@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/scripts/run/wake/run-wake-ports.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import type { AgentProfile } from '#scripts/agent/agent-role-profile'
 import { lane_close } from '#scripts/lane/lane-close'
+import { lane_withdraw_closed } from '#scripts/lane/lane-withdraw-closed'
 import { poll } from '#scripts/lib/poll'
 import { run_carry } from '#scripts/run/carry/run-carry'
 import { run_event_setup } from '#scripts/run/event/run-event-setup'
@@ -54,6 +55,15 @@ function wake_session(
 	return result
 }
 
+// The lanes the supervisor ends each pass: closes left incomplete, and lanes whose issue was closed as
+// not planned (`lane-withdraw-closed.ts`), each withdrawal said on stderr.
+async function retry_closes(): Promise<void> {
+	await lane_close.retry_closes()
+	const notes = await lane_withdraw_closed.withdraw_closed()
+
+	for (const note of notes) note_to_stderr(note)
+}
+
 // **A record this supervisor owns itself is not a session at work.** A failed driver leaves the record
 // adopted for this process, so reading that owner as live would have every restarted pass wait on
 // itself and never drive again.
@@ -79,9 +89,7 @@ function ports_for(
 			wake_session(context, invocation, profile, { id: session_id, material }),
 		sleep: poll.sleep,
 		now: () => new Date(),
-		retry_closes: async () => {
-			await lane_close.retry_closes()
-		},
+		retry_closes,
 	}
 }
 

package/scripts/run/wake/run-wake-session.ts

@@ -9,6 +9,7 @@ import { claude_agent_argv } from '#scripts/agent/claude-agent-argv'
 import { backlogrun_launch } from '#scripts/backlog/backlogrun-launch'
 import { detached_launch, type LaunchArgv } from '#scripts/run/detached-launch'
 import { run_invocation } from '#scripts/run/run-invocation'
+import { run_wake_caffeinate } from './run-wake-caffeinate'
 
 // How the supervisor starts things: the next agent session, and — at `--start` — its own detached
 // self. Both go through one `launch`, because the two differ only in what is being run.
@@ -164,6 +165,7 @@ const run_wake_session = {
 	WAKE_FLAGS,
 	ensure_log: detached_launch.ensure_log,
 	is_safe_argv: detached_launch.is_safe_argv,
+	keep_awake: run_wake_caffeinate.keep_awake,
 	launch: detached_launch.launch,
 	chosen_profile,
 	scheduler_profile,

package/scripts/run/wake/run-wake.ts

@@ -1,5 +1,6 @@
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
+import { durable_state } from '#scripts/josh/durable-state'
 import { process_identity } from '#scripts/josh/process-identity'
 import { process_owner_schema } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -16,7 +17,7 @@ import { z } from 'zod'
 
 const WAKE_PREFIX = 'josh-run-wake-'
 // The output of every session this starts, appended per repository so a silent death is diagnosable.
-const WAKE_LOG_PREFIX = 'josh-run-wake-log-'
+const WAKE_LOG_PREFIX = durable_state.PREFIX.WAKE_LOG
 const WAKE_LOG_SUFFIX = '.log'
 // How long a woken session has to claim the carry record — the only launch-failure detector, since a
 // claim also catches a session that dies in boot or never picks the run up. It covers a slow cold start.
@@ -153,7 +154,7 @@ function wake_path(git_directory: string): string {
 }
 
 function wake_log_path(git_directory: string): string {
-	return stamp_file.stamp_path(WAKE_LOG_PREFIX, git_directory, WAKE_LOG_SUFFIX)
+	return durable_state.path(WAKE_LOG_PREFIX, git_directory, WAKE_LOG_SUFFIX)
 }
 
 function parse_wake(raw: string): RunWake | undefined {

package/scripts/safe-chain/ci-installer-pin.ts

@@ -1,5 +1,7 @@
 import { createHash } from 'node:crypto'
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 import { composite_actions } from '#scripts/ci/composite-actions'
 import { execaSync } from 'execa'
 
@@ -16,6 +18,9 @@ const VERSION_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_VERSION:[ \t]*)(?<value>\
 const SHA256_RE = /^(?<key>[ \t]*SAFE_CHAIN_INSTALLER_SHA256:[ \t]*)(?<value>\S+)[ \t]*$/mu
 const VALUE_GROUP = 'value'
 const DOWNLOAD_TIMEOUT_MS = 30_000
+const REPOSITORY = 'AikidoSec/safe-chain'
+const INSTALLER_NAME = 'install-safe-chain.sh'
+const ATTESTATION_FAILURE = 'could not be verified against its release attestation'
 
 interface InstallerPin {
 	version: string
@@ -23,7 +28,7 @@ interface InstallerPin {
 }
 
 function installer_url(version: string): string {
-	return `https://github.com/AikidoSec/safe-chain/releases/download/${version}/install-safe-chain.sh`
+	return `https://github.com/${REPOSITORY}/releases/download/${version}/${INSTALLER_NAME}`
 }
 
 // The local composite actions follow the workflows: kit's own pin lives in
@@ -50,7 +55,7 @@ function rewrite_pin(content: string, pin: InstallerPin): string {
 		.replace(SHA256_RE, (_match, key: string) => `${key}${pin.sha256}`)
 }
 
-function fetch_installer_sha256(version: string): string | undefined {
+function fetch_installer(version: string): Uint8Array | undefined {
 	// `--proto =https` keeps the release redirect from being followed onto plain HTTP.
 	const result = execaSync('curl', ['--proto', '=https', '-fsSL', installer_url(version)], {
 		encoding: 'buffer',
@@ -61,7 +66,41 @@ function fetch_installer_sha256(version: string): string | undefined {
 	})
 	if (result.exitCode !== 0 || result.stdout.length === 0) return undefined
 
-	return createHash('sha256').update(result.stdout).digest('hex')
+	return result.stdout
+}
+
+// joshuafolkken/kit#4669: the hash recorded is the one the release's GitHub attestation signs, not
+// whatever the download happened to return. `gh release verify-asset` checks the signed attestation
+// GitHub issued when the release was published, so a release asset swapped afterwards fails here.
+function verify_installer(version: string, installer: Uint8Array): boolean {
+	const directory = mkdtempSync(path.join(tmpdir(), 'safe-chain-installer-'))
+	const installer_path = path.join(directory, INSTALLER_NAME)
+
+	try {
+		writeFileSync(installer_path, installer)
+		const result = execaSync(
+			'gh',
+			['release', 'verify-asset', version, installer_path, '--repo', REPOSITORY],
+			{
+				reject: false,
+				timeout: DOWNLOAD_TIMEOUT_MS,
+			},
+		)
+
+		return result.exitCode === 0
+	} finally {
+		rmSync(directory, { recursive: true, force: true })
+	}
+}
+
+// The hash to record, or why there is none — a pin is written only from a verified installer.
+function fetch_installer_sha256(version: string): { sha256: string } | { failure: string } {
+	const installer = fetch_installer(version)
+	if (installer === undefined) return { failure: 'could not be downloaded' }
+	// A missing or signed-out `gh` lands here too: no verification means no pin, whatever the reason.
+	if (!verify_installer(version, installer)) return { failure: ATTESTATION_FAILURE }
+
+	return { sha256: createHash('sha256').update(installer).digest('hex') }
 }
 
 // The workflows whose pin lags `latest` — a missing file or one without the pin is not a target.
@@ -83,15 +122,17 @@ function sync(latest: string, workflow_paths: ReadonlyArray<string> = list_workf
 	const targets = stale_workflows(latest, workflow_paths)
 	if (targets.length === 0) return
 
-	const sha256 = fetch_installer_sha256(latest)
+	const fetched = fetch_installer_sha256(latest)
 
-	if (sha256 === undefined) {
-		console.warn(`\n⚠ Could not download the safe-chain ${latest} installer; CI pin left as is`)
+	if ('failure' in fetched) {
+		console.warn(`\n⚠ The safe-chain ${latest} installer ${fetched.failure}; CI pin left as is`)
 
 		return
 	}
 
-	for (const workflow_path of targets) write_pin(workflow_path, { version: latest, sha256 })
+	for (const workflow_path of targets) {
+		write_pin(workflow_path, { version: latest, sha256: fetched.sha256 })
+	}
 }
 
 const ci_installer_pin = {

package/scripts/safe-chain/project-config.ts

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { file_reader } from '#scripts/lib/read-file'
 import { yaml_document } from '#scripts/lib/yaml-document'
+import { file_content } from '#scripts/sync/file-content'
 import { release_window } from '#scripts/version/release-window'
 import { dump } from 'js-yaml'
 
@@ -139,7 +140,7 @@ function sync_project_config(root: string): boolean {
 	const workspace = readFileSync(workspace_path, 'utf8')
 	const merged = merge_project_config(existing, workspace)
 	if (merged === existing) return false
-	writeFileSync(config_path, merged)
+	file_content.write_contained(config_path, merged)
 
 	return true
 }

package/scripts/security/secretlint-scan.ts

@@ -7,7 +7,11 @@ import { execaSync } from 'execa'
 
 const SECRETLINT_BIN = 'secretlint'
 const NO_GLOB_FLAG = '--no-glob'
+const END_OF_OPTIONS = '--'
 const ARGV_OFFSET = 2
+// Set by the CI `Secret Scan` job, where nothing provisions the binary later: there a missing
+// secretlint would turn the scan into a silent pass, so it fails instead (kit#4657).
+const REQUIRE_ENV = 'JOSH_SECRETLINT_REQUIRE'
 
 // The scan is defense in depth ahead of GitHub push protection, not the only gate, so a
 // missing binary must not block the commit. kit ships the pre-commit rule inside
@@ -21,7 +25,14 @@ const MISSING_NOTICE =
 	`   The kit pre-commit hook ships ahead of the dependency it needs.\n` +
 	`   Run \`pnpm josh sync && pnpm install\` to provision it.`
 
-type ScanDecision = { kind: 'skip'; notice?: string } | { kind: 'scan'; binary: string }
+const REQUIRED_MISSING_ERROR =
+	`❌ secretlint is not installed, and ${REQUIRE_ENV} requires the scan.\n` +
+	`   Add it to the devDependencies with \`pnpm josh sync && pnpm install\`.`
+
+type ScanDecision =
+	| { kind: 'skip'; notice?: string }
+	| { kind: 'fail'; error: string }
+	| { kind: 'scan'; binary: string }
 
 function resolve_secretlint_binary(project_root: string): string | undefined {
 	const candidate = resolve_local_bin(project_root, SECRETLINT_BIN)
@@ -31,17 +42,28 @@ function resolve_secretlint_binary(project_root: string): string | undefined {
 
 // lefthook substitutes literal paths, so `--no-glob` is mandatory: a SvelteKit route directory
 // such as `(app)` or `[id]` would otherwise reach secretlint's glob engine as a pattern.
-// Masking and the .gitignore cascade are both on by default in v13 — no flag adds them.
+// Masking and the .gitignore cascade are both on by default in v13 — no flag adds them. `--` ends
+// the options, so a staged file named like `--secretlintrc=evil.json` stays a path, not a flag.
 function build_scan_arguments(staged_files: ReadonlyArray<string>): Array<string> {
-	return [NO_GLOB_FLAG, ...staged_files]
+	return [NO_GLOB_FLAG, END_OF_OPTIONS, ...staged_files]
+}
+
+function plan_missing(is_required: boolean): ScanDecision {
+	return is_required
+		? { kind: 'fail', error: REQUIRED_MISSING_ERROR }
+		: { kind: 'skip', notice: MISSING_NOTICE }
 }
 
-function plan_scan(staged_files: ReadonlyArray<string>, project_root: string): ScanDecision {
+function plan_scan(
+	staged_files: ReadonlyArray<string>,
+	project_root: string,
+	is_required = false,
+): ScanDecision {
 	if (staged_files.length === 0) return { kind: 'skip' }
 
 	const binary = resolve_secretlint_binary(project_root)
 
-	if (binary === undefined) return { kind: 'skip', notice: MISSING_NOTICE }
+	if (binary === undefined) return plan_missing(is_required)
 
 	return { kind: 'scan', binary }
 }
@@ -59,18 +81,29 @@ function run_scan(binary: string, staged_files: ReadonlyArray<string>): number {
 	return resolve_spawn_exit(binary, result)
 }
 
-function main(staged_files: ReadonlyArray<string>, project_root: string): number {
-	const decision = plan_scan(staged_files, project_root)
+function main(
+	staged_files: ReadonlyArray<string>,
+	project_root: string,
+	is_required = false,
+): number {
+	const decision = plan_scan(staged_files, project_root, is_required)
 
 	if (decision.kind === 'scan') return run_scan(decision.binary, staged_files)
 
+	if (decision.kind === 'fail') {
+		console.error(decision.error)
+
+		return 1
+	}
+
 	if (decision.notice !== undefined) console.warn(decision.notice)
 
 	return 0
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-	const exit_code = main(process.argv.slice(ARGV_OFFSET), process.cwd())
+	const is_required = process.env[REQUIRE_ENV] === '1'
+	const exit_code = main(process.argv.slice(ARGV_OFFSET), process.cwd(), is_required)
 
 	if (exit_code !== 0) process.exit(exit_code)
 }
@@ -83,4 +116,4 @@ const secretlint_scan = {
 	run_scan,
 }
 
-export { MISSING_NOTICE, secretlint_scan }
+export { MISSING_NOTICE, REQUIRE_ENV, REQUIRED_MISSING_ERROR, secretlint_scan }

package/scripts/security/security-audit-provision-main.ts

@@ -1,12 +1,20 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { session_owner_pin } from '#scripts/discovery/session-owner-pin'
 import { security_audit_provision } from './security-audit-provision'
 
 // The `josh audit:provision` entry and the session-start hook's bundle, kept apart from
 // `security-audit-provision.ts` because `start-steps.ts` imports that one: a bundle is one file, so a
 // main guard there would fire for every command that carries it (joshuafolkken/kit#4186).
+//
+// Run by the session-start hook (`--session-start`), it also pins the session's owner
+// (`session-owner-pin.ts`) at no spawn of its own. A manual `josh audit:provision` pins only when
+// passed `--session-start`, which re-pins to whatever owner `origin` names at that moment.
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
 	const ARGV_OFFSET = 2
+	const SESSION_START_FLAG = '--session-start'
+	const argv = process.argv.slice(ARGV_OFFSET)
 
-	await security_audit_provision.run(process.argv.slice(ARGV_OFFSET))
+	if (argv.includes(SESSION_START_FLAG)) session_owner_pin.pin()
+	await security_audit_provision.run(argv)
 }

package/scripts/security/security-audit-provision.ts

@@ -140,7 +140,7 @@ async function report(
 	is_forced: boolean,
 ): Promise<string> {
 	const logic = security_audit_provision_logic
-	const target_path = security_audit_logic.build_managed_binary_path(project_root, platform)
+	const target_path = security_audit.managed_binary_path(project_root, platform)
 	const existing = existing_scanner(target_path)
 	if (existing !== undefined) return logic.format_already_present(existing)
 

package/scripts/security/security-audit.ts

@@ -1,10 +1,13 @@
 import { accessSync, constants, statSync } from 'node:fs'
+import path from 'node:path'
+import { git_common_directory } from '#scripts/git/git-common-directory'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { execaSync } from 'execa'
 import { security_audit_logic } from './security-audit-logic'
 import { security_audit_provision_logic } from './security-audit-provision-logic'
 
 const FAILURE_EXIT_CODE = 1
+const GIT_DIRECTORY_NAME = '.git'
 const UNKNOWN_VERSION = 'unknown'
 
 // execa reports `exitCode: undefined` only when the binary could not be spawned
@@ -56,11 +59,27 @@ interface ScannerChoice {
 	is_below_floor: boolean
 }
 
+// A linked work tree shares the primary checkout's managed scanner, so a lane neither downloads its
+// own copy at every session start nor keeps its own no-retry record (joshuafolkken/kit#4942). Where
+// the primary checkout cannot be named — a bare repository, a submodule, or no repository — the root
+// is the project's own. The primary checkout reads git's answer too, so it keys the no-retry record
+// on the same real path its lanes do even when it was entered through a symlink.
+function managed_root(project_root: string): string {
+	const common = git_common_directory.repository(project_root)
+	if (common === undefined || path.basename(common) !== GIT_DIRECTORY_NAME) return project_root
+
+	return path.dirname(common)
+}
+
+function managed_binary_path(project_root: string, platform: string): string {
+	return security_audit_logic.build_managed_binary_path(managed_root(project_root), platform)
+}
+
 // A provisioned copy counts only when it is both a real executable and at or above the floor: a
 // leftover from an earlier pinned version would otherwise be preferred over the PATH binary while
 // reading less of the lockfile than it should.
 function managed_scanner(project_root: string, platform: string): string | undefined {
-	const managed_path = security_audit_logic.build_managed_binary_path(project_root, platform)
+	const managed_path = managed_binary_path(project_root, platform)
 
 	return is_executable_file(managed_path) && meets_floor(managed_path) ? managed_path : undefined
 }
@@ -132,6 +151,7 @@ function run(): number {
 const security_audit = {
 	is_binary_available,
 	is_executable_file,
+	managed_binary_path,
 	meets_floor,
 	resolve_scanner,
 	run,

package/scripts/security/sonar-file.ts

@@ -1,7 +1,10 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
 import { init_logic } from '#scripts/init/init-logic'
 import type { SonarIdentifiers } from '#scripts/init/init-logic-sonar'
+import { file_content } from '#scripts/sync/file-content'
+
+// Written through `write_contained` like every other sync write, so a `sonar-project.properties`
+// linked outside the project is refused rather than written through (joshuafolkken/kit#4634).
 
 function write_sonar_file(
 	template_source: string,
@@ -14,8 +17,7 @@ function write_sonar_file(
 		identifiers.organization,
 	)
 
-	mkdirSync(path.dirname(destination_path), { recursive: true })
-	writeFileSync(destination_path, content)
+	file_content.write_contained(destination_path, content)
 }
 
 function merge_sonar_file(
@@ -36,7 +38,10 @@ function merge_sonar_file(
 	)
 	const existing = readFileSync(destination_path, 'utf8')
 
-	writeFileSync(destination_path, init_logic.merge_sonar_properties(existing, template_content))
+	file_content.write_contained(
+		destination_path,
+		init_logic.merge_sonar_properties(existing, template_content),
+	)
 }
 
 const sonar_file = { write_sonar_file, merge_sonar_file }

package/scripts/split/split-assess.ts

@@ -76,7 +76,8 @@ function non_test_changes(changes: ReadonlyArray<FileChange>): Array<FileChange>
 }
 
 // `split` only when **both** guides are exceeded together — the size condition a split has to clear,
-// per `split-assessment.md`'s conservative default. Either one alone leaves the change one Issue.
+// per `split-assessment.md`'s conservative default. Either one alone leaves the change one Issue. A
+// filing's declared estimate is judged by this same call (`issue/size-estimate.ts`).
 function verdict_for(files: number, lines: number): SplitVerdict {
 	return files > FILE_GUIDE && lines > LINE_GUIDE ? SPLIT_VERDICT : SINGLE_VERDICT
 }
@@ -107,9 +108,14 @@ function reason(measurement: SizeMeasurement): string {
 	return `${counted} (${guide}) — ${tail}`
 }
 
-// The `split-assessment.md` heading the notice points at; the document-rule test pins the document to it.
+// The `split-assessment.md` headings the notice and a filing refusal point at; the document-rule test
+// pins the document to both.
 const NOTICE_SECTION = 'Over the guide before the gate'
-const NOTICE_ACTION = `record why it stays one Issue, or carve the rest out into a new Issue — split-assessment.md → "${NOTICE_SECTION}"`
+const QUESTION_SECTION = 'The question'
+// The line that records why an Issue stays one — read the same in a filed body (`size_estimate`) and
+// in the Issue comment that answers the notice (`split_resolution`).
+const REASON_PREFIX = '- 分割しない理由:'
+const NOTICE_ACTION = `record why it stays one Issue in an Issue comment line \`${REASON_PREFIX} <理由>\`, or carve the rest out with \`pnpm josh issue:file --route split\` — split-assessment.md → "${NOTICE_SECTION}"`
 
 // The pre-gate notice `josh main:merge` prints for a diff over the guide. "Clearly" is the `split`
 // verdict — both guides exceeded — so the one bar this file draws is the one the notice fires on,
@@ -124,12 +130,15 @@ const split_assess = {
 	FILE_GUIDE,
 	LINE_GUIDE,
 	NOTICE_SECTION,
+	QUESTION_SECTION,
+	REASON_PREFIX,
 	SPLIT_VERDICT,
 	SINGLE_VERDICT,
 	assess,
 	notice,
 	parse_numstat,
 	reason,
+	verdict_for,
 }
 
 export type { FileChange, SizeMeasurement, SplitVerdict }

package/scripts/split/split-early-notice.ts

@@ -0,0 +1,116 @@
+import { existsSync } from 'node:fs'
+import { writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { git_branch } from '#scripts/git/git-branch'
+import { git_command } from '#scripts/git/git-command'
+import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
+import { split_assess, type SizeMeasurement } from './split-assess'
+import { split_measure } from './split-measure'
+
+// **The split notice, shown mid-implementation** (joshuafolkken/kit#4642). `josh main:merge` prints it
+// only before the gate, when the run can no longer carve anything out; a lane that grew to 17 files met
+// it 25 minutes in. The first `josh lint:related` or `josh test:related` after the branch's diff passes
+// the guide prints the same notice — `split_assess.notice`, so the bar and the question are one
+// definition — once per Issue: a marker in the work tree's git directory, created exclusively, records
+// that it was shown. A diff under the guide leaves no marker, so the first crossing still prints.
+// Advisory only: an unmeasurable diff or a branch with no Issue prints nothing.
+
+const MARKER_PREFIX = 'josh-split-notice-'
+const EXISTS_CODE = 'EEXIST'
+
+async function marker_path(issue_number: number): Promise<string | undefined> {
+	const [git_directory] = await git_command.git_directories()
+
+	if (git_directory === undefined) return undefined
+
+	return path.join(git_directory, `${MARKER_PREFIX}${String(issue_number)}`)
+}
+
+// Undefined once shown, so a later run skips the measurement — a diff against main and a read of
+// every untracked file.
+async function unclaimed_marker(issue_number: number): Promise<string | undefined> {
+	const target = await marker_path(issue_number)
+
+	return target === undefined || existsSync(target) ? undefined : target
+}
+
+function is_exists_error(error: unknown): boolean {
+	return error instanceof Error && 'code' in error && error.code === EXISTS_CODE
+}
+
+// True only for the call that created the marker — the one that shows the notice.
+async function claim(target: string): Promise<boolean> {
+	try {
+		await writeFile(target, '', { flag: 'wx' })
+
+		return true
+	} catch (error) {
+		if (is_exists_error(error)) return false
+		throw error
+	}
+}
+
+// The claim that shows the notice first also writes it to the lane ledger, so the ledger holds one
+// line per Issue, whichever command showed it (joshuafolkken/kit#4695).
+async function claim_notice(
+	target: string,
+	issue: number,
+	measurement: SizeMeasurement,
+): Promise<boolean> {
+	if (!(await claim(target))) return false
+	await lane_ledger_write.record_split_notice({
+		issue,
+		files: measurement.files,
+		lines: measurement.lines,
+	})
+
+	return true
+}
+
+async function branch_issue(): Promise<number | undefined> {
+	return git_branch.issue_from_branch(await git_command.branch())
+}
+
+async function pending_notice(): Promise<string | undefined> {
+	const issue_number = await branch_issue()
+
+	if (issue_number === undefined) return undefined
+	const target = await unclaimed_marker(issue_number)
+
+	if (target === undefined) return undefined
+	const measurement = await split_measure.read_branch()
+	const notice = split_assess.notice(measurement)
+
+	return notice !== undefined && (await claim_notice(target, issue_number, measurement))
+		? notice
+		: undefined
+}
+
+// `josh main:merge` prints its notice on every merge; this records the first showing, as the scoped
+// checks do, when neither of them showed it before. Advisory, as `surface` is.
+async function record(measurement: SizeMeasurement): Promise<void> {
+	try {
+		const issue_number = await branch_issue()
+		const target = issue_number === undefined ? undefined : await unclaimed_marker(issue_number)
+
+		if (issue_number !== undefined && target !== undefined) {
+			await claim_notice(target, issue_number, measurement)
+		}
+	} catch {
+		// Advisory: the notice was printed; only its record is lost.
+	}
+}
+
+async function surface(): Promise<void> {
+	try {
+		const notice = await pending_notice()
+
+		if (notice !== undefined) console.warn(`\n${notice}`)
+	} catch {
+		// Advisory: `josh main:merge` reports an unmeasurable diff before the gate.
+	}
+}
+
+const split_early_notice = { MARKER_PREFIX, record, surface }
+
+export { split_early_notice }

package/scripts/split/split-measure.ts

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises'
 import path from 'node:path'
+import { change_base } from '#scripts/git/change-base'
 import { changed_paths } from '#scripts/git/changed-paths'
 import { git_command } from '#scripts/git/git-command'
 import { git_spawn } from '#scripts/git/git-spawn'
@@ -14,7 +15,16 @@ import { split_assess } from './split-assess'
 // `git diff --numstat` counts it. An entry with no readable content — a dangling symlink, a nested
 // repository's directory — still counts as a file, of zero lines, so one such entry cannot reject
 // the whole measurement.
-
+//
+// joshuafolkken/kit#4696: **the tracked half is measured from the tree's base, through a merge in
+// progress** (`change_base.resolved_through_merge`). A merge of the default branch stopped on a
+// conflict has already put the default branch's files in the work tree while `HEAD` is still the
+// commit before it, so measuring from `HEAD`'s merge-base counted everything the merge brought in as
+// this branch's own — 53 files where the branch had 10. A base that cannot be resolved throws, so no
+// caller reads it as under the guide: the notices report the diff as unmeasured and `split:assess`
+// fails outright.
+
+const UNRESOLVED_BASE = 'the change base could not be resolved'
 const NUL_BYTE = 0
 const NO_CONTENT = Buffer.alloc(0)
 const NEWLINE = '\n'
@@ -54,8 +64,16 @@ async function untracked_numstat(): Promise<string> {
 	return rows.join(NEWLINE)
 }
 
+async function tracked_numstat(): Promise<string> {
+	const base = await change_base.resolved_through_merge()
+
+	if (base === undefined) throw new Error(UNRESOLVED_BASE)
+
+	return await git_command.diff_numstat_since(base)
+}
+
 async function read_branch(): Promise<ReturnType<typeof split_assess.assess>> {
-	const tracked = await git_command.diff_main_numstat()
+	const tracked = await tracked_numstat()
 
 	return split_assess.assess(`${tracked}${NEWLINE}${await untracked_numstat()}`)
 }