@joshuafolkken/kit 1.1229.0 → 1.1240.0

package/scripts/run/wake/run-wake.ts

@@ -126,14 +126,6 @@ interface RunWake {
 	// session that is merely slow is still doing the run's work, and a supervisor that killed what it
 	// could not account for would destroy exactly the work it exists to keep going.
 	woke_pid?: number | undefined
-	// When the wait on a still-running predecessor began. **It is its own field rather than a second
-	// use of `woke_at`, and that is the whole of the bound working as described.** Marked on `woke_at`,
-	// the first pass of a wait was the last one that could see the predecessor exit — every later pass
-	// read the mark as an outstanding wake and answered `pending` — so a predecessor that ended two
-	// seconds after the hold still cost the full grace window on a supervisor whose point is not to
-	// stall. Kept apart, the predecessor's liveness is read on every pass and the mark only bounds how
-	// long the wait may last.
-	held_at?: string | undefined
 	// The transcript ids of every session this supervisor forced with `--session-id`
 	// (joshuafolkken/kit#2407). `josh time --run` attributes a whiff only to a session in this list, so
 	// an unrelated read-only session that moved while the supervisor was alive is no longer counted
@@ -164,7 +156,6 @@ type WakeDecision =
 	| { kind: 'idle' }
 	| { kind: 'wait' }
 	| { kind: 'pending' }
-	| { kind: 'hold' }
 	| { kind: 'failed' }
 	| { kind: 'stop'; reason: WakeStopReason }
 
@@ -172,16 +163,16 @@ interface WakeDecisionInput {
 	read: CarryRead
 	woke_at: string | undefined
 	attempts: number
-	// Whether the process named on the carry record is still running. **A cut is the run's last write,
-	// not the moment its process is gone** — so a supervisor that woke the instant it saw the hand-off
-	// could have the new session answered `busy`, because `run-carry.ts` → `classify_claim` tests
-	// `is_foreign_live_owner` before it tests the hand-off. Answered `busy`, the woken session stops
-	// without claiming anything, and the supervisor would eventually call its own wake a failure and end
-	// the run. So the predecessor is waited out first.
+	// Whether the process named on the carry record is still running — read only for a record no cut
+	// handed off, where it tells a session at work from a crashed one (`decide_not_handed_off`).
+	//
+	// **A handed-off record is launched from whether its cutting process lives or not**
+	// (joshuafolkken/kit#3363). The supervisor used to wait that process out, for up to the grace
+	// window, because `run-carry.ts` → `classify_claim` once tested liveness before the hand-off and
+	// would have answered the successor `busy`. joshuafolkken/kit#1935 put the hand-off first, so the
+	// wait guarded nothing — and an interactive session outlives its own cut, so every cut paid the
+	// whole ten minutes before the driver started.
 	is_owner_live: boolean
-	// When the wait on that predecessor began, so the wait can be bounded without spending the mark
-	// that measures a launch.
-	held_at: string | undefined
 	// **Whether a woken session would find anything to do** (joshuafolkken/kit#2417). Before this the
 	// decision read the carry record alone, so a session was launched whether or not the backlog held a
 	// runnable issue or a lane was free — and a session that found nothing ended without touching
@@ -198,7 +189,6 @@ const WAKE_DECISION: WakeDecision = { kind: 'wake' }
 const IDLE_DECISION: WakeDecision = { kind: 'idle' }
 const WAIT_DECISION: WakeDecision = { kind: 'wait' }
 const PENDING_DECISION: WakeDecision = { kind: 'pending' }
-const HOLD_DECISION: WakeDecision = { kind: 'hold' }
 const FAILED_DECISION: WakeDecision = { kind: 'failed' }
 
 // The three carry reads that are not `carried`, each mapped to why the supervisor stops. `none` is the
@@ -220,7 +210,6 @@ const run_wake_schema = process_owner_schema.extend({
 	// reads as "no attempt has been made yet" and would restart the retry count on every pass.
 	attempts: z.number().optional(),
 	woke_pid: z.number().optional(),
-	held_at: z.string().optional(),
 	spawned: z.array(z.string()).optional(),
 	idle_since: z.string().optional(),
 	profile: agent_role_profile.PROFILE_SCHEMA.optional(),
@@ -279,32 +268,10 @@ function decide_not_handed_off(input: WakeDecisionInput): WakeDecision {
 	return decide_launch(input)
 }
 
-// Only before the first launch for this cut. Once a wake is out, the record's owner is whatever the
-// woken session declares, and waiting on it again would stall the grace window indefinitely.
-//
-// **The wait is bounded, and the bound is not decoration.** The owner is the agent process of the
-// session that cut, and an interactive one often outlives its own cut — waited on without a bound, the
-// supervisor would pend every interval for the record's whole life, wake nothing, and end on `expired`,
-// which sends no warning. That is a silent overnight failure, which is worse than the `busy` race this
-// wait exists to avoid: a `busy` merely costs one attempt, and attempts are retried. So the wait is
-// marked when it starts and expires into an ordinary wake through the same grace window everything
-// else uses.
-//
-// **And the wait ends the moment the predecessor does, because its liveness is read on every pass.**
-// The bound is the ceiling on the wait, never its length: a predecessor that exits two seconds after
-// the hold is waited two seconds. That is what `held_at` is a separate field for — marked on `woke_at`,
-// this test could not fire a second time, so every wait cost the whole ceiling.
-function is_predecessor_exiting(input: WakeDecisionInput): boolean {
-	if (input.woke_at !== undefined || !input.is_owner_live) return false
-
-	return input.held_at === undefined || !is_overdue(input.held_at, input.now)
-}
-
-// The whole policy, in four lines. Nothing else in this module decides whether to wake.
+// The whole policy, in three lines. Nothing else in this module decides whether to wake.
 function decide(input: WakeDecisionInput): WakeDecision {
 	if (input.read.kind !== 'carried') return { kind: 'stop', reason: STOP_REASONS[input.read.kind] }
 	if (input.read.carry.is_handed_off !== true) return decide_not_handed_off(input)
-	if (is_predecessor_exiting(input)) return HOLD_DECISION
 
 	return decide_launch(input)
 }
@@ -367,10 +334,9 @@ function is_supervisor_live(wake: RunWake): boolean {
 // inside the grace window would otherwise see no wake mark, launch a second session for the *same*
 // cut, count it as another cut served, and leave two sessions racing for one record. The invocation
 // has to match — a different one is a different run, and its state is not this one's.
-// **`woke_pid` and `held_at` come across too.** Without the first, a restart inside the grace window
-// that then spends its retries reports "the last one was none" in the warning — the one fact the
-// warning exists to hand the person, dropped exactly where it is needed. Without the second, a restart
-// restarts the bounded wait, which is the ceiling sliding by another road.
+// **`woke_pid` comes across too.** Without it, a restart inside the grace window that then spends its
+// retries reports "the last one was none" in the warning — the one fact the warning exists to hand the
+// person, dropped exactly where it is needed.
 function carried_state(existing: RunWake | undefined, invocation: string): Partial<RunWake> {
 	if (existing?.invocation !== invocation) return { woke: NO_WAKES }
 
@@ -379,7 +345,6 @@ function carried_state(existing: RunWake | undefined, invocation: string): Parti
 		woke_at: existing.woke_at,
 		attempts: existing.attempts,
 		woke_pid: existing.woke_pid,
-		held_at: existing.held_at,
 		// **`spawned` carries across too, or a restart mid-run would lose the ids of every session it
 		// already started** (joshuafolkken/kit#2407) — and `josh time --run`, reading the record after
 		// the restart, would under-count the whiffs and read the loss as a saving.
@@ -447,24 +412,12 @@ function count_wake(wake: RunWake, now: Date, pid: number, session_id: string):
 		spawned,
 		woke_at,
 		woke_pid: pid,
-		held_at: undefined,
 		idle_since: undefined,
 	}
 }
 
-// Starts the clock on a wait without launching anything. `attempts` is deliberately untouched, so the
-// bounded wait costs no retry: what it buys is that the wait expires into an ordinary wake instead of
-// running until the carry record does.
-//
-// **Marked once, so the ceiling does not slide.** A mark rewritten on every pass would measure from the
-// latest pass rather than from the start of the wait, and a predecessor that never exits would then be
-// waited on for ever — the unbounded wait this bound exists to prevent, arrived at by another road.
-function mark_wait(wake: RunWake, now: Date): RunWake {
-	return wake.held_at === undefined ? { ...wake, held_at: now.toISOString() } : wake
-}
-
-// Starts the idle stretch a deferred launch is bounded by (joshuafolkken/kit#2417). Marked once, for
-// the reason `mark_wait` is: rewritten each pass, the ceiling would slide and never be reached.
+// Starts the idle stretch a deferred launch is bounded by (joshuafolkken/kit#2417). Marked once:
+// rewritten each pass, the ceiling would slide and never be reached.
 function mark_idle(wake: RunWake, now: Date): RunWake {
 	return wake.idle_since === undefined ? { ...wake, idle_since: now.toISOString() } : wake
 }
@@ -489,7 +442,6 @@ function count_claim(wake: RunWake): RunWake {
 		woke,
 		woke_at: undefined,
 		attempts: undefined,
-		held_at: undefined,
 		idle_since: undefined,
 	}
 }
@@ -589,7 +541,6 @@ const run_wake = {
 	fresh_wake,
 	is_supervisor_live,
 	mark_idle,
-	mark_wait,
 	parse_wake,
 	read_own_wake,
 	read_wake,

package/scripts/version/latest-corepack.ts

@@ -30,8 +30,12 @@
  * manifest that arrived with the two fields out of step kept the pnpm dual-declaration
  * warning forever. The alignment is idempotent, so running it unconditionally is free.
  *
- * Registry and pnpm failures stay non-fatal: they are logged and swallowed (exit 0)
- * so the rest of the `josh latest` chain (`latest:update`, `audit`) keeps running.
+ * A failed bump exits non-zero with its cause, the manifest restored (#3361). It used to be
+ * swallowed as a skip, so `latest:scope --record` marked the run fresh and a pnpm that could not
+ * self-update (the Corepack shim refuses it) stayed pinned silently. `josh latest` runs this step
+ * last, right before the record, so the dependency update and the audit still finish and only the
+ * record is withheld. A registry answer not newer than the pin, or nothing aged past the
+ * quarantine window yet, remains a non-fatal skip.
  *
  * Usage: tsx scripts/version/latest-corepack.ts
  */
@@ -54,9 +58,19 @@ const WORKSPACE_PATH = 'pnpm-workspace.yaml'
 const SHA512_BYTES = 64
 const INTEGRITY_RE = /^sha512-([A-Za-z0-9+/]+={0,2})$/u
 const PACKAGE_MANAGER_VALUE_RE = /("packageManager"\s*:\s*")pnpm@[^"]+(")/u
+
+// `target` is undefined both when the registry did not answer and when it answered but nothing has
+// aged past the quarantine window yet; only the first is a failure (#3361).
+interface TargetResolution {
+	target: string | undefined
+	is_registry_reachable: boolean
+}
+
 const PNPM_DEVELOPMENT_MANAGER_SCHEMA = z.object({ name: z.literal('pnpm'), version: z.string() })
 const DEV_ENGINES_SCHEMA = z.object({ packageManager: PNPM_DEVELOPMENT_MANAGER_SCHEMA })
 const DEV_ENGINES_PNPM_SCHEMA = z.object({ devEngines: DEV_ENGINES_SCHEMA.optional() })
+const COREPACK_REMEDY =
+	'pnpm runs through the Corepack shim, where pnpm 11+ refuses self-update (ERR_PNPM_CANT_SELF_UPDATE_IN_COREPACK). Run `corepack disable pnpm`, install a standalone pnpm (https://pnpm.io/installation), then rerun josh latest.'
 
 function extract_development_engines_version(package_json_content: string): string | undefined {
 	const parsed = DEV_ENGINES_PNPM_SCHEMA.safeParse(
@@ -128,22 +142,33 @@ function query_release_times(): Record<string, string> | undefined {
 	return extract_times_json(result.stdout)
 }
 
+function to_resolution(
+	version: string | undefined,
+	is_registry_reachable: boolean,
+): TargetResolution {
+	const target = version === undefined ? undefined : `${TARGET_PREFIX}${version}`
+
+	return { target, is_registry_reachable }
+}
+
 // Ask the registry for the newest pnpm release on the pinned major that has aged past the
-// quarantine window. Returns undefined when the query fails or nothing qualifies yet.
-function query_major_latest_version(major: string): string | undefined {
+// quarantine window.
+function resolve_major_target(major: string): TargetResolution {
 	const times = query_release_times()
-	if (times === undefined) return undefined
+	if (times === undefined) return to_resolution(undefined, false)
 
 	// The project's own `pnpm-workspace.yaml`, deliberately not the upward walk the version check
 	// uses: `josh latest` reads `package.json` and writes the pnpm pin relative to the working
 	// directory, so it has no subdirectory case — and honouring an ancestor's policy here could freeze
 	// pnpm bumps in a project that declares none (joshuafolkken/kit#808).
-	return release_age.select_aged_version(
+	const version = release_age.select_aged_version(
 		times,
 		major,
 		release_age.read_minimum_release_age(WORKSPACE_PATH),
 		Date.now(),
 	)
+
+	return to_resolution(version, true)
 }
 
 function parse_latest_version(stdout: string): string | undefined {
@@ -163,24 +188,40 @@ function query_latest_version(): string | undefined {
 	return parse_latest_version(result.stdout)
 }
 
-// The value handed to pnpm self-update: an exact registry-resolved version on the pinned
-// major, the latest exact version when no major can be read from package.json, or undefined when
-// the registry could not answer (the caller skips non-fatally).
-function resolve_corepack_target(major: string | undefined): string | undefined {
-	const version = major === undefined ? query_latest_version() : query_major_latest_version(major)
-	if (version === undefined) return undefined
+// The target handed to pnpm self-update: an exact registry-resolved version on the pinned major, or
+// the latest exact version when no major can be read from package.json. The latest-version query
+// has no quarantine selection, so resolving nothing there always means the registry did not answer.
+function resolve_target(major: string | undefined): TargetResolution {
+	if (major !== undefined) return resolve_major_target(major)
+	const version = query_latest_version()
+
+	return to_resolution(version, version !== undefined)
+}
 
-	return `pnpm@${version}`
+function resolve_corepack_target(major: string | undefined): string | undefined {
+	return resolve_target(major).target
 }
 
-// Non-fatal skip message shared by both skip paths: keep the josh latest chain
-// (latest:update, audit) running instead of aborting on a bump failure.
+// Non-fatal skip message for a registry answer with nothing to adopt — nothing to bump, nothing failed.
 function warn_skip(reason: string): void {
-	console.warn(`⚠ Skipped pnpm bump (${reason}); the chain continues.`)
+	console.warn(`⚠ Skipped pnpm bump (${reason}).`)
+}
+
+// Every failure path ends here, so the exit status the `josh latest` chain stops on is one value.
+function fail_bump(reason: string): number {
+	console.error(
+		`✖ pnpm bump failed (${reason}); the run is not recorded, so the next josh latest retries it.`,
+	)
+
+	return FAILURE_EXIT_CODE
 }
 
-function warn_unresolved(major: string | undefined = ''): void {
-	warn_skip(`no pnpm ${major} release resolvable from the registry`)
+// Corepack exports COREPACK_ROOT to the package manager it launches, and pnpm 11+ refuses
+// `self-update` under it (ERR_PNPM_CANT_SELF_UPDATE_IN_COREPACK), so the remedy is named there.
+function fail_self_update(status: number, environment: NodeJS.ProcessEnv = process.env): number {
+	if (environment['COREPACK_ROOT'] !== undefined) console.error(COREPACK_REMEDY)
+
+	return fail_bump(`pnpm self-update exited ${String(status)}`)
 }
 
 function run_pnpm_update(target: string): number {
@@ -193,17 +234,6 @@ function run_pnpm_update(target: string): number {
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }
 
-// The target is an already-resolved exact version, so a non-zero status here is a
-// genuine pnpm or network failure; a later run retries. Returns whether a skip
-// happened.
-function did_warn_skip(status: number): boolean {
-	if (status === 0) return false
-
-	warn_skip(`pnpm self-update exited ${String(status)}`)
-
-	return true
-}
-
 // Realign `devEngines.packageManager.version` with the `packageManager` pin so the two
 // fields keep matching (pnpm suppresses the dual-declaration warning only on an exact
 // match). Runs on every path, not just after a successful bump: a repository that arrives
@@ -224,7 +254,7 @@ function restore_package_json(
 	package_json_path: string = PACKAGE_JSON_PATH,
 ): void {
 	writeFileSync(package_json_path, content)
-	console.info('✔ Restored package.json pin (pnpm bump skipped)')
+	console.info('✔ Restored package.json pin (pnpm bump failed)')
 }
 
 function decode_integrity(encoded: string): string | undefined {
@@ -292,35 +322,19 @@ function notify_skipped_bump(target: string, pinned_version: string): void {
 	warn_skip(`registry answered ${target}, below the pinned ${pinned_version}`)
 }
 
-// Resolve the pnpm target with the pin floor applied. Undefined means the bump was
-// skipped and the reason has already been logged.
-function resolve_floored_target(original: string, major: string | undefined): string | undefined {
-	const target = resolve_corepack_target(major)
-
-	if (target === undefined) {
-		warn_unresolved(major)
-
-		return undefined
-	}
-
-	const pinned_version = extract_pinned_version(original)
-	if (!is_target_not_newer_than_pin(target, pinned_version)) return target
-
-	notify_skipped_bump(target, pinned_version ?? '')
-
-	return undefined
-}
-
-function restore_after_update(original: string, target: string, integrity: string): void {
+function restore_after_update(original: string, target: string, integrity: string): number {
 	try {
 		restore_integrity(target, integrity)
+
+		return 0
 	} catch {
 		restore_package_json(original)
-		warn_skip('pnpm self-update wrote an unexpected pin')
+
+		return fail_bump('pnpm self-update wrote an unexpected pin')
 	}
 }
 
-function pin_unpinned_manifest(original: string, target: string, integrity: string): void {
+function pin_unpinned_manifest(original: string, target: string, integrity: string): number {
 	const manifest = z.record(z.string(), z.unknown()).parse(json_value.parse_or_undefined(original))
 	const pinned = JSON.stringify(
 		{ ...manifest, packageManager: `${target}+${integrity}` },
@@ -334,53 +348,71 @@ function pin_unpinned_manifest(original: string, target: string, integrity: stri
 	)
 
 	const result = execaSync('pnpm', ['--version'], { reject: false })
-	if (result.exitCode === 0 && result.stdout.trim() === target.slice(TARGET_PREFIX.length)) return
+	if (result.exitCode === 0 && result.stdout.trim() === target.slice(TARGET_PREFIX.length)) return 0
 
 	restore_package_json(original)
-	warn_skip('the newly pinned pnpm version could not start')
-}
 
-function update_pinned_manifest(original: string, target: string, integrity: string): void {
-	const is_skipped = did_warn_skip(run_pnpm_update(target))
+	return fail_bump('the newly pinned pnpm version could not start')
+}
 
-	if (is_skipped) {
-		restore_package_json(original)
+// The target is an already-resolved exact version, so a non-zero status here is a genuine
+// pnpm, Corepack or network failure.
+function update_pinned_manifest(original: string, target: string, integrity: string): number {
+	const status = run_pnpm_update(target)
+	if (status === 0) return restore_after_update(original, target, integrity)
 
-		return
-	}
+	restore_package_json(original)
 
-	restore_after_update(original, target, integrity)
+	return fail_self_update(status)
 }
 
 // Query integrity before mutating the manifest; self-update writes both pins without it.
-function bump_package_manager(original: string, target: string): void {
+function bump_package_manager(original: string, target: string): number {
 	const integrity = query_integrity(target)
+	if (integrity === undefined) return fail_bump(`no integrity for ${target}`)
+	if (!PACKAGE_MANAGER_RE.test(original)) return pin_unpinned_manifest(original, target, integrity)
 
-	if (integrity === undefined) {
-		warn_skip(`no integrity for ${target}`)
+	return update_pinned_manifest(original, target, integrity)
+}
 
-		return
-	}
+// An unreachable registry fails, so the unrecorded run is retried. A reachable one with nothing
+// aged past the quarantine window is the kit#768 skip — like a not-newer answer, there is nothing
+// to adopt yet, and failing would stall every run for up to the whole window.
+function report_unresolved(major: string | undefined, is_registry_reachable: boolean): number {
+	const label = `pnpm ${major ?? ''}`.trimEnd()
+	if (!is_registry_reachable) return fail_bump(`the registry did not answer for ${label}`)
 
-	if (!PACKAGE_MANAGER_RE.test(original)) {
-		pin_unpinned_manifest(original, target, integrity)
+	warn_skip(`no ${label} release has aged past the quarantine window yet`)
 
-		return
+	return 0
+}
+
+// Resolve the pnpm target with the pin floor applied, then bump.
+function bump_to_registry_target(original: string, major: string | undefined): number {
+	const { target, is_registry_reachable } = resolve_target(major)
+	if (target === undefined) return report_unresolved(major, is_registry_reachable)
+
+	const pinned_version = extract_pinned_version(original)
+
+	if (!is_target_not_newer_than_pin(target, pinned_version)) {
+		return bump_package_manager(original, target)
 	}
 
-	update_pinned_manifest(original, target, integrity)
+	notify_skipped_bump(target, pinned_version ?? '')
+
+	return 0
 }
 
-function main(): void {
+function main(): number {
 	const original = readFileSync(PACKAGE_JSON_PATH, 'utf8')
-	const major = extract_pnpm_major(original)
-	const target = resolve_floored_target(original, major)
-	if (target !== undefined) bump_package_manager(original, target)
+	const status = bump_to_registry_target(original, extract_pnpm_major(original))
 
 	sync_development_engines()
+
+	return status
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main()
+if (process.argv[1] === fileURLToPath(import.meta.url)) process.exitCode = main()
 
 const latest_corepack = {
 	extract_pnpm_major,
@@ -388,12 +420,11 @@ const latest_corepack = {
 	is_target_not_newer_than_pin,
 	notify_skipped_bump,
 	extract_times_json,
-	query_major_latest_version,
 	resolve_corepack_target,
 	run_pnpm_update,
 	query_integrity,
 	restore_integrity,
-	did_warn_skip,
+	fail_self_update,
 	sync_development_engines,
 	restore_package_json,
 	main,

package/templates/workflows/github-release.yml

@@ -7,6 +7,9 @@ name: GitHub Release
 # started by the GITHUB_TOKEN never fires one (joshuafolkken/kit#3138). kit's own release is the
 # `create-release` job of its publish.yml, which runs the same `josh release:github`, so this file is
 # distributed but never runs in kit.
+# The title names the tag, so a later tag's release can tell this run is still at work on it.
+run-name: GitHub Release ${{ github.event.client_payload.tag }}
+
 on:
   repository_dispatch:
     types: [new-tag-created]
@@ -67,3 +70,4 @@ jobs:
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
           RELEASE_WORKFLOW: ${{ steps.release.outputs.workflow }}
           RELEASE_AWAIT_PUBLISH: ${{ steps.release.outputs.await }}
+          RELEASE_RUN_WORKFLOW: github-release.yml