@joshuafolkken/kit 1.1373.0 → 1.1383.0

package/scripts/run/event/run-event-stream.ts

@@ -29,7 +29,7 @@ const EVENT_PREFIX = 'josh-run-events-'
 // every reader — a person, an editor — that it is a line stream rather than a single document, the same
 // distinction the ambient `.log` draws.
 const EVENT_SUFFIX = '.jsonl'
-// A run's session-facing events over the 8-hour whole-run bound: a plan, a launch/PR/review-round/merge
+// A run's session-facing events over one unattended night: a plan, a launch/PR/review-round/merge
 // per child across a few dozen children, plus parks, cuts and stops. Five hundred keeps the whole of a
 // large `backlogrun` and still bounds an unattended run — past it the oldest events roll off.
 const EVENT_CAP = 500
@@ -106,11 +106,6 @@ const EVENT_KIND = {
 	// The position that hands control back: `run:step` prints the command that
 	// shows the stopped report, so the agent fixes it and relaunches rather than rebuilding the context.
 	SHIP_STOP: 'ship-stop',
-	// The idle watch's window — when the run began waiting on an empty backlog and when that wait ends
-	// `backlog:offer` writes it whenever the window changes, so `run:board` reads
-	// the deadline rather than guessing it. It is a trace: `emit_once`'s drain dedup and `run:step`'s
-	// position both read past it, so a watching loop never re-marks the drain it is waiting after.
-	IDLE: 'idle',
 	// An Issue the run filed on its way, written by `issue:file`, so a run started from the command line
 	// still surfaces what it found — `run:board`'s findings section reads it.
 	FILED: 'filed',
@@ -141,7 +136,6 @@ const EVENT_KINDS: ReadonlyArray<string> = Object.values(EVENT_KIND)
 const TRACE_KINDS: ReadonlySet<string> = new Set([
 	EVENT_KIND.SHIP_STAGE,
 	EVENT_KIND.HEARTBEAT,
-	EVENT_KIND.IDLE,
 	EVENT_KIND.FILED,
 	EVENT_KIND.NOTE,
 	EVENT_KIND.LANE_PHASE,
@@ -151,13 +145,9 @@ const TRACE_KINDS: ReadonlySet<string> = new Set([
 
 // The trace kinds that say only that the run was alive, so the bound rolls them off first. A `filed` or
 // `note` line is a trace to the position readers but is the board's record of what the run found, so
-// it rolls off only with the positions. A ship-stage `start` and an `idle` line are disposable but go
-// last of them: `run:board` draws from those lines.
-const DISPOSABLE_KINDS: ReadonlySet<string> = new Set([
-	EVENT_KIND.SHIP_STAGE,
-	EVENT_KIND.HEARTBEAT,
-	EVENT_KIND.IDLE,
-])
+// it rolls off only with the positions. A ship-stage `start` is disposable but goes last of them:
+// `run:board` draws from that line.
+const DISPOSABLE_KINDS: ReadonlySet<string> = new Set([EVENT_KIND.SHIP_STAGE, EVENT_KIND.HEARTBEAT])
 
 const event_schema = z.object({
 	pos: z.number(),
@@ -200,9 +190,10 @@ function parse_line(line: string): RunEvent | undefined {
 	return event_schema.safeParse(json_value.parse_or_undefined(line)).data
 }
 
-// Every event on the stream, oldest first. An absent or unreadable file is an empty stream, the same
-// fail-quiet direction `stamp_file.read_stamp_text` takes for a planted or unowned file.
-function read_events(target: string): ReadonlyArray<RunEvent> {
+// Every line on the stream that parses, oldest first, whatever its kind. An absent or unreadable file
+// is an empty stream, the same fail-quiet direction `stamp_file.read_stamp_text` takes for a planted or
+// unowned file.
+function read_lines(target: string): ReadonlyArray<RunEvent> {
 	const raw = stamp_file.read_stamp_text(target)
 
 	if (raw === undefined) return []
@@ -215,6 +206,13 @@ function read_events(target: string): ReadonlyArray<RunEvent> {
 		.filter(is_present)
 }
 
+// Every event on the stream, oldest first. A line whose kind the enumeration no longer names — one a
+// previous version wrote — reads as no event, so no reader takes it for a position or for the run's
+// newest activity.
+function read_events(target: string): ReadonlyArray<RunEvent> {
+	return read_lines(target).filter((event) => is_event_kind(event.kind))
+}
+
 function last_position(events: ReadonlyArray<RunEvent>): number {
 	return events[events.length - POSITION_INCREMENT]?.pos ?? FIRST_POSITION
 }
@@ -243,12 +241,6 @@ function is_stage_start(event: RunEvent): boolean {
 	return event.text.split(WORD_SEPARATOR)[STAGE_PHASE_INDEX] === run_ship_stage.PHASE.START
 }
 
-// A disposable line `run:board` draws from: a ship-stage `start` is a phase on a lane's track, and an
-// `idle` line is the deadline of the run's wait.
-function is_drawn(event: RunEvent): boolean {
-	return event.kind === EVENT_KIND.IDLE || is_stage_start(event)
-}
-
 // The lines the bound may drop, in the order it drops them: the ones that draw nothing first, then the
 // ones `run:board` draws from, each group oldest first.
 function droppable(events: ReadonlyArray<RunEvent>): ReadonlyArray<RunEvent> {
@@ -256,8 +248,8 @@ function droppable(events: ReadonlyArray<RunEvent>): ReadonlyArray<RunEvent> {
 	const disposable = events.filter((event) => DISPOSABLE_KINDS.has(event.kind) && !kept.has(event))
 
 	return [
-		...disposable.filter((event) => !is_drawn(event)),
-		...disposable.filter((event) => is_drawn(event)),
+		...disposable.filter((event) => !is_stage_start(event)),
+		...disposable.filter((event) => is_stage_start(event)),
 	]
 }
 
@@ -272,8 +264,7 @@ function droppable(events: ReadonlyArray<RunEvent>): ReadonlyArray<RunEvent> {
 // append.
 //
 // **A ship-stage `start` outlasts the other disposable lines**: each one is a phase on the lane's track,
-// so it is kept past the `done` lines and the heartbeats. An `idle` line goes with them, oldest first,
-// so a run's newest wait is not the first line a stream of starts and positions gives up.
+// so it is kept past the `done` lines and the heartbeats.
 //
 // **The kept line carries the history**: on a stream the positions fill, every append still rolls off
 // the issue's previous stage line, so the newest one lists every stage its
@@ -293,11 +284,12 @@ function serialize(events: ReadonlyArray<RunEvent>): string {
 }
 
 // The read-modify-write, run only while the stream's lock is held. `replace_text_stamp` publishes the
-// rewrite with a rename, so a reader never sees the stream absent or half-written.
+// rewrite with a rename, so a reader never sees the stream absent or half-written. The position counts
+// on from every line the file holds, so a line of a retired kind — dropped by this rewrite — never
+// hands its position to a new event.
 function append_held(target: string, event: Omit<RunEvent, 'pos'>): number {
-	const existing = read_events(target)
-	const position = last_position(existing) + POSITION_INCREMENT
-	const events = bounded([...existing, { pos: position, ...event }])
+	const position = last_position(read_lines(target)) + POSITION_INCREMENT
+	const events = bounded([...read_events(target), { pos: position, ...event }])
 
 	stamp_file.replace_text_stamp(target, serialize(events))
 

package/scripts/run/merge/run-merge-collect.ts

@@ -93,7 +93,7 @@ async function collect_carried(carry: RunCarry): Promise<void> {
 async function collect_merged(directory: string): Promise<void> {
 	const read = run_carry.read_carry(run_carry.carry_path(directory))
 
-	if (read.kind !== 'carried' && read.kind !== 'expired') return
+	if (read.kind !== 'carried') return
 
 	try {
 		await collect_carried(read.carry)

package/scripts/run/merge/run-merge-steps.ts

@@ -102,7 +102,7 @@ async function read_record(): Promise<{ target: string; carry: RunCarry } | unde
 	const target = run_carry.carry_path(directory)
 	const read = run_carry.read_carry(target)
 
-	if (read.kind !== 'carried' && read.kind !== 'expired') return undefined
+	if (read.kind !== 'carried') return undefined
 
 	return { target, carry: read.carry }
 }

package/scripts/run/progress/run-progress-read.ts

@@ -123,7 +123,7 @@ function is_hold_present(read: HoldRead): boolean {
 }
 
 function is_carry_present(read: CarryRead): boolean {
-	return read.kind === 'carried' || read.kind === 'expired'
+	return read.kind === 'carried'
 }
 
 function hold_present(worktree: string | undefined): boolean {

package/scripts/run/run-headless.ts

@@ -44,8 +44,8 @@ function is_cut_capped(carry: RunCarry, source: EnvironmentSource = process.env)
 }
 
 // Only a live, un-handed-off record binds the session to its lanes. After `run:carry --cut` the next
-// successor drives them, and after `--end` (`none`) or past the bound (`expired`) there is no run left
-// to drive — ending the turn is correct in all three. An unreadable record fails open, as every stop
+// successor drives them, and after `--end` (`none`) there is no run left to drive — ending the turn is
+// correct in both. An unreadable record fails open, as every stop
 // rule does (`stop-guard.ts`).
 function is_driving(read: CarryRead | undefined): boolean {
 	return read?.kind === 'carried' && read.carry.is_handed_off !== true

package/scripts/run/run-status-cli.ts

@@ -25,7 +25,6 @@ const USAGE = 'Usage: josh run:status <issue-number> [--repo <owner/repo>]'
 const CARRY_NONE_NOTE = 'no run recorded here'
 const CARRY_UNREADABLE_NOTE = '(run record not bundled: unreadable)'
 const CARRY_SUMMARY_NONE = 'none'
-const CARRY_SUMMARY_EXPIRED = 'expired'
 const CARRY_SUMMARY_UNREADABLE = 'unreadable'
 const MERGED_SUFFIX = ' merged'
 
@@ -94,16 +93,13 @@ function failure_note(issue_number: string, kind: string): string {
 
 function carry_summary(carry: CarryRead): string {
 	if (carry.kind === 'carried') return `${String(carry.carry.merged)}${MERGED_SUFFIX}`
-	if (carry.kind === 'expired') return CARRY_SUMMARY_EXPIRED
 	if (carry.kind === 'unreadable') return CARRY_SUMMARY_UNREADABLE
 
 	return CARRY_SUMMARY_NONE
 }
 
 function carry_detail(carry: CarryRead): string {
-	if (carry.kind === 'carried' || carry.kind === 'expired') {
-		return run_carry.describe_carry(carry.carry)
-	}
+	if (carry.kind === 'carried') return run_carry.describe_carry(carry.carry)
 
 	if (carry.kind === 'unreadable') return CARRY_UNREADABLE_NOTE
 

package/scripts/run/run-step.ts

@@ -46,11 +46,6 @@ const VOCABULARY: ReadonlyArray<string> = [
 	UNKNOWN,
 ]
 
-// The whole-run bound is spent, and carrying the budget or discarding it is a person's call — the one
-// Tier-B point this machine surfaces rather than choosing.
-const EXPIRED_DECISION =
-	'decide: whole-run budget spent — resume with `pnpm josh run:carry --resume` | discard with `pnpm josh run:carry --end`'
-
 // The one step a stopped run still owes before it ends: the end-of-run retrospective.
 // It reads the run's own measurements and files the improvements worth carrying into the next run;
 // the command is kit-only, so it means nothing — and is never printed — in a consumer project.
@@ -288,12 +283,11 @@ function is_handed_off_parent(input: CarryFacts): boolean {
 	return input.is_handed_off && input.carry_kind === 'carried' && !input.is_lane_child
 }
 
-// The carry record's terminal answers: an unreadable record leaves the position unknowable, a handed-off
-// run is its successor's, and a spent budget is the person's call.
+// The carry record's terminal answers: an unreadable record leaves the position unknowable, and a
+// handed-off run is its successor's.
 function carry_terminal_action(input: CarryFacts): StepAction | undefined {
 	if (input.carry_kind === 'unreadable') return verdict(UNKNOWN)
 	if (is_handed_off_parent(input)) return verdict(STOP)
-	if (input.carry_kind === 'expired') return { kind: 'decide', line: EXPIRED_DECISION }
 
 	return undefined
 }
@@ -371,7 +365,6 @@ function next_action(input: StepInput): StepAction {
 
 const run_step = {
 	ALREADY_DONE,
-	EXPIRED_DECISION,
 	HAND_OFF_COMMAND,
 	HUMAN_REVIEW,
 	IMPLEMENT,

package/scripts/run/run-stop-notify.ts

@@ -28,7 +28,7 @@ const STOP_RECOVERY =
 // nothing readable there is no run this can honestly say stopped.
 function plan(read: CarryRead, reason: string | undefined): StopNotice | undefined {
 	if (reason === undefined || reason.length === 0) return undefined
-	if (read.kind !== 'carried' && read.kind !== 'expired') return undefined
+	if (read.kind !== 'carried') return undefined
 
 	return { reason }
 }

package/scripts/run/run-stranded-detect.ts

@@ -18,7 +18,7 @@ import {
 //
 // **Cheap and local.** Every read is a file on disk — the carry record, the wake record — and a process
 // liveness probe; there is no network call, so unlike the stall detector this makes every read every
-// time. The gate is the carry record itself: nothing carried, or a record that is expired or unreadable,
+// time. The gate is the carry record itself: nothing carried, or a record that is unreadable,
 // returns before the wake record is even read.
 
 // The recovery line names the command that hands the run to a fresh supervisor — the same one the pure
@@ -74,8 +74,8 @@ const DEFAULT_PORTS: DetectPorts = {
 	notify_stranded: real_notify_stranded,
 }
 
-// The three facts, assembled behind the carry-record gate. A non-`carried` read — nothing carried, a
-// spent bound, or an unreadable record — is `undefined`: there is no live budget to be stranded, so the
+// The three facts, assembled behind the carry-record gate. A non-`carried` read — nothing carried, or
+// an unreadable record — is `undefined`: there is no live budget to be stranded, so the
 // wake record is never read and the judge is never asked.
 async function gather(ports: DetectPorts): Promise<StrandedInput | undefined> {
 	const targets = await ports.resolve_targets()

package/scripts/run/run-stranded.ts

@@ -2,10 +2,10 @@ import { process_identity } from '#scripts/josh/process-identity'
 import { run_carry, type CarryRead, type RunCarry } from '#scripts/run/carry/run-carry'
 import type { RunWake } from '#scripts/run/wake/run-wake'
 
-// The mechanical judge of a *stranded* run: a handed-off budget whose cutting session died, with no
-// successor claiming it and no supervisor watching, so lanes run on with nobody driving. Three facts,
-// read and never weighed, are what say that state has been reached: the budget was handed off, its
-// owner is gone, and no supervisor is alive to wake a successor.
+// The mechanical judge of a *stranded* run: a budget whose owning session died — at a cut it handed
+// off, or with no hand-off at all — with no successor holding it and no supervisor watching, so lanes
+// run on with nobody driving. Three facts, read and never weighed, are what say that state has been
+// reached: the record names a driver, that owner is gone, and no supervisor is alive to wake a successor.
 //
 // **Pure by design, exactly as `backlog-stalled.ts` is.** The carry read, the owner's liveness and the
 // supervisor's are handed in, so the four acceptance cases — all three holding, a live owner, a claimed
@@ -72,19 +72,27 @@ function supervisor_liveness(
 	return is_same ? LIVE : GONE
 }
 
-// **The whole of the judgement, in four reads.** The carry record must be `carried` — an `expired`,
-// `none` or `unreadable` read is never a strand, because there is either no budget to strand or no way
-// to trust what the record says. It must be handed off and *not* yet adopted — `adopt_carry` spends
-// `is_handed_off` the instant a successor claims it, so a claimed successor reads `false` here. The owner
-// must be gone — a live owner is a session still spending the budget, the ordinary in-flight state. And
-// the supervisor must be `gone` — `live` or `unknown` both count as something that could still wake a
-// successor, so only a proven-absent supervisor completes the strand.
+// Whether the record names a driver whose absence can be proven: a hand-off waiting for its successor,
+// or an owner process. A record with neither was begun by nobody this machine can probe, and an
+// unprovable owner is never a strand.
+function had_driver(carry: RunCarry): boolean {
+	return carry.is_handed_off === true || carry.owner_pid !== undefined
+}
+
+// **The whole of the judgement, in four reads.** The carry record must be `carried` — a `none` or
+// `unreadable` read is never a strand, because there is either no run to strand or no way to trust
+// what the record says. The owner must be gone — a live owner is a session still spending the budget,
+// the ordinary in-flight state, and a successor that claimed a hand-off is that live owner, since
+// `adopt_carry` rewrites the owner as it spends `is_handed_off`. The record must name the driver that
+// is gone (`had_driver`). And the supervisor must be `gone` — `live` or `unknown` both count as
+// something that could still wake a successor, so only a proven-absent supervisor completes the strand.
+//
+// **A hand-off is not required.** An owner that died between its claim and the next cut — the
+// supervisor killed mid-drive, an interactive parent's terminal closed — leaves a record no cut handed
+// off, and with no supervisor nothing drives it either. `run-wake.ts` → `decide_not_handed_off`
+// recovers exactly that record, so the recovery the notification names holds for it too.
 function is_stranded(input: StrandedInput): boolean {
-	if (
-		input.read.kind !== 'carried' ||
-		input.read.carry.is_handed_off !== true ||
-		input.is_owner_live
-	) {
+	if (input.read.kind !== 'carried' || input.is_owner_live || !had_driver(input.read.carry)) {
 		return false
 	}
 
@@ -94,7 +102,7 @@ function is_stranded(input: StrandedInput): boolean {
 // The one line a person reads in the notification and on the stream: which run is stranded, and why. The
 // carry record's own summary carries the counts; this frames it as the strand it is.
 function describe(carry: RunCarry): string {
-	return `Run stranded — ${run_carry.describe_carry(carry)}. The owner is gone, no cut successor claimed the budget, and no supervisor is watching.`
+	return `Run stranded — ${run_carry.describe_carry(carry)}. The owner is gone, no successor holds the budget, and no supervisor is watching.`
 }
 
 function verdict_of(is_run_stranded: boolean): StrandedVerdict {

package/scripts/run/wake/run-wake-cli.ts

@@ -3,6 +3,7 @@ import { randomUUID } from 'node:crypto'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { AgentProfile } from '#scripts/agent/agent-role-profile'
+import { backlog_budget } from '#scripts/backlog/backlog-budget'
 import { cli_flags } from '#scripts/lib/cli-flags'
 import { poll } from '#scripts/lib/poll'
 import { telegram_notify } from '#scripts/notify/telegram-notify'
@@ -34,7 +35,6 @@ const FAILURE_EXIT_CODE = 1
 const ARGV_OFFSET = 2
 const ONE_GROUP = 1
 const MS_PER_SECOND = 1000
-const DEFAULT_INTERVAL_SECONDS = 60
 // Whole and positive. A zero interval is a busy loop against the temp directory, not a faster
 // supervisor.
 const INTERVAL_PATTERN = /^[1-9]\d*$/u
@@ -71,17 +71,15 @@ const WARNING_RECOVERY = `Check the wake command, then restart with \`pnpm josh
 // `stopped` is a person's own `--stop` or a supervisor being superseded, and a warning channel that
 // fired on those is one that stops being read.
 //
-// **`expired` and `unreadable` warn**, because both end the supervisor while a carry record is still
-// sitting there handed off, so the run would otherwise be left asleep with nothing anywhere saying so.
+// **`unreadable` warns**, because it ends the supervisor while a carry record is still sitting there
+// handed off, so the run would otherwise be left asleep with nothing anywhere saying so.
 // **Every reason is listed, and the silent two are listed as `undefined`.** A partial map would let a
-// sixth stop reason compile straight past this and reach nobody, which is the defect class this
+// fifth stop reason compile straight past this and reach nobody, which is the defect class this
 // section exists to close.
 const STOP_BODIES: Record<WakeStopReason, string | undefined> = {
 	ended: undefined,
 	stopped: undefined,
 	failed: 'The supervisor could not continue the run and has stopped.',
-	expired:
-		'The carried run passed its whole-run bound, so the supervisor stopped without continuing it.',
 	unreadable:
 		'The carry record could not be read, so the supervisor stopped rather than guess at it.',
 }
@@ -118,7 +116,7 @@ function note_to_stderr(note: string): void {
 }
 
 function to_interval_ms(value: string | boolean | undefined): number | undefined {
-	if (typeof value !== 'string') return DEFAULT_INTERVAL_SECONDS * MS_PER_SECOND
+	if (typeof value !== 'string') return backlog_budget.OFFER_INTERVAL_MS
 	if (!INTERVAL_PATTERN.test(value)) return undefined
 
 	const seconds = Number(value)
@@ -221,9 +219,9 @@ async function warn_of_stop(stop: LoopStop, body: string, context: WakeContext):
 	})
 }
 
-// **Only a failed wake exits non-zero; `expired` and `unreadable` warn but exit zero.** The
+// **Only a failed wake exits non-zero; `unreadable` warns but exits zero.** The
 // verdict-and-exit-code table in `docs/josh-commands-automation.md` is a contract callers branch on,
-// and what those two need is the notification, not a different exit code.
+// and what that one needs is the notification, not a different exit code.
 function exit_code_of(reason: WakeStopReason): number {
 	return reason === run_wake_loop.FAILED_REASON ? FAILURE_EXIT_CODE : SUCCESS_EXIT_CODE
 }

package/scripts/run/wake/run-wake-describe.ts

@@ -32,7 +32,7 @@ interface WakeContext {
 }
 
 function carry_cuts(read: CarryRead): string {
-	if (read.kind === 'carried' || read.kind === 'expired') return String(read.carry.cuts)
+	if (read.kind === 'carried') return String(read.carry.cuts)
 
 	return UNKNOWN_CUTS
 }
@@ -70,15 +70,13 @@ function deadline(marked_at: string | undefined, limit_ms: number): string {
 }
 
 // A live owner that is this supervisor is its own driver at work; any other is a session spending the
-// budget, which has no deadline of its own short of the carry record's whole-run expiry.
+// budget, which has no deadline of its own.
 function owner_wait(wake: RunWake, carry: RunCarry): string {
 	if (carry.owner_pid === wake.pid) {
 		return 'waiting: the driver holds the carry record and is running'
 	}
 
-	const expiry = deadline(carry.started_at, run_carry.CARRY_MAX_AGE_MS)
-
-	return `waiting: process ${String(carry.owner_pid)} holds the carry record; the driver starts at its next cut or once it exits, and the record expires at ${expiry}`
+	return `waiting: process ${String(carry.owner_pid)} holds the carry record; the driver starts at its next cut or once it exits`
 }
 
 const WAIT_LINES: Partial<Record<WakeDecision['kind'], (wake: RunWake) => string>> = {

package/scripts/run/wake/run-wake-driver.ts

@@ -159,9 +159,9 @@ function is_mechanical(result: JoshResult): boolean {
 	)
 }
 
-// A record that expired or was removed during the pause answers `undefined`: its stale verdict must not
-// reach a session, so the supervisor's own next pass re-reads the record and ends the run as `expired`
-// or `stopped`; a rerun would only fail on it and report the run as `failed`.
+// A record that was removed during the pause answers `undefined`: its stale verdict must not reach a
+// session, so the supervisor's own next pass re-reads the record and ends the run as `ended` or
+// `stopped`; a rerun would only fail on it and report the run as `failed`.
 async function run_driver(
 	target: string,
 	args: ReadonlyArray<string>,

package/scripts/run/wake/run-wake-loop.ts

@@ -24,12 +24,6 @@ const STOPPED_REASON: WakeStopReason = 'stopped'
 const FAILED_REASON: WakeStopReason = 'failed'
 const NO_ATTEMPTS = 0
 const STOPPED_BY_PERSON: LoopStop = { reason: STOPPED_REASON, note: undefined }
-// **The back-off after repeated whiffs, and its ceiling.** While a launch is
-// deferred for want of work, each wait is as long as the idle stretch so far — so the polling interval
-// doubles pass by pass — capped at this multiple of the configured one. Eight times the one-minute
-// default is eight minutes: far fewer backlog reads over a long empty stretch, and still well inside
-// the idle ceiling, so work that appears is picked up within one capped wait.
-const MAX_BACKOFF_FACTOR = 8
 
 interface LoopPorts {
 	// The carry record, re-read every pass rather than cached: it is written by the parent loop of a
@@ -157,18 +151,6 @@ async function decide_pass(wake: RunWake, ports: LoopPorts): Promise<WakeDecisio
 	return run_wake.decide({ ...input, has_work: await ports.has_work(input.read) })
 }
 
-// The wait before the next pass: the configured interval, stretched while a launch is being deferred
-// to the length of the idle stretch so far and capped at `MAX_BACKOFF_FACTOR` times the interval.
-function next_interval(wake: RunWake | undefined, interval_ms: number, now: Date): number {
-	const idle_since = wake?.idle_since === undefined ? NaN : Date.parse(wake.idle_since)
-
-	if (Number.isNaN(idle_since)) return interval_ms
-
-	const stretched = Math.max(interval_ms, now.getTime() - idle_since)
-
-	return Math.min(stretched, interval_ms * MAX_BACKOFF_FACTOR)
-}
-
 // The record is re-read at the top of every pass rather than carried in a variable, so a `--stop` that
 // removed it ends the loop at the next interval and a `--list` reads what the loop actually wrote.
 // One pass: decide, act, write the result back. `undefined` means carry on to the next interval.
@@ -187,6 +169,9 @@ async function run_pass(
 // The record is re-read at the top of every pass rather than carried in a variable, so a `--stop` that
 // removed it ends the loop at the next interval and a `--list` reads what the loop actually wrote.
 //
+// **The wait between two passes is the configured interval, however long the run has been idle**: a
+// launch deferred for want of work is asked about again as soon as a running one would be.
+//
 // **`read_own_wake` rather than `read_wake`, and the difference is a whole pass.**
 // A record that has become a *successor's* is not this loop's to act on, and reading it back would
 // have this pass decide from another supervisor's counters — spawning a session for a cut that
@@ -203,7 +188,7 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 		if (stop !== undefined) return stop
 
 		// eslint-disable-next-line no-await-in-loop -- polling: each read waits on the state the previous one saw
-		await ports.sleep(next_interval(run_wake.read_own_wake(target), interval_ms, ports.now()))
+		await ports.sleep(interval_ms)
 		wake = run_wake.read_own_wake(target)
 	}
 
@@ -212,8 +197,6 @@ async function run_loop(target: string, ports: LoopPorts, interval_ms: number):
 
 const run_wake_loop = {
 	FAILED_REASON,
-	MAX_BACKOFF_FACTOR,
-	next_interval,
 	run_loop,
 }
 

package/scripts/run/wake/run-wake-restart.ts

@@ -15,7 +15,7 @@ interface RestartPorts {
 	// One run of the loop over the record the caller claimed once and holds across every restart, so a
 	// `--stop` landing in the pause is read by the next pass as the person's stop.
 	pass: () => Promise<LoopStop>
-	// Whether the carry record can still be continued — `carried`, neither `expired` nor gone.
+	// Whether the carry record can still be continued — `carried`, neither unreadable nor gone.
 	is_resumable: () => boolean
 	pause: () => Promise<void>
 	note: (text: string) => void

package/scripts/run/wake/run-wake.ts

@@ -9,7 +9,7 @@ import { z } from 'zod'
 
 // The process outside the conversation that starts the next session after a `backlogrun` cut.
 // Whether to wake is the carry record's answer, never a judgement: `carried` and handed off wakes;
-// `none`, `expired` (the whole-run bound) and `unreadable` stop. A hand-off is set by `run:carry --cut`,
+// `none` and `unreadable` stop. A hand-off is set by `run:carry --cut`,
 // or by this supervisor when it recovers a record whose owner died, so a live session never reads as
 // waiting. The supervisor owns the record while its deterministic driver spends the budget; a judgment
 // branch hands it off so one AI session can adopt it.
@@ -23,8 +23,8 @@ const WAKE_LOG_SUFFIX = '.log'
 const WAKE_GRACE_MS = 600_000
 // Retried before failing: stopping ends a run nobody is watching.
 const MAX_WAKE_ATTEMPTS = 3
-// An empty backlog still needs one session to finish the run, so a deferral is bounded by the
-// `backlogrun` idle watch's own default.
+// A run with nothing to start still needs one session to finish it, so a deferral is bounded by the
+// `backlogrun` idle wait itself.
 const IDLE_CEILING_MS = backlog_budget.DEFAULT_IDLE_MS
 const NO_WAKES = 0
 const ONE_WAKE = 1
@@ -49,11 +49,11 @@ interface RunWake {
 	woke_pid?: number | undefined
 	// Every `--session-id` this forced, so `josh time --run` attributes whiffs only to its own sessions.
 	spawned?: ReadonlyArray<string> | undefined
-	// Start of one unbroken idle stretch: bounds the deferral and backs off the polling interval.
+	// Start of one unbroken idle stretch: bounds the deferral.
 	idle_since?: string | undefined
 }
 
-type WakeStopReason = 'ended' | 'expired' | 'unreadable' | 'failed' | 'stopped'
+type WakeStopReason = 'ended' | 'unreadable' | 'failed' | 'stopped'
 
 // `superseded`: another supervisor holds the record and this process is the replaced one.
 type WakeTidyResult = 'absent' | 'removed' | 'superseded'
@@ -87,9 +87,8 @@ const WAIT_DECISION: WakeDecision = { kind: 'wait' }
 const PENDING_DECISION: WakeDecision = { kind: 'pending' }
 const FAILED_DECISION: WakeDecision = { kind: 'failed' }
 
-const STOP_REASONS: Record<'none' | 'expired' | 'unreadable', WakeStopReason> = {
+const STOP_REASONS: Record<'none' | 'unreadable', WakeStopReason> = {
 	none: 'ended',
-	expired: 'expired',
 	unreadable: 'unreadable',
 }
 

package/scripts/sync/sync-ai-files.ts

@@ -5,6 +5,7 @@ import { transform_copied_content } from '#scripts/init/init-copy-content'
 import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import type { ProjectShape } from '#scripts/init/project-profile'
+import { security_policy } from '#scripts/init/security-policy'
 import { file_reader } from '#scripts/lib/read-file'
 import { pack_hook } from '#scripts/safe-chain/pack-hook'
 import { copy_directory_failure, directory_copy_blocker } from './directory-copy-guard'
@@ -80,6 +81,7 @@ function sync_workspace_yaml(
 
 // The source is the profile's: a basic project syncs from its own templates, as `josh init` wrote it.
 function sync_ai_copy_file(filename: string, is_force: boolean, shape?: ProjectShape): void {
+	if (security_policy.did_skip_unresolved(filename, PROJECT_ROOT)) return
 	const source = init_ai_copy.ai_file_source(filename, shape)
 
 	if (filename === WORKSPACE_YAML) {

package/scripts/version/latest-update.ts

@@ -13,6 +13,7 @@ import { overrides_check } from '#scripts/overrides/overrides-logic'
 import { execaSync } from 'execa'
 import { fresh_metadata_cache } from './fresh-metadata-cache'
 import { latest_regression, type VersionRegression } from './latest-regression'
+import { playwright_browsers } from './playwright-browsers'
 import { safe_chain_version_update } from './safe-chain-version-update'
 
 const PACKAGE_JSON_PATH = 'package.json'
@@ -164,23 +165,36 @@ function report_lockfile_overrides(): void {
 	process.exitCode = 1
 }
 
+// The browsers follow what `node_modules` holds, not how the update ended: a later stage failing
+// after `@playwright/test` moved, and a rollback — which restores the manifest and the lockfile but
+// leaves the newer package installed — both leave a Playwright whose browsers were never downloaded,
+// and the browser tests that run next would fail with "Executable doesn't exist".
+function install_browsers(playwright_version: string | undefined): void {
+	if (playwright_browsers.install_when_needed(playwright_version) !== 0) process.exitCode = 1
+}
+
+// The sync acts on the versions the update settled on, so it runs neither after a failed update nor
+// after a rollback — the latter so the files really are left exactly as they were found: it rewrites
+// the workflows' pinned safe-chain installer, which would contradict the notice that nothing changed.
 function main(): void {
 	const snapshot = take_snapshot()
+	const playwright_version = playwright_browsers.read_installed_version()
 	const overrides = overrides_files.read_current_overrides()
 
 	report_excluded(overrides_check.list_excluded_package_names(overrides))
 
 	const outcome = update_without_downgrading(snapshot)
 
+	// A failed `pnpm update` fails the command: the `josh latest` chain and `josh adopt` both read the
+	// exit code, and a zero here would let them carry on over dependencies that were never updated.
+	if (outcome.status !== 0) process.exitCode = outcome.status
+
 	report_overrides(overrides)
 	report_lockfile_overrides()
 
-	// Skipped after a rollback so the tree really is left exactly as it was found — this sync rewrites
-	// the workflows' pinned safe-chain installer, which would contradict the notice that
-	// nothing changed.
-	if (outcome.status === 0 && !outcome.is_rolled_back) {
-		safe_chain_version_update.sync()
-	}
+	if (outcome.status === 0 && !outcome.is_rolled_back) safe_chain_version_update.sync()
+
+	install_browsers(playwright_version)
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main()