@geonosis/ratchet 2.5.0 → 2.5.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @geonosis/ratchet
 
+## 2.5.2
+
+## 2.5.1
+
+### Patch Changes
+
+- 7f24da6: A machine-wide heavy budget, two slots, held by every tool that spends one (#385): measured load 48
+  with during.day's Stop-hook tier, this kit's Stop-hook tier, its ratchet and an engineer's suite all
+  running at once — nothing held the two-slot budget across the two repos, and three kit tests read
+  red under it that were green alone. `@geonosis/ratchet` ships `takeSlot`/`heavySlotDir` (a lock
+  directory under `os.tmpdir()/geonosis-heavy`, two slot files each holding `{ pid, command, cwd,
+  startedAt }`, a dead holder reaped on the next take, a taker that finds both held waiting once
+  before refusing naming them); `geonosis-verify` (each tier run) and `geonosis-ratchet` (the run, not
+  `--prove`'s inner unit) take a slot for the run's duration. `@geonosis/release`'s `smoke
+  baseline`/`smoke run` take one too, from their own copy (this layer imports nothing, same posture as
+  `envelope.ts`). The plugin's Stop hook reads a fresh green `gate-report.<tier>.json` — its own
+  recorded commit equal to the current `HEAD` with a clean tree — and reports PASS without re-running;
+  otherwise it peeks the same two slots (never claims one itself, or the verify child it is about to
+  spawn would be racing against its own reservation) and blocks naming both holders rather than
+  running a third tier.
+
 ## 2.5.0
 
 ## 2.4.3

package/bin/geonosis-ratchet.mjs

@@ -9,11 +9,19 @@ import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = dirname(fileURLToPath(import.meta.url))
-const newest = (dir) =>
+// tsup never reads a test file, so one counting as source made every bin refuse a build that had
+// not gone stale (#399).
+const NOT_SOURCE = (name) =>
+  name.endsWith('.test.ts') ||
+  name.endsWith('.test.tsx') ||
+  name === '__tests__' ||
+  name === '__fixtures__'
+const newest = (dir, skip) =>
   existsSync(dir)
     ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
+        if (skip !== undefined && skip(entry.name)) return most
         const at = join(dir, entry.name)
-        return Math.max(most, entry.isDirectory() ? newest(at) : statSync(at).mtimeMs)
+        return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
       }, 0)
     : 0
 const src = join(here, '..', 'src')
@@ -30,7 +38,7 @@ if (existsSync(src)) {
     )
     process.exit(2)
   }
-  if (newest(src) > built) {
+  if (newest(src, NOT_SOURCE) > built) {
     process.stderr.write(
       'geonosis-ratchet: dist is older than src — run pnpm build before trusting this bin.\n',
     )

package/dist/{chunk-2EAYMSC5.js → chunk-WENVCC67.js}

@@ -70,23 +70,53 @@ var versionOf = (moduleUrl) => {
   }
 };
 
-// src/core/lock.ts
+// src/core/heavy-slot.ts
+import { readFileSync as readFileSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+
+// src/core/file-claim.ts
 import { randomUUID } from "crypto";
-import { linkSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, isAbsolute, join as join2 } from "path";
-var heavyLockPath = () => {
-  const named = process.env.GEONOSIS_HEAVY_LOCK;
-  if (named !== void 0 && named !== "") return named;
-  const declared = process.env.XDG_CACHE_HOME;
-  const cache = declared !== void 0 && isAbsolute(declared) ? declared : join2(homedir(), ".cache");
-  return join2(cache, "geonosis", "heavy.lock");
+import { linkSync, mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
 };
 var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+var claimFile = (path, holder) => {
+  mkdirSync2(dirname2(path), { recursive: true });
+  const staging = `${path}.${holder.pid}.${randomUUID()}`;
+  try {
+    writeFileSync2(staging, JSON.stringify(holder));
+    linkSync(staging, path);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    rmSync(staging, { force: true });
+  }
+};
+
+// src/core/heavy-slot.ts
+var HEAVY_SLOTS = 2;
+var DEFAULT_WAIT_MS = 20 * 6e4;
+var heavySlotDir = () => {
+  const named = process.env.GEONOSIS_HEAVY_SLOT_DIR;
+  if (named !== void 0 && named !== "") return named;
+  return join2(tmpdir(), "geonosis-heavy");
+};
+var slotPath = (dir, at) => join2(dir, `slot-${at}.json`);
 var holderOf = (path) => {
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
     return typeof parsed.pid === "number" ? {
+      command: parsed.command ?? "unknown",
       cwd: parsed.cwd ?? "somewhere",
       pid: parsed.pid,
       startedAt: parsed.startedAt ?? "unknown"
@@ -95,12 +125,79 @@ var holderOf = (path) => {
     return void 0;
   }
 };
-var alive = (pid) => {
+var reapIfDead = (path) => {
+  const holder = holderOf(path);
+  if (holder !== void 0 && !alive(holder.pid)) rmSync2(path, { force: true });
+};
+var claim = (path, holder) => claimFile(path, holder);
+var namedHolders = (dir) => Array.from({ length: HEAVY_SLOTS }, (_unused, at) => holderOf(slotPath(dir, at))).filter(
+  (holder) => holder !== void 0
+);
+var describeHolders = (holders) => holders.map((one) => `${one.pid} ${one.command} since ${one.startedAt}`).join(", ");
+var HeavySlotTimeout = class extends Error {
+};
+var takeSlot = async ({
+  command,
+  cwd = process.cwd(),
+  dir = heavySlotDir(),
+  pollMs = 250,
+  say = (line) => process.stderr.write(`${line}
+`),
+  waitMs = Number(process.env.GEONOSIS_HEAVY_WAIT_MS ?? "") || DEFAULT_WAIT_MS
+}) => {
+  const until = Date.now() + waitMs;
+  let told = false;
+  for (; ; ) {
+    for (let at = 0; at < HEAVY_SLOTS; at += 1) {
+      const path = slotPath(dir, at);
+      reapIfDead(path);
+      const mine = {
+        command,
+        cwd,
+        pid: process.pid,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      if (claim(path, mine)) {
+        return () => {
+          if (holderOf(path)?.pid === process.pid) rmSync2(path, { force: true });
+        };
+      }
+    }
+    const holders = namedHolders(dir);
+    if (!told) {
+      told = true;
+      say(`waiting for a heavy slot: ${holders.length} held \u2014 ${describeHolders(holders)}`);
+    }
+    if (Date.now() >= until) {
+      throw new HeavySlotTimeout(
+        `waited ${waitMs} ms for a heavy slot: ${holders.length} held \u2014 ${describeHolders(holders)}`
+      );
+    }
+    await sleep(pollMs);
+  }
+};
+
+// src/core/lock.ts
+import { readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join as join3 } from "path";
+var heavyLockPath = () => {
+  const named = process.env.GEONOSIS_HEAVY_LOCK;
+  if (named !== void 0 && named !== "") return named;
+  const declared = process.env.XDG_CACHE_HOME;
+  const cache = declared !== void 0 && isAbsolute(declared) ? declared : join3(homedir(), ".cache");
+  return join3(cache, "geonosis", "heavy.lock");
+};
+var holderOf2 = (path) => {
   try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    return typeof parsed.pid === "number" ? {
+      cwd: parsed.cwd ?? "somewhere",
+      pid: parsed.pid,
+      startedAt: parsed.startedAt ?? "unknown"
+    } : void 0;
+  } catch {
+    return void 0;
   }
 };
 var heldFor = (holder) => {
@@ -108,25 +205,7 @@ var heldFor = (holder) => {
   if (Number.isNaN(since)) return "an unknown time";
   return `${Math.round((Date.now() - since) / 1e3)}s`;
 };
-var write = (path) => {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const mine = {
-    cwd: process.cwd(),
-    pid: process.pid,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const staging = `${path}.${process.pid}.${randomUUID()}`;
-  try {
-    writeFileSync2(staging, JSON.stringify(mine));
-    linkSync(staging, path);
-    return true;
-  } catch (error) {
-    if (error.code === "EEXIST") return false;
-    throw error;
-  } finally {
-    rmSync(staging, { force: true });
-  }
-};
+var write = (path) => claimFile(path, { cwd: process.cwd(), pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() });
 var acquireExclusive = async ({
   noticeMs = 15e3,
   path = heavyLockPath(),
@@ -138,16 +217,16 @@ var acquireExclusive = async ({
   const until = Date.now() + timeoutSeconds * 1e3;
   let told = 0;
   const release = () => {
-    if (holderOf(path)?.pid === process.pid) rmSync(path, { force: true });
+    if (holderOf2(path)?.pid === process.pid) rmSync3(path, { force: true });
   };
   for (; ; ) {
     if (write(path)) return release;
-    const holder = holderOf(path);
+    const holder = holderOf2(path);
     if (holder === void 0 || !alive(holder.pid)) {
       say(
         `geonosis-ratchet: taking over a stale heavy lock (pid ${holder?.pid ?? "unreadable"} is gone)`
       );
-      rmSync(path, { force: true });
+      rmSync3(path, { force: true });
       continue;
     }
     if (Date.now() >= until) {
@@ -167,7 +246,7 @@ var acquireExclusive = async ({
 };
 
 // src/core/config.ts
-import { existsSync, readFileSync as readFileSync3 } from "fs";
+import { existsSync, readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve2 } from "path";
 var CONFIG_FILE = "geonosis.ratchet.json";
 var keyOf = (entry) => entry.key ?? entry.counter;
@@ -176,7 +255,7 @@ var loadConfig = (cwd) => {
   if (!existsSync(path)) {
     throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 the ratchet has nothing to count`);
   }
-  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
   if (!Array.isArray(parsed.counters)) {
     throw new Error(`${CONFIG_FILE} has no "counters" array`);
   }
@@ -204,7 +283,7 @@ var loadConfig = (cwd) => {
 };
 var resolveBaseline = (cwd) => {
   try {
-    const parsed = JSON.parse(readFileSync3(resolve2(cwd, CONFIG_FILE), "utf8"));
+    const parsed = JSON.parse(readFileSync4(resolve2(cwd, CONFIG_FILE), "utf8"));
     return typeof parsed.baseline === "string" ? parsed.baseline : "gate-baseline.json";
   } catch {
     return "gate-baseline.json";
@@ -250,9 +329,9 @@ ${output.trim()}`
 };
 
 // src/core/prove.ts
-import { existsSync as existsSync2, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir } from "os";
-import { delimiter, dirname as dirname4, join as join3, resolve as resolve4 } from "path";
+import { existsSync as existsSync2, mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { delimiter, dirname as dirname4, join as join4, resolve as resolve4 } from "path";
 
 // src/core/exclusive.ts
 import { spawn } from "child_process";
@@ -323,7 +402,7 @@ var toolPath = (cwd) => {
   const dirs = [];
   let dir = resolve4(cwd);
   for (; ; ) {
-    const bin = join3(dir, "node_modules", ".bin");
+    const bin = join4(dir, "node_modules", ".bin");
     if (existsSync2(bin)) dirs.push(bin);
     const parent = dirname4(dir);
     if (parent === dir) break;
@@ -333,7 +412,7 @@ var toolPath = (cwd) => {
 };
 var NO_PROBE = "no probe \u2014 a counter nobody has seen read a planted finding has not been shown to measure";
 var oneProofOf = async (counter, key, path, probe) => {
-  const dir = mkdtempSync(join3(tmpdir(), "geonosis-prove-"));
+  const dir = mkdtempSync(join4(tmpdir2(), "geonosis-prove-"));
   try {
     probe.input(dir);
     const command = probe.command?.(dir);
@@ -351,7 +430,7 @@ var oneProofOf = async (counter, key, path, probe) => {
   } catch (error) {
     return { counter: counter.id, key, reason: error.message, verdict: "cannot-measure" };
   } finally {
-    rmSync2(dir, { force: true, recursive: true });
+    rmSync4(dir, { force: true, recursive: true });
   }
 };
 var probesOf = (counter) => {
@@ -417,7 +496,7 @@ var runProve = async ({
       const entryProbe = {
         command: () => "cat sample.txt",
         expect: declared.expect,
-        input: (dir) => writeFileSync3(join3(dir, "sample.txt"), sample),
+        input: (dir) => writeFileSync3(join4(dir, "sample.txt"), sample),
         name: "configured reading",
         params: Object.fromEntries(customized.map((one) => [one, entry[one]]))
       };
@@ -434,20 +513,20 @@ var runProve = async ({
     }
   }
   if (exclusiveVia !== void 0) {
-    const dir = mkdtempSync(join3(tmpdir(), "geonosis-lock-"));
+    const dir = mkdtempSync(join4(tmpdir2(), "geonosis-lock-"));
     try {
-      const proof = await proveExclusive({ cli: exclusiveVia, lockPath: join3(dir, "heavy.lock") });
+      const proof = await proveExclusive({ cli: exclusiveVia, lockPath: join4(dir, "heavy.lock") });
       proofs.push(proof);
       if (proof.verdict !== "serialised") return { proofs, proven: false };
     } finally {
-      rmSync2(dir, { force: true, recursive: true });
+      rmSync4(dir, { force: true, recursive: true });
     }
   }
   return { proofs, proven: true };
 };
 
 // src/core/ratchet.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve5 } from "path";
 var EVIDENCE_LINES = 10;
 var recorded = (counter, params, run) => {
@@ -499,7 +578,7 @@ var runRatchet = async ({
   if (!existsSync3(baselinePath)) {
     throw new Error(`no ${config.baseline} in ${cwd} \u2014 nothing to ratchet against`);
   }
-  const baseline = JSON.parse(readFileSync4(baselinePath, "utf8"));
+  const baseline = JSON.parse(readFileSync5(baselinePath, "utf8"));
   const byId = new Map(counters.map((one) => [one.id, one]));
   const measurements = [];
   const refusals = [];
@@ -581,9 +660,9 @@ var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/counters/plant.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, join as join4 } from "path";
+import { dirname as dirname5, join as join5 } from "path";
 var plant = (dir, relative, contents) => {
-  const path = join4(dir, relative);
+  const path = join5(dir, relative);
   mkdirSync3(dirname5(path), { recursive: true });
   writeFileSync5(path, contents);
 };
@@ -674,8 +753,8 @@ var bundleBytes = {
 };
 
 // src/counters/ci.ts
-import { readdirSync, readFileSync as readFileSync5 } from "fs";
-import { join as join5, resolve as resolve6 } from "path";
+import { readdirSync, readFileSync as readFileSync6 } from "fs";
+import { join as join6, resolve as resolve6 } from "path";
 var DISABLED = /\bif:[ \t]*false\b/;
 var WORKFLOW = /\.ya?ml$/;
 var disabledCiJobs = {
@@ -693,7 +772,7 @@ var disabledCiJobs = {
     const dir = resolve6(cwd, relative);
     let files;
     try {
-      files = readdirSync(dir, { withFileTypes: true }).filter((entry) => WORKFLOW.test(entry.name)).map((entry) => join5(dir, entry.name));
+      files = readdirSync(dir, { withFileTypes: true }).filter((entry) => WORKFLOW.test(entry.name)).map((entry) => join6(dir, entry.name));
     } catch {
       return 0;
     }
@@ -701,7 +780,7 @@ var disabledCiJobs = {
     for (const file of files) {
       let contents;
       try {
-        contents = readFileSync5(file, "utf8");
+        contents = readFileSync6(file, "utf8");
       } catch (error) {
         throw new CounterError(
           "disabledCiJobs",
@@ -790,10 +869,10 @@ ${said.slice(-500)}`
     return Number(found);
   }
 };
-var HEADING = /^([A-Z][A-Za-z ]+?) \((\d+)\)\s*$/gm;
+var HEADING_LINE = /^([A-Z][A-Za-z ]+?) \((\d+)\)\s*$/;
 var headingsIn = (output) => {
   const found = /* @__PURE__ */ new Map();
-  for (const [, heading = "", count = "0"] of output.matchAll(HEADING)) {
+  for (const [, heading = "", count = "0"] of output.matchAll(new RegExp(HEADING_LINE, "gm"))) {
     found.set(heading, Number(count));
   }
   return found;
@@ -804,7 +883,6 @@ var excusesIn = (params) => {
     typeof declared === "object" && declared !== null && !Array.isArray(declared) ? Object.keys(declared) : []
   );
 };
-var HEADING_LINE = /^([A-Z][A-Za-z ]+?) \((\d+)\)\s*$/;
 var UNRESOLVED = "Unresolved imports";
 var KNIP_DEFAULT = "npx knip --reporter compact";
 var knipEvidence = ({
@@ -864,7 +942,7 @@ var boundaryIssues = {
 };
 
 // src/counters/dx.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve7 } from "path";
 var DEFAULT_BUMP_REPORT = ".geonosis/bump-report.json";
 var bumpFile = (id, cwd, params) => {
@@ -877,7 +955,7 @@ var bumpFile = (id, cwd, params) => {
     );
   }
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch (error) {
     throw new CounterError(id, `${relative} is not readable JSON: ${error.message}`);
   }
@@ -963,7 +1041,7 @@ var openBacklogRows = {
     if (!existsSync4(at)) {
       throw new CounterError("openBacklogRows", `no register at ${relative}`);
     }
-    const lines = readFileSync6(at, "utf8").split("\n");
+    const lines = readFileSync7(at, "utf8").split("\n");
     return lines.filter((line, index) => {
       if (!ROW.test(line) || SEPARATOR.test(line)) return false;
       if (SEPARATOR.test(lines[index + 1] ?? "")) return false;
@@ -995,7 +1073,7 @@ var unformattedFiles = {
 };
 
 // src/counters/gate-report.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve9 } from "path";
 var DEFAULT_REPORT = ".geonosis/gate-report.json";
 var fastTierMs = {
@@ -1029,7 +1107,7 @@ var fastTierMs = {
     }
     let report;
     try {
-      report = JSON.parse(readFileSync7(path, "utf8"));
+      report = JSON.parse(readFileSync8(path, "utf8"));
     } catch (error) {
       throw new CounterError(
         "fastTierMs",
@@ -1051,7 +1129,7 @@ var fastTierMs = {
 };
 
 // src/counters/law.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve10 } from "path";
 var lawLineCount = {
   id: "lawLineCount",
@@ -1064,12 +1142,12 @@ var lawLineCount = {
     const relative = stringParam("lawLineCount", params, "path", "CLAUDE.md");
     const path = resolve10(cwd, relative);
     if (!existsSync7(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
-    return readFileSync8(path, "utf8").replace(/\n$/, "").split("\n").length;
+    return readFileSync9(path, "utf8").replace(/\n$/, "").split("\n").length;
   }
 };
 
 // src/counters/oxlint.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync10, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
 import { resolve as resolve11 } from "path";
 var DEFAULT_COMMAND = "npx oxlint --format=unix --config .oxlintrc.json .";
 var PROBE_COMMAND = "oxlint --format=unix --config .oxlintrc.json .";
@@ -1236,7 +1314,7 @@ var oxlintRule = {
     const source = resolve11(cwd, config);
     if (!existsSync8(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
     const strictName = `.oxlintrc.ratchet-${key}.json`;
-    const strict = readFileSync9(source, "utf8").replace(
+    const strict = readFileSync10(source, "utf8").replace(
       new RegExp(`("[^"]*${escapeForRegex(rule)}"\\s*:\\s*\\[?\\s*)"(warn|off)"`),
       '$1"error"'
     );
@@ -1244,15 +1322,15 @@ var oxlintRule = {
     try {
       return countRule(run(command.replace("{config}", strictName)), rule, expect);
     } finally {
-      rmSync3(resolve11(cwd, strictName), { force: true });
+      rmSync5(resolve11(cwd, strictName), { force: true });
     }
   }
 };
 
 // src/counters/probes.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "fs";
 import { createRequire } from "module";
-import { join as join6, resolve as resolve12 } from "path";
+import { join as join7, resolve as resolve12 } from "path";
 import { pathToFileURL } from "url";
 var ID2 = "probelessRules";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
@@ -1274,7 +1352,7 @@ var enabledIn = (config, namespace) => {
 var probedBy = async (cwd, plugin) => {
   let entry;
   try {
-    entry = createRequire(join6(cwd, "noop.js")).resolve(plugin);
+    entry = createRequire(join7(cwd, "noop.js")).resolve(plugin);
   } catch (error) {
     throw new CounterError(
       ID2,
@@ -1334,7 +1412,7 @@ var probelessRules = {
     if (!existsSync9(path)) throw new CounterError(ID2, `no oxlint config at ${relative}`);
     let config;
     try {
-      config = JSON.parse(readFileSync10(path, "utf8"));
+      config = JSON.parse(readFileSync11(path, "utf8"));
     } catch (error) {
       throw new CounterError(ID2, `${relative} does not parse: ${error.message}`);
     }
@@ -1368,15 +1446,15 @@ var runtimeCodeShipped = {
 
 // src/counters/scripts.ts
 import { readdirSync as readdirSync3 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/counters/workspace.ts
-import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "fs";
-import { join as join7, resolve as resolve13 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "fs";
+import { join as join8, resolve as resolve13 } from "path";
 var SKIP = /^(node_modules|\.)/;
 var childDirs = (dir) => {
   try {
-    return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join7(dir, entry.name));
+    return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join8(dir, entry.name));
   } catch {
     return [];
   }
@@ -1386,14 +1464,14 @@ var expand = (root, pattern) => {
   const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
   let dirs = [root];
   for (const segment of segments) {
-    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join7(dir, segment)).filter((dir) => existsSync10(dir));
+    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join8(dir, segment)).filter((dir) => existsSync10(dir));
   }
   return dirs;
 };
 var QUOTED = /^['"]|['"]$/g;
 var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
 var pnpmPatterns = (path) => {
-  const lines = readFileSync11(path, "utf8").split("\n");
+  const lines = readFileSync12(path, "utf8").split("\n");
   const at = lines.findIndex((line) => line.startsWith("packages:"));
   if (at === -1) return [];
   const inline = lines[at]?.slice("packages:".length).trim() ?? "";
@@ -1412,31 +1490,25 @@ var pnpmPatterns = (path) => {
   return patterns;
 };
 var npmPatterns = (path) => {
-  const parsed = JSON.parse(readFileSync11(path, "utf8"));
+  const parsed = JSON.parse(readFileSync12(path, "utf8"));
   const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
   return declared.filter((one) => typeof one === "string");
 };
 var nameOf = (dir) => {
-  const manifest = join7(dir, "package.json");
-  if (!existsSync10(manifest)) return void 0;
-  try {
-    const { name } = JSON.parse(readFileSync11(manifest, "utf8"));
-    return typeof name === "string" && name !== "" ? name : void 0;
-  } catch {
-    return void 0;
-  }
+  const name = manifestOf(dir)?.["name"];
+  return typeof name === "string" && name !== "" ? name : void 0;
 };
 var workspaceDirs = (cwd) => {
   const root = resolve13(cwd);
-  const pnpm = join7(root, "pnpm-workspace.yaml");
-  const manifest = join7(root, "package.json");
+  const pnpm = join8(root, "pnpm-workspace.yaml");
+  const manifest = join8(root, "package.json");
   const patterns = existsSync10(pnpm) ? pnpmPatterns(pnpm) : existsSync10(manifest) ? npmPatterns(manifest) : [];
-  const dirs = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).filter((dir) => existsSync10(join7(dir, "package.json")));
+  const dirs = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).filter((dir) => existsSync10(join8(dir, "package.json")));
   return [...new Set(dirs)];
 };
 var manifestOf = (dir) => {
   try {
-    const parsed = JSON.parse(readFileSync11(join7(dir, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync12(join8(dir, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : void 0;
   } catch {
     return void 0;
@@ -1466,7 +1538,7 @@ var holdsTests = (dir, depth = 6) => {
     if (entry.isDirectory()) {
       if (entry.name === TEST_DIR) return true;
       if (SKIP2.test(entry.name) || depth === 0) continue;
-      if (holdsTests(join8(dir, entry.name), depth - 1)) return true;
+      if (holdsTests(join9(dir, entry.name), depth - 1)) return true;
       continue;
     }
     if (TEST_FILE.test(entry.name)) return true;
@@ -1504,8 +1576,8 @@ var packagesWithoutTypecheck = {
 };
 
 // src/counters/seams.ts
-import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs";
-import { join as join9, resolve as resolve14 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "fs";
+import { join as join10, resolve as resolve14 } from "path";
 var CONFIG = "geonosis.json";
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".turbo", "coverage", "dist", "node_modules"]);
 var asPattern = (glob) => new RegExp(
@@ -1515,22 +1587,22 @@ var asPattern = (glob) => new RegExp(
 );
 var filesUnder = (root, at = root) => readdirSync4(at, { withFileTypes: true }).flatMap((entry) => {
   if (SKIP_DIRS.has(entry.name)) return [];
-  const full = join9(at, entry.name);
+  const full = join10(at, entry.name);
   if (entry.isDirectory()) return filesUnder(root, full);
   return entry.isFile() ? [full.slice(root.length + 1)] : [];
 });
 var seamGlobsIn = (root) => {
-  const at = join9(root, CONFIG);
+  const at = join10(root, CONFIG);
   if (!existsSync11(at)) return [];
   try {
-    const seams = JSON.parse(readFileSync12(at, "utf8")).adoption?.seams;
+    const seams = JSON.parse(readFileSync13(at, "utf8")).adoption?.seams;
     return Array.isArray(seams) ? seams.filter((one) => typeof one === "string") : [];
   } catch {
     return [];
   }
 };
 var linesIn = (path) => {
-  const body = readFileSync12(path, "utf8");
+  const body = readFileSync13(path, "utf8");
   return body === "" ? 0 : body.replace(/\n$/, "").split("\n").length;
 };
 var adoptionSeamLines = {
@@ -1549,7 +1621,7 @@ var adoptionSeamLines = {
     const root = resolve14(cwd);
     const globs = seamGlobsIn(root).map(asPattern);
     if (globs.length === 0) return 0;
-    return filesUnder(root).filter((one) => globs.some((pattern) => pattern.test(one))).reduce((total2, one) => total2 + linesIn(join9(root, one)), 0);
+    return filesUnder(root).filter((one) => globs.some((pattern) => pattern.test(one))).reduce((total2, one) => total2 + linesIn(join10(root, one)), 0);
   }
 };
 
@@ -1575,12 +1647,14 @@ var sumOfCounts = {
 };
 
 // src/counters/suppressions.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync13 } from "fs";
-import { join as join10, resolve as resolve15 } from "path";
+import { resolve as resolve15 } from "path";
+
+// src/counters/code-files.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync14 } from "fs";
+import { join as join11 } from "path";
 var CODE_FILE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts|vue|svelte|astro)$/;
 var SKIP3 = /^(?:node_modules|dist|coverage|\.[^.]|__fixtures__)/;
-var SUPPRESSION = /(?:eslint|oxlint|biome)-(?:disable|ignore)(?:-next-line|-line)?|@ts-expect-error|@ts-ignore/g;
-var countIn = (dir, depth = 12) => {
+var countInCodeFiles = (dir, countInFile, depth = 12) => {
   let entries;
   try {
     entries = readdirSync5(dir, { withFileTypes: true });
@@ -1591,17 +1665,21 @@ var countIn = (dir, depth = 12) => {
   for (const entry of entries) {
     if (SKIP3.test(entry.name)) continue;
     if (entry.isDirectory()) {
-      if (depth > 0) found += countIn(join10(dir, entry.name), depth - 1);
+      if (depth > 0) found += countInCodeFiles(join11(dir, entry.name), countInFile, depth - 1);
       continue;
     }
     if (!CODE_FILE.test(entry.name)) continue;
     try {
-      found += readFileSync13(join10(dir, entry.name), "utf8").match(SUPPRESSION)?.length ?? 0;
+      found += countInFile(readFileSync14(join11(dir, entry.name), "utf8"));
     } catch {
     }
   }
   return found;
 };
+
+// src/counters/suppressions.ts
+var SUPPRESSION = /(?:eslint|oxlint|biome)-(?:disable|ignore)(?:-next-line|-line)?|@ts-expect-error|@ts-ignore/g;
+var countIn = (dir) => countInCodeFiles(dir, (text) => text.match(SUPPRESSION)?.length ?? 0);
 var suppressionCount = {
   id: "suppressionCount",
   probe: {
@@ -1615,8 +1693,8 @@ var suppressionCount = {
 };
 
 // src/counters/surface.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
-import { join as join11, resolve as resolve16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { join as join12, resolve as resolve16 } from "path";
 var DECLARED = /^export\s+(?:declare\s+)?(?:abstract\s+)?(?:const|function|class|type|interface|enum|let|var)\s+([$\w]+)/;
 var BRACED = /^export\s+(?:type\s+)?\{([^}]*)\}(?:\s+from\s+(['"])(.+?)\2)?/;
 var nameOf2 = (spec) => {
@@ -1649,11 +1727,11 @@ var exportedSurfaceIn = (source) => {
 };
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var declarationEntriesOf = (dir) => {
-  const at = join11(dir, "package.json");
+  const at = join12(dir, "package.json");
   if (!existsSync12(at)) {
     throw new CounterError("floorSurface", `no package.json in ${dir} \u2014 that is not a package`);
   }
-  const manifest = JSON.parse(readFileSync14(at, "utf8"));
+  const manifest = JSON.parse(readFileSync15(at, "utf8"));
   const found = [];
   const walk = (value) => {
     if (typeof value === "string" && value.endsWith(".d.ts")) found.push(value);
@@ -1701,16 +1779,16 @@ var floorSurface = {
           `${relative} promises ${entry} and it is not there \u2014 build before measuring, or the surface reads as empty`
         );
       }
-      for (const name of exportedSurfaceIn(readFileSync14(at, "utf8")).keys()) names.add(name);
+      for (const name of exportedSurfaceIn(readFileSync15(at, "utf8")).keys()) names.add(name);
     }
     return names.size;
   }
 };
 
 // src/counters/tests.ts
-import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, rmSync as rmSync4 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join12, resolve as resolve17 } from "path";
+import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, rmSync as rmSync6 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join13, resolve as resolve17 } from "path";
 var COUNTER = "testFailures";
 var VITEST_LINE = /^\s*Tests {2,}(.+?)\s*$/;
 var VITEST_TOTAL = /\(\d+\)$/;
@@ -1750,7 +1828,7 @@ var fromReport = (path) => {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync15(path, "utf8"));
+    report = JSON.parse(readFileSync16(path, "utf8"));
   } catch (error) {
     throw new CounterError(
       COUNTER,
@@ -1781,7 +1859,7 @@ var reportPathFor = (cwd, params, command) => {
       `report: "${VITEST_JSON}" needs somewhere to put the report \u2014 write ${PLACEHOLDER} into the command (--outputFile=${PLACEHOLDER}) or give the entry a "reportPath"`
     );
   }
-  return { own: true, path: join12(mkdtempSync2(join12(tmpdir2(), "geonosis-report-")), "report.json") };
+  return { own: true, path: join13(mkdtempSync2(join13(tmpdir3(), "geonosis-report-")), "report.json") };
 };
 var testFailures = {
   id: COUNTER,
@@ -1830,16 +1908,14 @@ var testFailures = {
       run(command.replaceAll(PLACEHOLDER, path));
       return fromReport(path);
     } finally {
-      if (own) rmSync4(join12(path, ".."), { force: true, recursive: true });
+      if (own) rmSync6(join13(path, ".."), { force: true, recursive: true });
     }
   }
 };
 
 // src/counters/todos.ts
-import { existsSync as existsSync14, readdirSync as readdirSync6, readFileSync as readFileSync16 } from "fs";
-import { join as join13, resolve as resolve18 } from "path";
-var CODE_FILE2 = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts|vue|svelte|astro)$/;
-var SKIP4 = /^(?:node_modules|dist|coverage|\.[^.]|__fixtures__)/;
+import { existsSync as existsSync14, readdirSync as readdirSync6 } from "fs";
+import { resolve as resolve18 } from "path";
 var PLAN_FILE = /^(\d{3,})-[a-z\d][a-z\d.-]*\.md$/;
 var plansIn = (dir) => {
   if (!existsSync14(dir)) return /* @__PURE__ */ new Set();
@@ -1850,34 +1926,14 @@ var plansIn = (dir) => {
   }
   return found;
 };
-var countIn2 = (dir, marker, plans, depth = 12) => {
-  let entries;
-  try {
-    entries = readdirSync6(dir, { withFileTypes: true });
-  } catch {
-    return 0;
-  }
+var countIn2 = (dir, marker, plans) => countInCodeFiles(dir, (text) => {
   let found = 0;
-  for (const entry of entries) {
-    if (SKIP4.test(entry.name)) continue;
-    if (entry.isDirectory()) {
-      if (depth > 0) found += countIn2(join13(dir, entry.name), marker, plans, depth - 1);
-      continue;
-    }
-    if (!CODE_FILE2.test(entry.name)) continue;
-    let text = "";
-    try {
-      text = readFileSync16(join13(dir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of text.matchAll(marker)) {
-      const cited = match[1];
-      if (cited === void 0 || !plans.has(String(Number(cited)))) found += 1;
-    }
+  for (const match of text.matchAll(marker)) {
+    const cited = match[1];
+    if (cited === void 0 || !plans.has(String(Number(cited)))) found += 1;
   }
   return found;
-};
+});
 var orphanTodos = {
   id: "orphanTodos",
   probe: {
@@ -2128,6 +2184,11 @@ export {
   UnbalancedEnvelope,
   writeEnvelope,
   versionOf,
+  HEAVY_SLOTS,
+  heavySlotDir,
+  describeHolders,
+  HeavySlotTimeout,
+  takeSlot,
   heavyLockPath,
   acquireExclusive,
   CONFIG_FILE,

package/dist/cli.js

@@ -5,9 +5,10 @@ import {
   formatReport,
   runProve,
   runRatchet,
+  takeSlot,
   versionOf,
   writeEnvelope
-} from "./chunk-2EAYMSC5.js";
+} from "./chunk-WENVCC67.js";
 
 // src/cli.ts
 import process from "process";
@@ -131,6 +132,10 @@ var measure = async () => {
 ` : formatProve(proof));
     return proof.proven ? 0 : 2;
   }
+  releaseHeavySlot = await takeSlot({
+    command: `geonosis-ratchet${tier === void 0 ? "" : ` --tier ${tier}`}`,
+    cwd
+  });
   const startedAt = Date.now();
   const result = await runRatchet({ counters: COUNTERS, cwd, tier });
   if (!json) process.stdout.write(formatReport(result));
@@ -152,6 +157,7 @@ var measure = async () => {
   }
   return result.measurements.some((one) => one.verdict === "grew") ? 1 : 0;
 };
+var releaseHeavySlot = () => void 0;
 try {
   if (tierFlag !== -1 && (tier === void 0 || tier.startsWith("--"))) {
     throw new Error("--tier needs a tier name");
@@ -165,6 +171,7 @@ try {
   const release = exclusive ? await acquireExclusive({ timeoutSeconds }) : () => void 0;
   const giveBack = () => {
     release();
+    releaseHeavySlot();
     process.exit(130);
   };
   process.on("SIGINT", giveBack);
@@ -174,6 +181,7 @@ try {
     code = await measure();
   } finally {
     release();
+    releaseHeavySlot();
   }
   process.exit(code);
 } catch (error) {

package/dist/index.d.ts

@@ -288,6 +288,42 @@ declare const versionOf: (moduleUrl: string) => string;
 declare const COUNTERS: Counter[];
 declare const counterById: (id: string) => Counter;
 
+/** Who is spending a heavy slot, running what, since when. */
+type HeavySlotHolder = {
+    command: string;
+    cwd: string;
+    pid: number;
+    startedAt: string;
+};
+/**
+ * Two, not one: `core/lock.ts`'s `acquireExclusive` serialises a whole run against every other; this
+ * is the machine's OWN ceiling — measured 2026-09-05, load 48 with during.day's Stop-hook tier, this
+ * kit's Stop-hook tier, this kit's ratchet and an engineer's suite all running at once. A machine that
+ * can carry two heavy things at a time carries two; a third waits.
+ */
+declare const HEAVY_SLOTS = 2;
+declare const heavySlotDir: () => string;
+declare const describeHolders: (holders: HeavySlotHolder[]) => string;
+/** A wait that ran out. The message names every holder, because the caller's own refusal is this text. */
+declare class HeavySlotTimeout extends Error {
+}
+/**
+ * Claims one of the two machine-wide heavy slots, waiting for whoever holds them.
+ *
+ * A dead holder is reaped before a slot is tried, so a killed run never wedges the budget for
+ * whoever asks next. Both held is announced ONCE — not on every poll, which would turn a half-hour
+ * wait into a half hour of identical lines — and the wait is bounded, so a taker that can never get
+ * in refuses instead of hanging the process that called it.
+ */
+declare const takeSlot: ({ command, cwd, dir, pollMs, say, waitMs, }: {
+    command: string;
+    cwd?: string;
+    dir?: string;
+    pollMs?: number;
+    say?: (line: string) => void;
+    waitMs?: number;
+}) => Promise<() => void>;
+
 /** Who is running the heavy thing, since when, and where from. */
 type Holder = {
     cwd: string;
@@ -377,4 +413,4 @@ declare const formatProve: ({ proofs, proven }: ProveResult) => string;
  */
 declare const runCommand: (cwd: string, counterId: string, env?: NodeJS.ProcessEnv) => (command: string) => CommandResult;
 
-export { CONFIG_FILE, COUNTERS, type CommandResult, type Counter, type CounterConfig, type CounterContext, CounterError, type CounterProbe, ENVELOPES_DIR, type EnvelopeEntry, type Holder, type Measurement, type Proof, type ProveResult, type RatchetConfig, type RatchetResult, type Refusal, type ReportEnvelope, UnbalancedEnvelope, type Verdict, acquireExclusive, counterById, envelopePath, formatProve, formatReport, heavyLockPath, keyOf, loadConfig, resolveBaseline, runCommand, runProve, runRatchet, versionOf, writeEnvelope };
+export { CONFIG_FILE, COUNTERS, type CommandResult, type Counter, type CounterConfig, type CounterContext, CounterError, type CounterProbe, ENVELOPES_DIR, type EnvelopeEntry, HEAVY_SLOTS, type HeavySlotHolder, HeavySlotTimeout, type Holder, type Measurement, type Proof, type ProveResult, type RatchetConfig, type RatchetResult, type Refusal, type ReportEnvelope, UnbalancedEnvelope, type Verdict, acquireExclusive, counterById, describeHolders, envelopePath, formatProve, formatReport, heavyLockPath, heavySlotDir, keyOf, loadConfig, resolveBaseline, runCommand, runProve, runRatchet, takeSlot, versionOf, writeEnvelope };

package/dist/index.js

@@ -3,40 +3,50 @@ import {
   COUNTERS,
   CounterError,
   ENVELOPES_DIR,
+  HEAVY_SLOTS,
+  HeavySlotTimeout,
   UnbalancedEnvelope,
   acquireExclusive,
   counterById,
+  describeHolders,
   envelopePath,
   formatProve,
   formatReport,
   heavyLockPath,
+  heavySlotDir,
   keyOf,
   loadConfig,
   resolveBaseline,
   runCommand,
   runProve,
   runRatchet,
+  takeSlot,
   versionOf,
   writeEnvelope
-} from "./chunk-2EAYMSC5.js";
+} from "./chunk-WENVCC67.js";
 export {
   CONFIG_FILE,
   COUNTERS,
   CounterError,
   ENVELOPES_DIR,
+  HEAVY_SLOTS,
+  HeavySlotTimeout,
   UnbalancedEnvelope,
   acquireExclusive,
   counterById,
+  describeHolders,
   envelopePath,
   formatProve,
   formatReport,
   heavyLockPath,
+  heavySlotDir,
   keyOf,
   loadConfig,
   resolveBaseline,
   runCommand,
   runProve,
   runRatchet,
+  takeSlot,
   versionOf,
   writeEnvelope
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/ratchet",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "types": "./dist/index.d.ts",
   "description": "Debt as a number that may only shrink — one ratchet, pluggable counters.",
   "keywords": [