@gjermundgaraba/upup 0.3.0 → 0.5.0

package/dist/main.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as reason, t as openFlags } from "./io-BGJ4Yp7u.mjs";
+import { n as openFlags, r as reason, t as byName } from "./io-ns6xhFdF.mjs";
 import { findPackageJSON } from "node:module";
 import { NodeRuntime, NodeServices, NodeStdio } from "@effect/platform-node";
 import { Cause, Clock, Config, Context, Data, Deferred, Duration, Effect, Equal, Exit, Fiber, FiberHandle, FiberSet, FileSystem, Layer, Option, Predicate, Queue, Ref, Result, Schedule, Schema, Semaphore, Stream, SubscriptionRef, identity } from "effect";
@@ -17,10 +17,9 @@ import { homedir, tmpdir } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import lockfile from "proper-lockfile";
 import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
-import { Type } from "@earendil-works/pi-ai";
-import { GenerationTask, Harness, ToolTask, createRegistry, defineDoc, defineExtension, defineTool, hook, section, watchEvents } from "@earendil-works/pi-durable";
+import { GenerationTask, Harness, LiveDoc, ROOT_CONVERSATION_ID, ToolTask, createRegistry, defineDoc, defineExtension, defineTool, hook, section } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
-import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { ChildProcess, ChildProcessSpawner, CommandLine } from "effect/process";
 import { Worker } from "node:worker_threads";
 import semver from "semver";
 import tarStream from "tar-stream";
@@ -41,8 +40,9 @@ import { XMLParser } from "fast-xml-parser";
 import { isSea } from "node:sea";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { setup, types } from "xstate/fsm";
 // package.json
-var version$1 = "0.3.0";
+var version$1 = "0.5.0";
 // src/ai/Setup.ts
 const Thinking = Schema.Literals([
 	"off",
@@ -283,7 +283,7 @@ const ordered = (left, right) => Number(right.signedIn) - Number(left.signedIn)
 var AiFailed = class extends Schema.TaggedError()("AiFailed", { issue: Schema.String }) {};
 var Ai = class extends Context.Service()("upup/Ai") {};
 const failed$2 = (cause) => new AiFailed({ issue: cause instanceof Error ? cause.message : String(cause) });
-const make$14 = (models, credentials = store()) => Effect.gen(function* () {
+const make$15 = (models, credentials = store()) => Effect.gen(function* () {
 	const settings = yield* Settings;
 	const catalogue = Effect.promise(async () => {
 		const providers = models.getProviders();
@@ -328,7 +328,7 @@ const make$14 = (models, credentials = store()) => Effect.gen(function* () {
 });
 const layer$7 = Layer.effect(Ai, Effect.suspend(() => {
 	const credentials = store();
-	return make$14(builtinModels({ credentials }), credentials);
+	return make$15(builtinModels({ credentials }), credentials);
 }));
 // src/process/lock.ts
 var LockFailed = class extends Schema.TaggedError()("LockFailed", {
@@ -426,12 +426,12 @@ const withTarget = (pkg, target) => ({
 	target
 });
 const isUnaudited = Schema.is(UnauditedEcosystem);
-const isApp = Schema.is(AppEcosystem);
+const isApp$1 = Schema.is(AppEcosystem);
 const isRuntime = Schema.is(RuntimeEcosystem);
 const isUnauditedUpdate = (pkg) => isUnaudited(pkg.ecosystem);
-const isAppUpdate = (pkg) => isApp(pkg.ecosystem);
+const isAppUpdate = (pkg) => isApp$1(pkg.ecosystem);
 const unauditedKind = (pkg) => {
-	if (isApp(pkg.ecosystem)) return "app";
+	if (isApp$1(pkg.ecosystem)) return "app";
 	if (isRuntime(pkg.ecosystem)) return "runtime";
 	if (isUnaudited(pkg.ecosystem)) return "os";
 };
@@ -519,7 +519,7 @@ var CommandFailed = class extends Schema.TaggedError()("CommandFailed", {
 	output: Schema.String
 }) {};
 var Exec = class extends Context.Service()("upup/Exec") {};
-const commandLine = (invocation) => [invocation.command, ...invocation.args].join(" ");
+const commandLine = (invocation) => CommandLine.display([invocation.command, ...invocation.args]);
 const requireSuccess = (run) => (invocation) => run(invocation).pipe(Effect.filterOrFail((output) => output.exitCode === 0, (output) => new CommandFailed({
 	command: commandLine(invocation),
 	cwd: invocation.cwd,
@@ -550,7 +550,7 @@ const layer$6 = Layer.effect(Exec, Effect.gen(function* () {
 	}, Effect.scoped, (effect, invocation) => Effect.mapError(effect, (cause) => new CommandFailed({
 		command: commandLine(invocation),
 		cwd: invocation.cwd,
-		output: cause.message
+		output: Predicate.isError(cause.cause) ? cause.cause.message : cause.reason.description ?? cause.reason._tag
 	})));
 	return Exec.of({
 		run,
@@ -595,14 +595,14 @@ const Installed = Schema.Struct({
 	formulae: Schema.Array(Formula$2),
 	casks: Schema.Array(Cask$1)
 });
-const OutdatedEntry$1 = Schema.Struct({
+const OutdatedEntry = Schema.Struct({
 	name: Schema.String,
 	current_version: Schema.String,
 	pinned: Schema.Boolean
 });
-const Outdated$2 = Schema.Struct({
-	formulae: Schema.Array(OutdatedEntry$1),
-	casks: Schema.Array(OutdatedEntry$1)
+const Outdated$1 = Schema.Struct({
+	formulae: Schema.Array(OutdatedEntry),
+	casks: Schema.Array(OutdatedEntry)
 });
 const brew$1 = (args, refreshMetadata = false) => ({
 	command: "brew",
@@ -653,7 +653,7 @@ const packages = (installed, outdated) => {
 	});
 	return [...formulae, ...casks];
 };
-const make$13 = Effect.gen(function* () {
+const make$14 = Effect.gen(function* () {
 	const exec = yield* Exec;
 	const json = (schema, invocation) => exec.stdout(invocation).pipe(Effect.flatMap(decodeJson(schema, commandLine(invocation))));
 	const list = Effect.gen(function* () {
@@ -662,7 +662,7 @@ const make$13 = Effect.gen(function* () {
 			"--json=v2",
 			"--installed"
 		]));
-		const outdated = yield* json(Outdated$2, brew$1(["outdated", "--json=v2"], true));
+		const outdated = yield* json(Outdated$1, brew$1(["outdated", "--json=v2"], true));
 		return {
 			packages: packages(installed, outdated),
 			notices: []
@@ -695,7 +695,7 @@ const make$13 = Effect.gen(function* () {
 			exitCode: output.exitCode,
 			output: output.stderr
 		});
-		const outdated = yield* decodeJson(Outdated$2, commandLine(invocation))(output.stdout);
+		const outdated = yield* decodeJson(Outdated$1, commandLine(invocation))(output.stdout);
 		return [...outdated.formulae, ...outdated.casks].find((entry) => entry.name === pkg.name)?.current_version;
 	});
 	return {
@@ -752,15 +752,15 @@ const Severity = Schema.Literals([
 const Finding = Schema.Struct({
 	severity: Severity,
 	title: Schema.String,
-	detail: Schema.String,
-	paths: Schema.Array(Schema.String)
+	detail: Schema.String.annotate({ description: "Markdown: the evidence and why it matters." }),
+	paths: Schema.Array(Schema.String).annotate({ description: "Workspace paths, with line ranges where useful." })
 });
 const Report = Schema.Struct({
 	verdict: Verdict,
-	rationale: Schema.String,
-	summary: Schema.String,
+	rationale: Schema.String.annotate({ description: "One concrete sentence justifying the verdict." }),
+	summary: Schema.String.annotate({ description: "Markdown: what the update changes that bears on the mandate, what you flagged and why you cleared or kept it." }),
 	findings: Schema.Array(Finding),
-	unverified: Schema.Array(Schema.String)
+	unverified: Schema.Array(Schema.String).annotate({ description: "Each thing you could not verify." })
 });
 Schema.Struct({
 	mode: Mode,
@@ -797,7 +797,7 @@ const landingKey = (landing) => sha256(JSON.stringify([
 ]));
 const unauditedReasons = {
 	app: "an app update",
-	runtime: "a runtime version the project pins",
+	runtime: "a Node.js runtime version",
 	os: "an operating-system update"
 };
 const unauditable = (pkg) => {
@@ -843,21 +843,23 @@ const descriptions = {
 	grep: "Find a JavaScript regular expression in UTF-8 regular files below a path. Each line is matched whole. Lines over 1 KiB show a bounded window around each match with its file byte offset; a file stops at a line over 16 MiB.",
 	list: "List workspace entries below a directory to a bounded depth."
 };
-const parameters = {
-	read: {
-		path: "Workspace-relative file path.",
-		offset: "Zero-based byte offset; must be >= 0.",
-		limit: `Maximum bytes to return; must be between 1 and ${limits$1.readBytes} inclusive.`
-	},
-	grep: {
-		path: "Workspace-relative file or directory path.",
-		pattern: "JavaScript regular expression."
-	},
-	list: {
-		path: "Workspace-relative directory path; use . for the root.",
-		depth: `Maximum directory depth; must be between 1 and ${limits$1.listDepth} inclusive.`
-	}
-};
+const count$1 = (maximum) => Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isBetween({
+	minimum: 1,
+	maximum
+})));
+const ReadArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative file path." }),
+	offset: Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))).annotate({ description: "Zero-based byte offset; must be >= 0." }),
+	limit: count$1(limits$1.readBytes).annotate({ description: `Maximum bytes to return; must be between 1 and ${limits$1.readBytes} inclusive.` })
+});
+const GrepArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative file or directory path." }),
+	pattern: Schema.String.annotate({ description: "JavaScript regular expression." })
+});
+const ListArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative directory path; use . for the root." }),
+	depth: count$1(limits$1.listDepth).annotate({ description: `Maximum directory depth; must be between 1 and ${limits$1.listDepth} inclusive.` })
+});
 var ToolError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -914,10 +916,6 @@ const locate$4 = async (workspace, name, context) => {
 		return fail$1(`${context}: ${reason(error)}`);
 	}
 };
-const byName = (left, right) => {
-	if (left.name < right.name) return -1;
-	return left.name > right.name ? 1 : 0;
-};
 const suffixOf = (entry) => {
 	if (entry.isDirectory()) return "/";
 	return entry.isSymbolicLink() ? "@" : "";
@@ -1343,17 +1341,11 @@ const runDiff = (cwd, args, from, to, input) => Effect.callback((resume) => {
 	});
 	return Effect.sync(() => child.kill());
 });
-const regularFiles = async (root, relative = "") => {
-	const entries = await readdir(path.join(root, relative)).catch(() => []);
-	const found = [];
-	for (const name of entries.toSorted()) {
-		const file = relative === "" ? name : `${relative}/${name}`;
-		const info = await lstat(path.join(root, file));
-		if (info.isDirectory()) found.push(...await regularFiles(root, file));
-		else if (info.isFile()) found.push(file);
-	}
-	return found;
-};
+const regularFiles = (root, relative = "") => Effect.promise(async () => await readdir(path.join(root, relative), { withFileTypes: true }).catch(() => [])).pipe(Effect.flatMap((entries) => Effect.forEach(entries.toSorted(byName), (entry) => {
+	const file = relative === "" ? entry.name : `${relative}/${entry.name}`;
+	if (entry.isDirectory()) return regularFiles(root, file);
+	return Effect.succeed(entry.isFile() ? [file] : []);
+}, { concurrency: "unbounded" })), Effect.map((found) => found.flat()));
 const failure$1 = (from, to) => (cause) => new DiffFailed({
 	from,
 	to,
@@ -1371,15 +1363,25 @@ const plain$1 = (pair) => ({
 	paired: false,
 	rewritten: false
 });
-const planTree = async (workspace, from, to) => {
-	const [before, after] = await Promise.all([regularFiles(path.join(workspace, from)), regularFiles(path.join(workspace, to))]);
+const planTree = (workspace, from, to) => Effect.gen(function* () {
+	const attempt = (run) => Effect.tryPromise({
+		try: run,
+		catch: failure$1(from, to)
+	});
+	const [before, after] = yield* Effect.all([regularFiles(path.join(workspace, from)), regularFiles(path.join(workspace, to))], { concurrency: "unbounded" });
 	const beforeSet = new Set(before);
 	const afterSet = new Set(after);
 	const fromOnly = before.filter((file) => !afterSet.has(file));
 	const toOnly = after.filter((file) => !beforeSet.has(file));
-	const only = /* @__PURE__ */ new Map();
-	for (const file of fromOnly) only.set(`from\0${file}`, await readFile(path.join(workspace, from, file)));
-	for (const file of toOnly) only.set(`to\0${file}`, await readFile(path.join(workspace, to, file)));
+	const only = new Map(yield* Effect.forEach([...fromOnly.map((file) => ({
+		side: "from",
+		root: from,
+		file
+	})), ...toOnly.map((file) => ({
+		side: "to",
+		root: to,
+		file
+	}))], ({ side, root, file }) => attempt(async () => [`${side}\0${file}`, await readFile(path.join(workspace, root, file))]), { concurrency: 8 }));
 	const pairs = matchRenames(fromOnly, toOnly, (side, file) => only.get(`${side}\0${file}`) ?? Buffer.alloc(0));
 	const renames = renamesOf(pairs);
 	const pairedFrom = new Set(pairs.map((pair) => pair.from));
@@ -1390,32 +1392,36 @@ const planTree = async (workspace, from, to) => {
 		from: file,
 		to: file
 	}))];
-	for (const pair of candidates) {
+	const classify = async (pair) => {
 		const oldPath = path.join(workspace, from, pair.from);
 		const nextPath = path.join(workspace, to, pair.to);
 		const paired = pair.from !== pair.to;
-		if (!paired && renames.size === 0) {
-			if (!await identical(oldPath, nextPath)) changes.push(plain$1(pair));
-			continue;
-		}
-		const old = only.get(`from\0${pair.from}`) ?? await readFile(oldPath);
-		const next = only.get(`to\0${pair.to}`) ?? await readFile(nextPath);
-		if (!paired && old.equals(next)) continue;
+		if (!paired && renames.size === 0) return await identical(oldPath, nextPath) ? void 0 : {
+			same: false,
+			change: plain$1(pair)
+		};
+		const [old, next] = await Promise.all([only.get(`from\0${pair.from}`) ?? readFile(oldPath), only.get(`to\0${pair.to}`) ?? readFile(nextPath)]);
+		if (!paired && old.equals(next)) return;
 		const text = isText(old) ? old.toString("latin1") : void 0;
 		const rewrittenText = text === void 0 ? void 0 : rewrite(text, renames);
 		const rewritten = rewrittenText !== void 0 && rewrittenText !== text;
-		if (!paired && !rewritten) {
-			changes.push(plain$1(pair));
-			continue;
-		}
+		if (!paired && !rewritten) return {
+			same: false,
+			change: plain$1(pair)
+		};
 		const expected = rewrittenText === void 0 ? old : Buffer.from(rewrittenText, "latin1");
-		(expected.equals(next) ? same : changes).push({
-			...pair,
-			expected,
-			paired,
-			rewritten
-		});
-	}
+		return {
+			same: expected.equals(next),
+			change: {
+				...pair,
+				expected,
+				paired,
+				rewritten
+			}
+		};
+	};
+	const planned = yield* Effect.forEach(candidates, (pair) => attempt(async () => await classify(pair)), { concurrency: 8 });
+	for (const entry of planned) if (entry !== void 0) (entry.same ? same : changes).push(entry.change);
 	for (const file of fromOnly) if (!pairedFrom.has(file)) changes.push({
 		...plain$1({
 			from: file,
@@ -1437,7 +1443,7 @@ const planTree = async (workspace, from, to) => {
 		}),
 		same
 	};
-};
+});
 const mebibytes = (bytes) => `${Math.round(bytes / 1024 / 1024)} MiB`;
 const shownOmissions = 2e3;
 const changeDiff = (workspace, from, to, change) => {
@@ -1469,10 +1475,7 @@ const partial = (what, omitted) => omitted === "" ? "" : `The ${what} diff is pa
 const DiffBudget = Context.Reference("upup/DiffBudget", { defaultValue: () => () => maxDiffBytes });
 const treeDiff = (workspace, from, to, limit) => Effect.gen(function* () {
 	const budget = limit ?? (yield* DiffBudget)(from);
-	const { changes, same } = yield* Effect.tryPromise({
-		try: async () => await planTree(workspace, from, to),
-		catch: failure$1(from, to)
-	});
+	const { changes, same } = yield* planTree(workspace, from, to);
 	const parts = [];
 	const left = [];
 	let size = 0;
@@ -1806,12 +1809,16 @@ const majorsOf = (from, to) => {
 };
 const exists$1 = async (file) => await stat(file).then(() => true, () => false);
 const emptyTree = async (directory) => await readdir(directory).then((entries) => entries.length === 0, () => false);
-const readMajors = (workspace) => Effect.promise(async () => majorsOf(await listed$2(workspace, files.dependencyListFrom), await listed$2(workspace, files.dependencyListTo)));
+const majorsIn = async (workspace) => {
+	const [from, to] = await Promise.all([listed$2(workspace, files.dependencyListFrom), listed$2(workspace, files.dependencyListTo)]);
+	return majorsOf(from, to);
+};
+const readMajors = (workspace) => Effect.promise(async () => await majorsIn(workspace));
 const read$1 = (workspace) => Effect.gen(function* () {
 	const meta = yield* readMeta(workspace);
 	return yield* Effect.tryPromise({
 		try: async () => {
-			const diff = await readFile(path.join(workspace, files.diff));
+			const [diff, majors] = await Promise.all([readFile(path.join(workspace, files.diff)), majorsIn(workspace)]);
 			const trees = [];
 			const titled = [];
 			const targets = /* @__PURE__ */ new Map();
@@ -1850,7 +1857,7 @@ const read$1 = (workspace) => Effect.gen(function* () {
 				trees,
 				files: titled,
 				sections,
-				majors: majorsOf(await listed$2(workspace, files.dependencyListFrom), await listed$2(workspace, files.dependencyListTo))
+				majors
 			};
 		},
 		catch: failed$1(workspace)
@@ -1920,28 +1927,18 @@ const BriefDoc = defineDoc({
 	initial: () => ({ brief: null }),
 	checkpointWhen: () => false
 });
-const severity = Type.Union([
-	Type.Literal("info"),
-	Type.Literal("low"),
-	Type.Literal("medium"),
-	Type.Literal("high")
-]);
-const ReportParameters = Type.Object({
-	verdict: Type.Union([
-		Type.Literal("ok"),
-		Type.Literal("caution"),
-		Type.Literal("danger"),
-		Type.Literal("no-verdict")
-	]),
-	rationale: Type.String({ description: "One concrete sentence justifying the verdict." }),
-	summary: Type.String({ description: "Markdown: what the update changes that bears on the mandate, what you flagged and why you cleared or kept it." }),
-	findings: Type.Array(Type.Object({
-		severity,
-		title: Type.String(),
-		detail: Type.String({ description: "Markdown: the evidence and why it matters." }),
-		paths: Type.Array(Type.String(), { description: "Workspace paths, with line ranges where useful." })
+const parameters = (schema) => Schema.toJsonSchemaDocument(schema).schema;
+const decodeRead = Schema.decodeUnknownSync(ReadArgs);
+const decodeGrep = Schema.decodeUnknownSync(GrepArgs);
+const decodeList = Schema.decodeUnknownSync(ListArgs);
+const decodeSubmitted = Schema.decodeUnknownSync(Report);
+const encodeReport = (submitted) => ({
+	...submitted,
+	findings: submitted.findings.map((finding) => ({
+		...finding,
+		paths: [...finding.paths]
 	})),
-	unverified: Type.Array(Type.String(), { description: "Each thing you could not verify." })
+	unverified: [...submitted.unverified]
 });
 const ReportDoc = defineDoc({
 	kind: "upup.report",
@@ -1967,42 +1964,33 @@ const auditExtension = (workspace) => {
 		name: "read",
 		description: descriptions.read,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.read.path }),
-			offset: Type.Integer({ description: parameters.read.offset }),
-			limit: Type.Integer({ description: parameters.read.limit })
-		}),
-		execute: async (args, _api, invocation) => answer(await read$2(workspace, args, invocation.abortSignal))
+		parameters: parameters(ReadArgs),
+		execute: async (args, _api, invocation) => answer(await read$2(workspace, decodeRead(args), invocation.abortSignal))
 	});
 	const grep$1 = defineTool({
 		name: "grep",
 		description: descriptions.grep,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.grep.path }),
-			pattern: Type.String({ description: parameters.grep.pattern })
-		}),
-		execute: async (args, _api, invocation) => answer(await grep(workspace, args, invocation.abortSignal === void 0 ? {} : { signal: invocation.abortSignal }))
+		parameters: parameters(GrepArgs),
+		execute: async (args, _api, invocation) => answer(await grep(workspace, decodeGrep(args), invocation.abortSignal === void 0 ? {} : { signal: invocation.abortSignal }))
 	});
 	const list$1 = defineTool({
 		name: "list",
 		description: descriptions.list,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.list.path }),
-			depth: Type.Integer({ description: parameters.list.depth })
-		}),
-		execute: async (args, _api, invocation) => answer(await list(workspace, args, invocation.abortSignal))
+		parameters: parameters(ListArgs),
+		execute: async (args, _api, invocation) => answer(await list(workspace, decodeList(args), invocation.abortSignal))
 	});
 	const submit = defineTool({
 		name: "submit_report",
 		description: "Submit the audit report. Call exactly once, when the investigation is done; the audit ends.",
 		replay: "safe",
-		parameters: ReportParameters,
+		parameters: parameters(Report),
 		execute: async (args, api, invocation) => {
+			const encoded = encodeReport(decodeSubmitted(args));
 			await api.commit(async (tx) => {
 				const doc = await tx.doc(ReportDoc, api.conversationId);
-				doc.report = structuredClone(args);
+				doc.report = encoded;
 			}, invocation);
 			return {
 				...text$2("Report submitted."),
@@ -2078,6 +2066,32 @@ const entriesOf$1 = (message) => {
 	}
 	return [];
 };
+const TextBlock = Schema.Struct({
+	type: Schema.Literal("text"),
+	text: Schema.String
+});
+const ThinkingBlock = Schema.Struct({
+	type: Schema.Literal("thinking"),
+	thinking: Schema.String
+});
+const isTextBlock = Schema.is(TextBlock);
+const isThinkingBlock = Schema.is(ThinkingBlock);
+const decodeLive = Schema.decodeUnknownOption(Schema.Struct({ generation: Schema.optional(Schema.Struct({
+	attempt: Schema.Finite,
+	message: Schema.optional(Schema.Struct({ content: Schema.Array(Schema.Unknown) })),
+	retry: Schema.optional(Schema.Struct({ error: Schema.String }))
+})) }));
+const streamed = (block) => {
+	if (isThinkingBlock(block)) return block.thinking.trim() === "" ? [] : [{
+		kind: "thinking",
+		text: block.thinking
+	}];
+	if (isTextBlock(block)) return block.text.trim() === "" ? [] : [{
+		kind: "text",
+		text: block.text
+	}];
+	return [];
+};
 var Transcript = class {
 	committed = /* @__PURE__ */ new Map();
 	live = [];
@@ -2085,41 +2099,20 @@ var Transcript = class {
 	add(entry) {
 		this.committed.set(entry.id, (entry.model ?? []).flatMap(entriesOf$1));
 	}
-	apply(event) {
-		switch (event.type) {
-			case "snapshot":
-				this.committed.clear();
-				for (const entry of event.entries) this.add(entry);
-				this.live = [];
-				break;
-			case "entry_appended":
-			case "message_end":
-				this.add(event.entry);
-				this.live = [];
-				this.retry = void 0;
-				break;
-			case "message_update":
-				for (const change of event.changes) if (change.type === "text_delta" || change.type === "thinking_delta") {
-					const kind = change.type === "text_delta" ? "text" : "thinking";
-					const last = this.live.at(-1);
-					if (last?.kind === kind) this.live[this.live.length - 1] = {
-						kind,
-						text: last.text + change.delta
-					};
-					else this.live.push({
-						kind,
-						text: change.delta
-					});
-				}
-				break;
-			case "auto_retry_start":
-				this.retry = {
-					kind: "retry",
-					text: `retrying (attempt ${event.attempt}): ${event.errorMessage}`
-				};
-				break;
-			case "auto_retry_end": this.retry = void 0;
-		}
+	view(view) {
+		for (const entry of view.entries) this.add(entry);
+		const generation = decodeLive(view.docs[LiveDoc.definition.kind]).pipe(Option.flatMapNullishOr((live) => live.generation));
+		this.live = Option.match(generation, {
+			onNone: () => [],
+			onSome: ({ message }) => (message?.content ?? []).flatMap(streamed)
+		});
+		this.retry = Option.match(generation, {
+			onNone: () => void 0,
+			onSome: ({ attempt, retry }) => retry === void 0 ? void 0 : {
+				kind: "retry",
+				text: `retrying (attempt ${attempt}): ${retry.error}`
+			}
+		});
 	}
 	entries() {
 		return [
@@ -2134,16 +2127,24 @@ const attempt$1 = (evaluate) => Effect.tryPromise({
 	try: evaluate,
 	catch: failed
 });
+const watched = (open, onValue) => Effect.acquireRelease(attempt$1(async () => {
+	const watch = await open();
+	watch.start(async (call) => {
+		if (call.kind === "value") onValue(call.value);
+	});
+	return watch;
+}), (watch) => Effect.promise(async () => await watch.stop()).pipe(Effect.ignore));
 const lastAssistant = (entries) => entries.flatMap((entry) => entry.model ?? []).findLast((message) => message.role === "assistant");
-const openHarness = (file, workspace, models) => Effect.acquireRelease(attempt$1(async () => {
-	if (workspace === "" && !existsSync(file)) throw new Error(`no audit at ${file}`);
-	const extension = auditExtension(workspace);
+const openHarness = (file, models, workspace) => Effect.acquireRelease(attempt$1(async () => {
+	if (workspace === void 0 && !existsSync(file)) throw new Error(`no audit at ${file}`);
+	const extension = auditExtension(workspace ?? "");
 	const registry = createRegistry();
 	registry.install(extension);
 	return await Harness.open(await openNodeSqliteStorage(file), {
 		models,
 		registry,
-		settings: { extensions: [extension] }
+		settings: { extensions: [extension] },
+		readOnly: workspace === void 0
 	}, context);
 }), (harness) => Effect.promise(async () => {
 	await harness.close(context);
@@ -2156,7 +2157,7 @@ const encodeBrief = (brief) => ({
 	artifacts: [...brief.artifacts]
 });
 const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(options.file, options.brief.workspace, options.models);
+	const harness = yield* openHarness(options.file, options.models, options.brief.workspace);
 	const root = yield* attempt$1(async () => await harness.root(context, {
 		agent: {
 			model: {
@@ -2171,13 +2172,12 @@ const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
 		}
 	}));
 	const transcript = new Transcript();
-	const events = yield* Effect.acquireRelease(attempt$1(async () => await watchEvents(harness, root.id, context)), (stream) => Effect.promise(async () => await stream.stop()).pipe(Effect.ignore));
-	transcript.apply(events.snapshot);
-	options.onTranscript(transcript.entries());
-	events.start(async (batch) => {
-		for (const event of batch) transcript.apply(event);
+	const views = yield* watched(async () => await root.watch(context), (view) => {
+		transcript.view(view);
 		options.onTranscript(transcript.entries());
 	});
+	transcript.view(views.value);
+	options.onTranscript(transcript.entries());
 	harness.resume();
 	const settled = yield* Effect.tryPromise({
 		try: async (signal) => {
@@ -2204,20 +2204,29 @@ const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
 		_tag: "Reported",
 		report: decoded.value
 	};
-	const final = yield* attempt$1(async () => await watchEvents(harness, root.id, context));
-	yield* attempt$1(async () => await final.stop());
+	const final = yield* attempt$1(async () => await root.context(context));
 	if (settled.value.status === "unanswered") return {
 		_tag: "Failed",
 		issue: Predicate.isString(settled.value.detail) ? settled.value.detail : settled.value.reason
 	};
 	return {
 		_tag: "Failed",
-		issue: lastAssistant(final.snapshot.entries)?.errorMessage ?? "the model finished without submitting a report"
+		issue: lastAssistant(final.entries)?.errorMessage ?? "the model finished without submitting a report"
 	};
 }));
+const storedRoot = (file, models) => Effect.gen(function* () {
+	const harness = yield* openHarness(file, models);
+	return {
+		harness,
+		root: yield* attempt$1(async () => await harness.conversation(ROOT_CONVERSATION_ID, context))
+	};
+});
 const stored = (file, models) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(file, "", models);
-	const root = yield* attempt$1(async () => await harness.root(context));
+	const { harness, root } = yield* storedRoot(file, models);
+	if (root === void 0) return {
+		brief: Option.none(),
+		report: Option.none()
+	};
 	const brief = yield* attempt$1(async () => await harness.snapshot(BriefDoc, root.id, context));
 	const submitted = yield* attempt$1(async () => await harness.snapshot(ReportDoc, root.id, context));
 	return {
@@ -2226,12 +2235,12 @@ const stored = (file, models) => Effect.scoped(Effect.gen(function* () {
 	};
 }));
 const transcript = (file, models) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(file, "", models);
-	const root = yield* attempt$1(async () => await harness.root(context));
-	const events = yield* attempt$1(async () => await watchEvents(harness, root.id, context));
-	yield* attempt$1(async () => await events.stop());
+	const { root } = yield* storedRoot(file, models);
 	const built = new Transcript();
-	built.apply(events.snapshot);
+	if (root !== void 0) {
+		const active = yield* attempt$1(async () => await root.context(context));
+		for (const entry of active.entries) built.add(entry);
+	}
 	return built.entries();
 }));
 // src/inventory/versions.ts
@@ -2268,7 +2277,7 @@ var LookupFailed = class extends Schema.TaggedError()("LookupFailed", {
 	url: Schema.String,
 	issue: Schema.String
 }) {};
-const Release$2 = Schema.fromJsonString(Schema.Struct({
+const Release$3 = Schema.fromJsonString(Schema.Struct({
 	vers: Schema.String,
 	yanked: Schema.Boolean
 }));
@@ -2285,7 +2294,7 @@ const newestRelease = Effect.fn("CratesIndex.newestRelease")(function* (client,
 		issue: error.message
 	});
 	const text = yield* HttpClient.filterStatusOk(client).get(url).pipe(Effect.flatMap((response) => response.text), Effect.mapError(failed));
-	const releases = yield* Effect.forEach(text.split("\n").filter((line) => line.trim().length > 0), (line) => Schema.decodeEffect(Release$2)(line).pipe(Effect.mapError(failed)));
+	const releases = yield* Effect.forEach(text.split("\n").filter((line) => line.trim().length > 0), (line) => Schema.decodeEffect(Release$3)(line).pipe(Effect.mapError(failed)));
 	return newestOffer(current, releases.filter((release) => !release.yanked).map((release) => release.vers));
 });
 // src/registry/Metadata.ts
@@ -2338,7 +2347,7 @@ const escape = (path) => path.replaceAll(/[A-Z]/gu, (letter) => `!${letter.toLow
 const deprecation = (mod) => Option.fromNullishOr(/^\/\/\s*Deprecated:\s*(?<reason>.+)$/mu.exec(mod)?.groups?.["reason"]?.trim());
 const lookup$5 = Effect.fn("go.lookup")(function* (client, wanted) {
 	const base = `https://proxy.golang.org/${escape(wanted.name)}/@v`;
-	const [latest, infos] = yield* Effect.all([getJson(client, `https://proxy.golang.org/${escape(wanted.name)}/@latest`, Info$2), Effect.forEach(wanted.versions, (version) => getJson(client, `${base}/${escape(version)}.info`, Info$2).pipe(Effect.option), { concurrency: 2 })], { concurrency: 2 });
+	const [latest, infos] = yield* Effect.all([getJson(client, `https://proxy.golang.org/${escape(wanted.name)}/@latest`, Info$2), Effect.forEach(wanted.versions, (version) => getJson(client, `${base}/${escape(version)}.info`, Info$2).pipe(Effect.option), { concurrency: 2 })], { concurrency: "unbounded" });
 	const mod = yield* getText(client, `${base}/${escape(latest.Version)}.mod`);
 	const deprecated = deprecation(mod);
 	const found = infos.flatMap((info) => Option.isSome(info) ? [info.value] : []);
@@ -4849,30 +4858,36 @@ const resolveFormula = Effect.fn("brew.resolveFormula")(function* (client, sourc
 			digest: createHash("sha256").update(body).digest("hex")
 		};
 	});
-	let to;
-	let from;
-	if (source.tapGitHead !== "") {
-		const current = yield* Effect.option(snapshot(source.tapGitHead, "tap revision reported by brew info"));
-		if (current._tag === "Some" && matchesVersion(current.value.snapshot.text, toVersion) && (source.rubySourceChecksum === "" || source.rubySourceChecksum.toLowerCase() === current.value.digest)) to = current.value.snapshot;
-	}
-	let endpoint = `${githubApi}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits?${new URLSearchParams({
-		path: source.rubySourcePath,
-		per_page: `${historyPageSize}`
-	}).toString()}`;
-	let scanned = 0;
-	const complete = () => from !== void 0 && to !== void 0;
-	for (let page = 0; endpoint !== "" && page < maxHistoryPages && !complete(); page += 1) {
-		const { body, link } = yield* githubGet(client, endpoint, token).pipe(Effect.mapError(prefixed("query brew formula history")));
-		const commits = yield* commitsOf(body, endpoint);
-		for (const commit of commits) {
-			scanned += 1;
-			const { snapshot: candidate } = yield* snapshot(commit.sha, commit.message);
-			if (to === void 0 && matchesVersion(candidate.text, toVersion)) to = candidate;
-			if (from === void 0 && matchesVersion(candidate.text, fromVersion)) from = candidate;
-			if (complete()) break;
+	const scanHistory = Effect.gen(function* () {
+		let to;
+		let from;
+		let endpoint = `${githubApi}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits?${new URLSearchParams({
+			path: source.rubySourcePath,
+			per_page: `${historyPageSize}`
+		}).toString()}`;
+		let scanned = 0;
+		const complete = () => from !== void 0 && to !== void 0;
+		for (let page = 0; endpoint !== "" && page < maxHistoryPages && !complete(); page += 1) {
+			const { body, link } = yield* githubGet(client, endpoint, token).pipe(Effect.mapError(prefixed("query brew formula history")));
+			const commits = yield* commitsOf(body, endpoint);
+			for (const commit of commits) {
+				scanned += 1;
+				const { snapshot: candidate } = yield* snapshot(commit.sha, commit.message);
+				if (to === void 0 && matchesVersion(candidate.text, toVersion)) to = candidate;
+				if (from === void 0 && matchesVersion(candidate.text, fromVersion)) from = candidate;
+				if (complete()) break;
+			}
+			endpoint = complete() ? "" : nextPage(endpoint, link);
 		}
-		endpoint = complete() ? "" : nextPage(endpoint, link);
-	}
+		return {
+			from,
+			to,
+			scanned
+		};
+	});
+	const [current, history] = yield* Effect.all([source.tapGitHead === "" ? Effect.succeedNone : Effect.option(snapshot(source.tapGitHead, "tap revision reported by brew info")), scanHistory], { concurrency: "unbounded" });
+	const { from, scanned } = history;
+	const to = current._tag === "Some" && matchesVersion(current.value.snapshot.text, toVersion) && (source.rubySourceChecksum === "" || source.rubySourceChecksum.toLowerCase() === current.value.digest) ? current.value.snapshot : history.to;
 	if (to === void 0) return yield* new EvidenceUnavailable({
 		source: "brew",
 		issue: `brew formula history has no snapshot for target version ${toVersion} within the newest ${scanned} commits`
@@ -5277,13 +5292,14 @@ const payloadDiff = Effect.fn("brew.payloadDiff")(function* (client, workspace,
 	const { name } = shortName(artifact);
 	const oldStrip = yield* strip(name, plan.old);
 	const newStrip = yield* strip(name, plan.new);
-	const oldManifest = yield* payloadManifest(client, "installed", plan.old, oldStrip, path.join(workspace, files.payloadTreeFrom));
+	const [oldManifest, newManifest] = yield* Effect.all([payloadManifest(client, "installed", plan.old, oldStrip, path.join(workspace, files.payloadTreeFrom)), payloadManifest(client, "target", plan.new, newStrip, path.join(workspace, files.payloadTreeTo))], { concurrency: "unbounded" });
 	if (oldManifest === void 0) return yield* unavailablePayload(workspace, "installed Homebrew payload archive format is unsupported");
-	const newManifest = yield* payloadManifest(client, "target", plan.new, newStrip, path.join(workspace, files.payloadTreeTo));
 	if (newManifest === void 0) return yield* unavailablePayload(workspace, "target Homebrew payload archive format is unsupported");
-	const manifests = yield* writeFileDiff(workspace, files.payloadFrom, files.payloadTo, manifestJson(oldManifest), manifestJson(newManifest));
-	const binaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(oldManifest)), json(binarySummaries(newManifest)));
-	const trees = yield* treeDiff(workspace, files.payloadTreeFrom, files.payloadTreeTo);
+	const [manifests, binaries, trees] = yield* Effect.all([
+		writeFileDiff(workspace, files.payloadFrom, files.payloadTo, manifestJson(oldManifest), manifestJson(newManifest)),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(oldManifest)), json(binarySummaries(newManifest))),
+		treeDiff(workspace, files.payloadTreeFrom, files.payloadTreeTo)
+	], { concurrency: "unbounded" });
 	const contents = trees.diff;
 	const contentDetail = [" Extracted payload file contents are diffed.", partial("payload", trees.omitted)].filter((sentence) => sentence !== "").join(" ");
 	const origin = plan.old.origin === "" ? "" : ` (pinned by ${plan.old.origin})`;
@@ -5762,9 +5778,9 @@ const writeChanges = Effect.fn("git.writeChanges")(function* (from, to, destinat
 		modes
 	};
 	const contents = readBatch((yield* git(["cat-file", "--batch"], objects.map((object) => `${object}\n`).join(""))).stdout, objects);
-	yield* Effect.tryPromise({
+	yield* Effect.forEach(changes, (change) => Effect.tryPromise({
 		try: async () => {
-			for (const change of changes) for (const [object, root] of [[change.fromObject, destination.from], [change.toObject, destination.to]]) {
+			for (const [object, root] of [[change.fromObject, destination.from], [change.toObject, destination.to]]) {
 				if (object === void 0) continue;
 				const file = path.join(root, change.path);
 				await mkdir(path.dirname(file), {
@@ -5778,6 +5794,9 @@ const writeChanges = Effect.fn("git.writeChanges")(function* (from, to, destinat
 			repository,
 			issue: `write source files: ${String(error)}`
 		})
+	}), {
+		concurrency: 8,
+		discard: true
 	});
 	return {
 		files: changes.length,
@@ -5838,9 +5857,9 @@ const moduleChanges = (from, to, released) => {
 	};
 };
 const readSummaries = (workspace, file) => Effect.tryPromise(async () => await readFile(path.join(workspace, file), "utf-8")).pipe(Effect.flatMap((text) => Schema.decodeEffect(Summaries)(text)), Effect.option);
+const readBinarySummaries = (workspace) => Effect.all([readSummaries(workspace, files.binaryFrom), readSummaries(workspace, files.binaryTo)], { concurrency: "unbounded" });
 const goSourceEvidence = Effect.fn("goSource.evidence")(function* (client, workspace, released) {
-	const from = yield* readSummaries(workspace, files.binaryFrom);
-	const to = yield* readSummaries(workspace, files.binaryTo);
+	const [from, to] = yield* readBinarySummaries(workspace);
 	if (from._tag === "None" || to._tag === "None") return;
 	const { changes, reason } = moduleChanges(from.value, to.value, released);
 	if (changes.length === 0) return {
@@ -5852,7 +5871,7 @@ const goSourceEvidence = Effect.fn("goSource.evidence")(function* (client, works
 		const plan = yield* resolve$3(client, "go", modulePath, version);
 		return yield* materialize$2(client, plan, path.join(workspace, tree, modulePath));
 	});
-	const fetched = yield* Effect.forEach(changes, (change) => Effect.result(Effect.all([fetch(change.path, change.from, files.goSourceFrom), fetch(change.path, change.to, files.goSourceTo)], { concurrency: 2 })), { concurrency: 2 });
+	const fetched = yield* Effect.forEach(changes, (change) => Effect.result(Effect.all([fetch(change.path, change.from, files.goSourceFrom), fetch(change.path, change.to, files.goSourceTo)], { concurrency: "unbounded" })), { concurrency: 2 });
 	const failures = changes.flatMap((change, index) => {
 		const result = fetched[index];
 		return result?._tag === "Failure" ? [`${change.path}: ${result.failure.issue}`] : [];
@@ -5911,8 +5930,7 @@ const buildInfoSources = (from, to) => {
 	return [...sources.values()].slice(0, 4);
 };
 const readBuildInfoSources = Effect.fn("goSource.buildInfoSources")(function* (workspace) {
-	const from = yield* readSummaries(workspace, files.binaryFrom);
-	const to = yield* readSummaries(workspace, files.binaryTo);
+	const [from, to] = yield* readBinarySummaries(workspace);
 	return from._tag === "None" || to._tag === "None" ? [] : buildInfoSources(from.value, to.value);
 });
 // src/audit/source-evidence.ts
@@ -6224,7 +6242,7 @@ const releaseAssetSources = Effect.fn("sourceLink.releaseAssets")(function* (cli
 			} })), Effect.catch((error) => Effect.succeed(gap(error.issue))));
 		}
 		return Effect.succeed(gap("no release of the repository publishes this exact binary"));
-	});
+	}, { concurrency: 4 });
 });
 // src/audit/brew.ts
 const caskArchiveUnavailable = "compiled cask payloads are not source archives";
@@ -6290,7 +6308,7 @@ const sourceDiff = Effect.fn("brew.sourceDiff")(function* (client, workspace, pa
 	const [gap] = yield* Effect.all([sourceTree(client, pair.old, path.join(workspace, files.sourceFrom)).pipe(Effect.as(""), Effect.catch((error) => {
 		const reason = historicalGap(pair.old.url, error);
 		return reason === void 0 ? Effect.fail(labelled("download old brew source archive")(error)) : Effect.succeed(reason);
-	})), sourceTree(client, pair.new, path.join(workspace, files.source)).pipe(Effect.mapError(labelled("download new brew source archive")))], { concurrency: 2 });
+	})), sourceTree(client, pair.new, path.join(workspace, files.source)).pipe(Effect.mapError(labelled("download new brew source archive")))], { concurrency: "unbounded" });
 	if (gap !== "") return {
 		diff: Buffer.alloc(0),
 		reason: gap,
@@ -6327,9 +6345,11 @@ const sourceEvidence = Effect.fn("brew.sourceEvidence")(function* (client, works
 	};
 });
 const materialize$1 = Effect.fn("brew.materialize")(function* (client, workspace, identity, plan, key) {
-	const formula = yield* materializeFormula(workspace, plan.formula);
-	const source = yield* sourceEvidence(client, workspace, archives(plan.formula), plan.sourceGap);
-	const payload = yield* materializePayload(client, workspace, identity.delta.artifact, plan.payload);
+	const [formula, source, payload] = yield* Effect.all([
+		materializeFormula(workspace, plan.formula),
+		sourceEvidence(client, workspace, archives(plan.formula), plan.sourceGap),
+		materializePayload(client, workspace, identity.delta.artifact, plan.payload)
+	], { concurrency: "unbounded" });
 	const goSource = source.included ? void 0 : yield* goSourceEvidence(client, workspace, identity.delta);
 	const sources = goSource?.included === true || source.included ? [] : [...plan.repository === void 0 ? [] : [plan.repository], ...yield* readBuildInfoSources(workspace)];
 	const repository = sources.length === 0 ? void 0 : yield* materializeSources(workspace, sources);
@@ -6356,7 +6376,7 @@ const resolve$2 = Effect.fn("brew.resolve")(function* (client, identity) {
 	const formulaGap = formula.fromGap === "" ? archiveUnavailableReason(archives(formula)) : "the installed version's formula snapshot is unavailable";
 	const sourceGap = kind === "cask" ? caskArchiveUnavailable : formulaGap;
 	const payload = yield* resolvePayload(info, artifact, from, to, formula.from?.text);
-	const released = sourceGap !== "" && payload.old.url !== "" && payload.new.url !== "" ? yield* Effect.all([releaseTagSource(payload.old.url), releaseTagSource(payload.new.url)], { concurrency: 2 }) : void 0;
+	const released = sourceGap !== "" && payload.old.url !== "" && payload.new.url !== "" ? yield* Effect.all([releaseTagSource(payload.old.url), releaseTagSource(payload.new.url)], { concurrency: "unbounded" }) : void 0;
 	const repository = released === void 0 || released.every((side) => "gap" in side) ? void 0 : {
 		label: artifact,
 		from: released[0],
@@ -6421,7 +6441,7 @@ const workspaceOf$1 = Effect.fn("githubActions.workspace")(function* (workspace,
 const githubActionPreparer = (repositoryOf, options = {}) => Effect.fn("githubActions.prepare")(function* (_client, identity) {
 	const { artifact, from, to } = identity.delta;
 	const repository = repositoryOf(artifact);
-	const [fromCommit, toCommit] = yield* Effect.all([tagCommit(repository, from, options), tagCommit(repository, to, options)], { concurrency: 2 }).pipe(Effect.mapError(unavailable$1));
+	const [fromCommit, toCommit] = yield* Effect.all([tagCommit(repository, from, options), tagCommit(repository, to, options)], { concurrency: "unbounded" }).pipe(Effect.mapError(unavailable$1));
 	const listed = identity.context["revision"];
 	if (listed !== toCommit) return yield* new EvidenceUnavailable({
 		source: repository,
@@ -6447,7 +6467,7 @@ const githubActionPreparer = (repositoryOf, options = {}) => Effect.fn("githubAc
 const prepareGitHubAction = githubActionPreparer(githubRepository);
 // src/audit/pypi.ts
 const optional = (schema) => Schema.optionalKey(Schema.NullOr(schema));
-const Release$1 = Schema.Struct({ urls: optional(Schema.Array(Schema.Struct({
+const Release$2 = Schema.Struct({ urls: optional(Schema.Array(Schema.Struct({
 	filename: optional(Schema.String),
 	url: optional(Schema.String),
 	packagetype: optional(Schema.String),
@@ -6538,7 +6558,7 @@ const artifactPlan = ([file, reason]) => {
 };
 const resolve$1 = Effect.fn("pypi.resolve")(function* (client, name, version, pythonVersion) {
 	const source = releaseUrl(name, version);
-	const files = ((yield* getJson(client, source, Release$1).pipe(Effect.mapError((error) => new EvidenceUnavailable({
+	const files = ((yield* getJson(client, source, Release$2).pipe(Effect.mapError((error) => new EvidenceUnavailable({
 		source,
 		issue: error.issue
 	})))).urls ?? []).map((file) => ({
@@ -6618,12 +6638,14 @@ const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace,
 			issue: error instanceof Error ? error.message : String(error)
 		})
 	});
-	const [from, to] = yield* Effect.all([materialize(client, plans.from, path.join(workspace, files.from), path.join(workspace, files.wheelFrom)), materialize(client, plans.to, path.join(workspace, files.to), path.join(workspace, files.wheelTo))], { concurrency: 2 });
-	const sources = yield* treeDiff(workspace, files.from, files.to);
-	const records = yield* writeFileDiff(workspace, files.pypiFrom, files.pypiTo, manifestJson(from), manifestJson(to));
-	const sourceBinaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from.publisher_sdist?.archive_manifest)), json(binarySummaries(to.publisher_sdist?.archive_manifest)));
-	const wheels = yield* treeDiff(workspace, files.wheelFrom, files.wheelTo);
-	const wheelBinaries = yield* writeFileDiff(workspace, files.binaryWheelFrom, files.binaryWheelTo, json(binarySummaries(from.compatible_universal_wheel?.archive_manifest)), json(binarySummaries(to.compatible_universal_wheel?.archive_manifest)));
+	const [from, to] = yield* Effect.all([materialize(client, plans.from, path.join(workspace, files.from), path.join(workspace, files.wheelFrom)), materialize(client, plans.to, path.join(workspace, files.to), path.join(workspace, files.wheelTo))], { concurrency: "unbounded" });
+	const [sources, records, sourceBinaries, wheels, wheelBinaries] = yield* Effect.all([
+		treeDiff(workspace, files.from, files.to),
+		writeFileDiff(workspace, files.pypiFrom, files.pypiTo, manifestJson(from), manifestJson(to)),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from.publisher_sdist?.archive_manifest)), json(binarySummaries(to.publisher_sdist?.archive_manifest))),
+		treeDiff(workspace, files.wheelFrom, files.wheelTo),
+		writeFileDiff(workspace, files.binaryWheelFrom, files.binaryWheelTo, json(binarySummaries(from.compatible_universal_wheel?.archive_manifest)), json(binarySummaries(to.compatible_universal_wheel?.archive_manifest)))
+	], { concurrency: "unbounded" });
 	const detail = `Checksum-verified PyPI publisher artifacts; ${pairedDetail("source distributions", from.publisher_sdist, to.publisher_sdist)}; ${pairedDetail("compatible universal wheel candidates", from.compatible_universal_wheel, to.compatible_universal_wheel)}; the installer’s exact resolver selection is not known.`;
 	return yield* write(workspace, identity, Buffer.concat([
 		sources.diff,
@@ -6640,7 +6662,7 @@ const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace,
 const preparePyPI = Effect.fn("pypi.prepare")(function* (client, identity) {
 	const { artifact, from, to } = identity.delta;
 	const python = identity.context["python"] ?? "";
-	const [fromPlan, toPlan] = yield* Effect.all([resolve$1(client, artifact, from, python), resolve$1(client, artifact, to, python)], { concurrency: 2 });
+	const [fromPlan, toPlan] = yield* Effect.all([resolve$1(client, artifact, from, python), resolve$1(client, artifact, to, python)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
@@ -6733,7 +6755,7 @@ const resolveDependencies = Effect.fn("npmDependencies.resolve")(function* (clie
 	const outcomes = yield* Effect.forEach(changedNames, (dependency) => Effect.gen(function* () {
 		if (!packageName.test(dependency)) return Result.fail("its name is not a valid registry package name");
 		const side = (declared) => declared === void 0 ? Effect.undefined : resolveSide(client, host, dependency, declared);
-		const resolved = yield* Effect.result(Effect.all([side(before.get(dependency)), side(after.get(dependency))], { concurrency: 2 }));
+		const resolved = yield* Effect.result(Effect.all([side(before.get(dependency)), side(after.get(dependency))], { concurrency: "unbounded" }));
 		return Result.isFailure(resolved) ? Result.fail(resolved.failure.issue) : Result.succeed(resolved.success);
 	}), { concurrency: 4 });
 	for (const [index, dependency] of changedNames.entries()) {
@@ -6840,8 +6862,8 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 			issue: error instanceof Error ? error.message : String(error)
 		})
 	});
-	const sides = yield* Effect.forEach(dependencies.changed, (dependency) => Effect.all([fetchSide(client, dependency.from, path.join(workspace, files.dependenciesFrom, dependency.name)), fetchSide(client, dependency.to, path.join(workspace, files.dependenciesTo, dependency.name))], { concurrency: 2 }), { concurrency: 4 });
-	const summaries = yield* writeFileDiff(workspace, files.dependencyListFrom, files.dependencyListTo, record(dependencies, dependencies.changed.map((dependency, index) => ({
+	const sides = yield* Effect.forEach(dependencies.changed, (dependency) => Effect.all([fetchSide(client, dependency.from, path.join(workspace, files.dependenciesFrom, dependency.name)), fetchSide(client, dependency.to, path.join(workspace, files.dependenciesTo, dependency.name))], { concurrency: "unbounded" }), { concurrency: 4 });
+	const [summaries, trees] = yield* Effect.all([writeFileDiff(workspace, files.dependencyListFrom, files.dependencyListTo, record(dependencies, dependencies.changed.map((dependency, index) => ({
 		name: dependency.name,
 		...dependency.from === void 0 ? {} : { resolved: dependency.from },
 		...sides[index]?.[0] === void 0 ? {} : { fetched: sides[index][0] }
@@ -6849,8 +6871,7 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 		name: dependency.name,
 		...dependency.to === void 0 ? {} : { resolved: dependency.to },
 		...sides[index]?.[1] === void 0 ? {} : { fetched: sides[index][1] }
-	}))));
-	const trees = yield* treeDiff(workspace, files.dependenciesFrom, files.dependenciesTo);
+	})))), treeDiff(workspace, files.dependenciesFrom, files.dependenciesTo)], { concurrency: "unbounded" });
 	const failed = dependencies.changed.filter((_, index) => (sides[index] ?? []).some((side) => side?.error !== void 0));
 	const included = dependencies.changed.map((dependency) => `${dependency.name} ${dependency.from?.plan.version ?? "(new)"}${dependency.from?.lowest === true ? " (lowest of its range)" : ""} -> ${dependency.to?.plan.version ?? "(removed)"}${dependency.to?.bundled === true ? " (now a devDependency, so probably bundled into the package)" : ""}`);
 	const noneIncluded = dependencies.omitted.length === 0 ? "No direct dependency's declared version changed." : "No changed direct dependency is compared.";
@@ -6883,10 +6904,12 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 // src/audit/registry-evidence.ts
 const registryDetail = "Both published packages were downloaded and their checksums verified. File types and modes, and any native binaries, are summarised without running them.";
 const registryWorkspace = Effect.fn("evidence.registryWorkspace")(function* (client, workspace, identity, plans, npm, key) {
-	const [from, to] = yield* Effect.all([materialize$2(client, plans.from, path.join(workspace, files.from)), materialize$2(client, plans.to, path.join(workspace, files.to))], { concurrency: 2 });
-	const artifacts = yield* writeFileDiff(workspace, files.artifactFrom, files.artifactTo, manifestJson(from), manifestJson(to));
-	const trees = yield* treeDiff(workspace, files.from, files.to);
-	const binaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from)), json(binarySummaries(to)));
+	const [from, to] = yield* Effect.all([materialize$2(client, plans.from, path.join(workspace, files.from)), materialize$2(client, plans.to, path.join(workspace, files.to))], { concurrency: "unbounded" });
+	const [artifacts, trees, binaries] = yield* Effect.all([
+		writeFileDiff(workspace, files.artifactFrom, files.artifactTo, manifestJson(from), manifestJson(to)),
+		treeDiff(workspace, files.from, files.to),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from)), json(binarySummaries(to)))
+	], { concurrency: "unbounded" });
 	const treeDetail = [registryDetail, partial("artifact", trees.omitted)].filter((sentence) => sentence !== "").join(" ");
 	if (npm === void 0) return yield* write(workspace, identity, Buffer.concat([
 		artifacts,
@@ -6920,7 +6943,7 @@ const npmExtras = Effect.fn("evidence.npmExtras")(function* (client, name, from,
 		cpu: process.arch
 	});
 	const verifier = yield* Effect.cached(sigstoreVerifier);
-	const [fromSource, toSource] = yield* Effect.all([npmSource(client, name, from, fromManifest, verifier), npmSource(client, name, to, toManifest, verifier)], { concurrency: 2 });
+	const [fromSource, toSource] = yield* Effect.all([npmSource(client, name, from, fromManifest, verifier), npmSource(client, name, to, toManifest, verifier)], { concurrency: "unbounded" });
 	const { directory } = npmRepository(toManifest);
 	return {
 		dependencies,
@@ -6937,8 +6960,8 @@ const prepareRegistry = Effect.fn("evidence.prepareRegistry")(function* (client,
 	const manifests = ecosystem === "npm" ? yield* Effect.all({
 		from: npmVersion(client, artifact, from),
 		to: npmVersion(client, artifact, to)
-	}, { concurrency: 2 }) : void 0;
-	const [fromPlan, toPlan] = yield* Effect.all(manifests === void 0 ? [resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)] : [npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: 2 });
+	}, { concurrency: "unbounded" }) : void 0;
+	const [fromPlan, toPlan] = yield* Effect.all(manifests === void 0 ? [resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)] : [npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
@@ -7313,10 +7336,9 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 	}));
 	const started = yield* Clock.currentTimeMillis;
 	const base = path.join(root, "workspaces");
-	for (const name of yield* children(base)) {
-		if (name.endsWith(".lock")) continue;
+	yield* Effect.forEach((yield* children(base)).filter((name) => !name.endsWith(".lock")), (name) => {
 		const workspace = path.join(base, name);
-		yield* Effect.scoped(Effect.gen(function* () {
+		return Effect.scoped(Effect.gen(function* () {
 			if (!(yield* tryHold(workspace))) return;
 			const prepared = yield* Effect.promise(async () => await stat(path.join(workspace, files.meta)).then((info) => info.mtimeMs, () => 0));
 			if (started - prepared > Duration.toMillis(keptWorkspaces)) {
@@ -7324,9 +7346,15 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 				return;
 			}
 			const entries = yield* Effect.promise(async () => await readdir(workspace, { withFileTypes: true }).catch(() => []));
-			for (const entry of entries) if (entry.isDirectory()) yield* discard(path.join(workspace, entry.name), name);
+			yield* Effect.forEach(entries.filter((entry) => entry.isDirectory()), (entry) => discard(path.join(workspace, entry.name), name), {
+				concurrency: "unbounded",
+				discard: true
+			});
 		})).pipe(Effect.ignore);
-	}
+	}, {
+		concurrency: 8,
+		discard: true
+	});
 	yield* Effect.forkScoped(Effect.promise(async () => {
 		for (const name of await readdir(trash).catch(() => [])) await rm(path.join(trash, name), {
 			recursive: true,
@@ -7543,12 +7571,15 @@ const workflowFiles = Effect.fn("workflowFiles")(function* (root) {
 		for (const name of ["action.yml", "action.yaml"]) if (yield* present(path.join(dir, name))) return Option.some(path.join(dir, name));
 		return Option.none();
 	});
-	const workflows = yield* listed(path.join(".github", "workflows"), false);
-	const actions = yield* listed(path.join(".github", "actions"), true);
+	const [workflows, actions, own] = yield* Effect.all([
+		listed(path.join(".github", "workflows"), false),
+		listed(path.join(".github", "actions"), true),
+		actionFile("")
+	], { concurrency: "unbounded" });
 	const pending = [
 		...workflows.filter((file) => /\.ya?ml$/u.test(file)),
 		...actions.filter((file) => /^action\.ya?ml$/u.test(path.basename(file))),
-		...Option.toArray(yield* actionFile(""))
+		...Option.toArray(own)
 	];
 	const seen = /* @__PURE__ */ new Set();
 	const files = [];
@@ -7748,7 +7779,7 @@ const toPackage$1 = ({ uses, resolved, source }) => {
 	};
 };
 const publicTags = (url) => tags(url, { timeout: lsRemoteTimeout }).pipe(Effect.mapError((error) => error.issue), Effect.result);
-const make$12 = (root, origin, readPublic = publicTags) => Effect.gen(function* () {
+const make$13 = (root, origin, readPublic = publicTags) => Effect.gen(function* () {
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
 	const read = (file) => readText(file).pipe(Effect.provideService(FileSystem.FileSystem, fs));
@@ -7873,7 +7904,7 @@ const discover$4 = Effect.fn("GitHubActions.discover")(function* (dir) {
 		".github",
 		"action.yml",
 		"action.yaml"
-	], exists)).length === 0) return [];
+	], exists, { concurrency: "unbounded" })).length === 0) return [];
 	const origin = yield* exec.stdout({
 		command: "git",
 		args: [
@@ -7884,11 +7915,11 @@ const discover$4 = Effect.fn("GitHubActions.discover")(function* (dir) {
 		cwd: root
 	}).pipe(Effect.option);
 	const host = Option.isSome(origin) ? hostOf(origin.value.trim()) : void 0;
-	return [yield* make$12(root, host === "github.com" ? void 0 : host)];
+	return [yield* make$13(root, host === "github.com" ? void 0 : host)];
 });
 // src/process/on-path.ts
 const executable = (file) => Effect.promise(async () => await access(file, constants.X_OK).then(() => true, () => false));
-const onPath = (command) => Effect.forEach((process.env["PATH"] ?? "").split(path.delimiter).filter((dir) => dir !== ""), (dir) => executable(path.join(dir, command))).pipe(Effect.map((found) => found.includes(true)));
+const onPath = (command) => Effect.forEach((process.env["PATH"] ?? "").split(path.delimiter).filter((dir) => dir !== ""), (dir) => executable(path.join(dir, command)), { concurrency: "unbounded" }).pipe(Effect.map((found) => found.includes(true)));
 // src/process/Sudo.ts
 var Sudo = class extends Context.Service()("upup/Sudo") {};
 const asRoot = (invocation) => [
@@ -7898,7 +7929,7 @@ const asRoot = (invocation) => [
 ];
 const enablesTouchId = (pam) => pam.split("\n").some((line) => /^\s*auth\s+\S+\s+pam_tid\.so\b/u.test(line));
 const pamFiles = ["/etc/pam.d/sudo_local", "/etc/pam.d/sudo"];
-const make$11 = (interactive) => Effect.gen(function* () {
+const make$12 = (interactive) => Effect.gen(function* () {
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
 	const asking = yield* SubscriptionRef.make(void 0);
@@ -7957,8 +7988,8 @@ const make$11 = (interactive) => Effect.gen(function* () {
 		answer
 	});
 });
-const layer$4 = Layer.effect(Sudo, make$11(true));
-const layerNoPrompt = Layer.effect(Sudo, make$11(false));
+const layer$4 = Layer.effect(Sudo, make$12(true));
+const layerNoPrompt = Layer.effect(Sudo, make$12(false));
 // src/apps/app-store.ts
 const countryOf = (locale) => (/[@;]rg=(?<region>[a-z]{2})/iu.exec(locale)?.groups?.["region"] ?? /^[a-z]{2,3}[_-](?<region>[a-z]{2})\b/iu.exec(locale)?.groups?.["region"] ?? "us").toLowerCase();
 const Lookup = Schema.Struct({ results: Schema.Array(Schema.Struct({
@@ -8482,8 +8513,7 @@ const read = Effect.fn("bundles.read")(function* (bundle, arch) {
 	const short = nonEmpty(info.value.CFBundleShortVersionString);
 	const build = nonEmpty(info.value.CFBundleVersion);
 	const executable = nonEmpty(info.value.CFBundleExecutable);
-	const sparkle = yield* sparkleKeysOf(bundle, info.value);
-	const source = yield* sourceOf(bundle, bundleId, nonEmpty(info.value.SUFeedURL), arch);
+	const [sparkle, source] = yield* Effect.all([sparkleKeysOf(bundle, info.value), sourceOf(bundle, bundleId, nonEmpty(info.value.SUFeedURL), arch)], { concurrency: "unbounded" });
 	return Option.some({
 		path: bundle,
 		name: path.basename(bundle, ".app"),
@@ -8496,23 +8526,25 @@ const read = Effect.fn("bundles.read")(function* (bundle, arch) {
 		...plist === void 0 ? {} : { plist }
 	});
 });
-const walk = Effect.fn("bundles.walk")(function* (roots, wanted) {
+const isApp = (entry) => entry.endsWith(".app");
+const isLeftover = (entry) => entry.endsWith(".app.upup-old");
+const wanted$1 = (entry) => isApp(entry) || isLeftover(entry);
+const walk = Effect.fn("bundles.walk")(function* (roots) {
 	const fs = yield* FileSystem.FileSystem;
 	const entries = (dir) => fs.readDirectory(dir).pipe(Effect.orElseSucceed(() => []), Effect.map((names) => names.toSorted((left, right) => left.localeCompare(right)).map((name) => path.join(dir, name))));
 	const isLink = (entry) => fs.readLink(entry).pipe(Effect.isSuccess);
 	const isDirectory = (entry) => fs.stat(entry).pipe(Effect.map((info) => info.type === "Directory"), Effect.orElseSucceed(() => false));
-	const found = [];
-	for (const root of roots) for (const entry of yield* entries(root)) {
-		if (yield* isLink(entry)) continue;
-		if (wanted(entry)) found.push(entry);
-		else if (!/\.(?:app|localized|upup-old|upup-new)$/u.test(entry) && (yield* isDirectory(entry))) {
-			for (const nested of yield* entries(entry)) if (wanted(nested) && !(yield* isLink(nested))) found.push(nested);
-		}
-	}
-	return found;
+	const nestedIn = (folder) => entries(folder).pipe(Effect.flatMap((listed) => Effect.filter(listed.filter(wanted$1), (nested) => Effect.map(isLink(nested), (link) => !link), { concurrency: "unbounded" })));
+	const walked = (yield* Effect.forEach(roots, (root) => entries(root).pipe(Effect.flatMap((listed) => Effect.forEach(listed, (entry) => Effect.gen(function* () {
+		if (yield* isLink(entry)) return [];
+		if (wanted$1(entry)) return [entry];
+		return !/\.(?:app|localized|upup-old|upup-new)$/u.test(entry) && (yield* isDirectory(entry)) ? yield* nestedIn(entry) : [];
+	}), { concurrency: "unbounded" })), Effect.map((listed) => listed.flat())), { concurrency: "unbounded" })).flat();
+	return {
+		apps: walked.filter(isApp),
+		leftovers: walked.filter(isLeftover)
+	};
 });
-const paths = (roots) => walk(roots, (entry) => entry.endsWith(".app"));
-const leftovers = (roots) => walk(roots, (entry) => entry.endsWith(".app.upup-old"));
 // src/apps/running.ts
 const command$4 = (name, args) => ({
 	command: name,
@@ -8575,7 +8607,7 @@ const command$3 = (name, args) => ({
 });
 const host = Effect.gen(function* () {
 	const exec = yield* Exec;
-	const [arm64, os] = yield* Effect.all([exec.run(command$3("sysctl", ["-n", "hw.optional.arm64"])).pipe(Effect.map((output) => output.exitCode === 0 && output.stdout.trim() === "1"), Effect.orElseSucceed(() => false)), exec.stdout(command$3("sw_vers", ["-productVersion"])).pipe(Effect.map((text) => text.trim()))], { concurrency: 2 });
+	const [arm64, os] = yield* Effect.all([exec.run(command$3("sysctl", ["-n", "hw.optional.arm64"])).pipe(Effect.map((output) => output.exitCode === 0 && output.stdout.trim() === "1"), Effect.orElseSucceed(() => false)), exec.stdout(command$3("sw_vers", ["-productVersion"])).pipe(Effect.map((text) => text.trim()))], { concurrency: "unbounded" });
 	return {
 		arch: arm64 ? "arm64" : "x86_64",
 		os
@@ -8653,7 +8685,7 @@ const stage = Effect.fn("install.stage")(function* (client, wanted) {
 		const found = (yield* Effect.forEach(candidates, (candidate) => readInfo(candidate).pipe(Effect.map((info) => ({
 			path: candidate,
 			info
-		}))))).find(({ info }) => Option.isSome(info) && info.value.CFBundleIdentifier === wanted.bundleId);
+		}))), { concurrency: 4 })).find(({ info }) => Option.isSome(info) && info.value.CFBundleIdentifier === wanted.bundleId);
 		if (found === void 0 || Option.isNone(found.info)) return yield* refused(`its download holds no app with the bundle ID ${wanted.bundleId}`);
 		const app = found.path;
 		const info = found.info.value;
@@ -8672,7 +8704,7 @@ const stage = Effect.fn("install.stage")(function* (client, wanted) {
 		])).pipe(Effect.mapError((error) => refused(`codesign failed: ${error.output.trim()}`)), Effect.flatMap((output) => {
 			const hash = /^CDHash=(?<hash>[0-9a-f]+)$/mu.exec(output.stderr)?.groups?.["hash"];
 			return hash === void 0 ? Effect.fail(unsigned(output.stderr.trim())) : Effect.succeed(hash);
-		}))).pipe(Effect.map((hashes) => `${requirement(wanted.bundleId, wanted.team)} and info [CFBundleShortVersionString] = "${wanted.version.replaceAll(/["\\]/gu, "\\$&")}" and (${hashes.map((hash) => `cdhash H"${hash}"`).join(" or ")})`));
+		})), { concurrency: 2 }).pipe(Effect.map((hashes) => `${requirement(wanted.bundleId, wanted.team)} and info [CFBundleShortVersionString] = "${wanted.version.replaceAll(/["\\]/gu, "\\$&")}" and (${hashes.map((hash) => `cdhash H"${hash}"`).join(" or ")})`));
 		const signed = yield* exec.run(command$2("codesign", [
 			"--verify",
 			"--deep",
@@ -8750,7 +8782,7 @@ const locate$3 = Effect.gen(function* () {
 	return Option.isNone(manifest) || !(yield* fs.exists(zip).pipe(Effect.orElseSucceed(() => false))) ? Option.none() : yield* decode(manifest.value, zip);
 });
 // src/apps/swap.ts
-const tools = {
+const tools$2 = {
 	ps: "/bin/ps",
 	ditto: "/usr/bin/ditto",
 	mv: "/bin/mv",
@@ -9155,16 +9187,27 @@ const makeWith = (options) => Effect.gen(function* () {
 			}
 		};
 	});
+	const leftoverNotice = (old) => {
+		const app = old.slice(0, -9);
+		return fs.exists(app).pipe(Effect.orElseSucceed(() => true), Effect.map((present) => ({ message: present ? `${old} is the old copy of ${path.basename(app)} that an update left behind; move it to the Trash` : `${old} is ${path.basename(app)} from before an update that did not finish; rename it back to ${path.basename(app)}` })));
+	};
+	const scan = Effect.gen(function* () {
+		const [here, walked] = yield* Effect.all([host, walk(options.roots)], { concurrency: "unbounded" });
+		const [bundles, left] = yield* Effect.all([Effect.forEach(walked.apps, (app) => read(app, here.arch), { concurrency: inFlight }), Effect.forEach(walked.leftovers, leftoverNotice, { concurrency: "unbounded" })], { concurrency: "unbounded" });
+		return {
+			here,
+			found: bundles.flatMap((bundle) => Option.toArray(bundle)),
+			left
+		};
+	});
 	const list = Effect.gen(function* () {
-		const owners = yield* Effect.result(casks);
+		const [owners, { here, found, left }] = yield* Effect.all([Effect.result(casks), scan], { concurrency: "unbounded" });
 		if (Result.isFailure(owners)) return {
 			packages: [],
 			notices: [{ message: `upup lists no apps while it cannot read which apps Homebrew installed: ${describeError(owners.failure)}` }]
 		};
-		const here = yield* host;
 		const locale = yield* Effect.cached(country);
 		const caskOf = new Map(owners.success.flatMap((cask) => caskApps(cask).map((app) => [app, cask])));
-		const found = (yield* Effect.forEach(yield* paths(options.roots), (app) => read(app, here.arch), { concurrency: inFlight })).flatMap((bundle) => Option.toArray(bundle));
 		const ids = /* @__PURE__ */ new Set();
 		const kept = found.filter((bundle) => {
 			const cask = caskOf.get(path.basename(bundle.path));
@@ -9192,13 +9235,9 @@ const makeWith = (options) => Effect.gen(function* () {
 			here,
 			rows: new Map(all.map((row) => [row.pkg.id, row.listed]))
 		});
-		const leftovers$1 = yield* Effect.forEach(yield* leftovers(options.roots), (old) => {
-			const app = old.slice(0, -9);
-			return fs.exists(app).pipe(Effect.orElseSucceed(() => true), Effect.map((present) => ({ message: present ? `${old} is the old copy of ${path.basename(app)} that an update left behind; move it to the Trash` : `${old} is ${path.basename(app)} from before an update that did not finish; rename it back to ${path.basename(app)}` })));
-		});
 		return {
 			packages: all.map((row) => row.pkg),
-			notices: [...all.flatMap((row) => row.notice), ...leftovers$1]
+			notices: [...all.flatMap((row) => row.notice), ...left]
 		};
 	}).pipe(Effect.withSpan("Apps.list"), provide);
 	const observe = Effect.fn("Apps.observe")(function* (pkg) {
@@ -9233,7 +9272,7 @@ const makeWith = (options) => Effect.gen(function* () {
 		const ids = yield* Effect.forEach(paths, (app) => readInfo(app).pipe(Effect.flatMap((info) => Option.match(info, {
 			onNone: () => Effect.fail(new Unsupported({ reason: `upup could not read ${app}` })),
 			onSome: (found) => Effect.succeed(found.CFBundleIdentifier)
-		}))));
+		}))), { concurrency: inFlight });
 		const found = {
 			paths,
 			ids: new Set(ids)
@@ -9242,7 +9281,7 @@ const makeWith = (options) => Effect.gen(function* () {
 		return found;
 	});
 	const queue = yield* Ref.make([]);
-	const using = options.tools ?? tools;
+	const using = options.tools ?? tools$2;
 	const helper = options.sparkle === void 0 ? locate$3.pipe(Effect.provideService(FileSystem.FileSystem, fs)) : Effect.succeed(options.sparkle);
 	const sparkleOf = (pkg, install, build) => {
 		const refused = (reason) => new InstallRefused({
@@ -9442,7 +9481,7 @@ const makeWith = (options) => Effect.gen(function* () {
 		})
 	};
 });
-const make$10 = onPath("brew").pipe(Effect.flatMap((brewInstalled) => makeWith({
+const make$11 = onPath("brew").pipe(Effect.flatMap((brewInstalled) => makeWith({
 	roots: ["/Applications", path.join(homedir(), "Applications")],
 	brew: brewInstalled
 })));
@@ -9468,7 +9507,7 @@ const parseList = (text) => text.split("\n").flatMap((line) => {
 		fromCratesIo: source === void 0
 	}];
 });
-const make$9 = Effect.gen(function* () {
+const make$10 = Effect.gen(function* () {
 	const exec = yield* Exec;
 	const client = yield* HttpClient.HttpClient;
 	const installed = exec.stdout(cargo$1(["install", "--list"])).pipe(Effect.map(parseList));
@@ -9514,7 +9553,7 @@ const nestedDirs = Effect.fn("nestedDirs")(function* (dir, names) {
 		args,
 		cwd: dir
 	}).pipe(Effect.orElseSucceed(() => ""));
-	const [prefix, listed] = yield* Effect.all([git("rev-parse", "--show-prefix"), git("ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...names.map((name) => `:(glob)**/${name}`))], { concurrency: 2 });
+	const [prefix, listed] = yield* Effect.all([git("rev-parse", "--show-prefix"), git("ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...names.map((name) => `:(glob)**/${name}`))], { concurrency: "unbounded" });
 	const files = listed.split("\0").filter((file) => {
 		const folders = file.split("/").slice(0, -1);
 		return folders.length > 0 && !folders.includes("node_modules") && !(path.basename(file) === "go.mod" && ignoredByGo(folders));
@@ -9541,21 +9580,32 @@ const failing = (name, error) => ({
 	observe: () => Effect.succeedNone
 });
 const locateAll = Effect.fn("locateAll")(function* (dir, nested, manifest, locate) {
-	const own = yield* locate(dir);
-	const below = yield* Effect.forEach(nested, (from) => Effect.map(Effect.result(locate(from)), (result) => [from, result]), { concurrency: 8 });
+	const [own, below] = yield* Effect.all([locate(dir), Effect.forEach(nested, (from) => Effect.map(Effect.result(locate(from)), (result) => [from, result]), { concurrency: 8 })], { concurrency: "unbounded" });
 	const found = /* @__PURE__ */ new Map();
+	const claimed = /* @__PURE__ */ new Map();
 	const failed = [];
-	const add = (located) => {
-		if (Option.isSome(located) && !found.has(located.value.root)) found.set(located.value.root, located.value);
+	const add = (from, located) => {
+		if (Option.isNone(located)) return;
+		const { root } = located.value;
+		if (!found.has(root)) found.set(root, located.value);
+		claimed.set(root, [...claimed.get(root) ?? [], from]);
 	};
-	add(own);
+	add(dir, own);
 	const ownRoot = Option.map(own, (located) => located.root);
 	const outside = (located) => Option.isSome(located) && placeOf$1(dir, located.value.root) === "" && !Option.contains(ownRoot, located.value.root);
+	const failures = below.flatMap(([from, result]) => Result.isFailure(result) ? [{
+		from,
+		reason: describeError(result.failure)
+	}] : []);
+	const repeated = (from, reason) => failures.some((other) => other.reason === reason && from.startsWith(`${other.from}${path.sep}`));
 	for (const [from, result] of below) if (Result.isSuccess(result)) {
-		if (!outside(result.success)) add(result.success);
-	} else failed.push(failing(path.join(path.relative(dir, from), manifest), result.failure));
+		if (!outside(result.success)) add(from, result.success);
+	} else if (!repeated(from, describeError(result.failure))) failed.push(failing(path.join(path.relative(dir, from), manifest), result.failure));
 	return {
-		found: [...found.values()],
+		found: [...found.values()].map((located) => ({
+			...located,
+			claimed: claimed.get(located.root) ?? []
+		})),
 		failed
 	};
 });
@@ -9642,10 +9692,11 @@ const entriesOf = (manifest, parsed) => {
 	for (const [name, spec] of Object.entries(parsed.workspace?.dependencies ?? {})) add(["workspace", "dependencies"], name, spec);
 	return entries;
 };
-const cargo = (root, args) => ({
+const cargo = (cwd, args) => ({
 	command: "cargo",
 	args,
-	cwd: root
+	cwd,
+	env: { RUSTUP_AUTO_INSTALL: "0" }
 });
 const parseManifest = (file, text) => Effect.try({
 	try: () => getStaticTOMLValue(parseTOML(text)),
@@ -9670,7 +9721,7 @@ const resolvedByMember = (root, meta) => {
 		return [path.relative(root, pkg.manifest_path), deps];
 	}));
 };
-const make$8 = (root, place = "") => Effect.gen(function* () {
+const make$9 = (root, place = "") => Effect.gen(function* () {
 	const providerName = placed("cargo", place);
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
@@ -9683,6 +9734,7 @@ const make$8 = (root, place = "") => Effect.gen(function* () {
 			"metadata",
 			"--format-version",
 			"1",
+			"--all-features",
 			"--locked"
 		]);
 		return yield* exec.stdout(invocation).pipe(Effect.flatMap(decodeJson(Metadata, commandLine(invocation))));
@@ -9691,7 +9743,7 @@ const make$8 = (root, place = "") => Effect.gen(function* () {
 	const entries = (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => entriesOf(manifest, parsed)));
 	const workspace = Effect.gen(function* () {
 		const resolved = resolvedByMember(root, yield* metadata);
-		const manifests = yield* Effect.forEach(/* @__PURE__ */ new Set(["Cargo.toml", ...resolved.keys()]), (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => [manifest, parsed])));
+		const manifests = yield* Effect.forEach(/* @__PURE__ */ new Set(["Cargo.toml", ...resolved.keys()]), (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => [manifest, parsed])), { concurrency: 8 });
 		const inheritors = (key) => manifests.flatMap(([manifest, parsed]) => resolved.has(manifest) && inheritedKeys(parsed).includes(key) ? [manifest] : []);
 		return {
 			resolved,
@@ -9731,6 +9783,11 @@ const make$8 = (root, place = "") => Effect.gen(function* () {
 		};
 	});
 	const list = Effect.gen(function* () {
+		const lockfile = path.join(root, "Cargo.lock");
+		if (!(yield* fs.exists(lockfile).pipe(Effect.mapError(fileFailed("stat", lockfile))))) return {
+			packages: [],
+			notices: [{ message: "not listed: no Cargo.lock yet" }]
+		};
 		const { declared, notices } = yield* declarations;
 		return {
 			packages: yield* Effect.forEach(declared, ({ pkg }) => newestRelease(client, pkg.artifact, pkg.current).pipe(Effect.map((target) => {
@@ -9812,21 +9869,17 @@ const locate$2 = Effect.fn("CargoWorkspace.locate")(function* (dir) {
 	const exec = yield* Exec;
 	const manifest = yield* findUp(dir, "Cargo.toml");
 	if (Option.isNone(manifest)) return Option.none();
-	const root = yield* exec.stdout({
-		command: "cargo",
-		args: [
-			"locate-project",
-			"--workspace",
-			"--message-format",
-			"plain"
-		],
-		cwd: manifest.value
-	});
+	const root = yield* exec.stdout(cargo(manifest.value, [
+		"locate-project",
+		"--workspace",
+		"--message-format",
+		"plain"
+	]));
 	return Option.some({ root: path.dirname(root.trim()) });
 });
 const discover$3 = Effect.fn("CargoWorkspace.discover")(function* (dir, nested = []) {
 	const { found, failed } = yield* locateAll(dir, nested, "Cargo.toml", locate$2);
-	return [...failed, ...yield* Effect.forEach(found, ({ root }) => make$8(root, placeOf$1(dir, root)))];
+	return [...failed, ...yield* Effect.forEach(found, ({ root }) => make$9(root, placeOf$1(dir, root)))];
 });
 // src/registry/origin.ts
 const trailing = (url) => url.endsWith("/") ? url : `${url}/`;
@@ -9971,14 +10024,15 @@ const fromBuildInfo = (info, file) => {
 		current: main.Version
 	}) : Option.none();
 };
-const make$7 = Effect.gen(function* () {
+const make$8 = Effect.gen(function* () {
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
-	const goEnv = yield* Effect.cached(exec.stdout(go([
+	const envInvocation = go([
 		"env",
 		"-json",
 		...envKeys
-	])).pipe(Effect.flatMap(decodeGoJson(GoEnv, `go env -json ${envKeys.join(" ")}`))));
+	]);
+	const goEnv = yield* Effect.cached(exec.stdout(envInvocation).pipe(Effect.flatMap(decodeGoJson(GoEnv, commandLine(envInvocation)))));
 	const binDir = goEnv.pipe(Effect.map((env) => env.GOBIN || path.join(env.GOPATH.split(":")[0] ?? env.GOPATH, "bin")));
 	const inspect = Effect.fn("GoInstall.inspect")(function* (dir, file) {
 		const invocation = go([
@@ -9994,9 +10048,11 @@ const make$7 = Effect.gen(function* () {
 	});
 	const isPlainExecutable = Effect.fn("GoInstall.isPlainExecutable")(function* (dir, file) {
 		const binary = path.join(dir, file);
-		const info = yield* fs.stat(binary).pipe(Effect.mapError(fileFailed("stat", binary)));
-		const real = yield* fs.realPath(binary).pipe(Effect.mapError(fileFailed("resolve", binary)));
-		const realDir = yield* fs.realPath(dir).pipe(Effect.mapError(fileFailed("resolve", dir)));
+		const [info, real, realDir] = yield* Effect.all([
+			fs.stat(binary).pipe(Effect.mapError(fileFailed("stat", binary))),
+			fs.realPath(binary).pipe(Effect.mapError(fileFailed("resolve", binary))),
+			fs.realPath(dir).pipe(Effect.mapError(fileFailed("resolve", dir)))
+		], { concurrency: "unbounded" });
 		return info.type === "File" && (info.mode & 73) !== 0 && real === path.join(realDir, file);
 	});
 	const latest = Effect.fn("GoInstall.latest")(function* (modules) {
@@ -10066,6 +10122,7 @@ const make$7 = Effect.gen(function* () {
 });
 // src/go/GoModule.ts
 const ModFile = Schema.Struct({
+	Module: Schema.optionalKey(Schema.Struct({ Path: Schema.String })),
 	Require: Schema.optionalKey(Schema.Array(Schema.Struct({
 		Path: Schema.String,
 		Version: Schema.String,
@@ -10079,7 +10136,10 @@ const Selected = Schema.Struct({
 	Update: Schema.optionalKey(Schema.Struct({ Version: Schema.String })),
 	Error: Schema.optionalKey(Schema.Struct({ Err: Schema.String }))
 });
-const WorkFile = Schema.Struct({ Use: Schema.optionalKey(Schema.Array(Schema.Struct({ DiskPath: Schema.String }))) });
+const WorkFile = Schema.Struct({
+	Use: Schema.optionalKey(Schema.Array(Schema.Struct({ DiskPath: Schema.String }))),
+	Replace: Schema.optionalKey(Schema.Array(Schema.Struct({ Old: Schema.Struct({ Path: Schema.String }) })))
+});
 const goEnv = {
 	GOWORK: "off",
 	GIT_TERMINAL_PROMPT: "0"
@@ -10089,26 +10149,30 @@ const GoProxyEnv = Schema.Struct({
 	GOPRIVATE: Schema.optionalKey(Schema.String),
 	GONOPROXY: Schema.optionalKey(Schema.String)
 });
-const directRequirements = (mod) => {
+const directRequirements = (mod, local) => {
 	const replaced = new Set((mod.Replace ?? []).map((replace) => replace.Old.Path));
-	return (mod.Require ?? []).filter((requirement) => requirement.Indirect !== true && !replaced.has(requirement.Path));
+	return (mod.Require ?? []).filter((requirement) => requirement.Indirect !== true && !replaced.has(requirement.Path) && !local.has(requirement.Path));
+};
+const goIn = (cwd, args) => ({
+	command: "go",
+	args,
+	cwd,
+	env: goEnv
+});
+const readModFile = (exec, cwd) => {
+	const edit = goIn(cwd, [
+		"mod",
+		"edit",
+		"-json"
+	]);
+	return exec.stdout(edit).pipe(Effect.flatMap(decodeGoJson(ModFile, commandLine(edit))));
 };
-const make$6 = (root, moduleDir, place = "") => Effect.gen(function* () {
+const make$7 = (root, moduleDir, place = "", local = /* @__PURE__ */ new Set()) => Effect.gen(function* () {
 	const exec = yield* Exec;
 	const manifest = path.join(place, path.relative(root, path.join(moduleDir, "go.mod")));
-	const go = (args) => ({
-		command: "go",
-		args,
-		cwd: moduleDir,
-		env: goEnv
-	});
+	const go = (args) => goIn(moduleDir, args);
 	const requirements = Effect.gen(function* () {
-		const edit = go([
-			"mod",
-			"edit",
-			"-json"
-		]);
-		return directRequirements(yield* exec.stdout(edit).pipe(Effect.flatMap(decodeGoJson(ModFile, commandLine(edit)))));
+		return directRequirements(yield* readModFile(exec, moduleDir), local);
 	});
 	const selected = Effect.fn("GoModule.selected")(function* (paths, withUpdates) {
 		if (paths.length === 0) return /* @__PURE__ */ new Map();
@@ -10147,8 +10211,7 @@ const make$6 = (root, moduleDir, place = "") => Effect.gen(function* () {
 	]);
 	const origin = exec.stdout(env).pipe(Effect.flatMap(decodeGoJson(GoProxyEnv, commandLine(env))), Effect.map(withGoOrigin));
 	const list = Effect.gen(function* () {
-		const direct = yield* requirements;
-		const located = yield* origin;
+		const [direct, located] = yield* Effect.all([requirements, origin], { concurrency: "unbounded" });
 		const entries = yield* selected(direct.map((requirement) => requirement.Path), true);
 		const notices = [];
 		return {
@@ -10210,65 +10273,91 @@ const locate$1 = Effect.fn("GoModule.locate")(function* (dir) {
 const discover$2 = Effect.fn("GoModule.discover")(function* (dir, nested = []) {
 	const exec = yield* Exec;
 	const { found, failed } = yield* locateAll(dir, nested, "go.mod", locate$1);
-	const failedWorks = [];
-	const modules = yield* Effect.forEach(found, ({ root, work }) => Effect.gen(function* () {
-		if (!work) return [{
-			root,
-			moduleDir: root
-		}];
-		const edit = {
-			command: "go",
-			args: [
-				"work",
-				"edit",
-				"-json"
-			],
-			cwd: root
+	const works = yield* Effect.forEach(found, ({ root, work, claimed }) => Effect.gen(function* () {
+		if (!work) return {
+			modules: [{
+				root,
+				moduleDir: root,
+				local: /* @__PURE__ */ new Set()
+			}],
+			failed: [],
+			covered: [root]
 		};
-		const file = yield* exec.stdout(edit).pipe(Effect.flatMap(decodeGoJson(WorkFile, commandLine(edit))), Effect.result);
+		const covered = [];
 		const place = placeOf$1(dir, root);
-		if (Result.isSuccess(file)) return (file.success.Use ?? []).map((use) => ({
-			root,
-			moduleDir: path.resolve(root, use.DiskPath)
-		})).filter(({ moduleDir }) => place === "" || placeOf$1(dir, moduleDir) !== "");
-		if (place === "") return yield* file.failure;
-		failedWorks.push(failing(path.join(place, "go.work"), file.failure));
-		return [];
-	}));
-	const listed = new Set(modules.flat().map(({ moduleDir }) => moduleDir));
+		const scanned = yield* Effect.gen(function* () {
+			const edit = {
+				command: "go",
+				args: [
+					"work",
+					"edit",
+					"-json"
+				],
+				cwd: root
+			};
+			const file = yield* exec.stdout(edit).pipe(Effect.flatMap(decodeGoJson(WorkFile, commandLine(edit))));
+			const used = (file.Use ?? []).map((use) => path.resolve(root, use.DiskPath));
+			covered.push(...used);
+			const paths = yield* Effect.forEach(used, (moduleDir) => Effect.gen(function* () {
+				const mod = yield* readModFile(exec, moduleDir);
+				if (mod.Module === void 0) return yield* new OutputMalformed({
+					command: "go mod edit -json",
+					issue: `no module path in ${path.join(moduleDir, "go.mod")}`
+				});
+				return mod.Module.Path;
+			}), { concurrency: 8 });
+			const local = /* @__PURE__ */ new Set([...paths, ...(file.Replace ?? []).map((replace) => replace.Old.Path)]);
+			return used.map((moduleDir) => ({
+				root,
+				moduleDir,
+				local
+			})).filter(({ moduleDir }) => place === "" || placeOf$1(dir, moduleDir) !== "");
+		}).pipe(Effect.result);
+		if (Result.isSuccess(scanned)) return {
+			modules: scanned.success,
+			failed: [],
+			covered
+		};
+		return {
+			modules: [],
+			failed: [failing(path.join(place, "go.work"), scanned.failure)],
+			covered: [...covered, ...claimed]
+		};
+	}), { concurrency: 4 });
+	const listed = new Set(works.flatMap((work) => work.covered));
 	const outside = nested.flatMap((moduleDir) => listed.has(moduleDir) ? [] : [{
 		root: moduleDir,
-		moduleDir
+		moduleDir,
+		local: /* @__PURE__ */ new Set()
 	}]);
-	const providers = yield* Effect.forEach([...modules.flat(), ...outside], ({ root, moduleDir }) => make$6(root, moduleDir, placeOf$1(dir, root)));
+	const providers = yield* Effect.forEach([...works.flatMap(({ modules }) => modules), ...outside], ({ root, moduleDir, local }) => make$7(root, moduleDir, placeOf$1(dir, root), local));
 	return [
 		...failed,
-		...failedWorks,
+		...works.flatMap((work) => work.failed),
 		...providers
 	];
 });
 // src/inventory/ProviderSource.ts
 var ProviderSource = class extends Context.Service()("upup/ProviderSource") {};
-// src/node/prerelease-line.ts
+// src/node/release-history.ts
 const minutesPerDay = 1440;
-const firstPnpmMajorWithDefaultReleaseAge = 11;
 const gateSettings = {
 	pnpm: {
 		age: "minimumReleaseAge",
 		exclude: "minimumReleaseAgeExclude",
 		unit: 1,
-		unset: (version) => (semver.coerce(version)?.major ?? 0) >= firstPnpmMajorWithDefaultReleaseAge ? minutesPerDay : 0
+		unset: minutesPerDay
 	},
 	npm: {
 		age: "min-release-age",
 		exclude: "min-release-age-exclude",
 		unit: minutesPerDay,
-		unset: () => 0
+		unset: 0
 	}
 };
-const releaseGate = (manager, version, config) => {
+const releaseGate = (manager, config) => {
 	const settings = gateSettings[manager];
-	const minutes = Number(config[settings.age] ?? settings.unset(version)) * settings.unit;
+	const minutes = Number(config[settings.age] ?? settings.unset) * settings.unit;
 	return {
 		minutes: Number.isFinite(minutes) && minutes > 0 ? minutes : 0,
 		exclude: [config[settings.exclude] ?? []].flat().filter((pattern) => typeof pattern === "string")
@@ -10287,16 +10376,18 @@ const exempt = (rules, name, version) => {
 };
 const isPrerelease = (version) => semver.prerelease(version) !== null;
 const lineOf = (version) => (semver.prerelease(version) ?? []).map((part) => Predicate.isNumber(part) ? "#" : part).join(".");
-const prereleaseSuccessor = (name, current, history, gate, now) => {
+const releaseSuccessor = (name, current, history, gate, now) => {
 	const line = lineOf(current);
 	const following = isPrerelease(current);
 	const pinned = Date.parse(history.time[current] ?? "");
 	if (following && Number.isNaN(pinned)) return Result.fail(`${name} ${current} has no publish date, so upup offers it nothing`);
 	const releasedBeforePrereleasePin = (published) => following && !(published > pinned);
+	const latest = semver.valid(history.latest ?? "");
+	const beyondLatest = (candidate) => latest !== null && semver.gt(candidate, latest);
 	let newest;
 	for (const candidate of history.versions) {
 		if (semver.valid(candidate) === null || !semver.gt(candidate, current)) continue;
-		if (isPrerelease(candidate) && lineOf(candidate) !== line) continue;
+		if (isPrerelease(candidate) ? lineOf(candidate) !== line : beyondLatest(candidate)) continue;
 		const published = Date.parse(history.time[candidate] ?? "");
 		if (Number.isNaN(published) || releasedBeforePrereleasePin(published)) continue;
 		if (gate.minutes > 0 && now - published < gate.minutes * 6e4 && !exempt(gate.exclude, name, candidate)) continue;
@@ -10304,35 +10395,63 @@ const prereleaseSuccessor = (name, current, history, gate, now) => {
 	}
 	return Result.succeed(newest);
 };
-const Viewed = Schema.Struct({
+const ViewedRelease = Schema.Struct({
 	versions: Schema.Union([Schema.String, Schema.Array(Schema.String)]),
-	time: Schema.Record(Schema.String, Schema.String)
-});
-const prereleaseOffers = Effect.fn("prereleaseOffers")(function* (pins, manager, run, config) {
+	time: Schema.Record(Schema.String, Schema.String),
+	"dist-tags": Schema.optionalKey(Schema.Struct({ latest: Schema.optionalKey(Schema.String) }))
+});
+const Viewed = Schema.Union([ViewedRelease, Schema.NonEmptyArray(ViewedRelease)]);
+const ViewFailed = Schema.Struct({ error: Schema.Struct({
+	code: Schema.optionalKey(Schema.String),
+	summary: Schema.optionalKey(Schema.String),
+	message: Schema.optionalKey(Schema.String)
+}) });
+const releaseOffers = Effect.fn("releaseOffers")(function* (pins, manager, run, config) {
 	const exec = yield* Exec;
 	const now = yield* Clock.currentTimeMillis;
-	const read = (artifact) => {
+	const read = Effect.fn("releaseOffers.read")(function* (artifact) {
 		const view = run([
 			"view",
 			artifact,
 			"versions",
 			"time",
+			"dist-tags",
 			"--json"
 		]);
-		return exec.stdout(view).pipe(Effect.flatMap(decodeJson(Viewed, commandLine(view))), Effect.map((viewed) => ({
+		const output = yield* exec.run(view);
+		if (output.exitCode !== 0) {
+			const reported = Option.getOrUndefined(Schema.decodeOption(Schema.fromJsonString(ViewFailed))(output.stdout))?.error;
+			if (reported?.code?.includes("404") === true) return [artifact, Result.fail(`${artifact} isn't on the registry, or your credentials can't see it, so upup offers it nothing`)];
+			return yield* new CommandFailed({
+				command: commandLine(view),
+				cwd: view.cwd,
+				exitCode: output.exitCode,
+				output: reported?.summary ?? reported?.message ?? output.stderr
+			});
+		}
+		const decoded = yield* decodeJson(Viewed, commandLine(view))(output.stdout);
+		const viewed = "versions" in decoded ? decoded : decoded[0];
+		const latest = viewed["dist-tags"]?.latest;
+		const history = {
 			versions: [viewed.versions].flat(),
-			time: viewed.time
-		})), Effect.result, Effect.map((history) => [artifact, history]));
+			time: viewed.time,
+			...latest === void 0 ? {} : { latest }
+		};
+		return [artifact, Result.succeed(history)];
+	});
+	const artifacts = new Set(pins.map((pin) => pin.artifact));
+	const reads = yield* Effect.result(Effect.forEach(artifacts, read, { concurrency: 8 }));
+	const histories = new Map(Result.isSuccess(reads) ? reads.success : []);
+	const notices = Result.isFailure(reads) ? [{ message: `release histories could not be read, so upup offers nothing: ${describeError(reads.failure)}` }] : [];
+	const gate = releaseGate(manager, config);
+	const offer = (pin) => {
+		const history = histories.get(pin.artifact);
+		if (history === void 0) return Result.succeed(void 0);
+		return Result.flatMap(history, (found) => releaseSuccessor(pin.artifact, pin.current, found, gate, now));
 	};
-	const followed = (pin) => isPrerelease(pin.current) || pin.history === true;
-	const artifacts = new Set(pins.flatMap((pin) => followed(pin) ? [pin.artifact] : []));
-	const histories = new Map(yield* Effect.forEach(artifacts, read, { concurrency: 4 }));
-	const version = manager === "pnpm" && artifacts.size > 0 ? yield* exec.stdout(run(["--version"])) : "";
-	const gate = releaseGate(manager, version.trim(), config);
-	return (pin) => {
-		const history = followed(pin) ? histories.get(pin.artifact) : void 0;
-		if (history === void 0) return;
-		return Result.isFailure(history) ? Result.fail(`${pin.artifact}'s release history could not be read, so upup offers it nothing: ${describeError(history.failure)}`) : prereleaseSuccessor(pin.artifact, pin.current, history.success, gate, now);
+	return {
+		offer,
+		notices
 	};
 });
 // src/node/script-policy.ts
@@ -10388,7 +10507,7 @@ const Root = Schema.Struct({
 	dependencies: Schema.optionalKey(Schema.Record(Schema.String, Dependency))
 });
 const Listed$1 = Schema.Union([Root, Schema.Array(Root)]);
-const Outdated$1 = Schema.Record(Schema.String, Schema.Struct({ latest: Schema.optionalKey(Schema.String) }));
+const Outdated = Schema.Record(Schema.String, Schema.Struct({ latest: Schema.optionalKey(Schema.String) }));
 const parseListed = (provider, listed) => {
 	const roots = Array.isArray(listed) ? listed : [listed];
 	const pkg = (name, version, runtime) => ({
@@ -10422,7 +10541,7 @@ const makeGlobal = (spec) => Effect.gen(function* () {
 	const latest = Effect.gen(function* () {
 		const outdated = invocation(spec.outdated);
 		const output = yield* exec.run(outdated);
-		const parsed = yield* decodeJson(Outdated$1, commandLine(outdated))(output.stdout).pipe(Effect.catchTag("OutputMalformed", (error) => output.exitCode === 0 ? Effect.fail(error) : Effect.fail(new CommandFailed({
+		const parsed = yield* decodeJson(Outdated, commandLine(outdated))(output.stdout).pipe(Effect.catchTag("OutputMalformed", (error) => output.exitCode === 0 ? Effect.fail(error) : Effect.fail(new CommandFailed({
 			command: commandLine(outdated),
 			cwd: outdated.cwd,
 			exitCode: output.exitCode,
@@ -10435,21 +10554,21 @@ const makeGlobal = (spec) => Effect.gen(function* () {
 			installed,
 			latest,
 			readNpmConfig(spec.config, "/").pipe(Effect.provideService(Exec, exec))
-		], { concurrency: 3 });
-		const offers = yield* prereleaseOffers(packages, spec.config, (args) => ({
+		], { concurrency: "unbounded" });
+		const { offer, notices: unread } = yield* releaseOffers(packages.filter((pkg) => isPrerelease(pkg.current)), spec.config, (args) => ({
 			command: spec.config,
 			args,
 			cwd: "/"
 		}), config).pipe(Effect.provideService(Exec, exec));
-		const notices = [];
+		const notices = [...unread];
 		return {
 			packages: packages.map(withNpmOrigin(npmRegistries(config))).map((pkg) => {
-				const line = offers(pkg);
-				if (line !== void 0 && Result.isFailure(line)) notices.push({
+				const line = offer(pkg);
+				if (Result.isFailure(line)) notices.push({
 					rowKey: rowKey(pkg),
 					message: line.failure
 				});
-				const target = line === void 0 ? targets.get(pkg.name) : Result.getOrUndefined(line);
+				const target = isPrerelease(pkg.current) ? Result.getOrUndefined(line) : targets.get(pkg.name);
 				return target !== void 0 && isNewerStable(pkg.current, target) ? withTarget(pkg, target) : pkg;
 			}),
 			notices
@@ -10666,12 +10785,13 @@ const scan = Effect.fn("NodePins.scan")(function* (root, dir, nested) {
 	const fs = yield* FileSystem.FileSystem;
 	const read = (file) => readText(path.join(root, file));
 	const exists = (file) => fs.exists(path.join(root, file)).pipe(Effect.mapError(fileFailed("stat", path.join(root, file))));
-	const steps = (yield* workflowFiles(root)).flatMap(({ file, text }) => stepPins(file, text) ?? []);
-	const versioned = yield* Effect.filter(yield* versionFilesOf(root, dir, nested), exists);
-	const files = yield* Effect.forEach(versioned.toSorted(), (file) => Effect.map(read(file), (text) => filePin(file, text)));
+	const [workflows, listed] = yield* Effect.all([workflowFiles(root), versionFilesOf(root, dir, nested)], { concurrency: "unbounded" });
+	const steps = workflows.flatMap(({ file, text }) => stepPins(file, text) ?? []);
+	const versioned = yield* Effect.filter(listed, exists, { concurrency: "unbounded" });
+	const files = yield* Effect.forEach(versioned.toSorted(), (file) => Effect.map(read(file), (text) => filePin(file, text)), { concurrency: 8 });
 	return [...steps, ...files.flat()];
 });
-const make$5 = (root, dir = root, nested = []) => Effect.gen(function* () {
+const make$6 = (root, dir = root, nested = []) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const client = yield* HttpClient.HttpClient;
 	const context = yield* Effect.context();
@@ -10742,7 +10862,7 @@ const discover$1 = Effect.fn("NodePins.discover")(function* (dir, nested = []) {
 	if (Option.isNone(repository)) return [];
 	const pins = yield* scan(repository.value, dir, nested).pipe(Effect.result);
 	if (Result.isSuccess(pins) && pins.success.length === 0) return [];
-	return [yield* make$5(repository.value, dir, nested)];
+	return [yield* make$6(repository.value, dir, nested)];
 });
 // src/node/selector.ts
 const split = (name, spec) => {
@@ -10794,20 +10914,21 @@ const Manifest = Schema.Struct({
 	optionalDependencies: Schema.optionalKey(Specs)
 });
 const Resolved = Schema.Record(Schema.String, Schema.Struct({ version: Schema.String }));
-const PnpmLock = Schema.Struct({ importers: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
-	dependencies: Schema.optionalKey(Resolved),
-	devDependencies: Schema.optionalKey(Resolved),
-	optionalDependencies: Schema.optionalKey(Resolved)
-}))) });
+const PnpmLock = Schema.Struct({
+	overrides: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	importers: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
+		dependencies: Schema.optionalKey(Resolved),
+		devDependencies: Schema.optionalKey(Resolved),
+		optionalDependencies: Schema.optionalKey(Resolved)
+	})))
+});
 const PnpmManagerLock = Schema.Struct({ importers: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ packageManagerDependencies: Schema.optionalKey(Resolved) }))) });
 const NpmLock = Schema.Struct({ packages: Schema.Record(Schema.String, Schema.Struct({ version: Schema.optionalKey(Schema.String) })) });
 const Workspace = Schema.Struct({
 	catalog: Schema.optionalKey(Specs),
-	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Specs))
+	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Specs)),
+	overrides: Schema.optionalKey(Specs)
 });
-const OutdatedEntry = Schema.Struct({ latest: Schema.optionalKey(Schema.String) });
-const Outdated = Schema.Record(Schema.String, Schema.Union([OutdatedEntry, Schema.Array(OutdatedEntry)]));
-const NpmError = Schema.Struct({ error: Schema.Struct({ summary: Schema.String }) });
 const PackageJsonFields = Schema.Struct({
 	workspaces: Schema.optionalKey(Schema.Unknown),
 	packageManager: Schema.optionalKey(Schema.String),
@@ -10830,25 +10951,22 @@ const managerEntry = "the package manager's declaration is removed by hand, in p
 const resolvedVersion = (version) => version?.split("(")[0];
 const readJson = (schema, file) => readText(file).pipe(Effect.flatMap((text) => decodeFile(schema, file)(parse$1(text))));
 const exact = (version) => semver.valid(version) === version ? version : void 0;
+const overriddenName = (key) => {
+	const target = key.split(">").at(-1) ?? key;
+	const at = target.indexOf("@", target.startsWith("@") ? 1 : 0);
+	return at === -1 ? target : target.slice(0, at);
+};
 const corepackHashed = (name, algorithm) => {
 	if (algorithm === void 0) return {};
 	if (algorithm === "sha512") return { hashed: true };
 	return { held: `${name}'s packageManager entry carries a ${algorithm} hash, which upup can work out only for sha512; move it by hand` };
 };
-const pinOf = ({ pkg, manager: own }) => ({
-	artifact: pkg.artifact,
-	current: pkg.current,
-	...own === true ? { history: true } : {}
-});
 const editDeclaration = (text, manifest, entry, next) => {
 	if (next === void 0 && entry.pkg.unremovable !== void 0) return Result.fail(entry.pkg.unremovable);
 	if (manifest.endsWith(".yaml") && next !== void 0) return editYamlScalar(text, entry.path, next);
 	return editJson(text, entry.path, next);
 };
-const withoutDependencyKindMarker = (key) => key.replace(/ \([a-z]+\)$/u, "");
-const withoutLockedVersionSuffix = (key) => key.replace(/(?<=.)@[^@/ ]+$/u, "");
-const outdatedName = (key) => withoutLockedVersionSuffix(withoutDependencyKindMarker(key));
-const make$4 = (root, manager, place = "") => Effect.gen(function* () {
+const make$5 = (root, manager, place = "", claimed = []) => Effect.gen(function* () {
 	const providerName = placed(manager, place);
 	const exec = yield* Exec;
 	const fs = yield* FileSystem.FileSystem;
@@ -10929,27 +11047,35 @@ const make$4 = (root, manager, place = "") => Effect.gen(function* () {
 				onNone: () => []
 			})
 		});
+		const lockedDirs = new Set(members.map((member) => path.normalize(member)));
+		const unlocked = claimed.filter((dir) => !lockedDirs.has(path.normalize(dir))).toSorted((a, b) => a.localeCompare(b));
+		if (unlocked.length > 0) notices.push({ message: `not listed: ${unlocked.join(", ")} (not in ${lockfile})` });
 		const catalogLocked = /* @__PURE__ */ new Map();
-		for (const member of members.toSorted((a, b) => a.localeCompare(b))) {
+		const memberManifests = yield* Effect.forEach(members.toSorted((a, b) => a.localeCompare(b)), (member) => {
 			const memberDir = member === "." ? "" : member;
 			const manifest = path.join(memberDir, "package.json");
-			const fields = yield* readJson(Manifest, path.join(root, manifest));
-			for (const section of sections) for (const [name, spec] of Object.entries(fields[section] ?? {})) {
-				const resolved = Option.match(pnpm, {
-					onSome: (lock) => resolvedVersion(lock.importers?.[member]?.[section]?.[name]?.version),
-					onNone: () => Option.match(npm, {
-						onSome: (lock) => lock.packages[path.join(memberDir, "node_modules", name)]?.version ?? lock.packages[path.join("node_modules", name)]?.version,
-						onNone: () => void 0
-					})
-				});
-				if (spec.startsWith("catalog:")) {
-					const catalog = spec.slice(8) || "default";
-					const locked = catalogLocked.get(catalog) ?? /* @__PURE__ */ new Map();
-					if (resolved !== void 0 && !locked.has(name)) catalogLocked.set(catalog, locked.set(name, resolved));
-					continue;
-				}
-				add(manifest, section, [section, name], name, spec, resolved);
+			return Effect.map(readJson(Manifest, path.join(root, manifest)), (fields) => ({
+				member,
+				memberDir,
+				manifest,
+				fields
+			}));
+		}, { concurrency: 8 });
+		for (const { member, memberDir, manifest, fields } of memberManifests) for (const section of sections) for (const [name, spec] of Object.entries(fields[section] ?? {})) {
+			const resolved = Option.match(pnpm, {
+				onSome: (lock) => resolvedVersion(lock.importers?.[member]?.[section]?.[name]?.version),
+				onNone: () => Option.match(npm, {
+					onSome: (lock) => lock.packages[path.join(memberDir, "node_modules", name)]?.version ?? lock.packages[path.join("node_modules", name)]?.version,
+					onNone: () => void 0
+				})
+			});
+			if (spec.startsWith("catalog:")) {
+				const catalog = spec.slice(8) || "default";
+				const locked = catalogLocked.get(catalog) ?? /* @__PURE__ */ new Map();
+				if (resolved !== void 0 && !locked.has(name)) catalogLocked.set(catalog, locked.set(name, resolved));
+				continue;
 			}
+			add(manifest, section, [section, name], name, spec, resolved);
 		}
 		if (Option.isSome(pnpm) && (yield* exists(path.join(root, "pnpm-workspace.yaml")))) {
 			const workspacePath = path.join(root, "pnpm-workspace.yaml");
@@ -10963,8 +11089,25 @@ const make$4 = (root, manager, place = "") => Effect.gen(function* () {
 				["catalogs", catalog],
 				entries
 			])];
+			const overridden = /* @__PURE__ */ new Map();
+			for (const [key, spec] of Object.entries(workspace.overrides ?? {})) {
+				if (!spec.startsWith("catalog:")) continue;
+				const name = overriddenName(key);
+				const locked = pnpm.value.overrides?.[key];
+				const selector = locked === void 0 ? void 0 : parseSelector(name, locked);
+				if (selector === void 0 || exact(selector.range) === void 0) continue;
+				const id = `${spec.slice(8) || "default"}:${name}`;
+				const versions = overridden.get(id) ?? /* @__PURE__ */ new Set();
+				versions.add(selector.artifact === name ? selector.range : `${selector.artifact}@${selector.range}`);
+				overridden.set(id, versions);
+			}
 			for (const [catalog, catalogPath, entries] of catalogs) for (const [name, spec] of Object.entries(entries)) {
-				const resolved = catalogLocked.get(catalog)?.get(name);
+				const overrides = overridden.get(`${catalog}:${name}`);
+				if (overrides !== void 0 && overrides.size > 1) {
+					notices.push({ message: `${catalog} catalog entry ${name} has conflicting locked overrides; run pnpm install` });
+					continue;
+				}
+				const resolved = catalogLocked.get(catalog)?.get(name) ?? overrides?.values().next().value;
 				if (resolved === void 0) continue;
 				add("pnpm-workspace.yaml", catalogPath.join("."), [...catalogPath, name], name, spec, resolved);
 			}
@@ -11001,53 +11144,20 @@ const make$4 = (root, manager, place = "") => Effect.gen(function* () {
 			notices
 		};
 	}).pipe(Effect.provideService(FileSystem.FileSystem, fs));
-	const latest = Effect.gen(function* () {
-		const workspaces = manager === "npm" && (yield* readJson(PackageJsonFields, path.join(root, "package.json"))).workspaces !== void 0;
-		const outdated = run(manager === "pnpm" ? [
-			"outdated",
-			"-r",
-			"--format",
-			"json"
-		] : [
-			"outdated",
-			"--json",
-			...workspaces ? ["--workspaces", "--include-workspace-root"] : []
-		]);
-		const output = yield* exec.run(outdated);
-		const reported = Schema.decodeOption(Schema.fromJsonString(NpmError))(output.stdout);
-		if (output.exitCode !== 0 && (output.stdout.trim() === "" || Option.isSome(reported))) return yield* new CommandFailed({
-			command: commandLine(outdated),
-			cwd: root,
-			exitCode: output.exitCode,
-			output: Option.isSome(reported) ? reported.value.error.summary : output.stderr
-		});
-		const parsed = yield* decodeJson(Outdated, commandLine(outdated))(output.stdout || "{}");
-		const targets = /* @__PURE__ */ new Map();
-		for (const [key, entries] of Object.entries(parsed)) {
-			const name = outdatedName(key);
-			const newest = [entries].flat().find((entry) => entry.latest !== void 0)?.latest;
-			if (newest !== void 0 && !targets.has(name)) targets.set(name, newest);
-		}
-		return targets;
-	}).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	const list = Effect.gen(function* () {
-		const [{ declared, notices }, targets, config] = yield* Effect.all([
-			declarations,
-			latest,
-			readNpmConfig(manager, root).pipe(Effect.provideService(Exec, exec))
-		], { concurrency: 3 });
+		const [{ declared, notices }, config] = yield* Effect.all([declarations, readNpmConfig(manager, root).pipe(Effect.provideService(Exec, exec))], { concurrency: "unbounded" });
 		const origin = withNpmOrigin(npmRegistries(config));
-		const offers = yield* prereleaseOffers(declared.flatMap((entry) => entry.held === true ? [] : [pinOf(entry)]), manager, run, config).pipe(Effect.provideService(Exec, exec));
+		const { offer, notices: unread } = yield* releaseOffers(declared.flatMap((entry) => entry.held === true ? [] : [entry.pkg]), manager, run, config).pipe(Effect.provideService(Exec, exec));
 		return {
 			packages: declared.map((entry) => {
 				const pkg = origin(entry.pkg);
 				if (entry.held === true) return pkg;
-				const line = offers(pinOf(entry));
-				if (line !== void 0 && Result.isFailure(line)) notices.push({
+				const line = offer(entry.pkg);
+				if (Result.isFailure(line)) notices.push({
 					rowKey: rowKey(pkg),
 					message: line.failure
 				});
-				const target = line === void 0 ? targets.get(pkg.name) ?? targets.get(pkg.artifact) : Result.getOrUndefined(line);
+				const target = Result.getOrUndefined(line);
 				if (target === void 0 || !isNewerStable(pkg.current, target)) return pkg;
 				const selector = parseSelector(pkg.name, pkg.declaration?.selector ?? "");
 				if (selector === void 0 || moveTo(selector, target) === void 0) {
@@ -11059,7 +11169,7 @@ const make$4 = (root, manager, place = "") => Effect.gen(function* () {
 				}
 				return withTarget(pkg, target);
 			}),
-			notices
+			notices: [...unread, ...notices]
 		};
 	}).pipe(Effect.withSpan(`NodeProject.list`));
 	const find = (pkg) => declarations.pipe(Effect.map(({ declared }) => declared.find((entry) => entry.pkg.id === pkg.id)));
@@ -11230,7 +11340,7 @@ const discover = Effect.fn("NodeProject.discover")(function* (dir, nested = [])
 	const { found, failed } = yield* locateAll(dir, nested, "package.json", locate);
 	const providers = [...failed];
 	const unlisted = [];
-	for (const { root, manager } of found) {
+	for (const { root, manager, claimed } of found) {
 		const place = placeOf$1(dir, root);
 		if (!isManager(manager)) {
 			if (place === "") providers.push(failing(manager, new Unsupported({ reason: `${path.relative(dir, root) || "This"} project uses ${manager}, which upup does not support` })));
@@ -11240,11 +11350,147 @@ const discover = Effect.fn("NodeProject.discover")(function* (dir, nested = [])
 		const lockfile = path.join(root, lockfiles[manager]);
 		const installed = yield* fs.exists(lockfile).pipe(Effect.mapError(fileFailed("stat", lockfile)));
 		if (place !== "" && !installed) unlisted.push(`${place} (no ${lockfiles[manager]} yet)`);
-		else providers.push(yield* make$4(root, manager, place));
+		else {
+			const manifests = yield* Effect.filter(claimed, (from) => fs.exists(path.join(from, "package.json")).pipe(Effect.mapError(fileFailed("stat", from))), { concurrency: "unbounded" });
+			providers.push(yield* make$5(root, manager, place, manifests.map((from) => path.relative(root, from))));
+		}
 	}
 	if (unlisted.length > 0) providers.push(notListed(unlisted));
 	return providers;
 });
+// src/node/VpEnv.ts
+const vp$1 = (args) => ({
+	command: "vp",
+	args: ["env", ...args],
+	cwd: "/"
+});
+const defaults = vp$1(["default"]);
+const tools$1 = /* @__PURE__ */ new Set([
+	"node",
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+const Release$1 = Schema.Struct({
+	version: Schema.String,
+	latest: Schema.Boolean
+});
+const NodeReleases = Schema.Struct({ node: Schema.Array(Release$1) });
+const ManagerReleases = Schema.Struct({ package_managers: Schema.Record(Schema.String, Schema.Array(Release$1)) });
+const malformed$1 = (command, issue) => new OutputMalformed({
+	command: commandLine(command),
+	issue
+});
+const readDefaults = Effect.fn("VpEnv.readDefaults")(function* (output) {
+	const entries = [];
+	const notices = [];
+	let recognized = false;
+	for (const line of output.split("\n").map((text) => text.trim())) {
+		if (line.startsWith("No default Node.js version configured.") || line === "Package manager defaults: not configured") recognized = true;
+		if (!line.startsWith("Default ")) continue;
+		const fields = /^Default (?<name>.+) version: (?<selector>\S+)$/u.exec(line)?.groups;
+		const label = fields?.["name"];
+		const selector = fields?.["selector"];
+		if (label === void 0 || selector === void 0) return yield* malformed$1(defaults, `unrecognized default: ${line}`);
+		recognized = true;
+		const name = label === "Node.js" ? "node" : label;
+		if (tools$1.has(name)) entries.push({
+			name,
+			selector
+		});
+		else notices.push({ message: `Vite+ default ${name} is not supported` });
+	}
+	if (!recognized) return yield* malformed$1(defaults, "no global defaults found");
+	if (entries.length === 0) return {
+		packages: [],
+		notices
+	};
+	const manifest = /^\s+Set via: (?<path>.+)$/mu.exec(output)?.groups?.["path"];
+	if (manifest === void 0) return yield* malformed$1(defaults, "no configuration path found");
+	return {
+		packages: entries.map(({ name, selector }) => {
+			const version = semver.parse(selector);
+			return {
+				provider: "vp-env",
+				id: name,
+				name,
+				ecosystem: name === "node" ? "node" : "npm",
+				artifact: name === "yarn" && version !== null && version.major >= 2 ? "@yarnpkg/cli-dist" : name,
+				current: version?.version ?? selector,
+				declaration: {
+					manifest,
+					section: `${name} default`,
+					selector
+				},
+				description: version === null ? `Managed automatically by Vite+ (${selector})` : "Vite+ global default",
+				unremovable: "Vite+ defaults are cleared with vp env default --unset"
+			};
+		}),
+		notices
+	};
+});
+const make$4 = Effect.gen(function* () {
+	const exec = yield* Exec;
+	const configured = exec.stdout(defaults).pipe(Effect.flatMap(readDefaults));
+	const offer = Effect.fn("VpEnv.offer")(function* (pkg) {
+		const current = semver.parse(pkg.current);
+		if (current === null) return;
+		const withinMajor = pkg.id === "node" || pkg.id === "yarn" && current.major === 1;
+		const command = vp$1([
+			"list-remote",
+			pkg.id,
+			...withinMajor ? [String(current.major)] : [],
+			"--json"
+		]);
+		const output = yield* exec.stdout(command);
+		const releases = pkg.id === "node" ? (yield* decodeJson(NodeReleases, commandLine(command))(output)).node : (yield* decodeJson(ManagerReleases, commandLine(command))(output)).package_managers[pkg.id];
+		if (releases === void 0 || releases.length === 0) return yield* malformed$1(command, `no releases found for ${pkg.name}`);
+		return newestOffer(pkg.current, releases.filter(({ version, latest }) => (withinMajor || latest) && semver.prerelease(version) === null).map(({ version }) => version));
+	});
+	const list = Effect.gen(function* () {
+		const found = yield* configured;
+		const offered = yield* Effect.forEach(found.packages, (pkg) => Effect.map(Effect.result(offer(pkg)), (target) => ({
+			pkg,
+			target
+		})), { concurrency: 4 });
+		const notices = [...found.notices];
+		return {
+			packages: offered.map(({ pkg, target }) => {
+				if (Result.isFailure(target)) {
+					notices.push({
+						rowKey: rowKey(pkg),
+						message: describeError(target.failure)
+					});
+					return pkg;
+				}
+				return target.success === void 0 ? pkg : withTarget(pkg, target.success);
+			}),
+			notices
+		};
+	}).pipe(Effect.withSpan("VpEnv.list"));
+	const observe = Effect.fn("VpEnv.observe")(function* (pkg) {
+		return Option.fromUndefinedOr((yield* configured).packages.find((candidate) => candidate.id === pkg.id));
+	});
+	const unchanged = Effect.fn("VpEnv.unchanged")(function* (pkg) {
+		const current = yield* observe(pkg);
+		if (Option.isNone(current) || current.value.current !== pkg.current || current.value.declaration?.selector !== pkg.declaration?.selector) return yield* new InstallRefused({
+			package: pkg.name,
+			reason: "the Vite+ default changed; refresh before updating"
+		});
+	});
+	return {
+		name: "vp-env",
+		mode: "system",
+		list,
+		observe,
+		update: Effect.fn("VpEnv.update")(function* (pkg, target) {
+			yield* exec.stdout(vp$1(["install", `${pkg.id}@${target}`]));
+			yield* unchanged(pkg);
+			yield* exec.stdout(vp$1(["default", `${pkg.id}@${target}`]));
+		})
+	};
+});
 // src/node/VpSelf.ts
 const vp = (args) => ({
 	command: "vp",
@@ -11272,6 +11518,10 @@ const make$3 = Effect.gen(function* () {
 		mode: "system",
 		list: Effect.gen(function* () {
 			const output = yield* exec.stdout(check$1);
+			if (output.includes("Homebrew manages this installation.")) return {
+				packages: [],
+				notices: []
+			};
 			const { latest, current } = /found vite-plus@(?<latest>\S+) \(current: (?<current>\S+)\)/u.exec(output)?.groups ?? {};
 			if (latest === void 0 || current === void 0) return yield* malformed(check$1);
 			const pkg = vitePlus(current);
@@ -11347,7 +11597,7 @@ const make$2 = Effect.gen(function* () {
 				exec.stdout(command$1("apt", ["list", "--upgradable"])).pipe(Effect.map(parseUpgradable)),
 				exec.stdout(command$1("apt-mark", ["showhold"])).pipe(Effect.map((text) => new Set(text.split("\n").filter((line) => line !== "")))),
 				restart
-			], { concurrency: 4 });
+			], { concurrency: "unbounded" });
 			const packages = upgradable.map((entry) => {
 				const pkg = packageOf(entry, arch);
 				return holds.has(entry.name) || holds.has(pkg.id) ? pkg : withTarget(pkg, entry.version);
@@ -11492,7 +11742,7 @@ const make$1 = Effect.gen(function* () {
 			running,
 			scan(args),
 			Ref.get(installed)
-		], { concurrency: 2 });
+		], { concurrency: "unbounded" });
 		return {
 			packages: packagesOf$1(version, offers.filter((offer) => !done.has(offer.label))),
 			done
@@ -11577,7 +11827,7 @@ const make = Effect.gen(function* () {
 				"list",
 				"--outdated",
 				"--show-python"
-			])).pipe(Effect.map(parseTools))], { concurrency: 2 });
+			])).pipe(Effect.map(parseTools))], { concurrency: "unbounded" });
 			const targets = new Map(outdated.flatMap((tool) => tool.fromPyPI && tool.latest !== void 0 ? [[tool.pkg.id, tool.latest]] : []));
 			const index = privatePypiIndex();
 			return {
@@ -11615,18 +11865,19 @@ const make = Effect.gen(function* () {
 const system$1 = [
 	["softwareupdate", make$1],
 	["apt-get", make$2],
-	["brew", make$13],
-	["codesign", make$10],
+	["brew", make$14],
+	["codesign", make$11],
 	["npm", makeNpm],
 	["pnpm", makePnpm],
 	["vp", makeVp],
 	["vp", make$3],
-	["cargo", make$9],
-	["go", make$7],
+	["vp", make$4],
+	["cargo", make$10],
+	["go", make$8],
 	["uv", make]
 ];
-const available = (entries) => Effect.filter([...new Set(entries.map(([command]) => command))], onPath).pipe(Effect.map((found) => entries.filter(([command]) => found.includes(command))));
-const systemProviders = available(system$1).pipe(Effect.flatMap((found) => Effect.forEach(found, ([, make]) => make)));
+const available = (entries) => Effect.filter([...new Set(entries.map(([command]) => command))], onPath, { concurrency: "unbounded" }).pipe(Effect.map((found) => entries.filter(([command]) => found.includes(command))));
+const systemProviders = available(system$1).pipe(Effect.flatMap((found) => Effect.forEach(found, ([, make]) => make, { concurrency: "unbounded" })));
 const project$1 = [
 	["go", {
 		manifests: ["go.mod"],
@@ -11652,9 +11903,8 @@ const project$1 = [
 const manifests = project$1.flatMap(([, kind]) => kind.manifests);
 const projectProviders = (given) => Effect.gen(function* () {
 	const dir = yield* (yield* FileSystem.FileSystem).realPath(given).pipe(Effect.orElseSucceed(() => given));
-	const found = yield* available(project$1);
-	const nested = yield* nestedDirs(dir, manifests);
-	return (yield* Effect.forEach(found, ([, kind]) => kind.discover(dir, [...new Set(kind.manifests.flatMap(nested))]))).flat();
+	const [found, nested] = yield* Effect.all([available(project$1), nestedDirs(dir, manifests)], { concurrency: "unbounded" });
+	return (yield* Effect.forEach(found, ([, kind]) => kind.discover(dir, [...new Set(kind.manifests.flatMap(nested))]), { concurrency: "unbounded" })).flat();
 });
 const layer$3 = Layer.effect(ProviderSource, Effect.gen(function* () {
 	const context = yield* Effect.context();
@@ -11764,7 +12014,7 @@ const message = (version) => {
 };
 const lookup$1 = Effect.fn("npm.lookup")(function* (client, wanted) {
 	const path = wanted.name.replace("/", "%2F");
-	const [packument, downloads] = yield* Effect.all([getJson(client, `https://registry.npmjs.org/${path}`, Packument), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: 2 });
+	const [packument, downloads] = yield* Effect.all([getJson(client, `https://registry.npmjs.org/${path}`, Packument), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: "unbounded" });
 	const versions = packument.versions ?? {};
 	const latest = packument["dist-tags"]?.latest;
 	const repository = Predicate.isString(packument.repository) ? packument.repository : packument.repository?.url;
@@ -11804,7 +12054,7 @@ const repositoryKeys = [
 	"GitHub"
 ];
 const lookup = Effect.fn("pypi.lookup")(function* (client, wanted) {
-	const [project, recent] = yield* Effect.all([getJson(client, `https://pypi.org/pypi/${wanted.name}/json`, Project), getJson(client, `https://pypistats.org/api/packages/${wanted.name.toLowerCase()}/recent`, Recent).pipe(Effect.option)], { concurrency: 2 });
+	const [project, recent] = yield* Effect.all([getJson(client, `https://pypi.org/pypi/${wanted.name}/json`, Project), getJson(client, `https://pypistats.org/api/packages/${wanted.name.toLowerCase()}/recent`, Recent).pipe(Effect.option)], { concurrency: "unbounded" });
 	const urls = project.info.project_urls ?? {};
 	const repository = repositoryKeys.map((key) => urls[key]).find((url) => url !== void 0);
 	const homepage = urls["Homepage"] ?? project.info.home_page ?? void 0;
@@ -12398,12 +12648,10 @@ const layer$1 = (cacheDir) => Layer.succeed(UpdateLog, UpdateLog.of({
 		const directory = path.join(cacheDir, "updates");
 		const names = (await readdir(directory).catch(() => [])).filter((name) => name.endsWith(".jsonl")).toSorted();
 		const found = [];
-		for (const name of names) {
-			const text = await readFile(path.join(directory, name), "utf-8").catch(() => "");
-			for (const line of text.split("\n")) {
-				const entry = Option.getOrUndefined(decodeLine(line));
-				if (entry?.scope === scope && Date.parse(entry.at) >= since) found.push(entry);
-			}
+		const texts = await Promise.all(names.map(async (name) => await readFile(path.join(directory, name), "utf-8").catch(() => "")));
+		for (const text of texts) for (const line of text.split("\n")) {
+			const entry = Option.getOrUndefined(decodeLine(line));
+			if (entry?.scope === scope && Date.parse(entry.at) >= since) found.push(entry);
 		}
 		return found;
 	})
@@ -12491,18 +12739,17 @@ const runProvider = Effect.fn("Engine.runProvider")(function* (provider, targets
 		key: rowKey(target.pkg),
 		outcome
 	}))));
-	const checked = [];
+	const applied = [];
 	for (const target of targets) {
 		if (yield* stopped) {
 			yield* finish(target, Outcome.NotStarted());
 			continue;
 		}
-		const result = yield* check(target, emit);
-		if (Result.isFailure(result)) yield* finish(target, result.failure);
-		else checked.push([target, result.success]);
-	}
-	const applied = [];
-	for (const [target, attempt] of checked) {
+		const checked = yield* check(target, emit);
+		if (Result.isFailure(checked)) {
+			yield* finish(target, checked.failure);
+			continue;
+		}
 		if (yield* stopped) {
 			yield* finish(target, Outcome.NotStarted());
 			continue;
@@ -12511,7 +12758,7 @@ const runProvider = Effect.fn("Engine.runProvider")(function* (provider, targets
 			key: rowKey(target.pkg),
 			phase: "applying"
 		}));
-		const result = yield* Effect.result(withDecisions(attempt));
+		const result = yield* Effect.result(withDecisions(checked.success));
 		if (Result.isFailure(result)) yield* finish(target, failedAs(result.failure, false));
 		else if (provider.reconcile === void 0) yield* finish(target, yield* verify(target, emit));
 		else applied.push(target);
@@ -12656,15 +12903,236 @@ const updateTools = (home) => Action.implement(UpdateActions, Effect.gen(functio
 }));
 // src/mcp.ts
 const instructions = "upup reads the tools installed on this machine and the registry dependencies of a project, audits offered updates with the user's chosen model, and applies or removes them. Start with list_packages; every other tool takes its package keys. Before updating, look at package_changes or run audit_packages and poll audit_reports until no Audit is running; operating-system updates (ecosystem macos or apt) can't be audited and have no changes to read; app updates (ecosystem sparkle, electron, appstore or app) can't be audited either, and package_changes gives their release notes when the app's feed has any; ask the user to quit an open app before updating it; the Node.js versions a project pins (ecosystem node) can't be audited either and are edited in place. update_packages and remove_packages change the user's machine or project and cannot be undone by upup: confirm them with the user, and ask before passing allowScripts.";
-const serve = (home) => ActionMcp.runStdio([
+const tools = (home) => [
 	inventoryTools(home),
 	auditTools(home),
 	updateTools(home)
-], {
+];
+const serverInfo = {
 	name: "upup",
 	version: version$1,
 	instructions
+};
+const serve = (home) => ActionMcp.runStdio(tools(home), serverInfo);
+// src/session/operation.ts
+const machine$1 = setup({
+	schemas: { events: {
+		Run: types(),
+		Stop: types(),
+		Ask: types(),
+		Answer: types(),
+		Finish: types()
+	} },
+	states: {
+		Idle: { schemas: { context: types() } },
+		Running: { schemas: { context: types() } },
+		Asking: { schemas: { context: types() } }
+	}
+}).createFSM({
+	initial: "Idle",
+	context: {
+		stopping: false,
+		decision: void 0
+	},
+	states: {
+		Idle: { on: { Run: { target: "Running" } } },
+		Running: { on: {
+			Stop: { context: { stopping: true } },
+			Ask: ({ event }) => ({
+				target: "Asking",
+				context: { decision: event.decision }
+			}),
+			Finish: {
+				target: "Idle",
+				context: { stopping: false }
+			}
+		} },
+		Asking: { on: {
+			Stop: { context: { stopping: true } },
+			Answer: {
+				target: "Running",
+				context: { decision: void 0 }
+			},
+			Finish: {
+				target: "Idle",
+				context: {
+					stopping: false,
+					decision: void 0
+				}
+			}
+		} }
+	}
+});
+const step$1 = (snapshot, event) => {
+	const [next] = machine$1.transition(snapshot, event);
+	return [next, next !== snapshot];
+};
+// src/session/sign-in.ts
+const machine = setup({
+	schemas: { events: {
+		SaveKey: types(),
+		Start: types(),
+		Noticed: types(),
+		Prompt: types(),
+		Answer: types(),
+		Succeed: types(),
+		Fail: types(),
+		Close: types()
+	} },
+	states: {
+		Idle: { schemas: { context: types() } },
+		SavingKey: { schemas: { context: types() } },
+		Working: { schemas: { context: types() } },
+		Prompted: { schemas: { context: types() } },
+		Failed: { schemas: { context: types() } },
+		SignedIn: { schemas: { context: types() } }
+	}
+}).createFSM({
+	initial: "Idle",
+	context: {
+		attempt: 0,
+		provider: void 0,
+		notices: void 0,
+		prompt: void 0,
+		issue: void 0
+	},
+	states: {
+		Idle: { on: {
+			SaveKey: ({ context, event }) => ({
+				target: "SavingKey",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider
+				}
+			}),
+			Start: ({ context, event }) => ({
+				target: "Working",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider,
+					notices: []
+				}
+			})
+		} },
+		SavingKey: { on: {
+			Succeed: ({ context, event }) => event.attempt === context.attempt ? { target: "SignedIn" } : void 0,
+			Fail: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "Failed",
+				context: { issue: event.issue }
+			} : void 0,
+			Close: {
+				target: "Idle",
+				context: { provider: void 0 }
+			}
+		} },
+		Working: { on: {
+			Noticed: ({ context, event }) => event.attempt === context.attempt ? { context: { notices: [...context.notices, event.notice] } } : void 0,
+			Prompt: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "Prompted",
+				context: { prompt: event.prompt }
+			} : void 0,
+			Succeed: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "SignedIn",
+				context: { notices: void 0 }
+			} : void 0,
+			Fail: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "Failed",
+				context: {
+					notices: void 0,
+					issue: event.issue
+				}
+			} : void 0,
+			Close: {
+				target: "Idle",
+				context: {
+					provider: void 0,
+					notices: void 0
+				}
+			}
+		} },
+		Prompted: { on: {
+			Noticed: ({ context, event }) => event.attempt === context.attempt ? { context: { notices: [...context.notices, event.notice] } } : void 0,
+			Answer: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "Working",
+				context: { prompt: void 0 }
+			} : void 0,
+			Succeed: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "SignedIn",
+				context: {
+					notices: void 0,
+					prompt: void 0
+				}
+			} : void 0,
+			Fail: ({ context, event }) => event.attempt === context.attempt ? {
+				target: "Failed",
+				context: {
+					notices: void 0,
+					prompt: void 0,
+					issue: event.issue
+				}
+			} : void 0,
+			Close: {
+				target: "Idle",
+				context: {
+					provider: void 0,
+					notices: void 0,
+					prompt: void 0
+				}
+			}
+		} },
+		Failed: { on: {
+			SaveKey: ({ context, event }) => ({
+				target: "SavingKey",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider,
+					issue: void 0
+				}
+			}),
+			Start: ({ context, event }) => ({
+				target: "Working",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider,
+					notices: [],
+					issue: void 0
+				}
+			}),
+			Close: {
+				target: "Idle",
+				context: {
+					provider: void 0,
+					issue: void 0
+				}
+			}
+		} },
+		SignedIn: { on: {
+			SaveKey: ({ context, event }) => ({
+				target: "SavingKey",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider
+				}
+			}),
+			Start: ({ context, event }) => ({
+				target: "Working",
+				context: {
+					attempt: context.attempt + 1,
+					provider: event.provider,
+					notices: []
+				}
+			}),
+			Close: {
+				target: "Idle",
+				context: { provider: void 0 }
+			}
+		} }
+	}
 });
+const step = (snapshot, event) => {
+	const [next] = machine.transition(snapshot, event);
+	return [next, next !== snapshot];
+};
 // src/session/Session.ts
 const aboutKey = (pkg) => `${rowKey(pkg)}@${pkg.current}..${pkg.target ?? ""}`;
 const auditKey = (pkg, mode) => {
@@ -12677,13 +13145,14 @@ const questionOf = (state) => {
 		_tag: "Password",
 		request: state.password
 	};
-	if (state.decision?._tag === "ScriptsBlocked") return {
+	if (state.operation.value !== "Asking") return;
+	const { decision } = state.operation.context;
+	return decision._tag === "ScriptsBlocked" ? {
 		_tag: "Scripts",
-		blocked: state.decision
-	};
-	if (state.decision?._tag === "AppRunning") return {
+		blocked: decision
+	} : {
 		_tag: "Quit",
-		running: state.decision
+		running: decision
 	};
 };
 const initial = (mode, scope, preferences, audits = {}, settingsIssue) => ({
@@ -12694,14 +13163,12 @@ const initial = (mode, scope, preferences, audits = {}, settingsIssue) => ({
 	discoveryError: void 0,
 	providers: [],
 	selected: [],
-	running: false,
-	stopping: false,
+	operation: machine$1.initialState,
 	activity: {},
 	outcomes: {},
 	actions: {},
 	installed: {},
 	removed: {},
-	decision: void 0,
 	password: void 0,
 	about: {},
 	audits,
@@ -12711,7 +13178,7 @@ const initial = (mode, scope, preferences, audits = {}, settingsIssue) => ({
 	preferences,
 	settingsIssue,
 	catalogue: void 0,
-	signIn: void 0
+	signIn: machine.initialState
 });
 const issueOf = (error) => `${error.file} cannot be read (${error.issue}); upup keeps audit first on and changes no settings until it is fixed or deleted`;
 const without = (record, key) => Object.fromEntries(Object.entries(record).filter(([entry]) => entry !== key));
@@ -12822,9 +13289,15 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 	const providers = yield* Ref.make([]);
 	const loading = yield* FiberHandle.make();
 	const operation = yield* FiberHandle.make();
-	const stopRequested = yield* Ref.make(false);
 	const pendingDecision = yield* Ref.make(Option.none());
 	const update = (f) => SubscriptionRef.update(state, f);
+	const send = (event) => SubscriptionRef.modify(state, (current) => {
+		const [next, handled] = step$1(current.operation, event);
+		return [handled, handled ? {
+			...current,
+			operation: next
+		} : current];
+	});
 	const setProvider = (name, f) => update((current) => ({
 		...current,
 		providers: current.providers.map((entry) => entry.name === name ? f(entry) : entry)
@@ -12922,8 +13395,8 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		};
 	});
 	const recallAll = Effect.gen(function* () {
-		const found = yield* earlier(yield* SubscriptionRef.get(state));
-		const logged = yield* fromLog(yield* SubscriptionRef.get(state));
+		const before = yield* SubscriptionRef.get(state);
+		const [found, logged] = yield* Effect.all([earlier(before), fromLog(before)], { concurrency: "unbounded" });
 		yield* update((latest) => ({
 			...latest,
 			installed: {
@@ -12942,15 +13415,14 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 			const identity = identityOf(pkg, current.mode);
 			if (identity !== void 0 && current.audits[jobKey(identity)]?._tag !== "Running") wanted.set(jobKey(identity), identity);
 		}
-		yield* Effect.forEach(wanted.values(), audits.recall, {
-			concurrency: 4,
-			discard: true
-		});
 		const offered = packagesOf(current).flatMap((pkg) => {
 			const identity = pkg.target === void 0 ? void 0 : identityOf(pkg, current.mode);
 			return identity === void 0 ? [] : [identity];
 		});
-		const majors = yield* Effect.forEach(offered, (identity) => audits.majors(identity).pipe(Effect.map((identityMajors) => [jobKey(identity), identityMajors])), { concurrency: 4 });
+		const [, majors] = yield* Effect.all([Effect.forEach(wanted.values(), audits.recall, {
+			concurrency: 4,
+			discard: true
+		}), Effect.forEach(offered, (identity) => audits.majors(identity).pipe(Effect.map((identityMajors) => [jobKey(identity), identityMajors])), { concurrency: 4 })], { concurrency: "unbounded" });
 		yield* update((latest) => ({
 			...latest,
 			majors: {
@@ -12995,11 +13467,12 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		return {
 			...initial(mode, scope, current.preferences, current.audits, current.settingsIssue),
 			...places.get(`${mode}:${scope}`),
-			catalogue: current.catalogue
+			catalogue: current.catalogue,
+			signIn: current.signIn
 		};
 	});
 	const open = Effect.fn("Session.open")(function* (mode, scope) {
-		if ((yield* SubscriptionRef.get(state)).running) return;
+		if ((yield* SubscriptionRef.get(state)).operation.value !== "Idle") return;
 		yield* FiberHandle.clear(loading);
 		yield* reset(mode, scope);
 		yield* FiberHandle.run(loading, discover(mode, scope));
@@ -13016,7 +13489,7 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 	});
 	const refresh = Effect.gen(function* () {
 		const current = yield* SubscriptionRef.get(state);
-		if (current.running || current.discovering) return;
+		if (current.operation.value !== "Idle" || current.discovering) return;
 		yield* FiberHandle.run(loading, discover(current.mode, current.scope));
 	});
 	const toggle = Effect.fn("Session.toggle")(function* (key) {
@@ -13038,16 +13511,11 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 	const ask = (decision) => Effect.gen(function* () {
 		const answer = yield* Deferred.make();
 		yield* Ref.set(pendingDecision, Option.some(answer));
-		yield* update((current) => ({
-			...current,
+		yield* send({
+			type: "Ask",
 			decision
-		}));
-		const allowed = yield* Deferred.await(answer);
-		yield* update((current) => ({
-			...current,
-			decision: void 0
-		}));
-		return allowed;
+		});
+		return yield* Deferred.await(answer);
 	});
 	const decisions = Decisions.of({
 		asks: true,
@@ -13056,16 +13524,9 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 	});
 	const run = Effect.fn("Session.run")(function* (action, keys, accepted = []) {
 		const current = yield* SubscriptionRef.get(state);
-		if (current.running) return;
 		const targets = targetsFor(current, yield* Ref.get(providers), action, keys);
-		if (targets.length === 0) return;
-		yield* Ref.set(stopRequested, false);
+		if (targets.length === 0 || !(yield* send({ type: "Run" }))) return;
 		const vetting = action === "update" && current.preferences.auditFirst;
-		yield* update((latest) => ({
-			...latest,
-			running: true,
-			stopping: false
-		}));
 		const touched = [...new Set(targets.map((target) => target.provider))];
 		const confirmed = targets.filter((target) => accepted.includes(rowKey(target.pkg)));
 		const chosen = vetting ? vet(targets.filter((target) => !accepted.includes(rowKey(target.pkg))), current.mode).pipe(Effect.flatMap(({ approved, refused }) => update((latest) => ({
@@ -13085,7 +13546,7 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 				...latest.activity,
 				...Object.fromEntries(approved.map((target) => [rowKey(target.pkg), "waiting"]))
 			}
-		}))), Effect.flatMap((approved) => run$1(approved, Ref.get(stopRequested)).pipe(Stream.runForEach((event) => update((latest) => event._tag === "Progress" ? {
+		}))), Effect.flatMap((approved) => run$1(approved, SubscriptionRef.get(state).pipe(Effect.map((latest) => latest.operation.context.stopping))).pipe(Stream.runForEach((event) => update((latest) => event._tag === "Progress" ? {
 			...latest,
 			activity: {
 				...latest.activity,
@@ -13107,21 +13568,14 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 			selected: event.outcome._tag === "Completed" ? latest.selected.filter((key) => key !== event.key) : latest.selected
 		})), Effect.provideService(Decisions, decisions), Effect.provideService(UpdateLog, scoped(updateLog, placeOf(current))), Effect.andThen(collect$2(touched)), Effect.andThen(recallAll))), Effect.ensuring(Ref.set(pendingDecision, Option.none()).pipe(Effect.andThen(update((latest) => ({
 			...latest,
-			running: false,
-			stopping: false,
-			activity: {},
-			decision: void 0
+			operation: step$1(latest.operation, { type: "Finish" })[0],
+			activity: {}
 		})))))));
 	});
 	const answerPassword = (password) => sudo.answer(password);
-	const stop = Effect.gen(function* () {
-		yield* Ref.set(stopRequested, true);
-		yield* update((current) => current.running ? {
-			...current,
-			stopping: true
-		} : current);
-	});
+	const stop = Effect.asVoid(send({ type: "Stop" }));
 	const answer = Effect.fn("Session.answer")(function* (allowed) {
+		if (!(yield* send({ type: "Answer" }))) return;
 		const pending = yield* Ref.getAndSet(pendingDecision, Option.none());
 		if (Option.isSome(pending)) yield* Deferred.succeed(pending.value, allowed);
 	});
@@ -13178,73 +13632,86 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		...stored,
 		auditFirst: on
 	}));
-	const setSignIn = (signIn) => update((current) => ({
-		...current,
-		signIn
-	}));
-	const saveKey = (provider, key) => setSignIn({
-		_tag: "Working",
-		provider,
-		notices: []
-	}).pipe(Effect.andThen(ai.setApiKey(provider, key)), Effect.matchEffect({
-		onSuccess: () => setSignIn(void 0).pipe(Effect.andThen(loadCatalogue)),
-		onFailure: (error) => setSignIn({
-			_tag: "Failed",
-			provider,
+	const sendSignIn = (event) => SubscriptionRef.modify(state, (current) => {
+		const stepped = step(current.signIn, event);
+		const [next, handled] = stepped;
+		return [stepped, handled ? {
+			...current,
+			signIn: next
+		} : current];
+	});
+	const takeAnswer = (taken) => Ref.modify(pendingAnswer, (pending) => Option.isSome(pending) && taken(pending.value.attempt) ? [pending, Option.none()] : [Option.none(), pending]);
+	const finish = (attempt) => Effect.matchEffect({
+		onSuccess: () => sendSignIn({
+			type: "Succeed",
+			attempt
+		}).pipe(Effect.andThen(loadCatalogue)),
+		onFailure: (error) => sendSignIn({
+			type: "Fail",
+			attempt,
 			issue: error.issue
 		})
-	}));
+	});
+	const saveKey = (provider, key) => Effect.gen(function* () {
+		const [saving, handled] = yield* sendSignIn({
+			type: "SaveKey",
+			provider
+		});
+		if (handled) yield* ai.setApiKey(provider, key).pipe(finish(saving.context.attempt));
+	});
 	const signIn = (provider) => Effect.gen(function* () {
-		yield* setSignIn({
-			_tag: "Working",
-			provider,
-			notices: []
+		const [working, handled] = yield* sendSignIn({
+			type: "Start",
+			provider
 		});
+		if (!handled) return;
+		const { attempt } = working.context;
 		const context = yield* Effect.context();
-		const working = (change) => update((current) => current.signIn?._tag === "Working" && current.signIn.provider === provider ? {
-			...current,
-			signIn: change(current.signIn)
-		} : current);
 		yield* FiberHandle.run(signing, ai.login(provider, {
 			notify: (event) => {
-				const notice = noticeOf(event);
-				Effect.runForkWith(context)(working((current) => ({
-					...current,
-					notices: [...current.notices, notice]
-				})));
+				Effect.runForkWith(context)(sendSignIn({
+					type: "Noticed",
+					attempt,
+					notice: noticeOf(event)
+				}));
 			},
 			prompt: async (prompt) => await Effect.runPromiseWith(context)(Effect.gen(function* () {
 				const reply = yield* Deferred.make();
-				yield* Ref.set(pendingAnswer, Option.some(reply));
-				yield* working((current) => ({
-					...current,
+				const replaced = yield* Ref.modify(pendingAnswer, (pending) => Option.isSome(pending) && pending.value.attempt >= attempt ? [void 0, pending] : [pending, Option.some({
+					attempt,
+					reply
+				})]);
+				if (replaced === void 0) return yield* Effect.interrupt;
+				if (Option.isSome(replaced)) yield* Deferred.interrupt(replaced.value.reply);
+				const [, asked] = yield* sendSignIn({
+					type: "Prompt",
+					attempt,
 					prompt
-				}));
+				});
+				if (!asked) {
+					yield* takeAnswer((stored) => stored === attempt);
+					return yield* Effect.interrupt;
+				}
 				return yield* Deferred.await(reply);
 			}))
-		}).pipe(Effect.matchEffect({
-			onSuccess: () => setSignIn(void 0).pipe(Effect.andThen(loadCatalogue)),
-			onFailure: (error) => setSignIn({
-				_tag: "Failed",
-				provider,
-				issue: error.issue
-			})
-		})));
+		}).pipe(finish(attempt)));
 	});
 	const answerSignIn = (reply) => Effect.gen(function* () {
-		const pending = yield* Ref.getAndSet(pendingAnswer, Option.none());
-		if (Option.isNone(pending)) return;
-		yield* update((current) => current.signIn?._tag === "Working" ? {
-			...current,
-			signIn: {
-				_tag: "Working",
-				provider: current.signIn.provider,
-				notices: current.signIn.notices
-			}
-		} : current);
-		yield* Deferred.succeed(pending.value, reply);
+		const { attempt } = (yield* SubscriptionRef.get(state)).signIn.context;
+		const [, handled] = yield* sendSignIn({
+			type: "Answer",
+			attempt
+		});
+		if (!handled) return;
+		const pending = yield* takeAnswer((stored) => stored === attempt);
+		if (Option.isSome(pending)) yield* Deferred.succeed(pending.value.reply, reply);
+	});
+	const closeSignIn = Effect.gen(function* () {
+		const [closed] = yield* sendSignIn({ type: "Close" });
+		yield* FiberHandle.clear(signing);
+		const pending = yield* takeAnswer((stored) => stored <= closed.context.attempt);
+		if (Option.isSome(pending)) yield* Deferred.interrupt(pending.value.reply);
 	});
-	const closeSignIn = FiberHandle.clear(signing).pipe(Effect.andThen(Ref.set(pendingAnswer, Option.none())), Effect.andThen(setSignIn(void 0)));
 	const awaitIdle = FiberHandle.awaitEmpty(operation);
 	return Session.of({
 		changes: SubscriptionRef.changes(state),
@@ -13284,7 +13751,7 @@ const silenceNodeWarningsWhileTuiDraws = () => {
 };
 const loadTui = Effect.suspend(() => {
 	silenceNodeWarningsWhileTuiDraws();
-	return process.getBuiltinModule("node:ffi") === void 0 ? Effect.die(`upup's TUI needs Node 26.12 or newer; this is Node ${process.versions.node}`) : Effect.promise(async () => await import("./Tui-BiTtZ1EF.mjs"));
+	return process.getBuiltinModule("node:ffi") === void 0 ? Effect.die(`upup's TUI needs Node 26.13 or newer; this is Node ${process.versions.node}`) : Effect.promise(async () => await import("./Tui-DV_6wbrQ.mjs"));
 });
 const open$1 = (begin, projectDir) => Effect.gen(function* () {
 	const { launch } = yield* loadTui;