@rightkit/release 0.6.15 → 0.6.20

package/deterministic-scans.mjs

@@ -28,11 +28,15 @@ import { checkAdvisoryExceptions } from "./advisory-exceptions.mjs";
 import { CLIPPY_UNIVERSAL_FEATURE_FLAGS, canonicalJson, clippyBatchPlan, clippySelectionOf, digestScanSet, requiredScanIds, rustCratePlan, rustScanId } from "./scan-digest.mjs";
 import { reach } from "./lock-graph.mjs";
 import { cargoManifestState } from "./cargo-manifest-text.mjs";
+import { GRADLE_BUILD_FILE, gradleLockProblems, gradleOwnerOf } from "./gradle-lock.mjs";
+import { PYTHON_LOCK_FILE, pythonLockProblems } from "./python-lock.mjs";
+import { lockOwnerOf, packageLockProblems, xcodeProjectLockProblems } from "./swift-lock.mjs";
 import { LAUNCH_GUARD_IMPORT } from "./class-a-launch-guard.mjs";
 import { advisoryCacheRoot, ensureAdvisoryDb, prepareDenyOverlay, readAdvisoryPin } from "./advisory-db.mjs";
 import { observedEnvOf, readRequestRef, verifySnapshotReceipt, writeSnapshotRequest } from "./snapshot-request.mjs";
 import { SCAN_TOKEN_ENV, appendLedger, readLedger, scanTokenOf, unclaimedLedgers } from "./cargo-ledger.mjs";
-import { brokerSection, carryBrokerAdapter, verifyBrokerLedger } from "./snapshot-broker.mjs";
+import { brokerSection, carryBrokerAdapterAsync, verifyBrokerLedger } from "./snapshot-broker.mjs";
+import { ADMISSION_POLL_MS, CARRIED_CANCEL_GRACE_MS, QUEUED_CEILING_FACTOR, createBrokerLive, createRunClock, createStatusPoller, watchBrokerAdmission } from "./broker-admission.mjs";
 import { CANCEL_WAIT_ENV, operationDeadlineEnv } from "./broker-wire.mjs";
 import { removeCarrier } from "./carrier-census.mjs";
 
@@ -46,7 +50,7 @@ export const CHECKER_IDENTITY = (() => {
   try {
     const p = JSON.parse(fs.readFileSync(new URL("./package.json", import.meta.url), "utf8"));
     const h = crypto.createHash("sha256");
-    for (const f of ["./deterministic-scans.mjs", "./scan-digest.mjs"]) { h.update(f); h.update("\0"); h.update(fs.readFileSync(new URL(f, import.meta.url))); h.update("\0"); }
+    for (const f of ["./deterministic-scans.mjs", "./scan-digest.mjs", "./swift-lock.mjs", "./gradle-lock.mjs", "./python-lock.mjs"]) { h.update(f); h.update("\0"); h.update(fs.readFileSync(new URL(f, import.meta.url))); h.update("\0"); }
     return `${p.name}@${p.version}#${h.digest("hex").slice(0, 16)}`;
   } catch { return null; }
 })();
@@ -64,7 +68,7 @@ const PROBE_LEDGER_TOKEN = scanTokenOf("tool-probe");
 /** Scan id prefixes (the text before the first ":") that belong to each class. */
 export const CLASS_A_SCAN_PREFIXES = Object.freeze([
   "rustfmt", "node-check", "json-parse", "toml-parse", "yaml-parse", "ownership-catalog",
-  "actionlint", "shellcheck", "pnpm-lockfile", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
+  "actionlint", "shellcheck", "pnpm-lockfile", "swift-lock", "gradle-lock", "python-lock", "pnpm-audit", "cargo-metadata", "cargo-deny", "cargo-audit", "cargo-package-list",
   "changelog-version", "license", "secret-scan", "path-policy", "advisory-exceptions", "suite-api",
   // Everything mechanical and deterministic that does not compile is class A (Adrian, 2026-10-27): typecheck, lint, generated docs.
   "tsc", "eslint", "biome", "generated-docs",
@@ -314,9 +318,18 @@ export function writeTscProject({ contentRoot, packageDir, workspace, tmpdir = o
     if (typeof manifest.name !== "string" || path.resolve(dir) === path.resolve(packageDir)) continue;
     const exported = manifest.exports && typeof manifest.exports === "object" ? Object.entries(manifest.exports) : [];
     for (const [sub, target] of exported) {
-      const types = target && typeof target === "object" ? target.types : null;
+      // Types sit on the target, or under one export condition (`development` for a test-only subpath, then `default`).
+      const types = target && typeof target === "object" ? (target.types ?? target.development?.types ?? target.default?.types ?? null) : null;
       const m = typeof types === "string" ? DIST_TYPES.exec(types) : null;
       if (!m) continue;
+      // A subpath pattern (`./*` -> `./dist/*.d.ts`) maps as a TypeScript paths pattern onto the same pattern in src; the sibling
+      // must commit a src directory for it to resolve against.
+      if (sub.includes("*")) {
+        if (!sub.endsWith("*") || (sub.match(/\*/g) ?? []).length !== 1 || (m[1].match(/\*/g) ?? []).length !== 1) throw new Error(`${manifest.name} exports ${sub} with types ${types}: only one trailing * pattern maps to src`);
+        if (!fs.existsSync(path.join(dir, "src"))) throw new Error(`${manifest.name} exports ${sub} with types ${types}, and ${rel}/src does not exist`);
+        paths[`${manifest.name}${sub.slice(1)}`] = [`src/${m[1]}.ts`, `src/${m[1]}.tsx`, `src/${m[1]}/index.ts`, `src/${m[1]}/index.tsx`].map((f) => path.join(dir, f));
+        continue;
+      }
       const source = [`src/${m[1]}.ts`, `src/${m[1]}.tsx`, `src/${m[1]}/index.ts`, `src/${m[1]}/index.tsx`].map((f) => path.join(dir, f)).find((f) => fs.existsSync(f));
       if (!source) throw new Error(`${manifest.name} exports ${sub} with types ${types}, and ${rel}/src has no committed source for it`);
       paths[sub === "." ? manifest.name : `${manifest.name}${sub.slice(1)}`] = [source];
@@ -867,6 +880,14 @@ export function planScans({
   crateFeatures = {},
   // ci/gate.config.json `npm`: per-package gate settings (`quietTests`), read by the package's unit name (packages/<dir> → rightkit-<dir>).
   packageFeatures = {},
+  // rightkit#1333 (PIPELINE-ARCHITECTURE P7: no e2e through the cargo test runner): the repository-relative directories of the end-to-end crates
+  // (app-check.mjs e2eCrates: a non-optional rightkit-qa dependency and a driver module), computed by the caller from the commit's files. Such a
+  // crate's test scan keeps its id and its class B compile but runs with --no-run: its tests need a built app and run only in the qualify stage
+  // (`qa.journeys` of the release config, outside the broker), where the gate owes them (result.qualifyOwed).
+  e2eCrateDirs = null,
+  // rightkit#1332: ci/gate.config.json `swift`: { "<package dir>": { qualifyOnly: { reason } } }. A Swift package that cannot build from the bare
+  // snapshot (a prep step, a prebuilt native library) is not built by class B; it stays in result.qualifyOwed with its reason. Never silent.
+  swiftPackages = {},
   // True for full class A on the live checkout, which runs the repository's own code anyway (tests, typecheck, lint).
   liveExecution = false,
   // Crates a workspace-wide Rust change (Cargo.lock, vendor/) actually reaches, computed by the caller from
@@ -934,7 +955,7 @@ export function planScans({
   const inputDigest = sha256(canonicalJson({ files: [...files].sort().map((f) => [f, bytesDigest(f)]), refused: refusals.map((r) => r.raw).sort() }));
   const under = (prefix) => files.filter((f) => f.startsWith(prefix));
   if (!["compile", "release"].includes(tier)) throw new Error(`planScans: tier must be compile or release, not ${JSON.stringify(tier)}`);
-  let scans = []; const notes = [];
+  let scans = []; const notes = []; const qualifyOwed = [];
   if (cargoLiveRoot) notes.push(`broker host: class A cargo scans run in the snapshot as carried read-only requests, class B compiles are carried requests started from the primary checkout ${cargoLiveRoot} (uncommitted edits there never reach a scan)`);
   // A snapshot compile's scans carry its target map (item 7): the map is part of every scan's cache key, so no result cached by a
   // live-checkout run (or a compile with another map) is taken for one that writes to these directories.
@@ -945,7 +966,8 @@ export function planScans({
     scans.push(entry);
   };
   const A = SCAN_CLASS.A; const B = SCAN_CLASS.B;
-  const refuse = (what, why) => add({ id: `path-policy:${sha256(`${what}\0${why}`).slice(0, 12)}`, class: A, internal: "refuse", detail: `${what}: ${why}; refused, never run` });
+  // `unit` names the npm or Rust unit a refusal belongs to, so a unit-scoped check drops it with that unit (app-closure.mjs scopeScans).
+  const refuse = (what, why, unit = null) => add({ id: `path-policy:${sha256(`${what}\0${why}`).slice(0, 12)}`, class: A, internal: "refuse", detail: `${what}: ${why}; refused, never run`, ...(unit ? { unit } : {}) });
   for (const r of refusals) refuse(`changed path ${JSON.stringify(r.raw)}`, r.why);
   // A rust unit's name may be `<cargoDir>:<crate>`; the part that reaches argv (`-p`) is the crate, and the workspace directory is
   // checked as a plain path where the unit is registered.
@@ -1355,10 +1377,43 @@ export function planScans({
     }
     for (const dir of [...packages].sort()) {
       const id = dir === "" || dir === "." ? "swift-build" : `swift-build:${dir}`;
-      if (platform === "darwin") add({ id, class: B, tool: "swift", args: ["build"], ...(dir === "" || dir === "." ? {} : { cwd: dir }) });
+      const declared = swiftPackages?.[dir === "" ? "." : dir]?.qualifyOnly;
+      const reason = typeof declared?.reason === "string" && declared.reason.trim() !== "" ? declared.reason.replace(/\s+/g, " ").trim() : null;
+      if (declared && !reason) notes.push(`ci/gate.config.json swift.${dir}.qualifyOnly is ignored: it must be { "reason": "<why this package cannot build from the bare snapshot>" } with a non-empty reason; ${id} is planned`);
+      if (reason) { qualifyOwed.push({ id, kind: "swift-build", dir: dir === "" ? "." : dir, reason }); notes.push(`${id} is not built by class B (ci/gate.config.json swift.${dir}.qualifyOnly: ${reason}); it is owed to the qualify stage`); }
+      // The committed Package.resolved is the lockfile: like cargo --locked and pnpm --frozen-lockfile, a stale one fails here with
+      // SwiftPM's own message instead of SwiftPM rewriting it inside the snapshot (seen only after the compile as a changed tree).
+      else if (platform === "darwin") add({ id, class: B, tool: "swift", args: ["build", "--disable-automatic-resolution"], ...(dir === "" || dir === "." ? {} : { cwd: dir }) });
       else notes.push(`swift files changed in ${dir === "" || dir === "." ? "the root package" : dir}; \`swift build\` is required on the Mac host before its push`);
     }
   }
+  // Class A, file-only (rightkit swift-lock.mjs): the committed Package.resolved (or an Xcode project's) must match the declared dependencies, like
+  // cargo --locked and pnpm --frozen-lockfile (Adrian, 2026-11-01: a stale lockfile must never reach the compile). One scan per Swift package or
+  // .xcodeproj a changed file belongs to, planned on every platform and for qualify-only packages too: it reads files and builds nothing. It sets no
+  // `executes`, so a scoped class A run keeps it (app-closure.mjs scopeScans keeps file-only checks), and it never needs a live checkout.
+  const lockOwners = new Map();
+  for (const f of files) {
+    if (!(f.startsWith("swift/") || /(^|\/)(Package\.swift|Package\.resolved)$/.test(f) || /(^|\/)[^/]+\.xcodeproj\//.test(f))) continue;
+    const o = lockOwnerOf(f, { exists: (d) => exists(path.join(contentRoot, d)), ancestorDirs: ancestorDirsOf });
+    if (o) lockOwners.set(`${o.kind}:${o.dir}`, o);
+  }
+  for (const o of [...lockOwners.values()].sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0))) {
+    const resolved = o.kind === "xcode" ? `${o.dir}/project.xcworkspace/xcshareddata/swiftpm/Package.resolved` : inDir(o.dir, "Package.resolved");
+    add({ id: o.dir === "." ? "swift-lock" : `swift-lock:${o.dir}`, class: A, internal: "swift-lock", lock: o, files: [o.kind === "xcode" ? `${o.dir}/project.pbxproj` : inDir(o.dir, "Package.swift"), resolved] });
+  }
+  // The same file-only lock check for Gradle (`gradle-lock`: committed dependency locking must cover every direct dependency) and Python
+  // (`python-lock`: pins and uv/poetry locks must agree with their requirements), one scan per build root or directory a changed file belongs to.
+  const gradleRoots = new Set();
+  for (const f of files) {
+    if (!(GRADLE_BUILD_FILE.test(f) || /(^|\/)(gradle\.lockfile|libs\.versions\.toml)$/.test(f) || /(^|\/)gradle\/dependency-locks\//.test(f))) continue;
+    const g = f.includes("/gradle/") && !GRADLE_BUILD_FILE.test(f) ? f.slice(0, f.indexOf("/gradle/") + 1) + "x" : f;
+    const root = gradleOwnerOf(g, { exists: (d) => exists(path.join(contentRoot, d)), ancestorDirs: ancestorDirsOf });
+    if (root !== null) gradleRoots.add(root);
+  }
+  for (const dir of [...gradleRoots].sort()) add({ id: dir === "." ? "gradle-lock" : `gradle-lock:${dir}`, class: A, internal: "gradle-lock", dir, files: [] });
+  const pythonDirs = new Set();
+  for (const f of files) if (PYTHON_LOCK_FILE.test(f)) pythonDirs.add(path.posix.dirname(f));
+  for (const dir of [...pythonDirs].sort()) add({ id: dir === "." ? "python-lock" : `python-lock:${dir}`, class: A, internal: "python-lock", dir, files: [] });
   if (includeTests) {
     const deferredToCi = [];
     // Tests per declared feature set, serially too where the crate asks for it, as CI's gate runs them. `quietTests: true` marks
@@ -1371,9 +1426,12 @@ export function planScans({
         deferredToCi.push(...sets.map((set, i) => rustScanId.testRust(name, sets.length, i)), ...(own.alsoSerial ? sets.map((set, i) => rustScanId.testRustSerial(name, sets.length, i)) : []));
         continue;
       }
+      // An end-to-end crate compiles here and runs in qualify (P7): --no-run, the same id, the same feature sets, the same class B compile.
+      const e2e = e2eCrateDirs instanceof Set && e2eCrateDirs.has(rustDir(name));
+      if (e2e) { qualifyOwed.push({ id: rustScanId.testRust(name, sets.length, 0), kind: "e2e-crate", dir: rustDir(name), crate: crateOf(name), reason: "end-to-end crate: its tests drive a built app and never run as class B unit tests (P7)" }); notes.push(`${crateOf(name)} is an end-to-end crate: its test scan compiles with --no-run here; its tests run in the qualify stage against the built app (qa.journeys), never as class B unit tests`); }
       sets.forEach((set, i) => {
-        add({ id: rustScanId.testRust(name, sets.length, i), class: B, ...quiet, ...cargoIn(wsOf(name), "test", "-p", crateOf(name), ...set, "--locked", "--no-fail-fast") });
-        if (own.alsoSerial) add({ id: rustScanId.testRustSerial(name, sets.length, i), class: B, ...quiet, ...cargoIn(wsOf(name), "test", "-p", crateOf(name), ...set, "--locked", "--no-fail-fast", "--", "--test-threads=1") });
+        add({ id: rustScanId.testRust(name, sets.length, i), class: B, ...quiet, ...(e2e ? { e2e: true } : {}), ...cargoIn(wsOf(name), "test", "-p", crateOf(name), ...set, "--locked", ...(e2e ? ["--no-run"] : ["--no-fail-fast"])) });
+        if (own.alsoSerial) add({ id: rustScanId.testRustSerial(name, sets.length, i), class: B, ...quiet, ...(e2e ? { e2e: true } : {}), ...cargoIn(wsOf(name), "test", "-p", crateOf(name), ...set, "--locked", ...(e2e ? ["--no-run"] : ["--no-fail-fast", "--", "--test-threads=1"])) });
       });
     }
     for (const name of pkgNames) {
@@ -1429,7 +1487,7 @@ export function planScans({
         const reach = cargoReachOf({ unitDir, scripts: manifest.scripts, declared, readScripts: scriptsOf, packageDirOf });
         const hasRust = Object.keys(targetDirs).length > 0;
         if (reach.unprovable) {
-          if (hasRust) { refuse(`npm unit ${name}`, `its test reaches cargo while the compile reads a commit snapshot, and which workspace's outputs it writes cannot be proven (${reach.unprovable}); outputs must be the checkout's`); continue; }
+          if (hasRust) { refuse(`npm unit ${name}`, `its test reaches cargo while the compile reads a commit snapshot, and which workspace's outputs it writes cannot be proven (${reach.unprovable}); outputs must be the checkout's`, { npm: name }); continue; }
         } else if (reach.dir !== undefined || reach.dirs) {
           const workspaceOf = (from) => {
             let manifestDir = null;
@@ -1442,9 +1500,9 @@ export function planScans({
           };
           const found = (reach.dirs ?? [reach.dir]).map(workspaceOf);
           const unknown = found.find((f) => f.why);
-          if (unknown) { refuse(`npm unit ${name}`, unknown.why); continue; }
+          if (unknown) { refuse(`npm unit ${name}`, unknown.why, { npm: name }); continue; }
           const workspaces = [...new Set(found.map((f) => f.ws))];
-          if (workspaces.length > 1) { refuse(`npm unit ${name}`, `its test reaches cargo in more than one workspace (${workspaces.join(", ")} from ${reach.dirs.join(", ")}); one CARGO_TARGET_DIR binds the whole test, so one of them would write into another's outputs`); continue; }
+          if (workspaces.length > 1) { refuse(`npm unit ${name}`, `its test reaches cargo in more than one workspace (${workspaces.join(", ")} from ${reach.dirs.join(", ")}); one CARGO_TARGET_DIR binds the whole test, so one of them would write into another's outputs`, { npm: name }); continue; }
           cargoTarget = targetDirs[workspaces[0]];
         }
       }
@@ -1500,7 +1558,7 @@ export function planScans({
   if (dup) throw new Error(`planScans: duplicate scan id ${dup}`);
   const classDigest = (cls) => digestScanSet(scans.filter((s) => s.class === cls));
   return {
-    schema: SCAN_RESULT_SCHEMA, roots: { contentRoot, liveRoot, ...(cargoLiveRoot ? { cargoLiveRoot } : {}) }, changed: files, inputDigest, scans, notes, deferred,
+    schema: SCAN_RESULT_SCHEMA, roots: { contentRoot, liveRoot, ...(cargoLiveRoot ? { cargoLiveRoot } : {}) }, changed: files, inputDigest, scans, notes, deferred, qualifyOwed,
     scanSetDigest: digestScanSet(scans), classDigests: { A: classDigest(A), B: classDigest(B) },
   };
 }
@@ -1747,6 +1805,69 @@ export function scanTimeoutMs(scan, options = {}) {
   return scan?.class === SCAN_CLASS.B ? 60 * 60_000 : 30 * 60_000;
 }
 
+/**
+ * A scan the broker carries (rightkit#1367 step 2): on a broker host (`brokerHost`; a snapshot carrier implies one) a cargo or rustright scan, a carried Swift package build
+ * (only with the snapshot carrier: a Swift scan with no carrier is a local process), and an npm or node suite that declares a broker call (`brokerCall`: its compiles are
+ * carried requests). The broker queues and orders these; the gate neither counts them nor puts a clock on their queue time. This is the ONE test: the scheduler, the
+ * run clock, the snapshot carrier (`viaSnapshotBroker`) and the carried Swift route (`swiftBrokered`) all derive from it.
+ */
+export function isBrokerCarriedScan(scan, { brokerHost = false, snapshotBroker = null } = {}) {
+  if (brokerHost !== true && !snapshotBroker) return false;
+  if (scan?.tool === "rustright" || scan?.tool === "cargo") return true;
+  if (scan?.tool === "swift") return Boolean(snapshotBroker);
+  return Boolean(scan?.brokerCall);
+}
+
+/** Class B processes the broker never sees (npm or node test suites run on this host) are bounded here, one slot per suite; the broker bounds everything it carries (rightkit#1367 step 2). */
+export const LOCAL_CLASS_B_JOBS = 3;
+
+/**
+ * Whether a class B scan is the BROKER's to queue for scheduling: a cargo or rustright scan and a carried Swift build (isBrokerCarriedScan). An npm or node suite that merely makes broker
+ * calls (`brokerCall`) is still a process of this host, so it holds one of the local slots; only its broker calls are carried and watched.
+ */
+export function isBrokerScheduledScan(scan, ctx) {
+  return isBrokerCarriedScan(scan, ctx) && (scan?.tool === "rustright" || scan?.tool === "cargo" || scan?.tool === "swift");
+}
+
+/** The directory a class B scan works in: its `cwd`, else the package an `--dir <package>` argument names (an npm suite); null when it names none. */
+function scanDirectory(scan) {
+  if (typeof scan?.cwd === "string") return scan.cwd;
+  const at = Array.isArray(scan?.args) ? scan.args.indexOf("--dir") : -1;
+  return at >= 0 && typeof scan.args[at + 1] === "string" ? scan.args[at + 1] : null;
+}
+/**
+ * The chain a class B scan belongs to on a broker host. Scans of one component's directory share its output directory and run in plan order. A carried scan chains by its
+ * directory (the repository root, `.`, when it names none). A scan the broker never sees chains by ITS OWN package directory (else its id), never the shared `.` chain, so the
+ * local limit counts real suites and a root build never waits behind them.
+ */
+export function classBChainKey(scan, carried) {
+  const dir = scanDirectory(scan);
+  return carried ? (dir ?? ".") : `local:${dir ?? scan?.id ?? "."}`;
+}
+
+/**
+ * Class B on a broker host (rightkit#1367 step 2): one chain per component, its scans in plan order (compile, doc, tests: they share the component's output directory),
+ * every chain started at once. A broker-carried scan starts without a count; the broker queues and orders it. A scan the broker never sees (an npm or node suite) holds one
+ * of `localJobs` local slots while it runs. `run(index)` runs one scan and never rejects.
+ */
+export async function scheduleBrokerHostClassB({ scans, lanes, carried, localJobs, run }) {
+  const chains = new Map();
+  for (const lane of ["compile", "doc", "tests"]) {
+    for (const i of lanes[lane] ?? []) { const key = classBChainKey(scans[i], carried(scans[i])); if (!chains.has(key)) chains.set(key, []); chains.get(key).push(i); }
+  }
+  const limit = Math.max(1, Number(localJobs) || 1);
+  let held = 0; const waiters = [];
+  const take = async () => { while (held >= limit) await new Promise((resolve) => waiters.push(resolve)); held += 1; };
+  const free = () => { held -= 1; waiters.shift()?.(); };
+  await Promise.all([...chains.values()].map(async (chain) => {
+    for (const i of chain) {
+      const local = !carried(scans[i]);
+      if (local) await take();
+      try { await run(i); } finally { if (local) free(); }
+    }
+  }));
+}
+
 export function laneOf(scan) {
   if (/^(clippy|check|check-features|check-dependent):/.test(scan.id)) return "compile";
   if (/^doc:/.test(scan.id)) return "doc";
@@ -1940,6 +2061,22 @@ const INTERNAL = {
     for (const f of s.files) { try { parse(ctx.read(f)); } catch (e) { bad.push(`${f}: ${String(e.message).split("\n")[0]}`); } }
     return bad;
   },
+  // File-only SwiftPM lockfile check (swift-lock.mjs): runs no SwiftPM, reads Package.swift / project.pbxproj and Package.resolved as committed.
+  "swift-lock": (s, ctx) => {
+    const exists = (f) => ctx.deps.exists(path.join(ctx.contentRoot, f));
+    return s.lock.kind === "xcode" ? xcodeProjectLockProblems({ project: s.lock.dir, read: ctx.read, exists }) : packageLockProblems({ dir: s.lock.dir, read: ctx.read, exists });
+  },
+  // File-only Gradle dependency-locking check (gradle-lock.mjs): no Gradle is run.
+  "gradle-lock": (s, ctx) => gradleLockProblems({
+    dir: s.dir, read: ctx.read, exists: (f) => ctx.deps.exists(path.join(ctx.contentRoot, f)),
+    list: (d) => ctx.deps.readdir(path.join(ctx.contentRoot, d), { withFileTypes: true }).map((e) => ({ name: e.name, isDir: e.isDirectory() })),
+  }),
+  // File-only Python lock check (python-lock.mjs): no pip, uv or poetry is run.
+  "python-lock": async (s, ctx) => {
+    let parseToml;
+    try { parseToml = await ctx.deps.loadToml(); } catch (e) { return { missing: `TOML parser unavailable: ${e.message}` }; }
+    return pythonLockProblems({ dir: s.dir, names: ctx.deps.readdir(path.join(ctx.contentRoot, s.dir)).map(String), read: ctx.read, parseToml });
+  },
   "yaml-parse": async (s, ctx) => {
     let parse;
     try { parse = await ctx.deps.loadYaml(); } catch (e) { return { missing: `YAML parser unavailable: ${e.message}` }; }
@@ -2005,8 +2142,18 @@ const INTERNAL = {
  * GB-52: a carried scan's client gets an operation deadline BEFORE the scan's own limit, so the client cancels the job by id and watches its terminal state (within a 15 s cancel wait)
  * instead of being killed with the job still running; a user-set RUSTRIGHT_OPERATION_DEADLINE_MS or cancel wait is never replaced.
  */
+/** A span for a message: whole seconds under a minute, minutes from then on. */
+export const spanText = (ms) => (ms < 60_000 ? `${Math.max(0, Math.round(ms / 1000))} s` : `${Math.round(ms / 60_000)} min`);
+export const scanOperationDeadlineMs = (limitMs) => Math.max(Math.floor(limitMs / 2), limitMs - 20_000);
+/**
+ * What a carried Swift scan gives carryBrokerAdapterAsync: an UNWATCHED one passes its own limit as the client's operation deadline (the env, and `deadlineMs`, which also bounds the
+ * retry wait); a watched one passes neither (the stopwatch and the ceiling bound it, and the client's deadline is absolute from its start).
+ */
+export function carriedCallBudget({ env, limitMs, watched }) {
+  return watched ? { env: {} } : { env: scanOperationEnv(env, limitMs), deadlineMs: scanOperationDeadlineMs(limitMs) };
+}
 export function scanOperationEnv(env, limitMs) {
-  const deadline = operationDeadlineEnv({ env, deadlineMs: Math.max(Math.floor(limitMs / 2), limitMs - 20_000) });
+  const deadline = operationDeadlineEnv({ env, deadlineMs: scanOperationDeadlineMs(limitMs) });
   if (Object.keys(deadline).length === 0) return {};
   return { ...deadline, ...(Object.keys(env ?? {}).some((k) => k.toUpperCase() === CANCEL_WAIT_ENV) ? {} : { [CANCEL_WAIT_ENV]: "15000" }) };
 }
@@ -2070,6 +2217,14 @@ export async function runScans(plan, options = {}) {
   const ordered = [...selected.filter((s) => s.class === SCAN_CLASS.A), ...selected.filter((s) => s.class === SCAN_CLASS.B)];
   const ctx = { deps, contentRoot, read: (f) => deps.readFile(path.join(contentRoot, f)) };
   const cargoReadsAreCarried = Boolean(deps.snapshotBroker) || options.cargoReadsCarried === true;
+  // A broker host: the gate says so (options.brokerHost, from its executor) and a snapshot carrier implies it. One predicate (isBrokerCarriedScan) names the scans the broker carries.
+  const brokerHost = options.brokerHost === true || Boolean(deps.snapshotBroker);
+  const carriedCtx = { brokerHost, snapshotBroker: deps.snapshotBroker ?? null };
+  // The broker's live state of a request (queued or running), through an ASYNCHRONOUS client call: the gate's own reader when it hands one, else the carrier's client.
+  const brokerLive = options.brokerLive ?? (brokerHost && typeof deps.snapshotBroker?.client === "string" ? createBrokerLive({ client: deps.snapshotBroker.client, env: deps.env, spawn: defaultSpawnAsync, platform: deps.platform }) : null);
+  // One reader for the whole run: every watched scan registers with it (first read after 1 s, then every 5 s, two reads in flight at most), instead of a client spawn per scan.
+  const pollMs = options.brokerPollMs ?? ADMISSION_POLL_MS;
+  const statusPoller = brokerLive ? createStatusPoller({ live: brokerLive, intervalMs: pollMs }) : null;
   const toolVersions = {}; const toolIdentities = {}; const probed = new Map(); const advisoryDbs = new Map();
   const results = [];
   // The gate-owned cargo ledger of a wrapped snapshot compile (options.cargoLedger = { dir }): every call the wrapper decided, filed
@@ -2097,7 +2252,8 @@ export async function runScans(plan, options = {}) {
   // excluding every class A scan (or a plan with none) never unlocks class B; explicit prior evidence is needed.
   const planA = plan.scans.filter((x) => x.class === SCAN_CLASS.A);
   const inCallA = classes.includes(SCAN_CLASS.A) && planA.length > 0 && selected.filter((x) => x.class === SCAN_CLASS.A).length === planA.length;
-  const classBBlocked = !inCallA && !priorClassAValid;
+  // `classAEarlier`: the caller ran full class A of these same bytes once, before this call (the door's check stage before its compile pass, rightkit#1328).
+  const classBBlocked = !inCallA && !priorClassAValid && options.classAEarlier !== true;
 
   const toolCommand = (tool) => (tool === "node" ? deps.execPath : tool === "rustfmt" ? deps.findRustfmt({ env: deps.env, exists: deps.exists, readdir: deps.readdir, platform: deps.platform, spawn: deps.lookupSpawn }) : tool);
   async function probe(tool, scanDir = null) {
@@ -2118,13 +2274,20 @@ export async function runScans(plan, options = {}) {
       // A version probe is bounded (PROBE_TIMEOUT_MS): a hung tool reads as unavailable instead of holding a lane, or a quiet
       // lease, open.
       const probeMs = Number.isFinite(options.probeTimeoutMs) && options.probeTimeoutMs > 0 ? options.probeTimeoutMs : PROBE_TIMEOUT_MS;
-      const probeSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(probeMs)]) : AbortSignal.timeout(probeMs);
+      const signalFor = (ms) => (signal ? AbortSignal.any([signal, AbortSignal.timeout(ms)]) : AbortSignal.timeout(ms));
       // The gate's own version probes reach the wrapper too (cargo is first on PATH): they are filed under the probe token, which the
       // gate claims and checks like a scan's.
       const probeLedgerEnv = cargoLedger ? { [SCAN_TOKEN_ENV]: PROBE_LEDGER_TOKEN } : {};
       if (cargoLedger) claimedTokens.add(PROBE_LEDGER_TOKEN);
-      const r = await deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd, env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0", ...probeLedgerEnv }, signal: probeSignal });
-      if (!r || r.error || r.status !== 0) outcome = { ok: false, why: r?.error?.message ?? `exit ${r?.status}` };
+      const probeOnce = (ms) => deps.spawn(command, PROBES[tool] ?? ["--version"], { cwd, env: { ...deps.env, ...PNPM_NO_HOOKS_ENV, COREPACK_ENABLE_AUTO_PIN: "0", ...probeLedgerEnv }, signal: signalFor(ms) });
+      // One retry, with three times the bound, when only the bound stopped it (the run itself was not aborted).
+      let r = await probeOnce(probeMs);
+      if (r?.cancelled && !signal?.aborted) r = await probeOnce(probeMs * 3);
+      // A probe stopped by its own timeout (not by the run being aborted) says the host was busy, not that the tool is missing: it is
+      // named as a timeout and not remembered, so the next scan probes again (on a loaded Dell `cargo --version` outlived the 60 s
+      // bound while three compiles ran, and the cached failure then failed every later class B row at 0 s, hrwin 4ccadec2).
+      const timedOut = Boolean(r?.cancelled) && !signal?.aborted;
+      if (!r || r.error || r.status !== 0) outcome = { ok: false, transient: timedOut, why: timedOut ? `${tool} --version did not answer within ${Math.round(probeMs / 1000)} s and again within ${Math.round((probeMs * 3) / 1000)} s (host busy)` : r?.error?.message ?? `exit ${r?.status}` };
       else {
         const text = String(r.stdout || r.stderr || "");
         const version = PROBE_VERSION[tool] ? PROBE_VERSION[tool](text) : text.split(/\r?\n/).find((l) => l.trim())?.trim() ?? "unknown";
@@ -2134,7 +2297,7 @@ export async function runScans(plan, options = {}) {
       }
     }
     toolVersions[tool] = outcome.ok ? outcome.version : null;
-    probed.set(tool, outcome);
+    if (!outcome.transient) probed.set(tool, outcome);
     return outcome;
   }
 
@@ -2209,11 +2372,15 @@ export async function runScans(plan, options = {}) {
     const slots = new Array(bScans.length);
     const lanes = { compile: [], doc: [], tests: [], quiet: [] };
     bScans.forEach((s, i) => lanes[laneOf(s)].push(i));
-    // RightKit is many components, never one build (Adrian, 2026-10-29; rightkit#1285): class B scans of different components run
-    // concurrently, `classBJobs` at a time (the broker queues beyond its build capacity). A component is the directory a scan runs in
-    // (`cwd`, its own Cargo workspace and output directory); scans of one component stay in plan order, because they share its
-    // output directory and cargo locks it.
-    const bJobs = Math.max(1, Number(options.classBJobs ?? 1) || 1);
+    // RightKit is many components, never one build (Adrian, 2026-10-29; rightkit#1285). A component is the directory a scan runs in (`cwd`, its
+    // own Cargo workspace and output directory); scans of one component stay in plan order, because they share its output directory and cargo
+    // locks it.
+    // Direct host: class B scans of different components run `classBJobs` at a time (nothing else bounds work there), compile, doc, then tests.
+    // Broker host (options.brokerHost; rightkit#1367 step 2, Adrian 2026-11-01: "the broker manages the how many builds happen. That is not the
+    // job of the gate"): the scans the broker carries start with no count and no lane-wide wait, each component running its own chain while the
+    // broker queues and orders them. A scan the broker never sees (an npm or node test suite) is a process of this host: those keep the local limit.
+    const bJobs = Math.max(1, Number(options.classBJobs ?? (brokerHost ? LOCAL_CLASS_B_JOBS : 1)) || 1);
+    const failedRow = (i, error) => ({ id: bScans[i].id, class: bScans[i].class, command: bScans[i].command, tool: bScans[i].tool ?? null, toolVersion: null, status: "fail", code: "SCAN_ERROR", detail: String(error?.message ?? error) });
     const drain = async (queue, extraEnv = null) => {
       const busy = new Set(); const running = new Set();
       const keyOf = (i) => bScans[i].cwd ?? ".";
@@ -2223,14 +2390,21 @@ export async function runScans(plan, options = {}) {
         const [i] = queue.splice(at, 1); const key = keyOf(i); busy.add(key);
         // A scan that throws becomes a failed row: with several components in flight, a rejection must not abandon the others.
         const job = runOne(bScans[i], extraEnv)
-          .catch((error) => ({ id: bScans[i].id, class: bScans[i].class, command: bScans[i].command, tool: bScans[i].tool ?? null, toolVersion: null, status: "fail", code: "SCAN_ERROR", detail: String(error?.message ?? error) }))
+          .catch((error) => failedRow(i, error))
           .then((row) => { slots[i] = row; }).finally(() => { busy.delete(key); running.delete(job); });
         running.add(job);
       }
     };
-    await drain(lanes.compile);
-    await drain(lanes.doc);
-    await drain(lanes.tests);
+    if (brokerHost) {
+      await scheduleBrokerHostClassB({
+        scans: bScans, lanes, localJobs: bJobs, carried: (scan) => isBrokerScheduledScan(scan, carriedCtx),
+        run: async (i) => { try { slots[i] = await runOne(bScans[i]); } catch (error) { slots[i] = failedRow(i, error); } },
+      });
+    } else {
+      await drain(lanes.compile);
+      await drain(lanes.doc);
+      await drain(lanes.tests);
+    }
     if (lanes.quiet.length) {
       // One lease per quiet suite, as in class A above.
       for (const i of lanes.quiet) {
@@ -2337,7 +2511,8 @@ export async function runScans(plan, options = {}) {
           let cacheKey = null;
           // A cargo request that builds the commit snapshot through the broker (options.snapshotBroker) is never served from or written
           // to the scan cache: each run must carry its own request and verify the broker's own signed evidence.
-          const viaSnapshotBroker = Boolean(deps.snapshotBroker) && s.root === "cargoLive" && (s.tool === "rustright" || s.tool === "cargo");
+          const carriedScan = isBrokerCarriedScan(s, carriedCtx);
+          const viaSnapshotBroker = carriedScan && Boolean(deps.snapshotBroker) && s.root === "cargoLive" && (s.tool === "rustright" || s.tool === "cargo");
           const carriedRead = cargoReadsAreCarried && s.class === SCAN_CLASS.A && (s.tool === "rustright" || s.tool === "cargo"); // a snapshot compile never reuses a cargo read either
           if (cache && !viaSnapshotBroker && !carriedRead) {
             try {
@@ -2427,7 +2602,20 @@ export async function runScans(plan, options = {}) {
           }
           const limitMs = scanTimeoutMs(s, options);
           const timer = new AbortController();
-          const clock = setTimeout(() => timer.abort(), limitMs);
+          // The scan's run limit is a stopwatch. A scan the broker carries (class B, not a quiet suite under its lease) is watched: the stopwatch does not tick while
+          // every request of the scan is QUEUED at the broker (broker-admission.mjs), so queue time is neither charged to the scan nor bounded by a gate allowance.
+          // Without a live reader (no client to ask) the stopwatch simply runs, and every unwatched carried scan gives its client the scan's own limit as the operation deadline
+          // (RUSTRIGHT_OPERATION_DEADLINE_MS: the snapshot carrier, a rustright or cargo call, a carried Swift call through deadlineMs), so the client cancels by id before the gate stops it.
+          const watched = carriedScan && s.class === SCAN_CLASS.B && s.quiet !== true && brokerLive !== null;
+          let admission = null; let graceTimer = null; let genRefDir = null; let clockExpired = false;
+          // A carried scan is cancelled by id first and its process tree stopped only after a grace; any other scan is stopped at once.
+          const stopScan = () => {
+            clockExpired = true;
+            if (admission) { admission.cancelKnown().catch(() => {}); graceTimer = setTimeout(() => timer.abort(), options.brokerCancelGraceMs ?? CARRIED_CANCEL_GRACE_MS); } else timer.abort();
+          };
+          // A watched scan also has ONE wall-clock ceiling, its own limit x QUEUED_CEILING_FACTOR: a safety stop for a wedged broker queue (the broker's job deadlines are off by default), not a count.
+          const runClock = createRunClock({ limitMs, onExpire: stopScan, ...(watched ? { ceilingMs: limitMs * QUEUED_CEILING_FACTOR, onCeiling: stopScan } : {}) });
+          const stopClock = () => { runClock.stop(); admission?.stop(); if (graceTimer) clearTimeout(graceTimer); if (genRefDir) { fs.rmSync(genRefDir, { recursive: true, force: true }); genRefDir = null; } };
           const scanSignal = signal ? AbortSignal.any([signal, timer.signal]) : timer.signal;
           // A class A test row runs under the launch guard (class-a-launch-guard.mjs): its Node processes may not launch a compile.
           // Every class A row that executes repository code (tests, lint/typecheck with repository config, generators) runs under the
@@ -2440,12 +2628,12 @@ export async function runScans(plan, options = {}) {
           // build directory is the gate's own, keyed by the repository and the scan so it stays warm.
           // GB-67: on a broker host the scan is the carried `rightkit-swift` adapter job and the broker owns SwiftPM's scratch (it appends the one managed path and the
           // product location is `build --show-bin-path`): the gate sends no scratch or build path, and never adds one. Only a host with no broker (Linux direct) keeps its own.
-          const swiftBrokered = s.tool === "swift" && Boolean(deps.snapshotBroker);
+          const swiftBrokered = carriedScan && s.tool === "swift" && Boolean(deps.snapshotBroker);
           // The adapter takes exactly one relative --package-path (adapter.rs check_swift_package); the scan runs in its package directory, so that is `.`.
           if (swiftBrokered && finalArgs[0] === "build" && !finalArgs.some((a) => a === "--package-path" || a.startsWith("--package-path="))) finalArgs.splice(1, 0, "--package-path", ".");
           if (s.tool === "swift" && finalArgs[0] === "build" && !swiftBrokered && !finalArgs.some((a) => a === "--scratch-path" || a === "--build-path" || a.startsWith("--scratch-path=") || a.startsWith("--build-path="))) {
             try { finalArgs.push("--scratch-path", swiftScratchPath({ tmpRoot, roots: [contentRoot, liveRoot, cargoLiveRoot], id: s.id })); }
-            catch (e) { advisory?.cleanup?.(); return { ...row, status: "fail", code: "SWIFT_SCRATCH", detail: `${s.id}: ${e.message}` }; }
+            catch (e) { stopClock(); advisory?.cleanup?.(); return { ...row, status: "fail", code: "SWIFT_SCRATCH", detail: `${s.id}: ${e.message}` }; }
           }
           let carrier = null;
           if (viaSnapshotBroker) {
@@ -2456,7 +2644,7 @@ export async function runScans(plan, options = {}) {
               const cargoArgv = s.tool === "rustright" ? finalArgs.slice(1) : finalArgs;
               const made = writeSnapshotRequest({ controlRoot: sb.controlRoot, commit: sb.commit, snapshot: sb.snapshot, declaredInputs: sb.declaredInputs ?? [], handle: sb.handle, primaryCwd: fs.realpathSync.native(cwd), argv: cargoArgv, requestIdFile: path.join(refDir, "request.json") });
               carrier = { made, refDir, cargoArgv };
-            } catch (e) { fs.rmSync(refDir, { recursive: true, force: true }); clearTimeout(clock); advisory?.cleanup?.(); return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} could not be written: ${e.message}` }; }
+            } catch (e) { fs.rmSync(refDir, { recursive: true, force: true }); stopClock(); advisory?.cleanup?.(); return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} could not be written: ${e.message}` }; }
           }
           // From here to the end of its verification the carrier and the request reference are this request's: every exit (cancel,
           // timeout, a thrown spawn, a refused receipt) removes them.
@@ -2479,32 +2667,59 @@ export async function runScans(plan, options = {}) {
             let marked = null; let why = null;
             try { if (typeof deps.snapshotBroker.markBrokerSubmit !== "function") throw new Error("no build-ownership submit hook"); marked = deps.snapshotBroker.markBrokerSubmit(sub); } catch (e) { why = e.message; }
             if (marked?.broker?.submitted !== true || marked.handle !== deps.snapshotBroker.handle || !marked.broker.handles?.includes(sub)) {
-              clearTimeout(clock); advisory?.cleanup?.();
+              stopClock(); advisory?.cleanup?.();
               return { ...row, status: "fail", code: "SNAPSHOT_REQUEST", detail: `the snapshot request for ${s.id} was not sent: the build ownership did not record the broker submit under ${deps.snapshotBroker.handle}${why ? ` (${why})` : ""}` };
             }
           }
           if (swiftBrokered) {
             // One signed, ledgered adapter request in the commit's snapshot (the ownership records its sub-handle before it is sent); a refused or unverified call fails the scan.
+            // The carry is asynchronous (the gate's other scans keep running while this one queues or builds) and takes the scan's own signal: the run limit, or a cancel, stops it.
+            const swiftRefs = [];
+            const swiftBudget = carriedCallBudget({ env: { ...deps.env, ...s.env }, limitMs, watched });
+            if (watched) { admission = watchBrokerAdmission({ clock: runClock, refFiles: () => swiftRefs, live: brokerLive, poller: statusPoller }); admission.start(); }
             try {
-              const carried = carryBrokerAdapter({ adapter: "rightkit-swift", words: finalArgs, cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}) }, section: brokerSection(deps.snapshotBroker), record: (entry) => { if (cargoLedger && ledgerToken) appendLedger(cargoLedger.dir, ledgerToken, entry); }, err: () => {}, stdio: "capture" });
+              const carried = await carryBrokerAdapterAsync({ adapter: "rightkit-swift", words: finalArgs, cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...s.env, ...(extraEnv ?? {}), ...swiftBudget.env }, ...(swiftBudget.deadlineMs !== undefined ? { deadlineMs: swiftBudget.deadlineMs } : {}), section: brokerSection(deps.snapshotBroker), record: (entry) => { if (typeof entry.requestRef === "string" && !swiftRefs.includes(entry.requestRef)) swiftRefs.push(entry.requestRef); if (cargoLedger && ledgerToken) appendLedger(cargoLedger.dir, ledgerToken, entry); }, err: () => {}, stdio: "capture", signal: scanSignal, spawn: deps.adapterSpawn ?? defaultSpawnAsync });
               r = { status: carried.status, stdout: carried.stdout, stderr: carried.stderr };
-            } catch (e) { r = { error: e }; } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+            } catch (e) { r = { error: e }; } finally { stopClock(); advisory?.cleanup?.(); }
           } else {
           // The executables this scan runs are the ones resolved and verified above: read their bytes again now, immediately before the launch
           // (a replaced binary is TOOL_REPLACED), and hand the scan only those paths: actionlint its shellcheck, cargo its cargo-deny / cargo-audit.
           for (const identity of identities) {
             const swapped = trustedScanToolProblem(identity, { ops: options.toolOps });
-            if (swapped) { clearTimeout(clock); advisory?.cleanup?.(); return { ...row, status: "fail", code: swapped.code, detail: `${swapped.code}: ${swapped.detail}; the scan did not run` }; }
+            if (swapped) { stopClock(); advisory?.cleanup?.(); return { ...row, status: "fail", code: swapped.code, detail: `${swapped.code}: ${swapped.detail}; the scan did not run` }; }
           }
           const shellcheckIdentity = s.tool === "actionlint" ? identities.find((i) => i.tool === "shellcheck") : null;
           const spawnArgs = shellcheckIdentity ? ["-shellcheck", shellcheckIdentity.path, ...finalArgs] : finalArgs;
           const trustedDirs = trusts.map((tool) => identities.find((i) => i.tool === tool)).filter(Boolean).map((i) => path.dirname(i.path));
           const pathKey = Object.keys({ ...deps.env, ...s.env }).find((k) => k.toLowerCase() === "path") ?? "PATH";
-          const trustEnv = trustedDirs.length ? { [pathKey]: [...trustedDirs, ({ ...deps.env, ...s.env })[pathKey]].filter(Boolean).join(deps.platform === "win32" ? ";" : ":") } : {};
-          try { r = await deps.spawn(p.command, spawnArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...readTargetEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}), ...(carrier ? scanOperationEnv({ ...deps.env, ...s.env }, limitMs) : {}), ...trustEnv }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
+          // The gate's cargo wrapper stays first on PATH, ahead of the trusted directories: an enrolled analyzer's directory may also hold
+          // a real cargo (cargo-deny in ~/.cargo/bin beside rustup's cargo), which would otherwise answer the scan's `cargo` unbound and,
+          // with several workspaces, write into the sentinel (rightkit#1327).
+          const scanPath = ({ ...deps.env, ...s.env })[pathKey];
+          const pathSep = deps.platform === "win32" ? ";" : ":";
+          const scanCargo = ({ ...deps.env, ...s.env }).CARGO;
+          const wrapperBin = (cargoLedger || options.cargoSentinel) && typeof scanCargo === "string" && typeof scanPath === "string" ? (deps.platform === "win32" ? path.win32 : path.posix).dirname(scanCargo) : null;
+          const wrapperFirst = wrapperBin !== null && scanPath.split(pathSep)[0] === wrapperBin;
+          const trustEnv = trustedDirs.length ? { [pathKey]: (wrapperFirst ? [wrapperBin, ...trustedDirs, scanPath.slice(wrapperBin.length + 1)] : [...trustedDirs, scanPath]).filter(Boolean).join(pathSep) } : {};
+          // A watched scan names where its client writes the request id (RUSTRIGHT_REQUEST_ID_FILE) so the gate can ask the broker for it: the carrier's own reference, a file of its own for
+          // a scan that reaches the broker through `rustright cargo`, or the reference files its carried calls record in the cargo ledger (an npm suite with a broker call).
+          let refEnv = {};
+          if (watched) {
+            let refFiles;
+            if (carrier) refFiles = () => [path.join(carrier.refDir, "request.json")];
+            else if (s.tool === "rustright" || s.tool === "cargo") { genRefDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-scanreq-")); const file = path.join(genRefDir, "request.json"); refEnv = { RUSTRIGHT_REQUEST_ID_FILE: file }; refFiles = () => [file]; }
+            else refFiles = () => { try { return ledgerToken && cargoLedger ? readLedger(cargoLedger.dir, ledgerToken).entries.filter((e) => e.status === "pending" && typeof e.requestRef === "string").map((e) => e.requestRef) : []; } catch { return []; } };
+            admission = watchBrokerAdmission({ clock: runClock, refFiles, live: brokerLive, poller: statusPoller });
+            admission.start();
+          }
+          try { r = await deps.spawn(p.command, spawnArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...readTargetEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}), ...refEnv, ...(carriedScan && !watched ? scanOperationEnv({ ...deps.env, ...s.env }, limitMs) : {}), ...trustEnv }, signal: scanSignal, ...(watched ? {} : { timeout: limitMs }) }); } finally { stopClock(); advisory?.cleanup?.(); }
           }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };
-          if ((timer.signal.aborted || r?.error?.code === "ETIMEDOUT") && (!r || r.error || r.status !== 0)) return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} ran longer than ${Math.round(limitMs / 60000)} min and was killed with its process tree; a scan that does not finish fails` };
+          if ((clockExpired || timer.signal.aborted || r?.error?.code === "ETIMEDOUT") && (!r || r.error || r.status !== 0)) {
+            const how = `was ${admission ? "cancelled at the broker by id and stopped" : "killed"} with its process tree; a scan that does not finish fails`;
+            if (runClock.ceilingHit) return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} hit its wall-clock ceiling while it waited in the broker's queue (${spanText(limitMs * QUEUED_CEILING_FACTOR)}: ${QUEUED_CEILING_FACTOR} x its ${spanText(limitMs)} run limit, a safety stop for a wedged broker queue, not a count; it had waited ${spanText(runClock.queuedMs)} in the queue) and ${how}` };
+            return { ...row, status: "fail", code: "TIMEOUT", detail: `${s.id} ran longer than its ${spanText(limitMs)} run limit${runClock.queuedMs > 0 ? ` (the ${spanText(runClock.queuedMs)} it waited in the broker's queue does not count)` : ""} and ${how}` };
+          }
           if (!r || r.error) { status = "fail"; code = "SPAWN_ERROR"; detail = r?.error?.message ?? "no result"; }
           else if (r.status !== 0) { status = "fail"; code = "EXIT"; detail = tail(r) || `exit ${r.status}`; }
           // cargo-deny reports some failures only as an [ERROR] line and still exits 0 (under the broker, its nested offline
@@ -2540,7 +2755,7 @@ export async function runScans(plan, options = {}) {
               const ref = readRequestRef(path.join(carrier.refDir, "request.json"));
               const receipt = await deps.snapshotBroker.receiptOf(ref.requestId);
               const { evidence } = verifySnapshotReceipt(receipt, { pins: deps.snapshotBroker.pins, jobId: ref.requestId, carrier: carrier.made.carrier, argv: carrier.cargoArgv, workspace: ref.workspace, observedEnv: observedEnvOf({ ...deps.env, ...s.env, ...(extraEnv ?? {}) }, deps.platform ?? process.platform), checkout: deps.snapshotBroker.checkout, outputRoots: deps.snapshotBroker.outputRoots, platform: deps.snapshotBroker.platform ?? deps.platform ?? process.platform });
-              row.snapshotEvidence = { requestId: ref.requestId, outputDir: evidence.outputDir, treeAtStart: evidence.snapshot.treeAtStart, treeAtExit: evidence.snapshot.treeAtExit };
+              row.snapshotEvidence = { requestId: ref.requestId, outputDir: evidence.outputDir, cargoDir: s.cwd ?? ".", treeAtStart: evidence.snapshot.treeAtStart, treeAtExit: evidence.snapshot.treeAtExit };
             } catch (e) {
               status = "fail"; code = "SNAPSHOT_EVIDENCE"; detail = `${s.id}: the broker's snapshot evidence did not verify (${e.code ?? "error"}: ${e.message})`;
             }

package/development.mjs

@@ -519,6 +519,14 @@ export function resolvePnpmCli({ root, env = process.env } = {}) {
   }
   // Unix global pnpm exposes its JavaScript entry through a PATH symlink.
   for (const dir of String(env.PATH ?? env.Path ?? "").split(path.delimiter).filter(Boolean)) candidates.push(path.join(dir, "pnpm"));
+  // pnpm >= 11 installed through pnpm/action-setup or `npm install -g pnpm` puts a native executable behind the PATH name (and behind npm_execpath);
+  // its package keeps the JavaScript entry Corepack loads beside it at bin/pnpm.mjs, which is the entry to launch under the current node.
+  for (const candidate of [...candidates]) {
+    try {
+      const resolved = realpathSync(candidate);
+      if (!/pnpm\.(?:mjs|cjs|js)$/i.test(resolved)) candidates.push(path.join(path.dirname(resolved), "bin", "pnpm.mjs"), path.join(path.dirname(resolved), "..", "pnpm", "bin", "pnpm.mjs"));
+    } catch { /* an absent candidate is skipped */ }
+  }
   const selected = candidates.map(resolveJavaScriptEntrypoint).find(Boolean);
   if (!selected) throw new Error("could not resolve pnpm JavaScript CLI entrypoint; install/pin pnpm through Corepack");
   return selected;

package/disk-policy.mjs

@@ -338,9 +338,9 @@ export const BUDGET_PARTS = ["targets", "sccache", "cargoHome", "toolchains", "t
 
 /** RustRight's build budget (`buildBudget` of `rustright doctor --json --no-scan`, all parts in bytes), or null when RustRight is
  * missing, fails, times out or answers with anything else. Nothing is cached and no shell is used. */
-export function readRustrightBudget({ run = spawnSync } = {}) {
+export function readRustrightBudget({ run = spawnSync, platform = process.platform } = {}) {
   try {
-    const launch = brokerClientInvocation("rustright", ["doctor", "--json", "--no-scan"], { encoding: "utf8", timeout: 20_000, shell: false, maxBuffer: 1 << 24 }, { probe: run });
+    const launch = brokerClientInvocation("rustright", ["doctor", "--json", "--no-scan"], { encoding: "utf8", timeout: 20_000, shell: false, maxBuffer: 1 << 24 }, { probe: run, platform });
     const r = run(launch.command, launch.args, launch.options);
     if (!r || r.error || r.status !== 0) return null;
     const budget = JSON.parse(String(r.stdout)).buildBudget;