@joshuafolkken/kit 1.1229.0 → 1.1370.0

package/scripts/git/main-sync.ts

@@ -4,10 +4,11 @@ import { composite_arguments, USAGE_ERROR_EXIT_CODE } from '#scripts/josh/josh-c
 import { error_text } from '#scripts/lib/error-message'
 import { git_command } from './git-command'
 import { gone_branch, type PruneResult } from './gone-branch'
+import { lockfile_sync } from './lockfile-sync'
 
-// `josh main:sync` (`josh ms`) — return this checkout to the default branch and pull
-// (joshuafolkken/kit#1535), then prune the local branches whose merged remote branch is gone
-// (joshuafolkken/kit#2504; the rule for which ones is `gone-branch.ts`).
+// `josh main:sync` (`josh ms`) — return this checkout to the default branch and pull,
+// then prune the local branches whose merged remote branch is gone
+// (the rule for which ones is `gone-branch.ts`).
 //
 // **It refuses inside a linked work tree, and that refusal is the reason this stopped being a
 // one-line `sh -c` entry.** The default branch is a *branch*: advancing it means checking it out
@@ -28,6 +29,8 @@ const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const ARGV_OFFSET = 2
 const COMMAND_NAME = 'main:sync'
+const INSTALL_FAILURE =
+	'node_modules is behind pnpm-lock.yaml and `pnpm install --frozen-lockfile` failed; run `pnpm josh ms` again, or the install here by hand.'
 
 // `git_directories()` returns `[--absolute-git-dir, --git-common-dir]`. They are the same path in the
 // main work tree and differ in a linked one, which is git's own definition of the distinction rather
@@ -70,12 +73,12 @@ async function prune_quietly(default_branch: string): Promise<void> {
 	}
 }
 
-// **The local default branch is fast-forwarded before it is checked out** (joshuafolkken/kit#2979).
+// **The local default branch is fast-forwarded before it is checked out**.
 // A run's ledger file is committed on its feature branch and merged; a line appended afterwards leaves
 // it dirty, and git refuses to check out a stale default branch that lacks the file — so `run:tail`'s
-// sync failed exactly when the flush after it had work. Once fast-forwarded, the default branch holds
-// the committed file and the checkout carries the dirty lines over (the same step the flush takes,
-// joshuafolkken/kit#2462). Skipped on the default branch, where `fetch` refuses to update the checked-out
+// sync would fail exactly when the flush after it had work. Once fast-forwarded, the default branch
+// holds the committed file and the checkout carries the dirty lines over (the same step the flush
+// takes). Skipped on the default branch, where `fetch` refuses to update the checked-out
 // ref; a refusal elsewhere — a local default ahead of origin — is left to the checkout and pull to judge.
 async function fast_forward_quietly(default_branch: string): Promise<void> {
 	if ((await git_command.branch()) === default_branch) return
@@ -87,6 +90,18 @@ async function fast_forward_quietly(default_branch: string): Promise<void> {
 	}
 }
 
+// A pull that changed the lock leaves `node_modules` behind it, and every `josh` typed in this checkout
+// then fails to load the new dependency — so the install the lock now asks for
+// is part of the sync, and its failure is the sync's. A failed one is retried by the next `ms`.
+async function reinstall(root: string): Promise<number> {
+	const result = await lockfile_sync.reinstall_if_stale(root)
+
+	if (result.is_installed) return SUCCESS_EXIT_CODE
+	console.error(`${INSTALL_FAILURE}\n${result.output}`)
+
+	return FAILURE_EXIT_CODE
+}
+
 async function synchronize(): Promise<number> {
 	const default_branch = await git_command.get_default_branch()
 
@@ -96,7 +111,7 @@ async function synchronize(): Promise<number> {
 	await prune_quietly(default_branch)
 	console.info(default_branch)
 
-	return SUCCESS_EXIT_CODE
+	return await reinstall(await git_command.repository_root())
 }
 
 // The argument refusal is kept even though this is no longer an `sh -c` entry: the message is the

package/scripts/git/parse-json-array.ts

@@ -1,17 +1,12 @@
+import { json_value } from '#scripts/lib/json-value'
 import type { z } from 'zod'
 
-// Marks input that is not JSON at all, letting each caller pick its own empty value. Schema
-// mismatches are deliberately not folded in here: those rethrow, so a shape change stays visible
-// instead of silently degrading to a fallback.
-const MALFORMED_JSON = Symbol('malformed-json')
-
+// Input that is not JSON at all reads as `undefined`, letting each caller pick its own empty value.
+// Schema mismatches are deliberately not folded in here: those rethrow, so a shape change stays
+// visible instead of silently degrading to a fallback. A reader that wants both gaps as `undefined`
+// is `json_value.parse_with`.
 function parse_json_loose(raw_json: string): unknown {
-	try {
-		return JSON.parse(raw_json)
-	} catch (error) {
-		if (error instanceof SyntaxError) return MALFORMED_JSON
-		throw error
-	}
+	return json_value.parse_or_undefined(raw_json)
 }
 
 /**
@@ -19,8 +14,7 @@ function parse_json_loose(raw_json: string): unknown {
  * Malformed JSON yields undefined, so a caller can tell it apart from an empty listing.
  *
  * `parse_json_array_safe` answers `[]` for both, which reads as "there is nothing" — and a command
- * that acts on that reports a confident absence built on a response it could not parse
- * (joshuafolkken/kit#950).
+ * that acts on that reports a confident absence built on a response it could not parse.
  */
 function parse_json_array_or_undefined<T>(
 	raw_json: string,
@@ -30,14 +24,14 @@ function parse_json_array_or_undefined<T>(
 	// Not an array at all — `gh` answering `{"message":"API rate limit exceeded"}` rather than a
 	// listing. That is the same kind of gap as unparseable output, not a change in the shape of the
 	// elements, so it reads as unreadable instead of throwing out of the command.
-	if (value === MALFORMED_JSON || !Array.isArray(value)) return undefined
+	if (!Array.isArray(value)) return undefined
 
 	return element_schema.array().parse(value)
 }
 
 // What one listing read produced. The two gaps are deliberately apart: JSON that is not a listing at
 // all is an access or connectivity problem, while elements the schema rejects mean the tool's fields
-// changed — and those send a reader to two different places (joshuafolkken/kit#996). A caller that
+// changed — and those send a reader to two different places. A caller that
 // treats them the same still reads them from here rather than writing the try/catch again.
 type ListingRead<T> =
 	{ kind: 'read'; rows: Array<T> } | { kind: 'unreadable' } | { kind: 'unexpected_shape' }
@@ -47,7 +41,7 @@ type ListingRead<T> =
  *
  * The rethrow `parse_json_array_or_undefined` performs is the whole point, and every caller that
  * wants both gaps named was catching it itself — the `auto-ok` pickup and `epic:next`'s
- * repository-level busy check wrote the same six lines (joshuafolkken/kit#925).
+ * repository-level busy check wrote the same six lines.
  */
 function read_json_listing<T>(raw_json: string, element_schema: z.ZodType<T>): ListingRead<T> {
 	try {
@@ -66,34 +60,35 @@ function read_json_listing<T>(raw_json: string, element_schema: z.ZodType<T>): L
  * Deliberately **not** `parse_json_array_or_undefined(...) ?? []`, near-identical though the bodies
  * are. The two differ on the branch that matters: valid JSON that is not an array throws here, so a
  * `gh` field that changed shape stays visible, while the variant above reads it as a gap. Folding
- * them together silences that throw for every existing caller (joshuafolkken/kit#950).
+ * them together silences that throw for every existing caller.
  */
 function parse_json_array_safe<T>(raw_json: string, element_schema: z.ZodType<T>): Array<T> {
 	const value = parse_json_loose(raw_json)
-	if (value === MALFORMED_JSON) return []
+	if (value === undefined) return []
 
 	return element_schema.array().parse(value)
 }
 
 /**
  * Parse a JSON string into a single object validated by the given schema.
- * Malformed JSON yields undefined.
+ * Malformed JSON yields undefined; JSON the schema rejects throws, as the array readers above do —
+ * the name says only what it answers for text that is not JSON.
  */
-function parse_json_object_safe<T>(raw_json: string, schema: z.ZodType<T>): T | undefined {
+function parse_json_object_or_undefined<T>(raw_json: string, schema: z.ZodType<T>): T | undefined {
 	const value = parse_json_loose(raw_json)
-	if (value === MALFORMED_JSON) return undefined
+	if (value === undefined) return undefined
 
 	return schema.parse(value)
 }
 
 const parse_json = {
-	parse_json_object_safe,
+	parse_json_object_or_undefined,
 }
 
 export {
 	parse_json,
 	parse_json_array_or_undefined,
 	parse_json_array_safe,
-	parse_json_object_safe,
+	parse_json_object_or_undefined,
 	read_json_listing,
 }

package/scripts/git/repository-lock.ts

@@ -8,13 +8,16 @@ import { json_value } from '#scripts/lib/json-value'
 import { git_common_directory } from './git-common-directory'
 
 // One holder at a time per repository, for work that every work tree of that repository shares
-// (joshuafolkken/kit#2701 for the stash sweep, joshuafolkken/kit#2736 for `git worktree add`). The
+// (the stash sweep, `git worktree add`). The
 // record is keyed on the git common directory, so every work tree of one repository contends for one
 // record per lock name, and it lives in the platform temp root beside the other stamps rather than
 // inside `.git`. Each caller names its own lock with a prefix, so two unrelated kinds of work never
 // wait on each other.
 
 const POLL_INTERVAL_MS = 200
+// The synchronous wait is for locks held for milliseconds, so it polls far more often.
+const SYNC_POLL_INTERVAL_MS = 10
+const SLEEP_CELL = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT))
 
 type IsGone = (owner: ProcessOwner) => boolean
 
@@ -117,6 +120,23 @@ async function acquire(target: string, max_wait_ms: number): Promise<boolean> {
 	return true
 }
 
+// A blocking wait for a caller that cannot await. `Atomics.wait` parks the thread without spinning, so
+// a writer queued behind another costs no CPU while it waits.
+function sleep_sync(ms: number): void {
+	Atomics.wait(SLEEP_CELL, 0, 0, ms)
+}
+
+function acquire_sync(target: string, max_wait_ms: number): boolean {
+	const deadline = Date.now() + max_wait_ms
+
+	while (!claim(target)) {
+		if (Date.now() >= deadline) return false
+		sleep_sync(SYNC_POLL_INTERVAL_MS)
+	}
+
+	return true
+}
+
 // Runs `work` holding the lock at `target` and answers its result, or `undefined` without running it
 // when another holder kept the lock for the whole wait.
 async function with_lock<T>(
@@ -133,6 +153,18 @@ async function with_lock<T>(
 	}
 }
 
-const repository_lock = { clear_stale, lock_path, with_lock }
+// `with_lock` for synchronous work — a read-modify-write that holds the lock for milliseconds, whose
+// callers are synchronous all the way up.
+function with_lock_sync<T>(work: () => T, target: string, max_wait_ms: number): T | undefined {
+	if (!acquire_sync(target, max_wait_ms)) return undefined
+
+	try {
+		return work()
+	} finally {
+		release(target)
+	}
+}
+
+const repository_lock = { clear_stale, lock_path, with_lock, with_lock_sync }
 
 export { repository_lock }

package/scripts/git/stash/git-stash.ts

@@ -1,7 +1,7 @@
 import { git_spawn } from '#scripts/git/git-spawn'
 
 // The one place a sanctioned `git stash pop` is targeted by its message rather than its stack
-// position (joshuafolkken/kit#2050). The stash is a single repository-wide stack shared by every
+// position. The stash is a single repository-wide stack shared by every
 // working tree of the repository, so a bare `git stash pop` — or a positional `stash@{n}` read
 // before another lane pushed — pops whatever now sits on top, which is how one lane's parked work
 // ended up in another lane's tree. Resolving the selector from the message the stash was pushed
@@ -70,8 +70,7 @@ function select(entries: ReadonlyArray<StashEntry>, message: string): Selection
 }
 
 // The stash is a repository-level stack every work tree shares, so the list reads the same wherever
-// it runs; `dir` is what makes the pop land in the lane's tree rather than the primary checkout —
-// the `git -C <dir>` a lane child used to write by hand.
+// it runs; `dir` is what makes the pop land in the lane's tree rather than the primary checkout.
 function git_args(directory: string | undefined, args: Array<string>): Array<string> {
 	return directory === undefined ? args : ['-C', directory, ...args]
 }
@@ -97,7 +96,7 @@ async function has_conflict(directory?: string): Promise<boolean> {
 }
 
 // Uncommitted work is anything `git status --porcelain` lists — untracked files included, which is what
-// `push` below carries with `-u`, so the two agree on what "work" means (joshuafolkken/kit#2476).
+// `push` below carries with `-u`, so the two agree on what "work" means.
 async function has_changes(directory?: string): Promise<boolean> {
 	return (await git_spawn.read(git_args(directory, ['status', '--porcelain']))) !== ''
 }
@@ -108,7 +107,7 @@ async function push(message: string, directory?: string): Promise<void> {
 	await git_spawn.read(git_args(directory, ['stash', 'push', '-u', '-m', message]))
 }
 
-// The stack keyed by commit rather than position (joshuafolkken/kit#2701): a sweep that reads the
+// The stack keyed by commit rather than position: a sweep that reads the
 // stack, asks GitHub about each entry and only then drops one would drop whatever another lane pushed
 // on top in the meantime if it kept the `stash@{n}` it read first. The `selector` of each entry here is
 // its commit hash, which never moves.

package/scripts/git/stash/stash-orphans.ts

@@ -1,7 +1,8 @@
+import { session_cite } from '#scripts/issue/session-cite'
 import { run_preflight } from '#scripts/run/run-preflight'
 import type { StashEntry } from './git-stash'
 
-// Which stashes nobody is coming back for (joshuafolkken/kit#2505). A parked or paused run pushes its
+// Which stashes nobody is coming back for. A parked or paused run pushes its
 // work with a message `josh stash:pop` later targets, but an issue closed by another route leaves that
 // entry with no run to pop it — the pile #2168 sorted by hand. This reads the owning issue out of each
 // entry's subject so the closed ones, and the ones with no readable owner, can be put in front of a
@@ -71,7 +72,7 @@ function message_issues(subject: string): Array<string | undefined> {
 	return [...hashed, LEADING_PATTERN.exec(subject)?.groups?.['issue']]
 }
 
-// Every issue a subject names, not just its owner (joshuafolkken/kit#2701): `backlogrun: paused #M for
+// Every issue a subject names, not just its owner: `backlogrun: paused #M for
 // prerequisite #N` is tied to both, and the `#N` of a `run:hold reclaimed before #N` entry — which
 // `issue_of` reads as no owner — still names the run the work was found by. A `WIP on` subject is
 // read by its branch alone, for the reason `WIP_PREFIX` records.
@@ -95,7 +96,8 @@ function orphans(
 }
 
 function format_line(orphan: OrphanStash): string {
-	const owner = orphan.issue === undefined ? UNKNOWN_OWNER : `#${orphan.issue} closed`
+	const owner =
+		orphan.issue === undefined ? UNKNOWN_OWNER : `${session_cite.issue(orphan.issue)} closed`
 
 	return `  ${[orphan.selector, owner, orphan.subject].join(COLUMN_SEPARATOR)}`
 }

package/scripts/git/stash/stash-pop-args.ts

@@ -3,7 +3,7 @@ import { cli_flags } from '#scripts/lib/cli-flags'
 // `josh stash:pop` turns its `argv` into a single request: the message of the stash to pop. Parsing
 // lives here, acting on the stack lives in `stash-pop-cli.ts`, and a malformed command line is
 // `undefined` rather than a guessed intent — a pop run on a misread argument would take the wrong
-// entry off a stack shared by every lane (joshuafolkken/kit#2050).
+// entry off a stack shared by every lane.
 
 const USAGE = 'Usage: josh stash:pop "<message>" [--dir <path>]'
 

package/scripts/git/stash/stash-pop-cli.ts

@@ -3,8 +3,8 @@ import { error_text } from '#scripts/lib/error-message'
 import { git_stash } from './git-stash'
 import { stash_pop_args, type Request } from './stash-pop-args'
 
-// `josh stash:pop "<message>"` — pop the stash whose message matches, and no other
-// (joshuafolkken/kit#2050). The stash stack is shared by every working tree of the repository, so a
+// `josh stash:pop "<message>"` — pop the stash whose message matches, and no other.
+// The stash stack is shared by every working tree of the repository, so a
 // procedure that pops by position takes whatever another lane last pushed. This resolves the
 // selector from the message and pops that entry alone; no match and more than one match are both
 // refusals rather than a guess at which was meant.
@@ -32,7 +32,7 @@ function refuse(): number {
 }
 
 // A pop that leaves unmerged paths applied the stash and only needs the conflicts resolved, so it is
-// reported `conflicted` at exit 0 rather than raised as an unknown failure (joshuafolkken/kit#2050);
+// reported `conflicted` at exit 0 rather than raised as an unknown failure;
 // any other pop error is re-thrown for `run` to report. `has_conflict` reads the tree the pop wrote.
 async function pop_selected(selector: string, directory: string | undefined): Promise<number> {
 	try {

package/scripts/git/stash/stash-sweep-lock.ts

@@ -1,10 +1,10 @@
 import { repository_lock } from '#scripts/git/repository-lock'
 
-// One stash sweep at a time per repository (joshuafolkken/kit#2701). The stash is a single stack every
+// One stash sweep at a time per repository. The stash is a single stack every
 // work tree shares, and a `backlogrun` runs one sweep per lane seat at once: two sweeps that each
 // resolve the same entry to `stash@{n}` and drop it would have the second drop land on whichever entry
 // moved into that position, and two that carry the same ledger lines would both append them. The
-// locking itself is `repository-lock.ts`, shared with the work-tree writes (joshuafolkken/kit#2736).
+// locking itself is `repository-lock.ts`, shared with the work-tree writes.
 
 const LOCK_PREFIX = 'josh-stash-sweep-lock-'
 // The locked phase is local git and one file append per entry, so a holder finishes in well under the

package/scripts/hooks/batch-guard.ts

@@ -5,7 +5,7 @@ import { hook_decision } from '#scripts/josh/hook-decision'
 import { lane_guard_policy, type LaneGuardMode } from '#scripts/lane/lane-guard-policy'
 import { time_batch_guard, type GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 
-// The disk half of the batching guard (joshuafolkken/kit#1390): find the transcript, read enough of
+// The disk half of the batching guard: find the transcript, read enough of
 // its end, remember when a call was last refused, and write the refusal Claude Code understands.
 //
 // **It is a `PreToolUse` hook, and that is the point of the Issue.** The live density line rides
@@ -16,10 +16,9 @@ import { time_batch_guard, type GuardedCall } from '#scripts/time-runtime/time-b
 // **What the transcript holds is the turns already closed, and nothing usable about the one in hand.**
 // Claude Code writes one line per content block and starts the first tool as soon as that block parses,
 // so a turn's later `tool_use` lines do not exist yet — measured on a live session, they arrive 1.4 to
-// 15 seconds afterwards. The decision is therefore made from closed history alone;
-// `time-batch-guard.ts` → "What it cannot know" carries the measurement and what it costs.
+// 15 seconds afterwards. The decision is therefore made from closed history alone.
 //
-// **The shell is `hook-decision.ts`, shared with the investigation guard** (joshuafolkken/kit#1460):
+// **The shell is `hook-decision.ts`, shared with the investigation guard**:
 // the payload schema, the deny envelope, the switch, the `.env` load, the stamp that makes a refusal
 // unrepeatable, and the six steps every refusing hook takes in the same order. What stays here is this
 // guard's own rule and its own two names, and the seven exports below are unchanged so nothing that
@@ -36,14 +35,13 @@ const SWITCH_ENV_KEY = 'JOSH_BATCH_GUARD'
 // refuse and whether the run has stopped batching are both its, so a refusal here can never disagree
 // with the report the Issue's own verification step reads.
 // The transcript is read for a call the guard could act on either way: one it may refuse, or the one
-// whole-file write it may only notify about (joshuafolkken/kit#1848). The read is skipped for the rest
-// exactly as before — most of a run's calls are neither.
+// whole-file write it may only notify about. The read is skipped for the rest
+// — most of a run's calls are neither.
 function is_batch_candidate(call: GuardedCall): boolean {
 	return time_batch_guard.is_guarded_call(call) || time_batch_guard.is_notice_call(call)
 }
 
-// **How the batching guard behaves for the session in hand, decided from the one-place enumeration**
-// (joshuafolkken/kit#2138, joshuafolkken/kit#2164, joshuafolkken/kit#2178, joshuafolkken/kit#2276).
+// **How the batching guard behaves for the session in hand, decided from the one-place enumeration**.
 // Outside a lane child the mode is `refuse` and the guard is exactly what it always was; in a dispatched
 // lane child it is `notice` — kit#2178 took it to `off` after kit#2164's generic notice did not move the
 // density, and kit#2276 restores it as a notice that names the concrete recent calls and recurs every
@@ -72,7 +70,7 @@ function should_block_here(tail: string, call: GuardedCall, refused_at_ms: numbe
 	return time_batch_guard.should_block(tail, call, refused_at_ms)
 }
 
-// The whole-file write earns a notice on every run (joshuafolkken/kit#1848). The second branch turns a
+// The whole-file write earns a notice on every run. The second branch turns a
 // refusable call into a notice under a `notice`-mode guard, which is the mode batching takes in a lane
 // child again since kit#2276. Both read the notice's own record, so a notice never spends the refusal's
 // stamp and re-fires on the notice's own `NOTICE_REFIRE_EVERY` cadence.
@@ -88,8 +86,8 @@ function should_notify_here(tail: string, call: GuardedCall, notified_at_ms: num
 	)
 }
 
-// The wording each notice carries, with the concrete calls the run just issued one-per-turn appended
-// (joshuafolkken/kit#2276). The whole-file write keeps its own base text; the lane notice is reached
+// The wording each notice carries, with the concrete calls the run just issued one-per-turn appended.
+// The whole-file write keeps its own base text; the lane notice is reached
 // under the `notice`-mode guard batching takes in a lane child again since kit#2276, so a headless
 // child is shown *which* recent calls it could have batched rather than only told to batch.
 function notice_text(call: GuardedCall, tail: string): string {
@@ -107,7 +105,7 @@ const GUARD = hook_decision.create_transcript_guard({
 	should_block: should_block_here,
 	reason: time_batch_guard.REASON,
 	// The whole-file write is notified rather than refused, on a record of its own so it never spends
-	// the refusal's stamp (joshuafolkken/kit#1848); the lane-child refusable-call notice kit#2164 added
+	// the refusal's stamp; the lane-child refusable-call notice kit#2164 added
 	// here fires again since kit#2276 restored batching to `notice` in a lane child.
 	notify: {
 		prefix: time_batch_guard.NOTICE_STAMP_PREFIX,
@@ -120,7 +118,7 @@ const batch_refusal = GUARD.refusal
 const batch_outcome = GUARD.outcome
 const { is_enabled, refusal_path } = GUARD
 // The notice's stamp path, exposed the way `refusal_path` is so a test can clean it apart from the
-// refusal's record (joshuafolkken/kit#1848).
+// refusal's record.
 const notice_refusal_path = hook_decision.create_refusal_stamp(
 	time_batch_guard.NOTICE_STAMP_PREFIX,
 ).path

package/scripts/hooks/check-commit-message.ts

@@ -4,6 +4,7 @@ import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { git_command } from '#scripts/git/git-command'
+import { issue_cite } from '#scripts/issue/issue-cite'
 
 interface CheckResult {
 	success: boolean
@@ -25,10 +26,10 @@ function is_inside(directory: string, resolved_path: string): boolean {
 	return relative !== '' && !relative.startsWith(PARENT_SEGMENT) && !path.isAbsolute(relative)
 }
 
-// joshuafolkken/kit#1106: the guard used to be a prefix test — the path had to *start* with `.git/`,
-// which is only the shape the main work tree produces. A linked work tree gets an absolute
-// `<repo>/.git/worktrees/<name>/COMMIT_EDITMSG`, which shares no prefix with it, so the guard threw
-// before the real check ran and no commit inside a work tree could succeed.
+// A prefix test — the path has to *start* with `.git/` — fits only the shape the main work tree
+// produces. A linked work tree gets an absolute `<repo>/.git/worktrees/<name>/COMMIT_EDITMSG`, which
+// shares no prefix with it, so such a guard would throw before the real check ran and no commit inside
+// a work tree could succeed.
 //
 // The directories are asked of git rather than assumed to be named `.git`, because the name is not a
 // property of a repository: a bare repository's git directory is the repository, and
@@ -50,7 +51,7 @@ function is_safe_commit_message_path(
 // Where git would have written the message, for a run that was passed no path. The work tree's own
 // git directory rather than a literal `.git/`: in a linked work tree that name is a *file*, so the
 // relative spelling this used to hardcode ends the run at ENOTDIR — the same defect as the guard's,
-// on the branch the guard does not reach (joshuafolkken/kit#1106).
+// on the branch the guard does not reach.
 function default_commit_message_path(git_directories: ReadonlyArray<string>): string {
 	return path.join(git_directories[0] ?? FALLBACK_GIT_DIRECTORY, COMMIT_MESSAGE_FILE_NAME)
 }
@@ -85,11 +86,13 @@ function extract_issue_number(branch_name: string): string | undefined {
 }
 
 function create_error_message(issue_number: string, branch: string, message: string): string {
+	const reference = issue_cite.plain(issue_number)
+
 	return (
-		`🚫 Error: Commit message must include #${issue_number}\n` +
+		`🚫 Error: Commit message must include ${reference}\n` +
 		`   Current branch: ${branch}\n` +
 		`   Commit message: ${message}\n` +
-		`   Please include #${issue_number} in your commit message\n`
+		`   Please include ${reference} in your commit message\n`
 	)
 }
 
@@ -106,7 +109,7 @@ async function check_commit_message(): Promise<CheckResult> {
 
 	const commit_message = await get_commit_message()
 
-	if (!commit_message.includes(`#${issue_number}`)) {
+	if (!commit_message.includes(issue_cite.plain(issue_number))) {
 		return {
 			success: false,
 			message: create_error_message(issue_number, current_branch, commit_message),
@@ -115,7 +118,7 @@ async function check_commit_message(): Promise<CheckResult> {
 
 	return {
 		success: true,
-		message: `✅ Commit message check passed: Found #${issue_number}`,
+		message: `✅ Commit message check passed: Found ${issue_cite.plain(issue_number)}`,
 	}
 }
 

package/scripts/hooks/codex-hook-adapter.ts

@@ -3,6 +3,7 @@ import { text } from 'node:stream/consumers'
 import { fileURLToPath } from 'node:url'
 import { hook_decision, type GuardOutcome } from '#scripts/josh/hook-decision'
 import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { json_value } from '#scripts/lib/json-value'
 import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
 import { z } from 'zod'
 import { build_envelope, compose_context, format_edited_payload } from './format-edited-file'
@@ -36,13 +37,7 @@ const patch_input_schema = z.object({ command: z.string().min(1) })
 type PayloadFormatter = (raw_payload: string, project_root: string) => Promise<string | undefined>
 
 function parse_payload(raw_payload: string): z.infer<typeof codex_payload_schema> | undefined {
-	try {
-		const parsed = codex_payload_schema.safeParse(JSON.parse(raw_payload))
-
-		return parsed.success ? parsed.data : undefined
-	} catch {
-		return undefined
-	}
+	return json_value.parse_with(raw_payload, codex_payload_schema)
 }
 
 function paths_matching(command: string, pattern: RegExp): Array<string> {
@@ -96,8 +91,8 @@ function pretool_outcome(raw_payload: string): GuardOutcome {
 }
 
 // The formatters apply what eslint could fix silently and return what it could not; each patched
-// file's unfixed block is joined so the whole patch's lint problems reach the model on one edit
-// (joshuafolkken/kit#2275). `undefined` when every file was clean, so the ordinary patch adds nothing.
+// file's unfixed block is joined so the whole patch's lint problems reach the model on one edit.
+// `undefined` when every file was clean, so the ordinary patch adds nothing.
 async function format_posttool_payloads(
 	raw_payload: string,
 	project_root: string,
@@ -123,9 +118,19 @@ async function write_posttool_context(raw_payload: string): Promise<void> {
 	if (context !== undefined) process.stdout.write(`${build_envelope(context)}\n`)
 }
 
+// The environment file is loaded before the verdict, as `write_outcome` does, so the lane-child marker
+// the phase mark reads is in place; the mark follows the written envelope.
+async function write_pretool_outcome(raw_payload: string): Promise<void> {
+	hook_decision.load_environment_file()
+	const outcome = pretool_outcome(raw_payload)
+
+	hook_decision.emit_outcome(outcome)
+	await pretool_guard.mark_phase(outcome)
+}
+
 async function run(raw_payload: string, mode: string): Promise<void> {
 	if (mode === PRETOOL_MODE) {
-		hook_decision.write_outcome(raw_payload, pretool_outcome)
+		await write_pretool_outcome(raw_payload)
 
 		return
 	}
@@ -149,6 +154,7 @@ const codex_hook_adapter = {
 	posttool_payloads,
 	pretool_outcome,
 	pretool_payload,
+	write_pretool_outcome,
 }
 
 export { codex_hook_adapter }

package/scripts/hooks/edited-cspell.ts

@@ -3,10 +3,9 @@ import path from 'node:path'
 import { HOOK_PROCESS_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
-// The spell half of the edit hook (joshuafolkken/kit#2296). joshuafolkken/kit#2275 gave the hook a way
-// to hand the model an edit's lint problems on the spot rather than at the gate; the gate then still
-// ran two extra times on average, and an unregistered word was one of the two things that put it there
-// — a `cspell:dot` failure a run could only read one word at a time under the output cap. Checking the
+// The spell half of the edit hook. The lint half hands the model an edit's lint problems on the spot
+// rather than at the gate; an unregistered word is the other thing that sends a run back to the gate
+// — a `cspell:dot` failure a run can only read one word at a time under the output cap. Checking the
 // one edited file for unknown words the moment it changes closes that the same way the lint half does:
 // a short `additionalContext` block, riding the same `PostToolUse` envelope, and no output at all when
 // there is nothing to say.

package/scripts/hooks/format-edited-cli.ts

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url'
 import { report_no_payload, run_hook } from './format-edited-file'
 
 // The `PostToolUse` hook's entry, kept apart from `format-edited-file.ts` for the reason
-// `pretool-guard-cli.ts` gives (joshuafolkken/kit#2922): `codex-hook-adapter.ts` imports that module,
+// `pretool-guard-cli.ts` gives: `codex-hook-adapter.ts` imports that module,
 // so a self-invoke left in it lands in a shared chunk and the bundled hook never runs.
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
 	if (process.stdin.isTTY) {