@joshuafolkken/kit 1.1035.0 → 1.1094.0

package/scripts/agent/codex-hooks.ts

@@ -0,0 +1,92 @@
+import { hook_launch } from '#scripts/init/hook-launch'
+
+// `.codex/hooks.json` is derived from `.claude/settings.json`, never written by hand
+// (joshuafolkken/kit#2997). The hand copy carried every hook command twice, so a change to one side
+// left the other silently stale. Codex differs from Claude Code in three places only, and each is a
+// rule applied here rather than a line maintained in the copy:
+//
+// 1. The pretool and posttool handlers run through the Codex input adapter, which translates the
+//    `apply_patch` payload into the Edit/Write shape the Claude-side guards read.
+// 2. The PreToolUse and PostToolUse matchers also select `apply_patch`, Codex's edit tool.
+// 3. UserPromptSubmit carries no matcher — Codex documents that the event ignores it.
+
+interface HookHandler {
+	type: string
+	command: string
+	timeout?: number
+}
+
+interface MatcherGroup {
+	matcher?: string
+	hooks: Array<HookHandler>
+}
+
+type HookEvents = Record<string, Array<MatcherGroup>>
+
+interface HookConfig {
+	hooks: HookEvents
+}
+
+const CODEX_EDIT_TOOL = 'apply_patch'
+const TOOL_EVENTS: ReadonlySet<string> = new Set(['PreToolUse', 'PostToolUse'])
+const UNMATCHED_EVENTS: ReadonlySet<string> = new Set(['UserPromptSubmit'])
+const JSON_INDENT = '\t'
+
+function adapter_command(mode: string): string {
+	return hook_launch.bundle_launch_command(
+		`codex-hook-adapter.js ${mode}`,
+		`pnpm exec tsx scripts/hooks/codex-hook-adapter.ts ${mode}`,
+	)
+}
+
+// Each Claude-side guard command the adapter stands in for, keyed by that command verbatim.
+const ADAPTED_COMMANDS: ReadonlyMap<string, string> = new Map([
+	[
+		hook_launch.hook_launch_command('pretool-guard.js', 'pretool:guard'),
+		adapter_command('pretool'),
+	],
+	[
+		hook_launch.hook_launch_command('format-edited.js', 'format:edited'),
+		adapter_command('posttool'),
+	],
+])
+
+function codex_handler(handler: HookHandler): HookHandler {
+	return { ...handler, command: ADAPTED_COMMANDS.get(handler.command) ?? handler.command }
+}
+
+function codex_matcher(event: string, matcher: string | undefined): string | undefined {
+	if (UNMATCHED_EVENTS.has(event)) return undefined
+	if (matcher !== undefined && TOOL_EVENTS.has(event)) return `${matcher}|${CODEX_EDIT_TOOL}`
+
+	return matcher
+}
+
+function codex_group(event: string, group: MatcherGroup): MatcherGroup {
+	const matcher = codex_matcher(event, group.matcher)
+	const hooks = group.hooks.map((handler) => codex_handler(handler))
+
+	return matcher === undefined ? { hooks } : { matcher, hooks }
+}
+
+function codex_hook_config(claude: HookConfig): HookConfig {
+	const events = Object.entries(claude.hooks).map(([event, groups]) => [
+		event,
+		groups.map((group) => codex_group(event, group)),
+	])
+
+	return { hooks: Object.fromEntries(events) as HookEvents }
+}
+
+// The file text `.codex/hooks.json` holds — the formatter's own output for this JSON, so a write
+// followed by `pnpm josh format:edited` leaves it byte-identical.
+function codex_hooks_text(claude_settings_text: string): string {
+	const claude = JSON.parse(claude_settings_text) as HookConfig
+
+	return `${JSON.stringify(codex_hook_config(claude), undefined, JSON_INDENT)}\n`
+}
+
+const codex_hooks = { adapter_command, codex_hook_config, codex_hooks_text }
+
+export { codex_hooks }
+export type { HookConfig }

package/scripts/agent/interactive-ask.ts

@@ -86,6 +86,6 @@ function refused_ask_of(permission_denials: unknown): string | undefined {
 	return questions.map((question) => render_question(question)).join(QUESTION_SEPARATOR)
 }
 
-const interactive_ask = { INTERACTIVE_TOOLS, is_interactive_tool, refused_ask_of }
+const interactive_ask = { is_interactive_tool, refused_ask_of }
 
 export { interactive_ask }

package/scripts/auto-ok/auto-ok-cli.ts

@@ -3,19 +3,19 @@ import { fileURLToPath } from 'node:url'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_index, type FetchedEpics } from '#scripts/epic/epic-index'
 import { epic_issue } from '#scripts/epic/epic-issue'
-import { git_gh_command } from '#scripts/git/git-gh-command'
-import { SUMMARY_FIELDS } from '#scripts/git/git-gh-issue'
-import { git_next_issues } from '#scripts/git/git-next-issues'
-import { AUTO_OK_LABEL } from '#scripts/git/issue-labels'
+import { git_gh_command } from '#scripts/gh/git-gh-command'
+import { SUMMARY_FIELDS } from '#scripts/gh/git-gh-issue'
 import { cutoff_cause, cutoff_of, type ScanCutoff } from '#scripts/git/listing-cutoff'
 import { read_json_listing } from '#scripts/git/parse-json-array'
 import { open_issue_schema, type OpenIssueData } from '#scripts/git/schemas'
+import { git_next_issues } from '#scripts/issue/git-next-issues'
+import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
 
 // `josh auto-ok:next` — which issue outside the epic an unattended run picks up next
 // (joshuafolkken/kit#906).
 //
 // A command rather than a documented `gh` invocation, for the reason the label constant exists: the
-// name `auto-ok` is single-sourced in `scripts/git/issue-labels.ts`, and a procedure that told an
+// name `auto-ok` is single-sourced in `scripts/issue/issue-labels.ts`, and a procedure that told an
 // agent to type `gh issue list --label auto-ok` would put a second copy of it in prose, where
 // nothing checks it. The contract is `epic:next`'s: one token on standard output, every explanation
 // on standard error, so `answer=$(pnpm josh auto-ok:next)` reads it.
@@ -48,7 +48,7 @@ const LISTING_LIMIT = 200
 // CLI's version cannot be what changed the row shape — the same misdirection the message below
 // already refuses to repeat for the blocker relations, left standing one constant above it.
 const UNREADABLE_MESSAGE = `Could not read the \`${AUTO_OK_LABEL}\` listing. That is not "nothing is opted in" — check \`gh auth status\` and ask again.`
-const UNEXPECTED_SHAPE_MESSAGE = `Read the \`${AUTO_OK_LABEL}\` listing but could not parse it. That is not "nothing is opted in" — the rows came back in a shape this command does not recognize, so check the fields it asks for and the REST field mapping in \`scripts/git/git-gh-issue-rest.ts\` rather than your authentication.`
+const UNEXPECTED_SHAPE_MESSAGE = `Read the \`${AUTO_OK_LABEL}\` listing but could not parse it. That is not "nothing is opted in" — the rows came back in a shape this command does not recognize, so check the fields it asks for and the REST field mapping in \`scripts/gh/git-gh-issue-rest.ts\` rather than your authentication.`
 // The blocker relations failing takes the whole listing with them, and `issue_list` swallows
 // the error — so the read looks exactly like an access failure and sends the reader to
 // `gh auth status`, which is green. That is the misdirection joshuafolkken/kit#996 added the message
@@ -310,9 +310,8 @@ async function fetch_tracking(count: number): Promise<TrackingRead> {
 	}
 }
 
-// The pickup *order* is `git_next_issues.prioritize` itself, not a copy of it: newest first, with the
-// `epic` / `in-progress` / `needs-decision` exclusions. Its display cap does not reach this caller,
-// which reads only the first row.
+// The pickup *order* is `git_next_issues.order` itself, not a copy of it: the ranking `prioritize`
+// shows, with the `epic` / `in-progress` / `needs-decision` exclusions, before its display cap.
 //
 // The two are no longer the same *set*, and deliberately so: since joshuafolkken/kit#996 the pickup
 // also drops a candidate whose prerequisite is still open, while `🗒 Next issues` shows every open
@@ -323,9 +322,12 @@ async function fetch_tracking(count: number): Promise<TrackingRead> {
 // Membership of the label is the *query's* job, not this function's: `--label` is what makes the
 // listing the opted-in set, so re-testing it here would be a second definition of opting in.
 //
-// The exclusions are applied **before** `prioritize`, not after: it keeps only its first few rows,
-// so filtering its output would answer `none` whenever those rows happen to be blocked while a
-// runnable issue sits below them.
+// The exclusions are applied to `git_next_issues.order`'s **uncapped** ranking, never to
+// `prioritize`'s capped one, which would answer `none` whenever its first rows happen to be blocked
+// while a runnable issue sits below them. They are applied **after** the ranking, not before it: the
+// dependents key counts the issues waiting on a row, and a waiting issue is by definition blocked —
+// filtered first, every row would count zero and the key would never decide anything
+// (joshuafolkken/kit#2928).
 //
 // The `🗒 Next issues` display is deliberately *not* filtered this way; `git-next-issues.ts` records
 // why, and the short version is that a person can see a blocked issue and choose to start it anyway
@@ -354,9 +356,7 @@ function pick_next(
 	tracked: ReadonlyMap<number, number> = new Map(),
 	exclude: ReadonlyArray<number> = [],
 ): OpenIssueData | undefined {
-	const runnable = issues.filter((issue) => is_runnable(issue, tracked, exclude))
-
-	return git_next_issues.prioritize(runnable)[0]
+	return git_next_issues.order(issues).find((issue) => is_runnable(issue, tracked, exclude))
 }
 
 // Why there is nothing to run. "No open issue carries the label" and "every opted-in issue is
@@ -491,23 +491,13 @@ const auto_ok_cli = {
 	TRUNCATED_WITHOUT_ANSWER,
 	NONE_OPTED_IN_MESSAGE,
 	truncated_cause,
-	parse_issue_number,
-	parse_exclude,
-	parse_pair,
 	parse_options,
 	fetch_opted_in,
-	parse_listing,
-	is_page_complete,
-	is_closed,
-	is_unblocked,
 	fetch_tracking,
 	is_runnable,
 	pick_next,
 	truncation_note,
-	none_reason,
-	report,
 	run,
-	main,
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))

package/scripts/backlog/backlog-budget.ts

@@ -268,7 +268,6 @@ function decide(input: BudgetInput): BudgetDecision {
 
 const backlog_budget = {
 	ANSWERS,
-	ANSWER_STOP_REASONS,
 	BLOCKED_REASON,
 	DEFAULT_IDLE_MINUTES,
 	DEFAULT_IDLE_MS,
@@ -283,7 +282,6 @@ const backlog_budget = {
 	UNREADABLE_REASON,
 	WATCH_VERDICT,
 	WHOLE_RUN_BUDGET_HOURS,
-	WHOLE_RUN_BUDGET_MINUTES,
 	WHOLE_RUN_BUDGET_MS,
 	WHOLE_RUN_REASON,
 	decide,

package/scripts/backlog/backlog-defect-priority.ts

@@ -1,6 +1,6 @@
 import type { EpicChild } from '#scripts/epic/epic-graph'
 import type { EpicNextResult, RepoCandidates } from '#scripts/epic/epic-report'
-import { git_gh_command } from '#scripts/git/git-gh-command'
+import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { defect_rate, type DefectRate, type IssueKind } from '#scripts/issue/defect-rate'
 import { defect_rate_cli } from '#scripts/issue/defect-rate-cli'
 
@@ -72,6 +72,6 @@ async function prioritize(
 	return await reorder(result, repo)
 }
 
-const backlog_defect_priority = { UNMEASURED_MESSAGE, KIND_RANK, prioritize }
+const backlog_defect_priority = { UNMEASURED_MESSAGE, prioritize }
 
 export { backlog_defect_priority }

package/scripts/backlog/backlog-drive-cli.ts

@@ -5,13 +5,13 @@ import { CONTEXT_CUT_THRESHOLD } from '#scripts/cost-runtime/context-cut-thresho
 import { hook_decision } from '#scripts/josh/hook-decision'
 import { josh_command } from '#scripts/josh/josh-run'
 import { lane_await, type AwaitState } from '#scripts/lane/lane-await'
-import { lane_launch_cli } from '#scripts/lane/lane-launch-cli'
+import { lane_launch_cli, type LaunchOutcome } from '#scripts/lane/lane-launch-cli'
 import { lane_registry } from '#scripts/lane/lane-registry'
 import { cli_flags } from '#scripts/lib/cli-flags'
 import { error_text } from '#scripts/lib/error-message'
 import { run_carry, type RunCarry } from '#scripts/run/run-carry'
 import { run_event_stream_emit } from '#scripts/run/run-event-stream-emit'
-import { run_merge_cli } from '#scripts/run/run-merge-cli'
+import { run_merge_cli, type MergeResult } from '#scripts/run/run-merge-cli'
 import { z } from 'zod'
 import {
 	backlog_drive,
@@ -28,6 +28,7 @@ import { backlog_drive_owner } from './backlog-drive-owner'
 import { backlog_drive_restore } from './backlog-drive-restore'
 import { backlog_drive_retrospective } from './backlog-drive-retrospective'
 import { backlog_offer_cli } from './backlog-offer-cli'
+import { backlog_ready } from './backlog-ready'
 
 // `josh backlog:drive` — the backlogrun parent's loop as one resident wait (joshuafolkken/kit#2499).
 // The parent issues it once, in the background, and is woken only when it exits — with a token the model
@@ -217,7 +218,7 @@ function merge_token(out: string, code: number): string {
 
 // The child's transcript, where its lane recorded one, so `run:merge` can tell an API outage from a
 // failure exactly as it does for the parent that passes `--output` by hand.
-async function merge(issue: string, owner: string): Promise<string> {
+async function merge(issue: string, owner: string): Promise<MergeResult> {
 	await backlog_drive_owner.assert_current(owner)
 	const lane = await lane_registry.find_open_lane(issue)
 	const result = await run_merge_cli.merge_child({
@@ -231,13 +232,15 @@ async function merge(issue: string, owner: string): Promise<string> {
 
 	await backlog_drive_named.mark_done(issue, result, owner)
 
-	return result.token
+	return result
 }
 
-async function launch(issue: string, owner: string): Promise<boolean> {
+async function launch(issue: string, owner: string): Promise<LaunchOutcome['kind']> {
 	await backlog_drive_owner.assert_current(owner)
 
-	return (await lane_launch_cli.launch_lane({ issue, stash: undefined })) !== undefined
+	const outcome = await lane_launch_cli.launch_lane({ issue, stash: undefined })
+
+	return outcome.kind
 }
 
 // `lane:await`'s re-confirmed check, one state per child. A child already gone when the loop starts —
@@ -304,6 +307,7 @@ function ports_of(
 		merge: async (issue) => await merge(issue, context.owner),
 		offer: async (state) => await read_offer(state, context),
 		launch: async (issue) => await launch(issue, context.owner),
+		free_lanes: backlog_ready.drive_free_lane_count,
 		now: () => new Date(),
 		sleep: async (milliseconds) => {
 			await sleep(milliseconds)
@@ -375,14 +379,12 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 }
 
 const backlog_drive_cli = {
-	USAGE,
 	end_line,
 	finish: backlog_drive_finish.finish,
 	merge_token,
 	offer_argv: backlog_drive_offer_argv.offer_argv,
 	parse,
 	resume_line,
-	run,
 	to_offer,
 }
 

package/scripts/backlog/backlog-drive-named-offer.ts

@@ -1,6 +1,8 @@
-import { EPIC_LABEL, has_label_name } from '#scripts/git/issue-labels'
+import { EPIC_LABEL, has_label_name, NEEDS_DECISION_LABEL } from '#scripts/issue/issue-labels'
+import type { IssueState } from '#scripts/issue/issue-state'
 import { issue_state_cli } from '#scripts/issue/issue-state-cli'
 import type { RunCarry } from '#scripts/run/run-carry'
+import type { MergeResult } from '#scripts/run/run-merge-cli'
 import { backlog_budget } from './backlog-budget'
 import type { DriveState, OfferRead } from './backlog-drive'
 import { backlog_drive_named } from './backlog-drive-named'
@@ -44,6 +46,15 @@ function budget_offer(
 	}
 }
 
+// The outcome a named issue has already reached without this run dispatching it: closed is merged, and
+// a `needs-decision` park waits on a person, so re-dispatching it only repeats the stop it parked on
+// (joshuafolkken/kit#2965). Either is booked done rather than offered.
+function settled_outcome(state: IssueState): MergeResult['outcome'] | undefined {
+	if (state.state.toUpperCase() === 'CLOSED') return 'merged'
+
+	return has_label_name(state.labels, NEEDS_DECISION_LABEL) ? 'parked' : undefined
+}
+
 async function classify(issue: string, named: OfferRead, owner: string): Promise<OfferRead> {
 	const result = await issue_state_cli.read_issue(issue)
 
@@ -51,8 +62,10 @@ async function classify(issue: string, named: OfferRead, owner: string): Promise
 		return { verdict: 'issue-state', issues: [], retries: NO_RETRIES }
 	}
 
-	if (result.state.state.toUpperCase() === 'CLOSED') {
-		await backlog_drive_named.mark_done(issue, { outcome: 'merged', code: 0, token: 'none' }, owner)
+	const outcome = settled_outcome(result.state)
+
+	if (outcome !== undefined) {
+		await backlog_drive_named.mark_done(issue, { outcome, code: 0, token: 'none' }, owner)
 
 		return { verdict: 'wait', issues: [], retries: NO_RETRIES }
 	}

package/scripts/backlog/backlog-drive-named.ts

@@ -1,4 +1,4 @@
-import { has_label_name, NEEDS_DECISION_LABEL } from '#scripts/git/issue-labels'
+import { has_label_name, NEEDS_DECISION_LABEL } from '#scripts/issue/issue-labels'
 import { issue_state_cli } from '#scripts/issue/issue-state-cli'
 import { run_carry, type RunCarry } from '#scripts/run/run-carry'
 import type { RunEvent } from '#scripts/run/run-event-stream'
@@ -94,6 +94,7 @@ async function reconcile(
 	for (const issue of completed) {
 		const outcome = parked.has(issue) ? 'parked' : 'merged'
 
+		// eslint-disable-next-line no-await-in-loop -- each mark rewrites the same carry file
 		await mark_done(String(issue), { outcome, code: 0, token: 'none' }, owner)
 	}
 }

package/scripts/backlog/backlog-drive.ts

@@ -16,6 +16,9 @@
 // **Everything it touches is a port**, the pattern `run-wake-loop.ts` set, so the sequencing is pinned
 // without a process, a network or a clock.
 
+import type { LaunchOutcome } from '#scripts/lane/lane-launch-cli'
+import type { MergeResult } from '#scripts/run/run-merge-cli'
+
 const RUN_VERDICT = 'run'
 const STOP_VERDICT = 'stop'
 // The `run:merge` tokens that end the loop at once: a hand-off, a person's stop, the environment down,
@@ -32,6 +35,7 @@ const IMMEDIATE_TOKENS: ReadonlySet<string> = new Set([
 // and the children still in flight are collected before the loop ends (joshuafolkken/kit#2881).
 const HANDOFF_TOKENS: ReadonlySet<string> = new Set([...IMMEDIATE_TOKENS, STOP_VERDICT])
 const RESUMED_TOKEN = 'resumed'
+const MERGED_OUTCOME = 'merged'
 const WATCH_VERDICT = 'watch'
 // The verdicts the loop acts on without the parent. Any other is handed back as it was printed.
 const KNOWN_VERDICTS: ReadonlySet<string> = new Set([
@@ -41,6 +45,9 @@ const KNOWN_VERDICTS: ReadonlySet<string> = new Set([
 	'wait',
 ])
 const NO_RETRIES = 0
+const NO_FREE_LANES = 0
+const LAUNCHED = 'launched'
+const UNOPENED = 'unopened'
 
 interface OfferRead {
 	verdict: string
@@ -57,7 +64,9 @@ interface OfferRead {
 interface DriveState {
 	// The children this run has in flight — seeded from the open lanes, so a restarted loop resumes them.
 	in_flight: Array<string>
-	// Every child collected, fed back to `backlog:offer` because GitHub closes a merged issue late.
+	// Every child merged, fed back to `backlog:offer` because GitHub closes a merged issue late. A parked
+	// child is left out: its labels classify it, so one a person released is offered again
+	// (joshuafolkken/kit#3041).
 	exclude: Array<string>
 	// When the run last did something, handed to `backlog:budget` as `--active`.
 	active: string
@@ -80,14 +89,20 @@ interface DriveEnd {
 	is_finish?: boolean | undefined
 }
 
+type Collected = Pick<MergeResult, 'token' | 'outcome'>
+
 interface DrivePorts {
 	// Whether a child's process has confirmed-ended — `lane:await`'s re-confirmed check in production.
 	is_finished: (issue: string) => boolean
-	// `run:merge <N>`'s first stdout token.
-	merge: (issue: string) => Promise<string>
+	// `run:merge <N>`'s first stdout token and the outcome it handled the child as.
+	merge: (issue: string) => Promise<Collected>
 	// `backlog:offer`'s answer for the state, or `undefined` when it exited non-zero.
 	offer: (state: DriveState) => Promise<OfferRead | undefined>
-	launch: (issue: string) => Promise<boolean>
+	// Where `lane:launch`'s chain ended — `launched`, `unopened` (no lane taken) or `failed` (one taken).
+	launch: (issue: string) => Promise<LaunchOutcome['kind']>
+	// The lanes free right now — `backlog_ready.drive_free_lane_count` in production, the limit less the
+	// open lanes.
+	free_lanes: () => Promise<number>
 	now: () => Date
 }
 
@@ -150,29 +165,40 @@ function merge_stopped(issue: string, state: DriveState): DriveState {
 	}
 }
 
-// The child collected and excluded, and — unless its cut was resumed in place — out of flight.
+// Only a merged child is excluded: `backlog:next` may still read it OPEN. Any other is classified by
+// its labels, so excluding it would hide a child a person released for the rest of the process.
+function excluded(issue: string, outcome: Collected['outcome'], state: DriveState): Array<string> {
+	if (outcome !== MERGED_OUTCOME || state.exclude.includes(issue)) return state.exclude
+
+	return [...state.exclude, issue]
+}
+
+// The child collected, and — unless its cut was resumed in place — out of flight.
 function collected_state(
 	issue: string,
-	token: string,
+	collected: Collected,
 	state: DriveState,
 	active: string,
 ): DriveState {
 	const in_flight =
-		token === RESUMED_TOKEN ? state.in_flight : state.in_flight.filter((item) => item !== issue)
-	const exclude = state.exclude.includes(issue) ? state.exclude : [...state.exclude, issue]
+		collected.token === RESUMED_TOKEN
+			? state.in_flight
+			: state.in_flight.filter((item) => item !== issue)
+	const exclude = excluded(issue, collected.outcome, state)
 
 	return { ...state, in_flight, exclude, active }
 }
 
 // One finished child: handed back on an immediate token, otherwise collected.
 async function collect(issue: string, state: DriveState, ports: DrivePorts): Promise<PassResult> {
-	const token = await ports.merge(issue)
+	const collected = await ports.merge(issue)
+	const { token } = collected
 
 	// An empty first line is a `run:merge` that failed before printing one: never read as a collection.
 	if (token === '') return ended('merge', state, undefined, issue)
 	if (IMMEDIATE_TOKENS.has(token)) return ended('merge', state, token, issue)
 
-	const next = collected_state(issue, token, state, ports.now().toISOString())
+	const next = collected_state(issue, collected, state, ports.now().toISOString())
 
 	return { kind: 'continue', state: token === STOP_VERDICT ? merge_stopped(issue, next) : next }
 }
@@ -182,6 +208,7 @@ async function collect_finished(state: DriveState, ports: DrivePorts): Promise<P
 	let current = state
 
 	for (const issue of finished) {
+		// eslint-disable-next-line no-await-in-loop -- each collect starts from the state the previous one returned
 		const result = await collect(issue, current, ports)
 
 		if (result.kind === 'end') return { ...result, state: current }
@@ -192,22 +219,55 @@ async function collect_finished(state: DriveState, ports: DrivePorts): Promise<P
 	return { kind: 'continue', state: current }
 }
 
+// A `lane:open` refused with every lane taken is a wait, not a judgement (joshuafolkken/kit#3027): the
+// next offer after a lane frees retries it. A step failing after the lane opened is always handed back —
+// that lane holds the last seat itself, so the free count would read the failure as a full pool.
+async function refused(
+	issue: string,
+	outcome: LaunchOutcome['kind'],
+	state: DriveState,
+	ports: DrivePorts,
+): Promise<PassResult> {
+	if (outcome !== UNOPENED) return ended('launch', state, undefined, issue)
+	if ((await ports.free_lanes()) <= NO_FREE_LANES) return { kind: 'continue', state }
+
+	return ended('launch', state, undefined, issue)
+}
+
+// **No more launches than free lanes** (joshuafolkken/kit#3027). `backlog:offer` lists every ready issue
+// without reading the lanes, so launching all of them overran `JOSH_LANE_LIMIT` until `lane:open` ran
+// out of seats. The free count is read once, before the first launch, because every launch here opens
+// a lane the count would otherwise have to be told about.
+//
+// **Only a launch is activity** (joshuafolkken/kit#3027): a pass that started nothing — every lane taken
+// — keeps `active` where it was, or the once-a-minute offer would restart the idle budget for good.
+function launched(state: DriveState, in_flight: Array<string>, ports: DrivePorts): DriveState {
+	if (in_flight.length === state.in_flight.length) return { ...state, in_flight }
+
+	return { ...state, in_flight, active: ports.now().toISOString() }
+}
+
 async function launch_all(
 	issues: ReadonlyArray<string>,
 	state: DriveState,
 	ports: DrivePorts,
 ): Promise<PassResult> {
 	const in_flight = [...state.in_flight]
+	const free = await ports.free_lanes()
 
-	for (const issue of issues) {
-		const is_launched = await ports.launch(issue)
+	for (const issue of issues.slice(0, free)) {
+		// eslint-disable-next-line no-await-in-loop -- lanes launch in order and the first refusal ends the pass
+		const outcome = await ports.launch(issue)
 
-		if (!is_launched) return ended('launch', { ...state, in_flight }, undefined, issue)
+		if (outcome !== LAUNCHED) {
+			// eslint-disable-next-line no-await-in-loop -- lanes launch in order and the first refusal ends the pass
+			return await refused(issue, outcome, launched(state, in_flight, ports), ports)
+		}
 
 		in_flight.push(issue)
 	}
 
-	return { kind: 'continue', state: { ...state, in_flight, active: ports.now().toISOString() } }
+	return { kind: 'continue', state: launched(state, in_flight, ports) }
 }
 
 // A watch with nothing in flight is the drain: `run:step` owes the retrospective there, so it is the
@@ -337,7 +397,9 @@ async function run_loop(
 	let step = await loop_step(first, config, ports)
 
 	while (step.kind === 'next') {
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		await ports.sleep(config.poll_ms)
+		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
 		step = await loop_step(step.run, config, ports)
 	}
 
@@ -348,10 +410,8 @@ async function run_loop(
 
 const backlog_drive = {
 	HANDOFF_TOKENS,
-	collect,
 	initial_state,
 	merge_stopped,
-	on_verdict,
 	run_loop,
 	run_pass,
 }

package/scripts/backlog/backlog-named.ts

@@ -141,9 +141,6 @@ function epic_item_outcome(
 }
 
 const backlog_named = {
-	BACKLOG_KIND,
-	END_KIND,
-	NAMED_KIND,
 	NOTHING_TO_RUN,
 	after_failure,
 	epic_item_outcome,