 }) {
   return readJsonFile(join2(logsDir, `${sanitizeJobId(jobId)}.json`), fs);
 }
-function readLogTail({ logsDir, jobId, lines = 200, fs = nodeFs2 }) {
+function readLogTail({ logsDir, jobId, lines = 200, fs = nodeFs3 }) {
   let text;
   try {
     text = fs.readFileSync(join2(logsDir, `${sanitizeJobId(jobId)}.log`), "utf8");
   } catch {
     return { missing: true };
   }
-  const all = text.split("\n");
-  if (all.length > 0 && all[all.length - 1] === "") all.pop();
+  const all = text.split("\n").filter((line) => line !== "");
   const cap = clampLines(lines);
   return { lines: all.slice(Math.max(0, all.length - cap)) };
 }
-function readSettingsView({ settingsFile, fs = nodeFs2 }) {
+function readSettingsView({ settingsFile, fs = nodeFs3 }) {
   const result = readOverlay(settingsFile, { fs });
   if (result.invalid) return { path: settingsFile, invalid: result.invalid };
   return { path: settingsFile, overlay: result.overlay };
 }
-function readTriggers({ triggersPath, fs = nodeFs2 }) {
+function readTriggers({ triggersPath, fs = nodeFs3 }) {
   let text;
   try {
     text = fs.readFileSync(triggersPath, "utf8");
@@ -10534,13 +10955,17 @@ function normalizeTriggerForDisplay(entry) {
       return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
     case "comment":
       return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
-    case "pull_request":
+    case "pull_request": {
+      const prDisarmed = on.disarmed !== null && typeof on.disarmed === "object" && !Array.isArray(on.disarmed) ? on.disarmed : null;
       return {
         type: "pull_request",
         action: normalizeSelector(on.action),
         any: normalizeSelector(on.any),
         all: normalizeSelector(on.all),
         none: normalizeSelector(on.none),
+        ...Number.isInteger(on.number) && on.number >= 1 && { number: on.number },
+        ...on.once === true && { once: true },
+        ...prDisarmed !== null && { disarmed: prDisarmed },
         flow,
         command,
         packages,
@@ -10553,6 +10978,34 @@ function normalizeTriggerForDisplay(entry) {
         replicas,
         forge
       };
+    }
+    case "issue": {
+      const disarmed = on.disarmed !== null && typeof on.disarmed === "object" && !Array.isArray(on.disarmed) ? on.disarmed : null;
+      return {
+        type: "issue",
+        action: normalizeSelector(on.action),
+        // `null` is the every-item sentinel, this function's own flow/model/phrase convention; the loader
+        // refused anything but an integer >= 1, so the display mirrors rather than re-validates.
+        number: Number.isInteger(on.number) && on.number >= 1 ? on.number : null,
+        // An opt-IN, `=== true` like `resume` above and NOT `!== false`: the rendering mistake that costs
+        // is a one-shot with no marker, never a standing rule with a spurious one.
+        once: on.once === true,
+        // Absent, not null, when unspent: `disarmed` is a mark the worker adds, and a key that is usually
+        // missing reads truer than a fifth null sentinel -- consumers test presence, not value.
+        ...disarmed !== null && { disarmed },
+        flow,
+        command,
+        packages,
+        image,
+        skillsDir,
+        instructions,
+        resume,
+        secrets,
+        secretsProfile,
+        replicas,
+        forge
+      };
+    }
     default:
       return null;
   }
@@ -10561,7 +11014,7 @@ function normalizeSelector(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((member) => typeof member === "string");
 }
-function readStagedPackages({ globalPiDir, fs = nodeFs2, readManifest: readManifest2 = readStageManifest } = {}) {
+function readStagedPackages({ globalPiDir, fs = nodeFs3, readManifest: readManifest2 = readStageManifest } = {}) {
   const empty = { stagedAt: null, packages: [] };
   if (typeof globalPiDir !== "string" || globalPiDir === "") return empty;
   let manifest;
@@ -10769,7 +11222,7 @@ function readFolderSkills({ folder, exec: exec4 = execFileSync2 } = {}) {
   }
   return { head, skills, truncated: truncated || anyUnread, unreachable: null };
 }
-function readInjectedSkills({ skillsDir, fs = nodeFs2 } = {}) {
+function readInjectedSkills({ skillsDir, fs = nodeFs3 } = {}) {
   if (typeof skillsDir !== "string" || skillsDir === "") return { skills: [], truncated: false, unreachable: null };
   let names;
   try {
@@ -10792,7 +11245,7 @@ function readInjectedSkills({ skillsDir, fs = nodeFs2 } = {}) {
   }
   return { skills, truncated, unreachable: null };
 }
-function readOverlaySkills({ globalPiDir, fs = nodeFs2 } = {}) {
+function readOverlaySkills({ globalPiDir, fs = nodeFs3 } = {}) {
   if (typeof globalPiDir !== "string" || globalPiDir === "") return { skills: [], truncated: false, unreachable: null };
   const dir = join2(globalPiDir, "skills");
   let names;
@@ -10816,7 +11269,7 @@ function readOverlaySkills({ globalPiDir, fs = nodeFs2 } = {}) {
   }
   return { skills, truncated, unreachable: null };
 }
-function readStagedSkillsList({ globalPiDir, fs = nodeFs2, readStaged = readStagedSkills } = {}) {
+function readStagedSkillsList({ globalPiDir, fs = nodeFs3, readStaged = readStagedSkills } = {}) {
   const empty = { skills: [], unenumerable: [], truncated: false };
   if (typeof globalPiDir !== "string" || globalPiDir === "") return empty;
   let result;
@@ -10891,7 +11344,7 @@ function forgeRepoTargets({ records } = {}) {
 function escapeRegExp2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function listRunIds({ logsDir, fs = nodeFs2 }) {
+function listRunIds({ logsDir, fs = nodeFs3 }) {
   let names;
   try {
     names = fs.readdirSync(logsDir);
@@ -10936,8 +11389,8 @@ var init_read_model = __esm({
     init_runtime_settings();
     init_run_history();
     init_budget();
-    init_triggers();
     init_pause_windows();
+    init_scoped_limits();
     init_subscriptions();
     init_connection();
     init_queue();
@@ -10948,6 +11401,7 @@ var init_read_model = __esm({
     init_forges();
     init_graph_model();
     init_costs();
+    init_triggers_file();
     DISPATCH_RUN_TTL_SECONDS = 2 * 60 * 60;
     SCAN_WINDOW_MAX_DAYS = 92;
     GRAPH_LIMITS = Object.freeze({
@@ -11066,6 +11520,12 @@ function normalizeModel(model) {
       package: typeof n.package === "string" ? clip(n.package, 80) : null,
       tiersUnknown: Array.isArray(n.tiersUnknown) ? [...new Set(n.tiersUnknown.filter((t) => typeof t === "string").map((t) => clip(t, 40)))].sort().slice(0, 4) : [],
       replicas: intOr(n.replicas, null),
+      // One-shot facts (#231): `once` is the armed state, and the disarm mark is narrowed to its
+      // instant alone. The mark's jobId stays server-side on purpose: the page answers "spent, and
+      // when", and provenance beyond that belongs to the operator's own console -- a shareable
+      // file:// page should carry no more of a deployment's run history than the question needs.
+      once: n.once === true,
+      disarmed: n.disarmed !== null && n.disarmed !== void 0 && typeof n.disarmed === "object" && !Array.isArray(n.disarmed) ? { at: typeof n.disarmed.at === "string" ? clip(n.disarmed.at, 40) : Number.isFinite(n.disarmed.at) ? n.disarmed.at : null } : null,
       folderKey: typeof n.folderKey === "string" ? n.folderKey : null,
       runs: intOr(n.runs, 0),
       lastOutcome: typeof n.lastOutcome === "string" ? n.lastOutcome : null,
@@ -11510,6 +11970,8 @@ function buildTip(n, flags, groupLabel, nowMs) {
       const nextMs = typeof n.next === "number" ? n.next : typeof n.next === "string" ? Date.parse(n.next) : NaN;
       if (Number.isFinite(nextMs) && Number.isFinite(nowMs) && nextMs > nowMs) lines.push(`next ${relSpan(nextMs - nowMs)}`);
     }
+    if (n.disarmed !== null) lines.push(`one-shot, spent${n.disarmed.at !== null ? ` ${n.disarmed.at}` : ""}`);
+    else if (n.once) lines.push("one-shot (armed)");
   }
   if (n.aiTrigger) lines.push("chainable: ai-trigger allow");
   if (n.kind === "skill" && n.loops.length > 0) {
@@ -11540,6 +12002,7 @@ function nodeState(n, flagNames) {
   }
   if (n.kind === "skill-unverified") return { stroke: PAGE_DIM, dash: "10,4", faded: false };
   if (n.kind === "skill-not-at-head") return { stroke: PAGE_AMBER, dash: "10,4", faded: false };
+  if (n.kind === "trigger" && n.disarmed !== null) return { stroke: CHIP_STROKE, dash: "8,3", faded: true };
   if (flagNames.has("orphan")) return { stroke: CHIP_STROKE, dash: "8,3", faded: true };
   return { stroke: CHIP_STROKE, dash: null, faded: false };
 }
@@ -11784,6 +12247,7 @@ var init_graph_html = __esm({
       label: "#d8bfd8",
       comment: "#e7e7ae",
       pull_request: "#c0deed",
+      issue: "#c7e9c0",
       skill: "#fdd0a2"
     });
     STATUS_COMPLETED = "#3fb950";
@@ -11813,6 +12277,7 @@ var init_graph_html = __esm({
       label: "\u25C8",
       comment: "\u275D",
       pull_request: "\u21C4",
+      issue: "\u25C9",
       skill: "\u0192",
       "skill-missing": "!",
       "skill-unverified": "?",
@@ -12452,7 +12917,28 @@ function normBudget(v) {
       cap: Number.isInteger(t.cap) && t.cap > 0 ? t.cap : null,
       state: BUDGET_STATES.includes(t.state) ? t.state : "ok",
       maxTokens: Number.isInteger(t.maxTokens) && t.maxTokens > 0 ? t.maxTokens : null
-    }
+    },
+    // The scoped rows (issue #242): a pre-1.5 payload simply lacks the key and renders nothing.
+    scoped: Array.isArray(v.scoped) ? v.scoped.map(normScopedRow).filter((r) => r !== null) : [],
+    scopedInvalid: typeof v.scopedInvalid === "string" && v.scopedInvalid !== "" ? clip3(v.scopedInvalid, 160) : null
+  };
+}
+function normScopedRow(v) {
+  if (v === null || typeof v !== "object" || typeof v.scope !== "string" || v.scope === "") return null;
+  const win = (w) => {
+    if (w === null || w === void 0 || typeof w !== "object") return null;
+    return {
+      used: Number.isInteger(w.used) && w.used >= 0 ? w.used : null,
+      cap: Number.isInteger(w.cap) && w.cap > 0 ? w.cap : null,
+      state: BUDGET_STATES.includes(w.state) ? w.state : "ok"
+    };
+  };
+  return {
+    scope: clip3(v.scope, 60),
+    day: win(v.day),
+    week: win(v.week),
+    month: win(v.month),
+    concurrent: Number.isInteger(v.concurrent) && v.concurrent > 0 ? v.concurrent : null
   };
 }
 function normSpendMap(v) {
@@ -12824,6 +13310,24 @@ function budgetSectionHtml(nb) {
   if (nb.softHoldPct !== null) {
     rows.push(`<div class="dim small">soft-hold band: ${fmt(nb.softHoldPct)}% of each cap (the amber tick)</div>`);
   }
+  if (nb.scopedInvalid !== null) {
+    rows.push(`<div class="dim small">scoped limits: file invalid (${escapeHtml(nb.scopedInvalid)})</div>`);
+  } else if (nb.scoped.length > 0) {
+    rows.push('<div class="dim small">scoped limits (scoped-limits.json)</div>');
+    for (const s of nb.scoped) {
+      const bits = [];
+      let worst = "ok";
+      for (const key of ["day", "week", "month"]) {
+        const w = s[key];
+        if (w === null || w.cap === null) continue;
+        bits.push(`${key} used ${w.used !== null ? fmt(w.used) : "?"} / cap ${fmt(w.cap)}`);
+        if (w.state !== "ok") worst = w.state;
+      }
+      if (s.concurrent !== null) bits.push(`concurrent \u2264${fmt(s.concurrent)} (config; in-flight not shown)`);
+      rows.push(`<div class="row"><span class="wl">${escapeHtml(s.scope)}</span><span>${escapeHtml(bits.join(" \xB7 "))}</span>${worst !== "ok" ? stateWord(worst) : ""}</div>`);
+    }
+    rows.push('<div class="lever">scoped: dispatch_limit_add/edit/delete \xB7 or press m in the /dispatch panel</div>');
+  }
   rows.push('<div class="lever">adjust: /dispatch set dailyCap|weeklyCap|monthlyCap|dailyTokenCap|softHoldPct &lt;n&gt; \xB7 or press s in the /dispatch panel</div>');
   return `<div id="budget">${rows.join("")}</div>`;
 }
@@ -13227,9 +13731,9 @@ var init_open_browser = __esm({
 });
 
 // src/deployment-pointer.mjs
-import * as nodeFs3 from "node:fs";
+import * as nodeFs4 from "node:fs";
 import { homedir } from "node:os";
-import { join as join3, isAbsolute } from "node:path";
+import { join as join3, isAbsolute as isAbsolute2 } from "node:path";
 function pointerPath(env = process.env) {
   return env.PI_DISPATCH_DEPLOYMENT_FILE || join3(env.PI_CODING_AGENT_DIR || join3(homedir(), ".pi", "agent"), POINTER_BASENAME);
 }
@@ -13243,7 +13747,7 @@ function normalizePointer(raw) {
   if (raw.version > POINTER_VERSION) {
     return { ignored: `version ${raw.version} is newer than the supported version ${POINTER_VERSION}` };
   }
-  if (typeof raw.deploymentDir !== "string" || !isAbsolute(raw.deploymentDir)) {
+  if (typeof raw.deploymentDir !== "string" || !isAbsolute2(raw.deploymentDir)) {
     return { ignored: "deploymentDir must be an absolute path" };
   }
   const rawEnv = raw.env === void 0 ? {} : raw.env;
@@ -13254,12 +13758,12 @@ function normalizePointer(raw) {
   for (const key of POINTER_ENV_ALLOWLIST) {
     const value = rawEnv[key];
     if (typeof value !== "string" || value === "") continue;
-    if (key !== "VALKEY_URL" && !isAbsolute(value)) continue;
+    if (key !== "VALKEY_URL" && !isAbsolute2(value)) continue;
     env[key] = value;
   }
   return { pointer: { version: raw.version, deploymentDir: raw.deploymentDir, env } };
 }
-function readPointer({ path = pointerPath(), fs = nodeFs3 } = {}) {
+function readPointer({ path = pointerPath(), fs = nodeFs4 } = {}) {
   let text;
   try {
     text = fs.readFileSync(path, "utf8");
@@ -13292,12 +13796,12 @@ function layerPointer(env, fs) {
   }
   return { applied };
 }
-function applyDeploymentPointer(env = process.env, { fs = nodeFs3 } = {}) {
+function applyDeploymentPointer(env = process.env, { fs = nodeFs4 } = {}) {
   if (appliedOnce) return { applied: [] };
   appliedOnce = true;
   return layerPointer(env, fs);
 }
-function reapplyDeploymentPointer(env = process.env, { fs = nodeFs3 } = {}) {
+function reapplyDeploymentPointer(env = process.env, { fs = nodeFs4 } = {}) {
   appliedOnce = true;
   return layerPointer(env, fs);
 }
@@ -13306,7 +13810,7 @@ function takePointerNotice() {
   notice = void 0;
   return n;
 }
-function writePointer({ path = pointerPath(), pointer, fs = nodeFs3 } = {}) {
+function writePointer({ path = pointerPath(), pointer, fs = nodeFs4 } = {}) {
   const res = normalizePointer(pointer);
   if (res.ignored) return { invalid: res.ignored };
   const tmp = `${path}.tmp`;
@@ -13325,6 +13829,7 @@ var init_deployment_pointer = __esm({
       "PI_SETTINGS_FILE",
       "PI_TRIGGERS_FILE",
       "PI_PAUSE_WINDOWS_FILE",
+      "PI_SCOPED_LIMITS_FILE",
       "PI_SUBSCRIPTIONS_FILE"
     ]);
     POINTER_BASENAME = "pi-dispatch-deployment.json";
@@ -38869,7 +39374,7 @@ var init_pricing = __esm({
 
 // ../worker/src/sandbox-store.mjs
 import { lstatSync, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, renameSync, rmSync, writeFileSync } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join5, relative } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5, relative } from "node:path";
 function readManifest({ sandboxDir, jobId, fs = defaultFs }) {
   if (!sandboxDir || jobId === void 0 || jobId === null) return null;
   const dir = join5(sandboxDir, sanitizeJobId(jobId));
@@ -38942,10 +39447,10 @@ function resolveSandbox({ jobId, sandboxDir, retentionHours, publish = [], fs, f
   return { manifest, name: sandboxContainerName(jobId), publish };
 }
 function launchSandbox({ args, spawnFn = spawn }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawnFn("docker", args, { stdio: "inherit" });
-    child.on("error", (err) => resolve2({ code: null, error: err }));
-    child.on("close", (code) => resolve2({ code }));
+    child.on("error", (err) => resolve3({ code: null, error: err }));
+    child.on("close", (code) => resolve3({ code }));
   });
 }
 var exec3, SANDBOX_NAME_PREFIX;
@@ -39000,6 +39505,24 @@ function renderBudget({ budget, settings: settings2 } = {}) {
   if (pct !== null) lines.push(`  soft-hold band: ${pct}%`);
   return lines.join("\n");
 }
+function renderScopedLimits({ limits, scopedBudget } = {}) {
+  if (limits?.invalid) return `Scoped limits: file invalid (${limits.invalid})`;
+  const list = Array.isArray(limits?.limits) ? limits.limits : [];
+  if (list.length === 0) return null;
+  const lines = ["Scoped limits:"];
+  list.forEach((l, i) => {
+    const used = scopedBudget?.rows?.[i] ?? null;
+    const bits = [];
+    for (const key of ["day", "week", "month"]) {
+      if (!Number.isInteger(l[key])) continue;
+      const u = used && Number.isFinite(used[key]) ? used[key] : "-";
+      bits.push(`${key} ${u}/${l[key]}`);
+    }
+    if (Number.isInteger(l.concurrent)) bits.push(`<=${l.concurrent} at once`);
+    lines.push(`  ${l.scope}: ${bits.join(" \xB7 ")}`);
+  });
+  return lines.join("\n");
+}
 function capLabel(cap, reserved, pct) {
   if (!Number.isInteger(cap)) return "unknown (worker env/default)";
   const state = windowState(reserved, cap, pct);
@@ -39039,6 +39562,7 @@ function triggerLine(t) {
   const res = t?.resume === true ? "  [resume]" : "";
   const rep = t?.replicas > 1 ? `  [x${t.replicas}]` : "";
   const sec = t?.secrets > 0 ? `  [secrets ${t.secrets}${t.secretsProfile ? ` via ${t.secretsProfile}` : ""}]` : "";
+  const shot = t?.disarmed ? "  [spent]" : t?.once === true ? "  [once]" : "";
   switch (t?.type) {
     case "cron":
       return `cron  ${t.id ?? "-"}  ${t.pattern ?? "-"} \u2192 ${t.folder ?? "-"}/${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
@@ -39049,7 +39573,13 @@ function triggerLine(t) {
     case "pull_request": {
       const clauses = ruleClauses(t);
       const action = `action[${(t.action ?? []).join(",")}]`;
-      return `pull_request  ${action}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
+      const num = Number.isInteger(t.number) ? ` #${t.number}` : "";
+      return `pull_request  ${action}${num}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${shot}`;
+    }
+    case "issue": {
+      const action = `action[${(t.action ?? []).join(",")}]`;
+      const num = Number.isInteger(t.number) ? ` #${t.number}` : "";
+      return `issue  ${action}${num} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${shot}`;
     }
     default:
       return "(unknown trigger)";
@@ -39360,7 +39890,25 @@ function createDashboardDeps(paths) {
         redis.hgetall(STALL_KEY).catch(() => ({}))
       ]);
       const workers = Array.isArray(workerList) && workerList.length > 0 ? workerList.length : "unknown";
+      const scopedLimits = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const limitRows = Array.isArray(scopedLimits?.limits) ? scopedLimits.limits : [];
+      const scopedNow = /* @__PURE__ */ new Date();
+      const scopedBudget = {
+        rows: await Promise.all(
+          limitRows.map(async (l) => {
+            const prefix = scopeKeyPrefix(l.scope);
+            const cell2 = (key) => redis.get(key).then((v) => Number(v ?? 0), () => null);
+            const row = {};
+            if (Number.isInteger(l.day)) row.day = await cell2(dayKey(scopedNow, prefix));
+            if (Number.isInteger(l.week)) row.week = await cell2(weekKey(scopedNow, prefix));
+            if (Number.isInteger(l.month)) row.month = await cell2(monthKey(scopedNow, prefix));
+            return row;
+          })
+        )
+      };
       return {
+        scopedLimits,
+        scopedBudget,
         queue: { pausedState, counts, workers },
         budget: { day: Number(dayRaw ?? 0), week: Number(weekRaw ?? 0), month: Number(monthRaw ?? 0), tokensToday: Number(tokenRaw ?? 0) },
         schedulers: mapSchedulers(schedulerList, Date.now()),
@@ -39721,6 +40269,10 @@ function makeDashboard({
         void dispose().finally(() => done({ action: "managePauses" }));
         return;
       }
+      if (data === "m" || data === "M") {
+        void dispose().finally(() => done({ action: "manageLimits" }));
+        return;
+      }
       if (matchesKey(data, "up")) {
         selected = Math.max(0, selected - 1);
         tui?.requestRender?.();
@@ -39824,6 +40376,8 @@ function renderPanel(snapshot, width, state, styler) {
     { title: "RUNS", lines: renderRunList(buildRows(snapshot, runSort), selected, 24) },
     { title: "SETTINGS", lines: toLines(renderSettingsView(snapshot.settings)) }
   ];
+  const scopedText = renderScopedLimits({ limits: snapshot.scopedLimits, scopedBudget: snapshot.scopedBudget });
+  if (scopedText) sections.splice(2, 0, { title: "SCOPED LIMITS", lines: toLines(scopedText) });
   const plain = [title];
   for (const section of sections) plain.push(section.title, ...section.lines);
   plain.push(KEY_HINTS);
@@ -39851,6 +40405,7 @@ function collapseKeys(sections, availableRows, focus, baseRows) {
 function buildListLines(snapshot, selected, inner, styler, runSort = "time", availableRows = null) {
   const trg = triggerLines(snapshot, selected, inner, styler);
   const pw = pauseLines(snapshot.pauseWindows, inner, styler);
+  const sl = limitLines(snapshot.scopedLimits, snapshot.scopedBudget, inner, styler);
   const runRows = buildRows(snapshot, runSort).slice(trg.count);
   const runCount = Array.isArray(snapshot.runs) ? snapshot.runs.length : 0;
   const sections = [
@@ -39858,6 +40413,10 @@ function buildListLines(snapshot, selected, inner, styler, runSort = "time", ava
     { key: "spend", head: ["spend & limits", "jobs & tokens/day \xB7 s set"], body: spendLines(snapshot.budget, snapshot.settings, inner, styler), priority: 4, viewKey: "s" },
     { key: "triggers", head: ["triggers", `${trg.count} standing \xB7 a add \xB7 \u21B5 open`], body: trg.lines, priority: 3, viewKey: "tab" },
     { key: "pauses", head: ["pause windows", `${pw.count} \xB7 w manage`], body: pw.lines, priority: 1, viewKey: "w" },
+    // Priority 0: the section an operator acts on least often from the panel folds FIRST under the
+    // collapse budget. The key hint lives in this divider, not the footer -- the footer's width
+    // arithmetic has no headroom for another hint (its own comment), the s/o/Tab precedent.
+    { key: "limits", head: ["scoped limits", `${sl.count} \xB7 m manage`], body: sl.lines, priority: 0, viewKey: "m" },
     { key: "runs", head: ["runs", `last ${runCount} \xB7 o ${runSort}`], body: runLines(runRows, selected - trg.count, inner, styler) },
     { key: "settings", head: ["settings", "s edit"], body: settingsLines(snapshot.settings, inner, styler), priority: 2, viewKey: "s" }
   ];
@@ -39892,7 +40451,8 @@ function statusHeader(queue, inner, styler) {
   const dot = styler.fg(stateColor, "\u25CF");
   const word = styler.bold(styler.fg(stateColor, running ? "RUNNING" : "PAUSED"));
   const sep2 = styler.fg("dim", " \xB7 ");
-  const vitals = `${c.waiting ?? 0} waiting` + sep2 + `${c.active ?? 0} active` + sep2 + (failed > 0 ? styler.fg("error", `${failed} failed`) : `${failed} failed`) + sep2 + `${queue.workers ?? "?"} workers`;
+  const delayed = Number(c.delayed ?? 0);
+  const vitals = `${c.waiting ?? 0} waiting` + sep2 + `${c.active ?? 0} active` + sep2 + (delayed > 0 ? `${delayed} delayed` + sep2 : "") + (failed > 0 ? styler.fg("error", `${failed} failed`) : `${failed} failed`) + sep2 + `${queue.workers ?? "?"} workers`;
   const clock = (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
   const left = `${dot} ${word}  ${vitals}`;
   const gap = inner - styler.visibleLen(left) - clock.length;
@@ -39978,8 +40538,9 @@ function triggerRow(t, sel, inner, styler, sched = null) {
   const img = t?.image ? " " + styler.fg("accent", `[${t.image}]`) : "";
   const res = t?.resume === true ? " " + styler.fg("warning", "[resume]") : "";
   const rep = t?.replicas > 1 ? " " + styler.fg("warning", `[x${t.replicas}]`) : "";
+  const shot = t?.disarmed ? " " + styler.fg("dim", "[spent]") : t?.once === true ? " " + styler.fg("accent", "[once]") : "";
   const health = sched && (sched.overdueMs || sched.stallMax > 0 && sched.stalls >= sched.stallMax) ? " " + styler.fg("warning", sched.overdueMs ? "\u26A0 overdue" : "\u26A0 stalled") : "";
-  return fitLine(`${cursor} ${badge} ${matchColored(t, styler)} ${targetColored(t, styler)}${pkgs}${img}${res}${rep}${health}`, inner, styler);
+  return fitLine(`${cursor} ${badge} ${matchColored(t, styler)} ${targetColored(t, styler)}${pkgs}${img}${res}${rep}${shot}${health}`, inner, styler);
 }
 function matchColored(t, styler) {
   switch (t?.type) {
@@ -39987,10 +40548,15 @@ function matchColored(t, styler) {
       return styler.fg("text", `${t.id ?? "-"}  ${t.pattern ?? "-"}`);
     case "comment":
       return styler.fg("text", `"${t.phrase ?? "-"}"`);
+    case "issue": {
+      const num = Number.isInteger(t.number) ? " " + styler.fg("success", `#${t.number}`) : "";
+      return styler.fg("muted", `[${(t.action ?? []).join(",")}]`) + num;
+    }
     case "label":
     case "pull_request": {
       const parts = [];
       if (t.type === "pull_request") parts.push(styler.fg("muted", `[${(t.action ?? []).join(",")}]`));
+      if (t.type === "pull_request" && Number.isInteger(t.number)) parts.push(styler.fg("success", `#${t.number}`));
       for (const x of t.any ?? []) parts.push(styler.fg("success", x));
       for (const x of t.all ?? []) parts.push(styler.fg("success", `+${x}`));
       for (const x of t.none ?? []) parts.push(styler.fg("error", `!${x}`));
@@ -40041,6 +40607,39 @@ function pauseRow(w, now, inner, styler) {
   if (until) bits.push(styler.fg("warning", `resumes in ${humanizeMs(until - now) || "<1m"}`));
   return fitLine(bits.join(styler.fg("dim", "  ")), inner, styler);
 }
+function limitLines(scopedLimits, scopedBudget, inner, styler) {
+  const lines = [];
+  if (scopedLimits && scopedLimits.missing) {
+    lines.push(styler.cell("(no scoped limits \xB7 m to manage)", inner, { color: "dim" }));
+    return { count: 0, lines };
+  }
+  if (scopedLimits && scopedLimits.invalid) {
+    lines.push(styler.cell(`(scoped-limits file invalid: ${scopedLimits.invalid})`, inner, { color: "error" }));
+    return { count: 0, lines };
+  }
+  const list = (scopedLimits && scopedLimits.limits) ?? [];
+  if (list.length === 0) {
+    lines.push(styler.cell("(no scoped limits \xB7 m to manage)", inner, { color: "dim" }));
+    return { count: 0, lines };
+  }
+  list.forEach((l, i) => lines.push(limitRow(l, scopedBudget?.rows?.[i] ?? null, inner, styler)));
+  return { count: list.length, lines };
+}
+function limitRow(l, used, inner, styler) {
+  let atCap = false;
+  const windows = [];
+  for (const key of ["day", "week", "month"]) {
+    if (!Number.isInteger(l[key])) continue;
+    const u = used && Number.isFinite(used[key]) ? used[key] : null;
+    const over = u !== null && u >= l[key];
+    if (over) atCap = true;
+    windows.push(styler.fg(over ? "warning" : "text", `${key} ${u ?? "-"}/${l[key]}`));
+  }
+  const dot = atCap ? styler.fg("warning", "\u25CF") : styler.fg("dim", "\u25CB");
+  const bits = [`${dot} ${styler.fg("accent", l.scope ?? "-")}`, ...windows];
+  if (Number.isInteger(l.concurrent)) bits.push(styler.fg("muted", `\u2264${l.concurrent} at once`));
+  return fitLine(bits.join(styler.fg("dim", "  ")), inner, styler);
+}
 function runLines(rows, selected, inner, styler) {
   if (!Array.isArray(rows) || rows.length === 0) return [styler.cell("(no runs)", inner, { color: "dim" })];
   const { top, count } = runsWindow(rows.length, selected);
@@ -40125,11 +40724,17 @@ function renderTriggerDetail(t, inner, styler, sched = null, staged = null) {
     }
   } else if (t.type === "label" || t.type === "pull_request") {
     if (t.type === "pull_request") out.push(kv("PR actions", (t.action ?? []).join(", ") || "-"));
+    if (t.type === "pull_request" && Number.isInteger(t.number)) out.push(kv("item", `#${t.number}`, "success"));
+    if (t.once === true) out.push(kv("one-shot", t.disarmed ? `spent ${t.disarmed.at ?? "-"}${t.disarmed.jobId ? ` by ${t.disarmed.jobId}` : ""}` : "armed", t.disarmed ? "dim" : "accent"));
     out.push(kv("any of", (t.any ?? []).join(" \xB7 ") || "-", "success"));
     out.push(kv("all of", (t.all ?? []).join(" \xB7 ") || "-", "success"));
     out.push(kv("none of", (t.none ?? []).join(" \xB7 ") || "-", "error"));
   } else if (t.type === "comment") {
     out.push(kv("phrase", `"${t.phrase ?? "-"}"`));
+  } else if (t.type === "issue") {
+    out.push(kv("issue actions", (t.action ?? []).join(", ") || "-"));
+    if (Number.isInteger(t.number)) out.push(kv("item", `#${t.number}`, "success"));
+    if (t.once === true) out.push(kv("one-shot", t.disarmed ? `spent ${t.disarmed.at ?? "-"}${t.disarmed.jobId ? ` by ${t.disarmed.jobId}` : ""}` : "armed", t.disarmed ? "dim" : "accent"));
   }
   blank();
   section("runs");
@@ -40193,33 +40798,38 @@ function trustModel(t) {
   }
   const subject = t?.type === "comment" ? "adversarial comment text" : "adversarial issue/PR text";
   const where = `lives in the receiver \xB7 task is ${subject}`;
+  const closeCapable = t?.type === "issue" || t?.type === "pull_request" && (t?.action ?? []).some((a) => a === "closed" || a === "close");
+  const oneShot = (lines) => closeCapable && (t?.once === true || t?.disarmed) ? [...lines, "one-shot: the WORKER writes on.disarmed into triggers.json, strictly after the run record \u2014 spent always has its run"] : lines;
   switch (t?.forge) {
     case "gitlab":
-      return [
+      return oneShot([
         "authorized by the actor's resolved project access level (>= Developer) \u2014 a label is NOT approval here",
         "HMAC over the body (19.0+) or a bare X-Gitlab-Token \xB7 dedup by webhook-id",
         where
-      ];
+      ]);
     case "forgejo":
-      return [
+      return oneShot([
         "authorized by the actor's resolved repository permission (admin|write), on every trigger type",
         "HMAC over the body (GitHub-compatible) \xB7 dedup by X-GitHub-Delivery GUID",
         where
-      ];
+      ]);
     case "azure":
-      return [
+      return oneShot([
         "authorized by the actor's resolved project membership \u2014 work items name the actor only by email",
         "NO HMAC: a shared secret that covers no bytes \xB7 dedup by the payload's own id (OQ-015)",
         where
-      ];
+      ]);
     default:
-      return [
+      return oneShot([
         // A review trigger reads the REVIEWER's author_association, not the PR author's (issue #66), so it
         // cannot share the generic line: an operator reading "author gate" would picture the wrong person.
-        t?.type === "comment" ? "authorized by a collaborator comment (author_association) + HMAC" : t?.type === "pull_request" && (t?.action ?? []).includes("review_submitted") ? "authorized by the REVIEWER's author_association (not the PR author's) + HMAC" : "authorized by a collaborator's label + HMAC webhook + author gate",
+        // A close rule reads the CLOSER's resolved permission (issue #231), for the inversion's sharper
+        // sibling: GitHub sends NO association for a close at all, so the collaborator-label line would
+        // name a gate this rule never runs — and a wrong trust model is worse than an absent one.
+        closeCapable ? "authorized by the CLOSER's resolved repository permission (admin|write) + HMAC \u2014 a close names no author_association" : t?.type === "comment" ? "authorized by a collaborator comment (author_association) + HMAC" : t?.type === "pull_request" && (t?.action ?? []).includes("review_submitted") ? "authorized by the REVIEWER's author_association (not the PR author's) + HMAC" : "authorized by a collaborator's label + HMAC webhook + author gate",
         "dedup by X-GitHub-Delivery GUID (redelivery-safe)",
         where
-      ];
+      ]);
   }
 }
 function triggerDetailHints(inner, styler, pendingDelete = false) {
@@ -40447,6 +41057,7 @@ var init_dashboard = __esm({
     init_scheduler_stall_guard();
     init_pause_windows();
     init_read_model();
+    init_scoped_limits();
     init_render();
     init_keys2();
     init_panel();
@@ -40460,7 +41071,7 @@ var init_dashboard = __esm({
     TAIL_VIEWPORT = 20;
     MIN_WIDTH2 = 8;
     DRILL_WIDTH = 70;
-    KIND_COLOR = { cron: "accent", label: "syntaxType", comment: "syntaxKeyword", pull_request: "syntaxFunction" };
+    KIND_COLOR = { cron: "accent", label: "syntaxType", comment: "syntaxKeyword", pull_request: "syntaxFunction", issue: "syntaxString" };
     KIND_WIDTH = 13;
     FRAME_CHROME_ROWS = 4;
   }
@@ -40485,7 +41096,7 @@ __export(setup_wizard_exports, {
   runSetupWizard: () => runSetupWizard,
   runtimeDirFor: () => runtimeDirFor
 });
-import * as nodeFs4 from "node:fs";
+import * as nodeFs5 from "node:fs";
 import { execFileSync as execFileSync3, spawn as nodeSpawn2 } from "node:child_process";
 import { homedir as homedir2 } from "node:os";
 import { join as join6 } from "node:path";
@@ -40501,7 +41112,7 @@ async function defaultProbeQueue(url) {
 async function detectDeployment({
   env = process.env,
   cwd = process.cwd(),
-  fs = nodeFs4,
+  fs = nodeFs5,
   probeQueue = defaultProbeQueue
 } = {}) {
   const pointerRes = readPointer({ path: pointerPath(env), fs });
@@ -40535,16 +41146,16 @@ async function runAttached(ctx, { title, argv0, args, cwd, env, shell, spawnFn =
 ${title}
 
 `);
-        outcome = await new Promise((resolve2) => {
+        outcome = await new Promise((resolve3) => {
           let child;
           try {
             child = spawnFn(argv0, args, { stdio: "inherit", cwd, env, ...shell ? { shell: true } : {} });
           } catch (err) {
-            resolve2({ code: null, error: err });
+            resolve3({ code: null, error: err });
             return;
           }
-          child.on("error", (err) => resolve2({ code: null, error: err }));
-          child.on("close", (code) => resolve2({ code }));
+          child.on("error", (err) => resolve3({ code: null, error: err }));
+          child.on("close", (code) => resolve3({ code }));
         });
       } catch (err) {
         outcome = { code: null, error: err };
@@ -40628,7 +41239,7 @@ async function ensureDocker(ui, notify, { platform, probeDockerFn }) {
 function npmSpawnOptions(platform, dir) {
   return platform === "win32" ? { bin: "npm.cmd", options: { cwd: dir, shell: true } } : { bin: "npm", options: { cwd: dir } };
 }
-function listRepoSkills(cwd, fs = nodeFs4) {
+function listRepoSkills(cwd, fs = nodeFs5) {
   try {
     const root = join6(cwd, ".pi", "skills");
     return fs.readdirSync(root).filter((name) => SKILL_NAME_RE.test(name) && fs.existsSync(join6(root, name, "SKILL.md")));
@@ -40656,7 +41267,7 @@ function ensureDeploymentPackageJson(fs, dir) {
 }
 async function runSetupWizard(paths, ctx, notify, deps = {}) {
   const {
-    fs = nodeFs4,
+    fs = nodeFs5,
     env = process.env,
     platform = process.platform,
     execPath = process.execPath,
@@ -40763,6 +41374,7 @@ up shows each docker action and asks y/N before it \u2014 nothing is auto-accept
     env: {
       PI_TRIGGERS_FILE: join6(dir, "triggers.json"),
       PI_PAUSE_WINDOWS_FILE: join6(dir, "pause-windows.json"),
+      PI_SCOPED_LIMITS_FILE: join6(dir, "scoped-limits.json"),
       PI_SUBSCRIPTIONS_FILE: join6(dir, "subscriptions.json")
     }
   };
@@ -40970,7 +41582,7 @@ async function offerFirstTrigger(repoCwd, deployDir, ui, notify, { fs, listRepoS
   );
 }
 function registerNudge(pi, deps = {}) {
-  const { fs = nodeFs4, env = process.env, homedirFn = homedir2 } = deps;
+  const { fs = nodeFs5, env = process.env, homedirFn = homedir2 } = deps;
   pi.on("session_start", (event, ctx) => {
     try {
       if (event?.reason !== "startup" || !ctx?.hasUI) return;
@@ -40995,8 +41607,8 @@ var init_setup_wizard = __esm({
     init_deployment_pointer();
     init_read_model();
     init_index();
-    RUNTIME_VERSION = "1.3.0";
-    RECEIVER_VERSION = "1.2.0";
+    RUNTIME_VERSION = "1.5.0";
+    RECEIVER_VERSION = "1.3.0";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -41112,7 +41724,7 @@ var init_secrets_command = __esm({
 // src/index.ts
 import { VERSION } from "@earendil-works/pi-coding-agent";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
-import * as nodeFs5 from "node:fs";
+import * as nodeFs6 from "node:fs";
 function computePiVersionAdvisory(version, supported) {
   if (version === supported || version === "0.0.0") return void 0;
   return `pi-dispatch admin: running on pi ${version}, tested with pi ${supported} \u2014 things should work; report anything odd, and check for a newer @edgehero/pi-dispatch-admin`;
@@ -41190,15 +41802,15 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_costs",
     label: "pi-dispatch costs",
-    description: "Read-only. Folds the PII-free run history against the operator's declared subscriptions and pi-ai's rate tables into the costs read-model: window totals, daily buckets, per-flow and per-model rollups, per-plan verdicts, and provenance. window = 7d | 30d | mtd (default mtd); flow filters to one flow's runs.",
-    parameters: typebox_exports.Object({ window: typebox_exports.Optional(typebox_exports.String()), flow: typebox_exports.Optional(typebox_exports.String()) }),
+    description: `Read-only. Folds the PII-free run history against the operator's declared subscriptions and pi-ai's rate tables into the costs read-model: window totals, daily buckets, per-flow and per-model rollups, per-plan verdicts, and provenance. window = 7d | 30d | mtd (default mtd); flow filters to one flow's runs; repo filters to one repo's runs by the by-repo rollup's key (e.g. "acme/web" or "local:site").`,
+    parameters: typebox_exports.Object({ window: typebox_exports.Optional(typebox_exports.String()), flow: typebox_exports.Optional(typebox_exports.String()), repo: typebox_exports.Optional(typebox_exports.String()) }),
     async execute(_toolCallId, params) {
       const window = params.window ?? "mtd";
       if (!COSTS_WINDOWS.includes(window)) {
         throw new Error(`unknown window '${window}' (7d|30d|mtd)`);
       }
       const paths = resolvePaths(process.env);
-      const res = assembleCosts(paths, window, params.flow);
+      const res = assembleCosts(paths, window, params.flow, params.repo);
       if (res.unreachable) throw new Error(`could not read the run history: ${res.unreachable}`);
       return toolText(JSON.stringify({ window, fold: res.fold }));
     }
@@ -41254,7 +41866,7 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_triggers",
     label: "pi-dispatch triggers",
-    description: "Read-only. Lists the configured triggers as `{ index, ...trigger }` entries. Use the `index` to target a specific trigger with dispatch_trigger_edit or dispatch_trigger_delete.",
+    description: "Read-only. Lists the configured triggers as `{ index, ...trigger }` entries. Use the `index` to target a specific trigger with dispatch_trigger_edit or dispatch_trigger_delete. A close-capable entry (kind issue, or a pull_request on the forge's close word) may carry `on.number` (narrowed to one item), `on.once` (a one-shot), and `on.disarmed` { at, jobId? } \u2014 the worker's mark that the one-shot fired; a disarmed entry still lists here but matches nothing until an operator deletes the key to re-arm it.",
     parameters: typebox_exports.Object({}),
     async execute() {
       const paths = resolvePaths(process.env);
@@ -41299,7 +41911,7 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_trigger_add",
     label: "pi-dispatch add trigger",
-    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. Webhook triggers take an optional `forge` = github (default) | gitlab | forgejo | azure, which also decides which action words pull_request accepts: github is labeled|opened|synchronize|reopened|review_submitted, gitlab is open|update|reopen|approved, forgejo is label_updated|opened|synchronized|reopened, azure is created|updated. An azure label or comment trigger must also set `repository` (a work item belongs to a project, not a repository), and an azure pull_request trigger may not carry labels[] at all. A github review_submitted trigger may also set reviewState[] (approved|changes_requested|commented) to narrow which verdicts fire; omitted, all three do. For webhook triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model.",
+    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request|issue. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. issue fires when an ISSUE closes: it needs flow, its action[] defaults to the forge's close word (github/forgejo closed, gitlab close; azure has no close trigger), and it may set `number` (the forge's own item number, narrowing the rule to that one issue) and `once: true` (a one-shot: it fires once, the run is recorded, then the worker disarms the entry by writing on.disarmed; once requires number). A close-only pull_request rule accepts the same number/once narrowing. Webhook triggers take an optional `forge` = github (default) | gitlab | forgejo | azure, which also decides which action words pull_request accepts: github is labeled|opened|synchronize|reopened|review_submitted|closed, gitlab is open|update|reopen|approved|close, forgejo is label_updated|opened|synchronized|reopened|closed, azure is created|updated (no close word). The close word rides alone: it cannot be mixed with other actions in one entry. An azure label or comment trigger must also set `repository` (a work item belongs to a project, not a repository), and an azure pull_request trigger may not carry labels[] at all. A github review_submitted trigger may also set reviewState[] (approved|changes_requested|commented) to narrow which verdicts fire; omitted, all three do. For webhook triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model.",
     executionMode: "sequential",
     parameters: typebox_exports.Object({
       kind: typebox_exports.String(),
@@ -41316,13 +41928,18 @@ function registerTools(pi) {
       phrase: typebox_exports.Optional(typebox_exports.String()),
       labels: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
       action: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
+      // The close-trigger narrowings (issue #231), read only by the close-capable arms of
+      // buildTriggerEntry and refused fail-loud by the shared validator everywhere else -- the
+      // `repository` posture above, restated for the two fields whose whole point is narrowing spend.
+      number: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      once: typebox_exports.Optional(typebox_exports.Boolean()),
       model: typebox_exports.Optional(typebox_exports.String()),
       provider: typebox_exports.Optional(typebox_exports.String()),
       maxTurns: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
     }),
     async execute(_id, params, _signal, _onUpdate, ctx) {
       const entry = buildTriggerEntry(params.kind, params);
-      if (!entry) throw new Error(`unknown trigger kind '${params.kind}' (cron|label|comment|pull_request)`);
+      if (!entry) throw new Error(`unknown trigger kind '${params.kind}' (cron|label|comment|pull_request|issue)`);
       const result = await confirmedWrite(
         ctx,
         { title: `Add ${params.kind} trigger`, message: `Add to triggers.json:
@@ -41475,6 +42092,113 @@ ${JSON.stringify(before)}
       return toolText(JSON.stringify(result));
     }
   });
+  pi.registerTool({
+    name: "dispatch_limits",
+    label: "pi-dispatch scoped limits",
+    description: "Read-only. Lists the scoped limits (per repo/folder budget caps and concurrency, scoped-limits.json) with their array index and, when the queue is reachable, each scope's used day/week/month run counts. Use the index for dispatch_limit_edit / dispatch_limit_delete. The always-on one-job-per-folder mutex for local jobs is separate: it has no entry here and no switch anywhere.",
+    parameters: typebox_exports.Object({}),
+    async execute() {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      if (!Array.isArray(p?.limits)) return toolText(JSON.stringify(p));
+      const counters = await readScopedBudget({ url: paths.valkeyUrl, limits: p.limits });
+      const rows = p.limits.map((l, index) => ({ index, ...l, used: counters.rows?.[index] ?? null }));
+      return toolText(JSON.stringify(rows));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_add",
+    label: "pi-dispatch add scoped limit",
+    description: 'Adds a scoped limit and applies it live: jobs whose scope (a repo "owner/name" or a local folder path, ABSOLUTE, matched exactly like pause windows \u2014 no globs) exceed the `day`/`week`/`month` job-count caps are REFUSED before any spend (reason scope-cap, never retried); jobs over `concurrent` are DEFERRED, never dropped, and run when a slot frees. At least one of day/week/month/concurrent is required, each an integer >= 1. The operator MUST approve a confirm dialog showing the entry; refused with no interactive operator.',
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({
+      scope: typebox_exports.String(),
+      day: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      week: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      month: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      concurrent: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
+    }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const l = buildScopedLimit(params);
+      const result = await confirmedWrite(
+        ctx,
+        { title: "Add scoped limit", message: `Add to scoped-limits.json:
+${JSON.stringify(l)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (list) => [...list, l] });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, added: l };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_delete",
+    label: "pi-dispatch delete scoped limit",
+    description: "Removes a scoped limit (by array index from dispatch_limits) and applies it live. The operator MUST approve a confirm dialog showing the limit; refused with no interactive operator.",
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({ index: typebox_exports.Integer({ minimum: 0 }) }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const list = Array.isArray(p?.limits) ? p.limits : [];
+      const cur = list[params.index];
+      if (!cur) throw new Error(`no scoped limit at index ${params.index} (have ${list.length})`);
+      const result = await confirmedWrite(
+        ctx,
+        { title: `Delete scoped limit #${params.index + 1}`, message: `Remove scoped limit #${params.index + 1}: ${cur.scope} ${limitSummary(cur)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.filter((_, i) => i !== params.index) });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, deletedIndex: params.index };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_edit",
+    label: "pi-dispatch edit scoped limit",
+    description: "Changes fields of an existing scoped limit (by array index from dispatch_limits) and applies it live. Provide only the fields to change (scope/day/week/month/concurrent); the rest keep their current value (to drop one cap from an entry, delete it and re-add without that field). The operator MUST approve a confirm dialog showing the before->after; refused with no interactive operator.",
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({
+      index: typebox_exports.Integer({ minimum: 0 }),
+      scope: typebox_exports.Optional(typebox_exports.String()),
+      day: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      week: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      month: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      concurrent: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
+    }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const list = Array.isArray(p?.limits) ? p.limits : [];
+      const cur = list[params.index];
+      if (!cur) throw new Error(`no scoped limit at index ${params.index} (have ${list.length})`);
+      const before = buildScopedLimit(cur);
+      const merged = buildScopedLimit({
+        scope: params.scope ?? cur.scope,
+        day: params.day ?? cur.day,
+        week: params.week ?? cur.week,
+        month: params.month ?? cur.month,
+        concurrent: params.concurrent ?? cur.concurrent
+      });
+      const result = await confirmedWrite(
+        ctx,
+        { title: `Edit scoped limit #${params.index + 1}`, message: `scoped limit #${params.index + 1}:
+${JSON.stringify(before)}
+\u2192 ${JSON.stringify(merged)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.map((w, i) => i === params.index ? merged : w) });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, index: params.index, limit: merged };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
   pi.registerTool({
     name: "dispatch_trigger_delete",
     label: "pi-dispatch delete trigger",
@@ -41533,6 +42257,17 @@ function buildTriggerEntry(kind, f) {
     const on = { type: "pull_request", action: asWords(f.action) };
     const any = asWords(f.labels ?? f.any);
     if (any.length > 0) on.any = any;
+    const prNumber = optInt(f.number);
+    if (prNumber !== void 0) on.number = prNumber;
+    if (typeof f.once === "boolean") on.once = f.once;
+    return { on, run: { kind: forge, flow: f.flow } };
+  }
+  if (kind === "issue") {
+    const action = asWords(f.action);
+    const on = { type: "issue", action: action.length > 0 ? action : [ISSUE_CLOSE_WORD[forge] ?? "closed"] };
+    const number = optInt(f.number);
+    if (number !== void 0) on.number = number;
+    if (typeof f.once === "boolean") on.once = f.once;
     return { on, run: { kind: forge, flow: f.flow } };
   }
   return null;
@@ -41549,6 +42284,22 @@ function buildPauseWindow(f) {
   if (dateTo) w.dateTo = dateTo;
   return w;
 }
+function buildScopedLimit(f) {
+  const l = { scope: String(f.scope ?? "").trim() };
+  for (const k of ["day", "week", "month", "concurrent"]) {
+    const v = optInt(f[k]);
+    if (v !== void 0) l[k] = v;
+  }
+  return l;
+}
+function limitSummary(l) {
+  const bits = [];
+  if (Number.isInteger(l?.day)) bits.push(`day ${l.day}`);
+  if (Number.isInteger(l?.week)) bits.push(`week ${l.week}`);
+  if (Number.isInteger(l?.month)) bits.push(`month ${l.month}`);
+  if (Number.isInteger(l?.concurrent)) bits.push(`\u2264${l.concurrent} at once`);
+  return bits.join(" \xB7 ");
+}
 function asWords(x) {
   if (Array.isArray(x)) return x.map((s) => String(s).trim()).filter(Boolean);
   return splitWords(x);
@@ -41584,7 +42335,7 @@ async function dispatch(pi, args, ctx) {
     if (det.state === "pointer" && !runtimeSkewNoticed) {
       const ptrRes = readPointer({ path: pointerPath(process.env) });
       const deploymentDir = ptrRes.pointer?.deploymentDir;
-      const installed = deploymentDir ? readInstalledVersion2(nodeFs5, runtimeDirFor2(deploymentDir)) : void 0;
+      const installed = deploymentDir ? readInstalledVersion2(nodeFs6, runtimeDirFor2(deploymentDir)) : void 0;
       if (typeof installed === "string" && installed !== RUNTIME_VERSION2) {
         runtimeSkewNoticed = true;
         notify?.(
@@ -41618,7 +42369,11 @@ ${renderBudget({ budget, settings: settings2 })}`);
     case "budget": {
       const budget = await readBudget({ url: paths.valkeyUrl });
       const settings2 = readSettingsView({ settingsFile: paths.settingsFile });
-      send(pi, renderBudget({ budget, settings: settings2 }));
+      const limits = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const scopedBudget = Array.isArray(limits?.limits) && limits.limits.length > 0 ? await readScopedBudget({ url: paths.valkeyUrl, limits: limits.limits }) : { rows: [] };
+      const scopedText = renderScopedLimits({ limits, scopedBudget });
+      send(pi, `${renderBudget({ budget, settings: settings2 })}${scopedText ? `
+${scopedText}` : ""}`);
       return;
     }
     case "triggers": {
@@ -41699,13 +42454,14 @@ ${renderBudget({ budget, settings: settings2 })}`);
       return;
   }
 }
-function assembleCosts(paths, window, flow) {
+function assembleCosts(paths, window, flow, repo) {
   const nowMs = Date.now();
   const sinceMs = costsSinceMs(window, nowMs);
   const records = scanRunRecords({ logsDir: paths.logsDir, sinceMs, nowMs });
   if (!Array.isArray(records)) return records;
   const subs = readSubscriptions({ subscriptionsPath: paths.subscriptionsPath });
-  const scoped = typeof flow === "string" && flow !== "" ? records.filter((r) => (r?.flow ?? null) === flow) : records;
+  const flowScoped = typeof flow === "string" && flow !== "" ? records.filter((r) => (r?.flow ?? null) === flow) : records;
+  const scoped = typeof repo === "string" && repo !== "" ? flowScoped.filter((r) => repoOfTarget(r?.target) === repo) : flowScoped;
   const triggersView = readTriggers({ triggersPath: paths.triggersPath });
   const triggerJoin = attributeRunsToTriggers({ records: scoped, triggers: Array.isArray(triggersView?.triggers) ? triggersView.triggers : [] });
   const fold = foldCosts({
@@ -41743,7 +42499,7 @@ async function assembleGraph(paths) {
   });
 }
 function realArtifactDeps() {
-  return { fs: nodeFs5, openBrowser, env: process.env, now: () => Date.now(), platform: process.platform };
+  return { fs: nodeFs6, openBrowser, env: process.env, now: () => Date.now(), platform: process.platform };
 }
 function isHeadlessEnv(env, platform) {
   if (env?.SSH_CONNECTION || env?.SSH_TTY) return "SSH session";
@@ -41768,13 +42524,27 @@ async function assembleBudgetView(paths) {
   const tokensSpent = unreachable === null ? Number(raw.tokensToday ?? 0) : null;
   const tokenCap = posIntOrNull(overlay.dailyTokenCap);
   const tokenState = tokenCap !== null && tokensSpent !== null ? tokensSpent >= tokenCap ? "over" : pct !== null && tokensSpent > Math.floor(tokenCap * pct / 100) ? "soft-hold" : "ok" : "ok";
+  const limitsView = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const limits = Array.isArray(limitsView?.limits) ? limitsView.limits : [];
+  const scopedCounters = limits.length > 0 ? await readScopedBudget({ url: paths.valkeyUrl, limits }) : { rows: [] };
+  const scoped = limits.map((l, i) => {
+    const used = scopedCounters?.rows?.[i] ?? null;
+    const win = (cap, key) => {
+      if (cap === null) return null;
+      const u = used && Number.isFinite(used[key]) ? used[key] : null;
+      return { used: u, cap, state: u !== null ? windowState(u, cap, null) : "ok" };
+    };
+    return { scope: l.scope, day: win(l.day, "day"), week: win(l.week, "week"), month: win(l.month, "month"), concurrent: l.concurrent };
+  });
   return {
     unreachable,
     softHoldPct: pct,
     day: slotWindow("day", "dailyCap"),
     week: slotWindow("week", "weeklyCap"),
     month: slotWindow("month", "monthlyCap"),
-    tokens: { spent: tokensSpent, cap: tokenCap, state: tokenState, maxTokens: posIntOrNull(overlay.maxTokens) }
+    tokens: { spent: tokensSpent, cap: tokenCap, state: tokenState, maxTokens: posIntOrNull(overlay.maxTokens) },
+    scoped,
+    scopedInvalid: limitsView?.invalid ? String(limitsView.invalid) : null
   };
 }
 async function assembleInsights(paths, window) {
@@ -41941,7 +42711,7 @@ could not start docker: ${error.message}
   }
 }
 function pauseForMessage() {
-  return new Promise((resolve2) => setTimeout(resolve2, 2500));
+  return new Promise((resolve3) => setTimeout(resolve3, 2500));
 }
 function splitWords(s) {
   return String(s ?? "").split(/\s+/).map((w) => w.trim()).filter(Boolean);
@@ -41967,7 +42737,83 @@ async function handleDashboardAction(result, paths, ctx) {
       return editSettingsViaDialogs(paths, ui, notify);
     case "managePauses":
       return managePausesViaDialogs(paths, ui, notify);
+    case "manageLimits":
+      return manageLimitsViaDialogs(paths, ui, notify);
+  }
+}
+async function manageLimitsViaDialogs(paths, ui, notify) {
+  const action = await ui.select("Scoped limits", ["Add a scoped limit", "Edit a scoped limit", "Delete a scoped limit"]);
+  if (!action) return;
+  if (action.startsWith("Add")) return addScopedLimitViaDialogs(paths, ui, notify);
+  if (action.startsWith("Edit")) return editScopedLimitViaDialogs(paths, ui, notify);
+  return deleteScopedLimitViaDialogs(paths, ui, notify);
+}
+async function addScopedLimitViaDialogs(paths, ui, notify) {
+  const scope = await ui.input('scope \u2014 a repo "owner/name" or an ABSOLUTE local folder path (exact match, no globs)', "");
+  if (scope === void 0 || scope.trim() === "") return;
+  const day = await ui.input("day \u2014 max jobs per UTC day for this scope (blank = no day cap)", "");
+  if (day === void 0) return;
+  const week = await ui.input("week \u2014 max jobs per Mon-Sun UTC week (blank = no week cap)", "");
+  if (week === void 0) return;
+  const month = await ui.input("month \u2014 max jobs per calendar month (blank = no month cap)", "");
+  if (month === void 0) return;
+  const concurrent = await ui.input("concurrent \u2014 max jobs in flight for this scope, extras deferred (blank = no limit)", "");
+  if (concurrent === void 0) return;
+  const l = buildScopedLimit({ scope, day, week, month, concurrent });
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (list) => [...list, l] });
+  notify?.(res.ok ? `scoped limit added (live) \u2014 ${l.scope} ${limitSummary(l)}` : `add rejected: ${res.invalid}`, res.ok ? "info" : "error");
+}
+async function editScopedLimitViaDialogs(paths, ui, notify) {
+  const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const list = Array.isArray(p?.limits) ? p.limits : [];
+  if (list.length === 0) {
+    notify?.("no scoped limits to edit", "info");
+    return;
   }
+  const labels = list.map((l, i) => `#${i + 1}  ${l.scope}  ${limitSummary(l)}`);
+  const picked = await ui.select("Edit which scoped limit", labels);
+  if (!picked) return;
+  const index = labels.indexOf(picked);
+  if (index < 0) return;
+  const cur = list[index];
+  const ask = async (label, current) => ui.input(`${label} \u2014 blank keeps "${current}"`, current);
+  const keep = (v, current) => v === void 0 || v.trim() === "" ? current : v;
+  const scope = await ask("scope", cur.scope ?? "");
+  if (scope === void 0) return;
+  const day = await ask("day cap", String(cur.day ?? ""));
+  if (day === void 0) return;
+  const week = await ask("week cap", String(cur.week ?? ""));
+  if (week === void 0) return;
+  const month = await ask("month cap", String(cur.month ?? ""));
+  if (month === void 0) return;
+  const concurrent = await ask("concurrent (max in flight)", String(cur.concurrent ?? ""));
+  if (concurrent === void 0) return;
+  const merged = buildScopedLimit({
+    scope: keep(scope, cur.scope),
+    day: keep(day, cur.day),
+    week: keep(week, cur.week),
+    month: keep(month, cur.month),
+    concurrent: keep(concurrent, cur.concurrent)
+  });
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.map((w, i) => i === index ? merged : w) });
+  notify?.(res.ok ? `scoped limit #${index + 1} updated (live) \u2014 ${merged.scope} ${limitSummary(merged)}` : `edit rejected: ${res.invalid}`, res.ok ? "info" : "error");
+}
+async function deleteScopedLimitViaDialogs(paths, ui, notify) {
+  const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const list = Array.isArray(p?.limits) ? p.limits : [];
+  if (list.length === 0) {
+    notify?.("no scoped limits to delete", "info");
+    return;
+  }
+  const labels = list.map((l, i) => `#${i + 1}  ${l.scope}  ${limitSummary(l)}`);
+  const picked = await ui.select("Delete which scoped limit", labels);
+  if (!picked) return;
+  const index = labels.indexOf(picked);
+  if (index < 0) return;
+  const ok = await ui.confirm("Delete scoped limit", `Remove ${labels[index]}?`);
+  if (!ok) return;
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.filter((_, i) => i !== index) });
+  notify?.(res.ok ? `scoped limit #${index + 1} deleted (live)` : `delete rejected: ${res.invalid}`, res.ok ? "info" : "error");
 }
 async function managePausesViaDialogs(paths, ui, notify) {
   const action = await ui.select("Pause windows", ["Add a pause window", "Edit a pause window", "Delete a pause window"]);
@@ -42269,7 +43115,7 @@ function completeArguments(prefix) {
   }
   return null;
 }
-var USED_API, SUPPORTED_PI_VERSION, piVersionAdvisory, piVersionCheckDone, runtimeSkewNoticed, CHANNEL, REBUILT_NOTICE, USAGE, KNOWN_SUBCOMMANDS, FORGE_PROMPT, PR_ACTION_VOCAB, PRICING, INSIGHTS_USAGE, VIEWPORT_LINES;
+var USED_API, SUPPORTED_PI_VERSION, piVersionAdvisory, piVersionCheckDone, runtimeSkewNoticed, CHANNEL, REBUILT_NOTICE, USAGE, KNOWN_SUBCOMMANDS, FORGE_PROMPT, ISSUE_CLOSE_WORD, PR_ACTION_VOCAB, PRICING, INSIGHTS_USAGE, VIEWPORT_LINES;
 var init_index = __esm({
   "src/index.ts"() {
     init_build();
@@ -42312,10 +43158,14 @@ var init_index = __esm({
       "secrets"
     ];
     FORGE_PROMPT = "forge \u2014 github, gitlab, forgejo or azure";
+    ISSUE_CLOSE_WORD = { github: "closed", gitlab: "close", forgejo: "closed" };
     PR_ACTION_VOCAB = {
-      github: { hint: "labeled opened synchronize reopened review_submitted", dflt: "labeled" },
-      gitlab: { hint: "open update reopen approved", dflt: "update" },
-      forgejo: { hint: "label_updated opened synchronized reopened", dflt: "label_updated" },
+      // The close words ride the hint too (issue #231): the dialog passes whatever is typed through the
+      // shared validator, so a close-only rule IS authorable here, and a hint that omits the word reads
+      // as the word not existing. The loader refuses a list mixing a close word with any other action.
+      github: { hint: "labeled opened synchronize reopened review_submitted closed", dflt: "labeled" },
+      gitlab: { hint: "open update reopen approved close", dflt: "update" },
+      forgejo: { hint: "label_updated opened synchronized reopened closed", dflt: "label_updated" },
       azure: { hint: "created updated", dflt: "updated" }
     };
     PRICING = { listPricedModels, getPricedModel, isZeroRated, reprice, piAiVersion };