@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/backlog/backlog-overlap.ts

@@ -2,6 +2,7 @@ import type { BusyRead } from '#scripts/epic/epic-busy'
 import type { EpicChild } from '#scripts/epic/epic-graph'
 import type { SoloSelection } from '#scripts/epic/epic-solo'
 import { session_cite } from '#scripts/issue/session-cite'
+import { lane_state, type LaneRecords } from '#scripts/lane/lane-state'
 
 // Which candidates may not run side by side because their bodies declare overlapping paths.
 // joshuafolkken/kit#3221 held back only a path both bodies named beside a move, split, rename or
@@ -16,11 +17,16 @@ import { session_cite } from '#scripts/issue/session-cite'
 const CODE_SPAN = /`([^`\s]+)`/gu
 const LINE_SUFFIX = /:\d+(?:[-:]\d+)?$/u
 const FILE_EXTENSION = /\.[a-z]\w*$/iu
-const ROOT_FILE_EXTENSION = /\.(?:[cm]?[jt]sx?|svelte|jsonc?|md|ya?ml|css|html|sh|toml|txt)$/u
+// `properties`: `sonar-project.properties`, which joshuafolkken/kit#5083 and its holder both named
+// and neither declared (joshuafolkken/kit#5107).
+const ROOT_FILE_EXTENSION =
+	/\.(?:[cm]?[jt]sx?|svelte|jsonc?|md|ya?ml|css|html|sh|toml|txt|properties)$/u
 const GLOB = '*'
 const ISSUE_MARK = '#'
 const SEPARATOR = '/'
 const MIN_DIRECTORY_DEPTH = 2
+const DOCS_DIRECTORY = 'docs/'
+const MARKDOWN = '.md'
 
 // The paths each issue declares, by issue number. A directory ends in `/`; anything else is a file.
 type Declared = ReadonlyMap<number, ReadonlySet<string>>
@@ -51,9 +57,8 @@ function claim_of(path: string): string | undefined {
 	return is_file(path) ? path : undefined
 }
 
-// The backticked files and directories `body` declares.
-function declared_paths(body: string): ReadonlySet<string> {
-	const tokens = [...body.matchAll(CODE_SPAN)].map((match) => match[1] ?? '')
+// The files and directories `tokens` claim — a body's code spans, or the paths a lane plans to edit.
+function path_claims(tokens: ReadonlyArray<string>): ReadonlySet<string> {
 	const paths = tokens
 		.filter((token) => !token.includes(ISSUE_MARK))
 		.map((token) => claim_of(without_glob(token.replace(LINE_SUFFIX, ''))))
@@ -61,6 +66,11 @@ function declared_paths(body: string): ReadonlySet<string> {
 	return new Set(paths.filter((path) => path !== undefined))
 }
 
+// The backticked files and directories `body` declares.
+function declared_paths(body: string): ReadonlySet<string> {
+	return path_claims([...body.matchAll(CODE_SPAN)].map((match) => match[1] ?? ''))
+}
+
 function declared_of(issues: ReadonlyArray<DeclaringIssue>): Declared {
 	return new Map(issues.map((issue) => [issue.number, declared_paths(issue.body ?? '')]))
 }
@@ -69,13 +79,25 @@ function contains(outer: string, inner: string): boolean {
 	return outer.endsWith(SEPARATOR) ? inner.startsWith(outer) : outer === inner
 }
 
+// A document under `docs/` — a Markdown file or a directory of them. Nearly every issue edits one
+// (`docs/josh-commands-run.md`), and the lane's sync with main resolves the overlap, so holding a lane
+// back for it cost a whole lane each (joshuafolkken/kit#4926). `prompts/` and `.claude/` are the rules
+// themselves and still count.
+function is_shared_document(path: string): boolean {
+	return path.startsWith(DOCS_DIRECTORY) && (path.endsWith(SEPARATOR) || path.endsWith(MARKDOWN))
+}
+
 function overlaps(left: string, right: string): boolean {
+	if (is_shared_document(left) || is_shared_document(right)) return false
+
 	return contains(left, right) || contains(right, left)
 }
 
 interface SeparateContext {
 	read: BusyRead
 	repo: string
+	// The holders' lane state records, so a clash names a paused holder (joshuafolkken/kit#4270).
+	lanes?: LaneRecords | undefined
 }
 
 // The path each of `holders` declares, mapped to the issue that holds it.
@@ -122,23 +144,44 @@ interface Holding {
 	repo: string
 }
 
+// The path of `paths` that one of `holders` already declares — what `lane:plan` yields on.
+function path_clash(
+	paths: ReadonlySet<string>,
+	declared: Declared,
+	holders: ReadonlyArray<number>,
+): Clash | undefined {
+	return clash_of(claims_of(declared, holders), paths)
+}
+
 // The path `child` declares that one of the running `holders` already declares — the clash `separate`
 // withholds a candidate on, for a reader that names the running issues itself (`run:board`).
 function running_clash(child: EpicChild, declared: Declared, holding: Holding): Clash | undefined {
-	const claims = claims_of(declared, holding.holders)
+	return path_clash(paths_of(child, declared, holding.repo), declared, holding.holders)
+}
 
-	return clash_of(claims, paths_of(child, declared, holding.repo))
+// Whether `waiting` declares a path `holder` declares — the overlap `separate` withholds it on.
+function holds(declared: Declared, holder: number, waiting: number): boolean {
+	return clash_of(claims_of(declared, [holder]), declared.get(waiting) ?? new Set()) !== undefined
 }
 
-function clash_note(child: EpicChild, clash: Clash): string {
+// ` — paused since 01:28 by lane:pause` for a holder whose lane is paused: it holds the path while
+// nothing moves, so the wait lasts until someone resumes it.
+function paused_tail(clash: Clash, lanes: LaneRecords): string {
+	const note = lane_state.paused_note(lanes.get(String(clash.holder)))
+
+	return note === undefined ? '' : ` — ${note}`
+}
+
+function clash_note(child: EpicChild, clash: Clash, lanes: LaneRecords): string {
 	const waiting = session_cite.issue(child.number, undefined, child.repo)
 	const holder = session_cite.issue(clash.holder, undefined, child.repo)
 
-	return `${waiting} waits: its \`${clash.path}\` overlaps \`${clash.claimed}\`, which ${holder} declares.`
+	return `${waiting} waits: its \`${clash.path}\` overlaps \`${clash.claimed}\`, which ${holder} declares${paused_tail(clash, lanes)}.`
 }
 
 interface Walk {
 	claims: Map<string, number>
+	lanes: LaneRecords
 	offered: Array<EpicChild>
 	withheld: Array<EpicChild>
 	notes: Array<string>
@@ -155,7 +198,7 @@ function visit(walk: Walk, child: EpicChild, paths: ReadonlySet<string>): void {
 	}
 
 	walk.withheld.push(child)
-	walk.notes.push(clash_note(child, clash))
+	walk.notes.push(clash_note(child, clash, walk.lanes))
 }
 
 function merged_notice(
@@ -176,6 +219,7 @@ function separate(
 ): SoloSelection {
 	const walk: Walk = {
 		claims: running_claims(declared, context.read),
+		lanes: context.lanes ?? new Map(),
 		offered: [],
 		withheld: [],
 		notes: [],
@@ -189,7 +233,15 @@ function separate(
 	return { offered: walk.offered, withheld, ...(notice !== undefined && { notice }) }
 }
 
-const backlog_overlap = { declared_of, declared_paths, running_clash, separate }
+const backlog_overlap = {
+	declared_of,
+	declared_paths,
+	holds,
+	path_claims,
+	path_clash,
+	running_clash,
+	separate,
+}
 
 export { backlog_overlap }
 export type { Clash, Declared }

package/scripts/backlog/backlog-plan-cli.ts

@@ -6,6 +6,7 @@ import { backlog_named } from './backlog-named'
 import { backlog_next } from './backlog-next'
 import { backlog_plan, type NamedPlan } from './backlog-plan'
 import { backlog_plan_read, type OpenListing, type Plan } from './backlog-plan-read'
+import { backlog_rank } from './backlog-rank'
 import { backlog_scope } from './backlog-scope'
 import { backlog_waves } from './backlog-waves'
 
@@ -105,7 +106,9 @@ function print_plan(plan: Plan, listing: OpenListing, view: PlanView): void {
 	const scope = { repo: plan.repo, exclude: plan.exclude, tracked: plan.tracked }
 	const rows = backlog_scope.out_of_scope(listing.rows, plan.result, scope)
 
-	console.info(backlog_plan.format_plan(plan.result, rows, context, view.named))
+	const ordered = backlog_rank.offer_order(plan.result, plan.repo, plan.scope.yielded)
+
+	console.info(backlog_plan.format_plan(ordered, rows, context, view.named))
 }
 
 async function report(plan: Plan, view: PlanView): Promise<number> {

package/scripts/backlog/backlog-plan-comment.ts

@@ -0,0 +1,81 @@
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { has_any_label, PLANNED_LABEL } from '#scripts/issue/issue-labels'
+import { issue_read, type IssueComment } from '#scripts/issue/issue-read'
+import { markdown_section } from '#scripts/issue/markdown-section'
+import { plan_consumers_section } from '#scripts/issue/plan-consumers-section'
+import { lane_plan } from '#scripts/lane/lane-plan'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { backlog_overlap, type Declared } from './backlog-overlap'
+
+// The paths a pool issue declares — the plan a running lane recorded with `lane:plan`, else the plan
+// `issue:plan` posted as a comment, else its body.
+//
+// **A plan replaces the body**: a body cites paths as evidence (joshuafolkken/kit#4937). A plan naming
+// no path leaves the body.
+//
+// **A plan posted as a comment declares paths too.** joshuafolkken/kit#4910's body named none of the
+// files its plan comment did, so dispatch saw no overlap with joshuafolkken/kit#4911 and
+// joshuafolkken/kit#4907, and the lane sat in `lane:plan`'s `wait` for 23 minutes
+// (joshuafolkken/kit#4923). Only a `run:planned` issue is read, so an unplanned pool costs no request,
+// and only a trusted author's comment counts — the same trust `issue:read` applies. A plan is the
+// comment carrying the consumers section `issue:plan` refuses a plan without; the latest one wins.
+// A listing that cannot be read leaves the body alone — the scope dispatch gated on before — and
+// `lane:plan` still holds the lane at its first edit.
+
+const PLANNED: ReadonlySet<string> = new Set([PLANNED_LABEL])
+const READ_CONCURRENCY = 8
+
+interface PoolIssue {
+	number: number
+	body?: string | undefined
+	labels?: ReadonlyArray<{ name: string }> | undefined
+}
+
+function is_plan(comment: IssueComment): boolean {
+	return (
+		comment.is_trusted === true &&
+		markdown_section.has_line(comment.body, plan_consumers_section.HEADING)
+	)
+}
+
+// The latest trusted plan among `comments`, less its consumers section — whose entries are readers,
+// not edited files — or `undefined` when none is one.
+function plan_of(comments: ReadonlyArray<IssueComment>): string | undefined {
+	const plan = comments.findLast((comment) => is_plan(comment))?.body
+
+	return plan === undefined ? undefined : plan_consumers_section.without(plan)
+}
+
+// The plan comment `issue` carries, or `undefined` when none does or the listing could not be read.
+async function read_plan(issue: number): Promise<string | undefined> {
+	const json = await git_gh_issue_read.issue_list_comments(String(issue))
+	const comments = await issue_read.parse_comments(json)
+
+	return comments === undefined ? undefined : plan_of(comments)
+}
+
+// The paths `issue`'s plan comment declares — what `lane:plan` is handed before the first edit.
+async function plan_paths(issue: number): Promise<ReadonlyArray<string>> {
+	return [...backlog_overlap.declared_paths((await read_plan(issue)) ?? '')]
+}
+
+async function with_plan(issue: PoolIssue): Promise<PoolIssue> {
+	if (!has_any_label(issue.labels, PLANNED)) return issue
+
+	const plan = await read_plan(issue.number)
+
+	if (plan === undefined || backlog_overlap.declared_paths(plan).size === 0) return issue
+
+	return { ...issue, body: plan }
+}
+
+// What each of `issues` declares, read from `directory`'s lane plans — the scope dispatch gates on.
+async function declared_of(issues: ReadonlyArray<PoolIssue>, directory: string): Promise<Declared> {
+	const planned = await bounded_pool.bounded_map(issues, READ_CONCURRENCY, with_plan)
+
+	return lane_plan.with_plans(backlog_overlap.declared_of(planned), directory)
+}
+
+const backlog_plan_comment = { declared_of, plan_of, plan_paths }
+
+export { backlog_plan_comment }

package/scripts/backlog/backlog-plan-read.ts

@@ -4,7 +4,10 @@ import type { EpicNextResult } from '#scripts/epic/epic-report'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { open_issue_schema, type OpenIssueData } from '#scripts/git/git-schemas'
 import { read_json_listing } from '#scripts/git/parse-json-array'
-import { backlog_next, type OptedIn } from './backlog-next'
+import { issue_sample_prime } from '#scripts/issue/issue-sample-prime'
+import { lane_capacity } from '#scripts/lane/lane-capacity'
+import { backlog_gate_scope, type OptedIn } from './backlog-gate-scope'
+import { backlog_next } from './backlog-next'
 import type { PlanContext } from './backlog-plan'
 import type { GateScope } from './backlog-rank'
 import { backlog_scope } from './backlog-scope'
@@ -23,8 +26,8 @@ interface Plan {
 	// past the listing cap. Carrying the *whole* index here instead would move that misreport rather
 	// than remove it: the sentence would name an epic that is withholding nothing.
 	tracked: ReadonlyMap<number, number>
-	// The rows the offer's cap bounds and the paths each issue declares, so `--waves` cuts each
-	// wave where `backlog:next` does.
+	// The rows the offer's cap bounds and the paths each issue declares, so `--waves` separates each
+	// wave as `backlog:next` does — and the lane limit it cuts each wave at.
 	scope: GateScope
 }
 
@@ -41,6 +44,14 @@ interface PlanRead {
 	listing: OpenListing
 }
 
+// The lane limit a wave is cut at, capped at the port seats as a launch is; `undefined` when the
+// limit cannot be read, so the plan stays drawable and says it is uncapped.
+async function read_wave_limit(): Promise<number | undefined> {
+	const choice = await lane_capacity.lane_limit()
+
+	return choice.kind === 'limit' ? lane_capacity.seated_limit(choice.limit) : undefined
+}
+
 // The same reads and the same classification `backlog:next` makes, through the same two functions.
 // `undefined` is a failure it has already reported.
 async function classify(
@@ -60,7 +71,10 @@ async function classify(
 		repo: context.repo,
 		exclude,
 		tracked: epic_index.withheld_children(context.tracking.index, context.opted_in.issues),
-		scope: backlog_next.gate_scope(context),
+		scope: {
+			...(await backlog_gate_scope.gate_scope(context)),
+			wave_limit: await read_wave_limit(),
+		},
 	}
 }
 
@@ -74,7 +88,10 @@ async function fetch_open(): Promise<OpenListing | undefined> {
 
 	const read = read_json_listing(json, open_issue_schema)
 
-	return read.kind === 'read' ? { rows: read.rows, is_capped } : undefined
+	if (read.kind !== 'read') return undefined
+	await issue_sample_prime.prime(read.rows.map((row) => row.body))
+
+	return { rows: read.rows, is_capped }
 }
 
 // A cut listing cannot say an issue is closed, only that it was not read — so the blocker filter is

package/scripts/backlog/backlog-plan.ts

@@ -4,7 +4,12 @@ import { epic_report, type EpicNextResult } from '#scripts/epic/epic-report'
 import { epic_solo } from '#scripts/epic/epic-solo'
 import { epic_triage } from '#scripts/epic/epic-triage'
 import { issue_cite } from '#scripts/issue/issue-cite'
-import { has_label_name, IN_PROGRESS_LABEL, RUN_SOLO_LABEL } from '#scripts/issue/issue-labels'
+import {
+	has_label_name,
+	IN_PROGRESS_LABEL,
+	PARKED_LABELS,
+	RUN_SOLO_LABEL,
+} from '#scripts/issue/issue-labels'
 import type { OutOfScopeRow } from './backlog-scope'
 
 // The plan a person reads before a `backlogrun` starts.
@@ -30,8 +35,9 @@ const ONLY_NAMED_HEADING =
 const READY_HEADING =
 	'Ready now — each takes a free lane in its repository, so these may run in parallel:'
 const WAITING_HEADING = 'Waiting — each names what it is waiting on:'
-const HUMAN_HEADING =
-	'Waiting on a person (`needs-decision`) — resolve these before the run starts:'
+// Every park label (`PARKED_LABELS`) puts a child here, so the heading names none and each row names
+// its own: a `run:stalled` row read as `needs-decision` sends a person to decide a mechanical failure.
+const HUMAN_HEADING = 'Waiting on a person — resolve these before the run starts:'
 const SCOPE_HEADING = 'Out of scope — open, but the backlog will not run these:'
 // `epic_report`'s own words for the same condition, so the plan and the run name it identically.
 const UNUSABLE_HEADING = 'The dependency graph is unusable, so there is no plan:'
@@ -150,6 +156,14 @@ function child_lines(
 	return children.map((child) => row_of(child, context, note(child)))
 }
 
+// The park labels a child carries, so its row says what the person is asked for.
+function park_note(child: EpicChild): string {
+	return [...PARKED_LABELS]
+		.filter((label) => has_label_name(child.labels, label))
+		.map((label) => `\`${label}\``)
+		.join(', ')
+}
+
 // A section whose rows say nothing beyond naming the issue: being under the heading is the whole
 // statement.
 function no_note(): string {
@@ -239,7 +253,7 @@ function format_plan(
 		'',
 		section(WAITING_HEADING, waiting_lines(result.waiting, context)),
 		'',
-		section(HUMAN_HEADING, child_lines(result.blocked_on_people, context, no_note)),
+		section(HUMAN_HEADING, child_lines(result.blocked_on_people, context, park_note)),
 		'',
 		section(SCOPE_HEADING, scope_lines(out_of_scope, context.repo)),
 	].join('\n')

package/scripts/backlog/backlog-pool.ts

@@ -1,3 +1,4 @@
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
 import { auto_ok_cli } from '#scripts/auto-ok/auto-ok-cli'
 import type { Classification } from '#scripts/epic/epic-classify'
 import { epic_graph, type EpicChild, type GraphAnomaly } from '#scripts/epic/epic-graph'
@@ -7,12 +8,7 @@ import type { EpicView } from '#scripts/epic/epic-next-views'
 import { epic_outside_blocker } from '#scripts/epic/epic-outside-blocker'
 import type { OpenIssueData } from '#scripts/git/git-schemas'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
-import {
-	ALREADY_DONE_LABEL,
-	EPIC_LABEL,
-	has_any_label,
-	NEEDS_DECISION_LABEL,
-} from '#scripts/issue/issue-labels'
+import { EPIC_LABEL, has_any_label, PARKED_LABELS } from '#scripts/issue/issue-labels'
 
 // The candidate pool `josh backlog:next` answers from.
 //
@@ -25,11 +21,12 @@ import {
 
 const EPIC_LABELS: ReadonlySet<string> = new Set([EPIC_LABEL])
 // The labels that put a withheld row in the "needs a person" bucket rather than the "waiting on
-// time" one. `already-done` belongs with `needs-decision` because no amount of waiting moves it: the
-// work is merged and the close is Tier C, so a person is the only thing that resolves it.
+// time" one are the park labels (`PARKED_LABELS`). `already-done` and `run:stalled` belong with
+// `needs-decision` because no amount of waiting moves them: the work is merged and the close is Tier C,
+// or a mechanical cause has to be fixed, so a person is the only thing that resolves it.
 // Read as `time`, it would be reported as something that resolves itself
-// and nobody would ever be told to close it.
-const DECISION_LABELS: ReadonlySet<string> = new Set([NEEDS_DECISION_LABEL, ALREADY_DONE_LABEL])
+// and nobody would ever be told to act on it.
+const DECISION_LABELS: ReadonlySet<string> = PARKED_LABELS
 
 // What decides whether a standalone row is offered: the children an opted-in epic is going to offer
 // instead, the ones the caller has named as done, and the repository the rows belong to.
@@ -65,13 +62,19 @@ function waits_outside(issue: OpenIssueData, running: ReadonlySet<string>, repo:
 		.some((blocker) => blocker.state === 'OPEN' && !running.has(epic_graph.blocker_key(blocker)))
 }
 
-function needs_person(issue: OpenIssueData, context: StandaloneContext): boolean {
+// An issue whose author lacks write access waits on a person too: only they can vouch for its body.
+function is_stuck(issue: OpenIssueData, running: ReadonlySet<string>, repo: string): boolean {
 	return (
+		!auto_ok_author.is_author_trusted(issue) ||
 		has_any_label(issue.labels, DECISION_LABELS) ||
-		waits_outside(issue, context.running, context.repo)
+		waits_outside(issue, running, repo)
 	)
 }
 
+function needs_person(issue: OpenIssueData, context: StandaloneContext): boolean {
+	return is_stuck(issue, context.running, context.repo)
+}
+
 // Each open epic's key, read off the tracking index — child number to the epics listing it.
 function epic_keys_of(tracking: TrackingIndex, repo: string): ReadonlySet<string> {
 	return new Set([...tracking.values()].flat().map((number) => epic_graph.key_of({ repo, number })))
@@ -106,10 +109,6 @@ function rooted(
 	return with_tracking_epics(members, tracking, repo)
 }
 
-function is_stuck(issue: OpenIssueData, running: ReadonlySet<string>, repo: string): boolean {
-	return has_any_label(issue.labels, DECISION_LABELS) || waits_outside(issue, running, repo)
-}
-
 // The running set with every standalone row a person has to resolve taken out, repeated until a pass
 // removes nothing — a row waiting on such a row waits on that person too, however long the chain.
 function settle_standalone(
@@ -140,6 +139,9 @@ function settle_standalone(
 // `epic_issue.blocker_references_of` is the epic side's own resolution —
 // `repository_url` when the node names one, this repository only as the fallback an unqualified
 // relation has always meant — and it is reused rather than repeated.
+//
+// The body rides along as an epic child's does, so a declared start time (`issue-not-before.ts`)
+// reaches the classification and the board's waiting row for a standalone row too (#4014).
 function to_child(issue: OpenIssueData, repo: string): EpicChild {
 	return {
 		number: issue.number,
@@ -147,6 +149,7 @@ function to_child(issue: OpenIssueData, repo: string): EpicChild {
 		state: 'OPEN',
 		labels: (issue.labels ?? []).map((label) => label.name),
 		blocked_by: epic_issue.blocker_references_of(issue, repo),
+		body: issue.body,
 	}
 }
 
@@ -293,6 +296,29 @@ function keys_of(children: ReadonlyArray<EpicChild>): Set<string> {
 	return new Set(children.map((child) => epic_graph.key_of(child)))
 }
 
+// The graphs with every untrusted child taken out before the running set is built from them, so a row
+// blocked by one — standalone or in another epic — waits on a person rather than on time.
+function trusted_graphs(
+	graphs: ReadonlyArray<ReadonlyArray<EpicChild>>,
+	untrusted: ReadonlySet<string>,
+): Array<Array<EpicChild>> {
+	return graphs.map((children) => without(children, untrusted))
+}
+
+function waits_on(child: EpicChild, held: ReadonlySet<string>): boolean {
+	return child.blocked_by.some((blocker) => held.has(epic_graph.blocker_key(blocker)))
+}
+
+// The held keys and, however long the chain, every child waiting on one of them.
+function with_dependants(
+	children: ReadonlyArray<EpicChild>,
+	held: ReadonlySet<string>,
+): ReadonlySet<string> {
+	const grown = new Set([...held, ...keys_of(children.filter((child) => waits_on(child, held)))])
+
+	return grown.size === held.size ? held : with_dependants(children, grown)
+}
+
 // The epic half, already classified. `epic:next` decided each of these — the `blocked-by` graph, the
 // wave, the anomalies — so this only flattens the per-repository bundles back into one list, in the
 // order the epics' own task lists gave them.
@@ -302,15 +328,26 @@ function keys_of(children: ReadonlyArray<EpicChild>): Set<string> {
 // `runnable` — and a child offered on standard output while standard error lists it as waiting is
 // work a loop would start against a dependency that is still standing. So `human` is settled first,
 // `time` next, and `runnable` keeps only what neither claimed.
-function epic_classification(views: ReadonlyArray<EpicView>): Classification {
-	const human = unique_children(views.flatMap((view) => view.result.blocked_on_people))
-	const time = without(
-		unique_children(views.flatMap((view) => view.result.waiting)),
-		keys_of(human),
-	)
+//
+// `untrusted` names the children whose author lacks write access (`auto_ok_author.untrusted_child_keys`).
+// Each waits on a person wherever `epic:next` put it, exactly as a standalone row's does in
+// `needs_person`: only a person can vouch for its body (joshuafolkken/kit#4633). A sibling waiting on
+// one waits on that person too — `epic:next` weighs a blocker in the same graph by its own category,
+// never by the running set, so the untrusted child's absence from that set does not reach it.
+function epic_classification(
+	views: ReadonlyArray<EpicView>,
+	untrusted: ReadonlySet<string>,
+): Classification {
+	const waiting = views.flatMap((view) => view.result.waiting)
 	const offered = views.flatMap((view) =>
 		view.result.candidates.flatMap((bundle) => bundle.children),
 	)
+	const held = with_dependants(waiting, untrusted)
+	const human = unique_children([
+		...views.flatMap((view) => view.result.blocked_on_people),
+		...[...waiting, ...offered].filter((child) => held.has(epic_graph.key_of(child))),
+	])
+	const time = without(unique_children(waiting), keys_of(human))
 
 	return {
 		runnable: without(unique_children(offered), keys_of([...human, ...time])),
@@ -378,6 +415,7 @@ const backlog_pool = {
 	standalone_rows,
 	to_child,
 	to_children,
+	trusted_graphs,
 }
 
 export { backlog_pool }