@joshuafolkken/kit 1.1240.0 → 1.1370.0

package/scripts/build/hook-bundle-stamp.ts

@@ -1,26 +1,45 @@
 import { createHash } from 'node:crypto'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { json_value } from '#scripts/lib/json-value'
 
 // What a hook build was made from, so a later launch can tell whether `dist/hooks/` still matches the
-// source it runs beside (joshuafolkken/kit#2984). `dist/` is git-ignored and rebuilt only by
+// source it runs beside. `dist/` is git-ignored and rebuilt only by
 // `pnpm build`, so without this record an edited guard keeps running its old bundle with nothing to
 // say so — and a lane's bundles are copied from the main checkout, whose source can differ.
 //
 // **The record is a content digest, not a timestamp.** A copy (`lane-cache.ts`) or a fresh checkout
 // rewrites every mtime while leaving the content alone, and a digest is the only comparison that
-// neither rebuilds on that nor misses an edit that kept the old mtime.
+// neither rebuilds on that nor misses an edit that kept the old mtime. The mtime memory below only
+// decides when the digest is recomputed, never what it is compared against.
 //
 // **The digest is taken from the bytes the build read, never re-read from disk afterwards.** A source
 // edited while the build runs would otherwise be recorded as built, and its stale bundle read as fresh.
 //
+// **A verified digest is remembered by each input's mtime and size**. Hashing
+// every input on every hook launch is the gate's whole cost, so once the digest has matched, the
+// inputs' signatures are written beside the stamp and a later launch whose signatures all match skips
+// the hash. The digest stays the record: a copied or checked-out tree matches no remembered signature
+// and is hashed once, then remembered. Each signature is taken before its input is read, so an edit
+// landing during the hash leaves a signature that no longer matches. The memory is a separate file
+// rather than a rewrite of the stamp, so a launch never races the build that owns the stamp, and the
+// build's prune drops it with the outputs it vouched for.
+//
+// **Nothing is remembered while an input's mtime is still within the timestamp granularity of now.**
+// On a coarse-mtime volume (HFS+ 1 s, FAT/exFAT 2 s) a same-size edit landing in the tick the
+// signature was taken in keeps that signature, so it would be remembered as verified and never hashed
+// again. Once an mtime is older than the window any later write moves it, so only settled inputs are
+// remembered; a launch inside the window simply hashes.
+//
 // This module is loaded by plain `node` on every hook launch (`scripts/hooks/hook-bundle-ready.ts`),
 // so it imports `node:` built-ins and `#scripts/*` subpaths alone — nothing slow to load.
 
 const STAMP_NAME = 'inputs.json'
+const VERIFIED_NAME = '.inputs-verified.json'
 const DIGEST_ALGORITHM = 'sha256'
 const JSON_INDENT = '\t'
+// The coarsest mtime resolution a remembered signature has to outlast (FAT/exFAT).
+const MTIME_GRANULARITY_MS = 2000
 
 interface HookBundleStamp {
 	digest: string
@@ -31,6 +50,20 @@ interface HookBundleStamp {
 // Package-relative input path → the bytes the build read for it.
 type HookSources = ReadonlyMap<string, Uint8Array>
 
+// Package-relative input path → `<mtimeMs>:<size>`, as it stood when its bytes were hashed.
+type InputSignatures = Record<string, string>
+
+interface InputSnapshot {
+	signatures: InputSignatures
+	// False while any input's mtime is too recent to tell a later edit in the same tick apart.
+	is_settled: boolean
+}
+
+interface VerifiedDigest {
+	digest: string
+	signatures: InputSignatures
+}
+
 // Code-unit order, so the digest does not depend on the locale of the machine that computes it.
 function by_code_unit(left: string, right: string): number {
 	if (left === right) return 0
@@ -95,17 +128,86 @@ function read_stamp(out_directory: string): HookBundleStamp | undefined {
 	return is_stamp(stamp) ? stamp : undefined
 }
 
+// Undefined when an input is gone, like `read_sources`.
+function read_snapshot(
+	package_directory: string,
+	inputs: ReadonlyArray<string>,
+): InputSnapshot | undefined {
+	const signatures: InputSignatures = {}
+	const settled_before = Date.now() - MTIME_GRANULARITY_MS
+	let is_settled = true
+
+	for (const input of inputs) {
+		const stats = statSync(path.join(package_directory, input), { throwIfNoEntry: false })
+		if (stats === undefined) return undefined
+		signatures[input] = `${String(stats.mtimeMs)}:${String(stats.size)}`
+		is_settled &&= stats.mtimeMs < settled_before
+	}
+
+	return { signatures, is_settled }
+}
+
+function read_verified(out_directory: string): Record<string, unknown> | undefined {
+	const verified_path = path.join(out_directory, VERIFIED_NAME)
+	if (!existsSync(verified_path)) return undefined
+	const verified = json_value.parse_or_undefined(readFileSync(verified_path, 'utf8'))
+
+	return json_value.is_record(verified) ? verified : undefined
+}
+
+// True when `digest` was verified against inputs whose signatures are all still `signatures`.
+function is_remembered(
+	out_directory: string,
+	digest: string,
+	signatures: InputSignatures,
+): boolean {
+	const verified = read_verified(out_directory)
+	const remembered = verified?.['signatures']
+	if (verified?.['digest'] !== digest || !json_value.is_record(remembered)) return false
+
+	return Object.keys(signatures).every((input) => remembered[input] === signatures[input])
+}
+
+// Written through a rename so a concurrent launch never reads half a record. Best-effort: a tree that
+// cannot be written is simply hashed again next time.
+function remember(out_directory: string, verified: VerifiedDigest): void {
+	const temporary_path = path.join(out_directory, `${VERIFIED_NAME}.${String(process.pid)}`)
+
+	try {
+		writeFileSync(temporary_path, JSON.stringify(verified))
+		renameSync(temporary_path, path.join(out_directory, VERIFIED_NAME))
+	} catch {
+		rmSync(temporary_path, { force: true })
+	}
+}
+
+function is_digest_current(
+	out_directory: string,
+	package_directory: string,
+	stamp: HookBundleStamp,
+	{ signatures, is_settled }: InputSnapshot,
+): boolean {
+	const sources = read_sources(package_directory, stamp.inputs)
+	if (sources === undefined || digest_of(sources) !== stamp.digest) return false
+	if (is_settled) remember(out_directory, { digest: stamp.digest, signatures })
+
+	return true
+}
+
 // Fresh only when the record exists, every output it lists is still there, and the listed inputs hash
-// to the recorded digest — a missing or deleted input counts as stale.
+// to the recorded digest — a missing or deleted input counts as stale. The hash is skipped when the
+// inputs still carry the signatures of an earlier launch that verified this digest.
 function is_fresh(out_directory: string, package_directory: string): boolean {
 	const stamp = read_stamp(out_directory)
 	if (!stamp?.outputs.every((output) => existsSync(path.join(out_directory, output)))) return false
-	const sources = read_sources(package_directory, stamp.inputs)
+	const snapshot = read_snapshot(package_directory, stamp.inputs)
+	if (snapshot === undefined) return false
+	if (is_remembered(out_directory, stamp.digest, snapshot.signatures)) return true
 
-	return sources !== undefined && digest_of(sources) === stamp.digest
+	return is_digest_current(out_directory, package_directory, stamp, snapshot)
 }
 
-const hook_bundle_stamp = { is_fresh, STAMP_NAME, stamp_text }
+const hook_bundle_stamp = { is_fresh, STAMP_NAME, stamp_text, VERIFIED_NAME }
 
 export type { HookSources }
 export { hook_bundle_stamp }

package/scripts/build/local-bin.ts

@@ -25,7 +25,7 @@ function resolve_local_bin(project_root: string, bin_name: string): string {
 
 // pnpm finds a shim by walking up from the working directory, so a caller that resolved only the
 // directory it was invoked in would disagree with the very commands it spawns — `josh gate` typed
-// in `src/lib` would miss the toolkit its sibling checks resolve fine (joshuafolkken/kit#934).
+// in `src/lib` would miss the toolkit its sibling checks resolve fine.
 // Ascending for the shim itself, rather than for a `package.json` first, is what keeps the two in
 // step: a nested manifest that owns no `node_modules` is not where pnpm would stop either.
 function find_local_bin_upwards(start_directory: string, bin_name: string): string | undefined {
@@ -58,7 +58,7 @@ function read_bin_entry(
 // none in a consumer's tree — resolving it from this package's own directory finds it anyway. And
 // pnpm's shim hardcodes the store path of the version present when it was written: after a bump the
 // old store entry is pruned but the shim is not regenerated, so spawning it dies with
-// MODULE_NOT_FOUND (joshuafolkken/kit#668). Returns the CLI entry to hand `process.execPath`, or
+// MODULE_NOT_FOUND. Returns the CLI entry to hand `process.execPath`, or
 // nothing when the package, its `bin` field or the entry on disk is missing — every caller has a
 // slower route to fall back to, so a failure here is never thrown.
 // One constraint worth knowing before adding a caller: this reads the target's manifest through

package/scripts/cases/cases-cli.ts

@@ -3,7 +3,7 @@ import { fileURLToPath } from 'node:url'
 import { cases, type Boundary } from './cases-logic'
 
 // `josh cases <path...>` — print the I/O boundaries the changed paths cross and the abnormal cases
-// each owes (joshuafolkken/kit#2246). The boundary tokens go on stdout so `$(pnpm josh cases …)` reads
+// each owes. The boundary tokens go on stdout so `$(pnpm josh cases …)` reads
 // them; the required cases go on stderr so a person sees them without a shell parsing around them.
 // The logic and the vocabulary live in `cases-logic.ts`; everything here is the invocation.
 

package/scripts/cases/cases-logic.ts

@@ -1,6 +1,6 @@
 import { file_reader } from '#scripts/lib/read-file'
 
-// `josh cases <path...>` (joshuafolkken/kit#2246): read the changed paths and answer which I/O
+// `josh cases <path...>`: read the changed paths and answer which I/O
 // boundaries the code crosses — network, process start, filesystem — then name the abnormal cases
 // that boundary always owes. The unit suite blocks network by construction
 // (`scripts/test/test-network-guard.ts`), so a boundary's abnormal cases never run there; this makes
@@ -50,7 +50,7 @@ const BOUNDARIES: ReadonlyArray<BoundaryDefinition> = [
 		boundary: 'time',
 		// The absence boundary: a change that coordinates over time — timers, schedules, retries,
 		// heartbeats — owes the cases where the awaited thing never happens, which no diff of an I/O
-		// call can surface (joshuafolkken/kit#2356). Same over-firing discipline as process and fs: the
+		// call can surface. Same over-firing discipline as process and fs: the
 		// verbs (`setInterval`, `schedule`, `retry`) require a call paren so prose like "schedule the
 		// release" no longer fires, while the domain nouns (`cron`, `heartbeat`, `watchdog`, `liveness`)
 		// are unambiguous enough in source to match bare.

package/scripts/ci/composite-actions.ts

@@ -3,8 +3,7 @@ import { existsSync, readdirSync } from 'node:fs'
 // A local composite action is one directory under `.github/actions`, and GitHub resolves
 // `uses: ./.github/actions/<name>` to that directory's `action.yml` (or `action.yaml`). Workflow
 // scanners that read `.github/workflows` read these files too: `.github/actions/setup-pnpm` holds
-// the pnpm/setup pin and the safe-chain installer pin kit's workflows used to carry inline
-// (joshuafolkken/kit#2982).
+// the pnpm/setup pin and the safe-chain installer pin kit's workflows used to carry inline.
 const ACTIONS_DIRECTORY = '.github/actions'
 const ACTION_FILE_NAMES = ['action.yml', 'action.yaml']
 

package/scripts/ci/pr-classification.ts

@@ -15,7 +15,7 @@ const CLASSIFICATION_SET: ReadonlySet<string> = new Set(CLASSIFICATION_LABELS)
 const ISSUE_BUG_LABEL = 'bug'
 // The line an Issue body declares its release classification with. A body written by a script
 // (`josh propagate`'s upgrade issue) builds it with `declaration`, so the writer and this parser share
-// one format (joshuafolkken/kit#2858).
+// one format.
 const DECLARATION_PREFIX = '- リリース分類: '
 const DECLARATION = new RegExp(`^${DECLARATION_PREFIX}(.+)$`, 'gmu')
 const LEGACY_LABELS: ReadonlySet<string> = new Set(['semver-major', 'semver-minor'])
@@ -94,7 +94,7 @@ function select_issue_classification(issue_json: string): ReleaseClassification
 // The labels as they stand when the check runs, not as the event carried them. `josh pr` opens the
 // pull request and labels it in a second call, so the `opened` event carries none; judged from the
 // payload, that run fails, and when it lands in the newer check suite GitHub keeps its red result —
-// a rerun replays the same payload and fails again (joshuafolkken/kit#2712).
+// a rerun replays the same payload and fails again.
 function fetch_current_labels(repository: string, pull_number: number): ReadonlyArray<string> {
 	const path = `repos/${repository}/issues/${String(pull_number)}/labels`
 

package/scripts/claude/workflow-destination.ts

@@ -8,7 +8,7 @@ const WORKFLOW_DESTINATION_PATTERN = /(?:^|[/\\])\.github[/\\]workflows[/\\][^/\
 
 // A local composite action is a workflow file too: it pins actions of its own, the distributed
 // `dependabot.yml` bumps it (`/.github/actions/*`), and the next sync writes it back — so it needs
-// the same pins and the same managed stamp as the workflow that calls it (joshuafolkken/kit#3013).
+// the same pins and the same managed stamp as the workflow that calls it.
 const COMPOSITE_ACTION_DESTINATION_PATTERN =
 	/(?:^|[/\\])\.github[/\\]actions[/\\][^/\\]+[/\\]action\.ya?ml$/u
 

package/scripts/clone/clone-aggregate.ts

@@ -1,4 +1,4 @@
-// Grouping fingerprints into clones, and classifying how far each clone spans (joshuafolkken/kit#2217).
+// Grouping fingerprints into clones, and classifying how far each clone spans.
 //
 // This is the pure core the `no-clones` rule was missing a measurement for: `sonarjs/no-identical-
 // functions` sees only inside one file, and the rule's real target is duplication that crosses file

package/scripts/clone/clone-fingerprint.ts

@@ -1,6 +1,6 @@
 import type { Fingerprint } from './clone-aggregate'
 
-// Turning source text into fingerprints (joshuafolkken/kit#2217).
+// Turning source text into fingerprints.
 //
 // A fingerprint is a block of consecutive significant lines, each normalized so that reindentation
 // and reflowed whitespace do not hide a copy. Blank lines and comment-only lines are dropped before

package/scripts/clone/clone-scan-cli.ts

@@ -2,7 +2,7 @@
 import { fileURLToPath } from 'node:url'
 import { clone_scan } from './clone-scan'
 
-// `josh clone:scan` — count duplication across files and repositories (joshuafolkken/kit#2217).
+// `josh clone:scan` — count duplication across files and repositories.
 //
 // A command rather than a paragraph, for the reason `josh repo:party` is one: the `no-clones` rule
 // fires on the agent's own recognition that it is about to copy something, which is exactly the moment

package/scripts/clone/clone-scan.ts

@@ -9,7 +9,7 @@ import {
 } from './clone-aggregate'
 import { clone_fingerprint } from './clone-fingerprint'
 
-// Walking the source trees and reporting the clones (joshuafolkken/kit#2217).
+// Walking the source trees and reporting the clones.
 //
 // The current repository is always scanned; every first-party sibling `repo_discovery` finds —
 // including the ones `JOSH_REPO_PATHS` adds — is scanned too, so a copy that crossed a package

package/scripts/config-merge/index.ts

@@ -3,7 +3,7 @@
 // `import` and tsconfig `extends` patches through `config_merge`, which exposes ensure + remove
 // semantics for one YAML or JSON list field while preserving every other key, value, and ordering.
 // JSON patches rewrite only the targeted field's own value, so comments, trailing commas and the
-// consumer's hand-formatting elsewhere in the document survive (joshuafolkken/kit#798).
+// consumer's hand-formatting elsewhere in the document survive.
 import { json_list } from './patch-json-list'
 import { yaml_list } from './patch-yaml-list'
 

package/scripts/config-merge/json-format.ts

@@ -3,8 +3,7 @@
 // EXCEPT one case: prettier keeps a short array of primitives on a single line when it fits within
 // printWidth, whereas JSON.stringify always expands every non-empty array. We post-process the
 // stringify output, collapsing exactly those arrays back inline — reusing JSON.stringify for all
-// string escaping, number formatting, and key ordering so we never diverge on those. See
-// joshuafolkken/kit#660 (a synced tsconfig `exclude` was emitted multi-line and failed prettier).
+// string escaping, number formatting, and key ordering so we never diverge on those.
 //
 // Scope note: an OVER-width array is left one-element-per-line, which matches prettier for string
 // arrays (the only kind these config files hold). prettier uses a packed "fill" layout only for
@@ -114,7 +113,6 @@ function format_json(value: unknown): string {
 // own line regardless of printWidth — so the inlining above, correct everywhere else, produces a
 // file the consumer's own `prettier --check` rejects. Plain `JSON.stringify` with tab indent is
 // byte-for-byte what that printer emits, so the fix is to skip the inlining rather than model it.
-// See joshuafolkken/kit#797.
 function format_package_json(value: unknown): string {
 	return `${JSON.stringify(value, undefined, '\t')}\n`
 }

package/scripts/config-merge/patch-json-array.ts

@@ -0,0 +1,90 @@
+import { findNodeAtLocation, getNodeValue, parseTree, type Node } from 'jsonc-parser'
+import { json_format } from './json-format'
+import { patch_json_key } from './patch-json-key'
+
+type ElementMatcher = (element: unknown) => boolean
+
+interface ElementUpsert {
+	key: string
+	value: unknown
+	is_target: ElementMatcher
+}
+
+interface ArraySite {
+	property: Node
+	elements: ReadonlyArray<Node>
+}
+
+// `format_json({ [key]: [value] })` opens with `{` and `\t"key": [`, and closes with `\t]`, `}` and
+// the empty string after the final newline; every line between them is the element.
+const PROBE_HEAD_LINES = 2
+const PROBE_TAIL_LINES = 3
+
+function element_nodes(array: Node | undefined): ReadonlyArray<Node> {
+	if (array?.type !== 'array') return []
+
+	return array.children ?? []
+}
+
+// The top-level array `key` holds, when it has at least one element to anchor an edit to.
+function find_array(content: string, key: string): ArraySite | undefined {
+	const root = parseTree(content)
+	const array = root === undefined ? undefined : findNodeAtLocation(root, [key])
+	const elements = element_nodes(array)
+	if (array?.parent === undefined || elements.length === 0) return undefined
+
+	return { property: array.parent, elements }
+}
+
+// The element's text at the depth it occupies in the document — rendered inside a probe of the same
+// shape, so prettier's printWidth decisions for its nested arrays are measured at that depth. The
+// first line carries no indent: it is spliced in where the element's line already starts.
+function render_element(content: string, site: ArraySite, upsert: ElementUpsert): string {
+	const lines = json_format.format_json({ [upsert.key]: [upsert.value] }).split('\n')
+	const text = lines.slice(PROBE_HEAD_LINES, -PROBE_TAIL_LINES).join('\n')
+	const unit = patch_json_key.line_indent(content, site.property.offset)
+
+	return patch_json_key.fit_value(content, text, unit).trimStart()
+}
+
+function splice(content: string, node: Node, length: number, text: string): string {
+	return content.slice(0, node.offset) + text + content.slice(node.offset + length)
+}
+
+function append_element(content: string, last: Node, element_text: string): string {
+	const indent = patch_json_key.line_indent(content, last.offset)
+	const text = `,${patch_json_key.eol_of(content)}${indent}${element_text}`
+	const end = { ...last, offset: last.offset + last.length }
+
+	return splice(content, end, 0, text)
+}
+
+function is_equal(node: Node, value: unknown): boolean {
+	return JSON.stringify(getNodeValue(node)) === JSON.stringify(value)
+}
+
+function upsert_in(content: string, site: ArraySite, upsert: ElementUpsert): string {
+	const target = site.elements.find((element) => upsert.is_target(getNodeValue(element)))
+	if (target !== undefined && is_equal(target, upsert.value)) return content
+	const element_text = render_element(content, site, upsert)
+	if (target !== undefined) return splice(content, target, target.length, element_text)
+	const last = site.elements.at(-1)
+
+	return last === undefined ? content : append_element(content, last, element_text)
+}
+
+// Replace the element `is_target` picks with `value`, or append `value` when none matches — touching
+// only that one element's text. Rewriting the whole array, as `set_json_key` does, would drop every
+// comment and hand-layout inside the elements the consumer owns. An element
+// already equal to `value` is left byte-for-byte as authored; an absent or empty array is created.
+function upsert_element(content: string, upsert: ElementUpsert): string {
+	const site = find_array(content, upsert.key)
+	if (site === undefined) return patch_json_key.set_json_key(content, upsert.key, [upsert.value])
+
+	return upsert_in(content, site, upsert)
+}
+
+const patch_json_array = { upsert_element }
+
+export type { ElementMatcher, ElementUpsert }
+export { patch_json_array }

package/scripts/config-merge/patch-json-key.ts

@@ -14,14 +14,14 @@ import { json_format } from './json-format'
 // tolerant JSONC parse and write the whole file back from the parsed object, which silently deleted
 // the consumer's comments — including the `// Path aliases are handled by ...` block `sv create`
 // ships. Editing text in place instead keeps comments, trailing commas, key order and any
-// hand-formatting outside the one value being changed. See joshuafolkken/kit#798.
+// hand-formatting outside the one value being changed.
 //
 // jsonc-parser is used ONLY to locate text, never to produce it. Two independent reasons:
 //
 //  1. Its formatter breaks every array one element per line regardless of width — the layout
 //     prettier wants for `package.json`, and the opposite of what it wants for the files edited
-//     here, where the `json` printer keeps a short array inline. Letting it render would
-//     re-introduce joshuafolkken/kit#797 on a new axis.
+//     here, where the `json` printer keeps a short array inline. Letting it render would fail
+//     `prettier --check` on the rewritten file.
 //  2. `modify` with `formattingOptions` reformats a region around its edit, not just the edit —
 //     removing `compilerOptions` from a document also expanded the untouched `extends` array above
 //     it. Dropping `formattingOptions` avoids that but then places inserted keys with no newline or
@@ -441,6 +441,9 @@ const patch_json_key = {
 	set_json_key,
 	remove_json_key,
 	remove_json_path,
+	eol_of,
+	fit_value,
+	line_indent,
 }
 
 export { patch_json_key }

package/scripts/config-merge/patch-json-list.ts

@@ -20,7 +20,7 @@ function normalize_list(value: unknown): ReadonlyArray<string> {
 // Ensure/remove the entries of one JSON list field, preserving every other key. A present field
 // keeps its position; a new field is appended last. Returns the input unchanged when nothing is
 // added or removed, so re-runs are idempotent. Only the field's own value is rewritten, so comments
-// and formatting elsewhere in the document survive (joshuafolkken/kit#798).
+// and formatting elsewhere in the document survive.
 function patch_json_list_field(content: string, options: PatchJsonListOptions): string {
 	const parsed = parse_jsonc(content)
 	const existing = normalize_list(parsed[options.field])

package/scripts/cost-runtime/codex-usage.ts

@@ -28,7 +28,7 @@ function same_project(cwd: string, target: string): boolean {
 	return cost_transcript.session_cwd(cwd) === cost_transcript.session_cwd(target)
 }
 
-// The billed input each request paid, oldest first (joshuafolkken/kit#2295). Each `token_count`
+// The billed input each request paid, oldest first. Each `token_count`
 // event carries `last_token_usage` — that request's own input — so the per-request sequence the
 // hand-off's recent window reads is those deltas, not a cumulative-total difference. A session
 // resumed with inherited context is excluded for free: the inherited tokens are in the cumulative

package/scripts/cost-runtime/context-cut-payback.ts

@@ -1,7 +1,7 @@
 import { cost_pricing } from './cost-pricing'
 
-// **When a context cut pays back, priced from the cost model rather than fixed at a ceiling**
-// (joshuafolkken/kit#2406). A cut ends the oversized session and relaunches a fresh one that rebuilds
+// **When a context cut pays back, priced from the cost model rather than fixed at a ceiling**.
+// A cut ends the oversized session and relaunches a fresh one that rebuilds
 // only its preamble, so what it saves is not decided by a ceiling on the accumulated context but by a
 // *rate*: a cache read bills the whole context on every request, so whether to cut turns on how many
 // requests are still to come and what each would pay, not on how much has piled up.
@@ -21,9 +21,8 @@ const POST_CUT_CONTEXT = 60_000
 // The requests a resumed session is expected to still run — the horizon the break-even is measured
 // against. A cut only pays if enough requests remain to recoup the preamble rewrite; even the shortest
 // resume (into the gate, commit, PR and merge) runs on the order of ten. Ten is the conservative
-// horizon: it keeps the shared threshold near joshuafolkken/kit#2374's empirically validated 150_000
-// (this lands at 135_000, inside the 100k–200k band that PR simulated) while pricing the decision from
-// the cost model. It is the knob a before/after lane measurement tunes.
+// horizon: it keeps the shared threshold near the empirically validated 150_000 (this lands at
+// 135_000, inside the simulated 100k–200k band) while pricing the decision from the cost model. It is the knob a before/after lane measurement tunes.
 const EXPECTED_REMAINING_REQUESTS = 10
 
 // The price of a dropped token relative to a rewritten one, from `cost-pricing.ts`. A cache read bills

package/scripts/cost-runtime/context-cut-threshold.ts

@@ -2,12 +2,10 @@ import { context_cut_payback } from './context-cut-payback'
 
 // The scheduler entry/hand-off and lane worker implementation cut use one threshold. Keeping the
 // value here prevents either side from drifting when the context budget changes.
-// joshuafolkken/kit#2374 lowered it from 200_000 by simulation; joshuafolkken/kit#2406 replaced the
-// hand-picked ceiling with a break-even: the threshold is no longer a chosen number but the current
-// per-request context at which a cut pays back over the expected remaining requests
-// (`context-cut-payback.ts`). At `POST_CUT_CONTEXT` 60_000 and a 10-request horizon that is 135_000 —
-// 10% under #2374's empirical 150_000 and inside the 100k–200k band that PR simulated — now derived
-// from the cache-price multipliers and the horizon rather than restated, so it moves with the model.
+// The threshold is a break-even, not a chosen number: the current per-request context at which a
+// cut pays back over the expected remaining requests (`context-cut-payback.ts`). At
+// `POST_CUT_CONTEXT` 60_000 and a 10-request horizon that is 135_000, derived from the cache-price
+// multipliers and the horizon rather than restated, so it moves with the model.
 const CONTEXT_CUT_THRESHOLD = context_cut_payback.break_even_context()
 
 export { CONTEXT_CUT_THRESHOLD }

package/scripts/cost-runtime/cost-attribute.ts

@@ -1,9 +1,9 @@
 import type { UsageRecord } from './cost-usage'
 
-// Which Issue a request belongs to (joshuafolkken/kit#962).
+// Which Issue a request belongs to.
 //
 // **The walk is keyed on the branch and nothing else**, which is why its input is `BranchBearing`
-// rather than `UsageRecord` (joshuafolkken/kit#1268). `josh time` attributes *spans* to an issue by
+// rather than `UsageRecord`. `josh time` attributes *spans* to an issue by
 // exactly this rule, and the alternative to widening the parameter was a second copy of the
 // fill-forward walk over a different element type — the clone `CLAUDE.md` prohibits, in the one
 // place where a drift between the two would make `josh cost --issue` and `josh time --issue`
@@ -28,7 +28,7 @@ const UNATTRIBUTED_KEY = -1
 
 // Everything the attribution reads. `UsageRecord` satisfies it, and so does a timed span.
 //
-// **`issue` is the branch's answer where the branch cannot give one** (joshuafolkken/kit#1617). The
+// **`issue` is the branch's answer where the branch cannot give one**. The
 // paragraph above assumes the session and the work share a checkout, and under lanes they do not: a
 // child's commands run in a linked work tree on `<N>-lane` while the session writing the transcript
 // sits on the default branch, so every line of a lane run reads `gitBranch: "main"` and no fill

package/scripts/cost-runtime/cost-blocks.ts

@@ -1,7 +1,7 @@
 import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 
-// Reading the content blocks out of a session transcript (joshuafolkken/kit#1151).
+// Reading the content blocks out of a session transcript.
 //
 // `cost-usage.ts` reads the same file for what each request was billed and skips everything else.
 // This module reads the other half: what the conversation is actually made of. They stay apart
@@ -43,9 +43,8 @@ const BASH_TOOL = 'Bash'
 const COMMAND_KEY = 'command'
 
 // One block, reduced to what a token estimate needs. `command` is split out from the rest of a Bash
-// tool_use's input because the command body is the quantity joshuafolkken/kit#1150 measured at 30.2%
-// of one run's context and joshuafolkken/kit#1159 has to re-measure — folded into the rest of the
-// input it would not be readable at all.
+// tool_use's input because the command body is a large, separately measured share of a run's
+// context — folded into the rest of the input it would not be readable at all.
 interface ContentBlock {
 	type: string
 	tool_name: string

package/scripts/cost-runtime/cost-cli.ts

@@ -12,7 +12,7 @@ import { own_session } from './own-session'
 import { transcript_cwd } from './transcript-cwd'
 
 // `josh cost` — what the next turn of a run will cost, read from the active provider's own session
-// usage (joshuafolkken/kit#962).
+// usage.
 //
 // Since #2016 this is the `--over` hand-off verdict alone. The readerless report scopes
 // (`--session` / `--issue` / `--all` / `--run` / `--json`) and the `--cap` counterfactual were
@@ -32,7 +32,7 @@ type CostVerdict = ReturnType<typeof cost_verdict.classify> | typeof UNMEASURABL
 interface Options {
 	over?: number
 	// The target project whose transcripts to read, or absent for this process's own working
-	// directory (joshuafolkken/kit#1987). From the kit checkout, `--path <dir>` reads another
+	// directory. From the kit checkout, `--path <dir>` reads another
 	// project's cost.
 	path?: string
 }
@@ -110,7 +110,7 @@ function parse_options(argv: ReadonlyArray<string>): Options | undefined {
 
 // An empty corpus is reported, never priced at zero. "No transcript was found" and "this run was
 // free" are different answers, and only one of them is ever true. `session_id` names the session the
-// environment pointed at when its transcript is the one absent (joshuafolkken/kit#2403), so the
+// environment pointed at when its transcript is the one absent, so the
 // message says "No transcript named <id>" rather than the whole-corpus "No transcripts found". The
 // wording is `cost_transcript`'s, so `josh time` says the same thing about the same directory.
 function report_empty(cwd: string, session_id: string | undefined): number {
@@ -121,14 +121,17 @@ function report_empty(cwd: string, session_id: string | undefined): number {
 	return FAILURE_EXIT_CODE
 }
 
+// The provider of this process's own session. A defaulted provider is no session at all: a launch may
+// default to Claude Code, but pricing here would measure the newest transcript of some other session.
 function provider_of(environment: Environment): AgentProvider | undefined {
 	const resolved = agent_role_profile.resolve_provider(environment)
+	if (resolved.kind !== 'provider' || resolved.is_default === true) return undefined
 
-	return resolved.kind === 'provider' ? resolved.provider : undefined
+	return resolved.provider
 }
 
 // The own-session measurement, and — when there is none — which of the two "nothing to measure"
-// answers it is (joshuafolkken/kit#2403). `absent`: the environment named a session whose transcript
+// answers it is. `absent`: the environment named a session whose transcript
 // is not in this corpus, reported by that name and never measured as another session's newest file.
 // `empty`: no transcript at all. `measured` still carries a session that exists but billed nothing,
 // which `report_over` reports as "no requests" — a third, distinct answer.
@@ -200,7 +203,7 @@ function measure(
 // `--over` for the anthropic provider: measured → the verdict; `absent` → the named session's
 // missing message; `empty` → the whole-corpus missing message. A measured session that billed
 // nothing falls to `report_over`'s "no requests", which keeps a 0-request transcript distinct from a
-// transcript that is not there at all (joshuafolkken/kit#2403).
+// transcript that is not there at all.
 function run_over_anthropic(own: OwnMeasurement, target: string, limit: number): number {
 	if (own.kind === 'measured') return cost_verdict.report_over(own.measurement, limit)
 
@@ -217,7 +220,7 @@ function run_over_codex(target: string, limit: number, environment: Environment)
 }
 
 // `--over`: what the next turn of this session will cost, read from the session's own transcript
-// alone — identified by id, not by mtime (joshuafolkken/kit#2403).
+// alone — identified by id, not by mtime.
 function run_over(
 	target: string,
 	limit: number,
@@ -241,7 +244,7 @@ function verdict_of(measurement: OverMeasurement | undefined): CostVerdict {
 	return cost_verdict.classify(measurement, CONTEXT_CUT_THRESHOLD)
 }
 
-// The `--cut` verdict as a value, printing nothing (joshuafolkken/kit#2165). `run:status` bundles
+// The `--cut` verdict as a value, printing nothing. `run:status` bundles
 // this beside the issue state and the carry record, so it needs the token rather than the exit code
 // `run` returns. `unmeasurable` is the read-only counterpart of `report_empty` / the empty-session
 // error: a session with no provider, no transcript of its own, or no request cannot be priced, and
@@ -269,8 +272,8 @@ function run_context(
 }
 
 // This process's own working directory, kept as-is: from a lane the transcript search covers the
-// lane's own slug alone (joshuafolkken/kit#2236), so pre-rewriting the cwd to the main checkout here
-// would drop the lane's own slug and hide a dispatched child's transcript (joshuafolkken/kit#1749).
+// lane's own slug alone, so pre-rewriting the cwd to the main checkout here
+// would drop the lane's own slug and hide a dispatched child's transcript.
 // `time-cli.ts` gives the same reason.
 function run(
 	argv: ReadonlyArray<string>,
@@ -285,7 +288,7 @@ function run(
 		return FAILURE_EXIT_CODE
 	}
 
-	// `--path <dir>` reads the target project instead of the process cwd (joshuafolkken/kit#1987).
+	// `--path <dir>` reads the target project instead of the process cwd.
 	const target = transcript_cwd.resolve(context.path, cwd)
 	if (reject_openai_cross_project(context, target, cwd)) return FAILURE_EXIT_CODE