@joshuafolkken/kit 1.2116.0 → 1.3000.0

package/scripts/followup/followup-section.ts

@@ -0,0 +1,30 @@
+import { run_step_section } from '#scripts/run/run-step-section'
+import { followup_ship_environment } from './followup-ship-environment'
+
+// **`josh followup` prints the section that governs it, once per session** (joshuafolkken/kit#5645),
+// so the reader spends no `doc:section` turn on `followup.md` before issuing it. A followup a ship
+// runs — in the foreground, detached or in a lane child — carries `SHIPPED_ENVIRONMENT` and prints
+// nothing: the ship's own section governs it, and its report is not the session's to mark
+// (joshuafolkken/kit#5696).
+
+const SUCCESS_EXIT_CODE = 0
+const FOLLOWUP = 'followup'
+const UNRESOLVED_MESSAGE = 'The section that governs `josh followup` could not be printed.'
+const { SHIPPED_ENVIRONMENT, is_ship_run } = followup_ship_environment
+
+// An unresolved heading fails the command, exactly as `run:review` and `ship` refuse it, so a renamed
+// section is never acted on unread.
+function print_section(
+	root: string = process.cwd(),
+	source: NodeJS.ProcessEnv = process.env,
+): void {
+	if (is_ship_run(source)) return
+
+	if (run_step_section.print_once(FOLLOWUP, root) !== SUCCESS_EXIT_CODE) {
+		throw new Error(UNRESOLVED_MESSAGE)
+	}
+}
+
+const followup_section = { SHIPPED_ENVIRONMENT, UNRESOLVED_MESSAGE, print_section }
+
+export { followup_section }

package/scripts/followup/followup-ship-environment.ts

@@ -0,0 +1,17 @@
+// **A followup a ship runs carries `SHIPPED_ENVIRONMENT`** (joshuafolkken/kit#5696), so it prints no
+// section of its own: the ship's governs it. Kept apart from `followup-section.ts`, so the ship's sync
+// sets it without the section printer's imports (joshuafolkken/kit#5987).
+
+const SHIP_FOLLOWUP_KEY = 'JOSH_SHIP_FOLLOWUP'
+const SHIP_FOLLOWUP_ON = '1'
+const SHIPPED_ENVIRONMENT: Readonly<Record<string, string>> = {
+	[SHIP_FOLLOWUP_KEY]: SHIP_FOLLOWUP_ON,
+}
+
+function is_ship_run(source: NodeJS.ProcessEnv): boolean {
+	return source[SHIP_FOLLOWUP_KEY] === SHIP_FOLLOWUP_ON
+}
+
+const followup_ship_environment = { SHIPPED_ENVIRONMENT, is_ship_run }
+
+export { followup_ship_environment }

package/scripts/followup/git-followup-finish.ts

@@ -1,5 +1,8 @@
+import { git_command } from '#scripts/git/git-command'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { issue_watch } from '#scripts/issue/issue-watch'
+import { josh_command } from '#scripts/josh/josh-run'
+import { lane_registry } from '#scripts/lane/lane-registry'
 import { review_attest } from '#scripts/review/review-attest'
 import { review_stamps } from '#scripts/review/review-stamps'
 import { run_hold } from '#scripts/run/hold/run-hold'
@@ -9,6 +12,8 @@ import { git_followup_cleanup, type CleanupStep } from './git-followup-cleanup'
 import { git_followup_pending } from './git-followup-pending'
 import { git_followup_stages } from './git-followup-stages'
 
+const MAIN_SYNC = 'main:sync'
+
 // **The count of unreleased merges, not the project version**. The local `package.json` version
 // reads as "the version this run just shipped", but children do not bump, so that number names the
 // *previous* release and the reading is false. The count is
@@ -224,11 +229,56 @@ function build_record_steps(should_merge: boolean): ReadonlyArray<CleanupStep> {
 	]
 }
 
+// **Only a main checkout already on the default branch is synced.** `main:sync` checks the default
+// branch out, so on any other branch it would move another session's work out from under it.
+async function is_on_default_branch(root: string): Promise<boolean> {
+	const [current, default_branch] = await Promise.all([
+		git_command.branch_at(root),
+		git_command.get_default_branch(),
+	])
+
+	return current === default_branch
+}
+
+// The default branch the merge advanced is pulled into the main checkout here, so no caller runs
+// `main:sync` as a step of its own after `followup` (#5941). **Run at the main repository root**:
+// `main:sync` refuses inside a linked work tree, and a lane is where `followup` usually runs.
+async function sync_main_checkout(should_merge: boolean): Promise<void> {
+	if (!should_merge) return
+
+	const root = await lane_registry.main_repository_root()
+
+	if (!(await is_on_default_branch(root))) {
+		console.info(`${MAIN_SYNC} skipped: ${root} is not on the default branch`)
+
+		return
+	}
+
+	josh_command.require_success(await josh_command.josh_run_at([MAIN_SYNC], root), MAIN_SYNC)
+}
+
+// Last, after the hold release: a sync that fails or takes long must not keep the working tree held.
+function build_sync_steps(should_merge: boolean): ReadonlyArray<CleanupStep> {
+	return [
+		{
+			label: 'The main checkout sync',
+			recovery: 'pnpm josh main:sync (in the primary checkout)',
+			run: async () => {
+				await sync_main_checkout(should_merge)
+			},
+		},
+	]
+}
+
 function build_finish_steps(
 	issue_number: string | undefined,
 	should_merge: boolean,
 ): ReadonlyArray<CleanupStep> {
-	return [...build_report_steps(issue_number, should_merge), ...build_record_steps(should_merge)]
+	return [
+		...build_report_steps(issue_number, should_merge),
+		...build_record_steps(should_merge),
+		...build_sync_steps(should_merge),
+	]
 }
 
 // The tail every invocation shares. Answers whether all of it completed, so a caller could report a
@@ -254,6 +304,7 @@ const git_followup_finish = {
 	clear_review_records,
 	release_worktree_hold,
 	end_progress_watcher,
+	sync_main_checkout,
 }
 
 export { git_followup_finish }

package/scripts/followup/git-followup-flush.ts

@@ -9,14 +9,12 @@ import { observations_flush } from '#scripts/observations/observations-flush'
 // ride its own commit, so the ledger is usually clean by now and this
 // short-circuits; what it still catches is a line appended after that commit — an observation
 // recorded between the commit and the merge — which would otherwise stay in the working tree after
-// the merge. **A passing second review round is not one of them**: it used to
-// be the usual case, and its push restarted the pull request's CI on six lanes of fourteen in a day,
-// so `review:record --comment` now records that round on the issue and leaves the tree clean.
+// the merge. A passing second review round is recorded on the issue with `review:record --comment`
+// so recording it does not restart the pull request's CI.
 //
-// **It commits onto the pull request's own branch, before the merge**. It used
-// to flush after the merge from the default branch, which a lane cannot reach, so a lane's lines
-// waited in the primary checkout for a batch-end flush and were lost there to another run's stash.
-// Committed to the branch instead, the lines merge with the pull request — in a lane as anywhere — and
+// It commits onto the pull request's own branch before the merge, because a lane cannot reach the
+// default branch and uncommitted lines in the primary checkout are vulnerable to another run's stash.
+// The lines merge with the pull request — in a lane as anywhere — and
 // the CI wait `pnpm josh followup` runs next covers the pushed commit like any other push.
 
 const COMMIT_MESSAGE_PREFIX = 'Record observation ledger entries'
@@ -24,7 +22,7 @@ const COMMIT_MESSAGE_PREFIX = 'Record observation ledger entries'
 function commit_message(issue_number: string | undefined): string {
 	return issue_number === undefined
 		? COMMIT_MESSAGE_PREFIX
-		: `${COMMIT_MESSAGE_PREFIX} ${issue_cite.plain(issue_number)}`
+		: `${COMMIT_MESSAGE_PREFIX} ${issue_cite.plain_for('github', issue_number)}`
 }
 
 // **A broken line refuses the merge rather than riding it**: the branch's

package/scripts/followup/git-followup-stages.ts

@@ -111,6 +111,8 @@ interface StageLog {
 	last_ms: number
 	coderabbit: CodeRabbitWait
 	ci_path: CiPath
+	// The CI jobs the check wait reran as flaky, read into the completion notification (#5545).
+	reran: Array<string>
 	issue?: number
 }
 
@@ -120,6 +122,7 @@ function new_log(): StageLog {
 		last_ms: performance.now(),
 		coderabbit: followup_coderabbit_wait.new_wait(),
 		ci_path: followup_ci_path.new_path(),
+		reran: [],
 	}
 }
 

package/scripts/followup/git-followup-workflow.ts

@@ -4,12 +4,15 @@ import { git_branch } from '#scripts/git/git-branch'
 import { git_error } from '#scripts/git/git-error'
 import { cli_body } from '#scripts/josh/cli-body'
 import { josh_environment_file } from '#scripts/josh/josh-environment-file'
+import { lane_size_record } from '#scripts/lane/lane-size-record'
 import { git_notify, type GitNotifyConfig } from '#scripts/notify/git-notify'
 import { acceptance_map_check } from '#scripts/review/acceptance-map-check'
 import { live_evidence } from '#scripts/review/live-evidence'
 import { removed_tests_check } from '#scripts/review/removed-tests-check'
+import { followup_human_merge, HumanMergeRequiredError } from './followup-human-merge'
 import { parse_issue_number_from_text } from './followup-issue-number'
 import { followup_review_gates } from './followup-review-gates'
+import { followup_section } from './followup-section'
 import { git_followup_finish } from './git-followup-finish'
 import { git_followup_flush } from './git-followup-flush'
 import { git_followup_merged, type MergePlan } from './git-followup-merged'
@@ -176,10 +179,12 @@ async function assert_merge_gates(
 	await assert_removed_tests_disposed(should_merge, branch_name)
 }
 
-// After the gates, before the CI wait: a line appended since the run's commit rides the pull request
+// After the gates, before the CI wait: the lane's size line is written while the branch is still
+// checked out, then a line appended since the run's commit rides the pull request
 // itself, so it merges with it — a lane's included. **A pull request that has
 // already merged skips both**: the gates guard a merge this run no longer
-// makes, and a ledger commit would land on a branch that has already gone in.
+// makes, and a ledger commit would land on a branch that has already gone in. The human-merge stop
+// is not here: it waits for green CI in `before_merge`, so a red workflow PR fails as red.
 async function prepare_merge(
 	plan: MergePlan,
 	issue_number: string | undefined,
@@ -188,18 +193,28 @@ async function prepare_merge(
 	if (plan.is_merged) return
 
 	await assert_merge_gates(plan.should_merge, issue_number, branch_name)
+	if (is_valid_issue(issue_number)) await lane_size_record.record(plan.should_merge, issue_number)
 	await git_followup_flush.commit_ledger_step(plan.should_merge, issue_number)
 }
 
-async function main(): Promise<void> {
-	const cli = parse_cli_arguments()
-
-	if (cli.values.help === true) {
-		display_help()
+// `--help` answers alone; every other invocation opens on the section that governs it. `true` when the
+// help was the whole answer.
+function answer_help_or_open(values: CliArguments['values']): boolean {
+	if (values.help !== true) {
+		followup_section.print_section()
 
-		return
+		return false
 	}
 
+	display_help()
+
+	return true
+}
+
+async function main(): Promise<void> {
+	const cli = parse_cli_arguments()
+
+	if (answer_help_or_open(cli.values)) return
 	const issue_number =
 		cli.values['issue-number'] ?? parse_issue_number_from_text(cli.positionals[0] ?? undefined)
 	const branch_name = await resolve_branch_name(cli.values.branch)
@@ -219,6 +234,9 @@ async function main(): Promise<void> {
 		should_merge: plan.should_merge,
 		is_merged: plan.is_merged,
 		merged_at: plan.merged_at,
+		before_merge: async (head) => {
+			await followup_human_merge.assert_allowed(branch_name, issue_number, head)
+		},
 	})
 
 	await git_followup_finish.finish(used_issue_number ?? issue_number, plan.should_merge)
@@ -228,10 +246,12 @@ try {
 	await main()
 	console.info('')
 } catch (error) {
-	git_error.handle(error)
+	if (error instanceof HumanMergeRequiredError) console.info(error.message)
+	else git_error.handle(error)
 }
 
 const git_followup_workflow = {
+	answer_help_or_open,
 	assert_acceptance_mapped,
 	assert_live_evidence,
 	assert_removed_tests_disposed,

package/scripts/followup/git-pr-followup-checks.ts

@@ -11,10 +11,12 @@ import {
 	is_coderabbit_check,
 	PrConflictError,
 } from '#scripts/gh/git-pr-checks-eval'
+import { MissingContextError } from '#scripts/gh/git-pr-checks-missing'
 import { CHECK_STATUS_PASS, type PrStateSnapshot } from '#scripts/gh/git-pr-checks-parse'
 import { issue_watch_gate } from '#scripts/issue/issue-watch-gate'
 import { json_value } from '#scripts/lib/json-value'
-import { followup_job_rerun } from './followup-job-rerun'
+import { followup_job_rerun, MAX_CHECK_RERUNS } from './followup-job-rerun'
+import { followup_run_rerun } from './followup-run-rerun'
 
 // The check wait and the notes read off its snapshot — split out of `git-pr-followup.ts` when it
 // reached its line limit. `git-pr-followup` re-exports each name it always
@@ -109,11 +111,13 @@ async function watch_before_polling(
 // A skipped or fallen-through watch keeps `DEFAULT_STABLE_READS`, and a check that turned red is still
 // caught: the poll evaluates the full merge gate and throws on failure before any stable read counts.
 // `observe` is shown each poll's snapshot, the watch's included — the run's `pr-checks` line
-// (joshuafolkken/kit#3770).
+// (joshuafolkken/kit#3770). `reran` collects the jobs the rerun below restarted, for the completion
+// notification's check report (joshuafolkken/kit#5545).
 interface RunChecksInput {
 	branch_name: string
 	is_skip_watch: boolean
 	observe?: SnapshotObserver
+	reran?: Array<string>
 }
 
 async function wait_for_checks(input: RunChecksInput): Promise<PrStateSnapshot> {
@@ -136,18 +140,71 @@ function is_checks_failure(error: unknown): boolean {
 	return error instanceof Error && error.message.startsWith(FAILURE_MESSAGE_PREFIX)
 }
 
-// **A job the runner stopped after every step passed, or one red only on tests outside the change, is
-// rerun once and the wait judged again** (`followup-job-rerun.ts`). The second wait has no rerun of its own, so a job that stops the same way
-// twice — or any other failure — ends the run as before.
+// A required job a partial rerun dropped is recovered by rerunning its whole run, or waited for again
+// when it only trailed (`followup-run-rerun.ts`). `undefined` leaves it to the failed-job rerun: a
+// job failed beside the gap, and rerunning it brings back the jobs that wait on it.
+async function rejudge_missing(
+	input: RunChecksInput,
+	error: MissingContextError,
+): Promise<PrStateSnapshot | undefined> {
+	const outcome = await followup_run_rerun.recover_missing(error.missing)
+	if (outcome === 'none') return undefined
+	if (outcome === 'rerun') input.reran?.push(...error.missing.contexts)
+
+	return await wait_for_checks(input)
+}
+
+// A spent cap stops on its own message only while the red is still one a rerun would retry; any
+// other red keeps its own failure.
+async function stop_reruns_spent(branch_name: string, error: unknown): Promise<never> {
+	const names = await followup_job_rerun.read_rerun_names(branch_name)
+	if (names.length === 0) throw error
+
+	throw new Error(followup_job_rerun.reruns_spent_message(names))
+}
+
+// The wait after a rerun: its snapshot, or the checks failure the next round reruns.
+type RerunWait = { snapshot: PrStateSnapshot } | { failure: unknown }
+
+async function wait_after_rerun(input: RunChecksInput): Promise<RerunWait> {
+	try {
+		return { snapshot: await wait_for_checks(input) }
+	} catch (error) {
+		if (!is_checks_failure(error)) throw error
+
+		return { failure: error }
+	}
+}
+
+// `round` counts the reruns already made; a wait that fails on checks again goes to the next round.
+async function rejudge_failed_jobs(
+	input: RunChecksInput,
+	error: unknown,
+	round: number,
+): Promise<PrStateSnapshot> {
+	if (round >= MAX_CHECK_RERUNS) return await stop_reruns_spent(input.branch_name, error)
+	const rerun = await followup_job_rerun.rerun_failed_jobs(input.branch_name, round)
+	if (rerun.length === 0) throw error
+	input.reran?.push(...rerun)
+	const waited = await wait_after_rerun(input)
+	if ('snapshot' in waited) return waited.snapshot
+
+	return await rejudge_failed_jobs(input, waited.failure, round + 1)
+}
+
+// **A job the runner stopped after every step passed, one red only on tests outside the change, or one
+// red on a download is rerun and the wait judged again** (`followup-job-rerun.ts`). Only a download
+// failure qualifies past the first attempt, so a test that fails the same way twice — or any other
+// failure — ends the run as before; a download outage is rerun up to `MAX_CHECK_RERUNS` times.
 async function rejudge_after_rerun(
 	input: RunChecksInput,
 	error: unknown,
 ): Promise<PrStateSnapshot> {
 	if (!is_checks_failure(error)) throw error
-	const rerun = await followup_job_rerun.rerun_failed_jobs(input.branch_name)
-	if (rerun.length === 0) throw error
+	const recovered =
+		error instanceof MissingContextError ? await rejudge_missing(input, error) : undefined
 
-	return await wait_for_checks(input)
+	return recovered ?? (await rejudge_failed_jobs(input, error, 0))
 }
 
 async function run_checks(input: RunChecksInput): Promise<PrStateSnapshot> {

package/scripts/followup/git-pr-followup-wrapup.ts

@@ -36,10 +36,10 @@ interface WrapupInput {
 	notify_config: GitNotifyConfig | undefined
 	pr_url: string | undefined
 	should_merge: boolean
-	// The managed config-file report, which reaches the completion report on the Issue as well as the
-	// completion notification. Empty on a run that changed nothing `josh sync`
-	// distributes, and an empty one adds no line.
-	managed_notes: ReadonlyArray<string>
+	// The managed config-file report and the check report (`followup-check-report.ts`), which reach
+	// the completion report on the Issue as well as the completion notification, after the
+	// `--notify-message` text. Empty on a run with nothing to report, and an empty one adds no line.
+	report_notes: ReadonlyArray<string>
 	// A pull request merged before this run is not merged again, and a tail whose completion report is
 	// already on the issue does not post it twice (`git-followup-merged.ts`).
 	is_merged?: boolean | undefined
@@ -48,6 +48,7 @@ interface WrapupInput {
 	// that head moved before the merge (`git-pr-merge-checked.ts`, #4036).
 	checked?: PrStateSnapshot | undefined
 	wait_for_green: WaitForGreen
+	before_merge?: ((head?: string) => Promise<void>) | undefined
 	// The completion Telegram, its body already read, sent beside the merge.
 	send_completion: () => Promise<void>
 }
@@ -56,14 +57,14 @@ function build_notify_body(input: {
 	notify_config: GitNotifyConfig
 	issue_number: string | undefined
 	pr_url: string | undefined
-	managed_notes: ReadonlyArray<string>
+	report_notes: ReadonlyArray<string>
 }): string {
 	return git_notify.build_completion_comment_body({
 		message: input.notify_config.message,
 		issue_number: input.issue_number,
 		pr_url: input.pr_url,
 		mentions: input.notify_config.mentions,
-		notes: input.managed_notes,
+		notes: input.report_notes,
 	})
 }
 
@@ -91,7 +92,7 @@ async function post_completion_notification(input: {
 	issue_number: string | undefined
 	notify_config: GitNotifyConfig | undefined
 	pr_url: string | undefined
-	managed_notes: ReadonlyArray<string>
+	report_notes: ReadonlyArray<string>
 }): Promise<void> {
 	if (input.notify_config === undefined) return
 
@@ -99,7 +100,7 @@ async function post_completion_notification(input: {
 		notify_config: input.notify_config,
 		issue_number: input.issue_number,
 		pr_url: input.pr_url,
-		managed_notes: input.managed_notes,
+		report_notes: input.report_notes,
 	})
 	const { target } = input.notify_config
 
@@ -128,7 +129,7 @@ async function notify_step(input: WrapupInput): Promise<void> {
 				issue_number: input.issue_number,
 				notify_config: input.notify_config,
 				pr_url: input.pr_url,
-				managed_notes: input.managed_notes,
+				report_notes: input.report_notes,
 			})
 		},
 	})
@@ -251,6 +252,7 @@ async function send_beside_merge(input: WrapupInput): Promise<string> {
 		return STAGE.telegram
 	}
 
+	await input.before_merge?.(input.checked?.head_sha)
 	await settled_together(input.send_completion(), merge_step(input))
 
 	return STAGE.telegram_and_merge

package/scripts/followup/git-pr-followup.ts

@@ -12,6 +12,7 @@ import {
 	type TelegramSendInput,
 	type TelegramTaskType,
 } from '#scripts/notify/telegram-notify'
+import { followup_check_report } from './followup-check-report'
 import { followup_checks_event } from './followup-checks-event'
 import { followup_ci_path } from './followup-ci-path'
 import { followup_coderabbit_retrigger, type Settled } from './followup-coderabbit-retrigger'
@@ -75,6 +76,7 @@ interface FollowupInput {
 	is_merged?: boolean | undefined
 	// When it merged — a completion report posted before it is the `prrun` stop's, not this tail's.
 	merged_at?: string | undefined
+	before_merge?: ((head?: string) => Promise<void>) | undefined
 }
 
 const { parse_closes_issue_number } = git_closes_keyword
@@ -134,9 +136,8 @@ interface PreparedNotify {
 
 // **The four reads in front of the check wait are issued together**. Not one
 // of them is a wait on anything: the `closes #N` check reads the pull request body, and the
-// notification needs the repository name, the issue title and the pull request URL — four requests
-// that were sent one at a time for 5.5 of `followup`'s measured 45.8 seconds, purely because they
-// were written as consecutive statements.
+// notification needs the repository name, the issue title and the pull request URL. Independent
+// requests need not delay one another (joshuafolkken/kit#1446).
 //
 // **This overlaps requests; it decides nothing differently.** The `closes #N` warning still fires on
 // the same body, the context still carries the same four fields, and the required-check wait and the
@@ -236,16 +237,17 @@ async function run_comment_scans(
 // diff read this cheap is not what a measurement of `followup` is looking for; its cost lands inside
 // `checks-wait`, where it is indistinguishable from noise.
 //
-// **The managed report comes back beside the notes as well as inside them**, because the two have
-// different destinations: every note reaches the completion notification, and this one alone also
-// reaches the completion report posted to the Issue. Returning it twice is
+// The report is the managed config-file report and the check report (#5545). **It comes back beside
+// the notes as well as inside them**, because the two have different destinations: every note reaches
+// the completion notification, and the report alone also reaches the completion report posted to
+// the Issue. Returning it twice is
 // what lets `run_stages` hand each destination what belongs to it without re-deriving the answer.
 //
 // **The snapshot travels on to the merge**, which names its head, and the same wait is what the merge
 // goes back to when that head moved before it (#4036).
 interface ReviewChecks {
 	notes: Array<string>
-	managed: Array<string>
+	report: Array<string>
 	snapshot?: PrStateSnapshot
 }
 
@@ -259,6 +261,7 @@ function wait_for_green_of(
 		return await run_checks({
 			branch_name: input.branch_name,
 			is_skip_watch: input.is_skip_watch,
+			reran: log.reran,
 			observe: followup_coderabbit_wait.all(
 				followup_checks_event.observer_of(issue_number, context.pr_url),
 				followup_coderabbit_wait.observer_of(log.coderabbit),
@@ -297,19 +300,21 @@ async function run_review_checks(
 	log: StageLog,
 	issue_number: string | undefined,
 ): Promise<ReviewChecks> {
-	if (input.is_merged === true) return { notes: [], managed: [] }
+	if (input.is_merged === true) return { notes: [], report: [] }
 
 	git_followup_stages.hold_issue(log, issue_number)
 	const managed = await git_pr_managed_config.handle_managed_config_changes({
 		should_merge: input.should_merge,
 	})
-	const { snapshot, notes } = await wait_for_review_green(input, context, issue_number, log)
-	const check_notes = [...notes, ...read_coderabbit_skip_notes(snapshot)]
+	const settled = await wait_for_review_green(input, context, issue_number, log)
+	const { snapshot } = settled
+	const check_notes = [...settled.notes, ...read_coderabbit_skip_notes(snapshot)]
 
 	log_skip_notes(check_notes)
 	const scan_notes = await run_comment_scans(input, context, log)
+	const report = [...managed, ...followup_check_report.lines({ ...settled, reran: log.reran })]
 
-	return { notes: [...managed, ...check_notes, ...scan_notes], managed, snapshot }
+	return { notes: [...report, ...check_notes, ...scan_notes], report, snapshot }
 }
 
 // **A tail re-run after a merge does not report twice**: where the issue
@@ -353,12 +358,13 @@ async function run_stages(input: FollowupInput, log: StageLog): Promise<string |
 			notify_config: input.notify_config,
 			pr_url: context.pr_url,
 			should_merge: input.should_merge,
-			managed_notes: checks.managed,
+			report_notes: checks.report,
 			is_merged: input.is_merged,
 			is_completion_recorded: notify.is_recorded,
 			send_completion: notify.send,
 			checked: checks.snapshot,
 			wait_for_green: wait_for_green_of(input, context, issue_number, log),
+			before_merge: input.before_merge,
 		},
 		log,
 	)

package/scripts/fresh-machine/fresh-machine-cli.ts

@@ -7,6 +7,7 @@ import { claude_token } from '#scripts/auth/claude-token'
 import { gh_cli_token } from '#scripts/gh/gh-cli-token'
 import { git_gh_exec } from '#scripts/gh/git-gh-exec'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
+import { JOSH_TMP_DIRECTORY } from '#scripts/lib/josh-temporary-directory'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
 import { fresh_machine_docker } from './fresh-machine-docker'
@@ -24,7 +25,7 @@ const USAGE =
 	'Usage: josh fresh:run <pattern> | --spec <file.json> [--package-version <version>] [--log-dir <dir>] [--rebuild] | --list'
 // The scratch directory kit's distributed `.gitignore` already ignores, so a log is never committed
 // from kit or from a consumer toolkit.
-const DEFAULT_LOG_DIRECTORY = '.josh/tmp/fresh-machine'
+const DEFAULT_LOG_DIRECTORY = `${JOSH_TMP_DIRECTORY}/fresh-machine`
 const NO_GITHUB_TOKEN =
 	'This scenario uses GitHub and `gh auth token` printed no token. Run `gh auth login` on this machine first.'
 const NO_CLAUDE_TOKEN = `This scenario uses Claude Code and neither the macOS keychain nor ${claude_token.VARIABLE} holds a token. ${claude_token.SETUP_HINT}`

package/scripts/fresh-machine/fresh-machine-image.ts

@@ -4,6 +4,8 @@
 // package and a consumer toolkit builds the same machine; `fresh-machine-image.test.ts` holds the
 // commands below to the guide's own lines.
 
+import { pnpm_installer } from '#scripts/lib/pnpm-installer'
+
 const BASE_IMAGE = 'buildpack-deps:bookworm-curl'
 const MACHINE_USER = 'dev'
 const HOME_DIRECTORY = `/home/${MACHINE_USER}`
@@ -11,7 +13,7 @@ const TAG_PREFIX = 'josh-fresh-machine'
 
 // `docs/setup/prerequisites.md` → "Linux and macOS". The first line runs in the shell a new machine
 // starts with; the guide then says to open a new terminal, which is what `NEW_TERMINAL` does.
-const INSTALL_PNPM = 'curl -fsSL https://get.pnpm.io/install.sh | sh -'
+const INSTALL_PNPM = pnpm_installer.command()
 const NEW_TERMINAL_COMMANDS = ['pnpm runtime set node 22 -g', 'node --version']
 
 // The guide sends a Linux reader to the gh installation page; these are that page's Debian steps,

package/scripts/fresh-machine/fresh-machine-patterns.ts

@@ -1,11 +1,13 @@
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
+import { fresh_machine_registry } from './fresh-machine-registry'
 import { fresh_machine_spec, type Scenario } from './fresh-machine-spec'
 
-// kit's own six patterns: three projects (one Lua file, one `index.html`, a minimal TypeScript
+// kit's own seven patterns: three projects (one Lua file, one `index.html`, a minimal TypeScript
 // SvelteKit app from `sv`) by two commands (`josh init`, `josh start`), each from the starting state
-// joshuafolkken/kit#2848 gave it. `josh init` installs the packed checkout, so a fix is retested
-// without a release; `josh start` installs a published version, because its setup pull request
-// would carry a tarball path CI cannot resolve.
+// joshuafolkken/kit#2848 gave it, and the Lua file through `pnpm dlx` against a local registry.
+// `josh init` installs the packed checkout, so a fix is retested without a release; `josh start`
+// installs a published version, because its setup pull request would carry a tarball path CI cannot
+// resolve.
 
 const KIT = KIT_PACKAGE_NAME
 const ALLOW_BUILDS = '--allow-build=esbuild --allow-build=unrs-resolver'
@@ -140,6 +142,24 @@ function start_pattern(
 	})
 }
 
+// The documented first command, `pnpm dlx` handing off to the kit it installs, against the local
+// registry where one of kit's dependencies is inside the release-age wait; the install a later person
+// runs must accept the lockfile it left (#7200). The project starts with a first commit because
+// `josh init` reads the tree's state through git, which only the GitHub image has.
+const DLX_INIT = `pnpm --allow-build=esbuild dlx ${KIT} init`
+const FROZEN_INSTALL = 'pnpm install --frozen-lockfile'
+const LOCKED_FRESH_DEPENDENCY = `grep -n -A2 '${fresh_machine_registry.FRESH_DEPENDENCY}@' pnpm-lock.yaml`
+
+function dlx_pattern(project: string, files: Record<string, string>): Scenario {
+	return fresh_machine_spec.define({
+		name: `kit-test-${project}-dlx`,
+		requires_github: true,
+		files,
+		commands: [...fresh_machine_registry.COMMANDS, ...FIRST_COMMIT, DLX_INIT, FROZEN_INSTALL],
+		probes: [LOCKED_FRESH_DEPENDENCY, ...fresh_machine_registry.PROBES],
+	})
+}
+
 const PATTERNS: ReadonlyArray<Scenario> = [
 	init_pattern('lua', LUA_FILES, [BARE_MANIFEST]),
 	// No Git: `josh start` creates the repository, the first commit and the GitHub repository.
@@ -160,6 +180,7 @@ const PATTERNS: ReadonlyArray<Scenario> = [
 			probes: [SETUP_CI],
 		},
 	),
+	dlx_pattern('lua', LUA_FILES),
 ]
 
 function names(): Array<string> {