@joshuafolkken/kit 1.1784.0 → 1.2114.0

package/scripts/agent/codex-agent-argv.ts

@@ -1,20 +1,47 @@
-import { lstatSync, mkdirSync } from 'node:fs'
+import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync } from 'node:fs'
 import path from 'node:path'
 import { git_common_directory } from '#scripts/git/git-common-directory'
+import { durable_state } from '#scripts/josh/durable-state'
 import { OBSERVATION_LEDGER_DIRECTORY } from '#scripts/observations/observation-ledger'
 import { agent_role_profile, type AgentProfile } from './agent-role-profile'
 
 const AGENT_COMMAND = 'codex'
-const AGENT_FLAGS: ReadonlyArray<string> = ['exec', '--sandbox', 'workspace-write']
+const AGENT_FLAGS: ReadonlyArray<string> = ['exec']
 const MODEL_FLAG = '--model'
 const CONFIG_FLAG = '-c'
 const JSON_FLAG = '--json'
-const NETWORK_CONFIG = 'sandbox_workspace_write.network_access=true'
 const SQLITE_CACHE_PATH = ['node_modules', '.cache', 'josh', 'openai']
 const EPHEMERAL_FLAG = '--ephemeral'
-const ADD_DIRECTORY_FLAG = '--add-dir'
 const GIT_DIRECTORY = '.git'
 const LEDGER_DIRECTORY = path.dirname(OBSERVATION_LEDGER_DIRECTORY)
+const WORKTREE_REGISTRY = 'worktrees'
+const READ = 'read'
+const WRITE = 'write'
+
+// The sandbox is a Codex permission profile, not `--sandbox workspace-write` with `--add-dir` roots
+// (joshuafolkken/kit#4653). It reads the whole disk and writes the work tree, the temp directories, the
+// network and the common git directory — whose root a ref deletion needs: `git branch -d` and
+// `git stash drop` rewrite `packed-refs` through `packed-refs.lock` there.
+const PERMISSION_PROFILE = 'josh_lane'
+const PROFILE_CONFIG = `default_permissions="${PERMISSION_PROFILE}"`
+const NETWORK_CONFIG = `permissions.${PERMISSION_PROFILE}.network.enabled=true`
+const FILESYSTEM_KEY = `permissions.${PERMISSION_PROFILE}.filesystem`
+const BASE_GRANTS: ReadonlyArray<Grant> = [
+	[':root', READ],
+	[':workspace_roots', WRITE],
+	[':slash_tmp', WRITE],
+	[':tmpdir', WRITE],
+]
+// What git runs or follows to another directory stays read-only, so the sandbox cannot plant code that
+// runs outside it the next time anything runs git: `hooks/` and `config`, and the `commondir` and
+// `config.worktree` that would point a git directory at a planted one. An exact read-only path also
+// refuses creating, renaming and deleting it (measured on codex-cli 0.156.1).
+const PINNED_WORKTREE_ENTRIES: ReadonlyArray<string> = ['commondir', 'config.worktree']
+const PINNED_ENTRIES: ReadonlyArray<string> = ['hooks', 'config', ...PINNED_WORKTREE_ENTRIES]
+// Each registered work tree's git directory is pinned the same way; one registered after launch — a
+// later lane, or the detached tree `josh test:red` and `josh metrics` add (`base-tree.ts`) — is not.
+
+type Grant = readonly [string, string]
 
 interface CodexArgv {
 	command: string
@@ -34,20 +61,49 @@ function persistence_arguments(profile: AgentProfile): ReadonlyArray<string> {
 	return profile.role === agent_role_profile.WORKER ? [] : [EPHEMERAL_FLAG]
 }
 
-function ensure_ledger_directory(directory: string): void {
+// A granted directory is created up front — it would otherwise be created in a directory the sandbox
+// cannot write — and refused when it is not a real directory, so a symlink cannot widen the grant.
+function ensure_writable_directory(directory: string, mode?: number): void {
 	const current = lstatSync(directory, { throwIfNoEntry: false })
 
-	if (current === undefined) mkdirSync(directory, { recursive: true })
+	if (current === undefined) mkdirSync(directory, { recursive: true, mode })
 	else if (!current.isDirectory() || current.isSymbolicLink()) {
-		throw new Error(`Ledger directory must be a real directory: ${directory}`)
+		throw new Error(`Writable root must be a real directory: ${directory}`)
 	}
 }
 
+function pinned(directory: string, entries: ReadonlyArray<string>): ReadonlyArray<Grant> {
+	return entries.map((entry) => [path.join(directory, entry), READ])
+}
+
+function registered_worktrees(common_directory: string): ReadonlyArray<string> {
+	const registry = path.join(common_directory, WORKTREE_REGISTRY)
+	if (!existsSync(registry)) return []
+
+	return readdirSync(registry, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => path.join(registry, entry.name))
+}
+
+// Real paths, since the sandbox matches resolved paths: a `.git` reached through a symlink is granted
+// where it lives, and an entry of it that is a symlink is not followed out of it.
+function git_grants(common_directory: string | undefined): ReadonlyArray<Grant> {
+	if (common_directory === undefined) return []
+
+	const root = realpathSync(common_directory)
+
+	return [
+		[root, WRITE],
+		...pinned(root, PINNED_ENTRIES),
+		...registered_worktrees(root).flatMap((worktree) => pinned(worktree, PINNED_WORKTREE_ENTRIES)),
+	]
+}
+
 // Only the ledger's parent directory is writable outside a lane, never the primary checkout root.
-function ledger_arguments(
+function ledger_grants(
 	common_directory: string | undefined,
 	profile: AgentProfile,
-): ReadonlyArray<string> {
+): ReadonlyArray<Grant> {
 	if (
 		common_directory === undefined ||
 		profile.role !== agent_role_profile.WORKER ||
@@ -56,27 +112,68 @@ function ledger_arguments(
 		return []
 	}
 
-	const directory = path.join(path.dirname(common_directory), LEDGER_DIRECTORY)
+	const ledger = path.join(path.dirname(common_directory), LEDGER_DIRECTORY)
+
+	ensure_writable_directory(ledger)
 
-	ensure_ledger_directory(directory)
+	return [[realpathSync(ledger), WRITE]]
+}
+
+// An inline TOML table; a JSON string is a valid TOML basic string.
+function filesystem_config(grants: ReadonlyArray<Grant>): string {
+	const pairs = grants.map(
+		([target, access]) => `${JSON.stringify(target)}=${JSON.stringify(access)}`,
+	)
 
-	return [ADD_DIRECTORY_FLAG, directory]
+	return `${FILESYSTEM_KEY}={${pairs.join(',')}}`
 }
 
-function lane_arguments(cwd: string, profile: AgentProfile): ReadonlyArray<string> {
+// A `backlogrun` parent runs in the primary checkout, where no common git directory grant is given,
+// so the run-state directory its lanes write through that grant is granted on its own — without it the
+// parent's records would fall back to the temp root, apart from its lanes'.
+function state_grants(cwd: string): ReadonlyArray<Grant> {
+	const repository = git_common_directory.repository(cwd)
+	if (repository === undefined) return []
+
+	const state = durable_state.root_for(repository)
+
+	ensure_writable_directory(state, durable_state.STATE_DIRECTORY_MODE)
+
+	return [[realpathSync(state), WRITE]]
+}
+
+function lane_grants(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<Grant> {
+	if (cwd === undefined) return []
+
 	const common_directory = git_common_directory.resolve(cwd)
-	const additional_directory =
-		common_directory === undefined ? [] : [ADD_DIRECTORY_FLAG, common_directory]
+
+	if (common_directory === undefined) return state_grants(cwd)
+
+	return [...git_grants(common_directory), ...ledger_grants(common_directory, profile)]
+}
+
+function permission_arguments(
+	cwd: string | undefined,
+	profile: AgentProfile,
+): ReadonlyArray<string> {
+	const grants = [...BASE_GRANTS, ...lane_grants(cwd, profile)]
 
 	return [
 		CONFIG_FLAG,
-		sqlite_config(cwd),
-		...persistence_arguments(profile),
-		...additional_directory,
-		...ledger_arguments(common_directory, profile),
+		PROFILE_CONFIG,
+		CONFIG_FLAG,
+		filesystem_config(grants),
+		CONFIG_FLAG,
+		NETWORK_CONFIG,
 	]
 }
 
+function lane_arguments(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<string> {
+	if (cwd === undefined) return []
+
+	return [CONFIG_FLAG, sqlite_config(cwd), ...persistence_arguments(profile)]
+}
+
 function build(invocation: string, profile: AgentProfile, cwd?: string): CodexArgv {
 	return {
 		command: AGENT_COMMAND,
@@ -86,9 +183,8 @@ function build(invocation: string, profile: AgentProfile, cwd?: string): CodexAr
 			profile.model,
 			CONFIG_FLAG,
 			effort_config(profile),
-			CONFIG_FLAG,
-			NETWORK_CONFIG,
-			...(cwd === undefined ? [] : lane_arguments(cwd, profile)),
+			...permission_arguments(cwd, profile),
+			...lane_arguments(cwd, profile),
 			JSON_FLAG,
 			invocation,
 		],

package/scripts/agent/usage-limit-reset.ts

@@ -0,0 +1,179 @@
+// When a Claude usage limit resets, read off the harness's own limit sentence (joshuafolkken/kit#4745):
+// `resets 10am (Asia/Tokyo)`, `resets 3:30pm (America/New_York)`, `resets Oct 25, 10am (Asia/Tokyo)`, or
+// the older `Claude AI usage limit reached|<epoch seconds>`. The wall clock is turned into an instant in
+// its named zone with the platform's `Intl`, so no time-zone table is kept here. A sentence that names
+// no readable time, or an unknown zone, answers `undefined` — the caller re-checks on an interval.
+
+const RESET_PATTERN = /resets (?<when>[^(]*)\((?<zone>[^)]*)\)/iu
+const TIME_PATTERN = /\b(?<hour>\d{1,2})(?::(?<minute>\d{2}))? ?(?<meridiem>am|pm)\b/iu
+const DATE_PATTERN = /\b(?<month>[a-z]+)\.? (?<day>\d{1,2})\b/iu
+const MONTH_PREFIX = 3
+const EPOCH_PATTERN = /\|(?<epoch>\d{10})\b/u
+const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec']
+const MS_PER_SECOND = 1000
+const MS_PER_MINUTE = 60_000
+const HALF_YEAR_MS = 15_778_800_000
+const HOURS_PER_HALF_DAY = 12
+const PM = 'pm'
+const NOT_FOUND = -1
+
+interface ZoneFields {
+	year: number
+	month: number
+	day: number
+	hour: number
+	minute: number
+}
+
+interface WallClock {
+	// The named date, where the sentence carries one — a weekly limit's reset can be days away.
+	date: Pick<ZoneFields, 'month' | 'day'> | undefined
+	hour: number
+	minute: number
+	zone: string
+}
+
+type Groups = Readonly<Record<string, string | undefined>>
+
+function epoch_ms(text: string): number | undefined {
+	const epoch = EPOCH_PATTERN.exec(text)?.groups?.['epoch']
+
+	return epoch === undefined ? undefined : Number(epoch) * MS_PER_SECOND
+}
+
+// A word that is no month's name — `resets at 10am` — names no date.
+function dated(groups: Groups): WallClock['date'] {
+	const month = MONTHS.indexOf(String(groups['month']).slice(0, MONTH_PREFIX).toLowerCase())
+
+	return month === NOT_FOUND ? undefined : { month, day: Number(groups['day']) }
+}
+
+function date_of(when: string): WallClock['date'] {
+	const groups = DATE_PATTERN.exec(when)?.groups
+
+	return groups === undefined ? undefined : dated(groups)
+}
+
+function hour_of(time: Groups): number {
+	const half = time['meridiem']?.toLowerCase() === PM ? HOURS_PER_HALF_DAY : 0
+
+	return (Number(time['hour']) % HOURS_PER_HALF_DAY) + half
+}
+
+function wall_of(when: string, zone: string): WallClock | undefined {
+	const time = TIME_PATTERN.exec(when)?.groups
+
+	if (time === undefined) return undefined
+
+	return { date: date_of(when), hour: hour_of(time), minute: Number(time['minute'] ?? 0), zone }
+}
+
+function zone_format(zone: string): Intl.DateTimeFormat {
+	return new Intl.DateTimeFormat('en-US', {
+		timeZone: zone,
+		hourCycle: 'h23',
+		year: 'numeric',
+		month: 'numeric',
+		day: 'numeric',
+		hour: 'numeric',
+		minute: 'numeric',
+	})
+}
+
+// The wall clock the zone reads at an instant. Throws `RangeError` on a zone `Intl` does not know.
+function zone_fields(at_ms: number, zone: string): ZoneFields {
+	const parts = zone_format(zone).formatToParts(at_ms)
+	const read = new Map(parts.map((part) => [part.type, Number(part.value)]))
+
+	function field(type: Intl.DateTimeFormatPartTypes): number {
+		return read.get(type) ?? 0
+	}
+
+	return {
+		year: field('year'),
+		month: field('month') - 1,
+		day: field('day'),
+		hour: field('hour'),
+		minute: field('minute'),
+	}
+}
+
+function utc_of(fields: ZoneFields): number {
+	return Date.UTC(fields.year, fields.month, fields.day, fields.hour, fields.minute)
+}
+
+// How far the zone's wall clock runs ahead of UTC at an instant, to the minute.
+function offset_ms(at_ms: number, zone: string): number {
+	return utc_of(zone_fields(at_ms, zone)) - (at_ms - (at_ms % MS_PER_MINUTE))
+}
+
+// The instant the zone's wall clock reads `fields`, the offset read again at the first guess so a
+// daylight-saving change between the two is followed.
+function instant_of(fields: ZoneFields, zone: string): number {
+	const guess = utc_of(fields)
+
+	return guess - offset_ms(guess - offset_ms(guess, zone), zone)
+}
+
+// The years to move a named date in this year by so it lies within half a year of `now_ms`: a January
+// date read in December is next year's, a December date read in January last year's.
+function year_shift(at_ms: number, now_ms: number): number {
+	if (now_ms - at_ms > HALF_YEAR_MS) return 1
+
+	return at_ms - now_ms > HALF_YEAR_MS ? -1 : 0
+}
+
+// A named date's nearest occurrence. One just past stays past, for the caller's re-check.
+function dated_instant(fields: ZoneFields, zone: string, now_ms: number): number {
+	const at_ms = instant_of(fields, zone)
+	const shift = year_shift(at_ms, now_ms)
+
+	return shift === 0 ? at_ms : instant_of({ ...fields, year: fields.year + shift }, zone)
+}
+
+// An undated hour's next occurrence: today's, else the next day's.
+function undated_instant(fields: ZoneFields, zone: string, now_ms: number): number {
+	const at_ms = instant_of(fields, zone)
+
+	return at_ms > now_ms ? at_ms : instant_of({ ...fields, day: fields.day + 1 }, zone)
+}
+
+function next_instant(wall: WallClock, now_ms: number): number {
+	const today = zone_fields(now_ms, wall.zone)
+	const fields = { ...today, ...wall.date, hour: wall.hour, minute: wall.minute }
+
+	if (wall.date === undefined) return undated_instant(fields, wall.zone, now_ms)
+
+	return dated_instant(fields, wall.zone, now_ms)
+}
+
+function wall_in(text: string): WallClock | undefined {
+	const groups = RESET_PATTERN.exec(text)?.groups
+
+	if (groups === undefined) return undefined
+
+	return wall_of(String(groups['when']), String(groups['zone']).trim())
+}
+
+// A zone `Intl` does not know reads as no time.
+function known_instant(wall: WallClock, now_ms: number): number | undefined {
+	try {
+		return next_instant(wall, now_ms)
+	} catch {
+		return undefined
+	}
+}
+
+function clock_ms(text: string, now_ms: number): number | undefined {
+	const wall = wall_in(text)
+
+	return wall === undefined ? undefined : known_instant(wall, now_ms)
+}
+
+function reset_ms(text: string, now_ms: number): number | undefined {
+	return epoch_ms(text) ?? clock_ms(text, now_ms)
+}
+
+const usage_limit_reset = { reset_ms }
+
+export { usage_limit_reset }

package/scripts/auth/claude-token-output.ts

@@ -1,11 +1,11 @@
 import { stripVTControlCharacters } from 'node:util'
+import { token_shape } from '#scripts/lib/token-shape'
 
 // What `claude setup-token` printed, split into the token and the text that may be shown: the token
 // is replaced, so it reaches neither the screen nor a log.
 
-const REDACTED = '[REDACTED]'
+const { REDACTED, ANTHROPIC_OAUTH_TOKEN: TOKEN_PATTERN } = token_shape
 const TOKEN_START = 'sk-ant-oat'
-const TOKEN_PATTERN = /sk-ant-oat\d+-[\w-]+/u
 const EVERY_TOKEN_PATTERN = new RegExp(TOKEN_PATTERN.source, 'gu')
 // A narrow terminal wraps the token onto lines of its own characters alone, so a continuation is a
 // whole such line and the prose after the token never joins it.

package/scripts/auto-ok/auto-ok-author.ts

@@ -0,0 +1,53 @@
+import { epic_graph, type EpicChild } from '#scripts/epic/epic-graph'
+import { gh_author_association } from '#scripts/gh/gh-author-association'
+import type { OpenIssueData } from '#scripts/git/git-schemas'
+
+// Whether an unattended run may act on an opted-in issue's body. The run takes that body as its
+// specification, and on a public repository anyone can file an issue — the `auto-ok` a person applied
+// says nothing about a body its author rewrote after the label. So only an issue whose author has
+// write access is runnable, and a lookup that failed is not trust; the rest wait on a person.
+
+async function with_trust(issue: OpenIssueData): Promise<OpenIssueData> {
+	const author = gh_author_association.author_of(issue)
+
+	return { ...issue, author_trusted: await gh_author_association.is_trusted(author) }
+}
+
+async function with_author_trust(
+	issues: ReadonlyArray<OpenIssueData>,
+): Promise<Array<OpenIssueData>> {
+	return await Promise.all(issues.map(async (issue) => await with_trust(issue)))
+}
+
+function is_author_trusted(issue: OpenIssueData): boolean {
+	return issue.author_trusted === true
+}
+
+// An epic child's body is run just the same, so the same rule holds for it (joshuafolkken/kit#4633).
+// The write-access lookup asks *this* repository's collaborators, which says nothing about access to
+// another one — so a child elsewhere is asked with no login, which `trust_of` answers for `OWNER` alone.
+async function is_child_trusted(child: EpicChild, repo: string): Promise<boolean> {
+	const author = gh_author_association.author_of(child)
+
+	return await gh_author_association.is_trusted(
+		child.repo === repo ? author : { ...author, login: undefined },
+	)
+}
+
+// The keys of the open children whose author is not trusted — a child read without author fields
+// among them, since an unknown author is not a trusted one.
+async function untrusted_child_keys(
+	children: ReadonlyArray<EpicChild>,
+	repo: string,
+): Promise<ReadonlySet<string>> {
+	const open = children.filter((child) => child.state === 'OPEN')
+	const trusted = await Promise.all(open.map(async (child) => await is_child_trusted(child, repo)))
+
+	const untrusted = open.filter((_, index) => trusted[index] !== true)
+
+	return new Set(untrusted.map((child) => epic_graph.key_of(child)))
+}
+
+const auto_ok_author = { is_author_trusted, untrusted_child_keys, with_author_trust }
+
+export { auto_ok_author }

package/scripts/auto-ok/auto-ok-cli.ts

@@ -1,3 +1,4 @@
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_index, type FetchedEpics } from '#scripts/epic/epic-index'
 import { epic_issue } from '#scripts/epic/epic-issue'
@@ -9,7 +10,7 @@ import { read_json_listing } from '#scripts/git/parse-json-array'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
 import { issue_not_before } from '#scripts/issue/issue-not-before'
-import { issue_sample_gate } from '#scripts/issue/issue-sample-gate'
+import { issue_sample_prime } from '#scripts/issue/issue-sample-prime'
 import { session_cite } from '#scripts/issue/session-cite'
 
 // `josh auto-ok:next` — which issue outside the epic an unattended run picks up next.
@@ -211,9 +212,13 @@ async function fetch_opted_in(): Promise<OptedInRead> {
 
 	const read = json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
 
-	if (read.kind === 'read') await issue_sample_gate.prime(read.issues.map((issue) => issue.body))
+	if (read.kind !== 'read') return read
 
-	return read
+	const issues = await auto_ok_author.with_author_trust(read.issues)
+
+	await issue_sample_prime.prime(issues.map((issue) => issue.body))
+
+	return { ...read, issues }
 }
 
 // Whether every issue this one declares as a blocker has closed. `blockedBy` is the same native
@@ -330,6 +335,16 @@ async function fetch_tracking(count: number): Promise<TrackingRead> {
 // by the native `blockedBy` relations `is_unblocked` already refuses to run past.
 // `tracked` is the narrowed set `epic_index.withheld_children` builds, not
 // every tracked child; this function only applies it.
+// What the issue itself must hold: an author with write access (`auto-ok-author.ts`), every blocker
+// closed, and its declared start date reached.
+function is_ready(issue: OpenIssueData, now: number): boolean {
+	return (
+		auto_ok_author.is_author_trusted(issue) &&
+		is_unblocked(issue) &&
+		issue_not_before.is_due(issue.body, now)
+	)
+}
+
 function is_runnable(
 	issue: OpenIssueData,
 	tracked: ReadonlyMap<number, number>,
@@ -338,11 +353,7 @@ function is_runnable(
 ): boolean {
 	if (tracked.has(issue.number)) return false
 
-	return (
-		is_unblocked(issue) &&
-		!exclude.includes(issue.number) &&
-		issue_not_before.is_due(issue.body, now)
-	)
+	return !exclude.includes(issue.number) && is_ready(issue, now)
 }
 
 function pick_next(
@@ -359,7 +370,7 @@ function pick_next(
 function none_reason(count: number): string {
 	if (count === 0) return NONE_OPTED_IN_MESSAGE
 
-	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, not due until its start time, or the one just merged.`
+	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, filed by an author without write access (waiting on a person), blocked by an open issue, not due until its start time, or the one just merged.`
 }
 
 // Said only when the cap actually bit, and worded from the answer rather than before it: the one run

package/scripts/backlog/backlog-defect-priority.ts

@@ -15,7 +15,7 @@ const UNMEASURED_MESSAGE =
 const KIND_RANK: Readonly<Record<IssueKind, number>> = { defect: 0, other: 1, mechanism: 2 }
 
 function above_message(measured: DefectRate): string {
-	return `The defect rate ${defect_rate.rate_text(measured)} is above its baseline ${String(defect_rate.BASELINE_RATE)}, so defects are offered first and new mechanisms last.`
+	return `The defect rate ${defect_rate.rate_text(measured)} is above its baseline ${String(defect_rate.BASELINE_RATE)}, so among issues the ranking keys tie, defects are offered first and new mechanisms last.`
 }
 
 // The body the listing already carried, else one read for it (joshuafolkken/kit#4550). An unreadable

package/scripts/backlog/backlog-drive-cli.ts

@@ -14,6 +14,7 @@ import { run_carry, type RunCarry } from '#scripts/run/carry/run-carry'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import type { MergeResult } from '#scripts/run/merge/run-merge-cli'
 import { run_merge_driver } from '#scripts/run/merge/run-merge-driver'
+import { run_merge_usage_limit } from '#scripts/run/merge/run-merge-usage-limit'
 import { z } from 'zod'
 import { backlog_budget } from './backlog-budget'
 import {
@@ -203,12 +204,16 @@ function reporters(holds: HoldRecorder): Pick<LoopPorts, 'hold' | 'idle' | 'paus
 }
 
 // What a launch is weighed against: the free lanes, a kept lane, and the memory for one more.
-function room_ports(): Pick<LoopPorts, 'free_lanes' | 'has_lane' | 'limit_room' | 'memory_held'> {
+function room_ports(): Pick<
+	LoopPorts,
+	'free_lanes' | 'has_lane' | 'limit_room' | 'memory_held' | 'usage_limited'
+> {
 	return {
 		free_lanes: backlog_ready.drive_free_lane_count,
 		limit_room: backlog_ready.drive_limit_room,
 		has_lane: backlog_drive_seats.has_kept_lane,
 		memory_held: backlog_drive_memory.gauge(),
+		usage_limited: async () => await run_merge_usage_limit.is_held(Date.now()),
 	}
 }
 

package/scripts/backlog/backlog-drive-hold.ts

@@ -1,4 +1,4 @@
-import { lane_ledger } from '#scripts/lane/lane-ledger'
+import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
 import type { DriveEnd, DrivePorts, DriveState, OfferRead, PassResult } from './backlog-drive'
 import { backlog_ready } from './backlog-ready'
 
@@ -104,7 +104,7 @@ async function free_count(
 
 async function release(ledger: HoldLedger): Promise<void> {
 	ledger.is_open = false
-	await lane_ledger.record_released()
+	await lane_ledger_write.record_released()
 }
 
 async function release_open(ledger: HoldLedger): Promise<void> {
@@ -134,7 +134,7 @@ async function record(
 	}
 
 	ledger.is_open = true
-	await lane_ledger.record_held({ reason: draft.reason, waiting: draft.waiting })
+	await lane_ledger_write.record_held({ reason: draft.reason, waiting: draft.waiting })
 }
 
 // The production `hold` port and the driver's end, sharing whether a hold is open. Best-effort like

package/scripts/backlog/backlog-drive-idle.ts

@@ -1,3 +1,4 @@
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
 import { auto_ok_cli } from '#scripts/auto-ok/auto-ok-cli'
 import type { OpenIssueData } from '#scripts/git/git-schemas'
 import { issue_cite } from '#scripts/issue/issue-cite'
@@ -21,6 +22,7 @@ const WATCH_VERDICT = 'watch'
 const BLOCKED_ANSWER = 'blocked'
 const DECISION_HEADING = `Waiting on a decision (${NEEDS_DECISION_LABEL}):`
 const STALLED_HEADING = `Stalled mechanically (${RUN_STALLED_LABEL}):`
+const UNTRUSTED_HEADING = 'Waiting on a person to vouch for the body (author without write access):'
 const IDLE_HEAD = 'No child running and nothing left to dispatch.'
 const IDLE_RECOVERY =
 	'Decide the parked issues, fix and release the stalled ones, or start the next run with `backlogrun`.'
@@ -70,6 +72,13 @@ function labelled_lines(issues: ReadonlyArray<OpenIssueData>, label: string): Ar
 		.map((issue) => cited(issue))
 }
 
+// `backlog:next` holds these for a person exactly as it does a parked one (joshuafolkken/kit#4633).
+function untrusted_lines(issues: ReadonlyArray<OpenIssueData>): Array<string> {
+	return issues
+		.filter((issue) => !auto_ok_author.is_author_trusted(issue))
+		.map((issue) => cited(issue))
+}
+
 function dated_lines(issues: ReadonlyArray<OpenIssueData>, now_ms: number): Array<string> {
 	const lines: Array<string> = []
 
@@ -92,6 +101,7 @@ function remaining_lines(reading: IdleReading): Array<string> {
 	const lines = [
 		...section(DECISION_HEADING, labelled_lines(reading.issues, NEEDS_DECISION_LABEL)),
 		...section(STALLED_HEADING, labelled_lines(reading.issues, RUN_STALLED_LABEL)),
+		...section(UNTRUSTED_HEADING, untrusted_lines(reading.issues)),
 		...section('Waiting on a date:', dated_lines(reading.issues, reading.now_ms)),
 	]