@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/gate/gate-run-steps.ts

@@ -0,0 +1,195 @@
+import { availableParallelism } from 'node:os'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { buffered_process } from '#scripts/lib/buffered-process'
+import { unit_worker_share } from '#scripts/test/unit-worker-share'
+import { check_cpu, type CheckCpu } from './check-cpu'
+import { core_budget, type Admission } from './core-budget'
+import { free_cores } from './free-cores'
+import { gate_plan, type GatePlan } from './gate-plan'
+import type { CheckClaim, GateStep, GateStepResult } from './gate-report'
+import { build_gate_step, with_granted_workers } from './gate-steps'
+import { project_checks } from './project-checks'
+
+// Running the gate's checks: each one under its place in the machine-wide budget, a reused one
+// (`check-reuse.ts`) without starting it. `verification-gate.ts` decides what runs and records the
+// outcome; this module only runs it.
+
+// `cpu` is the gate's shared reader, so concurrent checks each take their own growth; a lone call
+// reads its child alone from a baseline of its own.
+async function run_gate_step(
+	step: GateStep,
+	cpu: CheckCpu = check_cpu.check_cpu_reader(),
+): Promise<GateStepResult> {
+	if (step.skip_reason !== undefined) {
+		return {
+			label: step.label,
+			command: step.command_args.join(' '),
+			output: project_checks.skip_notice('check', step.skip_reason),
+			exit_code: 0,
+			elapsed_ms: 0,
+		}
+	}
+
+	const result = await buffered_process.run_buffered_process(
+		step.command_args,
+		step.cwd === undefined ? {} : { cwd: step.cwd },
+	)
+
+	return { label: step.label, command: step.command_args.join(' '), ...result, cpu_ms: cpu() }
+}
+
+// This gate's share of the machine, resolved once at the gate's entry and carried down as one value.
+// `available_cores` is the budget every check reserves against; `is_reserved`
+// is false for a gate nested inside another gate's unit suite — this repository's own gate tests — so
+// the outer gate reserves and every gate beneath it does not. Captured before this gate sets
+// `JOSH_UNIT_RUN_MARKED`, which is why it is read at entry rather than re-derived here.
+interface BudgetContext {
+	available_cores: number
+	is_reserved: boolean
+}
+
+function default_budget(): BudgetContext {
+	return {
+		available_cores: availableParallelism(),
+		is_reserved: !unit_worker_share.is_nested_run() && !core_budget.is_held(),
+	}
+}
+
+// A gate step paired with the cores it reserves from the machine-wide budget while it runs.
+// The weight travels with the step so `run_gate_steps` never has to re-pair a
+// step with its check by index.
+interface ReservedStep {
+	step: GateStep
+	weight: number
+	memory_mb: number
+	// The plan's `--maxWorkers` for the unit suite, the width the free memory bounds once it is admitted.
+	worker_cap: number | undefined
+	// When the check's own green record was taken, for a check `check-reuse.ts` found reusable.
+	reused_at: string | undefined
+}
+
+// The checks this gate reuses, each mapped to when it was last green.
+type ReusedChecks = ReadonlyMap<string, string>
+
+async function build_reserved_steps(
+	plan: GatePlan,
+	available_cores: number,
+	reused: ReusedChecks,
+): Promise<ReadonlyArray<ReservedStep>> {
+	return await Promise.all(
+		plan.checks.map(async (check) => ({
+			step: await build_gate_step(check, process.cwd(), plan),
+			weight: gate_plan.check_weight(check, plan, available_cores),
+			memory_mb: gate_plan.check_memory(check, plan, available_cores),
+			worker_cap: plan.unit_worker_cap,
+			reused_at: reused.get(check.label),
+		})),
+	)
+}
+
+// A reused check starts no process and claims no core: its result is the record's, and the empty
+// output is what that record was written from (`gate_report.has_nothing_to_say`).
+function reused_result(step: GateStep, reused_at: string): GateStepResult {
+	return {
+		label: step.label,
+		command: step.command_args.join(' '),
+		output: '',
+		exit_code: 0,
+		elapsed_ms: 0,
+		reused_at,
+	}
+}
+
+// What the check asked the budget for and what it ran at, for its ledger row (`gate-ledger.ts`).
+function claim_of(requested: number, admission: Admission): CheckClaim {
+	return {
+		requested,
+		granted: admission.granted ?? requested,
+		waited_ms: admission.waited_ms ?? 0,
+	}
+}
+
+// **The unit step's width is bounded by the free memory too** (joshuafolkken/kit#4528). The plan's cap
+// and the granted width are sized from the cores alone, and the `--maxWorkers` they become skips the
+// guard's own reading (`test-unit-guard.ts`), so the memory is read here, once the claim is admitted
+// and the suite is about to start. The free cores are not applied: the admission has already narrowed
+// the claim to them (joshuafolkken/kit#4167).
+async function admitted_step(
+	reserved: ReservedStep,
+	admission: Admission,
+	available_cores: number,
+): Promise<GateStep> {
+	if (reserved.step.label !== gate_plan.UNIT_LABEL) return reserved.step
+
+	const { memory_workers } = await free_cores.read({ available_cores })
+	const asked = admission.granted ?? reserved.worker_cap
+	const workers = unit_worker_share.cap_to_free(asked, memory_workers, available_cores)
+
+	return with_granted_workers(reserved.step, workers)
+}
+
+// **A nested gate takes no reservation, and the budget is what makes that necessary rather than
+// merely tidy**. The unit step spawns the suite, which runs this repository's
+// own gate tests; each of those is a gate inside the outer gate's unit reservation, and a place it
+// claimed would wait for cores the outer gate cannot free until the suite — this test included —
+// finishes.
+async function run_reserved_step(
+	reserved: ReservedStep,
+	budget: BudgetContext,
+	cpu: CheckCpu,
+): Promise<GateStepResult> {
+	if (reserved.reused_at !== undefined) return reused_result(reserved.step, reserved.reused_at)
+	if (!budget.is_reserved) return await run_gate_step(reserved.step, cpu)
+
+	return await core_budget.with_core_reservation(
+		reserved.weight,
+		async (admission) => ({
+			...(await run_gate_step(
+				await admitted_step(reserved, admission, budget.available_cores),
+				cpu,
+			)),
+			budget_note: core_budget.describe_overflow(admission),
+			claim: claim_of(reserved.weight, admission),
+		}),
+		{
+			budget: budget.available_cores,
+			memory_mb: reserved.memory_mb,
+			command: `gate ${reserved.step.label}`,
+			is_unit: reserved.step.label === gate_plan.UNIT_LABEL,
+		},
+	)
+}
+
+// `bounded_pool` rather than a bare `Promise.all`, so the plan's `concurrency` is what decides how
+// many run at once. **The all-failures-in-one-pass property survives the
+// change** because no check ever rejects: `buffered_process` reports a non-zero exit as a value, so
+// the pool's first-failure abort — written for callers that spawn real Claude sessions — never
+// fires here and every queued check still runs. Results come back in input order however they
+// finished, which is what keeps the printed sections in declaration order. Each step first claims its
+// place in the machine-wide budget and waits while the budget is full.
+async function run_gate_steps(
+	plan: GatePlan,
+	budget: BudgetContext = default_budget(),
+	reused: ReusedChecks = new Map(),
+): Promise<ReadonlyArray<GateStepResult>> {
+	const reserved = await build_reserved_steps(plan, budget.available_cores, reused)
+	const cpu = check_cpu.check_cpu_reader()
+
+	// **The checks run under the held mark, so a check's own dispatch claims nothing**.
+	// Each check is a `pnpm josh <target>` child, and a target that declares
+	// a weight would otherwise claim a second place for the cores reserved for it here. A nested gate
+	// sets the mark too, since its checks are covered by the outer gate's reservation.
+	return await core_budget.with_held_mark(
+		async () =>
+			await bounded_pool.bounded_map(
+				reserved,
+				plan.concurrency,
+				async (entry) => await run_reserved_step(entry, budget, cpu),
+			),
+	)
+}
+
+const gate_run_steps = { default_budget, run_gate_step, run_gate_steps }
+
+export type { BudgetContext, ReusedChecks }
+export { gate_run_steps }

package/scripts/gate/gate-skip.ts

@@ -64,10 +64,19 @@ const FORCE_FLAG = '--force'
 // rewritten by the hook's own install each cost minutes before anyone could tell them apart.
 type GateReuse = { stamp: FileMapStamp } | { miss: string }
 
+// The fingerprint of every declared check's tools and environment (`verification-inputs.ts`).
+const INPUTS_MOVED = 'a checked tool or environment variable changed since the green gate'
+
 function base_moved(recorded: string | undefined, base: string): string {
 	return `the merge base moved since the green gate (${recorded ?? 'none'} → ${base})`
 }
 
+function stamp_miss(stamp: FileMapStamp, base: string): string | undefined {
+	if (stamp.base !== base) return base_moved(stamp.base, base)
+
+	return review_stamps.gate_stamp.describes_inputs(stamp) ? undefined : INPUTS_MOVED
+}
+
 function gate_reuse(
 	tree: Record<string, string>,
 	base: string | undefined,
@@ -79,9 +88,10 @@ function gate_reuse(
 	const stamp = review_brief.matching_stamp(review_stamps.gate_stamp.read(source), tree)
 
 	if (stamp === undefined) return { miss: 'no green gate record matches the changed files' }
-	if (stamp.base !== base) return { miss: base_moved(stamp.base, base) }
 
-	return { stamp }
+	const miss = stamp_miss(stamp, base)
+
+	return miss === undefined ? { stamp } : { miss }
 }
 
 function stamp_of(reuse: GateReuse): FileMapStamp | undefined {

package/scripts/gate/gate-steps.ts

@@ -42,6 +42,17 @@ async function build_gate_step(
 	return { label: check.label, command_args, cwd, skip_reason }
 }
 
+// The unit step at a narrower worker count: the one its claim was admitted at past the wait cap
+// (`core_admission.narrowed_weight`), or the one the free memory holds (`gate-run-steps.ts`). Any
+// other step, or one left as asked, is returned unchanged.
+function with_granted_workers(step: GateStep, granted: number | undefined): GateStep {
+	if (granted === undefined || step.label !== UNIT_LABEL) return step
+
+	const kept = step.command_args.filter((argument) => !argument.startsWith(`${UNIT_WORKER_FLAG}=`))
+
+	return { ...step, command_args: [...kept, `${UNIT_WORKER_FLAG}=${String(granted)}`] }
+}
+
 async function build_gate_steps(
 	start_directory: string,
 	plan: GatePlan = gate_plan.resolve_gate_plan(),
@@ -51,4 +62,4 @@ async function build_gate_steps(
 	)
 }
 
-export { build_gate_step, build_gate_steps, UNIT_WORKER_FLAG }
+export { build_gate_step, build_gate_steps, UNIT_WORKER_FLAG, with_granted_workers }

package/scripts/gate/held-mark.ts

@@ -0,0 +1,55 @@
+// **The environment mark that says a parent already holds this process's cores**
+// `josh gate` reserves per check and then spawns `pnpm josh lint`. Without
+// the mark, that child's own dispatch would claim a second place for the cores its parent already
+// holds. Every holder sets it, and every child inherits it through the environment and claims nothing.
+const HELD_KEY = 'JOSH_CORE_RESERVED'
+const HELD_VALUE = '1'
+// The ledger key of the claim a command holds for its children (`core_budget.with_command_reservation`),
+// so a child reading the machine can tell that claim's admitted, not-yet-busy weight from running load.
+const HELD_RESERVATION_KEY = 'JOSH_CORE_RESERVATION'
+
+function is_held(): boolean {
+	return process.env[HELD_KEY] === HELD_VALUE
+}
+
+// The ledger key of the one claim a parent command holds for this process, `undefined` where none does.
+function held_reservation(): string | undefined {
+	const key = process.env[HELD_RESERVATION_KEY] ?? ''
+
+	return key === '' ? undefined : key
+}
+
+// A function of its own so the restoring write does not sit after an `await`, where
+// `require-atomic-updates` reads any write to `process` as a possible race — the reason `josh.ts`
+// gives `record_exit_code`.
+function set_held_mark(value: string, reservation: string): void {
+	process.env[HELD_KEY] = value
+	process.env[HELD_RESERVATION_KEY] = reservation
+}
+
+// Marks this process, and every child it spawns, as running inside a held reservation — `reservation`
+// names its ledger key where one claim covers them all. The previous values come back afterwards, so a
+// nested holder never clears the mark its outer holder set.
+async function with_held_mark<T>(run: () => Promise<T>, reservation = ''): Promise<T> {
+	const previous = process.env[HELD_KEY] ?? ''
+	const previous_reservation = process.env[HELD_RESERVATION_KEY] ?? ''
+
+	set_held_mark(HELD_VALUE, reservation)
+
+	try {
+		return await run()
+	} finally {
+		set_held_mark(previous, previous_reservation)
+	}
+}
+
+const held_mark = {
+	HELD_KEY,
+	HELD_RESERVATION_KEY,
+	HELD_VALUE,
+	held_reservation,
+	is_held,
+	with_held_mark,
+}
+
+export { held_mark }

package/scripts/gate/input-fingerprint.ts

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { stamp_file } from '#scripts/josh/stamp-file'
+
+// **The one fingerprint every kept result is computed with** (joshuafolkken/kit#4497). A reuse of a
+// verdict holds only while what it read holds, and each reader of a verdict once computed that on its
+// own — the ESLint cache's import closure, the test-read map's dirty files, the gate's tool versions —
+// so a miss in one (joshuafolkken/kit#4407, #4415, #4423, #4425) was a miss nowhere else. Every one now
+// digests a file, a set of files and a set of named entries here.
+
+// The digest of a path that does not exist, or cannot be read, so it still differs from any content.
+const ABSENT = 'absent'
+
+function of_content(content: Buffer | string): string {
+	return stamp_file.digest(content)
+}
+
+// One digest over `entries`, independent of their order.
+function of_entries(entries: Iterable<string>): string {
+	return of_content([...entries].toSorted((left, right) => left.localeCompare(right)).join('\n'))
+}
+
+function of_file(file_path: string): string {
+	try {
+		return of_content(readFileSync(file_path))
+	} catch {
+		return ABSENT
+	}
+}
+
+// Each of `relatives` (relative to `root`) keyed to the digest of its content, in path order.
+function of_files(root: string, relatives: Iterable<string>): Record<string, string> {
+	const sorted = [...new Set(relatives)].toSorted((left, right) => left.localeCompare(right))
+
+	return Object.fromEntries(
+		sorted.map((relative) => [relative, of_file(path.join(root, relative))]),
+	)
+}
+
+const input_fingerprint = { ABSENT, of_entries, of_file, of_files }
+
+export { input_fingerprint }

package/scripts/gate/machine-capacity.ts

@@ -1,5 +1,5 @@
 import { readFile } from 'node:fs/promises'
-import { availableParallelism, cpus, totalmem } from 'node:os'
+import { availableParallelism, cpus, loadavg, totalmem } from 'node:os'
 import { PROBE_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
@@ -24,19 +24,20 @@ import { execa } from 'execa'
 // admits without looking at memory, exactly as before.
 //
 // **`run:board` draws its machine gauges from the same reading**, so what the
-// board shows a person is what the gate admits against. The board takes a sample with no window and
+// board shows a person is what the gate admits against — the gate reading the free memory as none
+// while the board's pressure and swap gauges show why. The board takes a sample with no window and
 // draws the difference from its previous one. `lane:sample` records the memory half of it, so the
 // lane-limit measurement sets the same figures beside the lane count.
 
 // The window the busy cores are measured over: long enough that one scheduler tick does not dominate it,
 // short enough that a solo admission is not visibly delayed.
 const SAMPLE_WINDOW_MS = 250
-// **The background a developer machine always carries, which the gate's weights were measured beside.**
-// On 2026-10-07 the 11-core machine idled at about 1.5 cores outside `josh` — Claude sessions 0.55, the
-// window server 0.47, a browser 0.5. The solo gate's weights sum to exactly the core count and were
-// measured with that load present, so only what exceeds it is load the budget must give way to;
-// counting the baseline would defer a solo gate's unit suite on every run.
-const BASELINE_CORES = 2
+// **Run-queue load outside the ledger past this many times the cores holds the first waiter too**
+// (joshuafolkken/kit#4361). The first waiter ignores outside load (joshuafolkken/kit#4313), and lanes took
+// the 11-core machine to a load average of 25–34. Twice the cores is loose on purpose: the one-core
+// editor load #4313 stopped holding a solo gate stays far below it, so neither its starvation nor the
+// lanes' speed comes back, while a machine whose queue beyond the ledger passes two per core waits.
+const OVERLOAD_FACTOR = 2
 const BYTES_PER_MB = 1_048_576
 const KB_PER_MB = 1024
 const PERCENT = 100
@@ -50,29 +51,56 @@ const PAGE_SIZE_ARGUMENTS = ['PAGESIZE']
 // every second. `kern.memorystatus_level` is the kernel's own memory-pressure figure: the percentage of
 // memory still available, compressible and purgeable pages included — what `os.freemem()` leaves out on
 // macOS, where it reads near zero on a machine with gigabytes to spare. The swapper counters are the
-// pages swapped in and out since boot, `vm_stat`'s `Swapins` / `Swapouts`. The names stay in the output
+// pages swapped in and out since boot, `vm_stat`'s `Swapins` / `Swapouts`; `vm.compressor_input_bytes` is
+// the bytes the compressor has taken in since boot, `vm_stat`'s `Compressions`. The names stay in the output
 // (no `-n`), so a name an older macOS lacks drops only its own line.
 const LEVEL_NAME = 'kern.memorystatus_level'
 const SWAP_IN_NAME = 'vm.compressor.swapper.swapins_total'
 const SWAP_OUT_NAME = 'vm.compressor.swapper.swapouts_total'
+const COMPRESSED_NAME = 'vm.compressor_input_bytes'
 const PAGE_SIZE_NAME = 'hw.pagesize'
 // The kernel's memory-pressure verdict — 1 normal, 2 warning, 4 critical — the one Activity Monitor
 // colors its "memory pressure" graph by.
 const PRESSURE_NAME = 'kern.memorystatus_vm_pressure_level'
-const SYSCTL_ARGUMENTS = [LEVEL_NAME, SWAP_IN_NAME, SWAP_OUT_NAME, PAGE_SIZE_NAME, PRESSURE_NAME]
+// **Only critical holds; warning is sticky** (joshuafolkken/kit#4199). On macOS the verdict can stay at
+// warning for hours after the pressure passed, so a hold on warning never lifts. What is pressured right
+// now shows in the free figure and the swap and compressor traffic; the verdict adds only critical.
+const PRESSURE_HOLD = 4
+// The swap traffic across one window that reads as pressure — 64 MB a second paged to disk. A machine
+// that swapped once still pages a few megabytes back in as old pages are touched.
+const SWAP_PRESSURE_MB = 16
+// The compressor traffic across one window that reads as pressure. An idle machine compresses nothing
+// across a window; the 2026-10-16 thrash compressed about 240,000 16 KB pages every three seconds, about
+// 310 MB a window, with no swap figure to show for it.
+const COMPRESSION_PRESSURE_MB = 64
+const SYSCTL_ARGUMENTS = [
+	LEVEL_NAME,
+	SWAP_IN_NAME,
+	SWAP_OUT_NAME,
+	COMPRESSED_NAME,
+	PAGE_SIZE_NAME,
+	PRESSURE_NAME,
+]
 const SYSCTL_LINE = /^(?<name>[\w.]+): (?<value>\d+)$/gmu
 
+// `memory_pressured` says why `available_mb` read none, so a claim that waits can name the pressure.
+// `run_queue` is the one-minute load average: the busy cores stop at the core count, so only the queue
+// tells a machine at twice its cores from one at once (`is_overloaded`).
 interface MachineReading {
 	busy_cores: number | undefined
 	available_mb: number | undefined
+	memory_pressured?: boolean | undefined
+	run_queue?: number | undefined
 }
 
 // The memory half of a reading. `swapped_mb` is a counter — every page swapped in or out since boot —
-// so a rate is the difference between two readings. `pressure_level` is read on macOS only.
+// so a rate is the difference between two readings, and so is `compressed_mb`, every byte compressed
+// since boot. `pressure_level` and `compressed_mb` are read on macOS only.
 interface MemoryReading {
 	available_mb: number | undefined
 	swapped_mb: number | undefined
 	pressure_level: number | undefined
+	compressed_mb?: number | undefined
 }
 
 // What the ledger's admitted reservations declare — the part of the machine's load already accounted for.
@@ -81,9 +109,15 @@ interface LedgerLoad {
 	memory_mb: number
 }
 
+// `busy_excess` is the measured cores beyond what the ledger declares — what `cores` gave up to load the
+// ledger does not hold, so a claim that waits on it can name the CPU as saturated. `is_overloaded` lifts
+// the first waiter's exemption from that load (`core_admission.is_admitted`).
 interface MachineBudget {
 	cores: number
 	memory_mb: number
+	memory_pressured?: boolean | undefined
+	busy_excess?: number | undefined
+	is_overloaded?: boolean | undefined
 }
 
 interface CpuTimes {
@@ -141,10 +175,10 @@ function swapped_pages(
 	return pages_in === undefined || pages_out === undefined ? undefined : pages_in + pages_out
 }
 
-function swapped_mb(pages: number | undefined, page_bytes: number | undefined): number | undefined {
-	if (pages === undefined || page_bytes === undefined) return undefined
+function mb_of(units: number | undefined, unit_bytes: number | undefined): number | undefined {
+	if (units === undefined || unit_bytes === undefined) return undefined
 
-	return (pages * page_bytes) / BYTES_PER_MB
+	return (units * unit_bytes) / BYTES_PER_MB
 }
 
 // What was swapped between two readings of the counter. A counter that went back — a reboot between
@@ -163,11 +197,12 @@ function parse_darwin_memory(output: string, total_bytes: number): MemoryReading
 	return {
 		available_mb:
 			level === undefined ? undefined : (level / PERCENT) * (total_bytes / BYTES_PER_MB),
-		swapped_mb: swapped_mb(
+		swapped_mb: mb_of(
 			swapped_pages(values.get(SWAP_IN_NAME), values.get(SWAP_OUT_NAME)),
 			values.get(PAGE_SIZE_NAME),
 		),
 		pressure_level: values.get(PRESSURE_NAME),
+		compressed_mb: mb_of(values.get(COMPRESSED_NAME), 1),
 	}
 }
 
@@ -187,7 +222,7 @@ function pages_of(pattern: RegExp, vmstat: string): number | undefined {
 function parse_linux_swapped(vmstat: string, page_bytes: number): number | undefined {
 	const pages = swapped_pages(pages_of(LINUX_SWAP_IN, vmstat), pages_of(LINUX_SWAP_OUT, vmstat))
 
-	return swapped_mb(pages, page_bytes)
+	return mb_of(pages, page_bytes)
 }
 
 async function settled<T>(read: () => Promise<T>): Promise<T | undefined> {
@@ -256,56 +291,114 @@ async function default_sleep(ms: number): Promise<void> {
 	})
 }
 
+// Whether a counter gained more than `limit` MB across the window; an unread counter gained nothing.
+function moved_over(from: number | undefined, to: number | undefined, limit: number): boolean {
+	return (swapped_between(from, to) ?? 0) > limit
+}
+
+function is_pressured(before: MemoryReading, after: MemoryReading): boolean {
+	return (
+		(after.pressure_level ?? 0) >= PRESSURE_HOLD ||
+		moved_over(before.swapped_mb, after.swapped_mb, SWAP_PRESSURE_MB) ||
+		moved_over(before.compressed_mb, after.compressed_mb, COMPRESSION_PRESSURE_MB)
+	)
+}
+
+// **Only a reading the kernel calls critical has nothing free to admit against.** Swap and compressor
+// traffic across the window used to answer no free memory too (joshuafolkken/kit#3943), but this machine
+// swaps out 0.4–1.3 TB a day as a matter of course, so that traffic held about a third of every wait
+// with memory to spare (joshuafolkken/kit#4313). A claim now waits on memory only when the free figure
+// falls short of what it declares; the traffic still names the wait as pressure (`memory_pressured`),
+// and holds a claim past the shortfall that running alone or the wait cap would otherwise start
+// (`core_admission.is_swap_held`, joshuafolkken/kit#4451).
+function pressured_available(after: MemoryReading): number | undefined {
+	if (after.available_mb === undefined) return undefined
+
+	return (after.pressure_level ?? 0) >= PRESSURE_HOLD ? 0 : after.available_mb
+}
+
+// Memory is read at both ends of the window, so the swap counter's difference is the activity during it.
 async function read_machine(
 	sleep: (ms: number) => Promise<void> = default_sleep,
 ): Promise<MachineReading> {
 	const before = cpu_times()
-	const [memory] = await Promise.all([read_memory(), sleep(SAMPLE_WINDOW_MS)])
-	const busy_cores = is_unquoted()
-		? busy_cores_between(before, cpu_times(), cpus().length)
-		: undefined
+	const [memory_before] = await Promise.all([read_memory(), sleep(SAMPLE_WINDOW_MS)])
+	const memory_after = await read_memory()
+	const is_host = is_unquoted()
+	const busy_cores = is_host ? busy_cores_between(before, cpu_times(), cpus().length) : undefined
 
-	return { busy_cores, available_mb: memory.available_mb }
+	return {
+		busy_cores,
+		run_queue: is_host ? loadavg()[0] : undefined,
+		available_mb: pressured_available(memory_after),
+		memory_pressured: is_pressured(memory_before, memory_after),
+	}
 }
 
 async function read_sample(): Promise<MachineSample> {
 	return { cpu: cpu_times(), memory: await read_memory(), total_mb: totalmem() / BYTES_PER_MB }
 }
 
-// The busy cores the ledger does not account for, beyond the baseline the weights were measured beside,
-// in whole cores — the budget is in whole cores, and a fraction of a core is not a core to give up.
+// The busy cores the ledger does not account for, in whole cores — the budget is in whole cores, and a
+// fraction of a core is not a core to give up.
+//
+// **Every busy core counts, the background included** (joshuafolkken/kit#4238). A baseline of two cores
+// used to be exempt, so with 10 cores reserved and all 11 busy the reading saw no excess and admitted
+// another claim onto a saturated CPU.
 function external_cores(busy_cores: number | undefined, ledger_cores: number): number {
 	if (busy_cores === undefined) return 0
 
-	return Math.floor(Math.max(0, busy_cores - ledger_cores - BASELINE_CORES))
+	return Math.floor(Math.max(0, busy_cores - ledger_cores))
 }
 
-// **The budget the ledger admits against: what is free plus what the ledger itself already holds.**
-// The admitted reservations' load is inside the reading, and the admission walk counts their declared
-// weight again, so it is added back — what is subtracted is only the load from outside the ledger. The
-// caller passes every admitted claim's cores but only the memory of claims past
-// `core_admission.RAMP_UP_MS`, whose tools have had time to allocate.
+// The run queue beyond what the ledger declares, past `OVERLOAD_FACTOR` times the cores. The ledger's own
+// claims running past their weight count as outside load. The load average trails by a minute, so a
+// first waiter held here waits out the decay — only at a load already this far past the machine. A queue
+// that could not be read, and Windows' constant zero, never hold.
+function is_overloaded(
+	run_queue: number | undefined,
+	ledger_cores: number,
+	cores: number,
+): boolean {
+	if (run_queue === undefined) return false
+
+	return run_queue - ledger_cores > cores * OVERLOAD_FACTOR
+}
+
+// **The budget the ledger admits against: `cores − max(ledger, busy)` free, plus what the ledger itself
+// already holds.** The admission walk counts the ledger's declared weight again, so it is added back —
+// what is subtracted is only the busy load beyond it. A claim admitted moments ago is not busy yet, and
+// the ledger's declared cores cover it. The caller passes every admitted claim's cores but only the
+// memory of claims past `core_admission.RAMP_UP_MS`, whose tools have had time to allocate.
 // Memory that could not be read is no limit at all, the behavior before memory was read.
 function machine_budget(cores: number, reading: MachineReading, ledger: LedgerLoad): MachineBudget {
+	const busy_excess = external_cores(reading.busy_cores, ledger.cores)
+
 	return {
-		cores: cores - external_cores(reading.busy_cores, ledger.cores),
+		cores: Math.max(0, cores - busy_excess),
 		memory_mb:
 			reading.available_mb === undefined ? Infinity : reading.available_mb + ledger.memory_mb,
+		memory_pressured: reading.memory_pressured,
+		busy_excess,
+		is_overloaded: is_overloaded(reading.run_queue, ledger.cores, cores),
 	}
 }
 
 const machine_capacity = {
-	BASELINE_CORES,
 	busy_cores_between,
 	busy_share_between,
+	COMPRESSION_PRESSURE_MB,
 	external_cores,
 	machine_budget,
 	parse_darwin_memory,
 	parse_linux_available,
 	parse_linux_swapped,
+	PRESSURE_HOLD,
+	pressured_available,
 	read_machine,
 	read_memory,
 	read_sample,
+	SWAP_PRESSURE_MB,
 	swapped_between,
 }