@gjermundgaraba/upup 0.4.0 → 0.5.1

package/dist/main.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as reason, t as openFlags } from "./io-BGJ4Yp7u.mjs";
+import { n as openFlags, r as reason, t as byName } from "./io-ns6xhFdF.mjs";
 import { findPackageJSON } from "node:module";
 import { NodeRuntime, NodeServices, NodeStdio } from "@effect/platform-node";
 import { Cause, Clock, Config, Context, Data, Deferred, Duration, Effect, Equal, Exit, Fiber, FiberHandle, FiberSet, FileSystem, Layer, Option, Predicate, Queue, Ref, Result, Schedule, Schema, Semaphore, Stream, SubscriptionRef, identity } from "effect";
@@ -17,8 +17,7 @@ import { homedir, tmpdir } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import lockfile from "proper-lockfile";
 import { BACKGROUND_CONTEXT, withAbortSignal } from "@earendil-works/chord/context";
-import { Type } from "@earendil-works/pi-ai";
-import { GenerationTask, Harness, ToolTask, createRegistry, defineDoc, defineExtension, defineTool, hook, section, watchEvents } from "@earendil-works/pi-durable";
+import { GenerationTask, Harness, LiveDoc, ROOT_CONVERSATION_ID, ToolTask, createRegistry, defineDoc, defineExtension, defineTool, hook, section } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
 import { ChildProcess, ChildProcessSpawner, CommandLine } from "effect/process";
 import { Worker } from "node:worker_threads";
@@ -38,12 +37,11 @@ import { constVoid } from "effect/Function";
 import { applyEdits, modify, parse as parse$1 } from "jsonc-parser";
 import { getStaticTOMLValue, parseTOML, traverseNodes } from "toml-eslint-parser";
 import { XMLParser } from "fast-xml-parser";
-import { isSea } from "node:sea";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import { setup, types } from "xstate/fsm";
 // package.json
-var version$1 = "0.4.0";
+var version$1 = "0.5.1";
 // src/ai/Setup.ts
 const Thinking = Schema.Literals([
 	"off",
@@ -427,12 +425,12 @@ const withTarget = (pkg, target) => ({
 	target
 });
 const isUnaudited = Schema.is(UnauditedEcosystem);
-const isApp = Schema.is(AppEcosystem);
+const isApp$1 = Schema.is(AppEcosystem);
 const isRuntime = Schema.is(RuntimeEcosystem);
 const isUnauditedUpdate = (pkg) => isUnaudited(pkg.ecosystem);
-const isAppUpdate = (pkg) => isApp(pkg.ecosystem);
+const isAppUpdate = (pkg) => isApp$1(pkg.ecosystem);
 const unauditedKind = (pkg) => {
-	if (isApp(pkg.ecosystem)) return "app";
+	if (isApp$1(pkg.ecosystem)) return "app";
 	if (isRuntime(pkg.ecosystem)) return "runtime";
 	if (isUnaudited(pkg.ecosystem)) return "os";
 };
@@ -753,15 +751,15 @@ const Severity = Schema.Literals([
 const Finding = Schema.Struct({
 	severity: Severity,
 	title: Schema.String,
-	detail: Schema.String,
-	paths: Schema.Array(Schema.String)
+	detail: Schema.String.annotate({ description: "Markdown: the evidence and why it matters." }),
+	paths: Schema.Array(Schema.String).annotate({ description: "Workspace paths, with line ranges where useful." })
 });
 const Report = Schema.Struct({
 	verdict: Verdict,
-	rationale: Schema.String,
-	summary: Schema.String,
+	rationale: Schema.String.annotate({ description: "One concrete sentence justifying the verdict." }),
+	summary: Schema.String.annotate({ description: "Markdown: what the update changes that bears on the mandate, what you flagged and why you cleared or kept it." }),
 	findings: Schema.Array(Finding),
-	unverified: Schema.Array(Schema.String)
+	unverified: Schema.Array(Schema.String).annotate({ description: "Each thing you could not verify." })
 });
 Schema.Struct({
 	mode: Mode,
@@ -844,21 +842,23 @@ const descriptions = {
 	grep: "Find a JavaScript regular expression in UTF-8 regular files below a path. Each line is matched whole. Lines over 1 KiB show a bounded window around each match with its file byte offset; a file stops at a line over 16 MiB.",
 	list: "List workspace entries below a directory to a bounded depth."
 };
-const parameters = {
-	read: {
-		path: "Workspace-relative file path.",
-		offset: "Zero-based byte offset; must be >= 0.",
-		limit: `Maximum bytes to return; must be between 1 and ${limits$1.readBytes} inclusive.`
-	},
-	grep: {
-		path: "Workspace-relative file or directory path.",
-		pattern: "JavaScript regular expression."
-	},
-	list: {
-		path: "Workspace-relative directory path; use . for the root.",
-		depth: `Maximum directory depth; must be between 1 and ${limits$1.listDepth} inclusive.`
-	}
-};
+const count$1 = (maximum) => Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isBetween({
+	minimum: 1,
+	maximum
+})));
+const ReadArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative file path." }),
+	offset: Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))).annotate({ description: "Zero-based byte offset; must be >= 0." }),
+	limit: count$1(limits$1.readBytes).annotate({ description: `Maximum bytes to return; must be between 1 and ${limits$1.readBytes} inclusive.` })
+});
+const GrepArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative file or directory path." }),
+	pattern: Schema.String.annotate({ description: "JavaScript regular expression." })
+});
+const ListArgs = Schema.Struct({
+	path: Schema.String.annotate({ description: "Workspace-relative directory path; use . for the root." }),
+	depth: count$1(limits$1.listDepth).annotate({ description: `Maximum directory depth; must be between 1 and ${limits$1.listDepth} inclusive.` })
+});
 var ToolError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -915,10 +915,6 @@ const locate$4 = async (workspace, name, context) => {
 		return fail$1(`${context}: ${reason(error)}`);
 	}
 };
-const byName = (left, right) => {
-	if (left.name < right.name) return -1;
-	return left.name > right.name ? 1 : 0;
-};
 const suffixOf = (entry) => {
 	if (entry.isDirectory()) return "/";
 	return entry.isSymbolicLink() ? "@" : "";
@@ -1008,7 +1004,7 @@ const list = async (workspace, args, signal) => await respond(signal, async () =
 	return result === "" ? "no entries" : result;
 });
 const decodeAnswer = Schema.decodeUnknownOption(Schema.Union([Schema.Struct({ text: Schema.String }), Schema.Struct({ error: Schema.String })]));
-const grepWorker = process.env["UPUP_GREP_WORKER"] ?? new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
+const grepWorker = new URL(`grep-worker${path.extname(new URL(import.meta.url).pathname)}`, import.meta.url);
 const search = async (job, timeoutMs, signal) => {
 	const { promise, resolve, reject } = Promise.withResolvers();
 	const worker = new Worker(grepWorker);
@@ -1344,17 +1340,11 @@ const runDiff = (cwd, args, from, to, input) => Effect.callback((resume) => {
 	});
 	return Effect.sync(() => child.kill());
 });
-const regularFiles = async (root, relative = "") => {
-	const entries = await readdir(path.join(root, relative)).catch(() => []);
-	const found = [];
-	for (const name of entries.toSorted()) {
-		const file = relative === "" ? name : `${relative}/${name}`;
-		const info = await lstat(path.join(root, file));
-		if (info.isDirectory()) found.push(...await regularFiles(root, file));
-		else if (info.isFile()) found.push(file);
-	}
-	return found;
-};
+const regularFiles = (root, relative = "") => Effect.promise(async () => await readdir(path.join(root, relative), { withFileTypes: true }).catch(() => [])).pipe(Effect.flatMap((entries) => Effect.forEach(entries.toSorted(byName), (entry) => {
+	const file = relative === "" ? entry.name : `${relative}/${entry.name}`;
+	if (entry.isDirectory()) return regularFiles(root, file);
+	return Effect.succeed(entry.isFile() ? [file] : []);
+}, { concurrency: "unbounded" })), Effect.map((found) => found.flat()));
 const failure$1 = (from, to) => (cause) => new DiffFailed({
 	from,
 	to,
@@ -1372,15 +1362,25 @@ const plain$1 = (pair) => ({
 	paired: false,
 	rewritten: false
 });
-const planTree = async (workspace, from, to) => {
-	const [before, after] = await Promise.all([regularFiles(path.join(workspace, from)), regularFiles(path.join(workspace, to))]);
+const planTree = (workspace, from, to) => Effect.gen(function* () {
+	const attempt = (run) => Effect.tryPromise({
+		try: run,
+		catch: failure$1(from, to)
+	});
+	const [before, after] = yield* Effect.all([regularFiles(path.join(workspace, from)), regularFiles(path.join(workspace, to))], { concurrency: "unbounded" });
 	const beforeSet = new Set(before);
 	const afterSet = new Set(after);
 	const fromOnly = before.filter((file) => !afterSet.has(file));
 	const toOnly = after.filter((file) => !beforeSet.has(file));
-	const only = /* @__PURE__ */ new Map();
-	for (const file of fromOnly) only.set(`from\0${file}`, await readFile(path.join(workspace, from, file)));
-	for (const file of toOnly) only.set(`to\0${file}`, await readFile(path.join(workspace, to, file)));
+	const only = new Map(yield* Effect.forEach([...fromOnly.map((file) => ({
+		side: "from",
+		root: from,
+		file
+	})), ...toOnly.map((file) => ({
+		side: "to",
+		root: to,
+		file
+	}))], ({ side, root, file }) => attempt(async () => [`${side}\0${file}`, await readFile(path.join(workspace, root, file))]), { concurrency: 8 }));
 	const pairs = matchRenames(fromOnly, toOnly, (side, file) => only.get(`${side}\0${file}`) ?? Buffer.alloc(0));
 	const renames = renamesOf(pairs);
 	const pairedFrom = new Set(pairs.map((pair) => pair.from));
@@ -1391,32 +1391,36 @@ const planTree = async (workspace, from, to) => {
 		from: file,
 		to: file
 	}))];
-	for (const pair of candidates) {
+	const classify = async (pair) => {
 		const oldPath = path.join(workspace, from, pair.from);
 		const nextPath = path.join(workspace, to, pair.to);
 		const paired = pair.from !== pair.to;
-		if (!paired && renames.size === 0) {
-			if (!await identical(oldPath, nextPath)) changes.push(plain$1(pair));
-			continue;
-		}
-		const old = only.get(`from\0${pair.from}`) ?? await readFile(oldPath);
-		const next = only.get(`to\0${pair.to}`) ?? await readFile(nextPath);
-		if (!paired && old.equals(next)) continue;
+		if (!paired && renames.size === 0) return await identical(oldPath, nextPath) ? void 0 : {
+			same: false,
+			change: plain$1(pair)
+		};
+		const [old, next] = await Promise.all([only.get(`from\0${pair.from}`) ?? readFile(oldPath), only.get(`to\0${pair.to}`) ?? readFile(nextPath)]);
+		if (!paired && old.equals(next)) return;
 		const text = isText(old) ? old.toString("latin1") : void 0;
 		const rewrittenText = text === void 0 ? void 0 : rewrite(text, renames);
 		const rewritten = rewrittenText !== void 0 && rewrittenText !== text;
-		if (!paired && !rewritten) {
-			changes.push(plain$1(pair));
-			continue;
-		}
+		if (!paired && !rewritten) return {
+			same: false,
+			change: plain$1(pair)
+		};
 		const expected = rewrittenText === void 0 ? old : Buffer.from(rewrittenText, "latin1");
-		(expected.equals(next) ? same : changes).push({
-			...pair,
-			expected,
-			paired,
-			rewritten
-		});
-	}
+		return {
+			same: expected.equals(next),
+			change: {
+				...pair,
+				expected,
+				paired,
+				rewritten
+			}
+		};
+	};
+	const planned = yield* Effect.forEach(candidates, (pair) => attempt(async () => await classify(pair)), { concurrency: 8 });
+	for (const entry of planned) if (entry !== void 0) (entry.same ? same : changes).push(entry.change);
 	for (const file of fromOnly) if (!pairedFrom.has(file)) changes.push({
 		...plain$1({
 			from: file,
@@ -1438,7 +1442,7 @@ const planTree = async (workspace, from, to) => {
 		}),
 		same
 	};
-};
+});
 const mebibytes = (bytes) => `${Math.round(bytes / 1024 / 1024)} MiB`;
 const shownOmissions = 2e3;
 const changeDiff = (workspace, from, to, change) => {
@@ -1470,10 +1474,7 @@ const partial = (what, omitted) => omitted === "" ? "" : `The ${what} diff is pa
 const DiffBudget = Context.Reference("upup/DiffBudget", { defaultValue: () => () => maxDiffBytes });
 const treeDiff = (workspace, from, to, limit) => Effect.gen(function* () {
 	const budget = limit ?? (yield* DiffBudget)(from);
-	const { changes, same } = yield* Effect.tryPromise({
-		try: async () => await planTree(workspace, from, to),
-		catch: failure$1(from, to)
-	});
+	const { changes, same } = yield* planTree(workspace, from, to);
 	const parts = [];
 	const left = [];
 	let size = 0;
@@ -1807,12 +1808,16 @@ const majorsOf = (from, to) => {
 };
 const exists$1 = async (file) => await stat(file).then(() => true, () => false);
 const emptyTree = async (directory) => await readdir(directory).then((entries) => entries.length === 0, () => false);
-const readMajors = (workspace) => Effect.promise(async () => majorsOf(await listed$2(workspace, files.dependencyListFrom), await listed$2(workspace, files.dependencyListTo)));
+const majorsIn = async (workspace) => {
+	const [from, to] = await Promise.all([listed$2(workspace, files.dependencyListFrom), listed$2(workspace, files.dependencyListTo)]);
+	return majorsOf(from, to);
+};
+const readMajors = (workspace) => Effect.promise(async () => await majorsIn(workspace));
 const read$1 = (workspace) => Effect.gen(function* () {
 	const meta = yield* readMeta(workspace);
 	return yield* Effect.tryPromise({
 		try: async () => {
-			const diff = await readFile(path.join(workspace, files.diff));
+			const [diff, majors] = await Promise.all([readFile(path.join(workspace, files.diff)), majorsIn(workspace)]);
 			const trees = [];
 			const titled = [];
 			const targets = /* @__PURE__ */ new Map();
@@ -1851,7 +1856,7 @@ const read$1 = (workspace) => Effect.gen(function* () {
 				trees,
 				files: titled,
 				sections,
-				majors: majorsOf(await listed$2(workspace, files.dependencyListFrom), await listed$2(workspace, files.dependencyListTo))
+				majors
 			};
 		},
 		catch: failed$1(workspace)
@@ -1921,28 +1926,18 @@ const BriefDoc = defineDoc({
 	initial: () => ({ brief: null }),
 	checkpointWhen: () => false
 });
-const severity = Type.Union([
-	Type.Literal("info"),
-	Type.Literal("low"),
-	Type.Literal("medium"),
-	Type.Literal("high")
-]);
-const ReportParameters = Type.Object({
-	verdict: Type.Union([
-		Type.Literal("ok"),
-		Type.Literal("caution"),
-		Type.Literal("danger"),
-		Type.Literal("no-verdict")
-	]),
-	rationale: Type.String({ description: "One concrete sentence justifying the verdict." }),
-	summary: Type.String({ description: "Markdown: what the update changes that bears on the mandate, what you flagged and why you cleared or kept it." }),
-	findings: Type.Array(Type.Object({
-		severity,
-		title: Type.String(),
-		detail: Type.String({ description: "Markdown: the evidence and why it matters." }),
-		paths: Type.Array(Type.String(), { description: "Workspace paths, with line ranges where useful." })
+const parameters = (schema) => Schema.toJsonSchemaDocument(schema).schema;
+const decodeRead = Schema.decodeUnknownSync(ReadArgs);
+const decodeGrep = Schema.decodeUnknownSync(GrepArgs);
+const decodeList = Schema.decodeUnknownSync(ListArgs);
+const decodeSubmitted = Schema.decodeUnknownSync(Report);
+const encodeReport = (submitted) => ({
+	...submitted,
+	findings: submitted.findings.map((finding) => ({
+		...finding,
+		paths: [...finding.paths]
 	})),
-	unverified: Type.Array(Type.String(), { description: "Each thing you could not verify." })
+	unverified: [...submitted.unverified]
 });
 const ReportDoc = defineDoc({
 	kind: "upup.report",
@@ -1968,42 +1963,33 @@ const auditExtension = (workspace) => {
 		name: "read",
 		description: descriptions.read,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.read.path }),
-			offset: Type.Integer({ description: parameters.read.offset }),
-			limit: Type.Integer({ description: parameters.read.limit })
-		}),
-		execute: async (args, _api, invocation) => answer(await read$2(workspace, args, invocation.abortSignal))
+		parameters: parameters(ReadArgs),
+		execute: async (args, _api, invocation) => answer(await read$2(workspace, decodeRead(args), invocation.abortSignal))
 	});
 	const grep$1 = defineTool({
 		name: "grep",
 		description: descriptions.grep,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.grep.path }),
-			pattern: Type.String({ description: parameters.grep.pattern })
-		}),
-		execute: async (args, _api, invocation) => answer(await grep(workspace, args, invocation.abortSignal === void 0 ? {} : { signal: invocation.abortSignal }))
+		parameters: parameters(GrepArgs),
+		execute: async (args, _api, invocation) => answer(await grep(workspace, decodeGrep(args), invocation.abortSignal === void 0 ? {} : { signal: invocation.abortSignal }))
 	});
 	const list$1 = defineTool({
 		name: "list",
 		description: descriptions.list,
 		replay: "safe",
-		parameters: Type.Object({
-			path: Type.String({ description: parameters.list.path }),
-			depth: Type.Integer({ description: parameters.list.depth })
-		}),
-		execute: async (args, _api, invocation) => answer(await list(workspace, args, invocation.abortSignal))
+		parameters: parameters(ListArgs),
+		execute: async (args, _api, invocation) => answer(await list(workspace, decodeList(args), invocation.abortSignal))
 	});
 	const submit = defineTool({
 		name: "submit_report",
 		description: "Submit the audit report. Call exactly once, when the investigation is done; the audit ends.",
 		replay: "safe",
-		parameters: ReportParameters,
+		parameters: parameters(Report),
 		execute: async (args, api, invocation) => {
+			const encoded = encodeReport(decodeSubmitted(args));
 			await api.commit(async (tx) => {
 				const doc = await tx.doc(ReportDoc, api.conversationId);
-				doc.report = structuredClone(args);
+				doc.report = encoded;
 			}, invocation);
 			return {
 				...text$2("Report submitted."),
@@ -2079,6 +2065,32 @@ const entriesOf$1 = (message) => {
 	}
 	return [];
 };
+const TextBlock = Schema.Struct({
+	type: Schema.Literal("text"),
+	text: Schema.String
+});
+const ThinkingBlock = Schema.Struct({
+	type: Schema.Literal("thinking"),
+	thinking: Schema.String
+});
+const isTextBlock = Schema.is(TextBlock);
+const isThinkingBlock = Schema.is(ThinkingBlock);
+const decodeLive = Schema.decodeUnknownOption(Schema.Struct({ generation: Schema.optional(Schema.Struct({
+	attempt: Schema.Finite,
+	message: Schema.optional(Schema.Struct({ content: Schema.Array(Schema.Unknown) })),
+	retry: Schema.optional(Schema.Struct({ error: Schema.String }))
+})) }));
+const streamed = (block) => {
+	if (isThinkingBlock(block)) return block.thinking.trim() === "" ? [] : [{
+		kind: "thinking",
+		text: block.thinking
+	}];
+	if (isTextBlock(block)) return block.text.trim() === "" ? [] : [{
+		kind: "text",
+		text: block.text
+	}];
+	return [];
+};
 var Transcript = class {
 	committed = /* @__PURE__ */ new Map();
 	live = [];
@@ -2086,41 +2098,20 @@ var Transcript = class {
 	add(entry) {
 		this.committed.set(entry.id, (entry.model ?? []).flatMap(entriesOf$1));
 	}
-	apply(event) {
-		switch (event.type) {
-			case "snapshot":
-				this.committed.clear();
-				for (const entry of event.entries) this.add(entry);
-				this.live = [];
-				break;
-			case "entry_appended":
-			case "message_end":
-				this.add(event.entry);
-				this.live = [];
-				this.retry = void 0;
-				break;
-			case "message_update":
-				for (const change of event.changes) if (change.type === "text_delta" || change.type === "thinking_delta") {
-					const kind = change.type === "text_delta" ? "text" : "thinking";
-					const last = this.live.at(-1);
-					if (last?.kind === kind) this.live[this.live.length - 1] = {
-						kind,
-						text: last.text + change.delta
-					};
-					else this.live.push({
-						kind,
-						text: change.delta
-					});
-				}
-				break;
-			case "auto_retry_start":
-				this.retry = {
-					kind: "retry",
-					text: `retrying (attempt ${event.attempt}): ${event.errorMessage}`
-				};
-				break;
-			case "auto_retry_end": this.retry = void 0;
-		}
+	view(view) {
+		for (const entry of view.entries) this.add(entry);
+		const generation = decodeLive(view.docs[LiveDoc.definition.kind]).pipe(Option.flatMapNullishOr((live) => live.generation));
+		this.live = Option.match(generation, {
+			onNone: () => [],
+			onSome: ({ message }) => (message?.content ?? []).flatMap(streamed)
+		});
+		this.retry = Option.match(generation, {
+			onNone: () => void 0,
+			onSome: ({ attempt, retry }) => retry === void 0 ? void 0 : {
+				kind: "retry",
+				text: `retrying (attempt ${attempt}): ${retry.error}`
+			}
+		});
 	}
 	entries() {
 		return [
@@ -2135,16 +2126,24 @@ const attempt$1 = (evaluate) => Effect.tryPromise({
 	try: evaluate,
 	catch: failed
 });
+const watched = (open, onValue) => Effect.acquireRelease(attempt$1(async () => {
+	const watch = await open();
+	watch.start(async (call) => {
+		if (call.kind === "value") onValue(call.value);
+	});
+	return watch;
+}), (watch) => Effect.promise(async () => await watch.stop()).pipe(Effect.ignore));
 const lastAssistant = (entries) => entries.flatMap((entry) => entry.model ?? []).findLast((message) => message.role === "assistant");
-const openHarness = (file, workspace, models) => Effect.acquireRelease(attempt$1(async () => {
-	if (workspace === "" && !existsSync(file)) throw new Error(`no audit at ${file}`);
-	const extension = auditExtension(workspace);
+const openHarness = (file, models, workspace) => Effect.acquireRelease(attempt$1(async () => {
+	if (workspace === void 0 && !existsSync(file)) throw new Error(`no audit at ${file}`);
+	const extension = auditExtension(workspace ?? "");
 	const registry = createRegistry();
 	registry.install(extension);
 	return await Harness.open(await openNodeSqliteStorage(file), {
 		models,
 		registry,
-		settings: { extensions: [extension] }
+		settings: { extensions: [extension] },
+		readOnly: workspace === void 0
 	}, context);
 }), (harness) => Effect.promise(async () => {
 	await harness.close(context);
@@ -2157,7 +2156,7 @@ const encodeBrief = (brief) => ({
 	artifacts: [...brief.artifacts]
 });
 const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(options.file, options.brief.workspace, options.models);
+	const harness = yield* openHarness(options.file, options.models, options.brief.workspace);
 	const root = yield* attempt$1(async () => await harness.root(context, {
 		agent: {
 			model: {
@@ -2172,13 +2171,12 @@ const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
 		}
 	}));
 	const transcript = new Transcript();
-	const events = yield* Effect.acquireRelease(attempt$1(async () => await watchEvents(harness, root.id, context)), (stream) => Effect.promise(async () => await stream.stop()).pipe(Effect.ignore));
-	transcript.apply(events.snapshot);
-	options.onTranscript(transcript.entries());
-	events.start(async (batch) => {
-		for (const event of batch) transcript.apply(event);
+	const views = yield* watched(async () => await root.watch(context), (view) => {
+		transcript.view(view);
 		options.onTranscript(transcript.entries());
 	});
+	transcript.view(views.value);
+	options.onTranscript(transcript.entries());
 	harness.resume();
 	const settled = yield* Effect.tryPromise({
 		try: async (signal) => {
@@ -2205,20 +2203,29 @@ const run$5 = (options) => Effect.scoped(Effect.gen(function* () {
 		_tag: "Reported",
 		report: decoded.value
 	};
-	const final = yield* attempt$1(async () => await watchEvents(harness, root.id, context));
-	yield* attempt$1(async () => await final.stop());
+	const final = yield* attempt$1(async () => await root.context(context));
 	if (settled.value.status === "unanswered") return {
 		_tag: "Failed",
 		issue: Predicate.isString(settled.value.detail) ? settled.value.detail : settled.value.reason
 	};
 	return {
 		_tag: "Failed",
-		issue: lastAssistant(final.snapshot.entries)?.errorMessage ?? "the model finished without submitting a report"
+		issue: lastAssistant(final.entries)?.errorMessage ?? "the model finished without submitting a report"
 	};
 }));
+const storedRoot = (file, models) => Effect.gen(function* () {
+	const harness = yield* openHarness(file, models);
+	return {
+		harness,
+		root: yield* attempt$1(async () => await harness.conversation(ROOT_CONVERSATION_ID, context))
+	};
+});
 const stored = (file, models) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(file, "", models);
-	const root = yield* attempt$1(async () => await harness.root(context));
+	const { harness, root } = yield* storedRoot(file, models);
+	if (root === void 0) return {
+		brief: Option.none(),
+		report: Option.none()
+	};
 	const brief = yield* attempt$1(async () => await harness.snapshot(BriefDoc, root.id, context));
 	const submitted = yield* attempt$1(async () => await harness.snapshot(ReportDoc, root.id, context));
 	return {
@@ -2227,12 +2234,12 @@ const stored = (file, models) => Effect.scoped(Effect.gen(function* () {
 	};
 }));
 const transcript = (file, models) => Effect.scoped(Effect.gen(function* () {
-	const harness = yield* openHarness(file, "", models);
-	const root = yield* attempt$1(async () => await harness.root(context));
-	const events = yield* attempt$1(async () => await watchEvents(harness, root.id, context));
-	yield* attempt$1(async () => await events.stop());
+	const { root } = yield* storedRoot(file, models);
 	const built = new Transcript();
-	built.apply(events.snapshot);
+	if (root !== void 0) {
+		const active = yield* attempt$1(async () => await root.context(context));
+		for (const entry of active.entries) built.add(entry);
+	}
 	return built.entries();
 }));
 // src/inventory/versions.ts
@@ -2339,7 +2346,7 @@ const escape = (path) => path.replaceAll(/[A-Z]/gu, (letter) => `!${letter.toLow
 const deprecation = (mod) => Option.fromNullishOr(/^\/\/\s*Deprecated:\s*(?<reason>.+)$/mu.exec(mod)?.groups?.["reason"]?.trim());
 const lookup$5 = Effect.fn("go.lookup")(function* (client, wanted) {
 	const base = `https://proxy.golang.org/${escape(wanted.name)}/@v`;
-	const [latest, infos] = yield* Effect.all([getJson(client, `https://proxy.golang.org/${escape(wanted.name)}/@latest`, Info$2), Effect.forEach(wanted.versions, (version) => getJson(client, `${base}/${escape(version)}.info`, Info$2).pipe(Effect.option), { concurrency: 2 })], { concurrency: 2 });
+	const [latest, infos] = yield* Effect.all([getJson(client, `https://proxy.golang.org/${escape(wanted.name)}/@latest`, Info$2), Effect.forEach(wanted.versions, (version) => getJson(client, `${base}/${escape(version)}.info`, Info$2).pipe(Effect.option), { concurrency: 2 })], { concurrency: "unbounded" });
 	const mod = yield* getText(client, `${base}/${escape(latest.Version)}.mod`);
 	const deprecated = deprecation(mod);
 	const found = infos.flatMap((info) => Option.isSome(info) ? [info.value] : []);
@@ -4850,30 +4857,36 @@ const resolveFormula = Effect.fn("brew.resolveFormula")(function* (client, sourc
 			digest: createHash("sha256").update(body).digest("hex")
 		};
 	});
-	let to;
-	let from;
-	if (source.tapGitHead !== "") {
-		const current = yield* Effect.option(snapshot(source.tapGitHead, "tap revision reported by brew info"));
-		if (current._tag === "Some" && matchesVersion(current.value.snapshot.text, toVersion) && (source.rubySourceChecksum === "" || source.rubySourceChecksum.toLowerCase() === current.value.digest)) to = current.value.snapshot;
-	}
-	let endpoint = `${githubApi}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits?${new URLSearchParams({
-		path: source.rubySourcePath,
-		per_page: `${historyPageSize}`
-	}).toString()}`;
-	let scanned = 0;
-	const complete = () => from !== void 0 && to !== void 0;
-	for (let page = 0; endpoint !== "" && page < maxHistoryPages && !complete(); page += 1) {
-		const { body, link } = yield* githubGet(client, endpoint, token).pipe(Effect.mapError(prefixed("query brew formula history")));
-		const commits = yield* commitsOf(body, endpoint);
-		for (const commit of commits) {
-			scanned += 1;
-			const { snapshot: candidate } = yield* snapshot(commit.sha, commit.message);
-			if (to === void 0 && matchesVersion(candidate.text, toVersion)) to = candidate;
-			if (from === void 0 && matchesVersion(candidate.text, fromVersion)) from = candidate;
-			if (complete()) break;
+	const scanHistory = Effect.gen(function* () {
+		let to;
+		let from;
+		let endpoint = `${githubApi}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits?${new URLSearchParams({
+			path: source.rubySourcePath,
+			per_page: `${historyPageSize}`
+		}).toString()}`;
+		let scanned = 0;
+		const complete = () => from !== void 0 && to !== void 0;
+		for (let page = 0; endpoint !== "" && page < maxHistoryPages && !complete(); page += 1) {
+			const { body, link } = yield* githubGet(client, endpoint, token).pipe(Effect.mapError(prefixed("query brew formula history")));
+			const commits = yield* commitsOf(body, endpoint);
+			for (const commit of commits) {
+				scanned += 1;
+				const { snapshot: candidate } = yield* snapshot(commit.sha, commit.message);
+				if (to === void 0 && matchesVersion(candidate.text, toVersion)) to = candidate;
+				if (from === void 0 && matchesVersion(candidate.text, fromVersion)) from = candidate;
+				if (complete()) break;
+			}
+			endpoint = complete() ? "" : nextPage(endpoint, link);
 		}
-		endpoint = complete() ? "" : nextPage(endpoint, link);
-	}
+		return {
+			from,
+			to,
+			scanned
+		};
+	});
+	const [current, history] = yield* Effect.all([source.tapGitHead === "" ? Effect.succeedNone : Effect.option(snapshot(source.tapGitHead, "tap revision reported by brew info")), scanHistory], { concurrency: "unbounded" });
+	const { from, scanned } = history;
+	const to = current._tag === "Some" && matchesVersion(current.value.snapshot.text, toVersion) && (source.rubySourceChecksum === "" || source.rubySourceChecksum.toLowerCase() === current.value.digest) ? current.value.snapshot : history.to;
 	if (to === void 0) return yield* new EvidenceUnavailable({
 		source: "brew",
 		issue: `brew formula history has no snapshot for target version ${toVersion} within the newest ${scanned} commits`
@@ -5278,13 +5291,14 @@ const payloadDiff = Effect.fn("brew.payloadDiff")(function* (client, workspace,
 	const { name } = shortName(artifact);
 	const oldStrip = yield* strip(name, plan.old);
 	const newStrip = yield* strip(name, plan.new);
-	const oldManifest = yield* payloadManifest(client, "installed", plan.old, oldStrip, path.join(workspace, files.payloadTreeFrom));
+	const [oldManifest, newManifest] = yield* Effect.all([payloadManifest(client, "installed", plan.old, oldStrip, path.join(workspace, files.payloadTreeFrom)), payloadManifest(client, "target", plan.new, newStrip, path.join(workspace, files.payloadTreeTo))], { concurrency: "unbounded" });
 	if (oldManifest === void 0) return yield* unavailablePayload(workspace, "installed Homebrew payload archive format is unsupported");
-	const newManifest = yield* payloadManifest(client, "target", plan.new, newStrip, path.join(workspace, files.payloadTreeTo));
 	if (newManifest === void 0) return yield* unavailablePayload(workspace, "target Homebrew payload archive format is unsupported");
-	const manifests = yield* writeFileDiff(workspace, files.payloadFrom, files.payloadTo, manifestJson(oldManifest), manifestJson(newManifest));
-	const binaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(oldManifest)), json(binarySummaries(newManifest)));
-	const trees = yield* treeDiff(workspace, files.payloadTreeFrom, files.payloadTreeTo);
+	const [manifests, binaries, trees] = yield* Effect.all([
+		writeFileDiff(workspace, files.payloadFrom, files.payloadTo, manifestJson(oldManifest), manifestJson(newManifest)),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(oldManifest)), json(binarySummaries(newManifest))),
+		treeDiff(workspace, files.payloadTreeFrom, files.payloadTreeTo)
+	], { concurrency: "unbounded" });
 	const contents = trees.diff;
 	const contentDetail = [" Extracted payload file contents are diffed.", partial("payload", trees.omitted)].filter((sentence) => sentence !== "").join(" ");
 	const origin = plan.old.origin === "" ? "" : ` (pinned by ${plan.old.origin})`;
@@ -5763,9 +5777,9 @@ const writeChanges = Effect.fn("git.writeChanges")(function* (from, to, destinat
 		modes
 	};
 	const contents = readBatch((yield* git(["cat-file", "--batch"], objects.map((object) => `${object}\n`).join(""))).stdout, objects);
-	yield* Effect.tryPromise({
+	yield* Effect.forEach(changes, (change) => Effect.tryPromise({
 		try: async () => {
-			for (const change of changes) for (const [object, root] of [[change.fromObject, destination.from], [change.toObject, destination.to]]) {
+			for (const [object, root] of [[change.fromObject, destination.from], [change.toObject, destination.to]]) {
 				if (object === void 0) continue;
 				const file = path.join(root, change.path);
 				await mkdir(path.dirname(file), {
@@ -5779,6 +5793,9 @@ const writeChanges = Effect.fn("git.writeChanges")(function* (from, to, destinat
 			repository,
 			issue: `write source files: ${String(error)}`
 		})
+	}), {
+		concurrency: 8,
+		discard: true
 	});
 	return {
 		files: changes.length,
@@ -5839,9 +5856,9 @@ const moduleChanges = (from, to, released) => {
 	};
 };
 const readSummaries = (workspace, file) => Effect.tryPromise(async () => await readFile(path.join(workspace, file), "utf-8")).pipe(Effect.flatMap((text) => Schema.decodeEffect(Summaries)(text)), Effect.option);
+const readBinarySummaries = (workspace) => Effect.all([readSummaries(workspace, files.binaryFrom), readSummaries(workspace, files.binaryTo)], { concurrency: "unbounded" });
 const goSourceEvidence = Effect.fn("goSource.evidence")(function* (client, workspace, released) {
-	const from = yield* readSummaries(workspace, files.binaryFrom);
-	const to = yield* readSummaries(workspace, files.binaryTo);
+	const [from, to] = yield* readBinarySummaries(workspace);
 	if (from._tag === "None" || to._tag === "None") return;
 	const { changes, reason } = moduleChanges(from.value, to.value, released);
 	if (changes.length === 0) return {
@@ -5853,7 +5870,7 @@ const goSourceEvidence = Effect.fn("goSource.evidence")(function* (client, works
 		const plan = yield* resolve$3(client, "go", modulePath, version);
 		return yield* materialize$2(client, plan, path.join(workspace, tree, modulePath));
 	});
-	const fetched = yield* Effect.forEach(changes, (change) => Effect.result(Effect.all([fetch(change.path, change.from, files.goSourceFrom), fetch(change.path, change.to, files.goSourceTo)], { concurrency: 2 })), { concurrency: 2 });
+	const fetched = yield* Effect.forEach(changes, (change) => Effect.result(Effect.all([fetch(change.path, change.from, files.goSourceFrom), fetch(change.path, change.to, files.goSourceTo)], { concurrency: "unbounded" })), { concurrency: 2 });
 	const failures = changes.flatMap((change, index) => {
 		const result = fetched[index];
 		return result?._tag === "Failure" ? [`${change.path}: ${result.failure.issue}`] : [];
@@ -5912,8 +5929,7 @@ const buildInfoSources = (from, to) => {
 	return [...sources.values()].slice(0, 4);
 };
 const readBuildInfoSources = Effect.fn("goSource.buildInfoSources")(function* (workspace) {
-	const from = yield* readSummaries(workspace, files.binaryFrom);
-	const to = yield* readSummaries(workspace, files.binaryTo);
+	const [from, to] = yield* readBinarySummaries(workspace);
 	return from._tag === "None" || to._tag === "None" ? [] : buildInfoSources(from.value, to.value);
 });
 // src/audit/source-evidence.ts
@@ -6225,7 +6241,7 @@ const releaseAssetSources = Effect.fn("sourceLink.releaseAssets")(function* (cli
 			} })), Effect.catch((error) => Effect.succeed(gap(error.issue))));
 		}
 		return Effect.succeed(gap("no release of the repository publishes this exact binary"));
-	});
+	}, { concurrency: 4 });
 });
 // src/audit/brew.ts
 const caskArchiveUnavailable = "compiled cask payloads are not source archives";
@@ -6291,7 +6307,7 @@ const sourceDiff = Effect.fn("brew.sourceDiff")(function* (client, workspace, pa
 	const [gap] = yield* Effect.all([sourceTree(client, pair.old, path.join(workspace, files.sourceFrom)).pipe(Effect.as(""), Effect.catch((error) => {
 		const reason = historicalGap(pair.old.url, error);
 		return reason === void 0 ? Effect.fail(labelled("download old brew source archive")(error)) : Effect.succeed(reason);
-	})), sourceTree(client, pair.new, path.join(workspace, files.source)).pipe(Effect.mapError(labelled("download new brew source archive")))], { concurrency: 2 });
+	})), sourceTree(client, pair.new, path.join(workspace, files.source)).pipe(Effect.mapError(labelled("download new brew source archive")))], { concurrency: "unbounded" });
 	if (gap !== "") return {
 		diff: Buffer.alloc(0),
 		reason: gap,
@@ -6328,9 +6344,11 @@ const sourceEvidence = Effect.fn("brew.sourceEvidence")(function* (client, works
 	};
 });
 const materialize$1 = Effect.fn("brew.materialize")(function* (client, workspace, identity, plan, key) {
-	const formula = yield* materializeFormula(workspace, plan.formula);
-	const source = yield* sourceEvidence(client, workspace, archives(plan.formula), plan.sourceGap);
-	const payload = yield* materializePayload(client, workspace, identity.delta.artifact, plan.payload);
+	const [formula, source, payload] = yield* Effect.all([
+		materializeFormula(workspace, plan.formula),
+		sourceEvidence(client, workspace, archives(plan.formula), plan.sourceGap),
+		materializePayload(client, workspace, identity.delta.artifact, plan.payload)
+	], { concurrency: "unbounded" });
 	const goSource = source.included ? void 0 : yield* goSourceEvidence(client, workspace, identity.delta);
 	const sources = goSource?.included === true || source.included ? [] : [...plan.repository === void 0 ? [] : [plan.repository], ...yield* readBuildInfoSources(workspace)];
 	const repository = sources.length === 0 ? void 0 : yield* materializeSources(workspace, sources);
@@ -6357,7 +6375,7 @@ const resolve$2 = Effect.fn("brew.resolve")(function* (client, identity) {
 	const formulaGap = formula.fromGap === "" ? archiveUnavailableReason(archives(formula)) : "the installed version's formula snapshot is unavailable";
 	const sourceGap = kind === "cask" ? caskArchiveUnavailable : formulaGap;
 	const payload = yield* resolvePayload(info, artifact, from, to, formula.from?.text);
-	const released = sourceGap !== "" && payload.old.url !== "" && payload.new.url !== "" ? yield* Effect.all([releaseTagSource(payload.old.url), releaseTagSource(payload.new.url)], { concurrency: 2 }) : void 0;
+	const released = sourceGap !== "" && payload.old.url !== "" && payload.new.url !== "" ? yield* Effect.all([releaseTagSource(payload.old.url), releaseTagSource(payload.new.url)], { concurrency: "unbounded" }) : void 0;
 	const repository = released === void 0 || released.every((side) => "gap" in side) ? void 0 : {
 		label: artifact,
 		from: released[0],
@@ -6422,7 +6440,7 @@ const workspaceOf$1 = Effect.fn("githubActions.workspace")(function* (workspace,
 const githubActionPreparer = (repositoryOf, options = {}) => Effect.fn("githubActions.prepare")(function* (_client, identity) {
 	const { artifact, from, to } = identity.delta;
 	const repository = repositoryOf(artifact);
-	const [fromCommit, toCommit] = yield* Effect.all([tagCommit(repository, from, options), tagCommit(repository, to, options)], { concurrency: 2 }).pipe(Effect.mapError(unavailable$1));
+	const [fromCommit, toCommit] = yield* Effect.all([tagCommit(repository, from, options), tagCommit(repository, to, options)], { concurrency: "unbounded" }).pipe(Effect.mapError(unavailable$1));
 	const listed = identity.context["revision"];
 	if (listed !== toCommit) return yield* new EvidenceUnavailable({
 		source: repository,
@@ -6619,12 +6637,14 @@ const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace,
 			issue: error instanceof Error ? error.message : String(error)
 		})
 	});
-	const [from, to] = yield* Effect.all([materialize(client, plans.from, path.join(workspace, files.from), path.join(workspace, files.wheelFrom)), materialize(client, plans.to, path.join(workspace, files.to), path.join(workspace, files.wheelTo))], { concurrency: 2 });
-	const sources = yield* treeDiff(workspace, files.from, files.to);
-	const records = yield* writeFileDiff(workspace, files.pypiFrom, files.pypiTo, manifestJson(from), manifestJson(to));
-	const sourceBinaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from.publisher_sdist?.archive_manifest)), json(binarySummaries(to.publisher_sdist?.archive_manifest)));
-	const wheels = yield* treeDiff(workspace, files.wheelFrom, files.wheelTo);
-	const wheelBinaries = yield* writeFileDiff(workspace, files.binaryWheelFrom, files.binaryWheelTo, json(binarySummaries(from.compatible_universal_wheel?.archive_manifest)), json(binarySummaries(to.compatible_universal_wheel?.archive_manifest)));
+	const [from, to] = yield* Effect.all([materialize(client, plans.from, path.join(workspace, files.from), path.join(workspace, files.wheelFrom)), materialize(client, plans.to, path.join(workspace, files.to), path.join(workspace, files.wheelTo))], { concurrency: "unbounded" });
+	const [sources, records, sourceBinaries, wheels, wheelBinaries] = yield* Effect.all([
+		treeDiff(workspace, files.from, files.to),
+		writeFileDiff(workspace, files.pypiFrom, files.pypiTo, manifestJson(from), manifestJson(to)),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from.publisher_sdist?.archive_manifest)), json(binarySummaries(to.publisher_sdist?.archive_manifest))),
+		treeDiff(workspace, files.wheelFrom, files.wheelTo),
+		writeFileDiff(workspace, files.binaryWheelFrom, files.binaryWheelTo, json(binarySummaries(from.compatible_universal_wheel?.archive_manifest)), json(binarySummaries(to.compatible_universal_wheel?.archive_manifest)))
+	], { concurrency: "unbounded" });
 	const detail = `Checksum-verified PyPI publisher artifacts; ${pairedDetail("source distributions", from.publisher_sdist, to.publisher_sdist)}; ${pairedDetail("compatible universal wheel candidates", from.compatible_universal_wheel, to.compatible_universal_wheel)}; the installer’s exact resolver selection is not known.`;
 	return yield* write(workspace, identity, Buffer.concat([
 		sources.diff,
@@ -6641,7 +6661,7 @@ const pypiWorkspace = Effect.fn("pypi.workspace")(function* (client, workspace,
 const preparePyPI = Effect.fn("pypi.prepare")(function* (client, identity) {
 	const { artifact, from, to } = identity.delta;
 	const python = identity.context["python"] ?? "";
-	const [fromPlan, toPlan] = yield* Effect.all([resolve$1(client, artifact, from, python), resolve$1(client, artifact, to, python)], { concurrency: 2 });
+	const [fromPlan, toPlan] = yield* Effect.all([resolve$1(client, artifact, from, python), resolve$1(client, artifact, to, python)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
@@ -6734,7 +6754,7 @@ const resolveDependencies = Effect.fn("npmDependencies.resolve")(function* (clie
 	const outcomes = yield* Effect.forEach(changedNames, (dependency) => Effect.gen(function* () {
 		if (!packageName.test(dependency)) return Result.fail("its name is not a valid registry package name");
 		const side = (declared) => declared === void 0 ? Effect.undefined : resolveSide(client, host, dependency, declared);
-		const resolved = yield* Effect.result(Effect.all([side(before.get(dependency)), side(after.get(dependency))], { concurrency: 2 }));
+		const resolved = yield* Effect.result(Effect.all([side(before.get(dependency)), side(after.get(dependency))], { concurrency: "unbounded" }));
 		return Result.isFailure(resolved) ? Result.fail(resolved.failure.issue) : Result.succeed(resolved.success);
 	}), { concurrency: 4 });
 	for (const [index, dependency] of changedNames.entries()) {
@@ -6841,8 +6861,8 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 			issue: error instanceof Error ? error.message : String(error)
 		})
 	});
-	const sides = yield* Effect.forEach(dependencies.changed, (dependency) => Effect.all([fetchSide(client, dependency.from, path.join(workspace, files.dependenciesFrom, dependency.name)), fetchSide(client, dependency.to, path.join(workspace, files.dependenciesTo, dependency.name))], { concurrency: 2 }), { concurrency: 4 });
-	const summaries = yield* writeFileDiff(workspace, files.dependencyListFrom, files.dependencyListTo, record(dependencies, dependencies.changed.map((dependency, index) => ({
+	const sides = yield* Effect.forEach(dependencies.changed, (dependency) => Effect.all([fetchSide(client, dependency.from, path.join(workspace, files.dependenciesFrom, dependency.name)), fetchSide(client, dependency.to, path.join(workspace, files.dependenciesTo, dependency.name))], { concurrency: "unbounded" }), { concurrency: 4 });
+	const [summaries, trees] = yield* Effect.all([writeFileDiff(workspace, files.dependencyListFrom, files.dependencyListTo, record(dependencies, dependencies.changed.map((dependency, index) => ({
 		name: dependency.name,
 		...dependency.from === void 0 ? {} : { resolved: dependency.from },
 		...sides[index]?.[0] === void 0 ? {} : { fetched: sides[index][0] }
@@ -6850,8 +6870,7 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 		name: dependency.name,
 		...dependency.to === void 0 ? {} : { resolved: dependency.to },
 		...sides[index]?.[1] === void 0 ? {} : { fetched: sides[index][1] }
-	}))));
-	const trees = yield* treeDiff(workspace, files.dependenciesFrom, files.dependenciesTo);
+	})))), treeDiff(workspace, files.dependenciesFrom, files.dependenciesTo)], { concurrency: "unbounded" });
 	const failed = dependencies.changed.filter((_, index) => (sides[index] ?? []).some((side) => side?.error !== void 0));
 	const included = dependencies.changed.map((dependency) => `${dependency.name} ${dependency.from?.plan.version ?? "(new)"}${dependency.from?.lowest === true ? " (lowest of its range)" : ""} -> ${dependency.to?.plan.version ?? "(removed)"}${dependency.to?.bundled === true ? " (now a devDependency, so probably bundled into the package)" : ""}`);
 	const noneIncluded = dependencies.omitted.length === 0 ? "No direct dependency's declared version changed." : "No changed direct dependency is compared.";
@@ -6884,10 +6903,12 @@ const materializeDependencies = Effect.fn("npmDependencies.materialize")(functio
 // src/audit/registry-evidence.ts
 const registryDetail = "Both published packages were downloaded and their checksums verified. File types and modes, and any native binaries, are summarised without running them.";
 const registryWorkspace = Effect.fn("evidence.registryWorkspace")(function* (client, workspace, identity, plans, npm, key) {
-	const [from, to] = yield* Effect.all([materialize$2(client, plans.from, path.join(workspace, files.from)), materialize$2(client, plans.to, path.join(workspace, files.to))], { concurrency: 2 });
-	const artifacts = yield* writeFileDiff(workspace, files.artifactFrom, files.artifactTo, manifestJson(from), manifestJson(to));
-	const trees = yield* treeDiff(workspace, files.from, files.to);
-	const binaries = yield* writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from)), json(binarySummaries(to)));
+	const [from, to] = yield* Effect.all([materialize$2(client, plans.from, path.join(workspace, files.from)), materialize$2(client, plans.to, path.join(workspace, files.to))], { concurrency: "unbounded" });
+	const [artifacts, trees, binaries] = yield* Effect.all([
+		writeFileDiff(workspace, files.artifactFrom, files.artifactTo, manifestJson(from), manifestJson(to)),
+		treeDiff(workspace, files.from, files.to),
+		writeFileDiff(workspace, files.binaryFrom, files.binaryTo, json(binarySummaries(from)), json(binarySummaries(to)))
+	], { concurrency: "unbounded" });
 	const treeDetail = [registryDetail, partial("artifact", trees.omitted)].filter((sentence) => sentence !== "").join(" ");
 	if (npm === void 0) return yield* write(workspace, identity, Buffer.concat([
 		artifacts,
@@ -6921,7 +6942,7 @@ const npmExtras = Effect.fn("evidence.npmExtras")(function* (client, name, from,
 		cpu: process.arch
 	});
 	const verifier = yield* Effect.cached(sigstoreVerifier);
-	const [fromSource, toSource] = yield* Effect.all([npmSource(client, name, from, fromManifest, verifier), npmSource(client, name, to, toManifest, verifier)], { concurrency: 2 });
+	const [fromSource, toSource] = yield* Effect.all([npmSource(client, name, from, fromManifest, verifier), npmSource(client, name, to, toManifest, verifier)], { concurrency: "unbounded" });
 	const { directory } = npmRepository(toManifest);
 	return {
 		dependencies,
@@ -6938,8 +6959,8 @@ const prepareRegistry = Effect.fn("evidence.prepareRegistry")(function* (client,
 	const manifests = ecosystem === "npm" ? yield* Effect.all({
 		from: npmVersion(client, artifact, from),
 		to: npmVersion(client, artifact, to)
-	}, { concurrency: 2 }) : void 0;
-	const [fromPlan, toPlan] = yield* Effect.all(manifests === void 0 ? [resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)] : [npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: 2 });
+	}, { concurrency: "unbounded" }) : void 0;
+	const [fromPlan, toPlan] = yield* Effect.all(manifests === void 0 ? [resolve$3(client, ecosystem, artifact, from), resolve$3(client, ecosystem, artifact, to)] : [npmPlan(artifact, from, manifests.from), npmPlan(artifact, to, manifests.to)], { concurrency: "unbounded" });
 	const plans = {
 		from: fromPlan,
 		to: toPlan
@@ -7314,10 +7335,9 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 	}));
 	const started = yield* Clock.currentTimeMillis;
 	const base = path.join(root, "workspaces");
-	for (const name of yield* children(base)) {
-		if (name.endsWith(".lock")) continue;
+	yield* Effect.forEach((yield* children(base)).filter((name) => !name.endsWith(".lock")), (name) => {
 		const workspace = path.join(base, name);
-		yield* Effect.scoped(Effect.gen(function* () {
+		return Effect.scoped(Effect.gen(function* () {
 			if (!(yield* tryHold(workspace))) return;
 			const prepared = yield* Effect.promise(async () => await stat(path.join(workspace, files.meta)).then((info) => info.mtimeMs, () => 0));
 			if (started - prepared > Duration.toMillis(keptWorkspaces)) {
@@ -7325,9 +7345,15 @@ const layer$5 = (cacheDir) => Layer.effect(Audits, Effect.gen(function* () {
 				return;
 			}
 			const entries = yield* Effect.promise(async () => await readdir(workspace, { withFileTypes: true }).catch(() => []));
-			for (const entry of entries) if (entry.isDirectory()) yield* discard(path.join(workspace, entry.name), name);
+			yield* Effect.forEach(entries.filter((entry) => entry.isDirectory()), (entry) => discard(path.join(workspace, entry.name), name), {
+				concurrency: "unbounded",
+				discard: true
+			});
 		})).pipe(Effect.ignore);
-	}
+	}, {
+		concurrency: 8,
+		discard: true
+	});
 	yield* Effect.forkScoped(Effect.promise(async () => {
 		for (const name of await readdir(trash).catch(() => [])) await rm(path.join(trash, name), {
 			recursive: true,
@@ -7544,12 +7570,15 @@ const workflowFiles = Effect.fn("workflowFiles")(function* (root) {
 		for (const name of ["action.yml", "action.yaml"]) if (yield* present(path.join(dir, name))) return Option.some(path.join(dir, name));
 		return Option.none();
 	});
-	const workflows = yield* listed(path.join(".github", "workflows"), false);
-	const actions = yield* listed(path.join(".github", "actions"), true);
+	const [workflows, actions, own] = yield* Effect.all([
+		listed(path.join(".github", "workflows"), false),
+		listed(path.join(".github", "actions"), true),
+		actionFile("")
+	], { concurrency: "unbounded" });
 	const pending = [
 		...workflows.filter((file) => /\.ya?ml$/u.test(file)),
 		...actions.filter((file) => /^action\.ya?ml$/u.test(path.basename(file))),
-		...Option.toArray(yield* actionFile(""))
+		...Option.toArray(own)
 	];
 	const seen = /* @__PURE__ */ new Set();
 	const files = [];
@@ -7874,7 +7903,7 @@ const discover$4 = Effect.fn("GitHubActions.discover")(function* (dir) {
 		".github",
 		"action.yml",
 		"action.yaml"
-	], exists)).length === 0) return [];
+	], exists, { concurrency: "unbounded" })).length === 0) return [];
 	const origin = yield* exec.stdout({
 		command: "git",
 		args: [
@@ -7889,7 +7918,7 @@ const discover$4 = Effect.fn("GitHubActions.discover")(function* (dir) {
 });
 // src/process/on-path.ts
 const executable = (file) => Effect.promise(async () => await access(file, constants.X_OK).then(() => true, () => false));
-const onPath = (command) => Effect.forEach((process.env["PATH"] ?? "").split(path.delimiter).filter((dir) => dir !== ""), (dir) => executable(path.join(dir, command))).pipe(Effect.map((found) => found.includes(true)));
+const onPath = (command) => Effect.forEach((process.env["PATH"] ?? "").split(path.delimiter).filter((dir) => dir !== ""), (dir) => executable(path.join(dir, command)), { concurrency: "unbounded" }).pipe(Effect.map((found) => found.includes(true)));
 // src/process/Sudo.ts
 var Sudo = class extends Context.Service()("upup/Sudo") {};
 const asRoot = (invocation) => [
@@ -8483,8 +8512,7 @@ const read = Effect.fn("bundles.read")(function* (bundle, arch) {
 	const short = nonEmpty(info.value.CFBundleShortVersionString);
 	const build = nonEmpty(info.value.CFBundleVersion);
 	const executable = nonEmpty(info.value.CFBundleExecutable);
-	const sparkle = yield* sparkleKeysOf(bundle, info.value);
-	const source = yield* sourceOf(bundle, bundleId, nonEmpty(info.value.SUFeedURL), arch);
+	const [sparkle, source] = yield* Effect.all([sparkleKeysOf(bundle, info.value), sourceOf(bundle, bundleId, nonEmpty(info.value.SUFeedURL), arch)], { concurrency: "unbounded" });
 	return Option.some({
 		path: bundle,
 		name: path.basename(bundle, ".app"),
@@ -8497,23 +8525,25 @@ const read = Effect.fn("bundles.read")(function* (bundle, arch) {
 		...plist === void 0 ? {} : { plist }
 	});
 });
-const walk = Effect.fn("bundles.walk")(function* (roots, wanted) {
+const isApp = (entry) => entry.endsWith(".app");
+const isLeftover = (entry) => entry.endsWith(".app.upup-old");
+const wanted$1 = (entry) => isApp(entry) || isLeftover(entry);
+const walk = Effect.fn("bundles.walk")(function* (roots) {
 	const fs = yield* FileSystem.FileSystem;
 	const entries = (dir) => fs.readDirectory(dir).pipe(Effect.orElseSucceed(() => []), Effect.map((names) => names.toSorted((left, right) => left.localeCompare(right)).map((name) => path.join(dir, name))));
 	const isLink = (entry) => fs.readLink(entry).pipe(Effect.isSuccess);
 	const isDirectory = (entry) => fs.stat(entry).pipe(Effect.map((info) => info.type === "Directory"), Effect.orElseSucceed(() => false));
-	const found = [];
-	for (const root of roots) for (const entry of yield* entries(root)) {
-		if (yield* isLink(entry)) continue;
-		if (wanted(entry)) found.push(entry);
-		else if (!/\.(?:app|localized|upup-old|upup-new)$/u.test(entry) && (yield* isDirectory(entry))) {
-			for (const nested of yield* entries(entry)) if (wanted(nested) && !(yield* isLink(nested))) found.push(nested);
-		}
-	}
-	return found;
+	const nestedIn = (folder) => entries(folder).pipe(Effect.flatMap((listed) => Effect.filter(listed.filter(wanted$1), (nested) => Effect.map(isLink(nested), (link) => !link), { concurrency: "unbounded" })));
+	const walked = (yield* Effect.forEach(roots, (root) => entries(root).pipe(Effect.flatMap((listed) => Effect.forEach(listed, (entry) => Effect.gen(function* () {
+		if (yield* isLink(entry)) return [];
+		if (wanted$1(entry)) return [entry];
+		return !/\.(?:app|localized|upup-old|upup-new)$/u.test(entry) && (yield* isDirectory(entry)) ? yield* nestedIn(entry) : [];
+	}), { concurrency: "unbounded" })), Effect.map((listed) => listed.flat())), { concurrency: "unbounded" })).flat();
+	return {
+		apps: walked.filter(isApp),
+		leftovers: walked.filter(isLeftover)
+	};
 });
-const paths = (roots) => walk(roots, (entry) => entry.endsWith(".app"));
-const leftovers = (roots) => walk(roots, (entry) => entry.endsWith(".app.upup-old"));
 // src/apps/running.ts
 const command$4 = (name, args) => ({
 	command: name,
@@ -8576,7 +8606,7 @@ const command$3 = (name, args) => ({
 });
 const host = Effect.gen(function* () {
 	const exec = yield* Exec;
-	const [arm64, os] = yield* Effect.all([exec.run(command$3("sysctl", ["-n", "hw.optional.arm64"])).pipe(Effect.map((output) => output.exitCode === 0 && output.stdout.trim() === "1"), Effect.orElseSucceed(() => false)), exec.stdout(command$3("sw_vers", ["-productVersion"])).pipe(Effect.map((text) => text.trim()))], { concurrency: 2 });
+	const [arm64, os] = yield* Effect.all([exec.run(command$3("sysctl", ["-n", "hw.optional.arm64"])).pipe(Effect.map((output) => output.exitCode === 0 && output.stdout.trim() === "1"), Effect.orElseSucceed(() => false)), exec.stdout(command$3("sw_vers", ["-productVersion"])).pipe(Effect.map((text) => text.trim()))], { concurrency: "unbounded" });
 	return {
 		arch: arm64 ? "arm64" : "x86_64",
 		os
@@ -8654,7 +8684,7 @@ const stage = Effect.fn("install.stage")(function* (client, wanted) {
 		const found = (yield* Effect.forEach(candidates, (candidate) => readInfo(candidate).pipe(Effect.map((info) => ({
 			path: candidate,
 			info
-		}))))).find(({ info }) => Option.isSome(info) && info.value.CFBundleIdentifier === wanted.bundleId);
+		}))), { concurrency: 4 })).find(({ info }) => Option.isSome(info) && info.value.CFBundleIdentifier === wanted.bundleId);
 		if (found === void 0 || Option.isNone(found.info)) return yield* refused(`its download holds no app with the bundle ID ${wanted.bundleId}`);
 		const app = found.path;
 		const info = found.info.value;
@@ -8673,7 +8703,7 @@ const stage = Effect.fn("install.stage")(function* (client, wanted) {
 		])).pipe(Effect.mapError((error) => refused(`codesign failed: ${error.output.trim()}`)), Effect.flatMap((output) => {
 			const hash = /^CDHash=(?<hash>[0-9a-f]+)$/mu.exec(output.stderr)?.groups?.["hash"];
 			return hash === void 0 ? Effect.fail(unsigned(output.stderr.trim())) : Effect.succeed(hash);
-		}))).pipe(Effect.map((hashes) => `${requirement(wanted.bundleId, wanted.team)} and info [CFBundleShortVersionString] = "${wanted.version.replaceAll(/["\\]/gu, "\\$&")}" and (${hashes.map((hash) => `cdhash H"${hash}"`).join(" or ")})`));
+		})), { concurrency: 2 }).pipe(Effect.map((hashes) => `${requirement(wanted.bundleId, wanted.team)} and info [CFBundleShortVersionString] = "${wanted.version.replaceAll(/["\\]/gu, "\\$&")}" and (${hashes.map((hash) => `cdhash H"${hash}"`).join(" or ")})`));
 		const signed = yield* exec.run(command$2("codesign", [
 			"--verify",
 			"--deep",
@@ -8726,19 +8756,11 @@ const Manifest$2 = Schema.fromJsonString(Schema.Struct({
 }));
 const zipName = "upup-sparkle.zip";
 const manifestName = "upup-sparkle.json";
-const seaKeys = {
-	zip: `sparkle/${zipName}`,
-	manifest: `sparkle/${manifestName}`
-};
 const decode = (text, zip) => Schema.decodeEffect(Manifest$2)(text).pipe(Effect.map((manifest) => ({
 	zip,
 	...manifest
 })), Effect.option);
 const folder = () => {
-	if (isSea()) {
-		const assets = process.env["OTUI_ASSET_ROOT"];
-		return assets === void 0 ? void 0 : path.join(assets, path.dirname(seaKeys.zip));
-	}
 	const packageJson = findPackageJSON(import.meta.url);
 	return packageJson === void 0 ? void 0 : path.join(path.dirname(packageJson), "native", "dist");
 };
@@ -8820,9 +8842,16 @@ ready() {
     return 1
   fi
 }
-# A copy of what upup handed over, where only this user can write; a failure is step $1's.
+# A copy of what upup handed over, where only this user can write; a failure is step $1's. Others
+# may also read a shared one ($2): as root, Sparkle starts its progress agent from upup-sparkle's
+# framework as the user, so it goes in /var/tmp, whose sticky bit keeps others from moving it. An
+# app's copy stays private, since its owner gets it after it is checked.
 secure() {
-  private=$(mktemp -d 2>"$log") || { private=; fail "$1"; return 1; }
+  if [ "$mode" = root ] && [ "$2" = shared ]; then
+    private=$(mktemp -d /var/tmp/upup.XXXXXX 2>"$log") && chmod 755 "$private" 2>"$log" || { fail "$1"; return 1; }
+  else
+    private=$(mktemp -d 2>"$log") || { fail "$1"; return 1; }
+  fi
   payload="$private/$(basename "$source")"
   "$ditto" "$source" "$payload" 2>"$log" || { fail "$1"; return 1; }
 }
@@ -8836,7 +8865,7 @@ app() {
   if [ -e "$old" ] && [ ! -e "$dest" ]; then recover; return; fi
   rm -rf "$old" "$new" 2>"$log" || { fail cleanup; return; }
   if [ "$mode" = root ]; then
-    secure copy || return
+    secure copy private || return
     "$codesign" --verify --deep --strict -R "$check" "$payload" 2>"$log" || { fail recheck; return; }
     owner=$("$stat" -f %u:%g "$dest" 2>"$log") && "$chown" -R "$owner" "$payload" 2>"$log" || { fail copy; return; }
     staged=$payload
@@ -8866,7 +8895,7 @@ app() {
 # upup-sparkle's exit status: 0 installed, 2 nothing to install, 3 Sparkle would install another
 # build, 4 the app is open; its last line on standard error says why.
 sparkle() {
-  secure helper || return
+  secure helper shared || return
   sum=$("$shasum" -a 256 "$payload" 2>"$log") || { fail helper; return; }
   [ "\${sum%% *}" = "$check" ] || { echo "its sha256 is \${sum%% *}, not $check" >"$log"; fail helper; return; }
   "$ditto" -x -k "$payload" "$private" 2>"$log" || { fail helper; return; }
@@ -9156,16 +9185,27 @@ const makeWith = (options) => Effect.gen(function* () {
 			}
 		};
 	});
+	const leftoverNotice = (old) => {
+		const app = old.slice(0, -9);
+		return fs.exists(app).pipe(Effect.orElseSucceed(() => true), Effect.map((present) => ({ message: present ? `${old} is the old copy of ${path.basename(app)} that an update left behind; move it to the Trash` : `${old} is ${path.basename(app)} from before an update that did not finish; rename it back to ${path.basename(app)}` })));
+	};
+	const scan = Effect.gen(function* () {
+		const [here, walked] = yield* Effect.all([host, walk(options.roots)], { concurrency: "unbounded" });
+		const [bundles, left] = yield* Effect.all([Effect.forEach(walked.apps, (app) => read(app, here.arch), { concurrency: inFlight }), Effect.forEach(walked.leftovers, leftoverNotice, { concurrency: "unbounded" })], { concurrency: "unbounded" });
+		return {
+			here,
+			found: bundles.flatMap((bundle) => Option.toArray(bundle)),
+			left
+		};
+	});
 	const list = Effect.gen(function* () {
-		const owners = yield* Effect.result(casks);
+		const [owners, { here, found, left }] = yield* Effect.all([Effect.result(casks), scan], { concurrency: "unbounded" });
 		if (Result.isFailure(owners)) return {
 			packages: [],
 			notices: [{ message: `upup lists no apps while it cannot read which apps Homebrew installed: ${describeError(owners.failure)}` }]
 		};
-		const here = yield* host;
 		const locale = yield* Effect.cached(country);
 		const caskOf = new Map(owners.success.flatMap((cask) => caskApps(cask).map((app) => [app, cask])));
-		const found = (yield* Effect.forEach(yield* paths(options.roots), (app) => read(app, here.arch), { concurrency: inFlight })).flatMap((bundle) => Option.toArray(bundle));
 		const ids = /* @__PURE__ */ new Set();
 		const kept = found.filter((bundle) => {
 			const cask = caskOf.get(path.basename(bundle.path));
@@ -9193,13 +9233,9 @@ const makeWith = (options) => Effect.gen(function* () {
 			here,
 			rows: new Map(all.map((row) => [row.pkg.id, row.listed]))
 		});
-		const leftovers$1 = yield* Effect.forEach(yield* leftovers(options.roots), (old) => {
-			const app = old.slice(0, -9);
-			return fs.exists(app).pipe(Effect.orElseSucceed(() => true), Effect.map((present) => ({ message: present ? `${old} is the old copy of ${path.basename(app)} that an update left behind; move it to the Trash` : `${old} is ${path.basename(app)} from before an update that did not finish; rename it back to ${path.basename(app)}` })));
-		});
 		return {
 			packages: all.map((row) => row.pkg),
-			notices: [...all.flatMap((row) => row.notice), ...leftovers$1]
+			notices: [...all.flatMap((row) => row.notice), ...left]
 		};
 	}).pipe(Effect.withSpan("Apps.list"), provide);
 	const observe = Effect.fn("Apps.observe")(function* (pkg) {
@@ -9234,7 +9270,7 @@ const makeWith = (options) => Effect.gen(function* () {
 		const ids = yield* Effect.forEach(paths, (app) => readInfo(app).pipe(Effect.flatMap((info) => Option.match(info, {
 			onNone: () => Effect.fail(new Unsupported({ reason: `upup could not read ${app}` })),
 			onSome: (found) => Effect.succeed(found.CFBundleIdentifier)
-		}))));
+		}))), { concurrency: inFlight });
 		const found = {
 			paths,
 			ids: new Set(ids)
@@ -9515,7 +9551,7 @@ const nestedDirs = Effect.fn("nestedDirs")(function* (dir, names) {
 		args,
 		cwd: dir
 	}).pipe(Effect.orElseSucceed(() => ""));
-	const [prefix, listed] = yield* Effect.all([git("rev-parse", "--show-prefix"), git("ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...names.map((name) => `:(glob)**/${name}`))], { concurrency: 2 });
+	const [prefix, listed] = yield* Effect.all([git("rev-parse", "--show-prefix"), git("ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...names.map((name) => `:(glob)**/${name}`))], { concurrency: "unbounded" });
 	const files = listed.split("\0").filter((file) => {
 		const folders = file.split("/").slice(0, -1);
 		return folders.length > 0 && !folders.includes("node_modules") && !(path.basename(file) === "go.mod" && ignoredByGo(folders));
@@ -9542,8 +9578,7 @@ const failing = (name, error) => ({
 	observe: () => Effect.succeedNone
 });
 const locateAll = Effect.fn("locateAll")(function* (dir, nested, manifest, locate) {
-	const own = yield* locate(dir);
-	const below = yield* Effect.forEach(nested, (from) => Effect.map(Effect.result(locate(from)), (result) => [from, result]), { concurrency: 8 });
+	const [own, below] = yield* Effect.all([locate(dir), Effect.forEach(nested, (from) => Effect.map(Effect.result(locate(from)), (result) => [from, result]), { concurrency: 8 })], { concurrency: "unbounded" });
 	const found = /* @__PURE__ */ new Map();
 	const claimed = /* @__PURE__ */ new Map();
 	const failed = [];
@@ -9706,7 +9741,7 @@ const make$9 = (root, place = "") => Effect.gen(function* () {
 	const entries = (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => entriesOf(manifest, parsed)));
 	const workspace = Effect.gen(function* () {
 		const resolved = resolvedByMember(root, yield* metadata);
-		const manifests = yield* Effect.forEach(/* @__PURE__ */ new Set(["Cargo.toml", ...resolved.keys()]), (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => [manifest, parsed])));
+		const manifests = yield* Effect.forEach(/* @__PURE__ */ new Set(["Cargo.toml", ...resolved.keys()]), (manifest) => manifestOf(manifest).pipe(Effect.map((parsed) => [manifest, parsed])), { concurrency: 8 });
 		const inheritors = (key) => manifests.flatMap(([manifest, parsed]) => resolved.has(manifest) && inheritedKeys(parsed).includes(key) ? [manifest] : []);
 		return {
 			resolved,
@@ -10011,9 +10046,11 @@ const make$8 = Effect.gen(function* () {
 	});
 	const isPlainExecutable = Effect.fn("GoInstall.isPlainExecutable")(function* (dir, file) {
 		const binary = path.join(dir, file);
-		const info = yield* fs.stat(binary).pipe(Effect.mapError(fileFailed("stat", binary)));
-		const real = yield* fs.realPath(binary).pipe(Effect.mapError(fileFailed("resolve", binary)));
-		const realDir = yield* fs.realPath(dir).pipe(Effect.mapError(fileFailed("resolve", dir)));
+		const [info, real, realDir] = yield* Effect.all([
+			fs.stat(binary).pipe(Effect.mapError(fileFailed("stat", binary))),
+			fs.realPath(binary).pipe(Effect.mapError(fileFailed("resolve", binary))),
+			fs.realPath(dir).pipe(Effect.mapError(fileFailed("resolve", dir)))
+		], { concurrency: "unbounded" });
 		return info.type === "File" && (info.mode & 73) !== 0 && real === path.join(realDir, file);
 	});
 	const latest = Effect.fn("GoInstall.latest")(function* (modules) {
@@ -10172,8 +10209,7 @@ const make$7 = (root, moduleDir, place = "", local = /* @__PURE__ */ new Set())
 	]);
 	const origin = exec.stdout(env).pipe(Effect.flatMap(decodeGoJson(GoProxyEnv, commandLine(env))), Effect.map(withGoOrigin));
 	const list = Effect.gen(function* () {
-		const direct = yield* requirements;
-		const located = yield* origin;
+		const [direct, located] = yield* Effect.all([requirements, origin], { concurrency: "unbounded" });
 		const entries = yield* selected(direct.map((requirement) => requirement.Path), true);
 		const notices = [];
 		return {
@@ -10235,17 +10271,17 @@ const locate$1 = Effect.fn("GoModule.locate")(function* (dir) {
 const discover$2 = Effect.fn("GoModule.discover")(function* (dir, nested = []) {
 	const exec = yield* Exec;
 	const { found, failed } = yield* locateAll(dir, nested, "go.mod", locate$1);
-	const failedWorks = [];
-	const listed = /* @__PURE__ */ new Set();
-	const modules = yield* Effect.forEach(found, ({ root, work, claimed }) => Effect.gen(function* () {
-		if (!work) {
-			listed.add(root);
-			return [{
+	const works = yield* Effect.forEach(found, ({ root, work, claimed }) => Effect.gen(function* () {
+		if (!work) return {
+			modules: [{
 				root,
 				moduleDir: root,
 				local: /* @__PURE__ */ new Set()
-			}];
-		}
+			}],
+			failed: [],
+			covered: [root]
+		};
+		const covered = [];
 		const place = placeOf$1(dir, root);
 		const scanned = yield* Effect.gen(function* () {
 			const edit = {
@@ -10259,7 +10295,7 @@ const discover$2 = Effect.fn("GoModule.discover")(function* (dir, nested = []) {
 			};
 			const file = yield* exec.stdout(edit).pipe(Effect.flatMap(decodeGoJson(WorkFile, commandLine(edit))));
 			const used = (file.Use ?? []).map((use) => path.resolve(root, use.DiskPath));
-			for (const moduleDir of used) listed.add(moduleDir);
+			covered.push(...used);
 			const paths = yield* Effect.forEach(used, (moduleDir) => Effect.gen(function* () {
 				const mod = yield* readModFile(exec, moduleDir);
 				if (mod.Module === void 0) return yield* new OutputMalformed({
@@ -10275,20 +10311,27 @@ const discover$2 = Effect.fn("GoModule.discover")(function* (dir, nested = []) {
 				local
 			})).filter(({ moduleDir }) => place === "" || placeOf$1(dir, moduleDir) !== "");
 		}).pipe(Effect.result);
-		if (Result.isSuccess(scanned)) return scanned.success;
-		for (const moduleDir of claimed) listed.add(moduleDir);
-		failedWorks.push(failing(path.join(place, "go.work"), scanned.failure));
-		return [];
-	}));
+		if (Result.isSuccess(scanned)) return {
+			modules: scanned.success,
+			failed: [],
+			covered
+		};
+		return {
+			modules: [],
+			failed: [failing(path.join(place, "go.work"), scanned.failure)],
+			covered: [...covered, ...claimed]
+		};
+	}), { concurrency: 4 });
+	const listed = new Set(works.flatMap((work) => work.covered));
 	const outside = nested.flatMap((moduleDir) => listed.has(moduleDir) ? [] : [{
 		root: moduleDir,
 		moduleDir,
 		local: /* @__PURE__ */ new Set()
 	}]);
-	const providers = yield* Effect.forEach([...modules.flat(), ...outside], ({ root, moduleDir, local }) => make$7(root, moduleDir, placeOf$1(dir, root), local));
+	const providers = yield* Effect.forEach([...works.flatMap(({ modules }) => modules), ...outside], ({ root, moduleDir, local }) => make$7(root, moduleDir, placeOf$1(dir, root), local));
 	return [
 		...failed,
-		...failedWorks,
+		...works.flatMap((work) => work.failed),
 		...providers
 	];
 });
@@ -10296,24 +10339,23 @@ const discover$2 = Effect.fn("GoModule.discover")(function* (dir, nested = []) {
 var ProviderSource = class extends Context.Service()("upup/ProviderSource") {};
 // src/node/release-history.ts
 const minutesPerDay = 1440;
-const firstPnpmMajorWithDefaultReleaseAge = 11;
 const gateSettings = {
 	pnpm: {
 		age: "minimumReleaseAge",
 		exclude: "minimumReleaseAgeExclude",
 		unit: 1,
-		unset: (version) => (semver.coerce(version)?.major ?? 0) >= firstPnpmMajorWithDefaultReleaseAge ? minutesPerDay : 0
+		unset: minutesPerDay
 	},
 	npm: {
 		age: "min-release-age",
 		exclude: "min-release-age-exclude",
 		unit: minutesPerDay,
-		unset: () => 0
+		unset: 0
 	}
 };
-const releaseGate = (manager, version, config) => {
+const releaseGate = (manager, config) => {
 	const settings = gateSettings[manager];
-	const minutes = Number(config[settings.age] ?? settings.unset(version)) * settings.unit;
+	const minutes = Number(config[settings.age] ?? settings.unset) * settings.unit;
 	return {
 		minutes: Number.isFinite(minutes) && minutes > 0 ? minutes : 0,
 		exclude: [config[settings.exclude] ?? []].flat().filter((pattern) => typeof pattern === "string")
@@ -10399,8 +10441,7 @@ const releaseOffers = Effect.fn("releaseOffers")(function* (pins, manager, run,
 	const reads = yield* Effect.result(Effect.forEach(artifacts, read, { concurrency: 8 }));
 	const histories = new Map(Result.isSuccess(reads) ? reads.success : []);
 	const notices = Result.isFailure(reads) ? [{ message: `release histories could not be read, so upup offers nothing: ${describeError(reads.failure)}` }] : [];
-	const version = manager === "pnpm" && histories.size > 0 ? yield* exec.stdout(run(["--version"])) : "";
-	const gate = releaseGate(manager, version.trim(), config);
+	const gate = releaseGate(manager, config);
 	const offer = (pin) => {
 		const history = histories.get(pin.artifact);
 		if (history === void 0) return Result.succeed(void 0);
@@ -10511,7 +10552,7 @@ const makeGlobal = (spec) => Effect.gen(function* () {
 			installed,
 			latest,
 			readNpmConfig(spec.config, "/").pipe(Effect.provideService(Exec, exec))
-		], { concurrency: 3 });
+		], { concurrency: "unbounded" });
 		const { offer, notices: unread } = yield* releaseOffers(packages.filter((pkg) => isPrerelease(pkg.current)), spec.config, (args) => ({
 			command: spec.config,
 			args,
@@ -10742,9 +10783,10 @@ const scan = Effect.fn("NodePins.scan")(function* (root, dir, nested) {
 	const fs = yield* FileSystem.FileSystem;
 	const read = (file) => readText(path.join(root, file));
 	const exists = (file) => fs.exists(path.join(root, file)).pipe(Effect.mapError(fileFailed("stat", path.join(root, file))));
-	const steps = (yield* workflowFiles(root)).flatMap(({ file, text }) => stepPins(file, text) ?? []);
-	const versioned = yield* Effect.filter(yield* versionFilesOf(root, dir, nested), exists);
-	const files = yield* Effect.forEach(versioned.toSorted(), (file) => Effect.map(read(file), (text) => filePin(file, text)));
+	const [workflows, listed] = yield* Effect.all([workflowFiles(root), versionFilesOf(root, dir, nested)], { concurrency: "unbounded" });
+	const steps = workflows.flatMap(({ file, text }) => stepPins(file, text) ?? []);
+	const versioned = yield* Effect.filter(listed, exists, { concurrency: "unbounded" });
+	const files = yield* Effect.forEach(versioned.toSorted(), (file) => Effect.map(read(file), (text) => filePin(file, text)), { concurrency: 8 });
 	return [...steps, ...files.flat()];
 });
 const make$6 = (root, dir = root, nested = []) => Effect.gen(function* () {
@@ -11007,26 +11049,31 @@ const make$5 = (root, manager, place = "", claimed = []) => Effect.gen(function*
 		const unlocked = claimed.filter((dir) => !lockedDirs.has(path.normalize(dir))).toSorted((a, b) => a.localeCompare(b));
 		if (unlocked.length > 0) notices.push({ message: `not listed: ${unlocked.join(", ")} (not in ${lockfile})` });
 		const catalogLocked = /* @__PURE__ */ new Map();
-		for (const member of members.toSorted((a, b) => a.localeCompare(b))) {
+		const memberManifests = yield* Effect.forEach(members.toSorted((a, b) => a.localeCompare(b)), (member) => {
 			const memberDir = member === "." ? "" : member;
 			const manifest = path.join(memberDir, "package.json");
-			const fields = yield* readJson(Manifest, path.join(root, manifest));
-			for (const section of sections) for (const [name, spec] of Object.entries(fields[section] ?? {})) {
-				const resolved = Option.match(pnpm, {
-					onSome: (lock) => resolvedVersion(lock.importers?.[member]?.[section]?.[name]?.version),
-					onNone: () => Option.match(npm, {
-						onSome: (lock) => lock.packages[path.join(memberDir, "node_modules", name)]?.version ?? lock.packages[path.join("node_modules", name)]?.version,
-						onNone: () => void 0
-					})
-				});
-				if (spec.startsWith("catalog:")) {
-					const catalog = spec.slice(8) || "default";
-					const locked = catalogLocked.get(catalog) ?? /* @__PURE__ */ new Map();
-					if (resolved !== void 0 && !locked.has(name)) catalogLocked.set(catalog, locked.set(name, resolved));
-					continue;
-				}
-				add(manifest, section, [section, name], name, spec, resolved);
+			return Effect.map(readJson(Manifest, path.join(root, manifest)), (fields) => ({
+				member,
+				memberDir,
+				manifest,
+				fields
+			}));
+		}, { concurrency: 8 });
+		for (const { member, memberDir, manifest, fields } of memberManifests) for (const section of sections) for (const [name, spec] of Object.entries(fields[section] ?? {})) {
+			const resolved = Option.match(pnpm, {
+				onSome: (lock) => resolvedVersion(lock.importers?.[member]?.[section]?.[name]?.version),
+				onNone: () => Option.match(npm, {
+					onSome: (lock) => lock.packages[path.join(memberDir, "node_modules", name)]?.version ?? lock.packages[path.join("node_modules", name)]?.version,
+					onNone: () => void 0
+				})
+			});
+			if (spec.startsWith("catalog:")) {
+				const catalog = spec.slice(8) || "default";
+				const locked = catalogLocked.get(catalog) ?? /* @__PURE__ */ new Map();
+				if (resolved !== void 0 && !locked.has(name)) catalogLocked.set(catalog, locked.set(name, resolved));
+				continue;
 			}
+			add(manifest, section, [section, name], name, spec, resolved);
 		}
 		if (Option.isSome(pnpm) && (yield* exists(path.join(root, "pnpm-workspace.yaml")))) {
 			const workspacePath = path.join(root, "pnpm-workspace.yaml");
@@ -11096,7 +11143,7 @@ const make$5 = (root, manager, place = "", claimed = []) => Effect.gen(function*
 		};
 	}).pipe(Effect.provideService(FileSystem.FileSystem, fs));
 	const list = Effect.gen(function* () {
-		const [{ declared, notices }, config] = yield* Effect.all([declarations, readNpmConfig(manager, root).pipe(Effect.provideService(Exec, exec))], { concurrency: 2 });
+		const [{ declared, notices }, config] = yield* Effect.all([declarations, readNpmConfig(manager, root).pipe(Effect.provideService(Exec, exec))], { concurrency: "unbounded" });
 		const origin = withNpmOrigin(npmRegistries(config));
 		const { offer, notices: unread } = yield* releaseOffers(declared.flatMap((entry) => entry.held === true ? [] : [entry.pkg]), manager, run, config).pipe(Effect.provideService(Exec, exec));
 		return {
@@ -11302,7 +11349,7 @@ const discover = Effect.fn("NodeProject.discover")(function* (dir, nested = [])
 		const installed = yield* fs.exists(lockfile).pipe(Effect.mapError(fileFailed("stat", lockfile)));
 		if (place !== "" && !installed) unlisted.push(`${place} (no ${lockfiles[manager]} yet)`);
 		else {
-			const manifests = yield* Effect.filter(claimed, (from) => fs.exists(path.join(from, "package.json")).pipe(Effect.mapError(fileFailed("stat", from))));
+			const manifests = yield* Effect.filter(claimed, (from) => fs.exists(path.join(from, "package.json")).pipe(Effect.mapError(fileFailed("stat", from))), { concurrency: "unbounded" });
 			providers.push(yield* make$5(root, manager, place, manifests.map((from) => path.relative(root, from))));
 		}
 	}
@@ -11401,10 +11448,13 @@ const make$4 = Effect.gen(function* () {
 	});
 	const list = Effect.gen(function* () {
 		const found = yield* configured;
+		const offered = yield* Effect.forEach(found.packages, (pkg) => Effect.map(Effect.result(offer(pkg)), (target) => ({
+			pkg,
+			target
+		})), { concurrency: 4 });
 		const notices = [...found.notices];
 		return {
-			packages: yield* Effect.forEach(found.packages, (pkg) => Effect.gen(function* () {
-				const target = yield* Effect.result(offer(pkg));
+			packages: offered.map(({ pkg, target }) => {
 				if (Result.isFailure(target)) {
 					notices.push({
 						rowKey: rowKey(pkg),
@@ -11413,7 +11463,7 @@ const make$4 = Effect.gen(function* () {
 					return pkg;
 				}
 				return target.success === void 0 ? pkg : withTarget(pkg, target.success);
-			})),
+			}),
 			notices
 		};
 	}).pipe(Effect.withSpan("VpEnv.list"));
@@ -11545,7 +11595,7 @@ const make$2 = Effect.gen(function* () {
 				exec.stdout(command$1("apt", ["list", "--upgradable"])).pipe(Effect.map(parseUpgradable)),
 				exec.stdout(command$1("apt-mark", ["showhold"])).pipe(Effect.map((text) => new Set(text.split("\n").filter((line) => line !== "")))),
 				restart
-			], { concurrency: 4 });
+			], { concurrency: "unbounded" });
 			const packages = upgradable.map((entry) => {
 				const pkg = packageOf(entry, arch);
 				return holds.has(entry.name) || holds.has(pkg.id) ? pkg : withTarget(pkg, entry.version);
@@ -11690,7 +11740,7 @@ const make$1 = Effect.gen(function* () {
 			running,
 			scan(args),
 			Ref.get(installed)
-		], { concurrency: 2 });
+		], { concurrency: "unbounded" });
 		return {
 			packages: packagesOf$1(version, offers.filter((offer) => !done.has(offer.label))),
 			done
@@ -11775,7 +11825,7 @@ const make = Effect.gen(function* () {
 				"list",
 				"--outdated",
 				"--show-python"
-			])).pipe(Effect.map(parseTools))], { concurrency: 2 });
+			])).pipe(Effect.map(parseTools))], { concurrency: "unbounded" });
 			const targets = new Map(outdated.flatMap((tool) => tool.fromPyPI && tool.latest !== void 0 ? [[tool.pkg.id, tool.latest]] : []));
 			const index = privatePypiIndex();
 			return {
@@ -11824,8 +11874,8 @@ const system$1 = [
 	["go", make$8],
 	["uv", make]
 ];
-const available = (entries) => Effect.filter([...new Set(entries.map(([command]) => command))], onPath).pipe(Effect.map((found) => entries.filter(([command]) => found.includes(command))));
-const systemProviders = available(system$1).pipe(Effect.flatMap((found) => Effect.forEach(found, ([, make]) => make)));
+const available = (entries) => Effect.filter([...new Set(entries.map(([command]) => command))], onPath, { concurrency: "unbounded" }).pipe(Effect.map((found) => entries.filter(([command]) => found.includes(command))));
+const systemProviders = available(system$1).pipe(Effect.flatMap((found) => Effect.forEach(found, ([, make]) => make, { concurrency: "unbounded" })));
 const project$1 = [
 	["go", {
 		manifests: ["go.mod"],
@@ -11851,9 +11901,8 @@ const project$1 = [
 const manifests = project$1.flatMap(([, kind]) => kind.manifests);
 const projectProviders = (given) => Effect.gen(function* () {
 	const dir = yield* (yield* FileSystem.FileSystem).realPath(given).pipe(Effect.orElseSucceed(() => given));
-	const found = yield* available(project$1);
-	const nested = yield* nestedDirs(dir, manifests);
-	return (yield* Effect.forEach(found, ([, kind]) => kind.discover(dir, [...new Set(kind.manifests.flatMap(nested))]))).flat();
+	const [found, nested] = yield* Effect.all([available(project$1), nestedDirs(dir, manifests)], { concurrency: "unbounded" });
+	return (yield* Effect.forEach(found, ([, kind]) => kind.discover(dir, [...new Set(kind.manifests.flatMap(nested))]), { concurrency: "unbounded" })).flat();
 });
 const layer$3 = Layer.effect(ProviderSource, Effect.gen(function* () {
 	const context = yield* Effect.context();
@@ -11963,7 +12012,7 @@ const message = (version) => {
 };
 const lookup$1 = Effect.fn("npm.lookup")(function* (client, wanted) {
 	const path = wanted.name.replace("/", "%2F");
-	const [packument, downloads] = yield* Effect.all([getJson(client, `https://registry.npmjs.org/${path}`, Packument), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: 2 });
+	const [packument, downloads] = yield* Effect.all([getJson(client, `https://registry.npmjs.org/${path}`, Packument), getJson(client, `https://api.npmjs.org/downloads/point/last-week/${wanted.name}`, Downloads).pipe(Effect.option)], { concurrency: "unbounded" });
 	const versions = packument.versions ?? {};
 	const latest = packument["dist-tags"]?.latest;
 	const repository = Predicate.isString(packument.repository) ? packument.repository : packument.repository?.url;
@@ -12003,7 +12052,7 @@ const repositoryKeys = [
 	"GitHub"
 ];
 const lookup = Effect.fn("pypi.lookup")(function* (client, wanted) {
-	const [project, recent] = yield* Effect.all([getJson(client, `https://pypi.org/pypi/${wanted.name}/json`, Project), getJson(client, `https://pypistats.org/api/packages/${wanted.name.toLowerCase()}/recent`, Recent).pipe(Effect.option)], { concurrency: 2 });
+	const [project, recent] = yield* Effect.all([getJson(client, `https://pypi.org/pypi/${wanted.name}/json`, Project), getJson(client, `https://pypistats.org/api/packages/${wanted.name.toLowerCase()}/recent`, Recent).pipe(Effect.option)], { concurrency: "unbounded" });
 	const urls = project.info.project_urls ?? {};
 	const repository = repositoryKeys.map((key) => urls[key]).find((url) => url !== void 0);
 	const homepage = urls["Homepage"] ?? project.info.home_page ?? void 0;
@@ -12597,12 +12646,10 @@ const layer$1 = (cacheDir) => Layer.succeed(UpdateLog, UpdateLog.of({
 		const directory = path.join(cacheDir, "updates");
 		const names = (await readdir(directory).catch(() => [])).filter((name) => name.endsWith(".jsonl")).toSorted();
 		const found = [];
-		for (const name of names) {
-			const text = await readFile(path.join(directory, name), "utf-8").catch(() => "");
-			for (const line of text.split("\n")) {
-				const entry = Option.getOrUndefined(decodeLine(line));
-				if (entry?.scope === scope && Date.parse(entry.at) >= since) found.push(entry);
-			}
+		const texts = await Promise.all(names.map(async (name) => await readFile(path.join(directory, name), "utf-8").catch(() => "")));
+		for (const text of texts) for (const line of text.split("\n")) {
+			const entry = Option.getOrUndefined(decodeLine(line));
+			if (entry?.scope === scope && Date.parse(entry.at) >= since) found.push(entry);
 		}
 		return found;
 	})
@@ -13346,8 +13393,8 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 		};
 	});
 	const recallAll = Effect.gen(function* () {
-		const found = yield* earlier(yield* SubscriptionRef.get(state));
-		const logged = yield* fromLog(yield* SubscriptionRef.get(state));
+		const before = yield* SubscriptionRef.get(state);
+		const [found, logged] = yield* Effect.all([earlier(before), fromLog(before)], { concurrency: "unbounded" });
 		yield* update((latest) => ({
 			...latest,
 			installed: {
@@ -13366,15 +13413,14 @@ const layer = Layer.effect(Session, Effect.gen(function* () {
 			const identity = identityOf(pkg, current.mode);
 			if (identity !== void 0 && current.audits[jobKey(identity)]?._tag !== "Running") wanted.set(jobKey(identity), identity);
 		}
-		yield* Effect.forEach(wanted.values(), audits.recall, {
-			concurrency: 4,
-			discard: true
-		});
 		const offered = packagesOf(current).flatMap((pkg) => {
 			const identity = pkg.target === void 0 ? void 0 : identityOf(pkg, current.mode);
 			return identity === void 0 ? [] : [identity];
 		});
-		const majors = yield* Effect.forEach(offered, (identity) => audits.majors(identity).pipe(Effect.map((identityMajors) => [jobKey(identity), identityMajors])), { concurrency: 4 });
+		const [, majors] = yield* Effect.all([Effect.forEach(wanted.values(), audits.recall, {
+			concurrency: 4,
+			discard: true
+		}), Effect.forEach(offered, (identity) => audits.majors(identity).pipe(Effect.map((identityMajors) => [jobKey(identity), identityMajors])), { concurrency: 4 })], { concurrency: "unbounded" });
 		yield* update((latest) => ({
 			...latest,
 			majors: {