@joshuafolkken/kit 1.1784.0 → 1.2114.0

package/scripts/backlog/backlog-measure-close.ts

@@ -0,0 +1,112 @@
+import { git_gh_command } from '#scripts/gh/git-gh-command'
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { issue_measured_close } from '#scripts/issue/issue-measured-close'
+import {
+	measure_declaration,
+	type MeasureDeclaration,
+	type MeasureVerdict,
+} from '#scripts/issue/measure-declaration'
+import { trusted_measure, type CommandRun } from '#scripts/issue/trusted-measure'
+import { error_text } from '#scripts/lib/error-message'
+import { run_event_stream } from '#scripts/run/event/run-event-stream'
+import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+
+// joshuafolkken/kit#4621: the drive runs a due issue's measurement declaration (`measure-declaration.ts`)
+// before it opens a lane. A value within the bound closes the issue the way `issue:measured` does — the
+// result comment, the `measured` label, the close and the epic's progress — and puts a `measured` event
+// on the stream, so no lane is spent. Anything else — no declaration, an untrusted body, a value out of
+// bound, a failed command, output that is not one number — launches the lane as before; where a
+// command ran, its result is commented first, so the child starts from the measurement, not a re-run.
+
+const FENCE = '```'
+const VERDICT_WORDS: Readonly<Record<MeasureVerdict['kind'], string>> = {
+	pass: 'within the bound, so the issue is closed without a lane.',
+	fail: 'out of the bound, so the issue goes to a lane.',
+	unreadable: 'no value could be read from the output, so the issue goes to a lane.',
+}
+
+interface Measurement {
+	declaration: MeasureDeclaration
+	run: CommandRun
+	verdict: MeasureVerdict
+}
+
+async function declared(issue: string): Promise<MeasureDeclaration | undefined> {
+	const read = await trusted_measure.read_trusted_body(issue)
+
+	return read.kind === 'trusted' ? measure_declaration.parse(read.body) : undefined
+}
+
+function measured(declaration: MeasureDeclaration): Measurement {
+	const run = trusted_measure.run_command(declaration.command)
+	const verdict: MeasureVerdict =
+		run.kind === 'ok' ? measure_declaration.judge(declaration, run.output) : { kind: 'unreadable' }
+
+	return { declaration, run, verdict }
+}
+
+function value_words(verdict: MeasureVerdict): string {
+	return verdict.kind === 'unreadable' ? 'unreadable' : String(verdict.value)
+}
+
+// The result comment: the declaration, the value read, what follows and the command's own output.
+// Script-emitted, so English (`run-merge.ts` → `park_comment`).
+function report(measurement: Measurement): string {
+	const { declaration, run, verdict } = measurement
+
+	return [
+		'`backlog:drive` ran the measurement declaration.',
+		'',
+		`- Declaration: ${measure_declaration.format(declaration)}`,
+		`- Value: ${value_words(verdict)}`,
+		`- Verdict: ${VERDICT_WORDS[verdict.kind]}`,
+		'',
+		FENCE,
+		trusted_measure.text_of(run),
+		FENCE,
+	].join('\n')
+}
+
+async function close_passed(issue: string, measurement: Measurement): Promise<boolean> {
+	const is_closed = await issue_measured_close.close(issue, report(measurement))
+	const value = value_words(measurement.verdict)
+	const bound = `${measurement.declaration.operator} ${String(measurement.declaration.threshold)}`
+
+	if (is_closed) {
+		await run_event_stream_emit.emit(
+			run_event_stream.EVENT_KIND.MEASURED,
+			`${issue_cite.plain(issue)} measured by backlog:drive: ${value} ${bound}`,
+		)
+	}
+
+	return is_closed
+}
+
+// The result handed to the lane on the issue itself, which the child reads with its comments. A comment
+// that cannot be posted still launches the lane: the child re-runs the declaration.
+async function hand_over(issue: string, measurement: Measurement): Promise<false> {
+	try {
+		await git_gh_command.issue_comment(issue, report(measurement))
+	} catch (error) {
+		console.error(`Measurement result not posted: ${error_text.message_of(error)}`)
+	}
+
+	return false
+}
+
+// Whether the drive closed the issue by its declaration; `false` launches its lane.
+async function closed(issue: string): Promise<boolean> {
+	const declaration = await declared(issue)
+
+	if (declaration === undefined) return false
+
+	const measurement = measured(declaration)
+
+	return measurement.verdict.kind === 'pass'
+		? await close_passed(issue, measurement)
+		: await hand_over(issue, measurement)
+}
+
+const backlog_measure_close = { closed }
+
+export { backlog_measure_close }

package/scripts/backlog/backlog-next.ts

@@ -1,7 +1,9 @@
-import { auto_ok_cli, type OptedInRead, type TrackingRead } from '#scripts/auto-ok/auto-ok-cli'
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
+import { auto_ok_cli, type OptedInRead } from '#scripts/auto-ok/auto-ok-cli'
 import { repo_discovery } from '#scripts/discovery/repo-discovery'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_busy } from '#scripts/epic/epic-busy'
+import type { Classification } from '#scripts/epic/epic-classify'
 import type { EpicChild } from '#scripts/epic/epic-graph'
 import { epic_index } from '#scripts/epic/epic-index'
 import { epic_next } from '#scripts/epic/epic-next'
@@ -15,12 +17,11 @@ import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { issue_not_before } from '#scripts/issue/issue-not-before'
 import { issue_not_before_label } from '#scripts/issue/issue-not-before-label'
 import { session_cite } from '#scripts/issue/session-cite'
-import { lane_state } from '#scripts/lane/lane-state'
 import { issue_citation } from '#scripts/rules/issue-citation'
 import { backlog_defect_priority } from './backlog-defect-priority'
-import { backlog_overlap } from './backlog-overlap'
+import { backlog_gate_scope, type OptedIn, type PoolContext } from './backlog-gate-scope'
 import { backlog_pool } from './backlog-pool'
-import { backlog_rank, type GateScope } from './backlog-rank'
+import { backlog_rank } from './backlog-rank'
 import { backlog_wait_cause } from './backlog-wait-cause'
 
 // `josh backlog:next` — what the whole opted-in backlog may run next.
@@ -84,17 +85,6 @@ const VERDICT_TOKENS: Readonly<Record<BacklogVerdict, string>> = {
 	wait: 'wait',
 }
 
-type OptedIn = Extract<OptedInRead, { kind: 'read' }>
-type Tracking = Extract<TrackingRead, { kind: 'read' }>
-
-// Everything the answer is assembled from, read once and passed down rather than re-fetched.
-interface PoolContext {
-	opted_in: OptedIn
-	tracking: Tracking
-	repo: string
-	exclude: ReadonlyArray<number>
-}
-
 // One token per line on standard output: the runnable issue numbers of **this** repository, in the
 // order they may be started, or the single verdict word when there is nothing to offer here. Every
 // explanation is on standard error, so `answers=$(pnpm josh backlog:next)` captures something a loop
@@ -193,14 +183,27 @@ function running_of(
 // The two halves as one result. The epic half is already classified by `epic:next`; the standalone
 // half is classified here; the verdict is decided from the merge, so a backlog with a runnable epic
 // child and nothing else says `run` exactly as one with a runnable standalone issue does.
-function combine(views: ReadonlyArray<EpicView>, context: PoolContext): EpicNextResult {
-	const graphs = views.map((view) => view.snapshot.children)
-	const standalone = backlog_pool.standalone_rows(context.opted_in.issues)
-	const from_epics = backlog_pool.drop_excluded(
-		backlog_pool.epic_classification(views),
+// `untrusted` is the epic children an author without write access filed (joshuafolkken/kit#4633).
+function epic_half(
+	views: ReadonlyArray<EpicView>,
+	context: PoolContext,
+	untrusted: ReadonlySet<string>,
+): Classification {
+	return backlog_pool.drop_excluded(
+		backlog_pool.epic_classification(views, untrusted),
 		context.exclude,
 		context.repo,
 	)
+}
+
+function combine(
+	views: ReadonlyArray<EpicView>,
+	context: PoolContext,
+	untrusted: ReadonlySet<string>,
+): EpicNextResult {
+	const graphs = views.map((view) => view.snapshot.children)
+	const standalone = backlog_pool.standalone_rows(context.opted_in.issues)
+	const from_epics = epic_half(views, context, untrusted)
 	const from_standalone = backlog_pool.classify_standalone(standalone, {
 		tracked: epic_index.withheld_children(context.tracking.index, context.opted_in.issues),
 		exclude: context.exclude,
@@ -245,10 +248,17 @@ function settled_views(
 //
 // The running set covers the standalone rows as well as every read graph, so an epic child waiting on
 // an opted-in standalone issue waits rather than stops.
-function views_from(reads: ReadonlyArray<EpicRead>, context: PoolContext): ReadonlyArray<EpicView> {
+function views_from(
+	reads: ReadonlyArray<EpicRead>,
+	context: PoolContext,
+	untrusted: ReadonlySet<string>,
+): ReadonlyArray<EpicView> {
 	if (reads.length === 0) return []
 
-	const graphs = reads.map((read) => read.snapshot.children)
+	const graphs = backlog_pool.trusted_graphs(
+		reads.map((read) => read.snapshot.children),
+		untrusted,
+	)
 
 	return settled_views(
 		reads,
@@ -277,11 +287,15 @@ async function resolve(context: PoolContext): Promise<EpicNextResult | undefined
 		return undefined
 	}
 
+	const untrusted = await auto_ok_author.untrusted_child_keys(
+		reads.flatMap((read) => read.snapshot.children),
+		context.repo,
+	)
 	// The defect priority and the ranking keys are applied here rather than when printing, so
 	// `backlog:plan` shows the order the run takes. The
 	// ranking goes last: its sort is stable, so the defect order survives as its final key.
 	const ordered = await backlog_defect_priority.prioritize(
-		combine(views_from(reads, context), context),
+		combine(views_from(reads, context, untrusted), context, untrusted),
 		context.repo,
 	)
 
@@ -318,29 +332,6 @@ function report_retry(context: PoolContext): number {
 	return SUCCESS_EXIT_CODE
 }
 
-// The rows the offer's cap bounds — the standalone half.
-function standalone_keys(context: PoolContext): ReadonlySet<string> {
-	return backlog_pool.standalone_keys(context.opted_in.issues, {
-		tracked: epic_index.withheld_children(context.tracking.index, context.opted_in.issues),
-		exclude: context.exclude,
-		repo: context.repo,
-	})
-}
-
-// The running lanes still carry the pickup label, so the opted-in listing holds their bodies too —
-// which is what lets a candidate be held back from a path a running lane already declares.
-// `backlog:plan --waves` reads the same scope, so its first wave is this offer. Their lane state
-// records name a paused holder in the wait it causes (joshuafolkken/kit#4270); they are local files.
-async function gate_scope(context: PoolContext): Promise<GateScope> {
-	const { issues } = context.opted_in
-
-	return {
-		standalone: standalone_keys(context),
-		declared: backlog_overlap.declared_of(issues),
-		lanes: await lane_state.read_states(issues.map((issue) => String(issue.number))),
-	}
-}
-
 // The `run:solo` gate is applied here rather than in `resolve`, because `backlog:plan` shares
 // `resolve` and a plan made before the run lists everything. The holders are
 // read only on a `run` answer — the one answer the gate can change. The cap follows the gate
@@ -356,7 +347,7 @@ async function gate_solo(result: EpicNextResult, context: PoolContext): Promise<
 
 	if (notice !== undefined) console.error(notice)
 
-	const gated = backlog_rank.gate(result, read, repo, await gate_scope(context))
+	const gated = backlog_rank.gate(result, read, repo, await backlog_gate_scope.gate_scope(context))
 
 	if (gated.notice !== undefined) console.error(gated.notice)
 
@@ -470,10 +461,9 @@ const backlog_next = {
 	READ_FAILURES,
 	VERDICT_TOKENS,
 	resolve,
-	gate_scope,
 	context_of,
 	run,
 }
 
 export { backlog_next }
-export type { BacklogVerdict, OptedIn, PoolContext }
+export type { BacklogVerdict }

package/scripts/backlog/backlog-occupied.ts

@@ -27,8 +27,8 @@ import type { LaneRecords } from '#scripts/lane/lane-state'
 // child ended at the hand-off, and while `josh followup` runs the supervisor only polls CI, CodeRabbit
 // and the merge, so the slot is free for the next launch while every merge check still runs. The wait is
 // unmarked while the followup stage merges and gates again (`run-ship-sync.ts`); a stop there counts
-// the lane again, and past the limit the supervisor waits for a place before it relaunches the child
-// (`run-ship-return.ts`). A named epic's offer discounts the same lanes (`epic-lane-offer.ts`).
+// the lane again, and more than one lane past the limit the supervisor waits for a place before it
+// relaunches the child (`run-ship-place.ts`). A named epic's offer discounts the same lanes (`epic-lane-offer.ts`).
 
 // The issues whose lane has no child working in it (`lane_spent.idle_lanes`).
 type IdleRead = (lanes: ReadonlyArray<LaneInfo>) => ReadonlyArray<string>

package/scripts/backlog/backlog-overlap.ts

@@ -17,11 +17,16 @@ import { lane_state, type LaneRecords } from '#scripts/lane/lane-state'
 const CODE_SPAN = /`([^`\s]+)`/gu
 const LINE_SUFFIX = /:\d+(?:[-:]\d+)?$/u
 const FILE_EXTENSION = /\.[a-z]\w*$/iu
-const ROOT_FILE_EXTENSION = /\.(?:[cm]?[jt]sx?|svelte|jsonc?|md|ya?ml|css|html|sh|toml|txt)$/u
+// `properties`: `sonar-project.properties`, which joshuafolkken/kit#5083 and its holder both named
+// and neither declared (joshuafolkken/kit#5107).
+const ROOT_FILE_EXTENSION =
+	/\.(?:[cm]?[jt]sx?|svelte|jsonc?|md|ya?ml|css|html|sh|toml|txt|properties)$/u
 const GLOB = '*'
 const ISSUE_MARK = '#'
 const SEPARATOR = '/'
 const MIN_DIRECTORY_DEPTH = 2
+const DOCS_DIRECTORY = 'docs/'
+const MARKDOWN = '.md'
 
 // The paths each issue declares, by issue number. A directory ends in `/`; anything else is a file.
 type Declared = ReadonlyMap<number, ReadonlySet<string>>
@@ -52,9 +57,8 @@ function claim_of(path: string): string | undefined {
 	return is_file(path) ? path : undefined
 }
 
-// The backticked files and directories `body` declares.
-function declared_paths(body: string): ReadonlySet<string> {
-	const tokens = [...body.matchAll(CODE_SPAN)].map((match) => match[1] ?? '')
+// The files and directories `tokens` claim — a body's code spans, or the paths a lane plans to edit.
+function path_claims(tokens: ReadonlyArray<string>): ReadonlySet<string> {
 	const paths = tokens
 		.filter((token) => !token.includes(ISSUE_MARK))
 		.map((token) => claim_of(without_glob(token.replace(LINE_SUFFIX, ''))))
@@ -62,6 +66,11 @@ function declared_paths(body: string): ReadonlySet<string> {
 	return new Set(paths.filter((path) => path !== undefined))
 }
 
+// The backticked files and directories `body` declares.
+function declared_paths(body: string): ReadonlySet<string> {
+	return path_claims([...body.matchAll(CODE_SPAN)].map((match) => match[1] ?? ''))
+}
+
 function declared_of(issues: ReadonlyArray<DeclaringIssue>): Declared {
 	return new Map(issues.map((issue) => [issue.number, declared_paths(issue.body ?? '')]))
 }
@@ -70,7 +79,17 @@ function contains(outer: string, inner: string): boolean {
 	return outer.endsWith(SEPARATOR) ? inner.startsWith(outer) : outer === inner
 }
 
+// A document under `docs/` — a Markdown file or a directory of them. Nearly every issue edits one
+// (`docs/josh-commands-run.md`), and the lane's sync with main resolves the overlap, so holding a lane
+// back for it cost a whole lane each (joshuafolkken/kit#4926). `prompts/` and `.claude/` are the rules
+// themselves and still count.
+function is_shared_document(path: string): boolean {
+	return path.startsWith(DOCS_DIRECTORY) && (path.endsWith(SEPARATOR) || path.endsWith(MARKDOWN))
+}
+
 function overlaps(left: string, right: string): boolean {
+	if (is_shared_document(left) || is_shared_document(right)) return false
+
 	return contains(left, right) || contains(right, left)
 }
 
@@ -125,12 +144,19 @@ interface Holding {
 	repo: string
 }
 
+// The path of `paths` that one of `holders` already declares — what `lane:plan` yields on.
+function path_clash(
+	paths: ReadonlySet<string>,
+	declared: Declared,
+	holders: ReadonlyArray<number>,
+): Clash | undefined {
+	return clash_of(claims_of(declared, holders), paths)
+}
+
 // The path `child` declares that one of the running `holders` already declares — the clash `separate`
 // withholds a candidate on, for a reader that names the running issues itself (`run:board`).
 function running_clash(child: EpicChild, declared: Declared, holding: Holding): Clash | undefined {
-	const claims = claims_of(declared, holding.holders)
-
-	return clash_of(claims, paths_of(child, declared, holding.repo))
+	return path_clash(paths_of(child, declared, holding.repo), declared, holding.holders)
 }
 
 // Whether `waiting` declares a path `holder` declares — the overlap `separate` withholds it on.
@@ -207,7 +233,15 @@ function separate(
 	return { offered: walk.offered, withheld, ...(notice !== undefined && { notice }) }
 }
 
-const backlog_overlap = { declared_of, declared_paths, holds, running_clash, separate }
+const backlog_overlap = {
+	declared_of,
+	declared_paths,
+	holds,
+	path_claims,
+	path_clash,
+	running_clash,
+	separate,
+}
 
 export { backlog_overlap }
 export type { Clash, Declared }

package/scripts/backlog/backlog-plan-cli.ts

@@ -6,6 +6,7 @@ import { backlog_named } from './backlog-named'
 import { backlog_next } from './backlog-next'
 import { backlog_plan, type NamedPlan } from './backlog-plan'
 import { backlog_plan_read, type OpenListing, type Plan } from './backlog-plan-read'
+import { backlog_rank } from './backlog-rank'
 import { backlog_scope } from './backlog-scope'
 import { backlog_waves } from './backlog-waves'
 
@@ -105,7 +106,9 @@ function print_plan(plan: Plan, listing: OpenListing, view: PlanView): void {
 	const scope = { repo: plan.repo, exclude: plan.exclude, tracked: plan.tracked }
 	const rows = backlog_scope.out_of_scope(listing.rows, plan.result, scope)
 
-	console.info(backlog_plan.format_plan(plan.result, rows, context, view.named))
+	const ordered = backlog_rank.offer_order(plan.result, plan.repo, plan.scope.yielded)
+
+	console.info(backlog_plan.format_plan(ordered, rows, context, view.named))
 }
 
 async function report(plan: Plan, view: PlanView): Promise<number> {

package/scripts/backlog/backlog-plan-comment.ts

@@ -0,0 +1,81 @@
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { has_any_label, PLANNED_LABEL } from '#scripts/issue/issue-labels'
+import { issue_read, type IssueComment } from '#scripts/issue/issue-read'
+import { markdown_section } from '#scripts/issue/markdown-section'
+import { plan_consumers_section } from '#scripts/issue/plan-consumers-section'
+import { lane_plan } from '#scripts/lane/lane-plan'
+import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { backlog_overlap, type Declared } from './backlog-overlap'
+
+// The paths a pool issue declares — the plan a running lane recorded with `lane:plan`, else the plan
+// `issue:plan` posted as a comment, else its body.
+//
+// **A plan replaces the body**: a body cites paths as evidence (joshuafolkken/kit#4937). A plan naming
+// no path leaves the body.
+//
+// **A plan posted as a comment declares paths too.** joshuafolkken/kit#4910's body named none of the
+// files its plan comment did, so dispatch saw no overlap with joshuafolkken/kit#4911 and
+// joshuafolkken/kit#4907, and the lane sat in `lane:plan`'s `wait` for 23 minutes
+// (joshuafolkken/kit#4923). Only a `run:planned` issue is read, so an unplanned pool costs no request,
+// and only a trusted author's comment counts — the same trust `issue:read` applies. A plan is the
+// comment carrying the consumers section `issue:plan` refuses a plan without; the latest one wins.
+// A listing that cannot be read leaves the body alone — the scope dispatch gated on before — and
+// `lane:plan` still holds the lane at its first edit.
+
+const PLANNED: ReadonlySet<string> = new Set([PLANNED_LABEL])
+const READ_CONCURRENCY = 8
+
+interface PoolIssue {
+	number: number
+	body?: string | undefined
+	labels?: ReadonlyArray<{ name: string }> | undefined
+}
+
+function is_plan(comment: IssueComment): boolean {
+	return (
+		comment.is_trusted === true &&
+		markdown_section.has_line(comment.body, plan_consumers_section.HEADING)
+	)
+}
+
+// The latest trusted plan among `comments`, less its consumers section — whose entries are readers,
+// not edited files — or `undefined` when none is one.
+function plan_of(comments: ReadonlyArray<IssueComment>): string | undefined {
+	const plan = comments.findLast((comment) => is_plan(comment))?.body
+
+	return plan === undefined ? undefined : plan_consumers_section.without(plan)
+}
+
+// The plan comment `issue` carries, or `undefined` when none does or the listing could not be read.
+async function read_plan(issue: number): Promise<string | undefined> {
+	const json = await git_gh_issue_read.issue_list_comments(String(issue))
+	const comments = await issue_read.parse_comments(json)
+
+	return comments === undefined ? undefined : plan_of(comments)
+}
+
+// The paths `issue`'s plan comment declares — what `lane:plan` is handed before the first edit.
+async function plan_paths(issue: number): Promise<ReadonlyArray<string>> {
+	return [...backlog_overlap.declared_paths((await read_plan(issue)) ?? '')]
+}
+
+async function with_plan(issue: PoolIssue): Promise<PoolIssue> {
+	if (!has_any_label(issue.labels, PLANNED)) return issue
+
+	const plan = await read_plan(issue.number)
+
+	if (plan === undefined || backlog_overlap.declared_paths(plan).size === 0) return issue
+
+	return { ...issue, body: plan }
+}
+
+// What each of `issues` declares, read from `directory`'s lane plans — the scope dispatch gates on.
+async function declared_of(issues: ReadonlyArray<PoolIssue>, directory: string): Promise<Declared> {
+	const planned = await bounded_pool.bounded_map(issues, READ_CONCURRENCY, with_plan)
+
+	return lane_plan.with_plans(backlog_overlap.declared_of(planned), directory)
+}
+
+const backlog_plan_comment = { declared_of, plan_of, plan_paths }
+
+export { backlog_plan_comment }

package/scripts/backlog/backlog-plan-read.ts

@@ -4,8 +4,10 @@ import type { EpicNextResult } from '#scripts/epic/epic-report'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { open_issue_schema, type OpenIssueData } from '#scripts/git/git-schemas'
 import { read_json_listing } from '#scripts/git/parse-json-array'
-import { issue_sample_gate } from '#scripts/issue/issue-sample-gate'
-import { backlog_next, type OptedIn } from './backlog-next'
+import { issue_sample_prime } from '#scripts/issue/issue-sample-prime'
+import { lane_capacity } from '#scripts/lane/lane-capacity'
+import { backlog_gate_scope, type OptedIn } from './backlog-gate-scope'
+import { backlog_next } from './backlog-next'
 import type { PlanContext } from './backlog-plan'
 import type { GateScope } from './backlog-rank'
 import { backlog_scope } from './backlog-scope'
@@ -24,8 +26,8 @@ interface Plan {
 	// past the listing cap. Carrying the *whole* index here instead would move that misreport rather
 	// than remove it: the sentence would name an epic that is withholding nothing.
 	tracked: ReadonlyMap<number, number>
-	// The rows the offer's cap bounds and the paths each issue declares, so `--waves` cuts each
-	// wave where `backlog:next` does.
+	// The rows the offer's cap bounds and the paths each issue declares, so `--waves` separates each
+	// wave as `backlog:next` does — and the lane limit it cuts each wave at.
 	scope: GateScope
 }
 
@@ -42,6 +44,14 @@ interface PlanRead {
 	listing: OpenListing
 }
 
+// The lane limit a wave is cut at, capped at the port seats as a launch is; `undefined` when the
+// limit cannot be read, so the plan stays drawable and says it is uncapped.
+async function read_wave_limit(): Promise<number | undefined> {
+	const choice = await lane_capacity.lane_limit()
+
+	return choice.kind === 'limit' ? lane_capacity.seated_limit(choice.limit) : undefined
+}
+
 // The same reads and the same classification `backlog:next` makes, through the same two functions.
 // `undefined` is a failure it has already reported.
 async function classify(
@@ -61,7 +71,10 @@ async function classify(
 		repo: context.repo,
 		exclude,
 		tracked: epic_index.withheld_children(context.tracking.index, context.opted_in.issues),
-		scope: await backlog_next.gate_scope(context),
+		scope: {
+			...(await backlog_gate_scope.gate_scope(context)),
+			wave_limit: await read_wave_limit(),
+		},
 	}
 }
 
@@ -76,7 +89,7 @@ async function fetch_open(): Promise<OpenListing | undefined> {
 	const read = read_json_listing(json, open_issue_schema)
 
 	if (read.kind !== 'read') return undefined
-	await issue_sample_gate.prime(read.rows.map((row) => row.body))
+	await issue_sample_prime.prime(read.rows.map((row) => row.body))
 
 	return { rows: read.rows, is_capped }
 }

package/scripts/backlog/backlog-pool.ts

@@ -1,3 +1,4 @@
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
 import { auto_ok_cli } from '#scripts/auto-ok/auto-ok-cli'
 import type { Classification } from '#scripts/epic/epic-classify'
 import { epic_graph, type EpicChild, type GraphAnomaly } from '#scripts/epic/epic-graph'
@@ -61,13 +62,19 @@ function waits_outside(issue: OpenIssueData, running: ReadonlySet<string>, repo:
 		.some((blocker) => blocker.state === 'OPEN' && !running.has(epic_graph.blocker_key(blocker)))
 }
 
-function needs_person(issue: OpenIssueData, context: StandaloneContext): boolean {
+// An issue whose author lacks write access waits on a person too: only they can vouch for its body.
+function is_stuck(issue: OpenIssueData, running: ReadonlySet<string>, repo: string): boolean {
 	return (
+		!auto_ok_author.is_author_trusted(issue) ||
 		has_any_label(issue.labels, DECISION_LABELS) ||
-		waits_outside(issue, context.running, context.repo)
+		waits_outside(issue, running, repo)
 	)
 }
 
+function needs_person(issue: OpenIssueData, context: StandaloneContext): boolean {
+	return is_stuck(issue, context.running, context.repo)
+}
+
 // Each open epic's key, read off the tracking index — child number to the epics listing it.
 function epic_keys_of(tracking: TrackingIndex, repo: string): ReadonlySet<string> {
 	return new Set([...tracking.values()].flat().map((number) => epic_graph.key_of({ repo, number })))
@@ -102,10 +109,6 @@ function rooted(
 	return with_tracking_epics(members, tracking, repo)
 }
 
-function is_stuck(issue: OpenIssueData, running: ReadonlySet<string>, repo: string): boolean {
-	return has_any_label(issue.labels, DECISION_LABELS) || waits_outside(issue, running, repo)
-}
-
 // The running set with every standalone row a person has to resolve taken out, repeated until a pass
 // removes nothing — a row waiting on such a row waits on that person too, however long the chain.
 function settle_standalone(
@@ -293,6 +296,29 @@ function keys_of(children: ReadonlyArray<EpicChild>): Set<string> {
 	return new Set(children.map((child) => epic_graph.key_of(child)))
 }
 
+// The graphs with every untrusted child taken out before the running set is built from them, so a row
+// blocked by one — standalone or in another epic — waits on a person rather than on time.
+function trusted_graphs(
+	graphs: ReadonlyArray<ReadonlyArray<EpicChild>>,
+	untrusted: ReadonlySet<string>,
+): Array<Array<EpicChild>> {
+	return graphs.map((children) => without(children, untrusted))
+}
+
+function waits_on(child: EpicChild, held: ReadonlySet<string>): boolean {
+	return child.blocked_by.some((blocker) => held.has(epic_graph.blocker_key(blocker)))
+}
+
+// The held keys and, however long the chain, every child waiting on one of them.
+function with_dependants(
+	children: ReadonlyArray<EpicChild>,
+	held: ReadonlySet<string>,
+): ReadonlySet<string> {
+	const grown = new Set([...held, ...keys_of(children.filter((child) => waits_on(child, held)))])
+
+	return grown.size === held.size ? held : with_dependants(children, grown)
+}
+
 // The epic half, already classified. `epic:next` decided each of these — the `blocked-by` graph, the
 // wave, the anomalies — so this only flattens the per-repository bundles back into one list, in the
 // order the epics' own task lists gave them.
@@ -302,15 +328,26 @@ function keys_of(children: ReadonlyArray<EpicChild>): Set<string> {
 // `runnable` — and a child offered on standard output while standard error lists it as waiting is
 // work a loop would start against a dependency that is still standing. So `human` is settled first,
 // `time` next, and `runnable` keeps only what neither claimed.
-function epic_classification(views: ReadonlyArray<EpicView>): Classification {
-	const human = unique_children(views.flatMap((view) => view.result.blocked_on_people))
-	const time = without(
-		unique_children(views.flatMap((view) => view.result.waiting)),
-		keys_of(human),
-	)
+//
+// `untrusted` names the children whose author lacks write access (`auto_ok_author.untrusted_child_keys`).
+// Each waits on a person wherever `epic:next` put it, exactly as a standalone row's does in
+// `needs_person`: only a person can vouch for its body (joshuafolkken/kit#4633). A sibling waiting on
+// one waits on that person too — `epic:next` weighs a blocker in the same graph by its own category,
+// never by the running set, so the untrusted child's absence from that set does not reach it.
+function epic_classification(
+	views: ReadonlyArray<EpicView>,
+	untrusted: ReadonlySet<string>,
+): Classification {
+	const waiting = views.flatMap((view) => view.result.waiting)
 	const offered = views.flatMap((view) =>
 		view.result.candidates.flatMap((bundle) => bundle.children),
 	)
+	const held = with_dependants(waiting, untrusted)
+	const human = unique_children([
+		...views.flatMap((view) => view.result.blocked_on_people),
+		...[...waiting, ...offered].filter((child) => held.has(epic_graph.key_of(child))),
+	])
+	const time = without(unique_children(waiting), keys_of(human))
 
 	return {
 		runnable: without(unique_children(offered), keys_of([...human, ...time])),
@@ -378,6 +415,7 @@ const backlog_pool = {
 	standalone_rows,
 	to_child,
 	to_children,
+	trusted_graphs,
 }
 
 export { backlog_pool }