@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/dist/josh.js

@@ -20,6 +20,10 @@ function read_spawn_stderr(result) {
   return result.stderr ?? "";
 }
 
+// scripts/lib/timeouts.ts
+var PROBE_TIMEOUT_MS = 2e3;
+var GIT_TIMEOUT_MS = 1e4;
+
 // scripts/git/git-spawn-sync.ts
 import { execaSync } from "execa";
 
@@ -28,17 +32,13 @@ import { platform } from "node:os";
 var GIT_COMMAND_UNIX = "/usr/bin/git";
 var GIT_BINARY_KEY = "JOSH_GIT_BINARY";
 function get_git_command() {
-  if (platform() === "win32") {
-    return String.raw`"C:\Program Files\Git\cmd\git.exe"`;
-  }
+  if (platform() === "win32") return String.raw`"C:\Program Files\Git\cmd\git.exe"`;
   return GIT_COMMAND_UNIX;
 }
 function get_git_command_for_spawn() {
   const binary = process.env[GIT_BINARY_KEY];
   if (binary !== void 0 && binary !== "") return binary;
-  if (platform() === "win32") {
-    return String.raw`C:\Program Files\Git\cmd\git.exe`;
-  }
+  if (platform() === "win32") return String.raw`C:\Program Files\Git\cmd\git.exe`;
   return GIT_COMMAND_UNIX;
 }
 var git_utilities = {
@@ -47,7 +47,6 @@ var git_utilities = {
 };
 
 // scripts/git/git-spawn-sync.ts
-var GIT_TIMEOUT_MS = 1e4;
 var SUCCESS_EXIT_CODE = 0;
 var C_LOCALE = { LC_ALL: "C", LANGUAGE: "C" };
 function run(args, options = {}) {
@@ -94,20 +93,20 @@ var ABSENT_CODE = "ENOENT";
 function is_absent(error) {
   return error instanceof Error && "code" in error && error.code === ABSENT_CODE;
 }
-function read_optional(path5) {
+function read_optional(path12) {
   try {
-    return readFileSync(path5, "utf8");
+    return readFileSync(path12, "utf8");
   } catch (error) {
     if (is_absent(error)) return void 0;
     throw error;
   }
 }
-function read_file_or_empty(path5) {
-  return read_optional(path5) ?? "";
+function read_file_or_empty(path12) {
+  return read_optional(path12) ?? "";
 }
-function read_if_readable(path5) {
+function read_if_readable(path12) {
   try {
-    return readFileSync(path5, "utf8");
+    return readFileSync(path12, "utf8");
   } catch {
     return void 0;
   }
@@ -125,7 +124,6 @@ var CLAUDE_MD = "CLAUDE.md";
 var PLUGIN_ID = "kit@kit";
 var CLAUDE_MD_POINTER = `@${NODE_MODULES}/${KIT_PACKAGE_NAME}/dist/${CLAUDE_MD}`;
 var SECRETLINT_BIN = path.join(NODE_MODULES, ".bin", "secretlint");
-var GIT_TIMEOUT_MS2 = 2e3;
 var manifest_schema = z.object({
   name: z.string().optional(),
   dependencies: z.record(z.string(), z.string()).optional(),
@@ -160,7 +158,7 @@ function is_plugin_declared(root) {
 }
 function configured_hooks_path(root) {
   const value = git_spawn_sync.read(["-C", root, "config", "--get", "core.hooksPath"], {
-    timeout: GIT_TIMEOUT_MS2
+    timeout: PROBE_TIMEOUT_MS
   });
   return value === "" ? void 0 : value;
 }
@@ -232,14 +230,31 @@ var doctor_consumer = {
 };
 
 // scripts/josh/josh-logic.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import path4 from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
+import path11 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // scripts/build/local-bin.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { createRequire } from "node:module";
+import path3 from "node:path";
+
+// scripts/lib/ancestor-directories.ts
 import path2 from "node:path";
+var MAX_DEPTH = 64;
+function list(start_directory) {
+  const directories = [];
+  let current = path2.resolve(start_directory);
+  while (directories.length < MAX_DEPTH && !directories.includes(current)) {
+    directories.push(current);
+    current = path2.dirname(current);
+  }
+  return directories;
+}
+function nearest(start_directory, is_match) {
+  return list(start_directory).find((directory) => is_match(directory));
+}
+var ancestor_directories = { list, nearest };
 
 // scripts/lib/schemas.ts
 import { z as z2 } from "zod";
@@ -281,26 +296,767 @@ var WINDOWS_SHIM_SUFFIX = ".cmd";
 var PACKAGE_JSON = "package.json";
 function resolve_local_bin(project_root, bin_name) {
   const shim = process.platform === WINDOWS_PLATFORM ? `${bin_name}${WINDOWS_SHIM_SUFFIX}` : bin_name;
-  return path2.join(project_root, NODE_MODULES2, BIN_DIR, shim);
+  return path3.join(project_root, NODE_MODULES2, BIN_DIR, shim);
 }
 function read_bin_entry(manifest_path, package_name, bin_name) {
   const { bin } = package_bin_schema.parse(JSON.parse(readFileSync2(manifest_path, "utf8")));
-  if (typeof bin === "string") return bin_name === path2.basename(package_name) ? bin : void 0;
+  if (typeof bin === "string") return bin_name === path3.basename(package_name) ? bin : void 0;
   return bin?.[bin_name];
 }
 function resolve_package_bin(base_directory, package_name, bin_name) {
   try {
-    const resolve_from = createRequire(path2.join(base_directory, PACKAGE_JSON));
+    const resolve_from = createRequire(path3.join(base_directory, PACKAGE_JSON));
     const manifest_path = resolve_from.resolve(`${package_name}/${PACKAGE_JSON}`);
     const bin_entry = read_bin_entry(manifest_path, package_name, bin_name);
     if (bin_entry === void 0) return void 0;
-    const cli_entry = path2.join(path2.dirname(manifest_path), bin_entry);
+    const cli_entry = path3.join(path3.dirname(manifest_path), bin_entry);
     return existsSync2(cli_entry) ? cli_entry : void 0;
   } catch {
     return void 0;
   }
 }
 
+// scripts/gate/core-budget.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { readdirSync as readdirSync2 } from "node:fs";
+import { availableParallelism as availableParallelism3 } from "node:os";
+import path8 from "node:path";
+
+// scripts/josh/platform-temporary.ts
+import { accessSync, constants } from "node:fs";
+import { tmpdir } from "node:os";
+var POSIX_TEMP_ROOT = "/tmp";
+var WINDOWS_PLATFORM2 = "win32";
+function is_writable_directory(directory) {
+  try {
+    accessSync(directory, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolve_temporary_root(platform2, can_write = is_writable_directory) {
+  if (platform2 === WINDOWS_PLATFORM2) return tmpdir();
+  return can_write(POSIX_TEMP_ROOT) ? POSIX_TEMP_ROOT : tmpdir();
+}
+var TEMP_ROOT_KEY = "JOSH_TEMP_ROOT";
+function temporary_root(override, platform2) {
+  return override === void 0 || override === "" ? resolve_temporary_root(platform2) : override;
+}
+var PLATFORM_TEMP_ROOT = temporary_root(process.env[TEMP_ROOT_KEY], process.platform);
+
+// scripts/josh/process-identity.ts
+import { execFileSync, spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { readFileSync as readFileSync3, rmSync } from "node:fs";
+import { createServer } from "node:net";
+import path4 from "node:path";
+var PS_COMMAND = "/bin/ps";
+var FORMAT_FLAG = "-o";
+var START_TIME_FORMAT = "lstart=";
+var PID_FLAG = "-p";
+var PROBE_ENVIRONMENT = { TZ: "UTC", LC_ALL: "C" };
+var LIVENESS_SIGNAL = 0;
+var LOWEST_REAL_PID = 1;
+var PROC_START_FIELD_INDEX = 19;
+var BEACON_SCHEME = "socket:";
+var BEACON_SUFFIX = ".sock";
+var BEACON_PREFIX = `josh-process-identity-${String(process.getuid?.() ?? "")}-`;
+var BEACON_ID_LENGTH = 36;
+var BEACON_ID_PATTERN = /^[\da-f-]+$/u;
+var WINDOWS_PLATFORM3 = "win32";
+var SOCKET_PROBE_SOURCE = "const net=require('node:net');const socket=net.createConnection(process.argv[1]);socket.once('connect',()=>process.exit(0));socket.once('error',()=>process.exit(1));socket.setTimeout(1000,()=>process.exit(1));";
+var beacons = /* @__PURE__ */ new Map();
+var exit_cleanup = { is_registered: false };
+function is_live_pid(pid) {
+  if (pid < LOWEST_REAL_PID) return false;
+  try {
+    process.kill(pid, LIVENESS_SIGNAL);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function read_proc_start(pid) {
+  try {
+    const stat = readFileSync3(`/proc/${String(pid)}/stat`, "utf8");
+    const fields = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\s+/u);
+    const start = fields[PROC_START_FIELD_INDEX];
+    return start === void 0 ? void 0 : `proc:${start}`;
+  } catch {
+    return void 0;
+  }
+}
+function read_ps_start(pid) {
+  try {
+    const printed = execFileSync(
+      PS_COMMAND,
+      [FORMAT_FLAG, START_TIME_FORMAT, PID_FLAG, String(pid)],
+      {
+        encoding: "utf8",
+        timeout: PROBE_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "ignore"],
+        env: PROBE_ENVIRONMENT
+      }
+    ).trim();
+    return printed.length > 0 ? printed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var START_PROBES = { read_proc_start, read_ps_start };
+function safe_probe(probe, pid) {
+  try {
+    return probe(pid);
+  } catch {
+    return void 0;
+  }
+}
+function read_start(pid, probes = START_PROBES) {
+  return safe_probe(probes.read_proc_start, pid) ?? safe_probe(probes.read_ps_start, pid);
+}
+function close_beacon(token) {
+  const server = beacons.get(token);
+  if (server === void 0) return;
+  beacons.delete(token);
+  server.close();
+  rmSync(token.slice(BEACON_SCHEME.length), { force: true });
+}
+function close_beacons() {
+  for (const token of beacons.keys()) close_beacon(token);
+}
+function ensure_exit_cleanup() {
+  if (exit_cleanup.is_registered) return;
+  exit_cleanup.is_registered = true;
+  process.once("exit", close_beacons);
+}
+function ignore_beacon_error() {
+}
+function bind_beacon(target) {
+  return createServer().on("error", ignore_beacon_error).listen(target);
+}
+function try_bind_beacon(bind, target) {
+  try {
+    const server = bind(target);
+    return server.listening ? server : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function open_beacon(bind = bind_beacon) {
+  const target = path4.join(PLATFORM_TEMP_ROOT, `${BEACON_PREFIX}${randomUUID()}${BEACON_SUFFIX}`);
+  const token = `${BEACON_SCHEME}${target}`;
+  const server = try_bind_beacon(bind, target);
+  if (server === void 0) return void 0;
+  server.unref();
+  beacons.set(token, server);
+  ensure_exit_cleanup();
+  return token;
+}
+function resolve_own_start(probes = START_PROBES, platform2 = process.platform) {
+  const start = read_start(process.pid, probes);
+  if (start !== void 0 || platform2 === WINDOWS_PLATFORM3) return start;
+  return open_beacon();
+}
+function is_valid_beacon_name(name) {
+  if (!name.startsWith(BEACON_PREFIX) || !name.endsWith(BEACON_SUFFIX)) return false;
+  const id = name.slice(BEACON_PREFIX.length, -BEACON_SUFFIX.length);
+  return id.length === BEACON_ID_LENGTH && BEACON_ID_PATTERN.test(id);
+}
+function beacon_target(token) {
+  if (!token.startsWith(BEACON_SCHEME)) return void 0;
+  const target = token.slice(BEACON_SCHEME.length);
+  if (path4.dirname(target) !== PLATFORM_TEMP_ROOT) return void 0;
+  return is_valid_beacon_name(path4.basename(target)) ? target : void 0;
+}
+function is_live_beacon(target) {
+  return spawnSync(process.execPath, ["-e", SOCKET_PROBE_SOURCE, target], {
+    stdio: "ignore",
+    timeout: PROBE_TIMEOUT_MS
+  }).status === 0;
+}
+function has_matching_start(pid, recorded_start, read2) {
+  const observed = read2(pid);
+  return observed === void 0 ? void 0 : observed === recorded_start;
+}
+function matches_recorded_start(pid, recorded_start, read2) {
+  const target = beacon_target(recorded_start);
+  return target === void 0 ? has_matching_start(pid, recorded_start, read2) : is_live_beacon(target);
+}
+var own_probe = /* @__PURE__ */ new Map();
+function own_start() {
+  if (!own_probe.has(process.pid)) own_probe.set(process.pid, resolve_own_start());
+  return own_probe.get(process.pid);
+}
+function own_fields() {
+  const start = own_start();
+  return { pid: process.pid, ...start !== void 0 && { process_start: start } };
+}
+function is_same_process(pid, recorded_start, read2 = read_start) {
+  if (pid === void 0 || !is_live_pid(pid)) return false;
+  if (recorded_start === void 0) return void 0;
+  return matches_recorded_start(pid, recorded_start, read2);
+}
+function is_own_process(pid, recorded_start) {
+  return pid === process.pid && recorded_start === own_start();
+}
+var process_identity = {
+  close_beacon,
+  is_live_pid,
+  is_own_process,
+  is_same_process,
+  open_beacon,
+  own_fields,
+  own_start,
+  read_start,
+  resolve_own_start
+};
+
+// scripts/josh/process-owner.ts
+import { z as z3 } from "zod";
+var process_owner_schema = z3.object({ pid: z3.number(), process_start: z3.string().optional() });
+
+// scripts/josh/stamp-file.ts
+import { createHash, randomUUID as randomUUID2 } from "node:crypto";
+import { lstatSync, readFileSync as readFileSync4, renameSync, rmSync as rmSync2, writeFileSync } from "node:fs";
+import path6 from "node:path";
+
+// scripts/init/init-paths.ts
+import path5 from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_DIR = path5.join(path5.dirname(fileURLToPath(import.meta.url)), "..", "..");
+var PROJECT_ROOT = process.cwd();
+
+// scripts/josh/stamp-file.ts
+var HASH_ALGORITHM = "sha256";
+var STAMP_SUFFIX = ".json";
+var STAMP_KEY_LENGTH = 16;
+var STAMP_FILE_MODE = 384;
+var STAMP_WRITE_FLAG = "wx";
+var STAMP_CREATE_FLAG = STAMP_WRITE_FLAG;
+var EXISTS_ERROR_CODE = "EEXIST";
+var ACCOUNT_KEY_SEPARATOR = ":";
+function digest(content) {
+  return createHash(HASH_ALGORITHM).update(content).digest("hex");
+}
+function account_key() {
+  return String(process.getuid?.() ?? "");
+}
+function stamp_path(prefix, root = PACKAGE_DIR, suffix = STAMP_SUFFIX) {
+  const key = digest(`${account_key()}${ACCOUNT_KEY_SEPARATOR}${root}`).slice(0, STAMP_KEY_LENGTH);
+  return path6.join(PLATFORM_TEMP_ROOT, `${prefix}${key}${suffix}`);
+}
+function write_exclusively(target, content) {
+  rmSync2(target, { force: true });
+  writeFileSync(target, content, { flag: STAMP_WRITE_FLAG, mode: STAMP_FILE_MODE });
+  return target;
+}
+function write_stamp(target, payload) {
+  return write_exclusively(target, JSON.stringify(payload));
+}
+function replace_stamp(target, payload) {
+  const temporary = `${target}.${String(process.pid)}.${randomUUID2()}`;
+  try {
+    writeFileSync(temporary, JSON.stringify(payload), {
+      flag: STAMP_CREATE_FLAG,
+      mode: STAMP_FILE_MODE
+    });
+    renameSync(temporary, target);
+    return target;
+  } finally {
+    rmSync2(temporary, { force: true });
+  }
+}
+function write_text_stamp(target, text) {
+  return write_exclusively(target, text);
+}
+function create_stamp(target, payload) {
+  try {
+    writeFileSync(target, JSON.stringify(payload), {
+      flag: STAMP_CREATE_FLAG,
+      mode: STAMP_FILE_MODE
+    });
+    return true;
+  } catch (error) {
+    if (error.code === EXISTS_ERROR_CODE) return false;
+    throw error;
+  }
+}
+function remove_stamp(target) {
+  rmSync2(target, { force: true });
+}
+function is_own_regular_file(source) {
+  const stats = lstatSync(source);
+  if (!stats.isFile()) return false;
+  const uid = process.getuid?.();
+  return uid === void 0 || stats.uid === uid;
+}
+function read_stamp_text(source) {
+  try {
+    if (!is_own_regular_file(source)) return void 0;
+    return readFileSync4(source, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+var stamp_file = {
+  create_stamp,
+  digest,
+  is_own_regular_file,
+  read_stamp_text,
+  replace_stamp,
+  remove_stamp,
+  stamp_path,
+  write_stamp,
+  write_text_stamp
+};
+
+// scripts/test/unit-worker-share.ts
+import { readdirSync } from "node:fs";
+import { availableParallelism } from "node:os";
+import path7 from "node:path";
+var RUN_PREFIX = "josh-unit-running-";
+var WORKER_FLAG = "--maxWorkers";
+var WORKER_FLAGS = [WORKER_FLAG, "--max-workers"];
+var MIN_WORKERS = 1;
+var SOLO_RUNS = 1;
+function marker_path(pid = process.pid) {
+  return stamp_file.stamp_path(RUN_PREFIX, String(pid));
+}
+function is_running(marker) {
+  return process_identity.is_same_process(marker.pid, marker.process_start) !== false;
+}
+function read_marker(source) {
+  const raw = stamp_file.read_stamp_text(source);
+  if (raw === void 0) return void 0;
+  const parsed = process_owner_schema.safeParse(json_value.parse_or_undefined(raw));
+  return parsed.success ? parsed.data : void 0;
+}
+function marker_files(directory = PLATFORM_TEMP_ROOT) {
+  try {
+    return readdirSync(directory).filter((name) => name.startsWith(RUN_PREFIX));
+  } catch {
+    return [];
+  }
+}
+function sweep_marker(source) {
+  try {
+    stamp_file.remove_stamp(source);
+  } catch {
+  }
+}
+function is_marker_live(source) {
+  const marker = read_marker(source);
+  if (marker === void 0) return false;
+  if (is_running(marker)) return true;
+  sweep_marker(source);
+  return false;
+}
+function live_run_count(directory = PLATFORM_TEMP_ROOT) {
+  return marker_files(directory).filter((name) => is_marker_live(path7.join(directory, name))).length;
+}
+var NESTED_KEY = "JOSH_UNIT_RUN_MARKED";
+var NESTED_VALUE = "1";
+function is_nested_run() {
+  return process.env[NESTED_KEY] === NESTED_VALUE;
+}
+function resolve_unit_workers(available_cores, runs) {
+  if (runs <= SOLO_RUNS) return void 0;
+  return Math.max(MIN_WORKERS, Math.floor(available_cores / runs));
+}
+function current_share(available_cores = availableParallelism(), live_runs = live_run_count()) {
+  const own_run = is_nested_run() ? 0 : SOLO_RUNS;
+  return resolve_unit_workers(available_cores, live_runs + own_run);
+}
+function is_worker_flag(argument) {
+  return WORKER_FLAGS.some((flag) => argument === flag || argument.startsWith(`${flag}=`));
+}
+function worker_arguments(vitest_arguments, share) {
+  if (share === void 0) return [];
+  if (vitest_arguments.some((argument) => is_worker_flag(argument))) return [];
+  return [`${WORKER_FLAG}=${String(share)}`];
+}
+function mark_run_started(target) {
+  try {
+    stamp_file.write_stamp(target, process_identity.own_fields());
+  } catch {
+  }
+}
+async function with_run_marker(run2) {
+  if (is_nested_run()) return await run2();
+  const target = marker_path();
+  mark_run_started(target);
+  process.env[NESTED_KEY] = NESTED_VALUE;
+  try {
+    return await run2();
+  } finally {
+    process.env[NESTED_KEY] = "";
+    stamp_file.remove_stamp(target);
+  }
+}
+var unit_worker_share = {
+  MIN_WORKERS,
+  NESTED_KEY,
+  NESTED_VALUE,
+  RUN_PREFIX,
+  SOLO_RUNS,
+  current_share,
+  is_nested_run,
+  live_run_count,
+  marker_path,
+  read_marker,
+  resolve_unit_workers,
+  with_run_marker,
+  worker_arguments
+};
+
+// scripts/gate/core-budget.ts
+import { z as z4 } from "zod";
+
+// scripts/gate/core-admission.ts
+var MS_PER_SECOND = 1e3;
+var RAMP_UP_MS = 3e4;
+function compare_claim(left, right) {
+  const by_time = left.reservation.claimed_at - right.reservation.claimed_at;
+  return by_time === 0 ? left.key.localeCompare(right.key) : by_time;
+}
+function add_load(totals, reservation) {
+  totals.cores += reservation.weight;
+  totals.memory_mb += reservation.memory_mb ?? 0;
+}
+function exceeds(totals, budget) {
+  return totals.cores > budget.cores || totals.memory_mb > budget.memory_mb;
+}
+function admitted_keys(reservations, budget, memory_budget = Infinity) {
+  const limit = { cores: budget, memory_mb: memory_budget };
+  const totals = { cores: 0, memory_mb: 0 };
+  const admitted = /* @__PURE__ */ new Set();
+  for (const [index, entry] of reservations.toSorted(compare_claim).entries()) {
+    add_load(totals, entry.reservation);
+    if (index !== 0 && exceeds(totals, limit)) break;
+    admitted.add(entry.key);
+  }
+  return admitted;
+}
+function is_admitted(key, reservations, budget) {
+  return admitted_keys(reservations, budget.cores, budget.memory_mb).has(key);
+}
+function sum_load(reservations) {
+  const load = { cores: 0, memory_mb: 0 };
+  for (const entry of reservations) add_load(load, entry.reservation);
+  return load;
+}
+function is_ramped(reservation, now) {
+  const { admitted_at } = reservation;
+  return admitted_at !== void 0 && now - admitted_at >= RAMP_UP_MS;
+}
+function ledger_load(reservations, now) {
+  const admitted = reservations.filter((entry) => entry.reservation.admitted_at !== void 0);
+  const ramped = admitted.filter((entry) => is_ramped(entry.reservation, now));
+  return { cores: sum_load(admitted).cores, memory_mb: sum_load(ramped).memory_mb };
+}
+function total_weight(reservations) {
+  return sum_load(reservations).cores;
+}
+function admitted_load(reservations, budget) {
+  const admitted = admitted_keys(reservations, budget);
+  return total_weight(reservations.filter((entry) => admitted.has(entry.key)));
+}
+function describe_memory(ledger, budget) {
+  if (!Number.isFinite(budget.memory_mb)) return "";
+  return ` and ${String(Math.round(ledger.memory_mb))} MB of memory against ${String(Math.round(budget.memory_mb))} MB`;
+}
+function describe_overflow(admission) {
+  const { overflow } = admission;
+  if (overflow === void 0) return void 0;
+  const { ledger, budget } = overflow;
+  const waited = String(Math.round(overflow.waited_ms / MS_PER_SECOND));
+  const cores = `the ledger held ${String(ledger.cores)} cores against a budget of ${String(budget.cores)}`;
+  return `started past the core budget after ${waited}s \u2014 ${cores}${describe_memory(ledger, budget)}`;
+}
+var core_admission = {
+  RAMP_UP_MS,
+  admitted_keys,
+  admitted_load,
+  describe_overflow,
+  is_admitted,
+  ledger_load,
+  sum_load
+};
+
+// scripts/gate/machine-capacity.ts
+import { readFile } from "node:fs/promises";
+import { availableParallelism as availableParallelism2, cpus, totalmem } from "node:os";
+import { execa } from "execa";
+var SAMPLE_WINDOW_MS = 250;
+var BASELINE_CORES = 2;
+var BYTES_PER_MB = 1048576;
+var KB_PER_MB = 1024;
+var PERCENT = 100;
+var MEMINFO_PATH = "/proc/meminfo";
+var LINUX_AVAILABLE = /^MemAvailable:\s+(?<kb>\d+) kB/mu;
+var PRESSURE_ARGUMENTS = ["-n", "kern.memorystatus_level"];
+var PRESSURE_LEVEL = /^\s*(?<level>\d+)\s*$/u;
+function cpu_times() {
+  let busy = 0;
+  let idle = 0;
+  for (const { times } of cpus()) {
+    busy += times.user + times.nice + times.sys + times.irq;
+    idle += times.idle;
+  }
+  return { busy, total: busy + idle };
+}
+function busy_cores_between(before, after, cores) {
+  const total = after.total - before.total;
+  if (total <= 0) return void 0;
+  return (after.busy - before.busy) / total * cores;
+}
+function parse_darwin_pressure(output, total_bytes) {
+  const level = PRESSURE_LEVEL.exec(output)?.groups?.["level"];
+  if (level === void 0) return void 0;
+  return Number(level) / PERCENT * (total_bytes / BYTES_PER_MB);
+}
+function parse_linux_available(meminfo) {
+  const kb = LINUX_AVAILABLE.exec(meminfo)?.groups?.["kb"];
+  return kb === void 0 ? void 0 : Number(kb) / KB_PER_MB;
+}
+async function read_available_mb(platform2 = process.platform) {
+  try {
+    if (platform2 === "darwin") {
+      const { stdout } = await execa("sysctl", PRESSURE_ARGUMENTS);
+      return parse_darwin_pressure(stdout, totalmem());
+    }
+    return platform2 === "linux" ? parse_linux_available(await readFile(MEMINFO_PATH, "utf8")) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function is_unquoted() {
+  return cpus().length > 0 && cpus().length === availableParallelism2();
+}
+async function default_sleep(ms) {
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function read_machine(sleep = default_sleep) {
+  const before = cpu_times();
+  const [available_mb] = await Promise.all([read_available_mb(), sleep(SAMPLE_WINDOW_MS)]);
+  const busy_cores = is_unquoted() ? busy_cores_between(before, cpu_times(), cpus().length) : void 0;
+  return { busy_cores, available_mb };
+}
+function external_cores(busy_cores, ledger_cores) {
+  if (busy_cores === void 0) return 0;
+  return Math.floor(Math.max(0, busy_cores - ledger_cores - BASELINE_CORES));
+}
+function machine_budget(cores, reading, ledger) {
+  return {
+    cores: cores - external_cores(reading.busy_cores, ledger.cores),
+    memory_mb: reading.available_mb === void 0 ? Infinity : reading.available_mb + ledger.memory_mb
+  };
+}
+var machine_capacity = {
+  BASELINE_CORES,
+  busy_cores_between,
+  machine_budget,
+  parse_darwin_pressure,
+  parse_linux_available,
+  read_machine
+};
+
+// scripts/gate/core-budget.ts
+var RESERVED_PREFIX = "josh-core-reserved-";
+var RESERVED_SUFFIX = ".json";
+var POLL_INTERVAL_MS = 50;
+var WAIT_CAP_MS = 12e4;
+var MIN_BUDGET = 1;
+var CORE_WEIGHTS = {
+  lint: 2,
+  type_check: 1,
+  spell_check: 1,
+  eslint_scan: 1
+};
+var MEMORY_MB = {
+  lint: 2400,
+  type_check: 1300,
+  spell_check: 350,
+  eslint_scan: 2400,
+  unit_worker: 350
+};
+var HELD_KEY = "JOSH_CORE_RESERVED";
+var HELD_VALUE = "1";
+var reservation_schema = process_owner_schema.extend({
+  weight: z4.number(),
+  claimed_at: z4.number(),
+  memory_mb: z4.number().optional(),
+  admitted_at: z4.number().optional()
+});
+function marker_name(key) {
+  return `${RESERVED_PREFIX}${key}${RESERVED_SUFFIX}`;
+}
+function is_running2(reservation) {
+  return process_identity.is_same_process(reservation.pid, reservation.process_start) !== false;
+}
+function read_reservation(source) {
+  const raw = stamp_file.read_stamp_text(source);
+  if (raw === void 0) return void 0;
+  try {
+    const parsed = reservation_schema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sweep_marker2(source) {
+  try {
+    stamp_file.remove_stamp(source);
+  } catch {
+  }
+}
+function live_reservation(source) {
+  const reservation = read_reservation(source);
+  if (reservation === void 0) return void 0;
+  if (is_running2(reservation)) return reservation;
+  sweep_marker2(source);
+  return void 0;
+}
+function marker_files2(directory) {
+  try {
+    return readdirSync2(directory).filter(
+      (name) => name.startsWith(RESERVED_PREFIX) && name.endsWith(RESERVED_SUFFIX)
+    );
+  } catch {
+    return [];
+  }
+}
+function live_reservations(directory = PLATFORM_TEMP_ROOT) {
+  return marker_files2(directory).flatMap((name) => {
+    const reservation = live_reservation(path8.join(directory, name));
+    return reservation === void 0 ? [] : { key: name, reservation };
+  });
+}
+function normalize_budget(budget) {
+  return Number.isFinite(budget) ? Math.max(MIN_BUDGET, Math.floor(budget)) : MIN_BUDGET;
+}
+async function default_sleep2(ms) {
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function write_reservation(target, fields) {
+  stamp_file.replace_stamp(target, { ...process_identity.own_fields(), ...fields });
+}
+function resolve_timing(options) {
+  return {
+    now: options.now ?? Date.now,
+    sleep: options.sleep ?? default_sleep2,
+    poll_interval_ms: options.poll_interval_ms ?? POLL_INTERVAL_MS,
+    wait_cap_ms: options.wait_cap_ms ?? WAIT_CAP_MS
+  };
+}
+async function current_budget(context, reservations) {
+  if (reservations.length <= 1) return { cores: context.budget, memory_mb: Infinity };
+  const reading = await context.read_machine();
+  const ledger = core_admission.ledger_load(reservations, context.now());
+  const budget = machine_capacity.machine_budget(context.budget, reading, ledger);
+  return { ...budget, cores: normalize_budget(budget.cores) };
+}
+function admit(context, overflow) {
+  write_reservation(context.target, { ...context.fields, admitted_at: context.now() });
+  return { overflow };
+}
+function overflow_of(context, reservations, budget) {
+  return {
+    waited_ms: context.now() - context.fields.claimed_at,
+    ledger: core_admission.sum_load(reservations),
+    budget
+  };
+}
+async function poll_admission(context) {
+  const reservations = live_reservations(context.directory);
+  const budget = await current_budget(context, reservations);
+  if (core_admission.is_admitted(context.key, reservations, budget)) return admit(context);
+  if (context.now() >= context.deadline) {
+    return admit(context, overflow_of(context, reservations, budget));
+  }
+  return void 0;
+}
+async function await_admission(context) {
+  let admission = await poll_admission(context);
+  while (admission === void 0) {
+    await context.sleep(context.poll_interval_ms);
+    admission = await poll_admission(context);
+  }
+  return admission;
+}
+async function reserve(weight, options = {}) {
+  const timing = resolve_timing(options);
+  const directory = options.directory ?? PLATFORM_TEMP_ROOT;
+  const claimed_at = timing.now();
+  const name = marker_name(randomUUID3());
+  const target = path8.join(directory, name);
+  const fields = { weight, claimed_at, memory_mb: options.memory_mb };
+  write_reservation(target, fields);
+  const admission = await await_admission({
+    ...timing,
+    key: name,
+    target,
+    directory,
+    budget: normalize_budget(options.budget ?? availableParallelism3()),
+    deadline: claimed_at + timing.wait_cap_ms,
+    fields,
+    read_machine: options.read_machine ?? machine_capacity.read_machine
+  });
+  return { target, admission };
+}
+function release(handle) {
+  sweep_marker2(handle.target);
+}
+async function with_core_reservation(weight, run2, options = {}) {
+  const handle = await reserve(weight, options);
+  try {
+    return await run2(handle.admission);
+  } finally {
+    release(handle);
+  }
+}
+function is_held() {
+  return process.env[HELD_KEY] === HELD_VALUE;
+}
+function set_held_mark(value) {
+  process.env[HELD_KEY] = value;
+}
+async function with_held_mark(run2) {
+  const previous = process.env[HELD_KEY] ?? "";
+  set_held_mark(HELD_VALUE);
+  try {
+    return await run2();
+  } finally {
+    set_held_mark(previous);
+  }
+}
+async function with_command_reservation(weight, run2, options = {}) {
+  if (is_held() || unit_worker_share.is_nested_run()) return await run2();
+  return await with_core_reservation(weight, async () => await with_held_mark(run2), options);
+}
+var core_budget = {
+  CORE_WEIGHTS,
+  HELD_KEY,
+  HELD_VALUE,
+  MEMORY_MB,
+  RESERVED_PREFIX,
+  admitted_keys: core_admission.admitted_keys,
+  admitted_load: core_admission.admitted_load,
+  describe_overflow: core_admission.describe_overflow,
+  is_held,
+  live_reservations,
+  release,
+  reserve,
+  with_command_reservation,
+  with_core_reservation,
+  with_held_mark
+};
+
 // scripts/josh/josh-logic.ts
 import { execaSync as execaSync2 } from "execa";
 
@@ -410,6 +1166,9 @@ var BACKLOG_COMMANDS = {
   },
   "backlog:stalled": {
     script: "scripts/backlog/backlog-stalled-cli.ts",
+    // A stall sends one Telegram warning (joshuafolkken/kit#3357). The `Stop` hook calls the detector
+    // directly, so this flag costs only the manual command its in-process dispatch.
+    tsx_arguments: OPTIONAL_ENV_FILE_FLAGS,
     description: "Report whether ready backlog work is sitting undispatched with a free lane and no recent dispatch",
     category: "AI tools",
     reference: ["", "automation", ["network"]]
@@ -428,7 +1187,8 @@ var DOCUMENT_COMMANDS = {
     script: "scripts/document/document-section-cli.ts",
     description: 'Print one section of a markdown document, for a `file.md` \u2192 "Heading" reference',
     category: "AI tools",
-    reference: ["<file> <heading>", "automation", ["none"]]
+    reference: ["<file> <heading>", "automation", ["none"]],
+    is_bundled: true
   },
   "read:set": {
     script: "scripts/document/read-set-cli.ts",
@@ -534,10 +1294,16 @@ var ISSUE_COMMANDS = {
     description: "File an Issue with every filing step: lint, Origin, WIP cap, duplicate scout, labels, then epic:bundle",
     category: "AI tools",
     reference: [
-      "<title> --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>] [--distinct <N,\u2026>] [--over-cap] [--no-auto-ok]",
+      "<title> --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>] [--distinct <N,\u2026>] [--over-cap] [--no-auto-ok] [--release]",
       "automation",
       ["network"]
     ]
+  },
+  "issue:release": {
+    script: "scripts/issue/issue-release-cli.ts",
+    description: "Link an Issue to the repository's open release Issue as its blocker, filing one when none is open",
+    category: "AI tools",
+    reference: ["<issue>", "automation", ["network"]]
   }
 };
 
@@ -545,6 +1311,10 @@ var ISSUE_COMMANDS = {
 var LANE_SCRIPT = "scripts/lane/lane-cli.ts";
 var LANE_ARGUMENTS = { script: LANE_SCRIPT, tsx_arguments: OPTIONAL_ENV_FILE_FLAGS };
 var ISSUE_WITH_OPTIONS = "<issue> [options]";
+var MEASURE_ARGUMENTS = {
+  script: "scripts/lane/lane-measure-cli.ts",
+  tsx_arguments: OPTIONAL_ENV_FILE_FLAGS
+};
 var LANE_COMMANDS = {
   "lane:open": {
     ...LANE_ARGUMENTS,
@@ -569,7 +1339,7 @@ var LANE_COMMANDS = {
   },
   "lane:prune": {
     ...LANE_ARGUMENTS,
-    description: "Close every lane an interruption left without its work tree",
+    description: "Close every lane an interruption left without its work tree, then sweep unregistered leftovers under the lanes root",
     category: "AI tools",
     reference: ["", "automation", ["files", "git"]],
     default_script_arguments: ["prune"]
@@ -600,11 +1370,27 @@ var LANE_COMMANDS = {
     description: "Collapse a backlogrun lane-start event into one call: open the lane, pop and re-install on the first, dispatch the child",
     category: "AI tools",
     reference: ["<issue> [--stash <message>]", "automation", ["files", "git", "processes"]]
+  },
+  // The lane-limit measurement (joshuafolkken/kit#3355): `.env` is read so `lane:stats` labels the row
+  // with the `JOSH_LANE_LIMIT` a person set there.
+  "lane:sample": {
+    ...MEASURE_ARGUMENTS,
+    description: "Record the machine load (load average, swap, free memory, working lanes) to the lane ledger",
+    category: "AI tools",
+    reference: ["[--every <seconds>]", "maintainer", ["files"]],
+    default_script_arguments: ["sample"]
+  },
+  "lane:stats": {
+    ...MEASURE_ARGUMENTS,
+    description: "Print one table row of lane throughput, gate duration and machine load over a period",
+    category: "AI tools",
+    reference: ["--period <days> [--limit <lane-limit>]", "maintainer", ["none"]],
+    default_script_arguments: ["stats"]
   }
 };
 
 // scripts/josh/josh-commands-run.ts
-var RUN_HOLD_SCRIPT = "scripts/run/run-hold-cli.ts";
+var RUN_HOLD_SCRIPT = "scripts/run/hold/run-hold-cli.ts";
 var RUN_COMMANDS = {
   "run:hold": {
     script: RUN_HOLD_SCRIPT,
@@ -620,19 +1406,22 @@ var RUN_COMMANDS = {
     default_script_arguments: ["--release"]
   },
   "run:tidy": {
-    script: "scripts/run/run-tidy-cli.ts",
+    script: "scripts/run/tidy/run-tidy-cli.ts",
     description: "Close merged lanes and drop stashes whose issues are all merged",
     category: "AI tools",
     reference: ["", "automation", ["git", "network", "files"]]
   },
   "run:carry": {
-    script: "scripts/run/run-carry-cli.ts",
+    script: "scripts/run/carry/run-carry-cli.ts",
+    // `--stopped` sends the stop confirmation, so the Telegram credentials come from `.env` as for
+    // `run:wake` below (joshuafolkken/kit#3357).
+    tsx_arguments: OPTIONAL_ENV_FILE_FLAGS,
     description: "Carry one invocation\u2019s budget across its own session cuts",
     category: "AI tools",
     reference: ["<operation> [arguments...]", "automation", ["files"]]
   },
   "run:wake": {
-    script: "scripts/run/run-wake-cli.ts",
+    script: "scripts/run/wake/run-wake-cli.ts",
     // `.env` rather than the ambient environment:
     // the failure warning needs the Telegram credentials, the same
     // reasons `notify` and `followup` carry these flags.
@@ -642,7 +1431,7 @@ var RUN_COMMANDS = {
     reference: ["[options]", "automation", ["processes", "notifications"]]
   },
   "run:cut": {
-    script: "scripts/run/run-cut-cli.ts",
+    script: "scripts/run/cut/run-cut-cli.ts",
     description: "Cut a lane child before the gate and resume a fresh process",
     category: "AI tools",
     reference: ["[--resume] <issue> [--impl] [--handoff <path>]", "automation", ["files"]]
@@ -660,7 +1449,7 @@ var RUN_COMMANDS = {
     reference: ["<issue> --output <path> [--repo <owner/repo>]", "automation", ["network"]]
   },
   "run:progress": {
-    script: "scripts/run/run-progress-cli.ts",
+    script: "scripts/run/progress/run-progress-cli.ts",
     description: "Report an unattended run\u2019s progress once it has gone quiet for an interval",
     category: "AI tools",
     reference: [
@@ -679,7 +1468,9 @@ var RUN_COMMANDS = {
   // read the budget, gather the issue reads and decide the pre-implementation step. `run:hold`,
   // `cost --cut`, `run:prep` and `run:step` were four round trips re-billing a lane's full context each.
   "run:entry": {
-    script: "scripts/run/run-entry-cli.ts",
+    script: "scripts/run/entry/run-entry-cli.ts",
+    // A `busy` hold or an `over` budget sends the stop confirmation (joshuafolkken/kit#3357).
+    tsx_arguments: OPTIONAL_ENV_FILE_FLAGS,
     description: "Open a run in one call: claim the tree, read the budget, bundle the reads, decide the pre-implementation step",
     category: "AI tools",
     reference: ["<issue> [--to <command>]", "automation", ["git", "network", "files"]]
@@ -843,13 +1634,13 @@ var AI_COMMANDS = {
     reference: ["[<owner/repo>]", "automation", ["none"]]
   },
   "run:merge": {
-    script: "scripts/run/run-merge-cli.ts",
+    script: "scripts/run/merge/run-merge-cli.ts",
     description: "Collapse a backlogrun merge event into one call: confirm the child, do the post-merge steps, offer the next child",
     category: "AI tools",
     reference: [ISSUE_WITH_OPTIONS2, "automation", ["git", "network"]]
   },
   "run:review": {
-    script: "scripts/run/run-review-cli.ts",
+    script: "scripts/run/review/run-review-cli.ts",
     description: "Start the gate in the background and print the /code-review brief in one call so the two overlap (--join to join the gate and check its verdict)",
     category: "AI tools",
     reference: ["[--join]", "automation", ["processes", "files"]]
@@ -868,7 +1659,7 @@ var AI_COMMANDS = {
   // (`run:tail`) were four round trips re-billing the run's full context each. It stops at the first
   // failed step and names it, so the run reads only the step to fix.
   ship: {
-    script: "scripts/run/run-ship-cli.ts",
+    script: "scripts/run/ship/run-ship-cli.ts",
     description: "Ship a change in one call: gate, commit/push/PR, the CI-wait merge and the report bookkeeping, stopping at the first failed step",
     category: "AI tools",
     reference: [
@@ -878,7 +1669,7 @@ var AI_COMMANDS = {
     ]
   },
   "run:event": {
-    script: "scripts/run/run-event-cli.ts",
+    script: "scripts/run/event/run-event-cli.ts",
     description: "Append to, read or watch the run\u2019s append-only event stream (--append <kind> <text> | --from|--follow <n> | --watch [<n>] | --last)",
     category: "AI tools",
     reference: [
@@ -938,6 +1729,192 @@ var CLONE_COMMANDS = {
   }
 };
 
+// scripts/gate/gate-plan.ts
+import { availableParallelism as availableParallelism4 } from "node:os";
+
+// scripts/lib/status-icons.ts
+var FAIL_ICON = "\u2717";
+var PASS_ICON = "\u2714";
+var status_icons = { FAIL_ICON, PASS_ICON };
+
+// scripts/josh/josh-verdict.ts
+var { FAIL_ICON: FAIL_ICON2, PASS_ICON: PASS_ICON2 } = status_icons;
+var GATE_SUBJECT = "verification gate";
+var GATE_PASSED_PREFIX = `${PASS_ICON2} ${GATE_SUBJECT} passed`;
+var GATE_FAILED_PREFIX = `${FAIL_ICON2} ${GATE_SUBJECT} failed`;
+var PASSED_VERDICT = "passed";
+var FAILED_VERDICT = "failed";
+function format_gate_passed(step_count, total) {
+  return `${GATE_PASSED_PREFIX} (${step_count} checks) in ${total}.`;
+}
+function format_gate_failed(failed_labels, total) {
+  return `${GATE_FAILED_PREFIX}: ${failed_labels} (${total})`;
+}
+var GATE_OPENING_PREFIX = "plan: ";
+var GATE_OPENING_MARK = " checks at once";
+function is_gate_opening(line) {
+  const trimmed = line.trimStart();
+  return trimmed.startsWith(GATE_OPENING_PREFIX) && trimmed.includes(GATE_OPENING_MARK);
+}
+function read_verdict(line) {
+  const trimmed = line.trimStart();
+  if (trimmed.startsWith(GATE_FAILED_PREFIX)) return FAILED_VERDICT;
+  if (trimmed.startsWith(GATE_PASSED_PREFIX)) return PASSED_VERDICT;
+  return void 0;
+}
+var josh_verdict = {
+  PASSED_VERDICT,
+  FAILED_VERDICT,
+  format_gate_passed,
+  format_gate_failed,
+  GATE_OPENING_MARK,
+  GATE_OPENING_PREFIX,
+  is_gate_opening,
+  read_verdict
+};
+
+// scripts/gate/gate-plan.ts
+var LINT_LABEL = "lint";
+var TYPE_CHECK_LABEL = "check";
+var UNIT_LABEL = "test:unit";
+var BEHAVIOR_LABEL = "behavior";
+var WARNING_CHECKER_LABELS = [LINT_LABEL, TYPE_CHECK_LABEL];
+var STATIC_CHECKS = [
+  {
+    label: LINT_LABEL,
+    target: "lint",
+    reserved_cores: core_budget.CORE_WEIGHTS.lint,
+    memory_mb: core_budget.MEMORY_MB.lint
+  },
+  {
+    label: TYPE_CHECK_LABEL,
+    target: "check",
+    reserved_cores: core_budget.CORE_WEIGHTS.type_check,
+    memory_mb: core_budget.MEMORY_MB.type_check
+  },
+  {
+    label: "cspell",
+    target: "cspell:dot",
+    reserved_cores: core_budget.CORE_WEIGHTS.spell_check,
+    memory_mb: core_budget.MEMORY_MB.spell_check
+  },
+  { label: BEHAVIOR_LABEL, target: BEHAVIOR_LABEL, reserved_cores: 0 },
+  // **The unused-member check reserves no core** (joshuafolkken/kit#2987): it builds one TypeScript
+  // program and walks it for about 5s, and it is over well before lint and the type check. A
+  // reservation would only take a place from the four-core CI runner's fan-out and a worker from the
+  // unit suite for the whole gate.
+  { label: "exports", target: "exports:unused", reserved_cores: 0 }
+];
+var GATE_CHECKS = [
+  ...STATIC_CHECKS,
+  { label: UNIT_LABEL, target: UNIT_LABEL, reserved_cores: 0 }
+];
+function select_gate_checks(is_unit_included) {
+  return is_unit_included ? GATE_CHECKS : STATIC_CHECKS;
+}
+function has_unit_check(checks) {
+  return checks.some((check) => check.label === UNIT_LABEL);
+}
+var RESERVED_CORES = STATIC_CHECKS.reduce(
+  (total, check) => total + check.reserved_cores,
+  0
+);
+var MEASURED_CORES = 11;
+var MIN_CONCURRENCY = 1;
+var MIN_SHARED_CORES = 1;
+function shared_cores(available_cores, concurrent_runs) {
+  const runs = Number.isFinite(concurrent_runs) ? Math.max(unit_worker_share.SOLO_RUNS, concurrent_runs) : unit_worker_share.SOLO_RUNS;
+  return Math.max(MIN_SHARED_CORES, Math.floor(available_cores / runs));
+}
+function resolve_concurrency(available_cores, concurrent_runs = unit_worker_share.SOLO_RUNS, checks = GATE_CHECKS) {
+  const share = shared_cores(available_cores, concurrent_runs);
+  let admitted = 0;
+  let reserved = 0;
+  for (const check of checks) {
+    reserved += check.reserved_cores;
+    if (reserved > share) break;
+    admitted += 1;
+  }
+  return Math.max(MIN_CONCURRENCY, admitted);
+}
+function resolve_unit_worker_cap(available_cores, concurrent_runs = unit_worker_share.SOLO_RUNS) {
+  const share = unit_worker_share.resolve_unit_workers(available_cores, concurrent_runs);
+  if (share !== void 0) return share;
+  if (available_cores < MEASURED_CORES) return void 0;
+  return available_cores - RESERVED_CORES;
+}
+function solo_unit_weight(available_cores) {
+  return Math.max(0, available_cores - RESERVED_CORES);
+}
+function check_weight(check, plan, available_cores) {
+  if (check.label !== UNIT_LABEL) return check.reserved_cores;
+  return plan.unit_worker_cap ?? solo_unit_weight(available_cores);
+}
+function unit_memory(workers) {
+  return workers * core_budget.MEMORY_MB.unit_worker;
+}
+function check_memory(check, plan, available_cores) {
+  if (check.label !== UNIT_LABEL) return check.memory_mb ?? 0;
+  return unit_memory(check_weight(check, plan, available_cores));
+}
+function direct_unit_weight(available_cores = availableParallelism4(), live_runs = unit_worker_share.live_run_count()) {
+  const weight = unit_worker_share.current_share(available_cores, live_runs) ?? solo_unit_weight(available_cores);
+  return Math.max(unit_worker_share.MIN_WORKERS, weight);
+}
+function direct_unit_memory() {
+  return unit_memory(direct_unit_weight());
+}
+function plan_of(concurrency, unit_worker_cap, checks = GATE_CHECKS) {
+  return { checks, concurrency, unit_worker_cap };
+}
+function resolve_gate_plan(available_cores = availableParallelism4(), concurrent_runs = unit_worker_share.SOLO_RUNS, is_unit_included = true) {
+  const checks = select_gate_checks(is_unit_included);
+  return {
+    checks,
+    concurrency: resolve_concurrency(available_cores, concurrent_runs, checks),
+    unit_worker_cap: is_unit_included ? resolve_unit_worker_cap(available_cores, concurrent_runs) : void 0
+  };
+}
+function format_machine(available_cores, concurrent_runs) {
+  const cores = `${String(available_cores)} cores`;
+  if (concurrent_runs <= unit_worker_share.SOLO_RUNS) return cores;
+  return `${cores}, ${String(concurrent_runs)} unit runs`;
+}
+function format_unit_cap(plan) {
+  if (!has_unit_check(plan.checks)) return `${UNIT_LABEL} elsewhere`;
+  if (plan.unit_worker_cap === void 0) return `${UNIT_LABEL} unrestricted`;
+  return `${UNIT_LABEL} at ${String(plan.unit_worker_cap)} workers`;
+}
+function format_gate_plan(plan, available_cores = availableParallelism4(), concurrent_runs = unit_worker_share.SOLO_RUNS) {
+  const cap = format_unit_cap(plan);
+  const count = `${String(plan.concurrency)} of ${String(plan.checks.length)}`;
+  const width = `${count}${josh_verdict.GATE_OPENING_MARK}`;
+  const machine = format_machine(available_cores, concurrent_runs);
+  return `${josh_verdict.GATE_OPENING_PREFIX}${width}, ${cap} (${machine})`;
+}
+var gate_plan = {
+  GATE_CHECKS,
+  LINT_LABEL,
+  MEASURED_CORES,
+  RESERVED_CORES,
+  STATIC_CHECKS,
+  TYPE_CHECK_LABEL,
+  UNIT_LABEL,
+  WARNING_CHECKER_LABELS,
+  check_memory,
+  check_weight,
+  direct_unit_memory,
+  direct_unit_weight,
+  format_gate_plan,
+  format_machine,
+  has_unit_check,
+  plan_of,
+  resolve_concurrency,
+  resolve_gate_plan,
+  resolve_unit_worker_cap,
+  select_gate_checks
+};
+
 // scripts/josh/josh-commands-development.ts
 var FILE_ARGUMENTS = "[files...]";
 var REQUIRED_FILE_ARGUMENTS = "<files...>";
@@ -961,25 +1938,33 @@ var DEV_COMMANDS = {
     script: "scripts/lint/lint-parallel.ts",
     description: "Check code with prettier and eslint (skips a tool a basic project lacks)",
     category: "Development",
-    reference: ["", "developer", ["processes"]]
+    reference: ["", "developer", ["processes"]],
+    core_weight: core_budget.CORE_WEIGHTS.lint,
+    memory_mb: core_budget.MEMORY_MB.lint
   },
   "lint:related": {
     script: "scripts/lint/lint-related.ts",
     description: "Check only the changed files with prettier and eslint (whole tree on fallback)",
     category: "Development",
-    reference: [FILE_ARGUMENTS, "developer", ["processes"]]
+    reference: [FILE_ARGUMENTS, "developer", ["processes"]],
+    core_weight: core_budget.CORE_WEIGHTS.lint,
+    memory_mb: core_budget.MEMORY_MB.lint
   },
   lines: {
     script: "scripts/lines/lines-command.ts",
     description: "Print a file's code lines against the max-lines limit and the headroom left",
     category: "Development",
-    reference: [REQUIRED_FILE_ARGUMENTS, "developer", ["none"]]
+    reference: [REQUIRED_FILE_ARGUMENTS, "developer", ["none"]],
+    core_weight: core_budget.CORE_WEIGHTS.eslint_scan,
+    memory_mb: core_budget.MEMORY_MB.eslint_scan
   },
   "refactor:scan": {
     script: "scripts/refactor/refactor-scan-cli.ts",
     description: "List refactoring candidates in the changed scope by category and answer clear/candidates",
     category: "Development",
-    reference: ["", "automation", ["processes"]]
+    reference: ["", "automation", ["processes"]],
+    core_weight: core_budget.CORE_WEIGHTS.eslint_scan,
+    memory_mb: core_budget.MEMORY_MB.eslint_scan
   },
   bytes: {
     script: "scripts/lines/bytes-command.ts",
@@ -1058,7 +2043,9 @@ var DEV_COMMANDS = {
     script: "scripts/lint/cspell-cached.ts",
     description: "Run spell check including dotfiles",
     category: "Development",
-    reference: ["", "developer", ["processes"]]
+    reference: ["", "developer", ["processes"]],
+    core_weight: core_budget.CORE_WEIGHTS.spell_check,
+    memory_mb: core_budget.MEMORY_MB.spell_check
   },
   behavior: {
     script: "scripts/behavior/behavior-cli.ts",
@@ -1076,13 +2063,17 @@ var DEV_COMMANDS = {
     script: "scripts/test/test-unit-guard.ts",
     description: "Run unit tests with Vitest (skips when Vitest is absent; fails when it has no tests)",
     category: "Development",
-    reference: [FILTER_ARGUMENTS, "developer", ["processes"]]
+    reference: [FILTER_ARGUMENTS, "developer", ["processes"]],
+    core_weight: gate_plan.direct_unit_weight,
+    memory_mb: gate_plan.direct_unit_memory
   },
   "test:related": {
     script: "scripts/test/test-related.ts",
     description: "Run only the unit tests related to the changed files (full suite on fallback)",
     category: "Development",
-    reference: [FILE_ARGUMENTS, "developer", ["processes"]]
+    reference: [FILE_ARGUMENTS, "developer", ["processes"]],
+    core_weight: gate_plan.direct_unit_weight,
+    memory_mb: gate_plan.direct_unit_memory
   },
   "test:declared": {
     script: "scripts/test/test-declared.ts",
@@ -1125,7 +2116,9 @@ var DEV_COMMANDS = {
     script: "scripts/gate/type-check-command.ts",
     description: "Type-check with tsc (skips a basic project with no TypeScript to check)",
     category: "Development",
-    reference: ["[arguments...]", "developer", ["processes"]]
+    reference: ["[arguments...]", "developer", ["processes"]],
+    core_weight: core_budget.CORE_WEIGHTS.type_check,
+    memory_mb: core_budget.MEMORY_MB.type_check
   },
   port: {
     script: "scripts/ports/port-command.ts",
@@ -1222,7 +2215,7 @@ var MAINTENANCE_COMMANDS = {
     script: "scripts/overrides/overrides-check.ts",
     description: "Check pnpm overrides for drift",
     category: "Maintenance",
-    reference: ["[--save]", "maintainer", ["files"]]
+    reference: ["[--save]", "developer", ["files"]]
   },
   audit: {
     script: "scripts/security/security-audit.ts",
@@ -1246,11 +2239,11 @@ var MAINTENANCE_COMMANDS = {
     shell: [
       "sh",
       "-c",
-      "export NODE_AUTH_TOKEN=$(gh auth token) && pnpm josh latest:guard && pnpm josh latest:corepack && pnpm josh latest:update && pnpm josh ranges && pnpm josh audit && pnpm josh latest:scope --record"
+      "export NODE_AUTH_TOKEN=$(gh auth token) && pnpm josh latest:guard && pnpm josh latest:update && pnpm josh ranges && pnpm josh audit && pnpm josh latest:corepack && pnpm josh latest:scope --record"
     ],
-    description: "Update pnpm, dependencies, and run security audit",
+    description: "Update dependencies, run security audit, then update pnpm",
     category: "Maintenance",
-    reference: ["", "maintainer", ["files", "network", "processes"]],
+    reference: ["", "developer", ["files", "network", "processes"]],
     argument_targets: ["latest:corepack", "latest:update", "audit"]
   },
   "latest:scope": {
@@ -1273,13 +2266,13 @@ var MAINTENANCE_COMMANDS = {
     script: "scripts/version/latest-corepack.ts",
     description: "Update pnpm on the current major while preserving the integrity pin",
     category: "Maintenance",
-    reference: ["", "maintainer", ["files", "network"]]
+    reference: ["", "developer", ["files", "network"]]
   },
   "latest:update": {
     script: "scripts/version/latest-update.ts",
     description: "Update all dependencies to latest",
     category: "Maintenance",
-    reference: ["", "maintainer", ["files", "network"]]
+    reference: ["", "developer", ["files", "network"]]
   }
 };
 
@@ -1602,7 +2595,9 @@ var ALIASES = {
   rtr: "retrospective",
   rvf: "review:findings",
   ruv: "rule:value",
-  ev: "eval"
+  ev: "eval",
+  lsm: "lane:sample",
+  lst: "lane:stats"
 };
 
 // scripts/josh/josh-composite-arguments.ts
@@ -1633,15 +2628,23 @@ var composite_arguments = { format_rejection, is_composite_shell, reject_extra_a
 
 // scripts/josh/josh-in-process.ts
 import { realpathSync } from "node:fs";
+import path9 from "node:path";
 import { pathToFileURL } from "node:url";
 var TYPESCRIPT_EXTENSION = ".ts";
+var JAVASCRIPT_EXTENSION = ".js";
+var BUNDLED_COMMAND_DIRECTORY = path9.join("dist", "commands");
 var FAILURE_EXIT_CODE = 1;
 function is_typescript_dispatcher(dispatcher_url) {
   return dispatcher_url.endsWith(TYPESCRIPT_EXTENSION);
 }
-function can_run_in_process(entry, dispatcher_url) {
-  if (entry.script === void 0 || entry.tsx_arguments !== void 0) return false;
-  return is_typescript_dispatcher(dispatcher_url);
+function bundled_script_path(package_directory, script) {
+  const name = `${path9.basename(script, TYPESCRIPT_EXTENSION)}${JAVASCRIPT_EXTENSION}`;
+  return path9.join(package_directory, BUNDLED_COMMAND_DIRECTORY, name);
+}
+function in_process_target(entry, package_directory, dispatcher_url) {
+  if (entry.script === void 0 || entry.tsx_arguments !== void 0) return void 0;
+  if (is_typescript_dispatcher(dispatcher_url)) return path9.join(package_directory, entry.script);
+  return entry.is_bundled === true ? bundled_script_path(package_directory, entry.script) : void 0;
 }
 function read_exit_code() {
   const code = process.exitCode;
@@ -1665,7 +2668,7 @@ async function run_in_process(script_path, script_arguments) {
   }
   return read_exit_code();
 }
-var josh_in_process = { can_run_in_process, run_in_process };
+var josh_in_process = { bundled_script_path, in_process_target, run_in_process };
 
 // scripts/josh/kit-only.ts
 function kit_only_notice(cmd) {
@@ -1685,7 +2688,7 @@ var kit_only = {
 
 // scripts/josh/run-github-prerequisite.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path3 from "node:path";
+import path10 from "node:path";
 
 // scripts/discovery/repo-origin.ts
 var GITHUB_HOST = "github.com";
@@ -1750,15 +2753,15 @@ function origin_section_lines(lines) {
   const end = rest.findIndex((line) => is_section_header(line));
   return end === NOT_FOUND ? rest : rest.slice(0, end);
 }
-function entry_value(line, key) {
+function url_value(line) {
   const separator = line.indexOf("=");
   if (separator === NOT_FOUND) return void 0;
-  if (line.slice(0, separator).trim() !== key) return void 0;
+  if (line.slice(0, separator).trim() !== URL_KEY) return void 0;
   return line.slice(separator + 1).trim();
 }
 function parse_origin_from_config(content) {
   const lines = content.split("\n").map((line) => line.trim());
-  return origin_section_lines(lines).map((line) => entry_value(line, URL_KEY)).find((url) => url !== void 0);
+  return origin_section_lines(lines).map((line) => url_value(line)).find((url) => url !== void 0);
 }
 function section_groups(lines) {
   const groups = [];
@@ -1770,7 +2773,7 @@ function section_groups(lines) {
 }
 function parse_remote_urls_from_config(content) {
   const lines = content.split("\n").map((line) => line.trim());
-  return section_groups(lines).filter((group) => REMOTE_SECTION.test(group[0] ?? "")).flatMap((group) => group.map((line) => entry_value(line, URL_KEY))).filter((url) => url !== void 0);
+  return section_groups(lines).filter((group) => REMOTE_SECTION.test(group[0] ?? "")).flatMap((group) => group.map((line) => url_value(line))).filter((url) => url !== void 0);
 }
 function format_identity(identity) {
   return `${identity.owner}${PATH_SEPARATOR2}${identity.repo}`.toLowerCase();
@@ -1796,7 +2799,7 @@ var GITHUB_RUN_COMMANDS = /* @__PURE__ */ new Set([
 ]);
 function explanation(root, command) {
   if (!GITHUB_RUN_COMMANDS.has(command)) return void 0;
-  if (!existsSync3(path3.join(root, ".git"))) {
+  if (!existsSync3(path10.join(root, ".git"))) {
     return `${command} requires Git and a GitHub origin. Run git init and add a GitHub origin first.`;
   }
   const url = git_spawn_sync.origin_url(root);
@@ -1813,24 +2816,21 @@ var TSX_PACKAGE = "tsx";
 var PACKAGE_JSON2 = "package.json";
 var UNKNOWN_COMMAND_EXIT_CODE = -1;
 function find_package_directory(start_directory) {
-  let current = start_directory;
-  while (!existsSync4(path4.join(current, PACKAGE_JSON2))) {
-    const parent = path4.dirname(current);
-    if (parent === current) return start_directory;
-    current = parent;
-  }
-  return current;
+  return ancestor_directories.nearest(
+    start_directory,
+    (directory) => existsSync4(path11.join(directory, PACKAGE_JSON2))
+  ) ?? start_directory;
 }
-var PACKAGE_DIR = find_package_directory(path4.dirname(fileURLToPath(import.meta.url)));
+var PACKAGE_DIR2 = find_package_directory(path11.dirname(fileURLToPath2(import.meta.url)));
 function resolve_tsx_executable() {
   const candidates = [
-    resolve_local_bin(PACKAGE_DIR, TSX_BIN),
+    resolve_local_bin(PACKAGE_DIR2, TSX_BIN),
     resolve_local_bin(process.cwd(), TSX_BIN)
   ];
   return candidates.find(existsSync4) ?? TSX_BIN;
 }
 function resolve_tsx_cli_entry() {
-  for (const base_directory of [PACKAGE_DIR, process.cwd()]) {
+  for (const base_directory of [PACKAGE_DIR2, process.cwd()]) {
     const cli_entry = resolve_package_bin(base_directory, TSX_PACKAGE, TSX_BIN);
     if (cli_entry !== void 0) return cli_entry;
   }
@@ -1844,7 +2844,7 @@ function resolve_tsx_runner() {
   return { executable: resolve_tsx_executable(), leading_arguments: [] };
 }
 function read_package_version() {
-  const raw = readFileSync3(path4.join(PACKAGE_DIR, PACKAGE_JSON2), "utf8");
+  const raw = readFileSync5(path11.join(PACKAGE_DIR2, PACKAGE_JSON2), "utf8");
   return package_version_schema.parse(JSON.parse(raw)).version;
 }
 var HEADER = `josh v${read_package_version()} \u2014 Joshua Folkken's dev toolkit`;
@@ -1928,12 +2928,10 @@ function spawn_script_entry(entry, script_path, script_arguments) {
   ]);
 }
 async function run_script_entry(entry, subcommand_arguments) {
-  const script_path = path4.join(PACKAGE_DIR, entry.script ?? "");
   const script_arguments = [...entry.default_script_arguments ?? [], ...subcommand_arguments];
-  if (josh_in_process.can_run_in_process(entry, import.meta.url)) {
-    return await josh_in_process.run_in_process(script_path, script_arguments);
-  }
-  return spawn_script_entry(entry, script_path, script_arguments);
+  const target = josh_in_process.in_process_target(entry, PACKAGE_DIR2, import.meta.url);
+  if (target !== void 0) return await josh_in_process.run_in_process(target, script_arguments);
+  return spawn_script_entry(entry, path11.join(PACKAGE_DIR2, entry.script ?? ""), script_arguments);
 }
 function github_prerequisite_exit(resolved, is_consumer) {
   if (!is_consumer) return void 0;
@@ -1958,10 +2956,22 @@ function pre_dispatch_exit(resolved, entry, subcommand_arguments, is_consumer) {
   console.error(rejection);
   return USAGE_ERROR_EXIT_CODE;
 }
-async function dispatch_entry(entry, subcommand_arguments) {
+async function run_entry(entry, subcommand_arguments) {
   if (entry.shell) return run_shell_command(entry.shell, subcommand_arguments);
   return await run_script_entry(entry, subcommand_arguments);
 }
+function declared(value) {
+  return typeof value === "function" ? value() : value;
+}
+async function dispatch_entry(entry, subcommand_arguments) {
+  const weight = declared(entry.core_weight);
+  if (weight === void 0) return await run_entry(entry, subcommand_arguments);
+  return await core_budget.with_command_reservation(
+    weight,
+    async () => await run_entry(entry, subcommand_arguments),
+    { memory_mb: declared(entry.memory_mb) }
+  );
+}
 async function run_command(cmd, subcommand_arguments, is_consumer = false) {
   const resolved = resolve_alias(cmd);
   const entry = Object.hasOwn(COMMAND_MAP, resolved) ? COMMAND_MAP[resolved] : void 0;