@rightkit/release 0.6.10 → 0.6.11

package/crate-workspaces.mjs

@@ -0,0 +1,87 @@
+// One Cargo workspace and lock per RightKit crate (Adrian, 2026-10-29: "I want you to have 1 cargo dot lock per component";
+// rightkit#1285). Every `crates/<x>` is its own workspace; crates that use each other link by path dependency across
+// workspaces. This module reads manifests only (no cargo) and answers which crates exist, which sibling crates each one
+// path-depends on, and which crates a change reaches: the changed crate plus every crate that path-depends on it, transitively.
+// It imports nothing outside node: CI's plan job runs it before any package install, so it reads the few manifest keys it needs
+// (the package name and dependency `path` values) line by line instead of through a TOML library.
+import fs from "node:fs";
+import path from "node:path";
+
+const posix = (p) => p.split(path.sep).join("/");
+const defaults = { readFile: (f) => fs.readFileSync(f, "utf8"), readdir: (d) => fs.readdirSync(d), exists: fs.existsSync };
+
+/** [{ name, dir: "crates/<x>", manifest, lock }] for every crates/<x>/Cargo.toml, sorted by dir. */
+export function crateWorkspaces(root, io = {}) {
+  const { readFile, readdir, exists } = { ...defaults, ...io };
+  const cratesDir = path.join(root, "crates");
+  if (!exists(cratesDir)) return [];
+  const out = [];
+  for (const entry of [...readdir(cratesDir)].map(String).sort()) {
+    if (entry.startsWith(".")) continue;
+    const manifest = `crates/${entry}/Cargo.toml`;
+    if (!exists(path.join(root, manifest))) continue;
+    const name = manifestFacts(readFile(path.join(root, manifest))).name;
+    if (typeof name !== "string") continue;
+    out.push({ name, dir: `crates/${entry}`, manifest, lock: `crates/${entry}/Cargo.lock` });
+  }
+  return out;
+}
+
+const DEPENDENCY_TABLE = /^(?:target\.(?:'[^']*'|"[^"]*"|[^.\]]+)\.)?(?:dev-|build-)?dependencies$/;
+const unquote = (v) => v.replace(/^(["'])(.*)\1$/, "$2");
+
+/** { name, paths }: the [package] name and every dependency `path` value (inline tables and `[dependencies.<x>]` sections). */
+export function manifestFacts(text) {
+  let section = ""; let name; const paths = [];
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.replace(/\s+#.*$/, "").trim();
+    if (!line || line.startsWith("#")) continue;
+    const header = line.match(/^\[\[?([^\[\]]+)\]\]?$/);
+    if (header) { section = header[1].trim(); continue; }
+    if (section === "package") { const m = line.match(/^name\s*=\s*("[^"]*"|'[^']*')/); if (m) name = unquote(m[1]); continue; }
+    if (DEPENDENCY_TABLE.test(section)) {
+      const m = line.match(/^[A-Za-z0-9_.-]+\s*=\s*\{(.*)\}$/);
+      const p = m && m[1].match(/(?:^|,)\s*path\s*=\s*("[^"]*"|'[^']*')/);
+      if (p) paths.push(unquote(p[1]));
+      continue;
+    }
+    const dotted = section.match(/^(.*)\.([^.]+)$/);
+    if (dotted && DEPENDENCY_TABLE.test(dotted[1])) { const m = line.match(/^path\s*=\s*("[^"]*"|'[^']*')/); if (m) paths.push(unquote(m[1])); }
+  }
+  return { name, paths };
+}
+
+/** Map<name, Set<name>>: each crate's direct path dependencies on sibling crates (normal, dev, build, any target). */
+export function pathDependencies(root, io = {}, workspaces = crateWorkspaces(root, io)) {
+  const { readFile } = { ...defaults, ...io };
+  const byDir = new Map(workspaces.map((w) => [w.dir, w.name]));
+  const deps = new Map(workspaces.map((w) => [w.name, new Set()]));
+  for (const w of workspaces) {
+    for (const dep of manifestFacts(readFile(path.join(root, w.manifest))).paths) {
+      const target = byDir.get(posix(path.posix.normalize(path.posix.join(w.dir, posix(dep)))));
+      if (target && target !== w.name) deps.get(w.name).add(target);
+    }
+  }
+  return deps;
+}
+
+/** Set<name>: every crate that path-depends on any of `names`, transitively; `names` themselves are excluded. */
+export function reverseDependents(names, deps) {
+  const reverse = new Map();
+  for (const [from, tos] of deps) for (const to of tos) (reverse.get(to) ?? reverse.set(to, new Set()).get(to)).add(from);
+  const seen = new Set(); const queue = [...names];
+  while (queue.length) {
+    for (const dependent of reverse.get(queue.shift()) ?? []) {
+      if (!seen.has(dependent)) { seen.add(dependent); queue.push(dependent); }
+    }
+  }
+  for (const n of names) seen.delete(n);
+  return seen;
+}
+
+/** The crate whose workspace holds `file` (repository-relative, posix), or null. */
+export function crateOfFile(file, workspaces) {
+  let best = null;
+  for (const w of workspaces) if (file.startsWith(`${w.dir}/`) && (!best || w.dir.length > best.dir.length)) best = w;
+  return best?.name ?? null;
+}

package/create-mac-updater.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from "./background-process.mjs";
 import { existsSync, rmSync } from "node:fs";
 import path from "node:path";
 import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
+import { ArtifactPathError, loadSplitArtifactContext, resolveArtifactPath, resolveArtifactWritePath } from "./release-artifact-path.mjs";
 
 const args = process.argv.slice(2);
 let app;
@@ -18,8 +19,19 @@ for (let i = 0; i < args.length; i++) {
 }
 if (!app || !output) fail("--app and --output are required");
 
-const appPath = path.resolve(cwd, app);
-const outputPath = path.resolve(cwd, output);
+// A door split (row 7.04c, R-T2): a target-prefixed `--app` is the bound Cargo target's, an absolute one must lie inside it, and the tarball is
+// written under the snapshot app root (a generated, ignored ledger entry). Outside a split both are resolved against the cwd as always.
+let appPath;
+let outputPath;
+try {
+  const artifactPaths = await loadSplitArtifactContext({ cwd });
+  const split = artifactPaths.mode === "split";
+  appPath = split ? resolveArtifactPath(app, artifactPaths) : path.resolve(cwd, app);
+  outputPath = split ? resolveArtifactWritePath(output, artifactPaths) : path.resolve(cwd, output);
+} catch (error) {
+  if (error instanceof ArtifactPathError) fail(error.message);
+  throw error;
+}
 if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
 
 const env = { ...process.env };

package/deterministic-scans.mjs

@@ -25,12 +25,14 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn as spawnChild, spawnSync } from "./background-process.mjs";
 import { spawnUnderOwnership } from "./build-ownership.mjs";
 import { checkAdvisoryExceptions } from "./advisory-exceptions.mjs";
-import { canonicalJson, digestScanSet, requiredScanIds, rustCratePlan, rustScanId } from "./scan-digest.mjs";
+import { CLIPPY_UNIVERSAL_FEATURE_FLAGS, canonicalJson, clippyBatchPlan, clippySelectionOf, digestScanSet, requiredScanIds, rustCratePlan, rustScanId } from "./scan-digest.mjs";
 import { reach } from "./lock-graph.mjs";
 import { cargoManifestState } from "./cargo-manifest-text.mjs";
 import { LAUNCH_GUARD_IMPORT } from "./class-a-launch-guard.mjs";
 import { advisoryCacheRoot, ensureAdvisoryDb, prepareDenyOverlay, readAdvisoryPin } from "./advisory-db.mjs";
 import { observedEnvOf, readRequestRef, verifySnapshotReceipt, writeSnapshotRequest } from "./snapshot-request.mjs";
+import { SCAN_TOKEN_ENV, readLedger, scanTokenOf, unclaimedLedgers } from "./cargo-ledger.mjs";
+import { verifyBrokerLedger } from "./snapshot-broker.mjs";
 
 export const SCAN_RESULT_SCHEMA = "rightkit.deterministic-scans/1";
 /**
@@ -48,6 +50,14 @@ export const CHECKER_IDENTITY = (() => {
 })();
 export const CHECKER_VERSION = CHECKER_IDENTITY;
 export const SCAN_CLASS = Object.freeze({ A: "A", B: "B" });
+/**
+ * Recorded in the result of every wrapped snapshot compile (item 7 row 7.10, lead re-decision F7): cargo hands a build script its own
+ * path in CARGO (measured, cargo 1.98.0), so a cargo a build script runs through $CARGO never reaches the wrapper's ledger.
+ */
+export const UNOBSERVED_NESTED_CARGO_NOTE = "cargo calls that a build script makes through $CARGO are unobserved: cargo hands build scripts its own path, not the gate's wrapper, so they are not in the cargo ledger; they inherit the parent's bound CARGO_TARGET_DIR, and the per-scan sentinel and the after-compile snapshot verify are the backstops";
+
+/** The ledger token of the gate's own tool version probes (they reach the cargo wrapper like any scan does). */
+const PROBE_LEDGER_TOKEN = scanTokenOf("tool-probe");
 
 /** Scan id prefixes (the text before the first ":") that belong to each class. */
 export const CLASS_A_SCAN_PREFIXES = Object.freeze([
@@ -197,6 +207,19 @@ export function checkArgs(unit, { features = [], messageFormat, locked = false }
 }
 
 /** `cargo doc -p <unit> --no-deps --all-features --locked`; run it with RUSTDOCFLAGS=DOC_RUSTDOCFLAGS (CI). */
+// Every compile reports every failure (Adrian, 2026-10-29: "even to ship, why isn't it better to get all errors and fix them all
+// wholesale?"; rightkit#1293): a compile keeps going past a failed crate (`--keep-going`) and a test run past a failed test binary
+// (`--no-fail-fast`). The run still fails if anything failed; the crates that compiled stay warm for the next run.
+// Cargo 1.98: build, check, clippy (through its cargo check) and doc take `--keep-going`; test and bench reject it and take
+// `--no-fail-fast` instead (the broker's BR29 adds the same split).
+const KEEP_GOING_SUBCOMMANDS = new Set(["build", "check", "clippy", "doc"]);
+const NO_FAIL_FAST_SUBCOMMANDS = new Set(["test", "bench"]);
+export function everyFailure(args) {
+  const [sub, ...rest] = args;
+  const until = rest.indexOf("--"); const own = until === -1 ? rest : rest.slice(0, until);
+  const flag = KEEP_GOING_SUBCOMMANDS.has(sub) ? "--keep-going" : NO_FAIL_FAST_SUBCOMMANDS.has(sub) ? "--no-fail-fast" : null;
+  return flag && !own.includes(flag) ? [sub, flag, ...rest] : args;
+}
 export function docArgs(unit) { return ["doc", "-p", unit, "--no-deps", "--all-features", "--locked"]; }
 export const DOC_RUSTDOCFLAGS = "-D warnings";
 /** The same check as rustdoc arguments (`cargo rustdoc ... -- -D warnings`), for the broker path. */
@@ -208,6 +231,35 @@ export function fmtCheckArgs(unit = null) { return unit ? ["fmt", "-p", unit, "-
 /** `cargo metadata` that validates manifests and the lock without resolving anything new. */
 export function metadataArgs({ noDeps = true } = {}) { return ["metadata", ...(noDeps ? ["--no-deps"] : []), "--format-version", "1", "--locked"]; }
 
+// ---- Clippy batching (GATE-CONTRACT §1 "Clippy route & batching"; item 8 rows 8.6, 8.8, 8.15) -----------------------------------------
+
+// The batch planner itself (clippyBatchPlan, clippySelectionOf, CLIPPY_UNIVERSAL_FEATURE_FLAGS) lives in scan-digest.mjs, beside the scan
+// ids, and is re-exported here.
+export { CLIPPY_UNIVERSAL_FEATURE_FLAGS, clippyBatchPlan, clippySelectionOf };
+
+/**
+ * Does this crate's directory declare sidecars its build needs staged first? A Tauri crate with `bundle.externalBin` refuses to build
+ * until its sidecars are in place (bin/rightkit-gate.mjs, the compile stage), so it is scheduled after the independent crates. The
+ * declaration is read from the crate's own Tauri configuration (JSON, JSON5 or TOML), in its directory or its `src-tauri`.
+ */
+export function sidecarBoundCrate({ dir, exists = fs.existsSync, readFile = (f) => fs.readFileSync(f, "utf8") }) {
+  for (const base of [dir, path.join(dir, "src-tauri")]) {
+    for (const name of ["tauri.conf.json", "tauri.conf.json5", "Tauri.toml"]) {
+      const file = path.join(base, name);
+      let body;
+      try { if (!exists(file)) continue; body = readFile(file); } catch { continue; }
+      try {
+        const conf = JSON.parse(body);
+        const list = conf?.bundle?.externalBin ?? conf?.tauri?.bundle?.externalBin;
+        if (Array.isArray(list) && list.length) return { bound: true, file, externalBin: list };
+        continue;
+      } catch { /* not strict JSON: read as text */ }
+      if (/(^|[\s{,"'])externalBin["']?\s*[:=]\s*\[\s*["']/.test(body)) return { bound: true, file, externalBin: null };
+    }
+  }
+  return { bound: false };
+}
+
 // ---- plan ---------------------------------------------------------------------------------------------
 
 const posix = (p) => p.replaceAll("\\", "/");
@@ -305,6 +357,11 @@ export const ancestorConfigChanged = (ws, changed, pattern = ANCESTOR_RUST_CONFI
   const rel = dir === "." ? f : f.startsWith(`${dir}/`) ? f.slice(dir.length + 1) : null;
   return rel !== null && pattern.test(rel);
 }));
+// Genuinely shared inputs of a repository whose every crate is its own Cargo workspace (rightkit#1285): no crate directory holds them,
+// so a change to one reaches every unit. Anything else outside a crate directory reaches no crate (a vendored source maps to the crates
+// that patch or path-depend on it through `externalInputs`; a repository-level toolchain, .cargo, clippy or rustfmt file is an
+// ANCESTOR_RUST_CONFIG_FILE of every workspace). The gate configuration, the pipeline's toolchain pins and the gate itself are named here.
+export const SHARED_RUST_SCOPE_FILE = /^(ci\/gate\.config\.json|ci\/rk-pipeline\.json|packages\/release\/(bin\/rightkit-gate|deterministic-scans|scan-digest|advisory-exceptions|crate-workspaces|lock-graph|cargo-target-shim)\.mjs)$/;
 const WORKSPACE_JS_FILE = /^(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|\.npmrc)$/;
 // The linter a package has is the one it configures. ESLint reads a flat `eslint.config.*` or a legacy `.eslintrc*` from the package directory or
 // any ancestor of it; Biome reads `biome.json` / `biome.jsonc` the same way. A Biome-only app (ViewRight, ScrapeRight: `"lint": "biome lint ."`)
@@ -739,7 +796,7 @@ export function planScans({
   // Repository-specific units for any layout: [{ name, dir, publish? }], dir repo-relative ("." for a root unit). When given they
   // replace the crates/<name> and packages/<name> layout (rightkit-gate). `cargoDir` is the Cargo workspace root the cargo scans run in.
   // A rust unit may name its own workspace: { name, dir, cargoDir, crate, publish? } runs its scans with cwd cargoDir and `-p <crate>`;
-  // `name` is then the unit's identity in scan ids and feature config (rightkit-gate names it `<cargoDir>:<crate>` below the root), and
+  // `name` is then the unit's identity in scan ids and feature config (rightkit-gate names it `<cargoDir>:<crate>` below the root, and the plain crate for a `crates/<crate>` workspace of its own), and
   // `crateFeatures` is read by `name` first, then by `crate`. Units of different workspaces never share a lock, a deny/audit run or a
   // `cargo metadata`; a unit that sets no cargoDir belongs to the global `cargoDir` above.
   rustUnits = null, npmUnits = null, cargoDir = ".",
@@ -757,6 +814,19 @@ export function planScans({
   rustLocks = null,
   // The pinned RustSec advisory database ({ url, commit }, advisory-db.json): cargo-deny and cargo-audit read exactly that commit and never fetch.
   advisoryPin = null,
+  // Cross-workspace reach of a crate-per-workspace repository (rightkit#1285): `crateDependents(unitNames: Set) -> Set` answers the
+  // units that path-depend on any of `unitNames`, transitively, across Cargo workspaces (the gate builds it from packages/release/
+  // crate-workspaces.mjs; manifests only). Every such unit that is not itself in scope gets a `check-dependent` scan. null plans none beyond
+  // the per-workspace lock graph (rustLocks).
+  crateDependents = null,
+  // `{ "<repo-relative directory>": [unit names] }`: sources outside every unit that a unit compiles (vendor/citationberg is patched into
+  // rightkit-typeset). A changed file under the directory puts those units in scope. null maps none.
+  externalInputs = null,
+  // Clippy batching (item 8; clippyBatchPlan). false keeps the production path: one Clippy scan per crate and lint feature set. It is
+  // switched on only after the batch-equivalence run (clippy-equivalence.mjs, row 8.7) has passed on the hosts the map names; then the
+  // planner emits one scan per compatible batch and no per-crate Clippy scan for a crate that belongs to one (row 8.15).
+  // `shardSolo` is ci/shards.json `solo`; `clippySeparate` maps a unit name to the reason equivalence found batching changed it.
+  clippyBatching = false, shardSolo = [], clippySeparate = new Map(),
 } = {}) {
   if (!contentRoot) throw new TypeError("planScans: contentRoot is required");
   if (!Array.isArray(cargoCommand) || cargoCommand.length === 0 || !["rustright", "cargo"].includes(cargoCommand[0]) || cargoCommand.slice(1).some((a) => a !== "cargo")) {
@@ -810,7 +880,7 @@ export function planScans({
   const plainDir = (d) => !ABSOLUTE_PATH.test(d) && !d.split("/").includes("..") && SAFE_UNIT_DIR.test(d);
   const cargoWs = cleanDir(cargoDir);
   if (!plainDir(cargoWs)) throw new TypeError("planScans: cargoDir must be a plain repository-relative directory");
-  const cargoIn = (ws, ...args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...args], ...(ws !== "." ? { cwd: ws } : {}), ...(cargoLiveRoot ? { root: "cargoLive" } : {}), ...(targetDirs?.[ws] ? { env: { CARGO_TARGET_DIR: targetDirs[ws] } } : {}) });
+  const cargoIn = (ws, ...args) => ({ tool: cargoCommand[0], args: [...cargoCommand.slice(1), ...everyFailure(args)], ...(ws !== "." ? { cwd: ws } : {}), ...(cargoLiveRoot ? { root: "cargoLive" } : {}), ...(targetDirs?.[ws] ? { env: { CARGO_TARGET_DIR: targetDirs[ws] } } : {}) });
   const unitMap = (units, kind) => {
     if (units === null) return null;
     if (!Array.isArray(units)) throw new TypeError(`planScans: ${kind}Units must be an array of { name, dir }`);
@@ -865,7 +935,13 @@ export function planScans({
   };
   // Units of an explicit-workspace layout (some unit names its cargoDir) get workspace-suffixed ids for the per-workspace scans.
   const perWorkspaceIds = Array.isArray(rustUnits) && rustUnits.some((u) => u?.cargoDir !== undefined);
-  const wsIdSuffix = (ws) => (perWorkspaceIds && ws !== "." ? `:${ws}` : "");
+  // The label a per-workspace scan id carries: the workspace directory, except for a workspace that is exactly one crate-named unit
+  // (`crates/rightkit-fs` holding rightkit-fs, rightkit#1285 D2), which is labelled by the crate (`cargo-deny:rightkit-fs`).
+  const wsLabel = (ws) => {
+    if (rustMap) for (const [name, u] of rustMap) if (u.cargoDir === ws && name === u.crate && ws === `crates/${u.crate}`) return name;
+    return ws;
+  };
+  const wsIdSuffix = (ws) => (perWorkspaceIds && ws !== "." ? `:${wsLabel(ws)}` : "");
   const wsOf = (n) => (rustMap ? rustMap.get(n).cargoDir : cargoWs);
   const crateOf = (n) => (rustMap?.get(n)?.crate ?? n);
   const featuresOf = (n) => crateFeatures?.[n] ?? crateFeatures?.[crateOf(n)] ?? {};
@@ -899,13 +975,32 @@ export function planScans({
   const verbatimUpstream = (f) => f.startsWith("vendor/") && typeof upstream[f] === "string" && bytesDigest(f) === upstream[f];
   const recordedPatch = (f) => f.startsWith("vendor/") && DIGEST.test(patched[f]?.base ?? "") && typeof patched[f]?.note === "string"
     && patched[f].note.startsWith("vendor/") && DIGEST.test(patched[f]?.sha256 ?? "") && bytesDigest(f) === patched[f].sha256;
+  // Declared fixture files (Adrian, 2026-10-30: "there should be a .rkignore list that somehow allows for those to be passed";
+  // rightkit#1291): `.rightkit/fixture-files.json` { schema: 1, files: { "<path>": { sha256, note } } } lists files that are
+  // deliberately malformed (an audit's known-answer inputs). A listed file whose bytes still match its sha256 skips the per-file
+  // format and parse scans only (rustfmt, node --check, json-parse, toml-parse); every other scan still reads it. Any edit changes
+  // the digest, so the file is checked again until re-recorded. A malformed manifest, a bad digest or an empty note refuses.
+  let fixtureFiles = {};
+  if (exists(path.join(contentRoot, ".rightkit/fixture-files.json"))) {
+    try {
+      const manifest = JSON.parse(readFile(path.join(contentRoot, ".rightkit/fixture-files.json")));
+      if (manifest?.schema !== 1 || !manifest.files || typeof manifest.files !== "object" || Array.isArray(manifest.files)) throw new Error("schema 1 with a files object is required");
+      for (const [f, row] of Object.entries(manifest.files)) {
+        if (!/^[0-9a-f]{64}$/.test(row?.sha256 ?? "")) throw new Error(`${f}: sha256 must be 64 lowercase hex characters`);
+        if (typeof row?.note !== "string" || !row.note.trim()) throw new Error(`${f}: a note saying why the file is malformed is required`);
+        if (f.startsWith("/") || f.split("/").includes("..")) throw new Error(`${f}: paths are repository-relative`);
+      }
+      fixtureFiles = manifest.files;
+    } catch (error) { refuse(".rightkit/fixture-files.json", error.message); }
+  }
+  const declaredFixture = (f) => Object.hasOwn(fixtureFiles, f) && bytesDigest(f) === fixtureFiles[f].sha256;
   // Generated Rust is not hand-formatted: bindgen output, or rustfmt's own `@generated` marker in the first five lines.
   const generatedRust = (f) => {
     let head = "";
     try { head = readFile(path.join(contentRoot, f)).split("\n", 5).join("\n"); } catch { return false; }
     return /@generated\b|automatically generated by rust-bindgen\b/.test(head);
   };
-  const rustFiles = files.filter((f) => f.endsWith(".rs") && !verbatimUpstream(f) && !recordedPatch(f) && !generatedRust(f));
+  const rustFiles = files.filter((f) => f.endsWith(".rs") && !verbatimUpstream(f) && !recordedPatch(f) && !generatedRust(f) && !declaredFixture(f));
   const byEdition = new Map();
   const editionOf = rustEditionResolver({ contentRoot, exists, readFile });
   const refusedEditions = new Set();
@@ -927,12 +1022,12 @@ export function planScans({
       add({ id: `rustfmt:${edition}${i ? `:${i / RUSTFMT_BATCH + 1}` : ""}`, class: A, tool: "rustfmt", args: ["--check", "--edition", edition, ...batch], root: "content" });
     }
   }
-  for (const f of files.filter((f) => /\.(mjs|cjs|js)$/.test(f) && !f.includes("node_modules")).sort()) {
+  for (const f of files.filter((f) => /\.(mjs|cjs|js)$/.test(f) && !f.includes("node_modules") && !declaredFixture(f)).sort()) {
     add({ id: `node-check:${f}`, class: A, tool: "node", args: ["--check", f], root: "content" });
   }
-  const jsonFiles = files.filter((f) => f.endsWith(".json") && !f.includes("node_modules")).sort();
+  const jsonFiles = files.filter((f) => f.endsWith(".json") && !f.includes("node_modules") && !declaredFixture(f)).sort();
   if (jsonFiles.length) add({ id: "json-parse", class: A, internal: "json-parse", files: jsonFiles });
-  const tomlFiles = files.filter((f) => f.endsWith(".toml") && !f.includes("node_modules")).sort();
+  const tomlFiles = files.filter((f) => f.endsWith(".toml") && !f.includes("node_modules") && !declaredFixture(f)).sort();
   if (tomlFiles.length) add({ id: "toml-parse", class: A, internal: "toml-parse", files: tomlFiles });
   // The strict workflow YAML parser covers the subset GitHub workflows and actions use; other YAML is not parsed with it.
   const yamlFiles = files.filter((f) => /^\.github\/.+\.ya?ml$/.test(f)).sort();
@@ -950,7 +1045,12 @@ export function planScans({
   const wideJsRoots = new Set(pnpmRoots.filter((r) => files.some((f) => { const rel = wsRel(r, f); return rel !== null && WORKSPACE_JS_FILE.test(rel); })));
   const wideCrates = wideWs.size ? (rustMap ? [...rustMap.keys()].filter((n) => wideWs.has(wsOf(n))) : listDir(path.join(contentRoot, "crates"))).filter((n) => !rustScope || rustScope.has(n)) : [];
   if (wideWs.size && rustScope) notes.push(`workspace Rust change reaches ${wideCrates.length} crate(s) through the lock graph`);
-  const crateNames = safeUnits([...new Set([...(rustMap ? files.map((f) => unitOf(rustMap, f)).filter(Boolean) : under("crates/").map((f) => f.split("/")[1])), ...wideCrates])].filter((n) => exists(path.join(contentRoot, rustDir(n), "Cargo.toml"))).sort(), "crate");
+  // A source outside every unit that a unit compiles (externalInputs), and a shared input, reach their units; nothing else outside a
+  // unit's directory does (a crate-per-workspace repository has no root manifest or lock to widen the scope).
+  const externalUnits = rustMap && externalInputs ? Object.entries(externalInputs).flatMap(([dir, names]) => (files.some((f) => f === dir || f.startsWith(`${dir.replace(/\/+$/, "")}/`)) ? names : [])).filter((n) => rustMap.has(n)) : [];
+  const sharedUnits = rustMap && files.some((f) => SHARED_RUST_SCOPE_FILE.test(f)) ? [...rustMap.keys()] : [];
+  if (sharedUnits.length) notes.push(`a shared build input changed (${files.filter((f) => SHARED_RUST_SCOPE_FILE.test(f)).join(", ")}); every Rust unit is in scope`);
+  const crateNames = safeUnits([...new Set([...(rustMap ? files.map((f) => unitOf(rustMap, f)).filter(Boolean) : under("crates/").map((f) => f.split("/")[1])), ...wideCrates, ...externalUnits, ...sharedUnits])].filter((n) => exists(path.join(contentRoot, rustDir(n), "Cargo.toml"))).sort(), "crate");
   // The workspace a changed file belongs to is the deepest one that holds it (a root workspace holds only what no nested one does).
   const wsOfFile = (f) => { let best = null; for (const ws of workspaces) if ((ws === "." || f.startsWith(`${ws}/`)) && (best === null || ws.length > best.length)) best = ws; return best; };
   const configWs = new Set();
@@ -1002,7 +1102,7 @@ export function planScans({
     // A non-empty list only: `[^\]\s]` is one character that is neither whitespace nor the closing bracket, so `ignore = []` followed by
     // a later `]` (the next table header) is not an ignore (Pulse, 2026-10-27: `\S` matched the `]` itself).
     const ignores = ["deny.toml", ".cargo/audit.toml"].some((f) => { try { return /\bignore\s*=\s*\[[^\]]*[^\]\s][^\]]*\]/s.test(readFile(path.join(contentRoot, dir, f))); } catch { return false; } });
-    if (ignores && !(dir === "" && exists(path.join(contentRoot, "ci/advisory-exceptions.json")))) add({ id: `advisory-exceptions${dir ? `:${dir}` : ""}`, class: A, internal: "advisory-exceptions", dir, exceptionsFile: ".rightkit/advisory-exceptions.json" });
+    if (ignores && !(dir === "" && exists(path.join(contentRoot, "ci/advisory-exceptions.json")))) add({ id: `advisory-exceptions${dir ? `:${wsLabel(ws)}` : ""}`, class: A, internal: "advisory-exceptions", dir, exceptionsFile: ".rightkit/advisory-exceptions.json" });
   }
   // Like generated-docs, planned only when a changed file is one of the contract's inputs or projections. The generator runs from
   // the trusted scanner checkout (the import below); the exported contract and projections are data it checks.
@@ -1085,6 +1185,7 @@ export function planScans({
       ...(trusted ? {} : { deferred: "requires a trusted-root run: the generator is repository code and no separate trusted checkout provides it; the content root's copy is never executed" }),
     });
   }
+  const clippyEntries = [];
   for (const name of crateNames) {
     // Feature sets exactly as CI's gate runs them (scripts/ci/gate.mjs, ci/gate.config.json rust.<crate>):
     // clippy per `featureSets` (default features when absent); check per `checkFeatureSets` (default
@@ -1097,16 +1198,25 @@ export function planScans({
     // check runs only when no clippy set covers default features.
     if (defaultCheck) add({ id: rustScanId.check(name), class: B, ...cargoIn(ws, ...checkArgs(crate, { locked: true })) });
     checkSets.forEach((set, i) => add({ id: rustScanId.checkFeatures(name, i), class: B, ...cargoIn(ws, ...checkArgs(crate, { features: set, locked: true })) }));
-    lintSets.forEach((set, i) => add({ id: rustScanId.clippy(name, lintSets.length, i), class: B, ...cargoIn(ws, ...clippyArgs(crate, { features: set, locked: true })) }));
+    if (clippyBatching) lintSets.forEach((set) => clippyEntries.push({ name, crate, ws, set, count: lintSets.length, env: targetDirs?.[ws] ?? null }));
+    else lintSets.forEach((set, i) => add({ id: rustScanId.clippy(name, lintSets.length, i), class: B, ...cargoIn(ws, ...clippyArgs(crate, { features: set, locked: true })) }));
     // rustdoc flags go after `--` for this crate's library only: the broker owns RUSTDOCFLAGS and refuses
     // a request that sets it. A crate with no library has no API docs to check.
     if (exists(path.join(contentRoot, rustDir(name), "src", "lib.rs"))) {
       add({ id: rustScanId.doc(name), class: B, ...cargoIn(ws, "rustdoc", "-p", crate, "--lib", ...lintSets[0], "--locked", "--", ...DOC_RUSTDOC_ARGS) });
     }
   }
+  if (clippyBatching && clippyEntries.length) {
+    // One Clippy scan per batch (row 8.6): the independent batches first, the sidecar-bound ones after them (row 8.8; the compile lane
+    // drains in plan order). The reason a configuration stays separate is recorded in the plan notes.
+    const sidecarBound = new Set(clippyEntries.filter((e) => sidecarBoundCrate({ dir: path.join(contentRoot, rustDir(e.name)), exists, readFile }).bound).map((e) => e.name));
+    const plan = clippyBatchPlan(clippyEntries, { solo: shardSolo, separate: clippySeparate, sidecarBound, toolchain: cargoCommand.join(" ") });
+    for (const b of plan.batches) add({ id: b.id, class: B, batch: { units: b.units, order: b.order, reason: b.reason }, ...cargoIn(b.ws, ...clippyArgs(b.crates, { features: b.set, locked: true })) });
+    notes.push(...plan.notes);
+  }
   // Reverse dependents: a workspace crate that is not in scope but whose lock closure reaches one that is must still compile.
   // A unit only depends on units of its own Cargo workspace (its own lock), so each workspace is judged by its own lock.
-  const inScope = new Set(crateNames);
+  const inScope = new Set(crateNames); const planned = new Set();
   for (const ws of [...new Set(crateNames.map(wsOf))].sort()) {
     const lock = lockOf(ws);
     if (!lock) continue;
@@ -1114,7 +1224,13 @@ export function planScans({
     const scoped = crateNames.filter((n) => wsOf(n) === ws).map(crateOf);
     const workspace = (rustMap ? [...rustMap.keys()] : listDir(path.join(contentRoot, "crates"))).filter((n) => wsOf(n) === ws);
     const dependents = safeUnits(workspace.filter((n) => !inScope.has(n) && exists(path.join(contentRoot, rustDir(n), "Cargo.toml")) && scoped.some((t) => reach(lock, crateOf(n), memo).has(t))).sort(), "crate");
-    for (const name of dependents) add({ id: `check-dependent:${name}`, class: B, ...cargoIn(ws, ...checkArgs(crateOf(name), { locked: true })) });
+    for (const name of dependents) { planned.add(name); add({ id: `check-dependent:${name}`, class: B, ...cargoIn(ws, ...checkArgs(crateOf(name), { locked: true })) }); }
+  }
+  // Across Cargo workspaces (one workspace and lock per crate): a unit that path-depends on a unit in scope, transitively, is judged by
+  // the manifests' path dependencies, since no lock holds both.
+  if (typeof crateDependents === "function" && rustMap && crateNames.length) {
+    const across = [...crateDependents(new Set(crateNames))].filter((n) => !inScope.has(n) && !planned.has(n) && rustMap.has(n) && exists(path.join(contentRoot, rustDir(n), "Cargo.toml"))).sort();
+    for (const name of safeUnits(across, "crate")) add({ id: `check-dependent:${name}`, class: B, ...cargoIn(wsOf(name), ...checkArgs(crateOf(name), { locked: true })) });
   }
   // A linter config in the unit's directory or any ancestor of it (a repository-level config covers every unit, as the tools look it up).
   const hasConfig = (dir, names) => ancestorDirsOf(dir).some((d) => names.some((f) => exists(path.join(liveRoot, inDir(d, f)))));
@@ -1804,7 +1920,11 @@ export async function runScans(plan, options = {}) {
   const ctx = { deps, contentRoot, read: (f) => deps.readFile(path.join(contentRoot, f)) };
   const toolVersions = {}; const probed = new Map(); const advisoryDbs = new Map();
   const results = [];
-  // options.cache = { read(key), write(key, row), digest(scan) => string | null } (null: not cacheable, which is how the live class A checks opt out).
+  // The gate-owned cargo ledger of a wrapped snapshot compile (options.cargoLedger = { dir }): every call the wrapper decided, filed
+  // under its scan's token. `ledgerSeen` is the run's one-use record of carriers and request ids across every scan.
+  const cargoLedger = options.cargoLedger?.dir ? options.cargoLedger : null;
+  const claimedTokens = new Set(); const ledgerSeen = { nonces: new Set(), ids: new Set() };
+  // options.cache ={ read(key), write(key, row), digest(scan) => string | null } (null: not cacheable, which is how the live class A checks opt out).
   const cache = options.cache && typeof options.cache.read === "function" && typeof options.cache.write === "function" && typeof options.cache.digest === "function" ? options.cache : null;
   const cacheHits = [];
   let classAFailed = false;
@@ -1844,7 +1964,11 @@ export async function runScans(plan, options = {}) {
       // lease, open.
       const probeMs = Number.isFinite(options.probeTimeoutMs) && options.probeTimeoutMs > 0 ? options.probeTimeoutMs : PROBE_TIMEOUT_MS;
       const probeSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(probeMs)]) : AbortSignal.timeout(probeMs);
-      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd, env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0" }, signal: probeSignal });
+      // The gate's own version probes reach the wrapper too (cargo is first on PATH): they are filed under the probe token, which the
+      // gate claims and checks like a scan's.
+      const probeLedgerEnv = cargoLedger ? { [SCAN_TOKEN_ENV]: PROBE_LEDGER_TOKEN } : {};
+      if (cargoLedger) claimedTokens.add(PROBE_LEDGER_TOKEN);
+      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd, env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0", ...probeLedgerEnv }, signal: probeSignal });
       if (!r || r.error || r.status !== 0) outcome = { ok: false, why: r?.error?.message ?? `exit ${r?.status}` };
       else {
         const text = String(r.stdout || r.stderr || "");
@@ -1879,7 +2003,7 @@ export async function runScans(plan, options = {}) {
     try { onResult(row, { done, total, seconds: Math.round((Date.now() - started) / 1000) }); } catch { /* reporting never fails a scan */ }
     return row;
   }
-  // Class A may run concurrently. Every class B lane runs serially: tests and docs can compile too, and one checkout gets one build.
+  // Class A may run concurrently. Class B runs one scan per component at a time, `classBJobs` components at once (below).
   const aScans = ordered.filter((s) => s.class === SCAN_CLASS.A);
   const bScans = ordered.filter((s) => s.class === SCAN_CLASS.B);
   // Class A scans are independent content checks (and short broker calls: metadata, package list, deny, audit): they run
@@ -1928,7 +2052,25 @@ export async function runScans(plan, options = {}) {
     const slots = new Array(bScans.length);
     const lanes = { compile: [], doc: [], tests: [], quiet: [] };
     bScans.forEach((s, i) => lanes[laneOf(s)].push(i));
-    const drain = async (queue, extraEnv = null) => { while (queue.length) { const i = queue.shift(); slots[i] = await runOne(bScans[i], extraEnv); } };
+    // RightKit is many components, never one build (Adrian, 2026-10-29; rightkit#1285): class B scans of different components run
+    // concurrently, `classBJobs` at a time (the broker queues beyond its build capacity). A component is the directory a scan runs in
+    // (`cwd`, its own Cargo workspace and output directory); scans of one component stay in plan order, because they share its
+    // output directory and cargo locks it.
+    const bJobs = Math.max(1, Number(options.classBJobs ?? 1) || 1);
+    const drain = async (queue, extraEnv = null) => {
+      const busy = new Set(); const running = new Set();
+      const keyOf = (i) => bScans[i].cwd ?? ".";
+      while (queue.length || running.size) {
+        const at = running.size < bJobs ? queue.findIndex((i) => !busy.has(keyOf(i))) : -1;
+        if (at === -1) { await Promise.race(running); continue; }
+        const [i] = queue.splice(at, 1); const key = keyOf(i); busy.add(key);
+        // A scan that throws becomes a failed row: with several components in flight, a rejection must not abandon the others.
+        const job = runOne(bScans[i], extraEnv)
+          .catch((error) => ({ id: bScans[i].id, class: bScans[i].class, command: bScans[i].command, tool: bScans[i].tool ?? null, toolVersion: null, status: "fail", code: "SCAN_ERROR", detail: String(error?.message ?? error) }))
+          .then((row) => { slots[i] = row; }).finally(() => { busy.delete(key); running.delete(job); });
+        running.add(job);
+      }
+    };
     await drain(lanes.compile);
     await drain(lanes.doc);
     await drain(lanes.tests);
@@ -2119,14 +2261,19 @@ export async function runScans(plan, options = {}) {
           // CARGO_TARGET_DIR gets an empty directory of its own as one. Every cargo reached through the wrapper is bound elsewhere; only
           // a cargo that bypassed it (an absolute path, `rustup run`, a reset PATH) can write here, and the scan then fails below.
           let sentinel = null;
-          if (options.cargoSentinel && !Object.hasOwn(s.env ?? {}, "CARGO_TARGET_DIR")) {
+          // (A scan that is itself the carried broker request is bound by the broker: no sentinel, so the client's observed environment is the scan's own.)
+          if (options.cargoSentinel && !viaSnapshotBroker && !Object.hasOwn(s.env ?? {}, "CARGO_TARGET_DIR")) {
             sentinel = path.join(options.cargoSentinel, sha256(s.id).slice(0, 16));
             fs.rmSync(sentinel, { recursive: true, force: true });
             fs.mkdirSync(sentinel, { recursive: true });
           }
           const sentinelEnv = sentinel ? { CARGO_TARGET_DIR: sentinel, CARGO_BUILD_TARGET_DIR: sentinel } : {};
+          // Every cargo call the wrapper decides during this scan is filed under this token in the gate's ledger.
+          const ledgerToken = cargoLedger ? scanTokenOf(s.id) : null;
+          if (ledgerToken) claimedTokens.add(ledgerToken);
+          const ledgerEnv = ledgerToken ? { [SCAN_TOKEN_ENV]: ledgerToken } : {};
           try {
-          try { r = await deps.spawn(p.command, finalArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...(carrier ? carrier.made.env : {}) }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+          try { r = await deps.spawn(p.command, finalArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}) }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
           if ((timer.signal.aborted || r?.error?.code === "ETIMEDOUT") && (!r || r.error || r.status !== 0)) return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} ran longer than ${Math.round(limitMs / 60000)} min and was killed with its process tree; a scan that does not finish fails` };
           if (!r || r.error) { status = "fail"; code = "SPAWN_ERROR"; detail = r?.error?.message ?? "no result"; }
@@ -2139,6 +2286,19 @@ export async function runScans(plan, options = {}) {
             try { written = fs.readdirSync(sentinel); } catch (e) { written = [`(unreadable: ${e.message})`]; }
             if (written.length) { status = "fail"; code = "RK_CARGO_UNBOUND"; detail = `${s.id}: a cargo that bypassed the gate's wrapper wrote ${written.slice(0, 5).join(", ")} into the unbound sentinel ${sentinel}; with several Cargo workspaces no output directory can be inferred for it, so the scan proves nothing about where its outputs went`; }
           }
+          // The wrapper's ledger (rows 7.10 and 7.24): a refused, unverified or unfinished cargo call fails this scan even when the code
+          // under test ignored cargo's exit status; on a broker host each call's signed receipt is verified again here, by the gate.
+          if (ledgerToken) {
+            let problems;
+            try {
+              const ledger = readLedger(cargoLedger.dir, ledgerToken);
+              problems = [...ledger.problems, ...(deps.snapshotBroker ? await verifyBrokerLedger(ledger.entries, deps.snapshotBroker, { seen: ledgerSeen }) : [])];
+            } catch (e) { problems = [`the cargo ledger cannot be read (${e.message})`]; }
+            if (problems.length) {
+              const text = `${s.id}: the gate's cargo ledger records ${problems.length} cargo call(s) that did not complete as a verified success: ${problems.slice(0, 5).join("; ")}`;
+              if (status === "pass") { status = "fail"; code = "RK_CARGO_LEDGER"; detail = text; } else detail = `${detail ? `${detail}; ` : ""}${text}`;
+            }
+          }
           if (s.advisoryDb === "deny" && code !== "RK_CARGO_UNBOUND") {
             const denyError = `${r.stdout ?? ""}\n${r.stderr ?? ""}`.split(/\r?\n/).find((line) => /\[ERROR\]/.test(line));
             if (r.truncated) { status = "fail"; code = "DENY_ERROR"; detail = "cargo-deny output exceeded the kept tail, so the absence of an [ERROR] line cannot be shown"; }
@@ -2150,7 +2310,7 @@ export async function runScans(plan, options = {}) {
             try {
               const ref = readRequestRef(path.join(carrier.refDir, "request.json"));
               const receipt = await deps.snapshotBroker.receiptOf(ref.requestId);
-              const { evidence } = verifySnapshotReceipt(receipt, { pins: deps.snapshotBroker.pins, jobId: ref.requestId, carrier: carrier.made.carrier, argv: carrier.cargoArgv, workspace: ref.workspace, observedEnv: observedEnvOf({ ...deps.env, ...s.env, ...(extraEnv ?? {}) }, deps.platform ?? process.platform) });
+              const { evidence } = verifySnapshotReceipt(receipt, { pins: deps.snapshotBroker.pins, jobId: ref.requestId, carrier: carrier.made.carrier, argv: carrier.cargoArgv, workspace: ref.workspace, observedEnv: observedEnvOf({ ...deps.env, ...s.env, ...(extraEnv ?? {}) }, deps.platform ?? process.platform), checkout: deps.snapshotBroker.checkout, outputRoots: deps.snapshotBroker.outputRoots, platform: deps.snapshotBroker.platform ?? deps.platform ?? process.platform });
               row.snapshotEvidence = { requestId: ref.requestId, outputDir: evidence.outputDir, treeAtStart: evidence.snapshot.treeAtStart, treeAtExit: evidence.snapshot.treeAtExit };
             } catch (e) {
               status = "fail"; code = "SNAPSHOT_EVIDENCE"; detail = `${s.id}: the broker's snapshot evidence did not verify (${e.code ?? "error"}: ${e.message})`;
@@ -2181,12 +2341,27 @@ export async function runScans(plan, options = {}) {
     return { ...row, status, ...(code ? { code } : {}), ...(detail ? { detail } : {}) };
   }
 
+  // Cargo calls the gate cannot attribute to a scan (the code under test cleared or replaced the scan token): never skipped.
+  if (cargoLedger) {
+    // The gate's own version probes: anything but a completed call (a refused probe) fails the run too.
+    try {
+      const probeProblems = readLedger(cargoLedger.dir, PROBE_LEDGER_TOKEN).problems;
+      if (probeProblems.length) results.push({ id: "cargo-ledger:tool-probe", class: SCAN_CLASS.B, command: "cargo ledger", tool: null, toolVersion: null, status: "fail", code: "RK_CARGO_LEDGER", detail: `the gate's tool version probes reached the wrapper and did not complete: ${probeProblems.slice(0, 5).join("; ")}` });
+    } catch { /* an unreadable probe ledger is named by the unclaimed check only when it holds records */ }
+    let unclaimed;
+    try { unclaimed = unclaimedLedgers(cargoLedger.dir, claimedTokens); } catch (e) { unclaimed = [`unreadable (${e.message})`]; }
+    if (unclaimed.length) {
+      const calls = [];
+      for (const token of unclaimed) { try { for (const e of readLedger(cargoLedger.dir, token).entries) calls.push(`cargo ${(e.argv ?? []).join(" ")} (${e.status}, from ${e.cwd})`.trim()); } catch { /* named by its token below */ } }
+      results.push({ id: "cargo-ledger", class: SCAN_CLASS.B, command: "cargo ledger", tool: null, toolVersion: null, status: "fail", code: "RK_CARGO_LEDGER", detail: `cargo calls were filed under ${unclaimed.length} scan token(s) no scan owns (${unclaimed.slice(0, 3).join(", ")}), so they cannot be tied to a scan (${SCAN_TOKEN_ENV} was cleared, or the call came from outside every scan): ${calls.slice(0, 5).join("; ") || "unreadable"}` });
+    }
+  }
   const cancelled = signal?.aborted === true;
   return {
     schema: SCAN_RESULT_SCHEMA, ok: !cancelled && results.every((r) => r.status === "pass"), complete: !cancelled && results.every((r) => r.status === "pass"), classes, checker, ...(cancelled ? { cancelled: true } : {}),
     inputDigest: plan.inputDigest ?? null,
     deferred: results.filter((r) => r.status === "deferred").map((r) => r.id),
-    scans: results, toolVersions, cacheHits: [...cacheHits].sort(), notes: plan.notes ?? [],
+    scans: results, toolVersions, cacheHits: [...cacheHits].sort(), notes: [...(plan.notes ?? []), ...(cargoLedger ? [UNOBSERVED_NESTED_CARGO_NOTE] : [])],
     scanSetDigest: digestScanSet(results),
     classDigests: { A: digestScanSet(results.filter((r) => r.class === "A")), B: digestScanSet(results.filter((r) => r.class === "B")) },
   };

package/development.mjs

@@ -7,6 +7,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { readSourceSplit } from "./source-split.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 import { acquireManagedRunLease, directCargoEnv, directPlatform, managedRuntimeClient, managedRuntimeCommand, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
@@ -107,7 +108,10 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   // iOS: --dry-run validates the config and prints the plan on any host; everything else needs macOS with Xcode.
   if (!(platform === "ios" && dryRun)) assertNativeDevelopmentHost(platform);
   const target = validateDevelopmentConfig(config, platform, { root });
-  const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+  // Inside the door's source split `root` is the snapshot of a commit (no git directory): the repository is the checkout the door
+  // ran in, whose primary-checkout rule and execution policy still apply, and the commit is the split's.
+  const split = readSourceSplit({ env, cwd: root });
+  const repoRoot = split ? split.checkout : git(root, ["rev-parse", "--show-toplevel"]);
   assertPrimaryReleaseCheckout(repoRoot, env);
   if (dryRun && uiTests) {
     if (!target.uiTests) throw new Error("development.targets.ios.uiTests is not declared: list the journeys in uiTests.onlyTesting");
@@ -147,10 +151,11 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
     // Linux: the declared files become one tarball per architecture plus the digest manifest a guest link pins (rightkit#1230).
     // Only from a clean checkout: an artifact others install must name the exact commit it was built from.
     if (platform === "linux" && target.archive && !dryRun) {
-      if (git(repoRoot, ["status", "--porcelain", "--untracked-files=normal"])) throw new Error("linux artifacts are packed only from a clean checkout: commit first, so the manifest names the exact source");
+      // A split's snapshot is exactly its commit (the door verifies it at the start and end of the stage); the checkout may hold anything.
+      if (!split && git(repoRoot, ["status", "--porcelain", "--untracked-files=normal"])) throw new Error("linux artifacts are packed only from a clean checkout: commit first, so the manifest names the exact source");
       let version;
       try { version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version; } catch { version = undefined; }
-      packLinuxArtifacts({ root, archive: validateLinuxArchive(target.archive), app: target.archive.name, version, commit: git(repoRoot, ["rev-parse", "HEAD"]), run });
+      packLinuxArtifacts({ root, archive: validateLinuxArchive(target.archive), app: target.archive.name, version, commit: split ? split.commit : git(repoRoot, ["rev-parse", "HEAD"]), run });
     }
     if (buildOnly || !target.install) return { built: true, installed: false, ...(staged.length ? { staged } : {}) };
     if (iosPrepared) return { built: true, installed: true, ios: installIosDevelopment(iosPrepared.install, { root, env: childEnv, run }) };
@@ -361,7 +366,11 @@ function execute(command, { root, env, dryRun, run, label, door = null }) {
   if (!inside(root, cwd)) throw new Error(`development ${label} cwd must stay inside app root`);
   const args = (command.args ?? []).map(String);
   if (dryRun) return { cmd: command.cmd, args, cwd };
-  const resolved = resolveCommand(command.cmd, args, { root, env });
+  // A pnpm step through the door is the broker's rightkit-pnpm job (or plain pnpm on a direct host), launched by name: the door never uses
+  // the node entry resolveCommand would find, so resolving pnpm's JavaScript CLI here would only fail a host that does not need it.
+  // The door's own `pnpm exec right-release` forms still resolve to this package's right-release.
+  const ownReleaseStep = (args[0] === "exec" && args[1] === "right-release") || args[0] === "right-release";
+  const resolved = door && command.cmd === "pnpm" && !ownReleaseStep ? { command: "pnpm", args } : resolveCommand(command.cmd, args, { root, env });
   // Every dev build step goes through the one door (build-launch.mjs): the door's own right-release stays in process order, a pnpm step
   // is the rightkit-pnpm broker job (by its own name, not the node entry resolveCommand finds), anything else as resolved.
   // A configured command can run code regardless of its label, so installation commands use the door too.