@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/.claude/skills/workflow-commands/retrospective.md

@@ -8,9 +8,6 @@ mark the step done. Read this file in full, in the same turn, before filing.
 drained, *before* the idle watch, so the watch picks up what it files; a run that stops without
 draining — the failure guard, `--idle 0` — still prints it at the stop position. Kit-only.
 
-Rationale: `docs/maintainers/retrospective-rationale.md` → "Why the retrospective is read at its step";
-provenance: `docs/maintainers/retrospective-rationale.md` → "Where each rule came from".
-
 ## The digest is read, not skimmed
 
 The command `run:step` prints folds four existing measurements into one digest — it adds none:
@@ -30,9 +27,12 @@ and anything the run surfaced that lives outside it).
 **The filing condition is the existing depth test, unchanged** (`observation-filing.md` → "The depth
 test"). What cannot pass it is not filed — not a shortfall, just not yet a finding.
 
+**A cost regression is filed.** The digest's `File a cost regression: …` line passes the depth test as
+printed — measured, with the command it names as the reproduction — and ranks first: one Issue names
+every regressed row, and the scout keeps a repeat sighting from filing twice.
+
 **Order what passes by effect, and file the top two.** **The third onward is stacked in the observation
 ledger** (drained by `pnpm josh observations:flush`). **File nothing when nothing passes.**
-`docs/maintainers/retrospective-rationale.md` → "Why the top two are a selection, not a ration".
 
 **Exclude what is already filed or already done, through the existing scout** (`issue-scout.md`): file
 with `pnpm josh issue:file`, which scouts first — an **open** candidate covering it means do not file, a
@@ -44,7 +44,7 @@ with `pnpm josh issue:file`, which scouts first — an **open** candidate coveri
 `- 人の判断: 不要`, so `issue:file` applies the label (with the run label
 `prompts/collaboration-workflow/issue-template.md` requires). **`backlogrun-steps.md` → "What one
 invocation approves" is that judgement's single source.** Every brake still counts these filings: the
-ten-per-invocation ceiling, the WIP cap, `--max` and the 150,000-token session budget.
+ten-per-run ceiling, the WIP cap, `--max` and the 135,000-token session budget.
 
 **Close with `pnpm josh run:carry --retrospective --summary "<result>" --owner "$PPID"`.** It marks the
 carry record so `run:step` prints `stop` from then on; the mark survives a session cut and is removed at

package/.claude/skills/workflow-commands/split-assessment.md

@@ -1,9 +1,7 @@
 # The split assessment — one definition, every entry point
 
 Before any entry point starts work on an Issue, decide whether the request is **one** deliverable or
-several. This file is the single definition; every command applies it identically. Reasons:
-`docs/maintainers/split-assessment-rationale.md` → "Why the default is not to split" and
-`docs/maintainers/split-assessment-rationale.md` → "Why diff size is not a reason to split".
+several. Every command applies it identically.
 
 ## The question
 
@@ -39,6 +37,18 @@ threshold that splits more is required to say why the round-1 measurement does n
 files and lines, test files excluded, and answers `split` / `single` on size alone. Separability stays
 a judgement, so its `split` is the size condition met, not a decision to divide.
 
+## Over the guide before the gate
+
+**Trigger: `pnpm josh main:merge` prints a `split notice`** — the branch's diff, untracked files
+included, answers `split` on `split:assess`. Take one action before `pnpm josh run:cut <N>`
+(`chain-rule.md` step 1) — the cut ends the turn, and the resumed run does not see the notice:
+
+- Keep it one Issue — it must land together: record why in one Issue comment, citing the counts.
+- Carve the rest out — the unimplemented part merges separately: `pnpm josh issue:file` it, narrow
+  this Issue's acceptance criteria to this branch, then gate.
+
+The notice never stops the run and never creates an epic.
+
 ## What each entry point does with the answer
 
 | Entry | Single | Two or more |
@@ -61,7 +71,7 @@ condition to evaluate.** **An entry point that applies a different condition is
 is the non-closing home for the split rationale.
 
 **Each split child is filed with the `route:split` label** —
-`pnpm josh issue:file "<sub-title>" --body-file <body-file> --depth <n> --route split` — and judged for
+`pnpm josh issue:file "<sub-title>" --body-file <body-file> --route split` — and judged for
 `auto-ok` like any filing (`kickoff.md` → "Words typed after `new`").
 
 ## Promote, or create a new epic

package/.claude/skills/workflow-commands/target-repository.md

@@ -2,8 +2,7 @@
 
 **This file is the prefix's single source, read at its point of use — the moment an entry is typed with an
 `owner/repo#` prefix (or a short `repo#` name), not at any entry.** A run given a bare `#N` or `new`
-targets the session's own repository and never reaches it. `SKILL.md` → §2's table keeps the trigger and
-points here. Rationale: `docs/maintainers/target-repository-rationale.md` → "Why the prefix reads as it does".
+targets the session's own repository and never reaches it.
 
 Every entry point takes the target repository in front of the Issue reference. Without it the target
 is the repository the session runs in.

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -1,7 +1,6 @@
 # The working-tree hold — one run per tree
 
-**The single source of the hold**, read at its point of use — the moment a run is about to claim or
-release the tree. History: `docs/maintainers/working-tree-hold-rationale.md` → "Where each rule came from".
+Read the moment a run is about to claim or release the tree.
 
 **Ask `pnpm josh run:hold` before anything else, and obey what it answers** — the first call of
 `fullrun` and `halfrun`, before the title, before `pnpm josh ms`, and **before a `new` entry files its
@@ -23,8 +22,7 @@ pnpm josh run:release --force # a record left behind by a run that has ended
 
 **The unit is the working tree** — one branch, one index and one uncommitted diff, and a linked work
 tree has its own three. **`backlogrun`'s per-repository guard (`epic-busy.ts`) is a separate layer.** **`kickoff`
-does not claim it** (`docs/maintainers/working-tree-hold-rationale.md` → "Why the unit is the working
-tree").
+does not claim it.**
 
 **Claim it in the checkout the run will edit** — a cross-repository `fullrun owner/repo#N` resolves
 that checkout from `pnpm josh doctor` **first** (a read) and claims there.
@@ -34,17 +32,17 @@ that checkout from `pnpm josh doctor` **first** (a read) and claims there.
 josh run:release --force` is the one spelling that removes a record this run did not write**, and the
 `busy` message names it.
 
-**Release what the claim recorded.** A `#N` entry releases `<N>`; a **`new` entry claimed before its
-Issue existed**, so it releases with the **bare** form — a `fullrun new` that stops on a split types
-`pnpm josh run:release`. The bare form removes no label, so every `new` stop that releases also runs
-`gh api -X DELETE repos/{owner}/{repo}/issues/<N>/labels/in-progress 2>/dev/null || true`.
+**Release what the claim recorded.** A `#N` entry releases `<N>`. A **`new` entry claimed before its
+Issue existed**, so once it files `<N>` it runs `pnpm josh run:hold --adopt <N>`, which re-keys the
+record to `<N>` and applies `in-progress`; from then on every stop releases with `run:release <N>`.
+A `new` stop before filing releases with the **bare** form.
 
 **Releasing is the run's, not a person's memory.** `pnpm josh followup` releases on a merged run; an
 abandoned record expires after 8 hours. **A stop that leaves the tree clean releases it explicitly** —
 a split, a prerequisite or a third-party target ends with `pnpm josh run:release <N>` (bare for a `new`
-entry, plus the label DELETE). **`halfrun`'s stop before commit keeps the hold**, as does a
-`needs-human-review` stop: the release command goes in the stop report and the Telegram for the person
-to type. **`fullrun #<N>` of the same issue adopts a `halfrun`'s kept hold** — "The halfrun resume"
+entry not yet adopted). **`halfrun`'s stop before commit keeps the hold** (`run:hold <N>
+--halfrun-stop`), as does a `needs-human-review` stop (`run:hold <N> --human-review-stop`); each is
+refused until `pnpm josh test:e2e` answered green on this tree, and sends its own `confirmation`. **`fullrun #<N>` of the same issue adopts a `halfrun`'s kept hold** — "The halfrun resume"
 below. **An expired record over a tree that still has uncommitted changes does not free it** — it
 answers `busy`; only an expired record over a clean tree is replaced.
 
@@ -56,10 +54,10 @@ run:hold` / `josh run:release`".
 
 **`fullrun #<N>` or `prrun #<N>` after a `halfrun` stop resumes it instead of claiming.** The stop is
 **recorded, never inferred**: the `halfrun` ends with `pnpm josh run:hold <N> --halfrun-stop`, marking
-its record (re-keying a `halfrun new`'s unnumbered one) — a `halfrun` still implementing or a
+its record (a `halfrun new` adopted its unnumbered one at filing) — a `halfrun` still implementing or a
 `backlogrun` child leaves the same dirty tree and is not adopted. On a marked hold for `#<N>`,
 `run:entry` asks the session budget, adopts the hold and prints `entry #<N> — resume: halfrun`. **Skip
-the title, the plan, the split assessment, `pnpm josh ms`, `latest:scope` and the implementation**;
+the title, the plan, the split assessment, `pnpm josh ms`, `latest:if-required` and the implementation**;
 re-read the issue (`pnpm josh issue:read <N>`), run the gate **in full** from the refactor
 (`chain-rule.md` → "Run the review-to-merge chain"), and ship as any `fullrun` does.
 

package/.codex/hooks.json

@@ -6,7 +6,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
+						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
 						"timeout": 180
 					}
 				]
@@ -17,7 +17,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
+						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
 						"timeout": 10
 					}
 				]
@@ -25,11 +25,11 @@
 		],
 		"PreToolUse": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|Agent|Task|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
+						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
 						"timeout": 20
 					}
 				]
@@ -41,7 +41,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
+						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
 						"timeout": 90
 					}
 				]
@@ -53,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
+						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-node/action.yml

@@ -22,11 +22,20 @@ inputs:
     required: false
     default: ''
 
+# The exact version `'24'` resolved to on this runner (joshuafolkken/kit#4346). Runner images do not
+# all carry the same patch release, and ESLint folds `process.version` into every cache entry, so a
+# cache restored across two patch releases is cold; the ESLint cache key names this value.
+outputs:
+  node-version:
+    description: The Node.js version installed, as actions/setup-node reports it (e.g. `v24.22.0`).
+    value: ${{ steps.setup-node.outputs.node-version }}
+
 runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      id: setup-node
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '24'
         registry-url: ${{ inputs.registry-url }}

package/.github/actions/setup-pnpm/action.yml

@@ -49,7 +49,7 @@ runs:
         echo "version=$version" >> "$GITHUB_OUTPUT"
 
     - name: Setup pnpm
-      uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
       with:
         version: ${{ steps.pnpm-version.outputs.version }}
         runtime: ${{ inputs.runtime }}

package/.github/dependabot.yml

@@ -8,6 +8,18 @@ updates:
       - '/.github/actions/*'
     schedule:
       interval: 'weekly'
+    # One pull request for every minor and patch bump. Separate pull requests that touch the same
+    # workflow file leave the later merge writing workflow content its head does not hold, which
+    # `GITHUB_TOKEN` may not, so GitHub withdraws its auto-merge (joshuafolkken/kit#4148). kit's own
+    # file only: the distributed `templates/dependabot.yml` stays ungrouped, because a consumer's
+    # auto-merge holds a whole pull request that touches an upstream-managed workflow.
+    groups:
+      github-actions:
+        update-types:
+          - 'minor'
+          - 'patch'
+    cooldown:
+      default-days: 3
   # Version updates are disabled: `josh latest` runs at the start of every fullrun / halfrun /
   # queue and already bumps npm dependencies to latest, so Dependabot's weekly PRs only duplicate
   # it and were being closed unmerged after consuming a full CI run. `open-pull-requests-limit: 0`
@@ -21,3 +33,7 @@ updates:
     schedule:
       interval: 'weekly'
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 3
+      exclude:
+        - 'vite'

package/.github/release.yml

@@ -7,11 +7,9 @@ changelog:
   categories:
     - title: Breaking Changes 🛠
       labels:
-        - Semver-Major
         - breaking-change
     - title: Exciting New Features 🎉
       labels:
-        - Semver-Minor
         - enhancement
     - title: Bug Fixes 🐛
       labels:

package/.github/workflows/ci.yml

@@ -51,6 +51,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
@@ -87,6 +89,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # The MCR image lags the npm publish by days, so a version-derived tag is not
       # guaranteed to exist. Probe it first and fall back to a plain runner instead of
@@ -150,6 +154,8 @@ jobs:
       pull-requests: read
     outputs:
       reuse: ${{ steps.prove.outputs.reuse }}
+      run-id: ${{ steps.prove.outputs.run-id }}
+      pull-number: ${{ steps.prove.outputs.pull-number }}
     steps:
       - name: Prove the pushed tree passed PR Checks
         id: prove
@@ -217,6 +223,8 @@ jobs:
           fi
 
           echo 'reuse=true' >> "$GITHUB_OUTPUT"
+          echo "run-id=${run_id}" >> "$GITHUB_OUTPUT"
+          echo "pull-number=${pull_number}" >> "$GITHUB_OUTPUT"
           echo "Reusing successful PR Checks for tree ${current_tree}."
 
   # joshuafolkken/kit#1226 split the gate's four checks across two runners. The unit suite is the only
@@ -250,8 +258,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Setup Node.js
+        id: setup-node
         uses: ./.github/actions/setup-node
         with:
           registry-url: 'https://npm.pkg.github.com'
@@ -273,11 +283,19 @@ jobs:
           # first — so the cache tracks `main` instead of freezing on the first commit that hit the
           # config-hash key and never re-saving. The config-hash body above still cold-invalidates on a
           # rule edit exactly as before; the sha only ever adds a save, never suppresses one.
-          key: ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
+          # joshuafolkken/kit#4346: ESLint hashes `process.version` into every entry, and runner
+          # images carry different Node.js patch releases for `'24'`. Restored across two of them,
+          # every entry was stale and lint ran cold (~340s against ~60s), so the resolved version
+          # leads every key and restore-key: each release keeps its own lineage.
+          # joshuafolkken/kit#4496: the key is not built from `scripts/gate/toolchain-inputs.ts`, the
+          # list every local reuse reads — the cache is restored before the install, with no tsx to run
+          # it. The lockfile and eslint config hashes move it with the two inputs ESLint's own
+          # per-entry check does not cover.
+          key: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
-            ${{ runner.os }}-eslint-cache-${{ hashFiles('pnpm-lock.yaml') }}-
-            ${{ runner.os }}-eslint-cache-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-
 
       # `.tsbuildinfo` and `.cspellcache` were not cached in CI at all, so the type check and spell
       # check ran cold on every run. Both are content-addressed — `tsc` records its compiler options
@@ -360,6 +378,76 @@ jobs:
         env:
           JOSH_METRICS_BASE: HEAD^1
 
+      # joshuafolkken/kit#4449: a main push that reuses this run skips the job above, so it saves no
+      # ESLint cache, and a later pull request restored an entry several merges old. Since
+      # joshuafolkken/kit#4415 every entry whose imports changed since then is linted afresh — 1,180 to
+      # 2,281 of about 3,200 files at 38 to 58 changed ones. The cache this run leaves is the cache of
+      # the tree the push carries, so it is handed to `seed-eslint-cache` below rather than linted
+      # again there. The prefix is the cache key above without its sha; the seed job saves it under
+      # the push's sha, and the test pins the two together. The upload only saves time, so a
+      # transient artifact-service error must not turn this required job red; it continues on error.
+      - name: Write ESLint cache prefix
+        id: eslint-cache-prefix
+        if: github.event_name == 'pull_request'
+        env:
+          ESLINT_CACHE_PREFIX: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+        run: printf '%s\n' "${ESLINT_CACHE_PREFIX}" > eslint-cache-prefix
+
+      - name: Upload ESLint cache
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: eslint-cache-${{ github.event.pull_request.number }}
+          path: |
+            .eslintcache
+            eslint-cache-prefix
+          include-hidden-files: true
+          retention-days: 1
+
+  # joshuafolkken/kit#4449: the other half of the hand-off above. It runs only on a push that reused
+  # a pull request's Checks, reads that exact run's cache, and saves it under this push's sha, so the
+  # next pull request restores the cache of the tree it branched from. `actions/cache` misses on the
+  # fresh key and saves the downloaded file in its post step; the prefix is checked before it becomes
+  # a key. A missing artifact — a run from before this — or a prefix that is not a key saves nothing
+  # and leaves the push green; the next pull request then restores an older entry, as it did before.
+  seed-eslint-cache:
+    name: Seed ESLint Cache
+    needs: reuse-pr-checks
+    if: ${{ needs.reuse-pr-checks.outputs.reuse == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      actions: read
+    steps:
+      - name: Download the reused run's ESLint cache
+        id: download
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ needs.reuse-pr-checks.outputs.run-id }}
+          PULL_NUMBER: ${{ needs.reuse-pr-checks.outputs.pull-number }}
+        run: |
+          if ! gh run download "${RUN_ID}" --repo "${REPOSITORY}" --name "eslint-cache-${PULL_NUMBER}"; then
+            echo '::notice::The reused run left no ESLint cache; saving nothing.'
+            exit 0
+          fi
+          prefix=$(cat eslint-cache-prefix)
+          if ! printf '%s' "${prefix}" | grep -Eq '^[A-Za-z]+-eslint-cache-v[0-9.]+-[0-9a-f]+-[0-9a-f]+-$'; then
+            echo '::warning::The ESLint cache prefix is not a cache key; saving nothing.'
+            exit 0
+          fi
+          echo "prefix=${prefix}" >> "$GITHUB_OUTPUT"
+
+      - name: Save the ESLint cache under this push
+        id: save
+        if: steps.download.outputs.prefix != ''
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            .eslintcache
+          key: ${{ steps.download.outputs.prefix }}${{ github.sha }}
+
   # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
   # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
   # (joshuafolkken/kit#2982), which `templates/workflows/ci.yml` calls the same way, so
@@ -374,16 +462,21 @@ jobs:
   # its files over more machines. `fail-fast: false` keeps a red shard from cancelling the others,
   # so one run reports every failing file. The `Checks` aggregate below reads `needs.unit.result`,
   # which for a matrix is `success` only when every shard succeeded — no change there is needed.
+  # The shards split by the recorded per-file durations in `tools/test/unit-durations.json`, not by
+  # file count, so they finish together (`tools/test/duration-shard.ts`, joshuafolkken/kit#4467).
+  # Four shards, not three (joshuafolkken/kit#4573): balanced at three, each shard still ran its tests
+  # for 196–227 seconds and set the CI wait; a fourth cuts each slice by a quarter for about 12
+  # seconds of duplicated setup.
   # Only kit shards: the distributed template runs the unit suite inside its single `checks` job,
   # where a small consumer suite would pay the duplicated setup and could leave a shard with no file.
   unit:
-    name: Unit Tests (${{ matrix.shard }}/3)
+    name: Unit Tests (${{ matrix.shard }}/4)
     needs: reuse-pr-checks
     if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4]
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -392,6 +485,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -413,7 +508,7 @@ jobs:
       # `scripts/ci/ci-yml-unit-job.test.ts` pins the command; the guard itself is
       # `scripts/test/test-unit-guard.ts`.
       - name: Run unit tests
-        run: pnpm josh test:unit --shard=${{ matrix.shard }}/3
+        run: pnpm josh test:unit --shard=${{ matrix.shard }}/4
 
       # One shard is enough: the check does not depend on which test files ran beside it.
       - name: Verify optional ESLint consumer install
@@ -440,21 +535,30 @@ jobs:
   # shell body is the pattern to keep out of a workflow regardless of the value's provenance.
   checks:
     name: Checks
-    needs: [reuse-pr-checks, static-checks, unit]
+    needs: [reuse-pr-checks, static-checks, unit, node-compat]
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 2
     permissions: {}
     steps:
+      # `node-compat` is aggregated here rather than added to the ruleset: the ruleset holds the one
+      # `Checks` context, and a matrix check name would drift with every Node version bump. It runs on
+      # the reuse path too, so its result is required on both paths (joshuafolkken/kit#4545).
       - name: Require both halves of the verification gate
         env:
           REUSE_RESULT: ${{ needs.reuse-pr-checks.outputs.reuse }}
           STATIC_RESULT: ${{ needs.static-checks.result }}
           UNIT_RESULT: ${{ needs.unit.result }}
+          NODE_RESULT: ${{ needs.node-compat.result }}
         run: |
           echo "Reuse PR Checks: ${REUSE_RESULT}"
           echo "Static Checks: ${STATIC_RESULT}"
           echo "Unit Tests: ${UNIT_RESULT}"
+          echo "Node builds: ${NODE_RESULT}"
+          if [ "${NODE_RESULT}" != 'success' ]; then
+            echo "::error::the Node build matrix did not pass"
+            exit 1
+          fi
           if [ "${STATIC_RESULT}" = 'success' ] && [ "${UNIT_RESULT}" = 'success' ]; then
             exit 0
           fi
@@ -476,7 +580,7 @@ jobs:
 
       - name: Upload PR Checks evidence
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-checks-${{ github.event.pull_request.number }}
           path: pr-checks-evidence
@@ -491,9 +595,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run security audit
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
         with:
           scan-args: --lockfile=pnpm-lock.yaml
 
@@ -508,6 +614,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # The same rule `scripts/test/test-e2e-guard.ts` applies locally, so a suite that runs under
       # `pnpm josh test:e2e` is a suite CI runs too. Every `*.e2e.{ts,js}` outside `node_modules`
@@ -561,6 +669,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
@@ -601,7 +711,7 @@ jobs:
       # marked red on the run and a missing report is never silent. This job is skipped while kit
       # ships no E2E specs; the guard is here so adding one cannot quietly turn the gap live.
       - name: Upload test results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         continue-on-error: true
         with:

package/.github/workflows/publish.yml

@@ -23,6 +23,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
 
@@ -34,7 +36,7 @@ jobs:
 
       # Kept as long as GitHub lets a run be re-run, so re-running a failed publish job still finds
       # the tarball instead of forcing a full re-run that republishes an existing version.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: kit-package
           path: ${{ runner.temp }}/kit.tgz
@@ -54,6 +56,8 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
         with:
@@ -83,7 +87,7 @@ jobs:
         env:
           LATEST: ${{ steps.registry-latest.outputs.latest }}
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: kit-package
           path: ${{ runner.temp }}
@@ -110,6 +114,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
         with:
@@ -126,7 +132,7 @@ jobs:
         with:
           cache: 'false'
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: kit-package
           path: ${{ runner.temp }}
@@ -167,6 +173,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: ./.github/actions/setup-node
 

package/.github/workflows/sonar-qube.yml

@@ -40,6 +40,7 @@ jobs:
         if: env.SONAR_TOKEN != ''
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
+          persist-credentials: false
       # The dependencies are installed before the scan, on a push as well as on a pull request:
       # `tsconfig.sonar.json` extends `@joshuafolkken/kit/tsconfig/base`, which a consumer resolves
       # only from node_modules, so a scan ahead of the install read a config it could not load

package/.prettierignore

@@ -6,6 +6,8 @@
 !.claude/.claude-plugin/
 # Prettier pads every Markdown table column, which grows the skills past their byte budgets (joshuafolkken/kit#3325)
 .claude/**/*.md
+# Generated one-row-per-command table, pinned by its generator's test; padding would multiply its size (#4162)
+docs/josh-command-catalog.md
 
 # Package Managers
 package-lock.json

package/.vscode/tasks.json

@@ -7,8 +7,7 @@
 			"command": "pnpm josh run:board",
 			"isBackground": true,
 			"problemMatcher": [],
-			"presentation": { "reveal": "always", "panel": "dedicated", "focus": false },
-			"runOptions": { "runOn": "folderOpen" }
+			"presentation": { "reveal": "always", "panel": "dedicated", "focus": false }
 		}
 	]
 }