updates

ober

aaf272c131b4517849007e932626df19893ae098

diff --git a/data/anti-patterns.sexp b/data/anti-patterns.sexp
index e3be7cb..9bb14da 100644
--- a/data/anti-patterns.sexp
+++ b/data/anti-patterns.sexp
@@ -818,4 +818,25 @@
      "jerboa_security_scan"
      "jerboa_howto"
      "jerboa_verify"
-     "rg")))
+     "rg"))
+ (("advice"
+    .
+    "Keep the original pipe fd and wrap it directly with open-fd-input-port or open-fd-output-port, then transcode the binary port if text I/O is needed. Reopening /dev/fd can change blocking/lifetime behavior and leave builtin-to-external pipelines hanging.")
+   ("avoid"
+     .
+     "Do not turn an inherited pipe fd into a /dev/fd path and reopen it inside a thread that is implementing in-process pipeline stages.")
+   ("id" . "pipeline-dev-fd-reopen-deadlock")
+   ("kinds" "module" "debug-error")
+   ("pattern"
+     .
+     "/dev/fd/.*open-file-(input|output)-port|open-(input|output)-file.*dev/fd")
+   ("severity" . "high")
+   ("tags" "pipeline" "fd" "thread" "open-fd-input-port"
+     "deadlock" "jsh")
+   ("title"
+     .
+     "Reopening pipe fds through /dev/fd can deadlock shell pipeline threads")
+   ("tools"
+     "jerboa_check_balance"
+     "jerboa_verify"
+     "jerboa_run_tests")))
diff --git a/data/cookbooks.sexp b/data/cookbooks.sexp
index 18dc907..b8e8181 100644
--- a/data/cookbooks.sexp
+++ b/data/cookbooks.sexp
@@ -6187,12 +6187,12 @@
      "Bundle lazy optional libraries in static cross builds"))
  (("code"
     .
-    "# Avoid gen-embed prompting for an encrypted ~/.embed when verifying builds.\n# Run without a TTY and point JSH_EMBED at a path that does not exist.\nJSH_EMBED=/tmp/jsh-empty-embed make jsh-macos-minimal\n\n# Smoke-test the resulting binary.\n./jsh-macos-minimal -c 'echo ok'") ("id" . "jsh-minimal-build-with-empty-embed") ("imports")
+    "# Avoid gen-embed prompting for an encrypted ~/.embed when verifying builds.\n# Run without a TTY and point JSH_EMBED at an empty directory.\nmkdir -p /tmp/jsh-empty-embed\nJSH_EMBED=/tmp/jsh-empty-embed make jsh-macos-base\n\n# Smoke-test the resulting binary.\n./jsh-macos-base -c 'echo ok'") ("id" . "jsh-minimal-build-with-empty-embed") ("imports")
    ("notes"
      .
-     "If ~/.embed exists and the build has a TTY, gen-embed prompts for the embed encryption passphrase. For CI or verification runs where embed contents are not under test, use a non-interactive command and override JSH_EMBED to an empty/nonexistent path so Makefile generates empty embed-data.sls. The build may still warn about Cargo global cache cleanup permissions; that warning is non-fatal if compilation continues.")
-   ("tags" "jsh" "build" "embed" "minimal" "macos"
+     "If ~/.embed exists and the build has a TTY, gen-embed may prompt for the embed encryption passphrase. For CI or verification runs where embed contents are not under test, override JSH_EMBED to an empty directory so the Makefile generates empty embed-data.sls. The build may still warn about Cargo global cache cleanup permissions; that warning is non-fatal if compilation continues.")
+   ("tags" "jsh" "build" "embed" "base" "macos"
      "noninteractive")
    ("title"
      .
-     "Build jsh minimal without embed passphrase prompt")))
+     "Build jsh base without embed passphrase prompt")))