@plot-pm/board 0.15.0 → 0.16.1

package/plot-host.sh

@@ -391,6 +391,15 @@ set -uo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# Every temp path this script creates, and its only EXIT/INT/TERM traps.
+. "$here/plot-tmp.sh"
+
+# The host CLI's stderr for one call, read back after the call. One file per
+# process, created here in the parent because the calls redirect into it from
+# inside command substitutions, where an assignment would not reach the caller.
+HOST_ERR=""
+plot_tmpfile HOST_ERR host-err || { echo "plot-host: no temp file could be made under ${TMPDIR:-/tmp}" >&2; exit 3; }
+
 die() { echo "plot-host: $*" >&2; exit 1; }
 
 # Exit 3 — reserved for "the op itself cannot proceed", distinct from `die`'s
@@ -575,7 +584,9 @@ pr_list_failed() { # $1=stderr text
 # hundred lines below, where a `die` in a subshell turned an unknown state into
 # "no PRs matched".
 pr_list_call() { # "$@"=the host command → payload on stdout, or dies
-  local out rc err tmp="/tmp/plot-host-prlist-err.$$"
+  local out rc err tmp=""
+  plot_tmpfile tmp host-prlist-err \
+    || { echo "plot-host: no temp file could be made under ${TMPDIR:-/tmp}" >&2; exit 3; }
   out="$("$@" 2>"$tmp")"; rc=$?
   err="$(cat "$tmp" 2>/dev/null)"; rm -f "$tmp"
   [ "$rc" -eq 0 ] || pr_list_failed "$err"
@@ -858,7 +869,7 @@ bb_branch_sweep() { # global bb args… --state <s> --json → one JSON array
   # already seen once per branch, so eleven branches parsed the first branch's
   # payload eleven times.
   local _spool
-  _spool="$(mktemp "/tmp/plot-host-sweep.$$.XXXXXX")" || return 3
+  plot_tmpfile _spool host-sweep || return 3
   for _br in $PR_LIST_BRANCHES; do
     # RETURN, NOT EXIT. This runs inside the command substitution
     # `pr_list_call` wraps the sweep in, so the code must travel back as this
@@ -867,7 +878,7 @@ bb_branch_sweep() { # global bb args… --state <s> --json → one JSON array
     # as the sweep's own — the silent empty list `pr_list_call`'s header names.
     #
     # The spool is removed on EVERY exit path, including the failing one: a
-    # sweep that gives up mid-way must not leave a payload behind in /tmp.
+    # sweep that gives up mid-way must not leave a payload behind in TMPDIR.
     bb_branch_query "$_br" "$_st" ${_args[@]+"${_args[@]}"} >> "$_spool" \
       || { _rc=$?; rm -f "$_spool"; return $_rc; }
   done
@@ -880,6 +891,135 @@ bb_branch_sweep() { # global bb args… --state <s> --json → one JSON array
   printf '%s' "$_acc"
 }
 
+# List every pull request in ONE state updated inside the window, as one array.
+#
+# THE WINDOWED LISTING, and the third command in `pr_list_states`' slot beside
+# `bb pr list` and `bb_branch_sweep`. It takes the same trailing
+# `--state <s> --json` and prints the same JSON array, so the states loop, the
+# partial-answer rule and the one error classification stay in that helper.
+#
+# THE QUERY IS `bb_branch_query`'s WITHOUT THE BRANCH CLAUSE:
+#
+#   /repositories/{ws}/{repo}/pullrequests
+#     ?q=state="MERGED" AND updated_on>="<since>"&pagelen=50
+#
+# Measured 2026-09-28 on `quatico/quaweb-website`: `size: 9` in one request,
+# against 895 rows for the unwindowed listing of the same state.
+#
+# THE STATE TRAVELS INSIDE `q=`, NEVER BESIDE IT. Bitbucket lets `q=` silently
+# override a `state=` parameter, so `?q=…&state=MERGED` answers for whatever the
+# `q=` says and discards the state. `bb_query_state` maps the adapter's word to
+# Bitbucket's inside the expression.
+#
+# EVERY PAGE IS READ. `bb api` makes ONE request and returns ONE raw page, so a
+# window holding more than 50 matches arrives in several. The payload's `next`
+# names the following page as an absolute URL, and `bb api` prefixes its own
+# base, so the base is removed before the call. The walk ends when `next` is
+# absent.
+#
+# A SHORT WINDOW IS REFUSED, NEVER PRINTED AS WHOLE. `size` is the server's
+# count of matches. When the distinct rows read fall short of it, or a `next`
+# names a URL outside the API base, this prints nothing and exits 3. The board
+# advances its watermark over what a window returns, so a short window printed
+# as whole loses the missing rows until the next full read.
+#
+# THE HOST'S FAILURE TEXT AND EXIT CODE LEAVE UNTOUCHED, as in
+# `bb_branch_query`: `pr_list_call` classifies once, so a `429` still reads as
+# a rate limit.
+BB_API_BASE="https://api.bitbucket.org/2.0"
+bb_window_listing() { # global bb args… --state <s> --json → one JSON array
+  local _st="" _args=() _q _path _page _size=0 _next _pages=0 _rows _spool _rc
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --state) _st="${2:?}"; shift 2 ;;
+      --json)  shift ;;
+      *) _args+=("$1"); shift ;;
+    esac
+  done
+  [ -n "$_st" ] || die "bb_window_listing: no --state"
+  [ -n "$PR_LIST_SINCE" ] || die "bb_window_listing: no window"
+  _q="state=$(url_encode "\"$(bb_query_state "$_st")\"") AND updated_on>=$(url_encode "\"$PR_LIST_SINCE\"")"
+  _q="${_q// /%20}"
+  _path="/repositories/{ws}/{repo}/pullrequests?q=${_q}&pagelen=50"
+  plot_tmpfile _spool host-window || return 3
+  while [ -n "$_path" ]; do
+    _page="$(bb ${_args[@]+"${_args[@]}"} api "$_path")" \
+      || { _rc=$?; rm -f "$_spool"; return $_rc; }
+    _pages=$((_pages + 1))
+    printf '%s\n' "$_page" | jq -c '.values // []' >> "$_spool" \
+      || { rm -f "$_spool"; return 3; }
+    _size="$(printf '%s' "$_page" | jq -r '.size // 0')" || { rm -f "$_spool"; return 3; }
+    _next="$(printf '%s' "$_page" | jq -r '.next // empty')" || { rm -f "$_spool"; return 3; }
+    _path=""
+    if [ -n "$_next" ]; then
+      case "$_next" in
+        "$BB_API_BASE"/*) _path="${_next#"$BB_API_BASE"}" ;;
+        *)
+          rm -f "$_spool"
+          echo "bitbucket window state=$_st: next page '$_next' is outside $BB_API_BASE; refusing a window it cannot read to the end" >&2
+          return 3
+          ;;
+      esac
+    fi
+  done
+  # Distinct by id: a pull request updated while the walk runs can move between
+  # pages and arrive twice.
+  _rows="$(jq -c -s 'add // [] | unique_by(.id)' < "$_spool")" || { rm -f "$_spool"; return 3; }
+  rm -f "$_spool"
+  local _got
+  _got="$(jq 'length' <<<"$_rows")" || return 3
+  if [ "$_got" -lt "$_size" ] 2>/dev/null; then
+    echo "bitbucket window state=$_st is short ($_got of $_size matches after $_pages pages); refusing it rather than printing it as whole" >&2
+    return 3
+  fi
+  printf '%s' "$_rows"
+}
+
+# List the pull requests in ONE state, one page of 50, as one array.
+#
+# THE PLAIN LISTING, and the fourth command in `pr_list_states`' slot. It takes
+# the same trailing `--state <s> --json` as `bb_branch_sweep` and
+# `bb_window_listing` and prints the same JSON array, so the states loop, the
+# truncation report and the partial-answer rule stay in that helper.
+#
+#   /repositories/{ws}/{repo}/pullrequests?state=MERGED&pagelen=50
+#
+# ONE REQUEST PER STATE, WHERE `bb pr list` SPENDS UP TO FIVE. `bb pr list`
+# sends no `pagelen`, Bitbucket answers 10 rows a page, and `bb_paginate` walks
+# pages until it holds 50. Asking `pagelen=50` returns the same 50 rows in one
+# request. Measured 2026-09-30 on `quatico/quaweb-website` with bb 1.9.0: the
+# three states cost 8 requests through `bb pr list` (open 1, merged 5,
+# declined 2) and 3 through this path, and both return the same 67 rows
+# (3 open, 50 merged, 14 declined).
+#
+# THE STATES STAY SEPARATE CALLS. One `state=` union over the three returns the
+# 50 most recently updated rows across all of them: measured on the same
+# repository, 50 of 67 rows, 12 of 14 declined PRs lost, and an open PR survives
+# only if it was updated recently. That is the 2026-08-18 failure
+# `bb_states_for` records, reached through the page cap instead of through a
+# flag.
+#
+# ONE PAGE, AS BEFORE. 50 is the endpoint's `pagelen` ceiling and the limit
+# `bb_paginate` applied, so a state holding more than 50 rows answers with its
+# 50 most recent here too, and `pr_list_report_truncation` still says so.
+#
+# THE HOST'S FAILURE TEXT AND EXIT CODE LEAVE UNTOUCHED, as in
+# `bb_branch_query`: `pr_list_call` classifies once, so a `429` still reads as
+# a rate limit.
+bb_state_listing() { # global bb args… --state <s> --json → one JSON array
+  local _st="" _args=() _out
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --state) _st="${2:?}"; shift 2 ;;
+      --json)  shift ;;
+      *) _args+=("$1"); shift ;;
+    esac
+  done
+  [ -n "$_st" ] || die "bb_state_listing: no --state"
+  _out="$(bb ${_args[@]+"${_args[@]}"} api "/repositories/{ws}/{repo}/pullrequests?state=$(bb_query_state "$_st")&pagelen=50")" || return $?
+  printf '%s' "$_out" | jq -c '.values // []'
+}
+
 # The branches a sweep asks about, newline-or-space separated. Empty means the
 # caller named none, and the arm keeps the bulk listing it has always used.
 #
@@ -894,13 +1034,13 @@ bb_branch_sweep() { # global bb args… --state <s> --json → one JSON array
 # separator is git's guarantee rather than a hopeful convention.
 PR_LIST_BRANCHES=""
 
-# The window a sweep's query carries, the host's own stamp. Empty means ask
+# The window a Bitbucket query carries, the host's own stamp. Empty means ask
 # about everything, which is what every caller predating `--since` asks.
 #
 # A GLOBAL FOR `PR_LIST_BRANCHES`' REASON, and it travels the same route: the
 # `pr-list` arm sets it immediately before the call, `bb_branch_sweep` passes
-# through without reading it, and `bb_branch_query` composes it into the one
-# `q=` Bitbucket takes. Threading it through the sweep as an argument would mean
+# through without reading it, and `bb_branch_query` and `bb_window_listing`
+# compose it into the one `q=` Bitbucket takes. Threading it through the sweep as an argument would mean
 # teaching that function a parameter it only forwards, and its header already
 # refuses the mirror of that — "teaching `pr_list_states` which of its commands
 # is a sweep would put a backend's shape inside the one piece of this file that
@@ -964,7 +1104,7 @@ pr_list_states() { # $1=backend $2=limit $3=states $4=jq-program; rest=the host
   local backend="$1" limit="$2" states="$3" jq_prog="$4"; shift 4
   local _s _raw _rc _err _tmp _ok=0 _failed=0 _first_rc=0 _failed_states=""
   for _s in $states; do
-    _tmp="/tmp/plot-host-prlist-state-err.$$.$_s"
+    plot_tmpfile _tmp "host-prlist-state-err-$_s" || return 3
     # THE SUBSHELL'S CODE IS THE ONLY CHANNEL OUT, so it is captured rather
     # than propagated. `pr_list_failed` runs INSIDE the substitution and has
     # already composed its report and its repair line; that text is spooled
@@ -1000,7 +1140,13 @@ pr_list_states() { # $1=backend $2=limit $3=states $4=jq-program; rest=the host
     # THE DETECTOR ITSELF IS UNTOUCHED and still fires exactly as it did on
     # every listing call — `host.test.mjs:3060` passes unedited. What changed is
     # that a path exists whose premise it was never written about.
-    [ -n "$PR_LIST_BRANCHES" ] || pr_list_report_truncation "$backend" "$limit" "$_s" \
+    #
+    # A WINDOWED LISTING MAKES NO PAGE CLAIM EITHER. `bb_window_listing` reads
+    # every page and refuses a window whose rows fall short of the server's
+    # `size`, so an answer that reaches this line is whole. Only Bitbucket sets
+    # `PR_LIST_SINCE`; the GitHub arm carries its window as `--search`.
+    [ -n "$PR_LIST_BRANCHES" ] || [ -n "$PR_LIST_SINCE" ] \
+      || pr_list_report_truncation "$backend" "$limit" "$_s" \
       "$(jq 'length' <<<"$_raw" 2>/dev/null || echo 0)"
     printf '%s' "$_raw" | jq -c ${PR_LIST_JQ_ARGS[@]+"${PR_LIST_JQ_ARGS[@]}"} "$jq_prog"
   done
@@ -1804,6 +1950,13 @@ rest_pr_to_state() {
 # `bb` fix, and the three states partition the set (74 PRs, 74 unique ids,
 # 0 duplicates on the repo measured).
 #
+# bb 1.9.0 honours repeated `--state` and sends one union request, and the
+# states still stay separate. The union returns the 50 most recently updated
+# rows across all three states: measured 2026-09-29 on
+# `quatico/quaweb-website`, 50 of 67 rows, 12 of 14 declined PRs lost. The cost
+# is cut per state instead, by `bb_state_listing`'s `pagelen=50`: 8 requests
+# become 3 there, with all 67 rows kept.
+#
 # `superseded` is deliberately NOT part of `all`: such a PR is replaced by a
 # newer one for the same branch, and a board with one row per branch would
 # show that branch twice. `gh`'s `all` has no equivalent, so nothing is lost.
@@ -2558,11 +2711,11 @@ backend() {
 # `budget_rate`. A directory keyed on a pid must be removed by the process that
 # made it, or a long-lived machine accumulates one per `plot-host.sh` call.
 #
-# `EXIT` ALONE, deliberately. It runs on a normal return and on an uncaught
-# signal's default termination path is irrelevant here: the sweep is an
-# optimisation's housekeeping, and a cache that outlives one run costs a stale
-# reading at worst, which is the same staleness the memo grants by design.
-trap 'budget_memo_clear' EXIT
+# Registered with `plot-tmp.sh`, which owns this process's EXIT, INT and TERM
+# traps: a second `trap … EXIT` here would replace the helper's and leak every
+# temp path above. A memo that outlives a SIGKILL costs a stale reading at
+# worst, and `plot-reap.sh --sweep-temp` removes a dead pid's directory.
+plot_on_exit budget_memo_clear
 
 # WHO IS SPENDING — read from the CLI's own config, never from an API call.
 #
@@ -2785,13 +2938,13 @@ plot_harvest_headers() {
 # read may not charge.
 gh_api_harvest() {
   local raw rc hdr_tmp err_tmp
-  hdr_tmp="$(mktemp "${TMPDIR:-/tmp}/plot-host-hdr.XXXXXX")" || {
+  plot_tmpfile hdr_tmp host-hdr || {
     # No temp file, no harvest — and the call still happens, recorded by the
     # wrapper from its argv alone. Bookkeeping never fails its caller.
     gh api "$@"
     return $?
   }
-  err_tmp="$(mktemp "${TMPDIR:-/tmp}/plot-host-herr.XXXXXX")" || {
+  plot_tmpfile err_tmp host-herr || {
     rm -f "$hdr_tmp"
     gh api "$@"
     return $?
@@ -3104,11 +3257,11 @@ case "$op" in
         # place that knows how to read either.
         rest_repo="$(gh_rest_repo)" || exit $?
         if [[ "$ref" =~ ^[0-9]+$ ]]; then
-          if out="$(gh_api_harvest "repos/$rest_repo/pulls/$ref" 2>/tmp/plot-host-err.$$)"; then
-            rm -f "/tmp/plot-host-err.$$"
+          if out="$(gh_api_harvest "repos/$rest_repo/pulls/$ref" 2>"$HOST_ERR")"; then
+            rm -f "$HOST_ERR"
             rest_pr_to_state <<<"$out"
           else
-            err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+            err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
             host_miss_or_fail "$err" \
               '{"number":0,"state":"NONE","draft":false,"url":"","mergeCommit":""}' || exit $?
           fi
@@ -3121,15 +3274,15 @@ case "$op" in
           # `state=all`, because the default is `open` and a merged PR would
           # otherwise read as NONE — wrong in the reassuring direction.
           rest_owner="${rest_repo%%/*}"
-          if out="$(gh_api_harvest "repos/$rest_repo/pulls?head=$rest_owner:$ref&state=all&per_page=1" 2>/tmp/plot-host-err.$$)"; then
-            rm -f "/tmp/plot-host-err.$$"
+          if out="$(gh_api_harvest "repos/$rest_repo/pulls?head=$rest_owner:$ref&state=all&per_page=1" 2>"$HOST_ERR")"; then
+            rm -f "$HOST_ERR"
             if [ "$(jq -r 'length' <<<"$out" 2>/dev/null)" = "0" ]; then
               echo '{"number":0,"state":"NONE","draft":false,"url":"","mergeCommit":""}'
             else
               jq -c '.[0]' <<<"$out" | rest_pr_to_state
             fi
           else
-            err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+            err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
             host_miss_or_fail "$err" \
               '{"number":0,"state":"NONE","draft":false,"url":"","mergeCommit":""}' || exit $?
           fi
@@ -3137,11 +3290,11 @@ case "$op" in
       # mergeCommit is what lets a caller ask "which release contains this?" —
       # `git tag --contains <sha>` answers exactly, where dates cannot. It is ""
       # for anything unmerged, which is the honest answer rather than a guess.
-      elif out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr view "$ref" --json number,state,isDraft,url,mergeCommit 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      elif out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr view "$ref" --json number,state,isDraft,url,mergeCommit 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         jq -c '{number:.number,state:.state,draft:.isDraft,url:.url,mergeCommit:(.mergeCommit.oid // "")}' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # REFUSED FOR RATE IS NOT ANSWERED. The budget gate above could not see
         # this coming — `rate_limit` does not report the secondary limit — so the
         # cheap path was chosen and then declined. The second path is the one
@@ -3174,11 +3327,11 @@ case "$op" in
       # the GitHub arm gives for anything unmerged, so a caller cannot tell the
       # backends apart.
       if [[ "$ref" =~ ^[0-9]+$ ]]; then
-        if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr view "$ref" --json 2>/tmp/plot-host-err.$$)"; then
-          rm -f "/tmp/plot-host-err.$$"
+        if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr view "$ref" --json 2>"$HOST_ERR")"; then
+          rm -f "$HOST_ERR"
           jq -c '{number:.id,state:(if .state=="DECLINED" then "CLOSED" else .state end),draft:(.draft // false),url:.links.html.href,mergeCommit:(.merge_commit.hash // "")}' <<<"$out"
         else
-          err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+          err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
           host_miss_or_fail "$err" '{"number":0,"state":"NONE","draft":false,"url":"","mergeCommit":""}' || exit $?
         fi
       else
@@ -3203,7 +3356,7 @@ case "$op" in
         out=""; bb_rc=0
         bb_all_states="$(bb_states_for all)" || exit 1
         for _s in $bb_all_states; do
-          if _part="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state "$_s" --json 2>/tmp/plot-host-err.$$)"; then
+          if _part="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state "$_s" --json 2>"$HOST_ERR")"; then
             out="$out$_part"
             # `jq -e` exits non-zero on null/false, so this asks "did this state
             # contain the branch?" without a second parse of the whole page.
@@ -3215,7 +3368,7 @@ case "$op" in
           fi
         done
         if [ "$bb_rc" = 0 ]; then
-          rm -f "/tmp/plot-host-err.$$"
+          rm -f "$HOST_ERR"
           out="$(jq -c -s 'add // []' <<<"$out")"
           # THE BRANCH ARM CARRIES `mergeCommit` TOO, and it is the path that
           # matters most: `plot-pr-state.sh:33` asks `pr-state "idea/${SLUG}"` —
@@ -3229,7 +3382,7 @@ case "$op" in
                | if .==null then {number:0,state:"NONE",draft:false,url:"",mergeCommit:""}
                  else {number:.id,state:(if .state=="DECLINED" then "CLOSED" else .state end),draft:(.draft // false),url:.links.html.href,mergeCommit:(.merge_commit.hash // "")} end' <<<"$out"
         else
-          err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+          err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
           host_miss_or_fail "$err" '{"number":0,"state":"NONE","draft":false,"url":"","mergeCommit":""}' || exit $?
         fi
       fi
@@ -3261,15 +3414,15 @@ case "$op" in
       # --state all, because a merged PR reports CLOSED and the default `open`
       # would hide every one of them. --limit 100 rather than 1: the newest PR
       # is not the merge, exactly as the state is not the merge.
-      if out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr list --head "$ref" --state all --limit 100 --json mergedAt 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr list --head "$ref" --state all --limit 100 --json mergedAt 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         if jq -e 'any(.[]; .mergedAt != null)' >/dev/null 2>&1 <<<"$out"; then
           echo "merged"
         else
           echo "not-merged"
         fi
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # A LOOKUP MISS IS AN ANSWER — the branch has no PR, so nothing merged.
         # Anything else is the host failing to be asked, and that is `unknown`
         # rather than exit 3: the caller asked a question with a third value
@@ -3288,15 +3441,15 @@ case "$op" in
       # exposes no `mergedAt`, so this is the closest fact the backend holds,
       # and it is a positive statement about the merge rather than an inference
       # from CLOSED — `DECLINED` is bb's closed-unmerged word and is distinct.
-      if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state merged --json 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state merged --json 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         if jq -e --arg b "$ref" 'any(.[]; .source.branch.name==$b)' >/dev/null 2>&1 <<<"$out"; then
           echo "merged"
         else
           echo "not-merged"
         fi
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         if [ -z "$err" ] || is_lookup_miss "$err"; then
           echo "not-merged"
         else
@@ -3336,15 +3489,15 @@ case "$op" in
       esac
     done
     if [ "$be" = "github" ]; then
-      if out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr list --head "$ref" --state all --limit 100 --json mergedAt,mergeCommit 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr list --head "$ref" --state all --limit 100 --json mergedAt,mergeCommit 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         # The FIRST merged PR carrying a sha. A branch may hold several merged
         # PRs; each names its own merge commit, and any of them is a commit that
         # landed this branch's work.
         jq -r 'map(select(.mergedAt != null and .mergeCommit != null))
                | map(.mergeCommit.oid) | first // empty' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # A lookup miss is an answer: no PR, so no merge commit. Anything else
         # is the question failing, and silence must not read as "carried
         # nothing" — the caller distinguishes the two by the exit code.
@@ -3358,12 +3511,12 @@ case "$op" in
     else
       bb_require_json
       # Bitbucket names the merge commit `merge_commit.hash` on a merged PR.
-      if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state merged --json 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state merged --json 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         jq -r --arg b "$ref" 'map(select(.source.branch.name==$b))
                | map(.merge_commit.hash // empty) | first // empty' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         if [ -z "$err" ] || is_lookup_miss "$err"; then
           :
         else
@@ -3712,16 +3865,17 @@ case "$op" in
       # integration GitHub uses, which is why it is ABOVE the backend branch.
       # Bitbucket's `unknown` becomes a real value.
       #
-      # `bb pr list` has no --limit: it returns a fixed page (50 at 1.0.0).
-      # Forwarding it errors with `unknown flag`, and dropping it silently
+      # The listing has no --limit: it returns one page of 50 per state
+      # (`bb_state_listing`). `bb pr list` refuses the flag with `unknown flag`,
+      # and the page size is the endpoint's ceiling. Dropping it silently
       # would serve a short page as if it were the whole set — the quiet wrong
       # answer this adapter refuses elsewhere. So it is dropped AND said.
       # A SWEEP IS NOT A PAGE AND OWES NO SUCH WARNING. `--limit` bounds a
       # listing; a per-branch query returns that branch's pull requests and
       # nothing was capped, so the notice would describe a truncation that did
       # not happen. Said only for the listing it is about.
-      if [ -n "$limit" ] && [ -z "$branches" ]; then
-        echo "plot-host: bitbucket ignores --limit $limit; bb returns a fixed page (50 at 1.0.0)" >&2
+      if [ -n "$limit" ] && [ -z "$branches" ] && [ -z "$since" ]; then
+        echo "plot-host: bitbucket ignores --limit $limit; the listing returns one page of 50 per state" >&2
       fi
       # Establish that bb supports --json BEFORE calling it — Done-when 5.
       bb_require_json
@@ -3738,25 +3892,23 @@ case "$op" in
       # ways, which is how the six hand-applied fixes `pr_list_call` warns about
       # began. One assignment here; the sites are untouched but for this word.
       PR_LIST_BRANCHES="$branches"
-      # THE WINDOW REACHES THE SWEEP AND NOT THE LISTING, and the asymmetry is
-      # the CLI's rather than a choice. `bb pr list` takes `--state`, `--author`,
-      # `--json` and `--jq` and no query flag at all — verified against bb 1.9.0,
-      # which answers `unknown flag: --query` — so the only Bitbucket path that
-      # can carry `updated_on` is `bb_branch_query`'s own REST `q=`.
+      # THE WINDOW REACHES EVERY BITBUCKET PATH THROUGH `q=`. `bb pr list` takes
+      # no query flag (bb 1.9.0 answers `unknown flag: --query`), so a windowed
+      # LISTING goes through `bb_window_listing`, and a windowed SWEEP through
+      # `bb_branch_query`. Both put `updated_on>=` in the one `q=` Bitbucket
+      # takes, beside the state clause.
       #
-      # SAID RATHER THAN SWALLOWED, for the reason `--limit` two blocks up is
-      # said: a caller that asked for a window and got a full listing must not
-      # read the answer as a delta. It would advance its watermark over a window
-      # it never applied — harmless this pass, since a full listing holds every
-      # row a narrow one would, and wrong the moment the caller uses the flag to
-      # decide whether its answer was complete.
+      # THE REPORT STAYS FOR A PATH THAT CANNOT NARROW. Every path above
+      # narrows today, so `ignores --since` prints nowhere. A path added later
+      # that cannot carry the window clears `PR_LIST_SINCE` and says so: a
+      # caller that asked for a window and got a full listing must not read the
+      # answer as a delta.
       PR_LIST_SINCE="$since"
-      if [ -n "$since" ] && [ -z "$branches" ]; then
-        echo "plot-host: bitbucket ignores --since $since on a listing; bb pr list has no query flag (bb 1.9.0) — answering in full" >&2
-        PR_LIST_SINCE=""
-      fi
       PR_SWEEP_ASKED=0
-      bb_cmd=(bb ${repo_args[@]+"${repo_args[@]}"} pr list)
+      # THE PLAIN LISTING IS `bb_state_listing`, one request per state at
+      # `pagelen=50`, where `bb pr list` walks 10-row pages. Its header has the
+      # measurement.
+      bb_cmd=(bb_state_listing ${repo_args[@]+"${repo_args[@]}"})
       if [ -n "$branches" ]; then
         # A SWEEP'S COST IS THE CALLER'S WORKING SET, and it is reported so the
         # caller can check the claim it is about to be handed. Branches × states
@@ -3764,6 +3916,8 @@ case "$op" in
         # that answer for 50 of 902 rows.
         for _b in $branches; do PR_SWEEP_ASKED=$((PR_SWEEP_ASKED + 1)); done
         bb_cmd=(bb_branch_sweep ${repo_args[@]+"${repo_args[@]}"})
+      elif [ -n "$PR_LIST_SINCE" ]; then
+        bb_cmd=(bb_window_listing ${repo_args[@]+"${repo_args[@]}"})
       fi
       if [ "$rich" = 1 ]; then
         if [ "$ci" = "jenkins" ]; then
@@ -4194,13 +4348,13 @@ case "$op" in
       # unstarted by the only vocabulary GitHub has.
       gh_state="open"
       if out="$(gh issue list --state "$gh_state" ${limit_args[@]+"${limit_args[@]}"} \
-                  --json number,title,url,createdAt 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+                  --json number,title,url,createdAt 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         jq -c --arg status "$gh_state" \
           '.[] | {number:.number,title:.title,url:(.url // ""),createdAt:(.createdAt // ""),
                   status:$status,statusCategory:(if $status == "open" then "To Do" else "Done" end)}' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # NO empty-list fallback. `host_miss_or_fail` exists for a lookup whose
         # subject is absent — one PR that does not exist. A LIST has no absent
         # subject: if the call failed, the answer is unknown, and printing
@@ -4314,11 +4468,11 @@ case "$op" in
           url: ($base + "/browse/" + .key)
         }'
     elif [ "$be" = "github" ]; then
-      if out="$(gh issue view "$num" --json number,title,body,url 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(gh issue view "$num" --json number,title,body,url 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         jq -c '{number:.number,title:(.title // ""),body:(.body // ""),url:(.url // "")}' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # NO miss/fail split here, and that is deliberate. `host_miss_or_fail`
         # exists where an absent subject is a NORMAL answer — a branch with no
         # PR. An issue number reaching this op was read off `issue-list`
@@ -4466,8 +4620,8 @@ case "$op" in
     # This op REPORTS; it does not decide. A caller that wants to fall back when
     # one budget is spent reads this, compares remaining to zero, and acts.
     if [ "$be" = "github" ]; then
-      if out="$(gh api rate_limit 2>/tmp/plot-host-err.$$)"; then
-        rm -f "/tmp/plot-host-err.$$"
+      if out="$(gh api rate_limit 2>"$HOST_ERR")"; then
+        rm -f "$HOST_ERR"
         # The payload has `resources.graphql` and `resources.core`, each with
         # `remaining`, `limit`, and `reset`. Extract the two we care about.
         jq -c '{
@@ -4483,7 +4637,7 @@ case "$op" in
           }
         }' <<<"$out"
       else
-        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        err="$(cat "$HOST_ERR" 2>/dev/null)"; rm -f "$HOST_ERR"
         # The host could not be asked. Report unknown rather than failing outright,
         # because this is informational — a caller that cannot read the budget
         # should proceed with the default path, not error out.
@@ -4546,7 +4700,8 @@ case "$op" in
     # inventing a reading nobody took — the mistake `rate_limit` makes by
     # answering for both at once.
     if [ "$be" = "github" ]; then
-      _hdr_tmp="/tmp/plot-host-limit.$$"
+      _hdr_tmp=""
+      plot_tmpfile _hdr_tmp host-limit || die3 "limit: no temp file could be made under ${TMPDIR:-/tmp}"
       # `command gh`, NOT THE WRAPPER, and for the ordering reason
       # `gh_api_harvest` gives: the wrapper records the moment the call returns,
       # before any header has been read, so a wrapped call here would file an