@joshuafolkken/kit 1.3101.0 → 1.3125.0

package/scripts/backlog/backlog-drive-listing.ts

@@ -1,7 +1,10 @@
 import { git_gh_issue } from '#scripts/gh/git-gh-issue'
 import { git_gh_issue_rest, type RestIssue } from '#scripts/gh/git-gh-issue-rest'
 import { AUTO_OK_LABEL, IN_PROGRESS_LABEL } from '#scripts/issue/issue-labels'
+import { shared_cache } from '#scripts/josh/shared-cache'
 import { z } from 'zod'
+import { backlog_listing_trace, type ListingNote } from './backlog-listing-trace'
+import { backlog_next_shared } from './backlog-next-shared'
 
 type ListingCheck = () => Promise<boolean>
 
@@ -43,24 +46,35 @@ function has_change(seen: Listing | undefined, listing: Listing): boolean {
 // one outside a lane, counts. The first read is the baseline, and a read that fails reads as unchanged:
 // the ask's interval still comes. A first read that fails leaves an empty baseline rather than none, so
 // an issue listed before the next read that answers still counts as new (joshuafolkken/kit#7229).
-function watcher(): ListingCheck {
+//
+// **A change drops the kept `backlog:next` answer**: its key moves only with the run's stream, which an
+// `issue:file --publish` does not touch, so the ask the change wakes would replay the answer from before
+// it, and the change, already seen, wakes nothing more (joshuafolkken/kit#7583).
+function watcher(note: ListingNote = backlog_listing_trace.ignore): ListingCheck {
 	const memory: { seen?: Listing } = {}
 
 	function keep(listing: Listing): void {
 		memory.seen = listing
 	}
 
+	function settle(listing: Listing): boolean {
+		const is_new = has_change(memory.seen, listing)
+
+		keep(listing)
+		if (is_new) shared_cache.clear(backlog_next_shared.NEXT_CACHE)
+		note(is_new ? 'changed' : 'unchanged')
+
+		return is_new
+	}
+
 	return async function is_changed(): Promise<boolean> {
 		try {
 			const detail = await git_gh_issue.issue_list_label_first_page(AUTO_OK_LABEL)
-			const listing = listing_of(detail.body)
-			const is_new = has_change(memory.seen, listing)
-
-			keep(listing)
 
-			return is_new
+			return settle(listing_of(detail.body))
 		} catch {
 			keep(memory.seen ?? new Map())
+			note('failed')
 
 			return false
 		}

package/scripts/backlog/backlog-hold-text.ts

@@ -46,6 +46,7 @@ const OFFER_TEXT: ReadonlyMap<string, string> = new Map([
 const CAUSE_TEXT: Readonly<Record<WaitCause, string>> = {
 	chain: 'other issues',
 	gate: 'a start condition',
+	publication: 'their publication',
 	lane: 'a running lane',
 }
 const CAUSE_JOINER = ' or '

package/scripts/backlog/backlog-listing-trace.ts

@@ -0,0 +1,35 @@
+// What each `auto-ok` listing check of a waiting driver found, printed to its log when it differs from
+// the previous check, so a missed wake shows which step it fell at (joshuafolkken/kit#7583). Every
+// change prints: each one wakes an ask.
+type ListingOutcome = 'no-free-lane' | 'unchanged' | 'changed' | 'failed'
+
+type ListingNote = (outcome: ListingOutcome) => void
+
+const CHANGED: ListingOutcome = 'changed'
+
+function print_error(line: string): void {
+	console.error(line)
+}
+
+function tracer(print: (line: string) => void = print_error): ListingNote {
+	const memory: { last?: ListingOutcome } = {}
+
+	return function note(outcome: ListingOutcome): void {
+		if (outcome !== CHANGED && outcome === memory.last) return
+
+		memory.last = outcome
+		print(`listing check: ${outcome} at ${new Date().toISOString()}`)
+	}
+}
+
+function ignore(): void {
+	// A watcher no driver traces: the arrival probe's output is the parent's wake line.
+}
+
+// The driver's one trace, shared by the free-lane gate (`backlog-offer-timing.ts`) and its watcher.
+const drive = tracer()
+
+const backlog_listing_trace = { drive, ignore, tracer }
+
+export type { ListingNote, ListingOutcome }
+export { backlog_listing_trace }

package/scripts/backlog/backlog-offer-timing.ts

@@ -1,5 +1,6 @@
 import type { DriveState, LoopConfig, LoopPorts } from './backlog-drive'
 import { backlog_drive_memory } from './backlog-drive-memory'
+import { backlog_listing_trace } from './backlog-listing-trace'
 
 interface OfferTiming {
 	idle_until_ms?: number | undefined
@@ -57,14 +58,21 @@ function is_check_due(run: LoopRun, config: LoopConfig, now_ms: number): boolean
 }
 
 // The `auto-ok` listing, checked by its ETag at `check_ms` while a seat is free: a 304 spends no REST
-// core, so a new issue is asked about without waiting out the interval (joshuafolkken/kit#7227).
+// core, so a new issue is asked about without waiting out the interval (joshuafolkken/kit#7227). A
+// check a full pool skips is traced beside the watcher's own outcomes (joshuafolkken/kit#7583).
 async function is_listing_changed(
 	run: LoopRun,
 	config: LoopConfig,
 	ports: DuePorts,
 	now_ms: number,
 ): Promise<boolean> {
-	if (!is_check_due(run, config, now_ms) || (await ports.free_lanes()) === 0) return false
+	if (!is_check_due(run, config, now_ms)) return false
+
+	if ((await ports.free_lanes()) === 0) {
+		backlog_listing_trace.drive('no-free-lane')
+
+		return false
+	}
 
 	return await ports.listing_changed()
 }

package/scripts/backlog/backlog-wait-cause.ts

@@ -3,6 +3,7 @@ import type { EpicChild } from '#scripts/epic/epic-graph'
 import { issue_cite } from '#scripts/issue/issue-cite'
 import { has_label_name, IN_PROGRESS_LABEL } from '#scripts/issue/issue-labels'
 import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_publication_state } from '#scripts/issue/issue-publication-state'
 
 // Why the backlog had nothing to offer while children ran (joshuafolkken/kit#4513): which waiting
 // issues wait on a dependency chain, and which on a declared start condition (a start date or a
@@ -15,17 +16,21 @@ import { issue_not_before } from '#scripts/issue/issue-not-before'
 // A waiting child with neither cause waits on a running lane: the overlap separation withheld it on a
 // path a running lane declares, or the `run:solo` gate withheld it (joshuafolkken/kit#7307). Left
 // unnamed, the hold read as its siblings' `gate` alone and listed none of those children.
+//
+// A child whose filing has not published yet (`issue-publication-state.ts`) waits on that publication,
+// not on a running lane (joshuafolkken/kit#7572).
 
-type WaitCause = 'chain' | 'gate' | 'lane'
+type WaitCause = 'chain' | 'gate' | 'publication' | 'lane'
 
 type WaitCauses = Readonly<Record<WaitCause, ReadonlyArray<number>>> & {
 	not_before_ms?: number
 }
 
-const CAUSES: ReadonlyArray<WaitCause> = ['chain', 'gate', 'lane']
+const CAUSES: ReadonlyArray<WaitCause> = ['chain', 'gate', 'publication', 'lane']
 const MARKS: Readonly<Record<WaitCause, string>> = {
 	chain: 'Waiting on a dependency chain:',
 	gate: 'Waiting on a start condition:',
+	publication: 'Waiting on publication:',
 	lane: 'Waiting on a running lane:',
 }
 const TAG_SEPARATOR = '+'
@@ -49,6 +54,7 @@ function has_pending_blocker(child: EpicChild): boolean {
 
 function cause_of(child: EpicChild): WaitCause | undefined {
 	if (has_label_name(child.labels, IN_PROGRESS_LABEL)) return undefined
+	if (issue_publication_state.is_pending(child.body)) return 'publication'
 	if (!issue_not_before.is_due(child.body)) return 'gate'
 
 	return has_pending_blocker(child) ? 'chain' : 'lane'
@@ -74,6 +80,7 @@ function classify(children: ReadonlyArray<EpicChild>, repo: string): WaitCauses
 	return {
 		chain: numbers_with(here, 'chain'),
 		gate: numbers_with(here, 'gate'),
+		publication: numbers_with(here, 'publication'),
 		lane: numbers_with(here, 'lane'),
 		...deadline_of(here),
 	}
@@ -107,6 +114,7 @@ function parse(text: string): WaitCauses {
 	return {
 		chain: numbers_on(text, 'chain'),
 		gate: numbers_on(text, 'gate'),
+		publication: numbers_on(text, 'publication'),
 		lane: numbers_on(text, 'lane'),
 		...(Number.isFinite(not_before_ms) && { not_before_ms }),
 	}

package/scripts/document/document-byte-budget.ts

@@ -85,8 +85,8 @@ const DOCUMENT_BYTE_BUDGET: ReadonlyArray<DocumentBudget> = [
 	{ path: 'docs/josh-commands-run.md', bytes: 57_344 },
 	// The finished rows' icons, `⏩` already done among them (joshuafolkken/kit#7095), crossed the 20480 block.
 	{ path: 'docs/josh-commands-board.md', bytes: 24_576 },
-	// `lane:stats --since`'s usage example (joshuafolkken/kit#7007) crossed the 28672 block.
-	{ path: 'docs/josh-commands-lane.md', bytes: 32_768 },
+	// The `concurrent lanes` table's core-wait columns (joshuafolkken/kit#7550) crossed the 32768 block.
+	{ path: 'docs/josh-commands-lane.md', bytes: 36_864 },
 	// `cost:audit`'s dated period and usage breakdown (joshuafolkken/kit#7042) crossed the 16384 block.
 	{ path: 'docs/josh-commands-session.md', bytes: 20_480 },
 	// `josh effect:audit` (joshuafolkken/kit#4958) and `issue:priority`'s usage section (joshuafolkken/kit#4960) crossed the 57344 block;

package/scripts/git/git-command.ts

@@ -2,7 +2,7 @@ import { SUITE_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { PORCELAIN_FLAG, UNTRACKED_FILES_FLAG } from './constants'
 import { git_diff_reads } from './git-diff-reads'
 import { create_spawn_error } from './git-execa-error'
-import { git_pre_push_hook } from './git-pre-push-hook'
+import { git_pre_push_hook, type HookEnvironment } from './git-pre-push-hook'
 import { git_push_transport } from './git-push-transport'
 import { git_spawn } from './git-spawn'
 import { git_spawn_sync } from './git-spawn-sync'
@@ -225,8 +225,12 @@ async function push_with_upstream(
 // on a suite's budget of its own, before either push and outside the `try`; both transfers then skip it with `--no-verify`,
 // so neither the timeout retry nor the `--set-upstream` fallback repeats it, and a failed hook is not
 // mistaken for a missing upstream. A git too old to run the hook ahead leaves it to the push, as before.
-async function push(): Promise<void> {
-	const verify_flags = (await git_pre_push_hook.run()) ? [NO_VERIFY_FLAG] : []
+//
+// `hook_environment` reaches the hook run ahead and nothing else (joshuafolkken/kit#7539). The
+// transfers do not carry it: where the push itself runs the hook, the hook runs without the caller's
+// setting — for `pre_push_related_switch`, the whole suite, which is the safe side.
+async function push(hook_environment: HookEnvironment = {}): Promise<void> {
+	const verify_flags = (await git_pre_push_hook.run(hook_environment)) ? [NO_VERIFY_FLAG] : []
 
 	try {
 		await git_push_transport.push([...verify_flags])

package/scripts/git/git-pre-push-hook.ts

@@ -101,7 +101,9 @@ async function can_run_hooks(stdin_path: string): Promise<boolean> {
 	return await can_probe([HOOK_RUN, ...options])
 }
 
-async function run_with_stdin(stdin_line: string): Promise<boolean> {
+type HookEnvironment = Readonly<Record<string, string>>
+
+async function run_with_stdin(stdin_line: string, environment: HookEnvironment): Promise<boolean> {
 	const directory = await mkdtemp(path.join(tmpdir(), TEMPORARY_PREFIX))
 	const stdin_path = path.join(directory, STDIN_FILE)
 
@@ -113,7 +115,7 @@ async function run_with_stdin(stdin_line: string): Promise<boolean> {
 		await git_spawn.with_output(
 			'hook',
 			[...to_hook_run_arguments(stdin_path, HOOK_NAME), '--', REMOTE, url],
-			{ timeout_ms: SUITE_TIMEOUT_MS },
+			{ timeout_ms: SUITE_TIMEOUT_MS, environment },
 		)
 
 		return true
@@ -124,13 +126,14 @@ async function run_with_stdin(stdin_line: string): Promise<boolean> {
 
 // `true` when the hook is settled here — run, or nothing to push — so the push skips it; `false` when
 // this git cannot run it, so the push runs it as it always did. A hook that fails throws
-// `git hook exited with code <n>`, and the push is never attempted.
-async function run(): Promise<boolean> {
+// `git hook exited with code <n>`, and the push is never attempted. `environment` reaches the hook's process
+// only — added to the inherited environment, never written into this one.
+async function run(environment: HookEnvironment = {}): Promise<boolean> {
 	const references = await read_push_references()
 
 	if (references.local_oid === references.remote_oid) return true
 
-	return await run_with_stdin(to_stdin_line(references))
+	return await run_with_stdin(to_stdin_line(references), environment)
 }
 
 const git_pre_push_hook = {
@@ -138,3 +141,4 @@ const git_pre_push_hook = {
 }
 
 export { git_pre_push_hook }
+export type { HookEnvironment }

package/scripts/git/git-spawn.ts

@@ -112,9 +112,25 @@ async function with_output_remote(command: string, arguments_list: Array<string>
 //
 // `timeout_ms` defaults to a local command's budget. A command that runs hooks — a commit, a merge,
 // `git hook run` — is not one, and names the longer budget itself.
+//
+// `environment` is added to the inherited one for this one child — execa extends `process.env` with
+// it — so a caller hands a hook a setting without writing it into its own process.
 interface OutputOptions {
 	config_options?: ReadonlyArray<string>
 	timeout_ms?: number
+	environment?: Readonly<Record<string, string>>
+}
+
+interface OutputSpawnOptions {
+	stdio: 'inherit'
+	timeout: number
+	env: Readonly<Record<string, string>>
+}
+
+function to_output_spawn_options(options: OutputOptions): OutputSpawnOptions {
+	const { timeout_ms = GIT_TIMEOUT_MS, environment = {} } = options
+
+	return { stdio: 'inherit', timeout: timeout_ms, env: environment }
 }
 
 async function with_output(
@@ -122,17 +138,17 @@ async function with_output(
 	arguments_list: Array<string>,
 	options: OutputOptions = {},
 ): Promise<void> {
-	const { config_options = [], timeout_ms = GIT_TIMEOUT_MS } = options
 	const git_command_bin = git_utilities.get_git_command_for_spawn()
-	const spawn_arguments = [...config_options, command, ...arguments_list]
+	const spawn_arguments = [...(options.config_options ?? []), command, ...arguments_list]
+	const spawn_options = to_output_spawn_options(options)
 
 	try {
 		// execa runs the binary directly with an argument array and no `shell` option, so CLI
 		// args cannot break out of a shell sandbox; the git command and args are internally
 		// controlled, never untrusted input. tssecurity:S8705 is a false positive here.
-		await execa(git_command_bin, spawn_arguments, { stdio: 'inherit', timeout: timeout_ms }) // NOSONAR
+		await execa(git_command_bin, spawn_arguments, spawn_options) // NOSONAR
 	} catch (error) {
-		throw to_budget_error(command, error, timeout_ms)
+		throw to_budget_error(command, error, spawn_options.timeout)
 	}
 }
 

package/scripts/hooks/implementation-shell-deny-git.ts

@@ -57,8 +57,11 @@ const LIST_MODE =
 // List flags whose value is the next word, so the value is not read as a new ref's name.
 const LIST_VALUE_FLAGS: ReadonlySet<string> = new Set(['--sort', '--format'])
 const REFLOG_WRITES: ReadonlySet<string> = new Set(['expire', 'delete'])
-// A global that rewrites git's configuration or launcher, or an option that writes a file or runs one.
-const GIT_WRITE_FLAGS = /^-c$|^--(?:config-env|exec-path|output|ext-diff|textconv)/u
+// A global that rewrites git's configuration or launcher. Read only in front of the subcommand: after
+// it, `-c` is `git grep -c` (a count) or `git log -c` (a combined diff) (joshuafolkken/kit#7574).
+const GIT_GLOBAL_WRITE_FLAGS = /^-c|^--(?:config-env|exec-path)/u
+// An option that writes a file or runs a program, read wherever it stands.
+const GIT_OPTION_WRITE_FLAGS = /^--(?:output|ext-diff|textconv)/u
 const QUOTES = /['"\\]/gu
 
 function is_branch_change(argument: string): boolean {
@@ -115,8 +118,19 @@ function subcommand_refusal(segment: string): Refusal {
 	return is_git_write(subcommand, args) ? `\`git ${subcommand}\`, a git write` : undefined
 }
 
+// A quoted global runs as the bare one: `git '-c' k=v status` is `git -c k=v status`. The quotes come
+// off each word after the split, so a spaced value (`-C 'my dir'`) stays one word.
+function has_write_flag(args: ReadonlyArray<string>): boolean {
+	const globals = git_argv.globals_of(args.map((argument) => argument.replaceAll(QUOTES, '')))
+
+	return (
+		globals.some((word) => GIT_GLOBAL_WRITE_FLAGS.test(word)) ||
+		args.some((argument) => GIT_OPTION_WRITE_FLAGS.test(argument))
+	)
+}
+
 function refusal(segment: string, args: ReadonlyArray<string>): Refusal {
-	if (args.some((argument) => GIT_WRITE_FLAGS.test(argument))) {
+	if (has_write_flag(args)) {
 		return 'a git option that rewrites its configuration, runs a program or writes a file'
 	}
 

package/scripts/hooks/pre-push-related-switch.ts

@@ -1,7 +1,8 @@
 // **Switched on, a pre-push unit run the gate record does not cover runs the related tests rather than
 // the whole suite** — set by `josh ship`'s push ahead of the gate (`run-ship-sync.ts`), whose gate over
-// the same tree runs the whole suite next (joshuafolkken/kit#5067). Off by default. Its own module
-// because the hook is an entry with a main guard, which nothing may import.
+// the same tree runs the whole suite next (joshuafolkken/kit#5067), and by `josh release`'s push
+// (`release-publish.ts`), whose pull request CI runs it before the merge (joshuafolkken/kit#7539). Off
+// by default. Its own module because the hook is an entry with a main guard, which nothing may import.
 const SWITCH_ENV_KEY = 'JOSH_PRE_PUSH_RELATED'
 const SWITCH_ON = '1'
 

package/scripts/hooks/pre-push-unit.ts

@@ -153,7 +153,9 @@ async function run_reserved_suite(vitest_arguments: ReadonlyArray<string>): Prom
 // **A push its caller makes ahead of the gate runs the related tests, not the whole suite**
 // (joshuafolkken/kit#5067). `josh ship` pushes the tree its sync merged with the default branch onto an
 // open pull request so CI starts beside the gate, and the gate that follows runs the whole suite over
-// that same tree; the push itself only needs what this branch's change reaches. Only the caller sets
+// that same tree; the push itself only needs what this branch's change reaches. `josh release` pushes
+// its release commit from a fresh worktree no gate record covers, and the release pull request's CI
+// runs the whole suite over it before the merge (joshuafolkken/kit#7539). Only the caller sets
 // it, `--force` and the escape hatch still win, and a narrowed run asked for its own arguments rather
 // than this scope.
 function is_related_requested(extra_arguments: ReadonlyArray<string>): boolean {

package/scripts/issue/effect-audit.ts

@@ -130,8 +130,15 @@ function draft_title(row: AuditRow): string {
 	return `Retire or shrink the mechanism of ${cite(row.origin)}, which fell short of its expected effect`
 }
 
+// The plain-language summary `issue:file` requires first, then the background.
 function background_lines(origin: string, measurements: string): ReadonlyArray<string> {
 	return [
+		issue_body_keys.heading('summary'),
+		'',
+		`**${origin} で足した仕組みが、期待した効果を出せていないという改善要望です。**`,
+		'',
+		`後から計測したところ、${origin} の仕組みは見込んだ効果に届きませんでした。効かない仕組みは実行時間や読む量、保守の手間を増やすだけなので、取り除くか、効く範囲に絞ります。`,
+		'',
 		issue_body_keys.heading('background'),
 		'',
 		issue_body_keys.line('kind', 'non_bug'),

package/scripts/issue/issue-body-cli.ts

@@ -2,6 +2,8 @@ import { fileURLToPath } from 'node:url'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_lint_cli } from '#scripts/issue/issue-lint-cli'
 import { issue_number_shape } from '#scripts/issue/issue-number-shape'
+import { issue_publication_state } from '#scripts/issue/issue-publication-state'
+import { session_cite } from '#scripts/issue/session-cite'
 import { size_estimate } from '#scripts/issue/size-estimate'
 import { cli_body } from '#scripts/josh/cli-body'
 import { cli_flags } from '#scripts/lib/cli-flags'
@@ -11,7 +13,7 @@ import { error_text } from '#scripts/lib/error-message'
 // passes `issue:lint`. `issue:plan` writes only a blank body, and a consultation session's hook refuses
 // every non-GET `gh api`, so a body rewrite had no route a session could run (joshuafolkken/kit#7002).
 // An epic body (`## Split rationale`) is not an issue-template body, so `issue:lint` does not judge it;
-// `epic:check` does.
+// `epic:check` does. An unpublished split child's publication record is carried over (#7571).
 const BODY_FILE_FLAG = '--body-file'
 const USAGE = `Usage: josh issue:body <issue-number> ${BODY_FILE_FLAG} <path>`
 const OPTIONS = { 'body-file': { type: 'string' } } as const
@@ -37,6 +39,18 @@ function request_of(argv: ReadonlyArray<string>): BodyRequest {
 	return { issue, body_path }
 }
 
+// A failed read is refused, not taken for a body with no publication record: writing over it could
+// drop an unpublished child's record.
+async function current_body(issue: string): Promise<string | undefined> {
+	const read = await git_gh_command.issue_get_body_classified(issue)
+
+	if (read.kind !== 'read') {
+		throw new Error(`Cannot read the current body of ${session_cite.issue(issue)}: ${read.kind}`)
+	}
+
+	return read.text
+}
+
 async function apply(request: BodyRequest): Promise<number> {
 	const body = cli_body.read_file_or_stdin(request.body_path)
 	const problems = size_estimate.is_epic(body) ? [] : issue_lint_cli.problems(body)
@@ -49,7 +63,9 @@ async function apply(request: BodyRequest): Promise<number> {
 		return FAILURE
 	}
 
-	console.info(await git_gh_command.issue_edit_body(request.issue, body))
+	const next = issue_publication_state.carried(await current_body(request.issue), body)
+
+	console.info(await git_gh_command.issue_edit_body(request.issue, next))
 
 	return SUCCESS
 }

package/scripts/issue/issue-body-keys.ts

@@ -67,6 +67,7 @@ const VALUES = {
 } as const satisfies Record<string, Row>
 
 const HEADINGS = {
+	summary: { ja: '概要', en: 'Summary' },
 	background: { ja: '背景', en: 'Background' },
 	symptom: { ja: '現象', en: 'Symptom' },
 	expected: { ja: '期待結果', en: 'Expected result' },

package/scripts/issue/issue-file-pass.ts

@@ -65,6 +65,7 @@ function refusals_of(
 	growth: SizeRatios,
 ): ReadonlyArray<string> {
 	const problems = [
+		issue_lint_cli.summary_problem(filing.body),
 		...issue_lint_cli.problems(filing.body, issue_file.labels_of(filing.args, filing.body)),
 		size_estimate.guide_problem(filing.body, filing.args.route, rate, growth),
 		issue_sample_required.problem(filing.body),

package/scripts/issue/issue-lint-cli.ts

@@ -62,6 +62,18 @@ function problems(body: string, labels?: ReadonlyArray<string>): ReadonlyArray<s
 		.map((problem) => with_template(problem))
 }
 
+// `issue:file`'s refusal of a body that does not open with the summary, followed by the template's
+// summary section; `undefined` when it does. Only filing checks it: `problems` also lints the bodies
+// `issue:body` rewrites, and Issues filed before the rule have none.
+function summary_problem(body: string): string | undefined {
+	if (issue_lint.starts_with_summary(body)) return undefined
+	const heading = issue_lint.summary_heading()
+	const problem = `the body must start with ${heading}: a plain-language summary for a person deciding on the Issue — how to write it: the ${heading} section of ${issue_template_section.document_name()}'s template`
+	const template = issue_template_section.section(heading)
+
+	return template === undefined ? problem : `${problem}\n${template}`
+}
+
 // The body's warnings, printed by every command that lints a body whichever way its verdict goes; they
 // never change an exit code.
 function warn(body: string): void {
@@ -91,10 +103,12 @@ async function run(body_path: string | undefined): Promise<number> {
 	}
 
 	const body = cli_body.read_file_or_stdin(body_path)
+	const summary = summary_problem(body)
 
-	return report(problems(body), body)
+	// A pre-filing check: it answers as `issue:file` will, the leading summary included.
+	return report(summary === undefined ? problems(body) : [summary, ...problems(body)], body)
 }
 
-const issue_lint_cli = { problems, run, warn }
+const issue_lint_cli = { problems, run, summary_problem, warn }
 
 export { issue_lint_cli }

package/scripts/issue/issue-lint.ts

@@ -16,9 +16,25 @@ function missing_headings(body: string): ReadonlyArray<string> {
 	return REQUIRED_HEADINGS.filter((heading) => !markdown_section.has_line(body, heading))
 }
 
+// The plain-language summary a person reads before any internal detail (joshuafolkken/kit#7544), in the
+// session's column — read per call, as the canonical lines it is compared with are.
+function summary_heading(): string {
+	return issue_body_keys.heading('summary')
+}
+
+// Whether the body's first non-blank line is the summary heading — present further down does not count.
+// Read canonically, so the other language's heading counts as every other heading check does.
+function starts_with_summary(body: string): boolean {
+	const first = markdown_section.canonical_lines(body).find((line) => line.trim() !== '')
+
+	return first?.trim() === summary_heading()
+}
+
 const issue_lint = {
 	missing_headings,
 	REQUIRED_HEADINGS,
+	starts_with_summary,
+	summary_heading,
 }
 
 export { issue_lint }

package/scripts/issue/issue-publication-state.ts

@@ -3,12 +3,69 @@ import { issue_auto_ok } from './issue-auto-ok'
 import { AUTO_OK_LABEL, has_label_name } from './issue-labels'
 
 // A body record survives process termination without adding a workflow label or a user prohibition.
+// The record is an HTML comment starting its own line outside a fence: the prefix quoted inline or in
+// a code block is prose about the record, not one; `prepare` appends it, so the last one is the record
+// (joshuafolkken/kit#7573).
 const PREFIX = '<!-- josh:publication '
-const PATTERN = /<!-- josh:publication (?<record>[^\n]*?) -->/u
+const RECORDS = /^<!-- josh:publication (?<record>[^\n]*?) -->/gmu
+const RECORD_LINE = /^<!-- josh:publication /mu
+const FENCE_LINE = /^ {0,3}(?<marker>`{3,}|~{3,})/u
 const schema = z.object({ labels: z.array(z.string()) })
 
-function is_pending(body: string | undefined): boolean {
-	return body?.includes(PREFIX) === true
+interface Fence {
+	marker: string
+	lines: Array<string>
+}
+
+interface FenceScan {
+	kept: Array<string>
+	fence: Fence | undefined
+}
+
+function fence_marker(line: string): string | undefined {
+	return FENCE_LINE.exec(line)?.groups?.['marker']
+}
+
+// A fence closes only on a bare marker of its own character, at least as long as the opener.
+function is_close(fence: Fence, line: string): boolean {
+	const marker = fence_marker(line) ?? ''
+	const is_same = marker.startsWith(fence.marker.charAt(0))
+
+	return is_same && marker.length >= fence.marker.length && line.trim() === marker
+}
+
+function continued(fence: Fence, line: string): Fence | undefined {
+	if (is_close(fence, line)) return undefined
+	fence.lines.push(line)
+
+	return fence
+}
+
+function opened(kept: Array<string>, line: string): Fence | undefined {
+	const marker = fence_marker(line)
+	if (marker === undefined) kept.push(line)
+
+	return marker === undefined ? undefined : { marker, lines: [line] }
+}
+
+function scan_line({ kept, fence }: FenceScan, line: string): FenceScan {
+	return { kept, fence: fence === undefined ? opened(kept, line) : continued(fence, line) }
+}
+
+// An unclosed fence is kept: dropping it would hide the record `prepare` appends after it.
+function unfenced(body: string): string {
+	let scan: FenceScan = { kept: [], fence: undefined }
+	for (const line of body.split('\n')) scan = scan_line(scan, line)
+
+	return [...scan.kept, ...(scan.fence?.lines ?? [])].join('\n')
+}
+
+function is_pending(body = ''): boolean {
+	return RECORD_LINE.test(unfenced(body))
+}
+
+function last_record(body: string): RegExpExecArray | undefined {
+	return [...unfenced(body).matchAll(RECORDS)].at(-1)
 }
 
 function prepare(body: string, labels: ReadonlyArray<string>): string {
@@ -17,12 +74,24 @@ function prepare(body: string, labels: ReadonlyArray<string>): string {
 	return `${body}\n\n${PREFIX}${JSON.stringify({ labels })} -->\n`
 }
 
+// A body rewrite keeps a pending child's record unless the new body brings its own: without it,
+// `--publish` would publish the child with none of its intended labels (joshuafolkken/kit#7571).
+function carried(previous: string | undefined, next: string): string {
+	const record = last_record(previous ?? '')?.[0]
+	if (record === undefined || is_pending(next)) return next
+
+	return `${next.trimEnd()}\n\n${record}\n`
+}
+
 function public_body(body: string): string {
-	return body.replace(PATTERN, '').trimEnd()
+	const record = last_record(body)?.[0] ?? ''
+	const at = body.lastIndexOf(record)
+
+	return `${body.slice(0, at)}${body.slice(at + record.length)}`.trimEnd()
 }
 
 function intended_labels(body = ''): ReadonlyArray<string> {
-	const record = PATTERN.exec(body)?.groups?.['record']
+	const record = last_record(body)?.groups?.['record']
 
 	return schema.parse(JSON.parse(record ?? 'null')).labels
 }
@@ -56,6 +125,13 @@ function creation(
 	}
 }
 
-const issue_publication_state = { is_pending, prepare, public_body, labels_of, creation }
+const issue_publication_state = {
+	is_pending,
+	prepare,
+	carried,
+	public_body,
+	labels_of,
+	creation,
+}
 
 export { issue_publication_state }