@joshuafolkken/kit 1.1050.0 → 1.1128.0

package/dist/hooks/{chunk-5BK3K7V4.js → chunk-M7QKEKWO.js}

@@ -1,31 +1,29 @@
 import {
   ALREADY_DONE_LABEL,
-  BREAKING_CHANGE_LABEL,
-  BUGFIX_LABEL,
   CONTEXT_CUT_THRESHOLD,
-  ENHANCEMENT_LABEL,
-  FULL_PAGE_QUERY,
   IN_PROGRESS_LABEL,
   NEEDS_DECISION_LABEL,
   NEEDS_HUMAN_REVIEW_LABEL,
+  PORCELAIN_FLAG,
   RECENT_REQUEST_WINDOW,
-  RELEASE_CLASSIFICATION_NAMES,
   agent_role_profile,
   agent_session_environment,
   bash_triggers,
+  cli_flags,
   error_text,
   filing_cap,
-  gh_failure,
   git_command,
-  git_gh_api_path,
-  git_gh_exec,
+  git_common_directory,
+  git_gh_command,
+  git_gh_issue_read,
+  git_gh_pr_read,
+  git_spawn_sync,
   has_any_label,
-  has_stderr_field,
   issue_cite,
   lane_background,
   lane_park,
   lane_registry,
-  parse_json_array_or_undefined,
+  open_issue_schema,
   parse_json_object_safe,
   read_json_listing,
   repo_origin,
@@ -34,36 +32,34 @@ import {
   run_cut,
   run_headless,
   run_hold,
-  run_progress_clock,
   run_tail,
-  run_watcher_guard,
   shell_segments,
   tail_commands
-} from "./chunk-RLDX5SOC.js";
+} from "./chunk-AIOIOMPX.js";
 import {
   find_local_bin_upwards
 } from "./chunk-3V37IID6.js";
 import {
   batch_outcome
-} from "./chunk-GQ7KP45M.js";
+} from "./chunk-XYUIQOW3.js";
 import {
   investigation_refusal
-} from "./chunk-DMQN45FN.js";
+} from "./chunk-7HVB7SZG.js";
 import {
   duplicate_read_outcome
-} from "./chunk-HJIISEAC.js";
+} from "./chunk-5SD2YM7Z.js";
 import {
   investigation_reads
-} from "./chunk-EJDX2TOB.js";
+} from "./chunk-NXYMNPUQ.js";
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-NJQOBE6L.js";
+} from "./chunk-QVLT52OV.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-WQ4OSBSS.js";
+} from "./chunk-MKVGBQPA.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -75,10 +71,10 @@ import {
   lane_paths,
   stamp_file,
   time_shell
-} from "./chunk-7VPDUBRN.js";
+} from "./chunk-4JZDP5X5.js";
 
 // scripts/rules/direct-filing.ts
-var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api \u2026/issues` or `gh issue create`. The command runs every filing step in order \u2014 the duplicate scout, the body lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing into another repository, and `epic:bundle` after the create \u2014 so none of them is a step to remember. When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,\u2026>` for the ones that are separate deliverables. Reference: `docs/josh-commands.md` \u2192 "`josh issue:file`". **This rule fires on every occurrence, not once per run.**';
+var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api \u2026/issues` or `gh issue create`. The command runs every filing step in order \u2014 the duplicate scout, the body lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing into another repository, and `epic:bundle` after the create \u2014 so none of them is a step to remember. When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,\u2026>` for the ones that are separate deliverables. Reference: `docs/josh-commands-automation.md` \u2192 "`josh issue:file`". **This rule fires on every occurrence, not once per run.**';
 function is_any_filing(command) {
   return bash_triggers.is_direct_filing(command) || bash_triggers.is_issue_filing(command);
 }
@@ -204,7 +200,6 @@ var run_progress = {
   format_line,
   format_next_line,
   format_next_report,
-  format_record,
   format_report,
   is_due,
   minutes_from,
@@ -212,16 +207,140 @@ var run_progress = {
   observation_key
 };
 
+// scripts/run/run-progress-clock.ts
+import { z } from "zod";
+var PROGRESS_PREFIX = "josh-run-progress-";
+var LIFE_PREFIX = "josh-run-progress-life-";
+var LOG_SUFFIX = ".log";
+var LOG_KEEP = 12;
+var MS_PER_MINUTE2 = 6e4;
+var LOG_STALE_MINUTES = 90;
+var LOG_STALE_MS = LOG_STALE_MINUTES * MS_PER_MINUTE2;
+var BLOCK_SEPARATOR = "\n\n";
+var report_stamp_schema = z.object({ reported_at: z.string(), line: z.string().optional() });
+function parse_stamp(raw) {
+  const parsed = report_stamp_schema.safeParse(JSON.parse(raw));
+  if (!parsed.success) return void 0;
+  const reported_at = Date.parse(parsed.data.reported_at);
+  return Number.isNaN(reported_at) ? void 0 : reported_at;
+}
+function read_last_line(target) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return void 0;
+  try {
+    return report_stamp_schema.safeParse(JSON.parse(raw)).data?.line;
+  } catch {
+    return void 0;
+  }
+}
+function read_last_report(target) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return void 0;
+  try {
+    return parse_stamp(raw);
+  } catch {
+    return void 0;
+  }
+}
+function log_path_of(target) {
+  return `${target}${LOG_SUFFIX}`;
+}
+function is_log_stale(target, now_ms) {
+  const previous_ms = read_last_report(target);
+  return previous_ms === void 0 || now_ms - previous_ms > LOG_STALE_MS;
+}
+function recent_blocks(log_target2, is_fresh) {
+  if (is_fresh) return [];
+  const raw = stamp_file.read_stamp_text(log_target2);
+  if (raw === void 0) return [];
+  return raw.split(BLOCK_SEPARATOR).map((block) => block.trimEnd()).filter((block) => block.length > 0);
+}
+function append_line(log_target2, reported_at, line, is_fresh) {
+  const block = `${reported_at}
+${line}`;
+  const blocks = [...recent_blocks(log_target2, is_fresh), block].slice(-LOG_KEEP);
+  stamp_file.write_text_stamp(log_target2, `${blocks.join(BLOCK_SEPARATOR)}
+`);
+}
+function mark(target, now_ms, line) {
+  const reported_at = new Date(now_ms).toISOString();
+  const kept = line ?? read_last_line(target);
+  if (line !== void 0) {
+    append_line(log_path_of(target), reported_at, line, is_log_stale(target, now_ms));
+  }
+  stamp_file.write_stamp(target, kept === void 0 ? { reported_at } : { reported_at, line: kept });
+}
+function stamp_target_of(git_directory) {
+  return stamp_file.stamp_path(PROGRESS_PREFIX, git_directory);
+}
+function life_target_of(git_directory) {
+  return stamp_file.stamp_path(LIFE_PREFIX, git_directory);
+}
+var life_schema = z.object({ alive: z.literal(true), pinged_at: z.string().optional() });
+function begin_life(target) {
+  stamp_file.write_stamp(target, { alive: true, pinged_at: (/* @__PURE__ */ new Date()).toISOString() });
+}
+function ping_life(target) {
+  begin_life(target);
+}
+function parse_pinged_at(raw) {
+  const parsed = life_schema.safeParse(JSON.parse(raw));
+  if (!parsed.success || parsed.data.pinged_at === void 0) return void 0;
+  const pinged_ms = Date.parse(parsed.data.pinged_at);
+  return Number.isNaN(pinged_ms) ? void 0 : pinged_ms;
+}
+function is_life_fresh(target, threshold_ms) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return false;
+  try {
+    const pinged_ms = parse_pinged_at(raw);
+    return pinged_ms !== void 0 && Date.now() - pinged_ms < threshold_ms;
+  } catch (error) {
+    error_text.trace_swallowed("run_progress_clock.is_life_fresh", error);
+    return false;
+  }
+}
+function is_life_ended(target) {
+  return stamp_file.read_stamp_text(target) === void 0;
+}
+function end_life(target) {
+  stamp_file.remove_stamp(target);
+}
+function stamp_target_sync() {
+  const directory = git_common_directory.own();
+  return directory === void 0 ? void 0 : stamp_target_of(directory);
+}
+function read_last_report_sync() {
+  const target = stamp_target_sync();
+  return target === void 0 ? void 0 : read_last_report(target);
+}
+var run_progress_clock = {
+  LIFE_PREFIX,
+  LOG_KEEP,
+  LOG_STALE_MS,
+  begin_life,
+  end_life,
+  is_life_ended,
+  is_life_fresh,
+  life_target_of,
+  log_path_of,
+  mark,
+  parse_stamp,
+  ping_life,
+  read_last_line,
+  read_last_report,
+  read_last_report_sync,
+  stamp_target_of
+};
+
 // scripts/run/run-progress-config.ts
 import { readFileSync } from "node:fs";
 import path from "node:path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 var PACKAGE_FILE = "package.json";
-var CONFIG_FIELD = "josh";
-var INTERVAL_FIELD = "progress_interval_minutes";
 var MAX_DEPTH = 10;
-var package_schema = z.object({
-  josh: z.object({ progress_interval_minutes: z.number().positive() }).optional()
+var package_schema = z2.object({
+  josh: z2.object({ progress_interval_minutes: z2.number().positive() }).optional()
 });
 function ancestors_of(start) {
   const directories = [];
@@ -258,8 +377,6 @@ function configured_interval_ms(directory = process.cwd()) {
   return resolve_interval_ms(void 0, directory);
 }
 var run_progress_config = {
-  CONFIG_FIELD,
-  INTERVAL_FIELD,
   PACKAGE_FILE,
   configured_interval_ms,
   read_package_minutes,
@@ -323,7 +440,7 @@ function decide(call, run2, can_record) {
   if (can_record) ARM_RECORD.record(target, lands_ms);
   return false;
 }
-var EARLY_HEARTBEAT_REASON = '\u26D4 early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours to keep. `pnpm josh run:progress --wait` waits the interval out for you (`JOSH_PROGRESS_INTERVAL_MINUTES`, or `josh.progress_interval_minutes` in `package.json`, default 20 minutes), prints the five labelled lines and exits \u2014 start it in the background, relay the lines it printed when it exits, and start the next one. Two timers armed at once is what produced reports 3\u20135 minutes apart on a 15-minute setting (joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a child\'s completion woke the run, and `--mark` recorded each report without anything refusing the early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run `pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says. If you are waiting on something rather than on a clock, wait on the thing itself \u2014 `pnpm josh followup` waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` \u2192 "Progress while the run is quiet". **This rule fires on every early arm, not once per run**, so reissuing the same sleep will be refused again.';
+var EARLY_HEARTBEAT_REASON = "\u26D4 early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours to keep. `pnpm josh run:progress --wait` keeps it for you (`JOSH_PROGRESS_INTERVAL_MINUTES`, or `josh.progress_interval_minutes` in `package.json`, default 20 minutes): start it once in the background and it reports the five labelled lines to the run's event stream on its own, without waking you \u2014 relay nothing, and start it again only after it exits, which it does when newly runnable work arrives. Two timers armed at once is what produced reports 3\u20135 minutes apart on a 15-minute setting (joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a child's completion woke the run, and `--mark` recorded each report without anything refusing the early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run `pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says. If you are waiting on something rather than on a clock, wait on the thing itself \u2014 `pnpm josh followup` waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` \u2192 \"Progress while the run is quiet\". **This rule fires on every early arm, not once per run**, so reissuing the same sleep will be refused again.";
 var PROGRESS_NAMES = /* @__PURE__ */ new Set(["run:progress"]);
 var WATCH_FLAG = /(?:^|\s)--(?:wait|once)(?=\s|$)/u;
 function is_progress_watch_segment(segment) {
@@ -406,10 +523,7 @@ var ROW2 = {
 var file_body = {
   FILE_BODY_REASON,
   ROW: ROW2,
-  carries_a_file_body,
-  is_in_place_perl,
-  is_interpreter_write,
-  writes_existing_file
+  carries_a_file_body
 };
 
 // scripts/rules/gh-api.ts
@@ -424,8 +538,11 @@ var REPO_GROUP = 2;
 function is_gh_api(segment) {
   return GH_API_COMMAND.test(segment);
 }
+function method_of(segment) {
+  return API_METHOD.exec(segment)?.[1]?.toUpperCase();
+}
 function is_read(segment) {
-  const method = API_METHOD.exec(segment)?.[1];
+  const method = method_of(segment);
   if (method !== void 0) return method.toUpperCase() === READ_METHOD;
   return !API_FIELD.test(segment);
 }
@@ -437,7 +554,7 @@ function repo_target(segment) {
   if (match === null) return void 0;
   return { owner: match[OWNER_GROUP] ?? "", repo: match[REPO_GROUP] ?? "" };
 }
-var gh_api = { GH_API_COMMAND, GH_FLAGS, is_gh_api, is_read, is_write, repo_target };
+var gh_api = { GH_FLAGS, is_gh_api, is_read, is_write, method_of, repo_target };
 
 // scripts/rules/git-argv.ts
 var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u;
@@ -447,7 +564,8 @@ var WRAPPER_WORDS = /* @__PURE__ */ new Set([
   "exec",
   "run",
   "sudo",
-  "command"
+  "command",
+  "env"
 ]);
 var SUBSHELL_OPEN = "(";
 var VALUE_TAKING_GLOBALS = /* @__PURE__ */ new Set([
@@ -487,11 +605,15 @@ function after_globals(words, start) {
   }
   return index;
 }
-function parse(segment) {
+function arguments_of(segment, command) {
   const words = words_of(segment);
-  const git_index = after_wrapper(words);
-  if (words[git_index] !== GIT_COMMAND) return void 0;
-  const subcommand_index = after_globals(words, git_index + NEXT);
+  const command_index = after_wrapper(words);
+  return words[command_index] === command ? words.slice(command_index + NEXT) : void 0;
+}
+function parse(segment) {
+  const words = arguments_of(segment, GIT_COMMAND);
+  if (words === void 0) return void 0;
+  const subcommand_index = after_globals(words, 0);
   return { subcommand: words[subcommand_index], args: words.slice(subcommand_index + NEXT) };
 }
 var SHORT_CLUSTER = /^-[A-Za-z]+$/u;
@@ -503,7 +625,7 @@ function short_cluster_has(token, letters) {
   }
   return false;
 }
-var git_argv = { parse, short_cluster_has, words_of };
+var git_argv = { arguments_of, parse, short_cluster_has };
 
 // scripts/rules/git-force.ts
 var FORCE_LONG_PREFIX = "--force";
@@ -542,42 +664,32 @@ var ROW3 = {
 var git_force = {
   GIT_FORCE_REASON,
   ROW: ROW3,
-  is_branch_delete,
-  is_force_or_delete,
-  is_force_or_delete_push
+  is_force_or_delete
 };
 
 // scripts/cost-runtime/cost-cli.ts
 import { fileURLToPath } from "node:url";
-import { parseArgs } from "node:util";
 
 // scripts/cost-runtime/codex-usage.ts
 import { globSync, readFileSync as readFileSync2 } from "node:fs";
 import path2 from "node:path";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var THREAD_ID_PATTERN = /^[A-Za-z0-9-]+$/u;
-var SESSION_META_SCHEMA = z2.looseObject({
-  type: z2.literal("session_meta"),
-  payload: z2.looseObject({ id: z2.string(), cwd: z2.string() })
+var SESSION_META_SCHEMA = z3.looseObject({
+  type: z3.literal("session_meta"),
+  payload: z3.looseObject({ id: z3.string(), cwd: z3.string() })
 });
-var TOTAL_USAGE_SCHEMA = z2.looseObject({ input_tokens: z2.number().nonnegative() });
-var TOKEN_COUNT_SCHEMA = z2.looseObject({
-  type: z2.literal("event_msg"),
-  payload: z2.looseObject({
-    type: z2.literal("token_count"),
-    info: z2.looseObject({
+var TOTAL_USAGE_SCHEMA = z3.looseObject({ input_tokens: z3.number().nonnegative() });
+var TOKEN_COUNT_SCHEMA = z3.looseObject({
+  type: z3.literal("event_msg"),
+  payload: z3.looseObject({
+    type: z3.literal("token_count"),
+    info: z3.looseObject({
       total_token_usage: TOTAL_USAGE_SCHEMA,
       last_token_usage: TOTAL_USAGE_SCHEMA
     })
   })
 });
-function decode(line) {
-  try {
-    return JSON.parse(line);
-  } catch {
-    return void 0;
-  }
-}
 function same_project(cwd, target) {
   return cost_transcript.session_cwd(cwd) === cost_transcript.session_cwd(target);
 }
@@ -585,7 +697,7 @@ function billed_per_request(usages) {
   return usages.map((usage) => usage.last_token_usage.input_tokens);
 }
 function measurement_from(content, target, thread_id) {
-  const values = content.split("\n").map((line) => decode(line));
+  const values = content.split("\n").map((line) => json_value.parse_or_undefined(line));
   const metadata = values.flatMap((value) => {
     const parsed = SESSION_META_SCHEMA.safeParse(value);
     return parsed.success ? [parsed.data] : [];
@@ -736,11 +848,9 @@ function mainline_records(pairs) {
   return [...groups.values()];
 }
 var cost_corpus = {
-  accumulate_missing,
   load_corpus,
   attribute_corpus,
   floor_for_issue,
-  dedupe_across_sessions,
   attributed,
   mainline_records
 };
@@ -830,8 +940,8 @@ function selected_threshold(values) {
 function threshold_option(over) {
   return over === void 0 ? {} : { over };
 }
-function path_option(path7) {
-  return path7 === void 0 ? {} : { path: path7 };
+function path_option(path10) {
+  return path10 === void 0 ? {} : { path: path10 };
 }
 function to_options(values) {
   if (values.cut === true && values.over !== void 0) return void 0;
@@ -845,12 +955,8 @@ var PARSE_ARGS_OPTIONS = {
   path: { type: "string" }
 };
 function parse_options(argv) {
-  try {
-    const { values } = parseArgs({ args: [...argv], options: PARSE_ARGS_OPTIONS, strict: true });
-    return to_options(values);
-  } catch {
-    return void 0;
-  }
+  const values = cli_flags.values_of(argv, PARSE_ARGS_OPTIONS);
+  return values === void 0 ? void 0 : to_options(values);
 }
 function report_empty(cwd, session_id) {
   const searched = cost_transcript.searched_directories(cost_transcript.transcript_directories(cwd));
@@ -947,11 +1053,8 @@ var cost_cli = {
   USAGE,
   parse_options,
   to_threshold,
-  load_corpus: cost_corpus.load_corpus,
-  attributed: cost_corpus.attributed,
   run,
-  session_verdict,
-  main
+  session_verdict
 };
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET));
 
@@ -970,16 +1073,13 @@ function format_share(part, whole) {
   return `${(part / whole * PERCENT_SCALE).toFixed(PERCENT_DECIMALS)}%`;
 }
 var cost_format = {
-  USD_DECIMALS,
-  PERCENT_SCALE,
-  PERCENT_DECIMALS,
   format_usd,
   format_tokens,
   format_share
 };
 
 // scripts/rules/implementation-cut-verdict.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var VERDICT_CACHE_PREFIX = "josh-impl-cut-verdict-";
 var VERDICT_REUSE_MS = 5e3;
 var VERDICT_VALUES = [
@@ -987,7 +1087,7 @@ var VERDICT_VALUES = [
   "under",
   "unmeasurable"
 ];
-var cache_schema = z3.object({ read_at_ms: z3.number(), verdict: z3.enum(VERDICT_VALUES) });
+var cache_schema = z4.object({ read_at_ms: z4.number(), verdict: z4.enum(VERDICT_VALUES) });
 function cache_path(directory) {
   return stamp_file.stamp_path(VERDICT_CACHE_PREFIX, directory);
 }
@@ -1083,7 +1183,6 @@ var implementation_cut = {
   REISSUE_WINDOW_MS,
   ROW: ROW4,
   decide: decide2,
-  is_edit_tool,
   is_over_threshold_edit,
   is_reissued_refusal,
   takes_the_impl_cut,
@@ -1159,20 +1258,20 @@ var lane_carry_conflict = {
 };
 
 // scripts/agent/interactive-ask.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var INTERACTIVE_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion"]);
 function is_interactive_tool(name) {
   return INTERACTIVE_TOOLS.has(name);
 }
-var OPTION_SCHEMA = z4.looseObject({ label: z4.string().optional() });
-var QUESTION_SCHEMA = z4.looseObject({
-  question: z4.string().optional(),
-  options: z4.array(OPTION_SCHEMA).optional()
+var OPTION_SCHEMA = z5.looseObject({ label: z5.string().optional() });
+var QUESTION_SCHEMA = z5.looseObject({
+  question: z5.string().optional(),
+  options: z5.array(OPTION_SCHEMA).optional()
 });
-var ASK_INPUT_SCHEMA = z4.looseObject({ questions: z4.array(QUESTION_SCHEMA).optional() });
-var DENIAL_SCHEMA = z4.looseObject({
-  tool_name: z4.string().optional(),
-  tool_input: z4.unknown().optional()
+var ASK_INPUT_SCHEMA = z5.looseObject({ questions: z5.array(QUESTION_SCHEMA).optional() });
+var DENIAL_SCHEMA = z5.looseObject({
+  tool_name: z5.string().optional(),
+  tool_input: z5.unknown().optional()
 });
 var UNKNOWN_QUESTION = "(question text unavailable)";
 var OPTION_SEPARATOR = " / ";
@@ -1198,7 +1297,7 @@ function refused_ask_of(permission_denials) {
   if (questions.length === 0) return void 0;
   return questions.map((question) => render_question(question)).join(QUESTION_SEPARATOR);
 }
-var interactive_ask = { INTERACTIVE_TOOLS, is_interactive_tool, refused_ask_of };
+var interactive_ask = { is_interactive_tool, refused_ask_of };
 
 // scripts/rules/lane-interactive-ask.ts
 function is_interactive_ask(call, is_lane_child = lane_child_marker.is_child_of(process.cwd())) {
@@ -1257,6 +1356,108 @@ var lane_switch_main = {
   switch_targets
 };
 
+// scripts/run/run-stage.ts
+var KICKOFF = "kickoff";
+var HALFRUN = "halfrun";
+var PRRUN = "prrun";
+var FULLRUN = "fullrun";
+var COMMANDS = [KICKOFF, HALFRUN, PRRUN, FULLRUN];
+var DEFAULT_COMMAND = FULLRUN;
+var FRESH = "fresh";
+var PLANNED = "planned";
+var HALFRUN_STOPPED = "halfrun-stopped";
+var PRRUN_STOPPED = "prrun-stopped";
+var MERGED = "merged";
+var STATES = [FRESH, PLANNED, HALFRUN_STOPPED, PRRUN_STOPPED, MERGED];
+var REACHED = "reached";
+var STARTS = {
+  [FRESH]: "plan",
+  [PLANNED]: "implement",
+  [HALFRUN_STOPPED]: "gate",
+  [PRRUN_STOPPED]: "followup",
+  [MERGED]: REACHED
+};
+var START_TOKENS = [...new Set(Object.values(STARTS))];
+var ENDS = {
+  [KICKOFF]: "plan posted",
+  [HALFRUN]: "gated, before the commit",
+  [PRRUN]: "green, mergeable PR",
+  [FULLRUN]: "merged"
+};
+var NEXT_PREFIX = "Next: ";
+var NEXT_SEPARATOR = " | ";
+var STATE_HEADER = "Issue state";
+var CELL_ARROW = " \u2192 ";
+var REACHED_CELL = "reached \u2014 report and stop";
+function to_command(value) {
+  return COMMANDS.find((command) => command === value);
+}
+function state_of(facts) {
+  if (facts.is_closed) return MERGED;
+  if (facts.is_prrun_stopped) return PRRUN_STOPPED;
+  if (facts.is_halfrun_stopped) return HALFRUN_STOPPED;
+  return facts.is_planned ? PLANNED : FRESH;
+}
+function decide3(state, command) {
+  const is_reached = STATES.indexOf(state) > COMMANDS.indexOf(command);
+  const start = is_reached ? REACHED : STARTS[state];
+  return { state, command, start, end: ENDS[command], is_reached };
+}
+function next_commands(command) {
+  return COMMANDS.slice(COMMANDS.indexOf(command) + 1);
+}
+function next_line(command, issue) {
+  const commands = next_commands(command).map((next) => `${next} #${issue}`);
+  return `${NEXT_PREFIX}${commands.join(NEXT_SEPARATOR)}`;
+}
+function format_decision(issue, decision) {
+  const fields = [`at: ${decision.state}`, `to: ${decision.command}`, `start: ${decision.start}`];
+  return `stage #${issue} \u2014 ${fields.join(" \xB7 ")}`;
+}
+function cell(state, command) {
+  const decision = decide3(state, command);
+  return decision.is_reached ? REACHED_CELL : `${decision.start}${CELL_ARROW}${decision.end}`;
+}
+function table_rows() {
+  const header = [STATE_HEADER, ...COMMANDS.map((command) => `\`${command}\``)];
+  const rows = STATES.map((state) => [
+    `\`${state}\``,
+    ...COMMANDS.map((command) => cell(state, command))
+  ]);
+  return [header, ...rows];
+}
+var run_stage = {
+  COMMANDS,
+  DEFAULT_COMMAND,
+  FRESH,
+  HALFRUN,
+  HALFRUN_STOPPED,
+  KICKOFF,
+  MERGED,
+  PLANNED,
+  PRRUN,
+  PRRUN_STOPPED,
+  REACHED,
+  START_TOKENS,
+  STATES,
+  decide: decide3,
+  format_decision,
+  next_commands,
+  next_line,
+  state_of,
+  table_rows,
+  to_command
+};
+
+// scripts/rules/decision-oracle-stage.ts
+var RUN_ENTRY_ORACLE = {
+  name: "run:entry",
+  decision: "Where a run on an issue starts, and whether the typed command has already been reached",
+  args: "<N> [--to kickoff|halfrun|prrun|fullrun]",
+  vocabulary: run_stage.START_TOKENS,
+  single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72k"
+};
+
 // scripts/rules/decision-oracle.ts
 var CHAIN_RULE_MD = ".claude/skills/workflow-commands/chain-rule.md";
 var BACKLOGRUN_PROGRESS_MD = ".claude/skills/workflow-commands/backlogrun-progress.md";
@@ -1264,11 +1465,11 @@ var SKILL_2E = ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72e";
 var SPLIT_ASSESSMENT_QUESTION = ".claude/skills/workflow-commands/split-assessment.md \u2192 The question";
 var PRE_GATE_CUT_MD = ".claude/skills/workflow-commands/pre-gate-cut.md";
 var BACKLOGRUN_MD = ".claude/skills/workflow-commands/backlogrun.md";
-var RUN_MERGE_REFERENCE = "docs/josh-commands.md \u2192 `josh run:merge`";
-var EPIC_NEXT_REFERENCE = "docs/josh-commands.md \u2192 `josh epic:next`";
-var BACKLOG_BUDGET_REFERENCE = "docs/josh-commands.md \u2192 `josh backlog:budget`";
-var RUN_LIVENESS_REFERENCE = "docs/josh-commands.md \u2192 `josh run:liveness`";
-var AUTO_OK_NEXT_REFERENCE = "docs/josh-commands.md \u2192 `josh auto-ok:next`";
+var RUN_MERGE_REFERENCE = "docs/josh-commands-automation.md \u2192 `josh run:merge`";
+var EPIC_NEXT_REFERENCE = "docs/josh-commands-automation.md \u2192 `josh epic:next`";
+var BACKLOG_BUDGET_REFERENCE = "docs/josh-commands-automation.md \u2192 `josh backlog:budget`";
+var RUN_LIVENESS_REFERENCE = "docs/josh-commands-automation.md \u2192 `josh run:liveness`";
+var AUTO_OK_NEXT_REFERENCE = "docs/josh-commands-automation.md \u2192 `josh auto-ok:next`";
 var RUN_CUT_CMD = "run:cut";
 var REQUIRED = "required";
 var SKIP = "skip";
@@ -1520,15 +1721,16 @@ var DECISION_ORACLES = [
     decision: "Whether an epic's declaration matches its recorded relations, and the repair when it does not",
     args: "--reconcile <E>",
     vocabulary: [RECONCILED, NOTHING_TO_RECONCILE],
-    single_source: "docs/josh-commands.md \u2192 `josh epic --reconcile`"
+    single_source: "docs/josh-commands-automation.md \u2192 `josh epic --reconcile`"
   },
   {
     name: "lane:list",
     decision: "Whether each in-progress issue holds a live lane, and the two-directional difference",
     args: "",
     vocabulary: [LIVE, STOPPED, UNKNOWN],
-    single_source: "docs/josh-commands.md \u2192 The `in-progress` / lane difference"
-  }
+    single_source: "docs/josh-commands-automation.md \u2192 The `in-progress` / lane difference"
+  },
+  RUN_ENTRY_ORACLE
 ];
 function get_command(oracle) {
   return oracle.command ?? oracle.name;
@@ -1591,6 +1793,7 @@ var NOT_NAMED = /* @__PURE__ */ new Map([
   ["epic:next", READ],
   ["run:merge", PHASE],
   ["run:step", SELF],
+  ["run:entry", SELF],
   ["refactor:scan", PHASE],
   ["split:assess", PHASE],
   ["sonar:hotspots", READ],
@@ -1643,7 +1846,330 @@ function row_for(oracle, firing_point) {
   };
 }
 var ROWS = oracle_firing.firing_oracles().map(({ oracle, firing_point }) => row_for(oracle, firing_point));
-var oracle_consulted = { ROWS, command_line, reason_for, row_for, runs_the_oracle };
+var oracle_consulted = { ROWS, reason_for };
+
+// scripts/rules/destructive-command.ts
+var RM_COMMAND = "rm";
+var RECURSIVE_LONG = "--recursive";
+var RECURSIVE_LETTERS = "rR";
+var FORCE_LONG = "--force";
+var FORCE_LETTER = "f";
+function has_flag(args, long, letters) {
+  return args.some((argument) => argument === long || git_argv.short_cluster_has(argument, letters));
+}
+function is_recursive_forced_rm(segment) {
+  const args = git_argv.arguments_of(segment, RM_COMMAND);
+  if (args === void 0) return false;
+  return has_flag(args, RECURSIVE_LONG, RECURSIVE_LETTERS) && has_flag(args, FORCE_LONG, FORCE_LETTER);
+}
+var GH_COMMAND = "gh";
+var REPO_GROUP2 = "repo";
+var REPO_REMOVALS = /* @__PURE__ */ new Set(["delete", "archive"]);
+var REPO_EDIT = "edit";
+var VISIBILITY_FLAG = "--visibility";
+var PR_GROUP = "pr";
+var PR_CLOSE = "close";
+function is_destructive_repo_action(action, args) {
+  if (REPO_REMOVALS.has(action)) return true;
+  return action === REPO_EDIT && args.some((argument) => argument.startsWith(VISIBILITY_FLAG));
+}
+function is_destructive_gh_command(args) {
+  const [group, action = ""] = args;
+  if (group === PR_GROUP) return action === PR_CLOSE;
+  return group === REPO_GROUP2 && is_destructive_repo_action(action, args);
+}
+var DELETE_METHOD = "DELETE";
+var REPOSITORY_PATH = "repos/";
+var ISSUE_LABEL_PATH = /^['"]?\/?repos\/[^/\s'"]+\/[^/\s'"]+\/issues\/\d+\/labels\/[^/\s'"]+['"]?$/u;
+function is_destructive_api_call(args) {
+  const call = [GH_COMMAND, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || gh_api.method_of(call) !== DELETE_METHOD) return false;
+  return args.some(
+    (argument) => argument.includes(REPOSITORY_PATH) && !ISSUE_LABEL_PATH.test(argument)
+  );
+}
+function is_destructive_gh(segment) {
+  const args = git_argv.arguments_of(segment, GH_COMMAND);
+  if (args === void 0) return false;
+  return is_destructive_gh_command(args) || is_destructive_api_call(args);
+}
+function is_destructive_segment2(segment) {
+  return is_recursive_forced_rm(segment) || is_destructive_gh(segment);
+}
+function is_destructive_command(command) {
+  return shell_segments.segments_of(command).some((segment) => is_destructive_segment2(segment));
+}
+var DESTRUCTIVE_COMMAND_REASON = "\u26D4 destructive command: a recursive forced `rm` (`rm -rf`, `rm -fr`, `rm -r -f`, `rm --recursive --force`), `gh repo delete` / `archive`, `gh repo edit --visibility`, `gh pr close`, or a `gh api -X DELETE repos/\u2026` call deletes or closes something that cannot be restored, which is Tier C and needs explicit current-turn user instruction (`prompts/collaboration-workflow/operating-rules.md`). The `.claude/settings.json` deny list matches prefix globs, so it misses these spellings; this row reads the argv instead. Remove a file or directory one path at a time without `-f`, or ask the user to run the command in their own terminal. `gh issue close` and removing a label from an Issue (`DELETE repos/<o>/<r>/issues/<N>/labels/<name>`) are not refused. **This rule fires on every occurrence, not once per run.**";
+var ROW10 = {
+  id: "destructive-command",
+  is_trigger: bash_triggers.on_bash_command(is_destructive_command),
+  reason: DESTRUCTIVE_COMMAND_REASON,
+  decide: () => true
+};
+var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW10, is_destructive_command };
+
+// scripts/rules/worktree-guard.ts
+var CHECKOUT_SUBCOMMAND = "checkout";
+var RESTORE_SUBCOMMAND = "restore";
+var STASH_SUBCOMMAND = "stash";
+var PATHSPEC_SEPARATOR = "--";
+function is_worktree_checkout(args) {
+  return args.includes(PATHSPEC_SEPARATOR);
+}
+var STAGED_LONG = "--staged";
+var STAGED_LETTER = "S";
+var WORKTREE_LONG = "--worktree";
+var WORKTREE_LETTER = "W";
+function touches_worktree(args) {
+  const is_staged = args.some(
+    (argument) => argument === STAGED_LONG || git_argv.short_cluster_has(argument, STAGED_LETTER)
+  );
+  const is_worktree = args.some(
+    (argument) => argument === WORKTREE_LONG || git_argv.short_cluster_has(argument, WORKTREE_LETTER)
+  );
+  return !is_staged || is_worktree;
+}
+var PUSH_STASH = "push";
+var MESSAGE_LONG = "--message";
+var MESSAGE_SHORT_LETTER = "m";
+var READ_ONLY_STASH = /* @__PURE__ */ new Set(["list", "show"]);
+function has_message(args) {
+  return args.some(
+    (argument) => argument === MESSAGE_LONG || argument.startsWith(`${MESSAGE_LONG}=`) || git_argv.short_cluster_has(argument, MESSAGE_SHORT_LETTER)
+  );
+}
+function is_unauthorized_stash(args) {
+  const [stash_subcommand, ...rest] = args;
+  if (stash_subcommand === void 0) return true;
+  if (READ_ONLY_STASH.has(stash_subcommand)) return false;
+  if (stash_subcommand === PUSH_STASH) return !has_message(rest);
+  return true;
+}
+var CLEAN_SUBCOMMAND = "clean";
+var FORCE_LONG2 = "--force";
+var FORCE_LETTER2 = "f";
+function is_forced_clean(args) {
+  return args.some(
+    (argument) => argument === FORCE_LONG2 || git_argv.short_cluster_has(argument, FORCE_LETTER2)
+  );
+}
+var JUDGED_SUBCOMMANDS = /* @__PURE__ */ new Map([
+  [CHECKOUT_SUBCOMMAND, is_worktree_checkout],
+  [RESTORE_SUBCOMMAND, touches_worktree],
+  [CLEAN_SUBCOMMAND, is_forced_clean],
+  [STASH_SUBCOMMAND, is_unauthorized_stash]
+]);
+function is_unauthorized_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  return JUDGED_SUBCOMMANDS.get(call.subcommand ?? "")?.(call.args) === true;
+}
+function is_unauthorized_worktree_change(command) {
+  return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
+}
+var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced `git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
+var ROW11 = {
+  id: "worktree-mutation",
+  is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
+  reason: WORKTREE_MUTATION_REASON,
+  decide: () => true
+};
+var worktree_guard = {
+  ROW: ROW11,
+  WORKTREE_MUTATION_REASON,
+  is_unauthorized_worktree_change,
+  touches_worktree
+};
+
+// scripts/rules/index-guard.ts
+var INDEX_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "add",
+  "commit",
+  "mv",
+  "reset",
+  "rm",
+  "stage"
+]);
+var RESTORE_SUBCOMMAND2 = "restore";
+function is_index_restore(args) {
+  return !worktree_guard.touches_worktree(args);
+}
+function is_index_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  if (INDEX_SUBCOMMANDS.has(call.subcommand ?? "")) return true;
+  return call.subcommand === RESTORE_SUBCOMMAND2 && is_index_restore(call.args);
+}
+function is_index_mutation(command) {
+  return shell_segments.segments_of(command).some((segment) => is_index_segment(segment));
+}
+var INDEX_MUTATION_REASON = '\u26D4 git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore --staged` overwrite the user\'s staged snapshot, which `CLAUDE.md` \u2192 Git Rules forbids on your own judgement (`prompts/collaboration-workflow/operating-rules.md` \u2192 "git index \u3092\u52DD\u624B\u306B\u5909\u66F4\u3057\u306A\u3044"). The `.claude/settings.json` deny list matches prefix globs, so it misses `git -C . commit`, `git -c k=v commit` and `env git commit`; this row reads the argv instead, so the spelling does not matter. A commit goes through `pnpm josh git -y`; any other staging needs explicit current-turn user instruction, run by the user in their own terminal. **This rule fires on every occurrence, not once per run.**';
+var ROW12 = {
+  id: "index-mutation",
+  is_trigger: bash_triggers.on_bash_command(is_index_mutation),
+  reason: INDEX_MUTATION_REASON,
+  decide: () => true
+};
+var index_guard = { INDEX_MUTATION_REASON, ROW: ROW12, is_index_mutation };
+
+// scripts/rules/protected-files.ts
+import path5 from "node:path";
+
+// scripts/doctor/doctor-consumer.ts
+import { existsSync as existsSync2 } from "node:fs";
+import path4 from "node:path";
+
+// scripts/version/kit-descriptor.ts
+var KIT_PACKAGE_NAME = "@joshuafolkken/kit";
+
+// scripts/doctor/doctor-consumer.ts
+import { z as z6 } from "zod";
+var NODE_MODULES = "node_modules";
+var SETTINGS_PATH = path4.join(".claude", "settings.json");
+var CLAUDE_MD = "CLAUDE.md";
+var PLUGIN_ID = "kit@kit";
+var CLAUDE_MD_POINTER = `@${NODE_MODULES}/${KIT_PACKAGE_NAME}/dist/${CLAUDE_MD}`;
+var SECRETLINT_BIN = path4.join(NODE_MODULES, ".bin", "secretlint");
+var GIT_TIMEOUT_MS = 2e3;
+var manifest_schema = z6.object({
+  name: z6.string().optional(),
+  dependencies: z6.record(z6.string(), z6.string()).optional(),
+  devDependencies: z6.record(z6.string(), z6.string()).optional()
+});
+var settings_schema = z6.object({
+  enabledPlugins: z6.record(z6.string(), z6.boolean()).optional()
+});
+var STATE_OK = "ok";
+var STATE_TARGET_MISSING = "target-missing";
+var STATE_MISSING = "missing";
+function parse_manifest(root) {
+  const content = file_reader.read_if_readable(path4.join(root, "package.json"));
+  if (content === void 0) return void 0;
+  const parsed = manifest_schema.safeParse(json_value.parse_or_undefined(content));
+  return parsed.success ? parsed.data : void 0;
+}
+function lists_kit_dependency(manifest) {
+  if (manifest === void 0) return false;
+  return Object.hasOwn(manifest.dependencies ?? {}, KIT_PACKAGE_NAME) || Object.hasOwn(manifest.devDependencies ?? {}, KIT_PACKAGE_NAME);
+}
+function is_kit_consumer(root) {
+  const manifest = parse_manifest(root);
+  if (manifest?.name === KIT_PACKAGE_NAME) return false;
+  return lists_kit_dependency(manifest) || existsSync2(path4.join(root, NODE_MODULES, KIT_PACKAGE_NAME));
+}
+function is_plugin_declared(root) {
+  const content = file_reader.read_if_readable(path4.join(root, SETTINGS_PATH));
+  if (content === void 0) return false;
+  const parsed = settings_schema.safeParse(json_value.parse_or_undefined(content));
+  return parsed.success && parsed.data.enabledPlugins?.[PLUGIN_ID] === true;
+}
+function configured_hooks_path(root) {
+  const value = git_spawn_sync.read(["-C", root, "config", "--get", "core.hooksPath"], {
+    timeout: GIT_TIMEOUT_MS
+  });
+  return value === "" ? void 0 : value;
+}
+function claude_md_state(root) {
+  const content = file_reader.read_if_readable(path4.join(root, CLAUDE_MD));
+  if (content === void 0) return STATE_MISSING;
+  if (!content.includes(CLAUDE_MD_POINTER)) return STATE_OK;
+  return existsSync2(path4.join(root, NODE_MODULES, KIT_PACKAGE_NAME, "dist", CLAUDE_MD)) ? STATE_OK : STATE_TARGET_MISSING;
+}
+function is_secretlint_runnable(root) {
+  return existsSync2(path4.join(root, SECRETLINT_BIN));
+}
+function status_line(is_ok, ok_text, warn_text) {
+  return is_ok ? `  \u2713 ${ok_text}` : `  \u26A0 ${warn_text}`;
+}
+function plugin_line(is_declared2) {
+  return status_line(
+    is_declared2,
+    "kit plugin declared (skills load in a trusted workspace; headless from its second session)",
+    "kit plugin not declared in .claude/settings.json \u2014 run `pnpm josh sync`"
+  );
+}
+function hooks_path_line(hooks_path) {
+  return status_line(
+    hooks_path === void 0,
+    "git hooks install normally (core.hooksPath unset)",
+    `core.hooksPath is set (${hooks_path ?? ""}) \u2014 lefthook installs no git hooks; unset it`
+  );
+}
+function claude_md_line(state) {
+  if (state === STATE_OK) return "  \u2713 CLAUDE.md resolves to the installed kit rules";
+  if (state === STATE_TARGET_MISSING) {
+    return "  \u26A0 CLAUDE.md points at rules that are not installed \u2014 run `pnpm install`";
+  }
+  return "  \u26A0 CLAUDE.md is missing \u2014 run `pnpm josh init`";
+}
+function secretlint_line(is_runnable) {
+  return status_line(
+    is_runnable,
+    "secretlint is runnable",
+    "secretlint is not installed \u2014 run `pnpm install`"
+  );
+}
+function consumer_setup_lines(root) {
+  return [
+    plugin_line(is_plugin_declared(root)),
+    hooks_path_line(configured_hooks_path(root)),
+    claude_md_line(claude_md_state(root)),
+    secretlint_line(is_secretlint_runnable(root))
+  ];
+}
+function report_consumer_setup(root) {
+  if (!is_kit_consumer(root)) return;
+  console.info("");
+  console.info("Consumer setup:");
+  for (const line of consumer_setup_lines(root)) console.info(line);
+}
+var doctor_consumer = {
+  claude_md_line,
+  claude_md_state,
+  configured_hooks_path,
+  hooks_path_line,
+  is_kit_consumer,
+  is_plugin_declared,
+  is_secretlint_runnable,
+  plugin_line,
+  report_consumer_setup,
+  secretlint_line
+};
+
+// scripts/rules/protected-files.ts
+var READ_TOOL = "Read";
+var EDIT_TOOLS2 = /* @__PURE__ */ new Set(["Edit", "Write"]);
+var ENVIRONMENT_FILE = ".env";
+var SETTINGS_FILE = path5.join(".claude", "settings.json");
+function file_path_of(call) {
+  if (!json_value.is_record(call.input)) return "";
+  const value = call.input["file_path"];
+  return typeof value === "string" ? value : "";
+}
+function is_environment_read(call) {
+  return call.name === READ_TOOL && path5.basename(file_path_of(call)) === ENVIRONMENT_FILE;
+}
+function is_consumer_settings_edit(call, is_kit_consumer2) {
+  if (!EDIT_TOOLS2.has(call.name)) return false;
+  const file_path = path5.resolve(file_path_of(call));
+  if (!file_path.endsWith(`${path5.sep}${SETTINGS_FILE}`)) return false;
+  return is_kit_consumer2(path5.dirname(path5.dirname(file_path)));
+}
+function is_protected_file_call(call, is_kit_consumer2 = doctor_consumer.is_kit_consumer) {
+  return is_environment_read(call) || is_consumer_settings_edit(call, is_kit_consumer2);
+}
+var PROTECTED_FILE_REASON = '\u26D4 protected file: `.env` holds the Telegram bot token, so reading it puts a secret in the transcript \u2014 the scripts that need it load it in their own process. `.claude/settings.json` in a consumer repository is the deny list and the hooks every other rule rests on, so a run must not rewrite it; `josh sync` owns it, and a change belongs upstream in kit (`CLAUDE.md` \u2192 "Route distributed-doc / config changes upstream to kit"). Leave both files alone, or ask the user. **This rule fires on every occurrence, not once per run.**';
+var ROW13 = {
+  id: "protected-file",
+  is_trigger: is_protected_file_call,
+  reason: PROTECTED_FILE_REASON,
+  decide: () => true
+};
+var protected_files = { ROW: ROW13, is_protected_file_call };
+
+// scripts/rules/permission-guards.ts
+var ROWS2 = [index_guard.ROW, destructive_command.ROW, protected_files.ROW];
+var permission_guards = { ROWS: ROWS2 };
 
 // scripts/rules/piped-verification.ts
 var VERIFICATION_COMMANDS = /* @__PURE__ */ new Set([
@@ -1713,7 +2239,7 @@ function is_poll_loop(command) {
   return LOOP_KEYWORD2.test(plain) && SLEEP_COMMAND.test(plain);
 }
 var POLL_LOOP_REASON = '\u26D4 output poll loop: this hand-writes a `while`/`until` wait loop over a command\'s output, a marker file or a process \u2014 with a `sleep` or, worse, without one \u2014 and the loop does not know when the command finished. A regex that never matches waits to the harness block limit; one that matches a mid-run line exits too early \u2014 either way the command exit is not what ends the wait, and each pass spends a full-context round trip (joshuafolkken/kit#2371 measured about 45 minutes, 13% of six lanes, lost to exactly this). Do not poll the output file. A command known to take minutes \u2014 `pnpm josh gate`, `pnpm josh followup`, `pnpm josh format` \u2014 is started detached from the first with `run_in_background` set, and the harness re-invokes you when it exits: its completion notification is what ends the wait, on the task exit rather than a regex or the block limit. So issue the long command in the background and end the turn \u2014 do not arm a loop; the wake-up brings you back. To glance at interim output, `Read` the output file once, never in a sleep loop. If you are waiting on CI, `pnpm josh followup` waits on it for you. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every occurrence, not once per run.**';
-var ROW10 = {
+var ROW14 = {
   id: "poll-loop",
   is_trigger: bash_triggers.on_bash_command(is_poll_loop),
   reason: POLL_LOOP_REASON,
@@ -1721,7 +2247,7 @@ var ROW10 = {
 };
 var poll_loop = {
   POLL_LOOP_REASON,
-  ROW: ROW10,
+  ROW: ROW14,
   is_poll_loop
 };
 
@@ -1841,13 +2367,13 @@ function posts_at_path_literally(command) {
   return RAW_FIELD_BODY_AT.test(command);
 }
 var RAW_FIELD_BODY_REASON = "\u26D4 literal @path body: this passes `body=@<path>` to `gh api` with a raw field flag (`-f` / `--raw-field`), which sends the value verbatim \u2014 the string `@<path>` is posted as the comment, not the file it points at. `-F` / `--field` is the flag that reads the file, and the two spellings differ by one character while `gh` exits 0 and returns a comment URL either way, so the break is invisible until a person reads the issue (joshuafolkken/kit#2304 lost two park comments this way). Post an issue or PR comment with `pnpm josh issue:comment <N> --body-file <path>` \u2014 the one spelling, which cannot take the wrong flag. The rule and the safe forms are in `prompts/collaboration-workflow/shell-body.md`. This rule fires on every occurrence, not once per run.";
-var ROW11 = {
+var ROW15 = {
   id: "raw-field-body",
   is_trigger: bash_triggers.on_bash_command(posts_at_path_literally),
   reason: RAW_FIELD_BODY_REASON,
   decide: () => true
 };
-var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW11, posts_at_path_literally };
+var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW15, posts_at_path_literally };
 
 // scripts/rules/rule-body-guard.ts
 var EDIT_TOOL = "Edit";
@@ -1918,7 +2444,7 @@ function runs_placement_oracle(command) {
     (names) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
   );
 }
-var ROW12 = {
+var ROW16 = {
   id: "rule-body",
   is_trigger: writes_rule_prose,
   reason: RULE_BODY_REASON,
@@ -1927,12 +2453,9 @@ var ROW12 = {
 };
 var rule_body_guard = {
   RULE_BODY_REASON,
-  ROW: ROW12,
-  adds_rule_prose,
+  ROW: ROW16,
   answered_placement,
   is_rule_document,
-  prose_of,
-  runs_placement_oracle,
   writes_rule_prose
 };
 
@@ -2002,27 +2525,17 @@ var SHELL_BODY_REASON = "\u26D4 shell-evaluated body: this command carries a bod
 var shell_body_trigger = {
   SHELL_BODY_REASON,
   carries_a_body,
-  is_safe_body_form,
   is_shell_evaluated_body,
   keeps_body_safe
 };
 
-// scripts/test/test-declared-changed.ts
-import { execFileSync } from "node:child_process";
-
 // scripts/gate/project-checks.ts
-import { existsSync as existsSync3, globSync as globSync2, readFileSync as readFileSync4 } from "node:fs";
-import path5 from "node:path";
-
-// scripts/init/project-profile.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "node:fs";
-import path4 from "node:path";
-
-// scripts/version/kit-descriptor.ts
-var KIT_PACKAGE_NAME = "@joshuafolkken/kit";
+import { existsSync as existsSync4, globSync as globSync2, readFileSync as readFileSync4 } from "node:fs";
+import path7 from "node:path";
 
 // scripts/init/project-profile.ts
-import { execaSync } from "execa";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "node:fs";
+import path6 from "node:path";
 var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".svelte-kit"]);
 var WEB_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".css", ".js", ".jsx", ".mjs", ".cjs"]);
 var TYPESCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx"]);
@@ -2054,26 +2567,21 @@ function requested_profile(args, usage = "josh init [--profile basic|full]") {
   throw new Error("Profile must be basic or full");
 }
 function read_manifest(root) {
-  const filename = path4.join(root, "package.json");
-  if (!existsSync2(filename)) return void 0;
+  const filename = path6.join(root, "package.json");
+  if (!existsSync3(filename)) return void 0;
   const parsed = JSON.parse(readFileSync3(filename, "utf8"));
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error("package.json must contain an object");
-  }
+  if (!json_value.is_record(parsed)) throw new Error("package.json must contain an object");
   return parsed;
 }
-function is_record(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function recorded_profile(manifest) {
   const { josh } = manifest;
-  return is_record(josh) ? parse_profile(josh["profile"]) : void 0;
+  return json_value.is_record(josh) ? parse_profile(josh["profile"]) : void 0;
 }
 function has_build_script(value) {
-  return is_record(value) && ("build" in value || "dev" in value);
+  return json_value.is_record(value) && ("build" in value || "dev" in value);
 }
 function has_project_dependencies(value) {
-  if (!is_record(value)) return false;
+  if (!json_value.is_record(value)) return false;
   return Object.keys(value).some((name) => name !== KIT_PACKAGE_NAME);
 }
 function inferred_profile(manifest) {
@@ -2099,9 +2607,9 @@ function should_visit(entry) {
 function scan_directory(directory, pending) {
   const entries = readdirSync(directory, { withFileTypes: true });
   pending.push(
-    ...entries.filter((entry) => should_visit(entry)).map((entry) => path4.join(directory, entry.name))
+    ...entries.filter((entry) => should_visit(entry)).map((entry) => path6.join(directory, entry.name))
   );
-  return entries.filter((entry) => entry.isFile()).map((entry) => path4.extname(entry.name));
+  return entries.filter((entry) => entry.isFile()).map((entry) => path6.extname(entry.name));
 }
 function file_extensions(root) {
   const pending = [root];
@@ -2118,16 +2626,13 @@ function scan_files(root) {
   return { has_web, has_typescript };
 }
 function has_github_remote(root) {
-  const result = execaSync("git", ["config", "--get", "remote.origin.url"], {
-    cwd: root,
-    reject: false
-  });
-  return result.exitCode === 0 && repo_origin.parse_origin_url(result.stdout) !== void 0;
+  const url = git_spawn_sync.origin_url(root);
+  return url !== void 0 && repo_origin.parse_origin_url(url) !== void 0;
 }
 function inspect_project(root, requested) {
   const profile = resolve_profile(root, requested);
   const files = scan_files(root);
-  const has_git = existsSync2(path4.join(root, ".git"));
+  const has_git = existsSync3(path6.join(root, ".git"));
   return { ...profile, ...files, has_git, has_github: has_git && has_github_remote(root) };
 }
 var project_profile = {
@@ -2142,7 +2647,7 @@ var project_profile = {
 var SKIP_MARKER = "\u2014 skipping";
 
 // scripts/gate/project-checks.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var PACKAGE_JSON = "package.json";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -2177,11 +2682,11 @@ var CSPELL_CONFIGS = [
 ];
 var TYPE_CONFIGS = ["tsconfig.json", "jsconfig.json"];
 var DEPENDENCY_FIELDS = ["dependencies", "devDependencies"];
-var object_schema = z5.record(z5.string(), z5.unknown());
+var object_schema = z7.record(z7.string(), z7.unknown());
 function project_root(directory) {
   let current = directory;
-  while (!existsSync3(path5.join(current, PACKAGE_JSON))) {
-    const parent = path5.dirname(current);
+  while (!existsSync4(path7.join(current, PACKAGE_JSON))) {
+    const parent = path7.dirname(current);
     if (parent === current) return directory;
     current = parent;
   }
@@ -2194,24 +2699,23 @@ function has_files(directory, pattern) {
   return globSync2(pattern, { cwd: project_root(directory), exclude: is_ignored }).length > 0;
 }
 function has_config(directory, names) {
-  return names.some((name) => existsSync3(path5.join(project_root(directory), name)));
+  return names.some((name) => existsSync4(path7.join(project_root(directory), name)));
 }
 function has_bin(directory, bin_name) {
   return find_local_bin_upwards(directory, bin_name) !== void 0;
 }
 function josh_settings(manifest) {
-  if (typeof manifest !== "object" || manifest === null || !("josh" in manifest)) return void 0;
-  return manifest.josh;
+  return json_value.is_record(manifest) ? manifest["josh"] : void 0;
 }
 function is_basic_manifest(manifest) {
   const josh = josh_settings(manifest);
-  if (typeof josh !== "object" || josh === null || !("profile" in josh)) return false;
-  return project_profile.parse_profile(josh.profile) === "basic";
+  if (!json_value.is_record(josh)) return false;
+  return project_profile.parse_profile(josh["profile"]) === "basic";
 }
 function read_manifest2(directory) {
   try {
-    const manifest_path = path5.join(project_root(directory), PACKAGE_JSON);
-    return JSON.parse(readFileSync4(manifest_path, "utf8"));
+    const manifest_path = path7.join(project_root(directory), PACKAGE_JSON);
+    return json_value.parse_or_undefined(readFileSync4(manifest_path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2231,8 +2735,8 @@ function missing_tool_reason(directory, package_name, bin_name) {
   if (has_bin(directory, bin_name) || is_declared(directory, package_name)) return void 0;
   return `${package_name} is not installed`;
 }
-function skip_notice(check3, reason) {
-  return `josh ${check3}: ${reason} ${SKIP_MARKER} ${check3}.`;
+function skip_notice(check4, reason) {
+  return `josh ${check4}: ${reason} ${SKIP_MARKER} ${check4}.`;
 }
 function type_check_skip_reason(directory) {
   if (!is_basic(directory)) return void 0;
@@ -2254,8 +2758,6 @@ function eslint_skip_reason(directory) {
 var project_checks = {
   CSPELL_CONFIGS,
   ESLINT_CONFIGS,
-  SCRIPT_FILES,
-  TYPE_CONFIGS,
   TYPE_FILES,
   WEB_FILES,
   eslint_skip_reason,
@@ -2293,46 +2795,45 @@ var BASIC_REQUIRED_SUFFIXES = [
   ".toml"
 ];
 function normalize(paths) {
-  return paths.map((path7) => path7.trim()).filter((path7) => path7 !== "");
+  return paths.map((path10) => path10.trim()).filter((path10) => path10 !== "");
 }
-function is_test_file(path7) {
-  return TEST_SUFFIXES.some((suffix) => path7.endsWith(suffix));
+function is_test_file(path10) {
+  return TEST_SUFFIXES.some((suffix) => path10.endsWith(suffix));
 }
-function is_basic_manual(path7, is_basic2) {
-  const lower = path7.toLowerCase();
+function is_basic_manual(path10, is_basic2) {
+  const lower = path10.toLowerCase();
   return is_basic2 && BASIC_REQUIRED_SUFFIXES.every((suffix) => !lower.endsWith(suffix));
 }
-function is_basic_visual(path7) {
-  const lower = path7.toLowerCase();
+function is_basic_visual(path10) {
+  const lower = path10.toLowerCase();
   return BASIC_VISUAL_SUFFIXES.some((suffix) => lower.endsWith(suffix));
 }
-function is_exempt(path7, is_basic2 = false) {
-  if (EXEMPT_PATHS.includes(path7) || is_basic_manual(path7, is_basic2)) return true;
-  return EXEMPT_SUFFIXES.some((suffix) => path7.endsWith(suffix)) || EXEMPT_PREFIXES.some((prefix) => path7.startsWith(prefix));
+function is_exempt(path10, is_basic2 = false) {
+  if (EXEMPT_PATHS.includes(path10) || is_basic_manual(path10, is_basic2)) return true;
+  return EXEMPT_SUFFIXES.some((suffix) => path10.endsWith(suffix)) || EXEMPT_PREFIXES.some((prefix) => path10.startsWith(prefix));
 }
-function is_runtime(path7, is_basic2 = false) {
-  return !is_test_file(path7) && !is_exempt(path7, is_basic2);
+function is_runtime(path10, is_basic2 = false) {
+  return !is_test_file(path10) && !is_exempt(path10, is_basic2);
 }
 function verdict_for(paths, is_basic2 = false) {
   const changed = normalize(paths);
-  if (changed.some((path7) => is_test_file(path7))) return "satisfied";
-  if (changed.some((path7) => is_runtime(path7, is_basic2))) return "required";
+  if (changed.some((path10) => is_test_file(path10))) return "satisfied";
+  if (changed.some((path10) => is_runtime(path10, is_basic2))) return "required";
   return "exempt";
 }
 function runtime_files(paths, is_basic2 = false) {
-  return normalize(paths).filter((path7) => is_runtime(path7, is_basic2));
+  return normalize(paths).filter((path10) => is_runtime(path10, is_basic2));
 }
 function exempt_files(paths, is_basic2 = false) {
-  return normalize(paths).filter((path7) => is_exempt(path7, is_basic2));
+  return normalize(paths).filter((path10) => is_exempt(path10, is_basic2));
 }
 function manual_check_files(paths, is_basic2) {
-  return normalize(paths).filter((path7) => is_exempt(path7, is_basic2) && !is_exempt(path7));
+  return normalize(paths).filter((path10) => is_exempt(path10, is_basic2) && !is_exempt(path10));
 }
 var test_declared_logic = {
   EXEMPT_PATHS,
   EXEMPT_PREFIXES,
   EXEMPT_SUFFIXES,
-  TEST_SUFFIXES,
   exempt_files,
   is_basic_visual,
   is_exempt,
@@ -2352,15 +2853,9 @@ function path_of(line) {
   return arrow === -1 ? body : body.slice(arrow + RENAME_ARROW.length);
 }
 function read_changed_paths_sync() {
-  try {
-    const output = execFileSync("git", ["status", "--porcelain"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    return output.split("\n").filter((line) => line.length > STATUS_PREFIX_LENGTH).map((line) => path_of(line));
-  } catch {
-    return [];
-  }
+  const output = git_spawn_sync.run(["status", PORCELAIN_FLAG], { timeout: 0 });
+  if (output.exit_code !== 0) return [];
+  return output.stdout.split("\n").filter((line) => line.length > STATUS_PREFIX_LENGTH).map((line) => path_of(line));
 }
 var injected = {};
 function source_paths() {
@@ -2393,8 +2888,8 @@ function is_untested_commit(call) {
   return test_declared_changed.current_verdict() === "required";
 }
 var REASON = '\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads the working tree as `required` (a changed file that is neither a test \u2014 `*.test.ts` / `*.e2e.ts` \u2014 nor a mechanically-exempt non-runtime path). `CLAUDE.md` \u2192 Code Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an E2E. Add the declared test and reissue this commit. **If the change genuinely touches no executable runtime path** it is the pre-approved non-runtime exception \u2014 declare it in your Step 0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` \u2192 "\u914D\u9001\u3055\u308C\u3066\u3044\u308B\u898F\u5247". This fires once per run, so reissuing will not repeat on the call in hand.';
-var ROW13 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
-var test_declared_commit = { REASON, ROW: ROW13, is_untested_commit };
+var ROW17 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
+var test_declared_commit = { REASON, ROW: ROW17 };
 
 // scripts/rules/third-party-write.ts
 function is_third_party_write_segment(segment, session_owner) {
@@ -2410,101 +2905,38 @@ function writes_third_party(command, resolve_owner = repo_party.current_owner) {
   return targets.some((segment) => is_third_party_write_segment(segment, session_owner));
 }
 var THIRD_PARTY_WRITE_REASON = '\u26D4 third-party write: this `gh api` call writes to a repository whose owner is not this session \u2014 a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, is not that instruction (`CLAUDE.md` \u2192 "Third-party repositories are Tier C", `prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with `pnpm josh repo:party <owner/repo>` \u2014 owner equality, computed not judged. A read (`-X GET`, or no field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or `-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact for a person to post \u2014 do not publish it yourself. **This rule fires on every occurrence, not once per run.**';
-var ROW14 = {
+var ROW18 = {
   id: "third-party-write",
   is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
   reason: THIRD_PARTY_WRITE_REASON,
   decide: () => true
 };
 var third_party_write = {
-  ROW: ROW14,
+  ROW: ROW18,
   THIRD_PARTY_WRITE_REASON,
-  is_third_party_write_segment,
   writes_third_party
 };
 
-// scripts/rules/worktree-guard.ts
-var CHECKOUT_SUBCOMMAND = "checkout";
-var RESTORE_SUBCOMMAND = "restore";
-var STASH_SUBCOMMAND = "stash";
-var PATHSPEC_SEPARATOR = "--";
-function is_worktree_checkout(args) {
-  return args.includes(PATHSPEC_SEPARATOR);
+// scripts/rules/delivered-rules.ts
+var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
+var STAMP_PREFIX = "josh-rule-guard-";
+var { is_issue_filing, on_bash_command } = bash_triggers;
+var WIP_CAP = 30;
+var WIP_CAP_REASON = `\u26D4 backlog WIP cap: count the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by, and an interrupt, decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. The count command and both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call once you have counted \u2014 it fires once per run and cannot repeat on the call in hand.`;
+var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
+var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
+var FETCHES_COMMENTS = /--comments\b|--json\s[\w,]*\bcomments\b|\/comments\b/u;
+var ISSUES_PATH = /repos\/[^\s'"]*\/issues\//u;
+var FIELD_PROJECTION = /(?:--jq|--json)[= ]\s*('[^']*'|"[^"]*"|\S+)/u;
+var NAMES_THE_BODY = /\bbody\b/u;
+function projects_away_body(segment) {
+  const projection = FIELD_PROJECTION.exec(segment);
+  return projection !== null && !NAMES_THE_BODY.test(projection[1] ?? "");
 }
-var STAGED_LONG = "--staged";
-var STAGED_LETTER = "S";
-var WORKTREE_LONG = "--worktree";
-var WORKTREE_LETTER = "W";
-function touches_worktree(args) {
-  const is_staged = args.some(
-    (argument) => argument === STAGED_LONG || git_argv.short_cluster_has(argument, STAGED_LETTER)
-  );
-  const is_worktree = args.some(
-    (argument) => argument === WORKTREE_LONG || git_argv.short_cluster_has(argument, WORKTREE_LETTER)
-  );
-  return !is_staged || is_worktree;
-}
-var PUSH_STASH = "push";
-var MESSAGE_LONG = "--message";
-var MESSAGE_SHORT_LETTER = "m";
-var READ_ONLY_STASH = /* @__PURE__ */ new Set(["list", "show"]);
-function has_message(args) {
-  return args.some(
-    (argument) => argument === MESSAGE_LONG || argument.startsWith(`${MESSAGE_LONG}=`) || git_argv.short_cluster_has(argument, MESSAGE_SHORT_LETTER)
-  );
-}
-function is_unauthorized_stash(args) {
-  const [stash_subcommand, ...rest] = args;
-  if (stash_subcommand === void 0) return true;
-  if (READ_ONLY_STASH.has(stash_subcommand)) return false;
-  if (stash_subcommand === PUSH_STASH) return !has_message(rest);
-  return true;
-}
-function is_unauthorized_segment(segment) {
-  const call = git_argv.parse(segment);
-  if (call === void 0) return false;
-  if (call.subcommand === CHECKOUT_SUBCOMMAND) return is_worktree_checkout(call.args);
-  if (call.subcommand === RESTORE_SUBCOMMAND) return touches_worktree(call.args);
-  return call.subcommand === STASH_SUBCOMMAND && is_unauthorized_stash(call.args);
-}
-function is_unauthorized_worktree_change(command) {
-  return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
-}
-var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>` and an unauthorized `git stash` mutate the working tree or the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
-var ROW15 = {
-  id: "worktree-mutation",
-  is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
-  reason: WORKTREE_MUTATION_REASON,
-  decide: () => true
-};
-var worktree_guard = {
-  ROW: ROW15,
-  WORKTREE_MUTATION_REASON,
-  is_unauthorized_stash,
-  is_unauthorized_worktree_change,
-  is_worktree_checkout,
-  touches_worktree
-};
-
-// scripts/rules/delivered-rules.ts
-var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
-var STAMP_PREFIX = "josh-rule-guard-";
-var { is_issue_filing, on_bash_command } = bash_triggers;
-var WIP_CAP_REASON = "\u26D4 backlog WIP cap: count the target repository's open Issues before filing. With more than 30 open, close one first; nothing honestly closable means do not file. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by, and an interrupt, decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. The count command and both procedures are in `prompts/collaboration-workflow/wip-cap.md`. Reissue this call once you have counted \u2014 it fires once per run and cannot repeat on the call in hand.";
-var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
-var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
-var FETCHES_COMMENTS = /--comments\b|--json\s[\w,]*\bcomments\b|\/comments\b/u;
-var ISSUES_PATH = /repos\/[^\s'"]*\/issues\//u;
-var FIELD_PROJECTION = /(?:--jq|--json)[= ]\s*('[^']*'|"[^"]*"|\S+)/u;
-var NAMES_THE_BODY = /\bbody\b/u;
-function projects_away_body(segment) {
-  const projection = FIELD_PROJECTION.exec(segment);
-  return projection !== null && !NAMES_THE_BODY.test(projection[1] ?? "");
-}
-function is_body_read_segment(segment) {
-  if (projects_away_body(segment)) return false;
-  if (ISSUE_VIEW_COMMAND.test(segment)) return true;
-  return gh_api.is_gh_api(segment) && ISSUE_BODY_PATH.test(segment) && gh_api.is_read(segment);
+function is_body_read_segment(segment) {
+  if (projects_away_body(segment)) return false;
+  if (ISSUE_VIEW_COMMAND.test(segment)) return true;
+  return gh_api.is_gh_api(segment) && ISSUE_BODY_PATH.test(segment) && gh_api.is_read(segment);
 }
 function fetches_issue_comments(segment) {
   if (!FETCHES_COMMENTS.test(segment)) return false;
@@ -2727,6 +3159,10 @@ var DELIVERED_RULES = [
   git_force.ROW,
   worktree_guard.ROW,
   file_body.ROW,
+  // **The deny-list bypasses closed by argv and path rather than glob** (joshuafolkken/kit#2983) — an
+  // index mutation, a recursive forced `rm` or destructive `gh` call, and a protected file. Each
+  // claims a command or file no row above does and refuses every occurrence (`permission-guards.ts`).
+  ...permission_guards.ROWS,
   // **The hand-written wait loop a lane child improvises over a backgrounded command's output**
   // (joshuafolkken/kit#2371). `early-heartbeat` refuses a bare `sleep` and stands down on any loop
   // keyword; this is the loop it left — a `while`/`until` that sleeps between probes of an output
@@ -2819,12 +3255,12 @@ function is_first_delivery(tail, call, delivered_at_ms, run2) {
   return delivered_at_ms === hook_decision.NEVER_MS && !will_batch_guard_refuse(tail, call, run2);
 }
 function delivery_decision(rule) {
-  const { decide: decide5, already_satisfied } = rule;
-  if (decide5 === void 0 && already_satisfied === void 0) return is_first_delivery;
+  const { decide: decide6, already_satisfied } = rule;
+  if (decide6 === void 0 && already_satisfied === void 0) return is_first_delivery;
   return function should_block(tail, call, delivered_at_ms, run2) {
     if (already_satisfied?.(tail, call) === true) return false;
-    if (decide5 === void 0) return true;
-    return decide5(call, run2, !will_batch_guard_refuse(tail, call, run2), delivered_at_ms);
+    if (decide6 === void 0) return true;
+    return decide6(call, run2, !will_batch_guard_refuse(tail, call, run2), delivered_at_ms);
   };
 }
 function guard_of(rule) {
@@ -2870,6 +3306,7 @@ var delivered_rules = {
   SHELL_BODY_REASON: SHELL_BODY_REASON2,
   SWITCH_ENV_KEY,
   THIRD_PARTY_WRITE_REASON: third_party_write.THIRD_PARTY_WRITE_REASON,
+  WIP_CAP,
   WIP_CAP_REASON,
   WORKTREE_MUTATION_REASON: worktree_guard.WORKTREE_MUTATION_REASON,
   delivery,
@@ -2880,1680 +3317,11 @@ var delivered_rules = {
 };
 
 // scripts/run/run-watcher-hook.ts
-import { z as z17 } from "zod";
+import { z as z12 } from "zod";
 
 // scripts/run/run-progress-read.ts
 import { loadavg } from "node:os";
 
-// scripts/git/git-gh-helpers.ts
-function parse_pr_state_string(result) {
-  const trimmed = result.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function is_pr_already_exists_message(error_message) {
-  return error_message.toLowerCase().includes("already exists");
-}
-function get_error_message_with_stderr(error) {
-  if (!(error instanceof Error)) return String(error);
-  if (has_stderr_field(error) && error.stderr.length > 0) return `${error.message}
-${error.stderr}`;
-  return error.message;
-}
-function handle_pr_create_error(error) {
-  const error_message = get_error_message_with_stderr(error);
-  if (is_pr_already_exists_message(error_message)) {
-    throw new Error("PR_ALREADY_EXISTS");
-  }
-  throw error;
-}
-var git_gh_helpers = {
-  parse_pr_state_string,
-  is_pr_already_exists_message,
-  get_error_message_with_stderr,
-  handle_pr_create_error
-};
-
-// scripts/git/git-gh-issue-rest.ts
-import { z as z7 } from "zod";
-
-// scripts/git/git-gh-rest-state.ts
-var MERGED_STATE = "MERGED";
-function to_gh_state(state) {
-  return state?.toUpperCase();
-}
-
-// scripts/git/schemas.ts
-import { z as z6 } from "zod";
-var package_name_schema = z6.object({ name: z6.string().min(1) });
-var rollup_item_schema = z6.looseObject({
-  // eslint-disable-next-line @typescript-eslint/naming-convention -- GraphQL field name from GitHub API
-  __typename: z6.string().optional(),
-  state: z6.string().optional(),
-  status: z6.string().optional(),
-  conclusion: z6.string().optional(),
-  name: z6.string().optional(),
-  context: z6.string().optional()
-});
-var pr_raw_schema = z6.object({
-  statusCheckRollup: z6.array(rollup_item_schema).optional(),
-  mergeStateStatus: z6.string().optional(),
-  reviewDecision: z6.string().optional()
-});
-var pull_comment_schema = z6.object({
-  body: z6.string().optional(),
-  html_url: z6.string().optional(),
-  user: z6.object({ login: z6.string().optional() }).optional()
-});
-var ai_review_pull_comment_schema = z6.object({
-  body: z6.string().optional(),
-  url: z6.string().optional(),
-  author: z6.object({ login: z6.string().optional() }).optional()
-});
-var pr_info_schema = z6.object({
-  mergeable: z6.union([z6.boolean(), z6.string()]).nullable().optional(),
-  mergeStateStatus: z6.string().nullable().optional(),
-  state: z6.string().optional()
-});
-var epic_issue_schema = z6.object({
-  number: z6.number(),
-  body: z6.string().optional()
-});
-var blocking_issue_schema = z6.object({
-  number: z6.number(),
-  state: z6.string().optional(),
-  repository_url: z6.string().optional()
-});
-var blocked_by_schema = z6.object({
-  nodes: z6.array(blocking_issue_schema).default([]),
-  totalCount: z6.number().optional()
-}).optional();
-var epic_child_schema = z6.object({
-  state: z6.string().optional(),
-  blockedBy: blocked_by_schema
-});
-var rest_comment_schema = z6.looseObject({
-  body: z6.string().nullish(),
-  html_url: z6.string().optional(),
-  user: z6.looseObject({ login: z6.string().optional() }).nullish()
-});
-var issue_label_schema = z6.object({ name: z6.string() });
-var epic_subject_schema = z6.object({
-  number: z6.number(),
-  state: z6.string().optional(),
-  labels: z6.array(issue_label_schema).optional(),
-  body: z6.string().optional()
-});
-var open_issue_schema = z6.object({
-  number: z6.number(),
-  title: z6.string(),
-  labels: z6.array(issue_label_schema).optional(),
-  createdAt: z6.string(),
-  blockedBy: blocked_by_schema
-});
-
-// scripts/git/git-gh-issue-rest.ts
-var rest_issue_schema = z7.looseObject({
-  number: z7.number(),
-  issue_dependencies_summary: z7.looseObject({ total_blocked_by: z7.number().optional() }).nullish(),
-  // Present only on a pull request, which this endpoint serves as readily as an issue.
-  pull_request: z7.looseObject({ merged_at: z7.string().nullish() }).nullish()
-});
-var REPOSITORY_URL = /\/repos\/([\w.-]+\/[\w.-]+)$/u;
-var REPOSITORY_URL_GROUP = 1;
-var BLOCKED_BY_FIELD = "blockedBy";
-var BLOCKED_BY_COUNT_FIELD = "blocked_by_count";
-var STATE_FIELD = "state";
-var BODY_FIELD = "body";
-var FIELD_SEPARATOR = ",";
-var EMPTY_BODY = "";
-var REST_FIELD_NAMES = /* @__PURE__ */ new Map([
-  ["url", "html_url"],
-  ["createdAt", "created_at"]
-]);
-var NOT_AN_ISSUE_MESSAGE = "gh api answered something other than an issue object";
-var NOT_AN_ISSUE_LISTING_MESSAGE = "gh api answered something other than an issue listing";
-var NOT_A_BLOCKER_LISTING_MESSAGE = "gh api answered something other than a blocked-by listing";
-function rest_field_name(field) {
-  return REST_FIELD_NAMES.get(field) ?? field;
-}
-function split_fields(fields) {
-  return fields.split(FIELD_SEPARATOR).map((field) => field.trim()).filter((field) => field.length > 0);
-}
-function to_issue_state(rest, value) {
-  if (typeof rest.pull_request?.merged_at === "string") return MERGED_STATE;
-  return typeof value === "string" ? to_gh_state(value) : value;
-}
-function total_blocked_by(rest) {
-  return rest.issue_dependencies_summary?.total_blocked_by;
-}
-function to_gh_field_value(field, rest) {
-  if (field === BLOCKED_BY_COUNT_FIELD) return total_blocked_by(rest);
-  const value = rest[rest_field_name(field)];
-  if (field === STATE_FIELD) return to_issue_state(rest, value);
-  return field === BODY_FIELD ? value ?? EMPTY_BODY : value;
-}
-function parse_rest_issue(rest_json) {
-  const parsed = parse_json_object_safe(rest_json, rest_issue_schema);
-  if (parsed === void 0) throw new Error(NOT_AN_ISSUE_MESSAGE);
-  return parsed;
-}
-function is_pull_request(rest) {
-  return rest.pull_request !== void 0 && rest.pull_request !== null;
-}
-function parse_rest_issues(rest_json) {
-  const parsed = parse_json_array_or_undefined(rest_json, rest_issue_schema);
-  if (parsed === void 0) throw new Error(NOT_AN_ISSUE_LISTING_MESSAGE);
-  return parsed;
-}
-function empty_blocked_by() {
-  return { nodes: [], totalCount: 0 };
-}
-function repo_of_url(repository_url) {
-  const match = REPOSITORY_URL.exec(repository_url ?? "");
-  return match?.[REPOSITORY_URL_GROUP];
-}
-function to_blocked_by(blockers_json, exact_total) {
-  const parsed = parse_json_array_or_undefined(blockers_json, blocking_issue_schema);
-  if (parsed === void 0) throw new Error(NOT_A_BLOCKER_LISTING_MESSAGE);
-  const nodes = parsed.map((blocker) => ({ ...blocker, state: to_gh_state(blocker.state) }));
-  return { nodes, totalCount: exact_total ?? nodes.length };
-}
-function to_gh_issue(rest, fields, blocked_by) {
-  return Object.fromEntries(
-    fields.map((field) => [
-      field,
-      field === BLOCKED_BY_FIELD ? blocked_by : to_gh_field_value(field, rest)
-    ])
-  );
-}
-function to_field_text(value) {
-  if (typeof value === "string") return value;
-  return value === void 0 || value === null ? EMPTY_BODY : JSON.stringify(value);
-}
-var CLOSED = "CLOSED";
-function reference_of_blocker(node, fallback_repo) {
-  const repo = repo_of_url(node.repository_url) ?? fallback_repo;
-  if (node.state === void 0) return { repo, number: node.number };
-  return { repo, number: node.number, state: node.state.toUpperCase() === CLOSED ? CLOSED : "OPEN" };
-}
-var git_gh_issue_rest = {
-  empty_blocked_by,
-  repo_of_url,
-  reference_of_blocker,
-  split_fields,
-  is_pull_request,
-  parse_rest_issue,
-  parse_rest_issues,
-  total_blocked_by,
-  to_blocked_by,
-  to_gh_issue,
-  to_field_text
-};
-
-// scripts/git/git-gh-reachability.ts
-var RATE_LIMITED_STATUS = 429;
-var SERVER_ERROR_FLOOR = 500;
-function is_retryable_status(status) {
-  if (status >= SERVER_ERROR_FLOOR) return true;
-  return status === RATE_LIMITED_STATUS;
-}
-function classify_status(status) {
-  if (status === void 0) return "unreachable";
-  return is_retryable_status(status) ? "unreachable" : "reachable";
-}
-var gh_reachability = { classify_status };
-
-// scripts/git/git-gh-issue-read.ts
-async function read_blocked_by_listing(issue_number, repo, exact_total) {
-  const json = await git_gh_exec.exec_gh_api({
-    path: `${git_gh_api_path.blocked_by_api_path(issue_number, repo)}${git_gh_api_path.FULL_PAGE_QUERY}`
-  });
-  return git_gh_issue_rest.to_blocked_by(json, exact_total);
-}
-async function read_blocked_by(issue_number, rest, repo) {
-  if (git_gh_issue_rest.is_pull_request(rest)) return git_gh_issue_rest.empty_blocked_by();
-  const exact_total = git_gh_issue_rest.total_blocked_by(rest);
-  if (exact_total === 0) return git_gh_issue_rest.empty_blocked_by();
-  return await read_blocked_by_listing(issue_number, repo, exact_total);
-}
-function mark_followup(error) {
-  if (!(error instanceof Error)) return error;
-  const failure = gh_failure.failure_of(error);
-  if (failure === void 0) return error;
-  return gh_failure.attach(error, { ...failure, is_followup: true });
-}
-async function read_relations(issue_number, rest, repo) {
-  try {
-    return await read_blocked_by(issue_number, rest, repo);
-  } catch (error) {
-    throw mark_followup(error);
-  }
-}
-async function read_issue_fields(issue_number, fields, repo) {
-  const rest = git_gh_issue_rest.parse_rest_issue(
-    await git_gh_exec.exec_gh_api({ path: git_gh_api_path.issue_api_path(issue_number, repo) })
-  );
-  const requested = git_gh_issue_rest.split_fields(fields);
-  const blocked_by = requested.includes(BLOCKED_BY_FIELD) ? await read_relations(issue_number, rest, repo) : void 0;
-  return git_gh_issue_rest.to_gh_issue(rest, requested, blocked_by);
-}
-var NOT_FOUND_STATUS = 404;
-function is_number_unresolved(failure) {
-  return failure.status === NOT_FOUND_STATUS && failure.is_followup !== true;
-}
-function to_unreadable_reason(status) {
-  return gh_reachability.classify_status(status) === "unreachable" ? "unreachable" : "rejected";
-}
-function to_read_failure(error) {
-  const failure = gh_failure.failure_of(error);
-  if (failure === void 0) return { kind: "unreadable", reason: "malformed", status: void 0 };
-  if (is_number_unresolved(failure)) return { kind: "missing" };
-  return {
-    kind: "unreadable",
-    reason: to_unreadable_reason(failure.status),
-    status: failure.status
-  };
-}
-async function issue_view_json_classified(issue_number, fields, repo) {
-  try {
-    const issue = await read_issue_fields(issue_number, fields, repo);
-    return { kind: "read", json: JSON.stringify(issue) };
-  } catch (error) {
-    return to_read_failure(error);
-  }
-}
-async function issue_view_field_classified(issue_number, field, repo) {
-  try {
-    const issue = await read_issue_fields(issue_number, field, repo);
-    return { kind: "read", text: git_gh_issue_rest.to_field_text(issue[field]) };
-  } catch (error) {
-    return to_read_failure(error);
-  }
-}
-async function issue_view_field(issue_number, field, repo) {
-  const read2 = await issue_view_field_classified(issue_number, field, repo);
-  return read2.kind === "read" ? read2.text : void 0;
-}
-async function issue_get_title(issue_number, repo) {
-  const result = await issue_view_field(issue_number, "title", repo);
-  return result === void 0 ? void 0 : git_gh_helpers.parse_pr_state_string(result);
-}
-async function issue_get_body(issue_number, repo) {
-  return await issue_view_field(issue_number, "body", repo);
-}
-async function issue_get_body_classified(issue_number, repo) {
-  return await issue_view_field_classified(issue_number, "body", repo);
-}
-async function issue_view_json(issue_number, fields, repo) {
-  const read2 = await issue_view_json_classified(issue_number, fields, repo);
-  return read2.kind === "read" ? read2.json : void 0;
-}
-var STATE_AND_RELATIONS_FIELDS = "number,state,labels,blockedBy";
-async function issue_get_state_and_relations(issue_number, repo) {
-  return await issue_view_json(issue_number, STATE_AND_RELATIONS_FIELDS, repo);
-}
-async function issue_get_state_and_relations_classified(issue_number, repo) {
-  return await issue_view_json_classified(issue_number, STATE_AND_RELATIONS_FIELDS, repo);
-}
-function is_unreachable_read(failure) {
-  return failure.kind === "unreadable" && failure.reason === "unreachable";
-}
-var PLAN_FIELDS = "number,title,body,state,url,labels,blockedBy";
-async function issue_get_plan_fields(issue_number) {
-  return await issue_view_json(issue_number, PLAN_FIELDS);
-}
-async function issue_get_plan_fields_classified(issue_number) {
-  return await issue_view_json_classified(issue_number, PLAN_FIELDS);
-}
-async function issue_get_labels_and_body(issue_number) {
-  return await issue_view_json(issue_number, "number,state,labels,body");
-}
-async function issue_list_comments(issue_number) {
-  const path7 = `${git_gh_api_path.issue_comments_api_path(issue_number)}${git_gh_api_path.FULL_PAGE_QUERY}`;
-  try {
-    return await git_gh_exec.exec_gh_api({ path: path7, should_paginate: true });
-  } catch {
-    return void 0;
-  }
-}
-async function has_no_relations_endpoint(issue_number, repo) {
-  const status = await git_gh_exec.exec_gh_api_status(
-    git_gh_api_path.blocked_by_api_path(issue_number, repo)
-  );
-  return status === NOT_FOUND_STATUS;
-}
-async function issue_blocked_by_references(issue_number, own_repo, repo) {
-  try {
-    const listing = await read_blocked_by_listing(issue_number, repo);
-    return listing.nodes.map((blocker) => git_gh_issue_rest.reference_of_blocker(blocker, own_repo));
-  } catch (error) {
-    if (await has_no_relations_endpoint(issue_number, repo)) return [];
-    throw error;
-  }
-}
-async function issue_blocked_by_numbers(issue_number, repo) {
-  const references = await issue_blocked_by_references(issue_number, "", repo);
-  return references.map((blocker) => blocker.number);
-}
-var git_gh_issue_read = {
-  issue_blocked_by_numbers,
-  issue_blocked_by_references,
-  issue_get_title,
-  issue_get_body,
-  issue_get_body_classified,
-  issue_view_json,
-  issue_view_json_classified,
-  issue_get_state_and_relations,
-  issue_get_state_and_relations_classified,
-  is_unreachable_read,
-  issue_get_plan_fields,
-  issue_get_plan_fields_classified,
-  issue_get_labels_and_body,
-  issue_list_comments
-};
-
-// scripts/git/git-gh-issue-list.ts
-var PER_PAGE = 100;
-var FIRST_PAGE = 1;
-var DEFAULT_STATE = "open";
-var DEFAULT_SORT = "created";
-var LISTING_DIRECTION = "direction=desc";
-function listing_query(request) {
-  const state = request.state ?? DEFAULT_STATE;
-  const sort = request.sort ?? DEFAULT_SORT;
-  return `state=${state}&sort=${sort}&${LISTING_DIRECTION}`;
-}
-function listing_path(request, page) {
-  const label = request.label === void 0 ? "" : `&labels=${encodeURIComponent(request.label)}`;
-  const paging = `&per_page=${String(PER_PAGE)}&page=${String(page)}`;
-  return `${git_gh_api_path.issues_api_path(request.repo)}?${listing_query(request)}${label}${paging}`;
-}
-var DIGIT_PATTERN = /\d/u;
-function has_token_occurrence(body, term) {
-  let index = body.indexOf(term);
-  while (index !== -1) {
-    if (!DIGIT_PATTERN.test(body.charAt(index + term.length))) return true;
-    index = body.indexOf(term, index + 1);
-  }
-  return false;
-}
-function matches_body(rest, term) {
-  if (term === void 0) return true;
-  const { body } = rest;
-  return typeof body === "string" && has_token_occurrence(body, term);
-}
-function is_selected(rest, request) {
-  return !git_gh_issue_rest.is_pull_request(rest) && matches_body(rest, request.body_term);
-}
-async function fetch_page(request, page) {
-  const path7 = listing_path(request, page);
-  const rows = git_gh_issue_rest.parse_rest_issues(await git_gh_exec.exec_gh_api({ path: path7 }));
-  return {
-    selected: rows.filter((row) => is_selected(row, request)),
-    is_full: rows.length >= PER_PAGE
-  };
-}
-var MAX_PAGES = 5;
-var MAX_SCANNED = MAX_PAGES * PER_PAGE;
-function wants_more(has_more, selected_count, limit) {
-  return has_more && selected_count < limit;
-}
-async function fetch_selected(request) {
-  const selected = [];
-  let page = FIRST_PAGE;
-  let has_more = true;
-  while (page <= MAX_PAGES && wants_more(has_more, selected.length, request.limit)) {
-    const result = await fetch_page(request, page);
-    selected.push(...result.selected);
-    has_more = result.is_full;
-    page += 1;
-  }
-  return {
-    rows: selected.slice(0, request.limit),
-    is_capped: wants_more(has_more, selected.length, request.limit)
-  };
-}
-async function read_relations2(rows, repo) {
-  const relations = [];
-  for (const row of rows) {
-    relations.push(await read_blocked_by(String(row.number), row, repo));
-  }
-  return relations;
-}
-async function issue_list(request) {
-  try {
-    const { rows, is_capped } = await fetch_selected(request);
-    const fields = git_gh_issue_rest.split_fields(request.json_fields);
-    const relations = fields.includes(BLOCKED_BY_FIELD) ? await read_relations2(rows, request.repo) : void 0;
-    const mapped = rows.map(
-      (row, index) => git_gh_issue_rest.to_gh_issue(row, fields, relations?.[index])
-    );
-    return { json: JSON.stringify(mapped), is_capped };
-  } catch {
-    return { json: void 0, is_capped: false };
-  }
-}
-var git_gh_issue_list = {
-  issue_list
-};
-
-// scripts/git/git-gh-issue-write.ts
-var PATCH_METHOD = "PATCH";
-var DELETE_METHOD = "DELETE";
-var HTML_URL_FILTER = ".html_url";
-var ID_FILTER = ".id";
-var LABELS_SEGMENT = "/labels";
-var COMMENTS_SEGMENT = "/comments";
-var CLOSED_STATE = "closed";
-var COLOR_HASH = "#";
-async function did_write_succeed(write) {
-  try {
-    await write();
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function issue_edit_body(issue_number, body) {
-  return await git_gh_exec.exec_gh_api({
-    path: git_gh_api_path.issue_api_path(issue_number),
-    method: PATCH_METHOD,
-    body: JSON.stringify({ body }),
-    jq_filter: HTML_URL_FILTER
-  });
-}
-async function issue_comment(issue_number, body) {
-  return await git_gh_exec.exec_gh_api({
-    path: `${git_gh_api_path.issue_api_path(issue_number)}${COMMENTS_SEGMENT}`,
-    body: JSON.stringify({ body }),
-    jq_filter: HTML_URL_FILTER
-  });
-}
-async function issue_try_comment(issue_number, body) {
-  return await did_write_succeed(async () => await issue_comment(issue_number, body));
-}
-async function issue_close(issue_number, comment) {
-  return await did_write_succeed(async () => {
-    if (comment !== void 0) await issue_comment(issue_number, comment);
-    await git_gh_exec.exec_gh_api({
-      path: git_gh_api_path.issue_api_path(issue_number),
-      method: PATCH_METHOD,
-      body: JSON.stringify({ state: CLOSED_STATE })
-    });
-  });
-}
-function to_label_color(color) {
-  return color.startsWith(COLOR_HASH) ? color.slice(COLOR_HASH.length) : color;
-}
-async function label_ensure(input) {
-  try {
-    await git_gh_exec.exec_gh_api({
-      path: `${git_gh_api_path.repo_api_path()}${LABELS_SEGMENT}`,
-      body: JSON.stringify({
-        name: input.name,
-        color: to_label_color(input.color),
-        description: input.description
-      })
-    });
-  } catch {
-  }
-}
-function issue_create_request(input) {
-  const { labels } = input;
-  return {
-    path: git_gh_api_path.issues_api_path(input.repo),
-    body: JSON.stringify({
-      title: input.title,
-      ...labels !== void 0 && { labels },
-      body: input.body
-    }),
-    jq_filter: HTML_URL_FILTER
-  };
-}
-async function issue_create_with_label(input) {
-  return await git_gh_exec.exec_gh_api(
-    issue_create_request({ title: input.title, body: input.body, labels: [input.label] })
-  );
-}
-async function issue_add_label(issue_number, label) {
-  return await did_write_succeed(
-    async () => await git_gh_exec.exec_gh_api({
-      path: `${git_gh_api_path.issue_api_path(issue_number)}${LABELS_SEGMENT}`,
-      body: JSON.stringify({ labels: [label] })
-    })
-  );
-}
-async function issue_remove_label(issue_number, label) {
-  const labels_path = `${git_gh_api_path.issue_api_path(issue_number)}${LABELS_SEGMENT}`;
-  await git_gh_exec.exec_gh_api({
-    path: `${labels_path}/${encodeURIComponent(label)}`,
-    method: DELETE_METHOD
-  });
-}
-async function read_issue_id(issue_number) {
-  const raw = await git_gh_exec.exec_gh_api({
-    path: git_gh_api_path.issue_api_path(issue_number),
-    jq_filter: ID_FILTER
-  });
-  const issue_id = Number(raw.trim());
-  if (!Number.isSafeInteger(issue_id) || issue_id <= 0) {
-    throw new Error(`gh api answered no database id for issue #${issue_number}`);
-  }
-  return issue_id;
-}
-async function issue_add_blocked_by(issue_number, blocker) {
-  return await did_write_succeed(async () => {
-    const issue_id = await read_issue_id(blocker);
-    await git_gh_exec.exec_gh_api({
-      path: git_gh_api_path.blocked_by_api_path(issue_number),
-      body: JSON.stringify({ issue_id })
-    });
-  });
-}
-async function issue_remove_blocked_by(issue_number, blocker) {
-  return await did_write_succeed(async () => {
-    const issue_id = await read_issue_id(blocker);
-    const relations_path = git_gh_api_path.blocked_by_api_path(issue_number);
-    await git_gh_exec.exec_gh_api({
-      path: `${relations_path}/${String(issue_id)}`,
-      method: DELETE_METHOD
-    });
-  });
-}
-var git_gh_issue_write = {
-  issue_edit_body,
-  issue_comment,
-  issue_try_comment,
-  issue_close,
-  label_ensure,
-  issue_create_request,
-  issue_create_with_label,
-  issue_add_label,
-  issue_remove_label,
-  issue_add_blocked_by,
-  issue_remove_blocked_by
-};
-
-// scripts/git/git-gh-issue.ts
-var NUMBER_AND_BODY_FIELDS = "number,body";
-var BACKLOG_SCAN_FIELDS = `number,title,body,${BLOCKED_BY_COUNT_FIELD}`;
-var NUMBER_TITLE_AND_LABELS_FIELDS = "number,title,labels";
-var SUMMARY_FIELDS = "number,title,labels,createdAt";
-var PICKUP_FIELDS = `${SUMMARY_FIELDS},blockedBy`;
-var { issue_list: issue_list2 } = git_gh_issue_list;
-async function issue_list_recent(limit) {
-  return await issue_list2({ json_fields: SUMMARY_FIELDS, limit });
-}
-async function issue_list_open_bodies(limit) {
-  return await issue_list2({ json_fields: BACKLOG_SCAN_FIELDS, limit });
-}
-async function issue_list_recently_closed(limit) {
-  return await issue_list2({
-    json_fields: NUMBER_TITLE_AND_LABELS_FIELDS,
-    limit,
-    state: "closed",
-    sort: "updated"
-  });
-}
-async function issue_search_body(term, limit) {
-  return await issue_list2({
-    json_fields: NUMBER_AND_BODY_FIELDS,
-    limit,
-    body_term: term
-  });
-}
-async function issue_list_by_label(label, limit) {
-  return await issue_list2({ json_fields: NUMBER_AND_BODY_FIELDS, limit, label });
-}
-async function issue_list_by_label_summary(label, limit, options) {
-  return await issue_list2({
-    json_fields: options?.json_fields ?? PICKUP_FIELDS,
-    limit,
-    label
-  });
-}
-async function issue_list_by_label_in_repo(label, limit, repo) {
-  return await issue_list2({ json_fields: SUMMARY_FIELDS, limit, label, repo });
-}
-var git_gh_issue = {
-  ...git_gh_issue_read,
-  ...git_gh_issue_write,
-  issue_list_recent,
-  issue_list_by_label,
-  issue_list_by_label_in_repo,
-  issue_list_by_label_summary,
-  issue_search_body,
-  issue_list_open_bodies,
-  issue_list_recently_closed
-};
-
-// scripts/ci/pr-classification.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { z as z8 } from "zod";
-var CLASSIFICATION_SET = new Set(RELEASE_CLASSIFICATION_NAMES);
-var ISSUE_BUG_LABEL = "bug";
-var DECLARATION_PREFIX = "- \u30EA\u30EA\u30FC\u30B9\u5206\u985E: ";
-var DECLARATION = new RegExp(`^${DECLARATION_PREFIX}(.+)$`, "gmu");
-var LEGACY_LABELS = /* @__PURE__ */ new Set(["semver-major", "semver-minor"]);
-var LABEL = z8.object({ name: z8.string() });
-var USER = z8.object({ login: z8.string() });
-var PULL_REQUEST = z8.object({ number: z8.number(), user: USER });
-var EVENT = z8.object({
-  pull_request: PULL_REQUEST,
-  repository: z8.object({ full_name: z8.string() })
-});
-function classification_error(labels, author) {
-  const legacy = labels.filter((label) => LEGACY_LABELS.has(label.toLowerCase()));
-  if (legacy.length > 0) return `Remove legacy release labels: ${legacy.join(", ")}`;
-  const selected = labels.filter((label) => CLASSIFICATION_SET.has(label.toLowerCase()));
-  if (selected.length > 1) {
-    return `Choose exactly one release classification; found: ${selected.join(", ")}`;
-  }
-  if (selected.length === 1 || author.endsWith("[bot]")) return void 0;
-  return `Choose one release classification: ${RELEASE_CLASSIFICATION_NAMES.join(", ")}`;
-}
-function declaration(label) {
-  return `${DECLARATION_PREFIX}${label}`;
-}
-function is_classification(value) {
-  return CLASSIFICATION_SET.has(value);
-}
-function release_candidates(candidates) {
-  if (!candidates.includes(BREAKING_CHANGE_LABEL)) return candidates;
-  return candidates.filter((candidate) => candidate !== ENHANCEMENT_LABEL);
-}
-function issue_candidates(issue_json) {
-  const issue = z8.object({ labels: z8.array(LABEL), body: z8.string().nullable() }).parse(JSON.parse(issue_json));
-  const names = issue.labels.map((label) => label.name.toLowerCase());
-  const declared = [...(issue.body ?? "").matchAll(DECLARATION)].map((match) => match[1] ?? "");
-  const candidates = [...release_candidates([...names, ...declared].filter(is_classification))];
-  const unknown = declared.filter((value) => !is_classification(value));
-  if (unknown.length > 0) throw new Error(`Unknown release classification: ${unknown.join(", ")}`);
-  if (names.includes(ISSUE_BUG_LABEL) && !candidates.includes(BREAKING_CHANGE_LABEL)) {
-    candidates.push(BUGFIX_LABEL);
-  }
-  return candidates;
-}
-function select_issue_classification(issue_json) {
-  const candidates = issue_candidates(issue_json);
-  const selected = [...new Set(candidates)];
-  const [label] = selected;
-  if (label === void 0 || selected.length > 1) {
-    throw new Error(
-      `Choose one release classification before opening the PR: ${RELEASE_CLASSIFICATION_NAMES.join(", ")}; found: ${selected.join(", ") || "none"}. Add "${DECLARATION_PREFIX}<label>" to the Issue body.`
-    );
-  }
-  return label;
-}
-function fetch_current_labels(repository, pull_number) {
-  const path7 = `repos/${repository}/issues/${String(pull_number)}/labels`;
-  try {
-    const names = git_gh_exec.exec_gh_api_sync({ path: path7, jq_filter: ".[].name" });
-    return names.split("\n").filter((name) => name !== "");
-  } catch (error) {
-    const detail = error_text.message_of(error);
-    throw new Error(`Could not read the pull request labels: ${detail}`, { cause: error });
-  }
-}
-function check_event(event_path, read_labels = fetch_current_labels) {
-  const event = EVENT.parse(JSON.parse(readFileSync5(event_path, "utf8")));
-  const labels = read_labels(event.repository.full_name, event.pull_request.number);
-  return classification_error(labels, event.pull_request.user.login);
-}
-if (process.argv[1] === fileURLToPath2(import.meta.url)) {
-  const event_path = process.env["GITHUB_EVENT_PATH"];
-  if (!event_path) throw new Error("GITHUB_EVENT_PATH is required");
-  const error = check_event(event_path);
-  if (error) {
-    console.error(`::error::${error}`);
-    process.exitCode = 1;
-  }
-}
-var pr_classification = {
-  classification_error,
-  check_event,
-  fetch_current_labels,
-  declaration,
-  is_classification,
-  select_issue_classification
-};
-
-// scripts/lib/poll.ts
-async function sleep(duration_ms) {
-  await new Promise((resolve2) => {
-    setTimeout(resolve2, duration_ms);
-  });
-}
-async function wait_between(wait, interval_ms, attempt, attempts) {
-  if (attempt < attempts - 1) await wait(interval_ms);
-}
-async function poll_until(is_done, options) {
-  const wait = options.sleeper ?? sleep;
-  for (let attempt = 0; attempt < options.attempts; attempt += 1) {
-    if (await is_done()) return true;
-    await wait_between(wait, options.interval_ms, attempt, options.attempts);
-  }
-  return false;
-}
-var poll = { poll_until, sleep };
-
-// scripts/git/git-gh-pr.ts
-import { z as z12 } from "zod";
-
-// scripts/git/git-gh-pr-rest.ts
-import { z as z9 } from "zod";
-var rest_repo_schema = z9.looseObject({ full_name: z9.string().optional() }).nullish();
-var rest_pull_side_schema = z9.looseObject({ repo: rest_repo_schema });
-var rest_pull_schema = z9.looseObject({
-  number: z9.number(),
-  html_url: z9.string().optional(),
-  body: z9.string().nullish(),
-  state: z9.string().optional(),
-  merged: z9.boolean().nullish(),
-  merged_at: z9.string().nullish(),
-  mergeable: z9.boolean().nullish(),
-  mergeable_state: z9.string().optional(),
-  // `sha` is the head commit, which is what both halves of the merge-gate rollup are keyed by —
-  // REST hangs the check runs and the status contexts off the commit rather than off the pull
-  // request (joshuafolkken/kit#1028).
-  head: z9.looseObject({ ref: z9.string().optional(), sha: z9.string().optional(), repo: rest_repo_schema }).nullish(),
-  base: rest_pull_side_schema.nullish(),
-  // `node_id` is what the GraphQL auto-merge mutation addresses a pull request by, and `auto_merge`
-  // is `null` until auto-merge is enabled — both read by `git-gh-pr-auto-merge.ts`
-  // (joshuafolkken/kit#2497).
-  node_id: z9.string().optional(),
-  auto_merge: z9.looseObject({}).nullish()
-});
-var NOT_A_PULL_MESSAGE = "gh api answered something other than a pull request object";
-var NOT_A_PULL_LISTING_MESSAGE = "gh api answered something other than a pull request listing";
-var NOT_A_COMMENT_LISTING_MESSAGE = "gh api answered something other than a comment listing";
-var OPEN_STATE2 = "open";
-var EMPTY_BODY2 = "";
-function parse_rest_pull(rest_json) {
-  const parsed = parse_json_object_safe(rest_json, rest_pull_schema);
-  if (parsed === void 0) throw new Error(NOT_A_PULL_MESSAGE);
-  return parsed;
-}
-function parse_rest_pulls(rest_json) {
-  const parsed = parse_json_array_or_undefined(rest_json, rest_pull_schema);
-  if (parsed === void 0) throw new Error(NOT_A_PULL_LISTING_MESSAGE);
-  return parsed;
-}
-function select_pull(pulls) {
-  return pulls.find((pull) => pull.state === OPEN_STATE2) ?? pulls[0];
-}
-function is_merged(pull) {
-  return pull.merged === true || typeof pull.merged_at === "string";
-}
-function to_pr_state(pull) {
-  return is_merged(pull) ? MERGED_STATE : to_gh_state(pull.state);
-}
-function to_repo_name(side) {
-  return side?.repo?.full_name;
-}
-function is_same_repository_head(pull) {
-  const head_repo = to_repo_name(pull.head);
-  return head_repo !== void 0 && head_repo === to_repo_name(pull.base);
-}
-function to_pr_info(pull) {
-  return {
-    mergeable: pull.mergeable,
-    mergeStateStatus: to_gh_state(pull.mergeable_state),
-    state: to_pr_state(pull)
-  };
-}
-function to_pr_comments(rest_json) {
-  const parsed = parse_json_array_or_undefined(rest_json, rest_comment_schema);
-  if (parsed === void 0) throw new Error(NOT_A_COMMENT_LISTING_MESSAGE);
-  return parsed.map((comment) => ({
-    body: comment.body ?? EMPTY_BODY2,
-    url: comment.html_url,
-    author: { login: comment.user?.login }
-  }));
-}
-var git_gh_pr_rest = {
-  parse_rest_pull,
-  parse_rest_pulls,
-  select_pull,
-  is_same_repository_head,
-  is_merged,
-  to_pr_state,
-  to_pr_info,
-  to_pr_comments
-};
-
-// scripts/git/git-gh-pr-read.ts
-var pr_number_by_branch = /* @__PURE__ */ new Map();
-var LOOKUP_QUERY = "state=all&sort=created&direction=desc&per_page=100";
-var COMMENTS_QUERY = FULL_PAGE_QUERY;
-var OWNER_PLACEHOLDER = "{owner}";
-var NO_PULL_REQUEST_MESSAGE = "gh api found no pull request for branch";
-var UNREADABLE_PULL_REQUEST_MESSAGE = "gh api could not read the pull requests for branch";
-function lookup_path(branch_name) {
-  const head = `${OWNER_PLACEHOLDER}:${encodeURIComponent(branch_name)}`;
-  return `${git_gh_api_path.pulls_api_path()}?head=${head}&${LOOKUP_QUERY}`;
-}
-async function fetch_pr_number(branch_name) {
-  const json = await git_gh_exec.exec_gh_api({ path: lookup_path(branch_name) });
-  return git_gh_pr_rest.select_pull(git_gh_pr_rest.parse_rest_pulls(json))?.number;
-}
-var pending_pr_number_by_branch = /* @__PURE__ */ new Map();
-async function fetch_pr_number_read(branch_name) {
-  try {
-    const pr_number = await fetch_pr_number(branch_name);
-    if (pr_number === void 0) return { kind: "missing" };
-    pr_number_by_branch.set(branch_name, pr_number);
-    return { kind: "read", pr_number };
-  } catch (error) {
-    return { kind: "unreadable", cause: error };
-  }
-}
-async function start_pr_number_read(branch_name) {
-  const pending = pending_pr_number_by_branch.get(branch_name);
-  if (pending !== void 0) return await pending;
-  const lookup = fetch_pr_number_read(branch_name);
-  pending_pr_number_by_branch.set(branch_name, lookup);
-  try {
-    return await lookup;
-  } finally {
-    pending_pr_number_by_branch.delete(branch_name);
-  }
-}
-function forget_pr_numbers() {
-  pr_number_by_branch.clear();
-  pending_pr_number_by_branch.clear();
-}
-async function read_pr_number(branch_name) {
-  const cached = pr_number_by_branch.get(branch_name);
-  if (cached !== void 0) return { kind: "read", pr_number: cached };
-  return await start_pr_number_read(branch_name);
-}
-async function resolve_pr_number(branch_name) {
-  const read2 = await read_pr_number(branch_name);
-  return read2.kind === "read" ? read2.pr_number : void 0;
-}
-function to_unreadable_error(branch_name, cause) {
-  return new Error(`${UNREADABLE_PULL_REQUEST_MESSAGE}: ${branch_name}`, { cause });
-}
-async function require_pr_number(branch_name) {
-  const read2 = await read_pr_number(branch_name);
-  if (read2.kind === "read") return read2.pr_number;
-  if (read2.kind === "missing") throw new Error(`${NO_PULL_REQUEST_MESSAGE}: ${branch_name}`);
-  throw to_unreadable_error(branch_name, read2.cause);
-}
-async function read_pull(pr_number) {
-  const json = await git_gh_exec.exec_gh_api({
-    path: git_gh_api_path.pull_api_path(String(pr_number))
-  });
-  return git_gh_pr_rest.parse_rest_pull(json);
-}
-async function read_pull_of_branch(branch_name) {
-  const pr_number = await resolve_pr_number(branch_name);
-  if (pr_number === void 0) return void 0;
-  try {
-    return await read_pull(pr_number);
-  } catch {
-    return void 0;
-  }
-}
-async function pr_exists(branch_name) {
-  const read2 = await read_pr_number(branch_name);
-  if (read2.kind === "unreadable") throw to_unreadable_error(branch_name, read2.cause);
-  return read2.kind === "read";
-}
-async function pr_get_number(branch_name) {
-  return await resolve_pr_number(branch_name);
-}
-async function pr_get_url(branch_name) {
-  const pull = await read_pull_of_branch(branch_name);
-  if (pull?.html_url === void 0) return void 0;
-  return git_gh_helpers.parse_pr_state_string(pull.html_url);
-}
-async function pr_get_body(branch_name) {
-  const pull = await read_pull_of_branch(branch_name);
-  const body = pull?.body;
-  return typeof body === "string" && body.length > 0 ? body : void 0;
-}
-async function pr_view(branch_name) {
-  const pull = await read_pull_of_branch(branch_name);
-  if (pull === void 0) return "";
-  return JSON.stringify(git_gh_pr_rest.to_pr_info(pull));
-}
-async function read_comments(branch_name, to_path, to_json) {
-  const pr_number = await resolve_pr_number(branch_name);
-  if (pr_number === void 0) return void 0;
-  const path7 = `${to_path(String(pr_number))}${COMMENTS_QUERY}`;
-  try {
-    return to_json(await git_gh_exec.exec_gh_api({ path: path7, should_paginate: true }));
-  } catch {
-    return void 0;
-  }
-}
-function to_comments_json(raw) {
-  return JSON.stringify(git_gh_pr_rest.to_pr_comments(raw));
-}
-function as_served(raw) {
-  return raw;
-}
-async function pr_get_comments(branch_name) {
-  return await read_comments(branch_name, git_gh_api_path.issue_comments_api_path, to_comments_json);
-}
-async function pr_get_review_comments(branch_name) {
-  return await read_comments(branch_name, git_gh_api_path.pull_comments_api_path, as_served);
-}
-var git_gh_pr_read = {
-  pr_exists,
-  pr_get_number,
-  pr_get_url,
-  pr_get_body,
-  pr_view,
-  pr_get_comments,
-  pr_get_review_comments
-};
-
-// scripts/git/git-gh-pr-review.ts
-import { z as z10 } from "zod";
-var REVIEW_APPROVED = "APPROVED";
-var REVIEW_CHANGES_REQUESTED = "CHANGES_REQUESTED";
-var REVIEW_NONE = "";
-var STATE_CHANGING_REVIEWS = /* @__PURE__ */ new Set([REVIEW_APPROVED, REVIEW_CHANGES_REQUESTED]);
-var rest_review_schema = z10.looseObject({
-  state: z10.string().optional(),
-  user: z10.looseObject({ login: z10.string().optional() }).nullish()
-});
-var NOT_A_REVIEW_LISTING = "gh api answered something other than a review listing";
-function parse_rest_reviews(reviews_json) {
-  const parsed = parse_json_array_or_undefined(reviews_json, rest_review_schema);
-  if (parsed === void 0) throw new Error(NOT_A_REVIEW_LISTING);
-  return parsed;
-}
-var UNATTRIBUTED_REVIEWER = "(no author)";
-function read_reviewer(review) {
-  const login = review.user?.login;
-  return typeof login === "string" && login.length > 0 ? login : UNATTRIBUTED_REVIEWER;
-}
-function read_state_changing(review) {
-  const state = review.state?.toUpperCase();
-  return state !== void 0 && STATE_CHANGING_REVIEWS.has(state) ? state : void 0;
-}
-function fold_latest_states(reviews) {
-  const latest = /* @__PURE__ */ new Map();
-  for (const review of reviews) {
-    const state = read_state_changing(review);
-    if (state !== void 0) latest.set(read_reviewer(review), state);
-  }
-  return latest;
-}
-function to_review_decision(reviews_json) {
-  const latest = new Set(fold_latest_states(parse_rest_reviews(reviews_json)).values());
-  if (latest.has(REVIEW_CHANGES_REQUESTED)) return REVIEW_CHANGES_REQUESTED;
-  return latest.has(REVIEW_APPROVED) ? REVIEW_APPROVED : REVIEW_NONE;
-}
-var git_gh_pr_review = { to_review_decision, parse_rest_reviews };
-
-// scripts/git/git-gh-pr-rollup.ts
-import { z as z11 } from "zod";
-var STATUS_CONTEXT_TYPE_NAME = "StatusContext";
-var TYPE_NAME_KEY = "__typename";
-var rollup_element_schema = z11.looseObject({});
-var check_runs_page_schema = z11.looseObject({
-  // Required, not optional: GitHub always names the key, and accepting a page without one would
-  // answer an empty rollup — which `git-pr-followup.ts` reports as "this branch has no checks".
-  check_runs: z11.array(rollup_element_schema)
-});
-var id_holder_schema = z11.object({ id: z11.number() });
-var status_page_schema = z11.looseObject({
-  statuses: z11.array(rollup_element_schema)
-});
-var NOT_A_CHECK_RUNS_LISTING = "gh api answered something other than a check run listing";
-var NOT_A_STATUS_LISTING = "gh api answered something other than a commit status listing";
-function read_pages(raw_json, schema, message) {
-  const pages = parse_json_array_or_undefined(raw_json, schema);
-  if (pages === void 0) throw new Error(message);
-  return pages;
-}
-var NO_SUITE = -1;
-function read_id(value) {
-  const parsed = id_holder_schema.safeParse(value);
-  return parsed.success ? parsed.data.id : void 0;
-}
-function check_run_group_key(run2) {
-  const { name, app } = run2;
-  if (typeof name !== "string") return void 0;
-  return JSON.stringify([name, read_id(app)]);
-}
-function read_rank(run2) {
-  const id = read_id(run2);
-  if (id === void 0) return void 0;
-  return { suite: read_id(run2["check_suite"]) ?? NO_SUITE, run: id };
-}
-function is_ranked_above(candidate, current) {
-  if (candidate.suite !== current.suite) return candidate.suite > current.suite;
-  return candidate.run > current.run;
-}
-function should_replace(previous, rank) {
-  const previous_rank = previous === void 0 ? void 0 : read_rank(previous);
-  return previous_rank === void 0 || is_ranked_above(rank, previous_rank);
-}
-function remember_newest_run(run2, newest) {
-  const key = check_run_group_key(run2);
-  const rank = read_rank(run2);
-  if (key === void 0 || rank === void 0) return;
-  if (should_replace(newest.get(key), rank)) newest.set(key, run2);
-}
-function is_newest_run(run2, newest) {
-  const key = check_run_group_key(run2);
-  if (key === void 0 || read_rank(run2) === void 0) return true;
-  return newest.get(key) === run2;
-}
-function to_check_run_items(check_runs_json) {
-  const pages = read_pages(check_runs_json, check_runs_page_schema, NOT_A_CHECK_RUNS_LISTING);
-  const runs = pages.flatMap((page) => page.check_runs);
-  const newest = /* @__PURE__ */ new Map();
-  for (const run2 of runs) remember_newest_run(run2, newest);
-  return runs.filter((run2) => is_newest_run(run2, newest));
-}
-function to_status_context_items(status_json) {
-  const pages = read_pages(status_json, status_page_schema, NOT_A_STATUS_LISTING);
-  return pages.flatMap((page) => page.statuses).map((status) => ({ ...status, [TYPE_NAME_KEY]: STATUS_CONTEXT_TYPE_NAME }));
-}
-function to_status_check_rollup(input) {
-  return [
-    ...to_check_run_items(input.check_runs_json),
-    ...to_status_context_items(input.status_json)
-  ];
-}
-var git_gh_pr_rollup = {
-  to_check_run_items,
-  to_status_context_items,
-  to_status_check_rollup
-};
-
-// scripts/git/git-gh-pr-snapshot.ts
-var NO_HEAD_SHA_MESSAGE = "gh api answered a pull request with no head commit";
-async function read_object_pages(path7) {
-  return await git_gh_exec.exec_gh_api({
-    path: `${path7}${FULL_PAGE_QUERY}`,
-    should_paginate: true,
-    should_slurp: true
-  });
-}
-async function read_array_pages(path7) {
-  return await git_gh_exec.exec_gh_api({
-    path: `${path7}${FULL_PAGE_QUERY}`,
-    should_paginate: true
-  });
-}
-function read_head_sha(pull) {
-  const sha = pull.head?.sha;
-  if (sha === void 0) throw new Error(NO_HEAD_SHA_MESSAGE);
-  return sha;
-}
-async function read_status_check_rollup(commit_sha) {
-  const [check_runs_json, status_json] = await Promise.all([
-    read_object_pages(git_gh_api_path.commit_check_runs_api_path(commit_sha)),
-    read_object_pages(git_gh_api_path.commit_status_api_path(commit_sha))
-  ]);
-  return git_gh_pr_rollup.to_status_check_rollup({ check_runs_json, status_json });
-}
-async function pr_get_review_decision(pr_number) {
-  const path7 = git_gh_api_path.pull_reviews_api_path(String(pr_number));
-  return git_gh_pr_review.to_review_decision(await read_array_pages(path7));
-}
-async function build_checks_fields(pull) {
-  return {
-    statusCheckRollup: await read_status_check_rollup(read_head_sha(pull)),
-    mergeStateStatus: to_gh_state(pull.mergeable_state)
-  };
-}
-async function resolve_pull(branch_name) {
-  const pr_number = await require_pr_number(branch_name);
-  return { pr_number, pull: await read_pull(pr_number) };
-}
-async function pr_get_checks_snapshot(branch_name) {
-  const { pr_number, pull } = await resolve_pull(branch_name);
-  return { pr_number, snapshot_json: JSON.stringify(await build_checks_fields(pull)) };
-}
-async function pr_get_state_snapshot(branch_name) {
-  const { pr_number, pull } = await resolve_pull(branch_name);
-  const [fields, review_decision] = await Promise.all([
-    build_checks_fields(pull),
-    pr_get_review_decision(pr_number)
-  ]);
-  return JSON.stringify({ ...fields, reviewDecision: review_decision });
-}
-var git_gh_pr_snapshot = {
-  pr_get_state_snapshot,
-  pr_get_checks_snapshot,
-  pr_get_review_decision
-};
-
-// scripts/git/git-gh-pr.ts
-var HTML_URL_FILTER2 = ".html_url";
-var PUT_METHOD = "PUT";
-var PATCH_METHOD2 = "PATCH";
-var MERGE_COMMIT_METHOD = "merge";
-var MERGE_REQUEST_TIMEOUT_MS = 18e4;
-var MERGE_UNCONFIRMED_MESSAGE = "gh api could not read the pull request back after the merge request failed";
-var MERGE_READ_BACK_ATTEMPTS = 3;
-var MERGE_READ_BACK_INTERVAL_MS = 1e3;
-var PR_NUMBER_PATTERN = /\/pull\/([1-9]\d*)$/u;
-var LABELS_SEGMENT2 = "/labels";
-var PR_LABELS = z12.array(z12.object({ name: z12.string() }));
-async function add_pr_classification(number, label) {
-  await git_gh_exec.exec_gh_api({
-    path: `${git_gh_api_path.issue_api_path(number)}${LABELS_SEGMENT2}`,
-    body: JSON.stringify({ labels: [label] })
-  });
-}
-async function pr_get_classification(branch_name) {
-  const number = await require_pr_number(branch_name);
-  const response = await git_gh_exec.exec_gh_api({
-    path: `${git_gh_api_path.issue_api_path(String(number))}${LABELS_SEGMENT2}`
-  });
-  const names = PR_LABELS.parse(JSON.parse(response)).map((label) => label.name.toLowerCase());
-  const selected = names.filter((name) => pr_classification.is_classification(name));
-  if (selected.length === 0) return void 0;
-  const error = pr_classification.classification_error(names, "human");
-  if (error !== void 0) throw new Error(error);
-  return selected[0];
-}
-async function pr_ensure_classification(branch_name, label) {
-  if (await pr_get_classification(branch_name) !== void 0) return;
-  const number = await require_pr_number(branch_name);
-  await add_pr_classification(String(number), label);
-}
-async function post_pull_request(title, body) {
-  const base = await git_command.get_default_branch();
-  const head = await git_command.branch();
-  forget_pr_numbers();
-  try {
-    return await git_gh_exec.exec_gh_api({
-      path: git_gh_api_path.pulls_api_path(),
-      body: JSON.stringify({ title, body, head, base }),
-      jq_filter: HTML_URL_FILTER2
-    });
-  } catch (error) {
-    return git_gh_helpers.handle_pr_create_error(error);
-  }
-}
-async function pr_create(title, body, label) {
-  const classification_error2 = pr_classification.classification_error([label], "human");
-  if (classification_error2 !== void 0) throw new Error(classification_error2);
-  const url = await post_pull_request(title, body);
-  const number = PR_NUMBER_PATTERN.exec(url)?.[1];
-  if (number === void 0) throw new Error(`Could not identify the created pull request: ${url}`);
-  await add_pr_classification(number, label);
-  return url;
-}
-async function pr_comment(branch_name, body) {
-  const pr_number = await require_pr_number(branch_name);
-  return await git_gh_issue_write.issue_comment(String(pr_number), body);
-}
-async function pr_update_body(branch_name, body) {
-  const pr_number = await require_pr_number(branch_name);
-  await git_gh_exec.exec_gh_api({
-    path: git_gh_api_path.pull_api_path(String(pr_number)),
-    method: PATCH_METHOD2,
-    body: JSON.stringify({ body })
-  });
-}
-async function put_merge(pr_number) {
-  await git_gh_exec.exec_gh_api({
-    path: git_gh_api_path.pull_merge_api_path(String(pr_number)),
-    method: PUT_METHOD,
-    body: JSON.stringify({ merge_method: MERGE_COMMIT_METHOD }),
-    timeout_ms: MERGE_REQUEST_TIMEOUT_MS
-  });
-}
-async function read_merge_state(pr_number) {
-  try {
-    return git_gh_pr_rest.is_merged(await read_pull(pr_number));
-  } catch (error) {
-    console.warn(`Could not read the pull request back: ${String(error)}`);
-    return void 0;
-  }
-}
-async function sleep_between_read_backs(attempt) {
-  if (attempt < MERGE_READ_BACK_ATTEMPTS - 1) await poll.sleep(MERGE_READ_BACK_INTERVAL_MS);
-}
-async function has_merge_landed(pr_number, merge_error) {
-  for (let attempt = 0; attempt < MERGE_READ_BACK_ATTEMPTS; attempt += 1) {
-    const is_merged2 = await read_merge_state(pr_number);
-    if (is_merged2 !== void 0) return is_merged2;
-    await sleep_between_read_backs(attempt);
-  }
-  throw new Error(MERGE_UNCONFIRMED_MESSAGE, { cause: merge_error });
-}
-async function pr_merge(branch_name) {
-  const pr_number = await require_pr_number(branch_name);
-  try {
-    await put_merge(pr_number);
-  } catch (error) {
-    if (!await has_merge_landed(pr_number, error)) throw error;
-  }
-}
-var git_gh_pr = {
-  ...git_gh_pr_read,
-  ...git_gh_pr_snapshot,
-  pr_create,
-  pr_get_classification,
-  pr_ensure_classification,
-  pr_comment,
-  pr_merge,
-  pr_update_body
-};
-
-// scripts/git/git-gh-pr-auto-merge.ts
-var GRAPHQL_PATH = "graphql";
-var OPEN_PULLS_QUERY = `${git_gh_api_path.FULL_PAGE_QUERY}&state=open`;
-var MISSING_NODE_ID_MESSAGE = "gh api answered a pull request without a node_id";
-var ENABLE_AUTO_MERGE_MUTATION = "mutation($id: ID!) { enablePullRequestAutoMerge(input: { pullRequestId: $id, mergeMethod: MERGE }) { clientMutationId } }";
-async function pr_enable_auto_merge(branch_name) {
-  const pull = await read_pull(await require_pr_number(branch_name));
-  if (pull.node_id === void 0) throw new Error(MISSING_NODE_ID_MESSAGE);
-  await git_gh_exec.exec_gh_api({
-    path: GRAPHQL_PATH,
-    body: JSON.stringify({ query: ENABLE_AUTO_MERGE_MUTATION, variables: { id: pull.node_id } })
-  });
-}
-async function pr_is_merged(branch_name) {
-  try {
-    return git_gh_pr_rest.is_merged(await read_pull(await require_pr_number(branch_name)));
-  } catch {
-    return false;
-  }
-}
-function head_reference_of(pull) {
-  return pull.head?.ref ?? "";
-}
-function has_head_prefix(pull, prefix) {
-  return git_gh_pr_rest.is_same_repository_head(pull) && head_reference_of(pull).startsWith(prefix);
-}
-function to_open_pull(pull) {
-  return {
-    number: pull.number,
-    head_ref: head_reference_of(pull),
-    has_auto_merge: pull.auto_merge !== null && pull.auto_merge !== void 0
-  };
-}
-async function pr_list_open_with_head_prefix(prefix) {
-  const json = await git_gh_exec.exec_gh_api({
-    path: `${git_gh_api_path.pulls_api_path()}${OPEN_PULLS_QUERY}`,
-    should_paginate: true
-  });
-  return git_gh_pr_rest.parse_rest_pulls(json).filter((pull) => has_head_prefix(pull, prefix)).map((pull) => to_open_pull(pull));
-}
-var git_gh_pr_auto_merge = {
-  pr_enable_auto_merge,
-  pr_is_merged,
-  pr_list_open_with_head_prefix
-};
-
-// scripts/git/git-gh-repo.ts
-async function repo_get_name_with_owner() {
-  try {
-    const result = await git_gh_exec.exec_gh_api({
-      path: git_gh_api_path.repo_api_path(),
-      jq_filter: ".full_name"
-    });
-    return git_gh_helpers.parse_pr_state_string(result);
-  } catch {
-    return void 0;
-  }
-}
-var git_gh_repo = {
-  repo_get_name_with_owner
-};
-
-// scripts/git/git-pr-checks-parse.ts
-var CHECK_STATUS_PASS = "pass";
-var CHECK_STATUS_PENDING = "pending";
-var CHECK_STATUS_FAIL = "fail";
-var CHECK_STATUS_MISSING = "missing";
-var PASSING_CONCLUSIONS = /* @__PURE__ */ new Set(["success", "skipped", "neutral"]);
-var KEY_TYPE_NAME = "__typename";
-var KEY_STATE = "state";
-var KEY_STATUS = "status";
-var KEY_CONCLUSION = "conclusion";
-var KEY_NAME = "name";
-var KEY_CONTEXT = "context";
-function read_string(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  if (trimmed.length === 0) return void 0;
-  return trimmed;
-}
-var PENDING_STATUS_STATES = /* @__PURE__ */ new Set(["pending", "expected"]);
-function parse_status_context(item) {
-  const state = read_string(item[KEY_STATE])?.toLowerCase();
-  if (state === "success") return CHECK_STATUS_PASS;
-  if (state !== void 0 && PENDING_STATUS_STATES.has(state)) return CHECK_STATUS_PENDING;
-  return CHECK_STATUS_FAIL;
-}
-function is_passing_conclusion(item) {
-  const conclusion = read_string(item[KEY_CONCLUSION])?.toLowerCase();
-  return conclusion !== void 0 && PASSING_CONCLUSIONS.has(conclusion);
-}
-function parse_check_run(item) {
-  const status = read_string(item[KEY_STATUS])?.toLowerCase();
-  if (status !== "completed") return CHECK_STATUS_PENDING;
-  return is_passing_conclusion(item) ? CHECK_STATUS_PASS : CHECK_STATUS_FAIL;
-}
-function parse_rollup_status(item) {
-  const type_name = read_string(item[KEY_TYPE_NAME]);
-  if (type_name === "StatusContext") return parse_status_context(item);
-  return parse_check_run(item);
-}
-function read_rollup_array(parsed) {
-  const result = pr_raw_schema.safeParse(parsed);
-  if (!result.success) return [];
-  return result.data.statusCheckRollup ?? [];
-}
-function parse_json_safe(raw_json) {
-  try {
-    return JSON.parse(raw_json);
-  } catch {
-    return void 0;
-  }
-}
-function parse_rollup_item(item) {
-  const name = read_string(item[KEY_NAME]) ?? read_string(item[KEY_CONTEXT]);
-  if (name === void 0) return void 0;
-  return { name, status: parse_rollup_status(item) };
-}
-function parse_rollup_checks(raw_json) {
-  const parsed = parse_json_safe(raw_json);
-  const rollup = read_rollup_array(parsed);
-  const checks = [];
-  for (const item of rollup) {
-    const parsed_item = parse_rollup_item(item);
-    if (parsed_item !== void 0) checks.push(parsed_item);
-  }
-  return checks;
-}
-function parse_pr_state_snapshot(raw_json) {
-  const parsed = parse_json_safe(raw_json);
-  const result = pr_raw_schema.safeParse(parsed);
-  const data = result.success ? result.data : void 0;
-  return {
-    rollup: parse_rollup_checks(raw_json),
-    merge_state_status: read_string(data?.mergeStateStatus),
-    review_decision: read_string(data?.reviewDecision)
-  };
-}
-
-// scripts/git/git-pr-checks-eval.ts
-var DEFAULT_REQUIRED_CHECKS = ["SonarQube"];
-var CODERABBIT_CHECK_NAME = "CodeRabbit";
-var REQUIRED_CHECKS_ENV_VAR = "JOSH_REQUIRED_CHECKS";
-function parse_required_checks() {
-  const raw = process.env[REQUIRED_CHECKS_ENV_VAR];
-  if (!raw) return DEFAULT_REQUIRED_CHECKS;
-  return raw.split(",").map((check3) => check3.trim()).filter((check3) => check3.length > 0);
-}
-var REQUIRED_CHECKS = parse_required_checks();
-var MERGE_STATE_CLEAN = "CLEAN";
-var MERGE_STATE_UNSTABLE = "UNSTABLE";
-var MERGE_STATE_DIRTY = "DIRTY";
-var REVIEW_CHANGES_REQUESTED2 = "CHANGES_REQUESTED";
-var CHECK_SUITE_SEPARATOR = " / ";
-var FAILURE_MESSAGE_PREFIX = "PR checks failed";
-var FAILURE_REASON_REVIEW = "review requested changes";
-var FAILURE_REASON_CHECKS = "failed checks";
-var FAILURE_REASON_CONFLICT = "merge conflict";
-function is_required_match(check_name, required_name) {
-  if (check_name === required_name) return true;
-  return check_name.startsWith(`${required_name}${CHECK_SUITE_SEPARATOR}`);
-}
-function find_required_check(checks, required_name) {
-  return checks.find((check3) => is_required_match(check3.name, required_name));
-}
-function read_required_statuses(checks) {
-  return REQUIRED_CHECKS.map(
-    (name) => find_required_check(checks, name)?.status ?? CHECK_STATUS_MISSING
-  );
-}
-function is_review_blocked(review_decision) {
-  return review_decision === REVIEW_CHANGES_REQUESTED2;
-}
-function is_merge_conflict(merge_state_status) {
-  return merge_state_status === MERGE_STATE_DIRTY;
-}
-function evaluate_failure_state(input) {
-  if (is_merge_conflict(input.merge_state_status) || is_review_blocked(input.review_decision) || input.failed_checks.length > 0) {
-    return "failure";
-  }
-  return void 0;
-}
-function is_merge_state_clean(merge_state_status) {
-  return merge_state_status === MERGE_STATE_CLEAN;
-}
-function is_every_required_passing(statuses) {
-  return statuses.every((status) => status === CHECK_STATUS_PASS);
-}
-function is_coderabbit_check(check_name) {
-  return is_required_match(check_name, CODERABBIT_CHECK_NAME);
-}
-function is_unstable_only_from_coderabbit(snapshot) {
-  if (snapshot.merge_state_status !== MERGE_STATE_UNSTABLE) return false;
-  const non_passing = snapshot.rollup.filter((check3) => check3.status !== CHECK_STATUS_PASS);
-  if (non_passing.length === 0) return false;
-  return non_passing.every((check3) => is_coderabbit_check(check3.name));
-}
-function is_required_check(check_name) {
-  return REQUIRED_CHECKS.some((required) => is_required_match(check_name, required));
-}
-function is_blocking_failure(check3) {
-  if (check3.status !== CHECK_STATUS_FAIL) return false;
-  return !is_coderabbit_check(check3.name) || is_required_check(check3.name);
-}
-function collect_blocking_failures(snapshot) {
-  return snapshot.rollup.filter((check3) => is_blocking_failure(check3)).map((check3) => check3.name);
-}
-function is_mergeable_state(snapshot) {
-  if (is_merge_state_clean(snapshot.merge_state_status)) return true;
-  return is_unstable_only_from_coderabbit(snapshot);
-}
-function collect_failure_reasons(snapshot) {
-  const reasons = [];
-  if (is_merge_conflict(snapshot.merge_state_status)) reasons.push(FAILURE_REASON_CONFLICT);
-  if (is_review_blocked(snapshot.review_decision)) reasons.push(FAILURE_REASON_REVIEW);
-  const failed = collect_blocking_failures(snapshot);
-  if (failed.length > 0) reasons.push(`${FAILURE_REASON_CHECKS}: ${failed.join(", ")}`);
-  return reasons;
-}
-function describe_pr_failure(snapshot) {
-  const reasons = collect_failure_reasons(snapshot);
-  if (reasons.length === 0) return `${FAILURE_MESSAGE_PREFIX}.`;
-  return `${FAILURE_MESSAGE_PREFIX} (${reasons.join("; ")}).`;
-}
-function evaluate_pr_state(snapshot) {
-  const statuses = read_required_statuses(snapshot.rollup);
-  const failure = evaluate_failure_state({
-    review_decision: snapshot.review_decision,
-    failed_checks: collect_blocking_failures(snapshot),
-    merge_state_status: snapshot.merge_state_status
-  });
-  if (failure !== void 0) return failure;
-  if (is_mergeable_state(snapshot) && is_every_required_passing(statuses)) {
-    return "success";
-  }
-  return "pending";
-}
-function is_review_decision_decisive(snapshot) {
-  return evaluate_pr_state(snapshot) !== "pending";
-}
-
-// scripts/git/git-pr-checks.ts
-var SECONDS_TO_MS = 1e3;
-var CHECK_WAIT_INTERVAL_MS = 1e4;
-var DEFAULT_TIMEOUT_SECONDS = 1920;
-function compute_max_attempts(timeout_seconds, interval_ms) {
-  return Math.ceil(timeout_seconds / (interval_ms / SECONDS_TO_MS)) + 1;
-}
-var DEFAULT_MAX_ATTEMPTS = compute_max_attempts(DEFAULT_TIMEOUT_SECONDS, CHECK_WAIT_INTERVAL_MS);
-function get_configured_max_attempts() {
-  const environment_seconds = Number(process.env["JOSH_CI_TIMEOUT_SECONDS"]);
-  return Number.isFinite(environment_seconds) && environment_seconds > 0 ? compute_max_attempts(environment_seconds, CHECK_WAIT_INTERVAL_MS) : DEFAULT_MAX_ATTEMPTS;
-}
-var CHECK_MAX_ATTEMPTS = get_configured_max_attempts();
-var DEFAULT_STABLE_READS = 2;
-var MAX_CONSECUTIVE_READ_FAILURES = 3;
-var PR_CHECKS_TIMEOUT_MESSAGE = "Timed out while waiting for PR checks to complete.";
-function is_pr_checks_timeout(error) {
-  return error instanceof Error && error.message === PR_CHECKS_TIMEOUT_MESSAGE;
-}
-var SHOULD_ALWAYS_READ_REVIEW_DECISION = () => true;
-var MERGE_GATE_EVALUATOR = {
-  evaluate: evaluate_pr_state,
-  describe: describe_pr_failure,
-  should_read_review_decision: is_review_decision_decisive
-};
-function advance_stable_count(previous, state) {
-  return state === "success" ? previous + 1 : 0;
-}
-function classify_poll_result(input) {
-  const state = input.evaluator.evaluate(input.snapshot);
-  if (state === "failure") throw new Error(input.evaluator.describe(input.snapshot));
-  const next_stable_count = advance_stable_count(input.stable_count, state);
-  return {
-    is_done: next_stable_count >= input.required_stable_reads,
-    next_stable_count
-  };
-}
-async function read_pr_state(input, evaluator) {
-  try {
-    const snapshot = await input.options.fetcher(
-      input.options.branch_name,
-      evaluator.should_read_review_decision ?? SHOULD_ALWAYS_READ_REVIEW_DECISION
-    );
-    return { kind: "read", snapshot };
-  } catch (error) {
-    return { kind: "unreadable", cause: error };
-  }
-}
-async function sleep_before_next_attempt(input) {
-  if (input.attempt < input.options.max_attempts - 1) {
-    await poll.sleep(input.options.interval_ms);
-  }
-}
-async function retry_after_unreadable(input, cause) {
-  const next_failure_count = input.failure_count + 1;
-  if (next_failure_count >= MAX_CONSECUTIVE_READ_FAILURES) throw cause;
-  console.warn(
-    `Could not read the PR state (${String(next_failure_count)}/${String(MAX_CONSECUTIVE_READ_FAILURES)}); asking again on the next poll: ${String(cause)}`
-  );
-  await sleep_before_next_attempt(input);
-  return { next_stable_count: 0, next_failure_count, read_failure: cause };
-}
-function to_exhaustion_error(last_read_failure) {
-  return last_read_failure ?? new Error(PR_CHECKS_TIMEOUT_MESSAGE);
-}
-async function attempt_pr_success_poll(input) {
-  const evaluator = input.options.evaluator ?? MERGE_GATE_EVALUATOR;
-  const read2 = await read_pr_state(input, evaluator);
-  if (read2.kind === "unreadable") return await retry_after_unreadable(input, read2.cause);
-  const classification = classify_poll_result({
-    snapshot: read2.snapshot,
-    stable_count: input.stable_count,
-    required_stable_reads: input.options.required_stable_reads,
-    evaluator
-  });
-  if (classification.is_done) {
-    return { snapshot: read2.snapshot, next_stable_count: 0, next_failure_count: 0 };
-  }
-  await sleep_before_next_attempt(input);
-  return { next_stable_count: classification.next_stable_count, next_failure_count: 0 };
-}
-async function wait_for_pr_success(options) {
-  let carried = { next_stable_count: 0, next_failure_count: 0 };
-  for (let attempt = 0; attempt < options.max_attempts; attempt += 1) {
-    console.info(`Checking PR status\u2026 (${String(attempt + 1)}/${String(options.max_attempts)})`);
-    carried = await attempt_pr_success_poll({
-      options,
-      stable_count: carried.next_stable_count,
-      failure_count: carried.next_failure_count,
-      attempt
-    });
-    if (carried.snapshot !== void 0) return carried.snapshot;
-  }
-  throw to_exhaustion_error(carried.read_failure);
-}
-async function default_fetch_pr_state(branch_name, should_read_review_decision = SHOULD_ALWAYS_READ_REVIEW_DECISION) {
-  const checks = await git_gh_pr_snapshot.pr_get_checks_snapshot(branch_name);
-  const snapshot = parse_pr_state_snapshot(checks.snapshot_json);
-  if (!should_read_review_decision(snapshot)) return snapshot;
-  const decision = await git_gh_pr_snapshot.pr_get_review_decision(checks.pr_number);
-  return { ...snapshot, review_decision: read_string(decision) };
-}
-
-// scripts/git/git-pr-checks-watch.ts
-var PR_CHECKS_WATCH_TIMEOUT_MS = 12e4;
-var WATCH_TIMED_OUT_NOTE = "\u23F1\uFE0F pr checks --watch timed out.";
-var NO_CHECKS_MESSAGE = "gh api reported no checks on the branch";
-var CHECKS_FAILED_MESSAGE = "gh api reported a failing check on the branch";
-function is_awaited_check(check3) {
-  return !is_coderabbit_check(check3.name) || is_required_check(check3.name);
-}
-function evaluate_checks_settled(snapshot) {
-  const awaited = snapshot.rollup.filter((check3) => is_awaited_check(check3));
-  const considered = awaited.length === 0 ? snapshot.rollup : awaited;
-  if (considered.length === 0 || considered.some((check3) => check3.status === CHECK_STATUS_PENDING)) {
-    return "pending";
-  }
-  return snapshot.rollup.some((check3) => check3.status === CHECK_STATUS_FAIL) ? "failure" : "success";
-}
-function describe_checks_failure(snapshot) {
-  const failed = snapshot.rollup.filter((check3) => check3.status === CHECK_STATUS_FAIL);
-  return `${CHECKS_FAILED_MESSAGE}: ${failed.map((check3) => check3.name).join(", ")}`;
-}
-var SHOULD_NEVER_READ_REVIEW_DECISION = () => false;
-var CHECKS_SETTLED_EVALUATOR = {
-  evaluate: evaluate_checks_settled,
-  describe: describe_checks_failure,
-  should_read_review_decision: SHOULD_NEVER_READ_REVIEW_DECISION
-};
-async function watch_until_settled(branch_name) {
-  await wait_for_pr_success({
-    branch_name,
-    fetcher: default_fetch_pr_state,
-    interval_ms: CHECK_WAIT_INTERVAL_MS,
-    max_attempts: compute_max_attempts(
-      PR_CHECKS_WATCH_TIMEOUT_MS / SECONDS_TO_MS,
-      CHECK_WAIT_INTERVAL_MS
-    ),
-    required_stable_reads: DEFAULT_STABLE_READS,
-    evaluator: CHECKS_SETTLED_EVALUATOR
-  });
-}
-async function fail_when_no_checks(branch_name) {
-  const snapshot = await default_fetch_pr_state(branch_name, SHOULD_NEVER_READ_REVIEW_DECISION);
-  if (snapshot.rollup.length === 0) throw new Error(NO_CHECKS_MESSAGE);
-}
-async function pr_checks_watch(branch_name) {
-  try {
-    await watch_until_settled(branch_name);
-    return { timed_out: false };
-  } catch (error) {
-    if (!is_pr_checks_timeout(error)) throw error;
-    await fail_when_no_checks(branch_name);
-    console.info(WATCH_TIMED_OUT_NOTE);
-    return { timed_out: true };
-  }
-}
-var git_pr_checks_watch = { pr_checks_watch };
-
-// scripts/git/git-gh-command.ts
-var git_gh_command = {
-  ...git_gh_pr,
-  ...git_gh_pr_auto_merge,
-  pr_checks_watch: git_pr_checks_watch.pr_checks_watch,
-  ...git_gh_issue,
-  ...git_gh_repo
-};
-
 // scripts/epic/epic-busy.ts
 var LISTING_LIMIT = 100;
 var PARKED_LABELS = /* @__PURE__ */ new Set([NEEDS_DECISION_LABEL, ALREADY_DONE_LABEL]);
@@ -4610,37 +3378,36 @@ var epic_busy = {
   unreadable_message,
   truncated_message,
   busy_reason,
-  format_holders,
   is_parked,
   parse_listing,
   read_repository
 };
 
 // scripts/run/run-liveness.ts
-import { readFileSync as readFileSync6, realpathSync, statSync } from "node:fs";
+import { readFileSync as readFileSync5, realpathSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import path6 from "node:path";
-import { setTimeout as sleep2 } from "node:timers/promises";
+import path8 from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
 
 // scripts/agent/agent-event.ts
-import { z as z14 } from "zod";
+import { z as z9 } from "zod";
 
 // scripts/agent/claude-result-event.ts
-import { z as z13 } from "zod";
-var RESULT_EVENT_SCHEMA = z13.looseObject({
-  type: z13.literal("result"),
-  is_error: z13.unknown().optional(),
-  subtype: z13.unknown().optional(),
-  num_turns: z13.unknown().optional(),
-  permission_denials: z13.unknown().optional(),
-  result: z13.unknown().optional(),
-  session_id: z13.unknown().optional(),
-  usage: z13.unknown().optional()
+import { z as z8 } from "zod";
+var RESULT_EVENT_SCHEMA = z8.looseObject({
+  type: z8.literal("result"),
+  is_error: z8.unknown().optional(),
+  subtype: z8.unknown().optional(),
+  num_turns: z8.unknown().optional(),
+  permission_denials: z8.unknown().optional(),
+  result: z8.unknown().optional(),
+  session_id: z8.unknown().optional(),
+  usage: z8.unknown().optional()
 });
-var USAGE_SCHEMA = z13.looseObject({
-  input_tokens: z13.unknown().optional(),
-  cache_read_input_tokens: z13.unknown().optional(),
-  output_tokens: z13.unknown().optional()
+var USAGE_SCHEMA = z8.looseObject({
+  input_tokens: z8.unknown().optional(),
+  cache_read_input_tokens: z8.unknown().optional(),
+  output_tokens: z8.unknown().optional()
 });
 function usable_reason(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
@@ -4661,7 +3428,7 @@ function usage_of(value) {
   };
   return Object.values(usage).some((count) => count !== void 0) ? usage : void 0;
 }
-function decode2(value) {
+function decode(value) {
   const parsed = RESULT_EVENT_SCHEMA.safeParse(value);
   if (!parsed.success) return void 0;
   const is_error = parsed.data.is_error === true;
@@ -4676,34 +3443,34 @@ function decode2(value) {
     usage: usage_of(parsed.data.usage)
   };
 }
-var claude_result_event = { decode: decode2 };
+var claude_result_event = { decode };
 
 // scripts/agent/agent-event.ts
-var TEXT_BLOCK_SCHEMA = z14.looseObject({ type: z14.literal("text"), text: z14.string() });
-var CLAUDE_MESSAGE_SCHEMA = z14.looseObject({ content: z14.array(z14.unknown()).optional() });
-var CLAUDE_INIT_SCHEMA = z14.looseObject({ type: z14.literal("system"), subtype: z14.literal("init") });
-var CLAUDE_ASSISTANT_SCHEMA = z14.looseObject({
-  type: z14.literal("assistant"),
+var TEXT_BLOCK_SCHEMA = z9.looseObject({ type: z9.literal("text"), text: z9.string() });
+var CLAUDE_MESSAGE_SCHEMA = z9.looseObject({ content: z9.array(z9.unknown()).optional() });
+var CLAUDE_INIT_SCHEMA = z9.looseObject({ type: z9.literal("system"), subtype: z9.literal("init") });
+var CLAUDE_ASSISTANT_SCHEMA = z9.looseObject({
+  type: z9.literal("assistant"),
   message: CLAUDE_MESSAGE_SCHEMA
 });
-var USAGE_SCHEMA2 = z14.looseObject({
-  input_tokens: z14.number().optional(),
-  cached_input_tokens: z14.number().optional(),
-  output_tokens: z14.number().optional()
+var USAGE_SCHEMA2 = z9.looseObject({
+  input_tokens: z9.number().optional(),
+  cached_input_tokens: z9.number().optional(),
+  output_tokens: z9.number().optional()
 });
-var CODEX_START_SCHEMA = z14.looseObject({ type: z14.enum(["thread.started", "turn.started"]) });
-var CODEX_PROGRESS_SCHEMA = z14.looseObject({
-  type: z14.enum(["item.started", "item.updated", "item.completed"]),
-  item: z14.looseObject({ type: z14.string(), text: z14.string().optional() }).optional()
+var CODEX_START_SCHEMA = z9.looseObject({ type: z9.enum(["thread.started", "turn.started"]) });
+var CODEX_PROGRESS_SCHEMA = z9.looseObject({
+  type: z9.enum(["item.started", "item.updated", "item.completed"]),
+  item: z9.looseObject({ type: z9.string(), text: z9.string().optional() }).optional()
 });
-var CODEX_COMPLETE_SCHEMA = z14.looseObject({
-  type: z14.literal("turn.completed"),
+var CODEX_COMPLETE_SCHEMA = z9.looseObject({
+  type: z9.literal("turn.completed"),
   usage: USAGE_SCHEMA2.optional()
 });
-var CODEX_FAILURE_SCHEMA = z14.looseObject({
-  type: z14.enum(["turn.failed", "error"]),
-  error: z14.looseObject({ message: z14.string().optional() }).optional(),
-  message: z14.string().optional()
+var CODEX_FAILURE_SCHEMA = z9.looseObject({
+  type: z9.enum(["turn.failed", "error"]),
+  error: z9.looseObject({ message: z9.string().optional() }).optional(),
+  message: z9.string().optional()
 });
 var EMPTY_STATE = {
   provider: void 0,
@@ -4794,7 +3561,7 @@ function describe(state) {
 var agent_event = { describe, read };
 
 // scripts/issue/issue-state.ts
-import { z as z15 } from "zod";
+import { z as z10 } from "zod";
 var NO_LABELS = "(none)";
 var LABEL_SEPARATOR = ", ";
 var STATE_LABEL = "state: ";
@@ -4804,9 +3571,9 @@ var YES = "yes";
 var NO = "no";
 var ISSUE_LABEL = "issue: ";
 var HUMAN_REVIEW_LABELS = /* @__PURE__ */ new Set([NEEDS_HUMAN_REVIEW_LABEL]);
-var label_schema = z15.looseObject({ name: z15.string() });
-var issue_state_schema = z15.looseObject({
-  state: z15.string(),
+var label_schema = z10.looseObject({ name: z10.string() });
+var issue_state_schema = z10.looseObject({
+  state: z10.string(),
   labels: label_schema.array().optional()
 });
 function parse_issue_state(json) {
@@ -4838,10 +3605,6 @@ ${format_issue_state(state)}`;
 }
 var issue_state = {
   NO_LABELS,
-  STATE_LABEL,
-  LABELS_LABEL,
-  HUMAN_REVIEW_LABEL_LINE,
-  ISSUE_LABEL,
   parse_issue_state,
   format_issue_state,
   format_attributed_issue_state
@@ -4856,9 +3619,9 @@ var PROCESS_ALIVE = "alive";
 var PROCESS_UNKNOWN = "unknown";
 var DEFAULT_SILENT_MINUTES = 30;
 var DEFAULT_GAP_SECONDS = 5;
-var MS_PER_MINUTE2 = 6e4;
+var MS_PER_MINUTE3 = 6e4;
 var MS_PER_SECOND2 = 1e3;
-var OPEN_STATE3 = "OPEN";
+var OPEN_STATE2 = "OPEN";
 var STATE_FIELDS = "state,labels";
 var REASONS = {
   [ALIVE_VERDICT]: "The unit is still working: its output moved, or a process of the child is alive.",
@@ -4904,7 +3667,7 @@ function to_advice(verdict, has_work_to_stash) {
   if (verdict === UNDETERMINED_VERDICT) return UNDETERMINED_ADVICE;
   return has_work_to_stash ? STOPPED_DIRTY_ADVICE : STOPPED_CLEAN_ADVICE;
 }
-function decide3(traces) {
+function decide4(traces) {
   const verdict = to_verdict(traces);
   const has_work_to_stash = verdict === STOPPED_VERDICT && traces.is_tree_dirty;
   return {
@@ -4927,12 +3690,12 @@ var ALLOWED_ROOTS = [
   )
 ];
 function is_within(candidate, root) {
-  const relative = path6.relative(root, candidate);
-  return relative !== "" && !relative.startsWith("..") && !path6.isAbsolute(relative);
+  const relative = path8.relative(root, candidate);
+  return relative !== "" && !relative.startsWith("..") && !path8.isAbsolute(relative);
 }
 function to_safe_path(output_path) {
-  const normalized2 = path6.normalize(output_path);
-  if (!path6.isAbsolute(normalized2)) return void 0;
+  const normalized2 = path8.normalize(output_path);
+  if (!path8.isAbsolute(normalized2)) return void 0;
   return ALLOWED_ROOTS.some((root) => is_within(normalized2, root)) ? normalized2 : void 0;
 }
 function sample_output(output_path) {
@@ -4946,7 +3709,7 @@ function read_agent_state(output_path) {
   const safe_path = to_safe_path(output_path);
   if (safe_path === void 0) return void 0;
   try {
-    const state = agent_event.read(readFileSync6(safe_path, "utf8"));
+    const state = agent_event.read(readFileSync5(safe_path, "utf8"));
     return state.provider === void 0 ? void 0 : state;
   } catch {
     return void 0;
@@ -4960,7 +3723,7 @@ async function read_output_frozen(request) {
   const first = sample_output(request.output_path);
   if (first === void 0) return void 0;
   if (request.now_ms - first.mtime_ms < request.silent_window_ms) return false;
-  await sleep2(request.gap_ms);
+  await sleep(request.gap_ms);
   const second = sample_output(request.output_path);
   if (second === void 0) return void 0;
   return second.mtime_ms === first.mtime_ms && second.size === first.size;
@@ -4977,7 +3740,7 @@ async function read_child_settled(issue, repo) {
   if (json === void 0) return void 0;
   const state = issue_state.parse_issue_state(json);
   if (state === void 0) return void 0;
-  return state.state !== OPEN_STATE3 || carries_settled_label(state.labels);
+  return state.state !== OPEN_STATE2 || carries_settled_label(state.labels);
 }
 async function read_traces(request) {
   const [is_initial_child_settled, is_output_frozen, is_tree_dirty] = await Promise.all([
@@ -4986,7 +3749,7 @@ async function read_traces(request) {
       gap_ms: request.gap_ms ?? DEFAULT_GAP_SECONDS * MS_PER_SECOND2,
       now_ms: Date.now(),
       output_path: request.output_path,
-      silent_window_ms: request.silent_window_ms ?? DEFAULT_SILENT_MINUTES * MS_PER_MINUTE2
+      silent_window_ms: request.silent_window_ms ?? DEFAULT_SILENT_MINUTES * MS_PER_MINUTE3
     }),
     run_hold.is_tree_dirty()
   ]);
@@ -5003,14 +3766,13 @@ async function read_traces(request) {
 }
 async function check(request) {
   run_issue_number.require_issue_number(request.issue);
-  return decide3(await read_traces(request));
+  return decide4(await read_traces(request));
 }
 var run_liveness = {
   check,
-  decide: decide3,
+  decide: decide4,
   describe_agent_state,
   read_child_settled,
-  read_agent_state,
   read_output_frozen,
   sample_output,
   to_safe_path
@@ -5018,14 +3780,14 @@ var run_liveness = {
 
 // scripts/lane/lane-report.ts
 var NO_LANES2 = "No lanes are open.";
-var OPEN_STATE4 = "open";
+var OPEN_STATE3 = "open";
 var STRANDED_STATE = "stranded";
 var UNREADABLE_STATE = "unreadable";
 var UNKNOWN_VALUE = "-";
 var COLUMN_SEPARATOR = "  ";
 function lane_state(lane) {
   if (lane.is_stranded) return STRANDED_STATE;
-  return lane.seat === void 0 ? UNREADABLE_STATE : OPEN_STATE4;
+  return lane.seat === void 0 ? UNREADABLE_STATE : OPEN_STATE3;
 }
 function value_or_unknown(value) {
   return value === void 0 ? UNKNOWN_VALUE : String(value);
@@ -5069,7 +3831,7 @@ function describe_opened(lane) {
 }
 var lane_report = {
   NO_LANES: NO_LANES2,
-  OPEN_STATE: OPEN_STATE4,
+  OPEN_STATE: OPEN_STATE3,
   STRANDED_STATE,
   UNREADABLE_STATE,
   describe_lane,
@@ -5079,7 +3841,7 @@ var lane_report = {
 };
 
 // scripts/run/run-preflight.ts
-import { z as z16 } from "zod";
+import { z as z11 } from "zod";
 var CLEAN_VERDICT = "clean";
 var RECLAIM_VERDICT = "reclaim";
 var RESUME_VERDICT = "resume";
@@ -5089,7 +3851,7 @@ var OPEN_PR = "open";
 var MERGED_PR = "merged";
 var CLOSED_PR = "closed";
 var NO_CHILD_WORK = { branch_name: void 0, pr_state: NO_PR };
-var pr_info_schema2 = z16.object({ state: z16.string().optional() });
+var pr_info_schema = z11.object({ state: z11.string().optional() });
 var GH_PR_STATES = /* @__PURE__ */ new Map([
   ["CLOSED", CLOSED_PR],
   ["MERGED", MERGED_PR],
@@ -5100,7 +3862,7 @@ var CLEAN_ADVICE = "Start the child.";
 var RESUME_ADVICE = "Reuse the branch and run the whole verification gate from the start \u2014 refactor, `pnpm josh gate`, `/code-review` \u2014 never only the part the interrupted run had not reached. Nobody verified what it already committed.";
 var PARK_ADVICE = "Park the child: add `needs-decision` and comment what was found. Do not delete the branch, do not reopen the pull request, and do not commit on top of it.";
 var STASH_LABEL_PREFIX = "run:hold reclaimed before #";
-var { ISSUE_NUMBER_PATTERN, require_issue_number } = run_issue_number;
+var { require_issue_number } = run_issue_number;
 var UNREADABLE_PR_MESSAGE = "The pull request could not be read for branch ";
 function needs_reclaim(tree) {
   return tree.is_dirty || tree.branch !== tree.default_branch;
@@ -5158,7 +3920,7 @@ function to_advice2(verdict, issue, tree) {
   if (verdict === PARK_VERDICT) return PARK_ADVICE;
   return CLEAN_ADVICE;
 }
-function decide4(tree, child, issue) {
+function decide5(tree, child, issue) {
   const verdict = to_verdict2(tree, child);
   return {
     advice: to_advice2(verdict, issue, tree),
@@ -5168,12 +3930,12 @@ function decide4(tree, child, issue) {
 }
 function read_pr_field(raw) {
   try {
-    return pr_info_schema2.parse(JSON.parse(raw)).state;
+    return pr_info_schema.parse(JSON.parse(raw)).state;
   } catch {
     return void 0;
   }
 }
-function to_pr_state2(raw) {
+function to_pr_state(raw) {
   const state = read_pr_field(raw);
   return (state === void 0 ? void 0 : GH_PR_STATES.get(state)) ?? NO_PR;
 }
@@ -5185,17 +3947,17 @@ async function read_tree_state() {
   ]);
   return { branch: current, default_branch, is_dirty };
 }
-async function read_pr_state2(branch_name) {
+async function read_pr_state(branch_name) {
   if (!await git_gh_pr_read.pr_exists(branch_name)) return NO_PR;
   const raw = await git_gh_pr_read.pr_view(branch_name);
   if (raw === "") throw new Error(`${UNREADABLE_PR_MESSAGE}${branch_name}`);
-  return to_pr_state2(raw);
+  return to_pr_state(raw);
 }
 function is_pr_open(state) {
   return state === OPEN_PR;
 }
 async function read_pr_of_branch(branch_name) {
-  return { branch_name, pr_state: await read_pr_state2(branch_name) };
+  return { branch_name, pr_state: await read_pr_state(branch_name) };
 }
 function pick_child_state(reads) {
   const decided = reads.find((read2) => is_pr_decided(read2.pr_state));
@@ -5259,30 +4021,23 @@ async function read_child_state(issue) {
 async function check2(issue) {
   require_issue_number(issue);
   const tree = await read_tree_state();
-  if (needs_reclaim(tree)) return decide4(tree, NO_CHILD_WORK, issue);
-  return decide4(tree, await read_child_state(issue), issue);
+  if (needs_reclaim(tree)) return decide5(tree, NO_CHILD_WORK, issue);
+  return decide5(tree, await read_child_state(issue), issue);
 }
 var run_preflight = {
-  CLEAN_ADVICE,
-  CLEAN_REASON,
   CLEAN_VERDICT,
-  ISSUE_NUMBER_PATTERN,
-  PARK_ADVICE,
-  PARK_VERDICT,
-  RECLAIM_VERDICT,
   RESUME_ADVICE,
-  RESUME_VERDICT,
   MERGED_PR,
   STASH_LABEL_PREFIX,
   check: check2,
-  decide: decide4,
+  decide: decide5,
   read_child_state,
-  read_pr_state: read_pr_state2,
-  to_pr_state: to_pr_state2
+  read_pr_state,
+  to_pr_state
 };
 
 // scripts/run/run-progress-read.ts
-var { PROGRESS_PREFIX, mark, parse_stamp, read_last_report } = run_progress_clock;
+var { mark: mark2, parse_stamp: parse_stamp2, read_last_report: read_last_report2 } = run_progress_clock;
 var FIRST_LOAD_AVERAGE = 0;
 var IDLE_READ = { kind: "idle" };
 var UNREADABLE_READ = { kind: "unreadable" };
@@ -5359,24 +4114,46 @@ async function read_observations(request) {
   return { kind: "observed", observations };
 }
 var run_progress_read = {
-  PROGRESS_PREFIX,
   has_run_started,
   live_target,
   log_target,
-  mark,
-  parse_stamp,
+  mark: mark2,
+  parse_stamp: parse_stamp2,
   read_children,
-  read_last_report,
+  read_last_report: read_last_report2,
   read_lanes,
   read_observations,
   read_record_age,
   stamp_target
 };
 
+// scripts/run/run-watcher-guard.ts
+var WATCHER_TICK_MS = 3e4;
+var TICK_MULTIPLIER = 3;
+var MS_PER_SECOND3 = 1e3;
+var STALE_THRESHOLD_MS = WATCHER_TICK_MS * TICK_MULTIPLIER;
+var STALE_THRESHOLD_S = STALE_THRESHOLD_MS / MS_PER_SECOND3;
+var STALE_NOTE = `Lane children are in-flight but the progress watcher has not pinged in the last ${String(STALE_THRESHOLD_S)}s \u2014 run \`pnpm josh run:progress --wait\` in the background before proceeding. It reports to the run event stream on its own and exits only when newly runnable work arrives, so start it once and relay nothing`;
+var OK_RESULT = { kind: "ok" };
+async function owes_watcher() {
+  if (!await run_headless.is_backlog_parent()) return false;
+  return await lane_registry.has_lanes_in_flight();
+}
+async function check3(life_target) {
+  if (!await owes_watcher()) return OK_RESULT;
+  if (run_progress_clock.is_life_fresh(life_target, STALE_THRESHOLD_MS)) return OK_RESULT;
+  return { kind: "stale", note: STALE_NOTE };
+}
+var run_watcher_guard = {
+  STALE_NOTE,
+  STALE_THRESHOLD_MS,
+  check: check3
+};
+
 // scripts/run/run-watcher-hook.ts
 var SWITCH_ENV_KEY2 = "JOSH_WATCHER_GUARD";
 var STAMP_PREFIX2 = "josh-watcher-guard-";
-var payload_schema = z17.object({ transcript_path: z17.string().min(1) });
+var payload_schema = z12.object({ transcript_path: z12.string().min(1) });
 function transcript_of(raw_payload) {
   try {
     const parsed = payload_schema.safeParse(JSON.parse(raw_payload));
@@ -5405,7 +4182,7 @@ async function watcher_hook_reason(raw_payload, now_ms = Date.now()) {
   if (transcript === void 0) return void 0;
   return await stale_reason(transcript, now_ms);
 }
-var run_watcher_hook = { SWITCH_ENV_KEY: SWITCH_ENV_KEY2, STAMP_PREFIX: STAMP_PREFIX2, transcript_of, watcher_hook_reason };
+var run_watcher_hook = { transcript_of, watcher_hook_reason };
 
 // scripts/run/run-parent-cut-hook.ts
 var SWITCH_ENV_KEY3 = "JOSH_PARENT_CUT_GUARD";
@@ -5437,7 +4214,8 @@ async function refusal_for(transcript, now_ms, state) {
 function is_unit_call(raw_payload) {
   try {
     return (hook_decision.parse_hook_payload(raw_payload)?.agent_id ?? "") !== "";
-  } catch {
+  } catch (error) {
+    error_text.trace_swallowed("run_parent_cut_hook.is_unit_call", error);
     return false;
   }
 }
@@ -5453,11 +4231,48 @@ async function parent_cut_reason(raw_payload, now_ms = Date.now(), state = curre
 var run_parent_cut_hook = {
   PARENT_CUT_REASON,
   QUIET_WINDOW_MS,
-  STAMP_PREFIX: STAMP_PREFIX3,
   SWITCH_ENV_KEY: SWITCH_ENV_KEY3,
   parent_cut_reason
 };
 
+// scripts/hooks/step-zero-notice.ts
+import path9 from "node:path";
+var STAMP_PREFIX4 = "josh-step-zero-notice-";
+var EDIT_TOOLS3 = /* @__PURE__ */ new Set(["Edit", "Write"]);
+var PARENT_PREFIX = "..";
+var NOTICE = "Before writing any implementation code: present the two-layer work summary (Now / Change / Check, then every change with its test) once per Issue. Full rule: Code Change Rules Step 0 in CLAUDE.md.";
+var STAMP = hook_decision.create_refusal_stamp(STAMP_PREFIX4);
+function edited_paths(tool_input) {
+  if (!json_value.is_record(tool_input)) return [];
+  const { file_path, file_paths } = tool_input;
+  const listed = Array.isArray(file_paths) ? file_paths : [];
+  return [file_path, ...listed].filter(
+    (entry) => typeof entry === "string" && entry.length > 0
+  );
+}
+function is_runtime_file(file_path, root) {
+  const relative = path9.relative(root, path9.resolve(root, file_path));
+  if (relative.startsWith(PARENT_PREFIX) || path9.isAbsolute(relative)) return false;
+  return !test_declared_logic.is_exempt(relative.split(path9.sep).join("/"));
+}
+function is_candidate(raw_payload, root) {
+  const payload = hook_decision.parse_hook_payload(raw_payload);
+  if (payload === void 0 || !EDIT_TOOLS3.has(payload.tool_name)) return void 0;
+  const has_runtime_file = edited_paths(payload.tool_input).some(
+    (file_path) => is_runtime_file(file_path, root)
+  );
+  return has_runtime_file ? payload.transcript_path : void 0;
+}
+function notice(raw_payload, root = process.cwd()) {
+  const transcript = is_candidate(raw_payload, root);
+  if (transcript === void 0) return void 0;
+  const target = STAMP.path(transcript);
+  if (STAMP.last_ms(target) !== hook_decision.NEVER_MS) return void 0;
+  if (!STAMP.record(target, Date.now())) return void 0;
+  return NOTICE;
+}
+var step_zero_notice = { NOTICE, notice, stamp_path: STAMP.path };
+
 // scripts/hooks/pretool-guard.ts
 function combine_outcomes(batch, extra_reason) {
   if (batch.reason !== void 0) return batch;
@@ -5469,11 +4284,16 @@ function combine_outcomes(batch, extra_reason) {
 function is_clear(outcome) {
   return outcome.reason === void 0 && outcome.notice === void 0 && outcome.fault === void 0;
 }
-function with_duplicate_notice(combined, notice) {
-  if (notice === void 0 || !is_clear(combined)) return combined;
-  return { reason: void 0, notice, fault: void 0 };
+function with_duplicate_notice(combined, notice2) {
+  if (notice2 === void 0 || !is_clear(combined)) return combined;
+  return { reason: void 0, notice: notice2, fault: void 0 };
 }
-function pretool_outcome(raw_payload) {
+function with_step_zero_notice(outcome, raw_payload) {
+  if (!is_clear(outcome)) return outcome;
+  const notice2 = step_zero_notice.notice(raw_payload);
+  return notice2 === void 0 ? outcome : { reason: void 0, notice: notice2, fault: void 0 };
+}
+function guard_outcome(raw_payload) {
   const batch = batch_outcome(raw_payload);
   const investigation = investigation_refusal(raw_payload);
   const duplicate = duplicate_read_outcome(raw_payload);
@@ -5482,17 +4302,21 @@ function pretool_outcome(raw_payload) {
   const combined = combine_outcomes(batch, investigation ?? duplicate_refusal ?? rule);
   return with_duplicate_notice(combined, duplicate.notice);
 }
+function pretool_outcome(raw_payload) {
+  return with_step_zero_notice(guard_outcome(raw_payload), raw_payload);
+}
 async function async_reason(raw_payload) {
   const watcher = await run_watcher_hook.watcher_hook_reason(raw_payload);
   return watcher ?? await run_parent_cut_hook.parent_cut_reason(raw_payload);
 }
 async function pretool_outcome_async(raw_payload) {
-  const base = pretool_outcome(raw_payload);
+  const base = guard_outcome(raw_payload);
   if (!is_clear(base)) return base;
   const reason = await async_reason(raw_payload);
-  return reason === void 0 ? base : { reason, notice: void 0, fault: void 0 };
+  if (reason !== void 0) return { reason, notice: void 0, fault: void 0 };
+  return with_step_zero_notice(base, raw_payload);
 }
-var pretool_guard = { combine_outcomes, pretool_outcome, pretool_outcome_async };
+var pretool_guard = { combine_outcomes, pretool_outcome };
 
 export {
   pretool_outcome_async,