@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/test/unit-setup-files.ts

@@ -0,0 +1,51 @@
+// The state guard runs on the pure project alone. isolate:false is what lets one file see the git
+// branch, working tree or GIT_* variables a sibling left changed, so that is the only run where a leak
+// is a correctness problem rather than a latent one — and the isolated project keeps exactly the guards
+// the single-project suite had. The network guard is armed once at the root instead, since it arms
+// `PATH` before any worker of either project forks.
+const STATE_GUARD: ReadonlyArray<string> = ['./tools/test/test-state-guard.ts']
+
+// Runs in every worker of both projects, before each test, and silences the real streams for the test
+// body so a fixture's direct `process.stdout` write cannot leak into `pnpm josh test:unit`'s output.
+// `setupFiles` rather than `globalSetup` because it must run inside the
+// worker where the test's writes happen, not once in the main process.
+const STDOUT_GUARD: ReadonlyArray<string> = ['./tools/test/test-stdout-guard.ts']
+
+// Runs in every worker for the same reason: it wraps that worker's own `fetch`, refusing a real
+// Telegram send and recording which test tried.
+const TELEGRAM_GUARD: ReadonlyArray<string> = ['./tools/test/test-telegram-guard.ts']
+
+// Runs in every worker too: it replaces that worker's machine reading, so a suite that drives the gate
+// admits the same way on every platform and every load.
+const MACHINE_GUARD: ReadonlyArray<string> = ['./tools/test/test-machine-guard.ts']
+
+// The guards every run of the suite arms, whichever config starts it: the network guard once in the
+// main process, the stdout, Telegram and machine guards in every worker. Named here so `vitest.config.ts` and
+// `vitest.harness.config.ts` read one definition — the harness once ran with none of them.
+const NETWORK_GUARD: ReadonlyArray<string> = ['./tools/test/test-network-guard.ts']
+const WORKER_GUARDS: ReadonlyArray<string> = [...STDOUT_GUARD, ...TELEGRAM_GUARD, ...MACHINE_GUARD]
+
+// Runs in every worker of the unit suite, idle unless a whole-suite `josh test:unit` asked it to
+// record which repository paths each test reads (`test-read-recorder.ts`). Not a guard, and not
+// the harness config's: only this suite's runs feed the test-read map.
+const READ_RECORDER: ReadonlyArray<string> = ['./tools/test/test-read-recorder.ts']
+
+// The unit suite's own reporter, which vitest loads by this path in its own process. Named rather
+// than imported so neither it nor the ledger it writes joins the config's import graph
+// (joshuafolkken/kit#4465).
+const UNIT_FILE_REPORTER = './vitest.reporter.config.ts'
+
+// Kept apart from `unit-projects.ts` so the shipped `josh test:related` can name every setup file
+// without loading the kit-internal project partition.
+const unit_setup_files = {
+	MACHINE_GUARD,
+	NETWORK_GUARD,
+	READ_RECORDER,
+	STATE_GUARD,
+	STDOUT_GUARD,
+	UNIT_FILE_REPORTER,
+	TELEGRAM_GUARD,
+	WORKER_GUARDS,
+}
+
+export { unit_setup_files }

package/scripts/test/unit-worker-share.ts

@@ -1,11 +1,6 @@
-import { readdirSync } from 'node:fs'
 import { availableParallelism } from 'node:os'
-import path from 'node:path'
-import { PLATFORM_TEMP_ROOT } from '#scripts/josh/platform-temporary'
-import { process_identity } from '#scripts/josh/process-identity'
-import { process_owner_schema, type ProcessOwner } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
-import { json_value } from '#scripts/lib/json-value'
+import { unit_run_marker } from './unit-run-marker'
 
 // How wide one vitest run may fan out when it is not the only one on the machine.
 //
@@ -26,131 +21,80 @@ import { json_value } from '#scripts/lib/json-value'
 // **The division activates only under concurrency.** One run in flight — every solo run, CI included
 // — gets exactly the number the gate and the hook produced before this module existed, so a quiet
 // machine behaves bit for bit as it did and only the condition that was measured broken changes.
+//
+// **The run markers and their division of the machine are `unit-run-marker.ts`**, the part the vitest
+// config imports (joshuafolkken/kit#4572); the capacity and claim bounds and the flag handling are here.
+const { MIN_WORKERS, NESTED_KEY, NESTED_VALUE, SOLO_RUNS } = unit_run_marker
+const { is_nested_run, live_run_count, mark_run_started, marker_path, resolve_unit_workers } =
+	unit_run_marker
 
-// A record that means something only while it exists, in the shape `stamp-file.ts` already keeps for
-// the in-flight gate marker. Keyed by pid rather than by checkout: `josh gate`'s unit step and a
-// `josh test:related` can be in flight in one checkout at once, and both of them are load.
-const RUN_PREFIX = 'josh-unit-running-'
 // Vitest's own flag, in both spellings its CLI accepts — it normalizes `--max-workers` to the same
 // option, so a run that recognized only one of them would replace a number the caller typed with the
 // share and contradict the promise below. The camel-case one is what gets written.
 const WORKER_FLAG = '--maxWorkers'
 const WORKER_FLAGS: ReadonlyArray<string> = [WORKER_FLAG, '--max-workers']
-// Never below one: a share of zero would run no test at all and report the suite green.
-const MIN_WORKERS = 1
-// One run in flight is this run alone, which is the case that changes nothing.
-const SOLO_RUNS = 1
-
-// A marker is the writing process's identity and nothing else; a pid-only marker has an answer of its
-// own below (`is_running`) rather than being rejected here.
-type RunMarker = ProcessOwner
-
-function marker_path(pid: number = process.pid): string {
-	return stamp_file.stamp_path(RUN_PREFIX, String(pid))
-}
-
-// **A marker is evidence, and the process behind it is the test.** A run killed outright leaves its
-// file behind, and a count that trusted the file alone would hold every later run down to one worker
-// for good — the failure mode `run-hold.ts` answers with an expiry, which cannot be sized here because
-// a unit suite under six-way load already takes minutes. The process that writes this marker is the
-// long-lived one, so unlike a `run:hold` record its identity is a liveness test rather than a note for
-// the reader.
-//
-// **The pid alone was not that identity**. The section below already named
-// what goes wrong — a reissued pid turns a leaked marker into a permanent phantom — and answered it by
-// sweeping, which only ever collected the markers whose pid had *not* yet been reissued. Since the
-// record now carries the writing process's start time beside its pid, a reissued pid is recognized as
-// a different process and swept like any other dead one. A pid that is not positive is caught by the
-// same check, inside `process_identity`: `process.kill(0, …)` addresses the caller's own process group
-// rather than a process, so a truncated or hand-edited marker would otherwise answer "alive" forever.
-//
-// **"Cannot tell" counts as live here, which is the opposite of what the in-flight gate marker's
-// readers do with it, and deliberately so.** A marker with no recorded start time — written before the
-// field existed, or on a platform where it cannot be read — resolves toward *more* sharing: being
-// wrong that way costs this run a narrower share of the machine, while being wrong the other way puts
-// six unit suites on eleven cores, an oversubscription measured at a load
-// average of 209.
-function is_running(marker: RunMarker): boolean {
-	return process_identity.is_same_process(marker.pid, marker.process_start) !== false
-}
-
-function read_marker(source: string): RunMarker | undefined {
-	const raw = stamp_file.read_stamp_text(source)
-
-	if (raw === undefined) return undefined
-
-	const parsed = process_owner_schema.safeParse(json_value.parse_or_undefined(raw))
-
-	return parsed.success ? parsed.data : undefined
-}
+// The core vitest's own process — the pool, the reporter and Vite's transforms — keeps busy beside its
+// workers (joshuafolkken/kit#4362). A direct run's claim holds it above its worker count.
+const MAIN_PROCESS_CORES = 1
+
+// **The run count divides the machine; the free cores bound what that division hands out.** The
+// share counts only unit runs, so load from outside the core budget's ledger — Claude sessions, other
+// tools — went unseen: 22 of 38 ledger samples at a load average of 20 or more had vitest as their
+// heaviest process, one at 381% over 30 processes. `free_cores` is `free-cores.ts`'s reading, the
+// cores less that outside load. `undefined` — a CI runner, a CPU quota — and a reading at or above
+// the ceiling both leave `workers` as it was, so an unread or quiet machine changes nothing.
+function cap_to_free(
+	workers: number | undefined,
+	free_cores: number | undefined,
+	available_cores: number,
+): number | undefined {
+	if (free_cores === undefined || free_cores >= (workers ?? available_cores)) return workers
 
-// An unreadable temp directory answers "no other run", which is the direction that leaves behavior
-// as it was rather than throttling a run on a guess. Unlike the network guard, being wrong here costs
-// wall time and never a false result.
-function marker_files(directory: string = PLATFORM_TEMP_ROOT): Array<string> {
-	try {
-		return readdirSync(directory).filter((name) => name.startsWith(RUN_PREFIX))
-	} catch {
-		return []
-	}
+	return Math.max(MIN_WORKERS, Math.floor(free_cores))
 }
 
-// **A marker whose process is gone is removed, not merely skipped.** Skipping it is correct only until
-// the operating system reissues that pid to something else, which on a machine left running for days
-// it will — and from then on the phantom is counted as a live run for good, with every solo run held
-// at one worker and `josh gate` announcing lanes that do not exist. `finally` in `with_run_marker`
-// cannot prevent the leak, because the interrupt that produces it (Ctrl-C reaching the whole foreground
-// group) does not unwind. Sweeping on read is what bounds it: the first later run collects it.
-function sweep_marker(source: string): void {
-	try {
-		stamp_file.remove_stamp(source)
-	} catch {
-		/* not ours to remove; counting it out is the whole requirement */
-	}
+// What the machine has free for this run's workers, both from `free-cores.ts`'s one reading: the free
+// cores, and the workers the free memory holds. Either is `undefined` where it could not be read.
+interface FreeCapacity {
+	cores: number | undefined
+	memory_workers: number | undefined
 }
 
-// **Only a marker that parsed to a dead pid is swept, and the unlink still cannot throw.** A marker
-// this account may not read — another user's file on a sticky `/tmp` — is `undefined` here, and
-// deleting on that answer would raise `EPERM` from a path with no `catch` between it and
-// `announce_gate_plan`: an unreadable file belonging to somebody else would abort the gate outright,
-// which is worse than the leak this sweep exists for. Unreadable therefore counts as not-live and is
-// left alone, exactly as it was before the sweep existed.
-function is_marker_live(source: string): boolean {
-	const marker = read_marker(source)
+const UNREAD_CAPACITY: FreeCapacity = { cores: undefined, memory_workers: undefined }
 
-	if (marker === undefined) return false
-	if (is_running(marker)) return true
-
-	sweep_marker(source)
+// **The free memory bounds the share as the free cores do** (joshuafolkken/kit#4528). Lanes running
+// their suites at once each sized workers from the cores alone, so their workers' memory piled up
+// until the batch stopped opening lanes. Both bounds go through `cap_to_free`, so an unread one leaves
+// the share as it was.
+function cap_to_capacity(
+	workers: number | undefined,
+	free: FreeCapacity,
+	available_cores: number,
+): number | undefined {
+	const core_capped = cap_to_free(workers, free.cores, available_cores)
 
-	return false
+	return cap_to_free(core_capped, free.memory_workers, available_cores)
 }
 
-// Every marker in the temp directory whose process is still alive. This run's own is deliberately not
-// among them: both callers count *before* writing theirs, so the `+ 1` at the call site adds it.
-function live_run_count(directory: string = PLATFORM_TEMP_ROOT): number {
-	return marker_files(directory).filter((name) => is_marker_live(path.join(directory, name))).length
+// The core-budget claim a unit run holds: the weight it reserved, and the narrower one it was admitted
+// at past the wait cap.
+interface UnitClaim {
+	weight: number
+	granted?: number | undefined
 }
 
-// **The gate claims its place before its unit step exists, and the child must not claim a second
-// one.** `josh gate` counts the runs in flight and then spawns `josh test:unit`, so without this the
-// marker appears a second or so after the count that needed it — and two lanes launched together, the
-// shape `epicrun` produces, both read "nothing else is running" and both take the whole machine. The
-// gate therefore marks itself around the whole run and passes this down through the environment; the
-// guard inside the child sees it and marks nothing, because the two processes are one run.
-const NESTED_KEY = 'JOSH_UNIT_RUN_MARKED'
-const NESTED_VALUE = '1'
-
-function is_nested_run(): boolean {
-	return process.env[NESTED_KEY] === NESTED_VALUE
-}
+// **The share never exceeds the claim the run was admitted on** (joshuafolkken/kit#4235). The share is
+// read after admission, when fewer runs may be in flight than when the weight was sized, and a share
+// wider than the claim puts workers on the machine the ledger does not hold. The claim bounds a solo
+// share too: vitest's own choice is one worker per core but one, wider than any weight the ledger
+// reserves for a unit run, so leaving it in place would open workers no claim holds. The claim holds
+// vitest's own process as well, so its workers are the claim less that core.
+function cap_to_claim(share: number | undefined, claim: UnitClaim | undefined): number | undefined {
+	if (claim === undefined) return share
 
-// **`undefined` at one run means "leave the choice where it was".** The gate then applies its own
-// core reservation and the hook passes no flag at all, which is what both did before this existed.
-function resolve_unit_workers(available_cores: number, runs: number): number | undefined {
-	if (runs <= SOLO_RUNS) return undefined
+	const bound = Math.max(MIN_WORKERS, (claim.granted ?? claim.weight) - MAIN_PROCESS_CORES)
 
-	return Math.max(MIN_WORKERS, Math.floor(available_cores / runs))
+	return Math.min(share ?? bound, bound)
 }
 
 // The share this run may take, read from the machine. Separate from `resolve_unit_workers` so that
@@ -163,10 +107,12 @@ function resolve_unit_workers(available_cores: number, runs: number): number | u
 function current_share(
 	available_cores: number = availableParallelism(),
 	live_runs: number = live_run_count(),
+	free: FreeCapacity = UNREAD_CAPACITY,
 ): number | undefined {
 	const own_run = is_nested_run() ? 0 : SOLO_RUNS
+	const share = resolve_unit_workers(available_cores, live_runs + own_run)
 
-	return resolve_unit_workers(available_cores, live_runs + own_run)
+	return cap_to_capacity(share, free, available_cores)
 }
 
 function is_worker_flag(argument: string): boolean {
@@ -182,28 +128,19 @@ function is_worker_flag(argument: string): boolean {
 // would make this function's own answer depend on what happened to be running while it was asked, and
 // `f(args, undefined)` takes the default rather than the value — so the case that matters most, "this
 // run is alone", would be the one case no test could express.
+function has_worker_flag(vitest_arguments: ReadonlyArray<string>): boolean {
+	return vitest_arguments.some((argument) => is_worker_flag(argument))
+}
+
 function worker_arguments(
 	vitest_arguments: ReadonlyArray<string>,
 	share: number | undefined,
 ): Array<string> {
-	if (share === undefined || vitest_arguments.some((argument) => is_worker_flag(argument))) {
-		return []
-	}
+	if (share === undefined || has_worker_flag(vitest_arguments)) return []
 
 	return [`${WORKER_FLAG}=${String(share)}`]
 }
 
-// **The write failing is not a reason to fail the run.** A marker that could not be written costs the
-// next run a wider share than it should have — the behavior that was there before — while a thrown
-// error here would fail a unit suite over bookkeeping.
-function mark_run_started(target: string): void {
-	try {
-		stamp_file.write_stamp(target, process_identity.own_fields())
-	} catch {
-		/* a missing marker costs a wide share, never a wrong result */
-	}
-}
-
 // `finally`, so a suite that threw still clears its marker — and so does the nested branch, which
 // restores nothing because it wrote nothing.
 async function with_run_marker<T>(run: () => Promise<T>): Promise<T> {
@@ -225,19 +162,16 @@ async function with_run_marker<T>(run: () => Promise<T>): Promise<T> {
 }
 
 const unit_worker_share = {
-	MIN_WORKERS,
-	NESTED_KEY,
-	NESTED_VALUE,
-	RUN_PREFIX,
-	SOLO_RUNS,
+	...unit_run_marker,
+	MAIN_PROCESS_CORES,
+	cap_to_capacity,
+	cap_to_claim,
+	cap_to_free,
 	current_share,
-	is_nested_run,
-	live_run_count,
-	marker_path,
-	read_marker,
-	resolve_unit_workers,
+	has_worker_flag,
 	with_run_marker,
 	worker_arguments,
 }
 
+export type { FreeCapacity, UnitClaim }
 export { unit_worker_share }

package/scripts/test/whole-suite-files.ts

@@ -0,0 +1,63 @@
+import path from 'node:path'
+import { unit_setup_files } from './unit-setup-files'
+
+// The files every test depends on without importing or reading them: the package and its lock,
+// the vitest configuration, and the setup files every worker runs before every test.
+const SETUP_FILES: ReadonlyArray<string> = [
+	...unit_setup_files.NETWORK_GUARD,
+	...unit_setup_files.STATE_GUARD,
+	...unit_setup_files.WORKER_GUARDS,
+	...unit_setup_files.READ_RECORDER,
+]
+
+const ROOT_FILES: ReadonlyArray<string> = [
+	'package.json',
+	'pnpm-lock.yaml',
+	'pnpm-workspace.yaml',
+	'tsconfig.json',
+	'vitest.config.ts',
+	'vitest.harness.config.ts',
+	// What the read recorder runs in every worker, which no test imports through the setup file.
+	'tools/test/test-read-capture.ts',
+	'scripts/test/test-read-trace.ts',
+]
+
+// **What the vitest config and the worker setup files import** (joshuafolkken/kit#4465). Vitest runs
+// every test when a file it is given is a config dependency — every module the config imports,
+// statically or not — and the setup files are in every test's graph, so `vitest related` widens to the
+// whole suite on any of these with no word of why. Named here, they print the reason instead.
+// `whole-suite-files.test.ts` holds the list to both graphs, so an import added to either fails there.
+const IMPORTED_BY_EVERY_TEST: ReadonlyArray<string> = [
+	'scripts/git/constants.ts',
+	'scripts/git/git-location-environment.ts',
+	'scripts/init/init-paths.ts',
+	'scripts/josh/agent-session-environment.ts',
+	'scripts/josh/platform-temporary.ts',
+	'scripts/josh/process-identity.ts',
+	'scripts/josh/process-owner.ts',
+	'scripts/josh/stamp-file.ts',
+	'scripts/lib/atomic-write.ts',
+	'scripts/lib/json-value.ts',
+	'scripts/lib/read-file.ts',
+	'scripts/lib/timeouts.ts',
+	'scripts/test/unit-run-marker.ts',
+	'scripts/test/unit-setup-files.ts',
+	'tools/test/duration-sequencer.ts',
+	'tools/test/duration-shard.ts',
+	'tools/test/pure-files.ts',
+	'tools/test/test-module-elapsed.ts',
+	'tools/test/test-repository-guard.ts',
+	'tools/test/unit-duration-record.ts',
+	'tools/test/unit-guard-environment.ts',
+	'tools/test/unit-projects.ts',
+	'tools/test/vitest-config-workers.ts',
+	'tools/test/vitest-include-globs.ts',
+]
+
+const WHOLE_SUITE_FILES: ReadonlySet<string> = new Set(
+	[...ROOT_FILES, ...IMPORTED_BY_EVERY_TEST, ...SETUP_FILES].map((file) => path.normalize(file)),
+)
+
+const whole_suite_files = { WHOLE_SUITE_FILES }
+
+export { whole_suite_files }

package/scripts/time-runtime/time-background.ts

@@ -51,8 +51,15 @@ const NO_FINISH = 0
 // let the #3273 lane child end its turn on a running task the stop hook never saw.
 const LAUNCH_PATTERN =
 	/(?:running in background with ID:|moved to the background \(ID:)\s*([\w-]+)/iu
-// A backgrounded subagent's launch result, which names its id on an `agentId:` line of its own.
-const AGENT_LAUNCH_PATTERN = /^Async agent launched[\s\S]*?\bagentId:\s*([\w-]+)/u
+// A backgrounded subagent's launch result, which names its id on an `agentId:` line of its own — or
+// the JSON result of a `SendMessage` that resumed one, which names it as `resumedAgentId`. A resumed
+// subagent runs in the background under the same id and ends with the same notice; missing that
+// spelling let the #4344 lane child's stop hook release its hold and `in-progress` while the resumed
+// investigator was still running (joshuafolkken/kit#4347). It is anchored on the result's own first
+// key: a command that printed a transcript line, which nests the same key under `toolUseResult`,
+// would otherwise open a resume that never finishes.
+const AGENT_LAUNCH_PATTERN =
+	/^(?:Async agent launched[\s\S]*?\bagentId:\s*|\{"success":[^\n]*?"resumedAgentId":")([\w-]+)/u
 // The notice the harness writes when a task it took into the background ends.
 // It is anchored at the start because the whole content of that line *is*
 // the notice — a body merely quoting one is text, the same hazard `read_id` unquotes for — and it
@@ -65,6 +72,11 @@ const AGENT_LAUNCH_PATTERN = /^Async agent launched[\s\S]*?\bagentId:\s*([\w-]+)
 // an enumeration of the harness's spellings, and a spelling it added later would silently start
 // reporting finished commands as never finished.
 const FINISH_PATTERN = /^<task-notification>[\s\S]*?<task-id>([\w-]+)<\/task-id>/u
+// The other end of a backgrounded task: the result of a `TaskStop` call. The harness writes no
+// task-notification for a task it was told to stop, so reading the notice alone left a stopped task
+// open for ever, and the lane stop guard blocked every stop after it (joshuafolkken/kit#4472). It is
+// anchored on the result's own first key for the reason `AGENT_LAUNCH_PATTERN` is.
+const STOP_PATTERN = /^\{"message":"Successfully stopped task:\s*([\w-]+)/u
 // The output file every reader of a backgrounded command names, whichever command it uses to read
 // it — `tail`, `cat`, `sed`, `grep`, or the `Monitor` tool, all of which carry the path.
 const OUTPUT_PATTERN = /tasks\/([\w-]+)\.output/u
@@ -113,6 +125,11 @@ function finished_id(text: string): string {
 	return FINISH_PATTERN.exec(text)?.[1] ?? NO_BACKGROUND
 }
 
+// The background run a `TaskStop` result reports stopping, or nothing for every other tool result.
+function stopped_id(text: string): string {
+	return STOP_PATTERN.exec(text)?.[1] ?? NO_BACKGROUND
+}
+
 // One line, as much of it as this reading needs. Taken structurally rather than as a `TranscriptLine`
 // so the import stays one-way: `time-transcript-line.ts` already imports this module to read the two
 // ids off a body, and asking for its type back would close the cycle.
@@ -300,6 +317,7 @@ const time_background = {
 	launch_id,
 	agent_launch_id,
 	finished_id,
+	stopped_id,
 	finished_at,
 	read_id,
 	read_id_of,

package/scripts/time-runtime/time-bundles.ts

@@ -1,3 +1,4 @@
+import { figure_format } from '#scripts/lib/figure-format'
 import { time_agent_bundles } from './time-agent-bundles'
 import { time_format } from './time-format'
 import { time_round_trips } from './time-round-trips'
@@ -111,7 +112,7 @@ const NO_BUNDLES: BundleTotals = {
 // `scripts/time-x` inside `scripts/time-xyz`.
 //
 // **The tail position is what makes an absolute path comparable with a relative one.** A `Read` call
-// names `/Users/…/kit/scripts/time/x.ts` while the `grep` before it named `scripts/time`, and nothing
+// names `/Users/…/kit/tools/time/x.ts` while the `grep` before it named `tools/time`, and nothing
 // here knows the working directory the second was relative to — so the search-then-read pair, which is
 // the whole reason the target test exists, would escape it on the two shapes it occurs in most.
 function contains_segments(whole: string, part: string): boolean {
@@ -124,7 +125,7 @@ function contains_segments(whole: string, part: string): boolean {
 }
 
 // Equal, or one inside the other. The containing form is what catches the search-then-read pair:
-// `grep -rn foo scripts` names `scripts`, and the `cat scripts/time/x.ts` that follows it names a path
+// `grep -rn foo scripts` names `scripts`, and the `cat tools/time/x.ts` that follows it names a path
 // beneath — which is exactly how the second call learned the first one's answer.
 function is_related(left: string, right: string): boolean {
 	if (left === right) return true
@@ -422,7 +423,7 @@ interface TripPrice {
 }
 
 function recoverable_suffix(totals: BundleTotals, round_trip_count: number): string {
-	const share = time_format.format_share(totals.recoverable_round_trips, round_trip_count)
+	const share = figure_format.format_share(totals.recoverable_round_trips, round_trip_count)
 
 	return `${share} of ${String(round_trip_count)} round trip(s)`
 }

package/scripts/time-runtime/time-density-hook.ts

@@ -66,22 +66,22 @@ const notice_schema = z.object({ notified_at_ms: z.number() })
 const call_schema = z.object({ tool_name: z.string().min(1), tool_input: z.unknown() })
 
 function parse_transcript_path(raw_payload: string): string | undefined {
-	const parsed = payload_schema.safeParse(JSON.parse(raw_payload))
+	const payload = json_value.parse_with(raw_payload, payload_schema)
 
-	if (!parsed.success || parsed.data.transcript_path === undefined) return undefined
+	if (payload?.transcript_path === undefined) return undefined
 
-	return time_hook_transcript.transcript_of(parsed.data.transcript_path, parsed.data.agent_id)
+	return time_hook_transcript.transcript_of(payload.transcript_path, payload.agent_id)
 }
 
 // The call that has just run, as the payload names it — what the line checks
 // against the turns behind it, so a call that needed their result is never offered as one that could
 // have shared their turn. A payload without a tool name answers `undefined`, judged on those turns alone.
 function parse_call(raw_payload: string): GuardedCall | undefined {
-	const parsed = call_schema.safeParse(JSON.parse(raw_payload))
+	const call = json_value.parse_with(raw_payload, call_schema)
 
-	if (!parsed.success) return undefined
+	if (call === undefined) return undefined
 
-	return { name: parsed.data.tool_name, input: parsed.data.tool_input }
+	return { name: call.tool_name, input: call.tool_input }
 }
 
 // The last `max_bytes` of a file, as text. The leading line is usually cut mid-way, which every
@@ -173,6 +173,8 @@ function density_notice(raw_payload: string, now_ms: number = Date.now()): strin
 const time_density_hook = {
 	density_notice,
 	notice_path,
+	parse_call,
+	parse_transcript_path,
 	read_tail,
 }
 

package/scripts/time-runtime/time-followup-stage.ts

@@ -1,4 +1,5 @@
 import { git_followup_stages, type FollowupStage } from '#scripts/followup/git-followup-stages'
+import { MS_PER_SECOND } from '#scripts/lib/timeouts'
 
 // Reading `followup`'s own stage rows back out of what it printed.
 //
@@ -35,9 +36,6 @@ const LINE_SEPARATOR = '\n'
 // so the tail is the one part of the row whose shape the alignment cannot move.
 const SECONDS_SUFFIX = ' s'
 const DIGIT_OR_POINT = /[\d.]/u
-// Written here rather than imported: `time-format.ts` keeps its own copy private, and reaching for
-// `run-progress.ts` would pull a command module into the parse for one number.
-const MS_PER_SECOND = 1000
 const NO_STAGES: ReadonlyArray<FollowupStage> = []
 
 // Leading whitespace is trimmed for the same reason `time-reported-failure.ts` trims it: the printer

package/scripts/time-runtime/time-format.ts

@@ -1,3 +1,6 @@
+import { figure_format } from '#scripts/lib/figure-format'
+import { MS_PER_SECOND } from '#scripts/lib/timeouts'
+
 // The column and number formatting every timing report is laid out through.
 //
 // It was `time-report.ts`'s until three renderers shared it: the run scope's own tables, the epic
@@ -12,13 +15,9 @@
 // imports either of them. **The words two blocks must spell identically are the exception**, and they
 // are here for the reason `NO_CALLS` is: a label printed by two renderers, one of which cannot import
 // the other, has to be written once or the two reports come to disagree about what a row is called.
+// The figures themselves are `figure_format`'s, shared with the cost reports.
 
-const MS_PER_MINUTE = 60_000
-const MS_PER_SECOND = 1000
-const MINUTE_DECIMALS = 1
 const SECOND_DECIMALS = 1
-const PERCENT_SCALE = 100
-const PERCENT_DECIMALS = 1
 const LABEL_WIDTH = 24
 // Wide enough for a three-digit run (`335.4 min`), so a long session's rows stay in column with a
 // short one's rather than pushing the share out by a character.
@@ -53,32 +52,12 @@ function overflow_line(row_count: number): Array<string> {
 	]
 }
 
-function format_minutes(duration_ms: number): string {
-	return `${(duration_ms / MS_PER_MINUTE).toFixed(MINUTE_DECIMALS)} min`
-}
-
 // Seconds rather than minutes for a per-turn figure: one turn is tens of seconds, and `0.1 min` is
 // too coarse to show the rise across a batch that this scale exists to make visible.
 function format_seconds(duration_ms: number): string {
 	return `${(duration_ms / MS_PER_SECOND).toFixed(SECOND_DECIMALS)} s`
 }
 
-function format_share(part: number, whole: number): string {
-	if (whole === 0) return 'n/a'
-
-	return `${((part / whole) * PERCENT_SCALE).toFixed(PERCENT_DECIMALS)}%`
-}
-
-// A dollar figure, to the caller's own precision. Two cost blocks print money now — the phase costs
-// and the per-subagent context-construction costs — and each rounds to a different place (a run total
-// to the cent, a per-round-trip figure finer), so the decimals are the caller's and only the `$` and
-// the `toFixed` are shared. It sits here beside the other number formatters rather than in one block,
-// for the reason `format_minutes` does: a second copy beside the second renderer is how two cost rows
-// of one report come to punctuate a dollar amount two ways.
-function usd(amount: number, decimals: number): string {
-	return `$${amount.toFixed(decimals)}`
-}
-
 // The one place the three columns are laid out, so a row carrying words instead of a duration lines
 // up with the rows that carry one rather than overrunning the numeric column.
 function format_columns(label: string, minutes: string, suffix: string): string {
@@ -86,7 +65,7 @@ function format_columns(label: string, minutes: string, suffix: string): string
 }
 
 function format_row(label: string, duration_ms: number, suffix: string): string {
-	return format_columns(label, format_minutes(duration_ms), suffix)
+	return format_columns(label, figure_format.format_minutes(duration_ms), suffix)
 }
 
 // **A share nobody read says so rather than totalling zero.** The duration column is left empty
@@ -101,8 +80,6 @@ const time_format = {
 	NO_CALLS,
 	overflow_line,
 	format_seconds,
-	format_share,
-	usd,
 	format_columns,
 	format_row,
 	// `format_clock` stays private: `format_window` is its only caller, and a namespace that offers

package/scripts/time-runtime/time-markers.ts

@@ -89,6 +89,11 @@ const BODY_FIELD_PATTERN = /\bbody=/u
 const ISSUE_COMMENT_PATTERN = /\bgh\s+issue\s+comment\b/u
 const BODY_FLAG_PATTERN = /--body(?:-file)?\b/u
 
+// `josh issue:plan` posts the plan under no API path of its own, so it is named outright — **as the
+// command run**, at the start or after a `;` / `&&` / `|`, so a grep or a commit message that merely
+// quotes it is not the call.
+const ISSUE_PLAN_PATTERN = /(?:^|[;&|]\s*)pnpm\s+josh\s+issue:plan\b/u
+
 // **The add form, not the label's name anywhere in the command.** The prerequisite branch removes the
 // same label with `-X DELETE …/labels/in-progress`, which is a run ending its hold on an issue rather
 // than opening one — matched loosely, that call would move the run's start to somewhere near its end.
@@ -159,6 +164,10 @@ function is_issue_comment(command: string): boolean {
 	return ISSUE_COMMENT_PATTERN.test(command) && BODY_FLAG_PATTERN.test(command)
 }
 
+function is_plan_write(command: string): boolean {
+	return is_api_body_write(command) || is_issue_comment(command) || ISSUE_PLAN_PATTERN.test(command)
+}
+
 function is_in_progress_label(command: string): boolean {
 	return ISSUE_LABELS_PATTERN.test(command) && command.includes(IN_PROGRESS_FIELD)
 }
@@ -216,7 +225,7 @@ function bash_issue(command: string): number {
 function bash_marker(command: string): PhaseMarker {
 	if (is_run_start(command)) return WORKFLOW_MARKER
 
-	return is_api_body_write(command) || is_issue_comment(command) ? PLAN_MARKER : NO_MARKER
+	return is_plan_write(command) ? PLAN_MARKER : NO_MARKER
 }
 
 const time_markers = {