@joshuafolkken/kit 1.1229.0 → 1.1370.0

package/scripts/lane/lane-dispatch.ts

@@ -2,45 +2,44 @@ import { agent_argv, type AgentArgv, type AgentArgvResult } from '#scripts/agent
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import type { LabelWrite } from '#scripts/gh/git-gh-issue-write'
+import { issue_cite } from '#scripts/issue/issue-cite'
 import { IN_PROGRESS_LABEL } from '#scripts/issue/issue-labels'
+import { issue_number_shape } from '#scripts/issue/issue-number-shape'
+import { session_cite } from '#scripts/issue/session-cite'
 import { telegram_notify } from '#scripts/notify/telegram-notify'
 import { detached_launch } from '#scripts/run/detached-launch'
 import { run_event_stream } from '#scripts/run/event/run-event-stream'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { run_ending } from '#scripts/run/run-ending'
-import { run_issue_number } from '#scripts/run/run-issue-number'
+import { run_label } from '#scripts/run/run-label'
 import { lane_child_invocation } from './lane-child-invocation'
 import { lane_child_marker } from './lane-child-marker'
 import { lane_dispatch_log } from './lane-dispatch-log'
+import { lane_ledger } from './lane-ledger'
 import { lane_output } from './lane-output'
 import { lane_registry, type LaneInfo } from './lane-registry'
 import { lane_resume, type ResumePlan } from './lane-resume'
 import { openai_lane_supervisor } from './openai-lane-supervisor'
 
-// `josh lane:dispatch <issue-number>` — start a lane's child as an operating-system process of its own
-// (joshuafolkken/kit#1749).
+// `josh lane:dispatch <issue-number>` — start a lane's child as an operating-system process of its own.
 //
-// **The premise the session cut rests on was not true, and this is what makes it true.** A delegated
-// child used to be an in-process subagent of the parent session, so cutting the parent killed every
-// child still implementing: `backlogrun-progress.md` → "The hand-off" says "nothing has to finish, because nothing
-// is being abandoned", and what actually happened was that the next session polled a file whose writer
-// was dead, waited out the silent-unit window, booked each lane `stopped`, and aborted the whole run on
-// the third one. Launched detached, the child survives the cut and the sentence holds as written.
+// **This is what makes the premise the session cut rests on true.** `backlogrun-progress.md` → "The
+// hand-off" says "nothing has to finish, because nothing is being abandoned"; an in-process child
+// would die with the parent it was cut from. Launched detached, the child survives the cut and the
+// sentence holds as written.
 //
 // **Nothing here is new machinery.** The lane is already a linked work tree with its own branch and
 // ports (`lane-open.ts`), the detached launcher is already `run:wake`'s (`detached-launch.ts`), and the
 // recorded output path is already how a session that never opened a lane polls it (`lane-output.ts`).
-// What was missing was the one command that puts the three together.
+// This is the one command that puts the three together.
 //
-// **The recording happens inside the dispatch, so "the lane records no path" stops being a state.**
-// `backlogrun.md`'s hand-off has an exception for a lane nobody could poll, and it exists because the
-// recording used to be a separate step a run could forget. A lane dispatched through here is recorded
-// by the same call that starts it.
+// **The recording happens inside the dispatch, so "the lane records no path" is not a state.** A
+// lane dispatched through here is recorded by the same call that starts it, so no run can forget it.
 
 // The invocation the child is given. Composed from this constant and a digits-only issue number, never
 // from text that was read from anywhere — the same discipline `run-wake-session.ts` applies to the
 // invocation it rebuilds out of the carry record.
-// The resume guide a relaunched child is pointed at (joshuafolkken/kit#2022). It carries the resume
+// The resume guide a relaunched child is pointed at. It carries the resume
 // procedure a `run:cut` successor follows, so naming it lets the child read one section rather than the
 // workflow-commands entry documents it would otherwise read to learn it is a resume at all.
 const NOTE_SEPARATOR = '; '
@@ -60,7 +59,7 @@ interface Dispatched {
 	log_path: string
 	pid: number
 	profile: AgentProfile
-	// The session id this dispatch resumed, or `undefined` when it started fresh (joshuafolkken/kit#2317).
+	// The session id this dispatch resumed, or `undefined` when it started fresh.
 	// `describe` reports which path was taken, so an `outage` re-dispatch says whether it recovered the
 	// disconnected child's context or fell back to a fresh run.
 	resumed_from: string | undefined
@@ -110,14 +109,13 @@ function child_invocation(issue: string): string {
 
 /**
  * The prompt a relaunched child is given after a `run:cut` — a resume-specific instruction followed by
- * the bare `child_invocation` (joshuafolkken/kit#2022). A relaunched child used to be given the plain
- * `fullrun #<N>`, so it read the workflow-commands entry documents (SKILL.md, fullrun.md, ~29k tokens)
- * every resume before it could learn it was a resume at all — the "do not re-read" exception lives
- * inside the very skill it had to open. This preamble tells it up front, so it goes straight to
- * `run:cut --resume` and the stage that answers.
+ * the bare `child_invocation`. Given the plain `fullrun #<N>`, a relaunched child would read the
+ * workflow-commands entry documents every resume before it could learn it was a resume at all — the
+ * "do not re-read" exception lives inside the very skill it would have to open. This preamble tells
+ * it up front, so it goes straight to `run:cut --resume` and the stage that answers.
  *
  * **It ends with `child_invocation` on purpose, not as decoration.** The parent's liveness poll is
- * `pgrep -laf "<child_invocation>$"` (built at dispatch — see `log_sentence`), so a relaunched process
+ * `lane_child_invocation.process_pattern` (read by `run:liveness` — see `log_sentence`), so a relaunched process
  * whose command line did not end with `fullrun #<N>` would be booked stopped while it ran. The trailing
  * invocation keeps that poll matching and is also the ordinary run a `fresh` verdict falls back to.
  */
@@ -171,7 +169,7 @@ function failed_start(
 
 // The `dispatched` outcome, built from the request the launch was composed from — one place so the
 // three launch paths cannot drift on which fields a dispatched child carries (the resume flag among
-// them, joshuafolkken/kit#2317). The request's `argv` rides along harmlessly, as it did before.
+// them). The request's `argv` rides along harmlessly.
 // **`kind` is written last on purpose**: the request was spread from a `Prepared`, so it still carries
 // `kind: 'prepared'` at runtime, and letting the spread win would mislabel the outcome.
 function dispatched_of(
@@ -190,7 +188,7 @@ function existing_dispatch(request: StartRequest): DispatchOutcome | undefined {
 	if (!openai_lane_supervisor.approve(request.lane.directory, active.nonce)) {
 		return failed_start(
 			request,
-			`the OpenAI supervisor for lane #${request.lane.issue} was cancelled`,
+			`the OpenAI supervisor for lane ${session_cite.issue(request.lane.issue)} was cancelled`,
 			[],
 		)
 	}
@@ -216,13 +214,17 @@ async function openai_dispatched_start(
 	if (owner?.issue !== lane.issue) {
 		if (nonce !== undefined) openai_lane_supervisor.cancel(lane.directory, nonce)
 
-		return failed_start(request, `the OpenAI supervisor did not claim lane #${lane.issue}`, notes)
+		return failed_start(
+			request,
+			`the OpenAI supervisor did not claim lane ${session_cite.issue(lane.issue)}`,
+			notes,
+		)
 	}
 
 	if (!openai_lane_supervisor.approve(lane.directory, owner.nonce)) {
 		return failed_start(
 			request,
-			`the OpenAI supervisor for lane #${lane.issue} was cancelled`,
+			`the OpenAI supervisor for lane ${session_cite.issue(lane.issue)} was cancelled`,
 			notes,
 		)
 	}
@@ -267,7 +269,7 @@ async function started(request: StartRequest): Promise<DispatchOutcome> {
 
 // Build the argv the plan calls for: a resume carries the stored session id, a fresh start does not.
 // Both run the same profile diagnostics under the already-resolved profile, so a resume is refused for
-// exactly the reasons a fresh dispatch is (joshuafolkken/kit#2317).
+// exactly the reasons a fresh dispatch is.
 function built_for(plan: ResumePlan, profile: AgentProfile, lane: LaneInfo): AgentArgvResult {
 	if (plan.kind === 'resume') {
 		return agent_argv.with_resume_in(plan.invocation, profile, plan.session_id, lane.directory)
@@ -276,7 +278,7 @@ function built_for(plan: ResumePlan, profile: AgentProfile, lane: LaneInfo): Age
 	return agent_argv.with_profile_in(plan.invocation, profile, lane.directory)
 }
 
-// **The re-dispatch decides resume-or-fresh from the lane's own exit record** (joshuafolkken/kit#2317).
+// **The re-dispatch decides resume-or-fresh from the lane's own exit record**.
 // The record is read from the log the previous dispatch of this lane wrote — a first dispatch finds
 // none and starts fresh, an `outage` ending with a session id resumes it. The provider is resolved
 // first because the resume mechanism is Claude Code's, and an OpenAI lane falls back to fresh.
@@ -304,30 +306,33 @@ function prepared(lane: LaneInfo): Prepared {
 // **The parent claims the marker before it starts the child**, so the window in which a running child
 // is uncounted closes at dispatch rather than tens of minutes later once the child's own `fullrun` gets
 // to its (idempotent) apply. `issue_add_label` creates the label if the repository lacks it — a
-// `POST /issues/{N}/labels` provisions a missing label with a generated color (measured on
-// joshuafolkken/kit#1026, `git-gh-issue-write.ts`) — so no separate `label_ensure` is needed here, and
+// `POST /issues/{N}/labels` provisions a missing label with a generated color
+// (`git-gh-issue-write.ts`) — so no separate `label_ensure` is needed here, and
 // its unapplied answer is a real refusal to launch rather than a note — confirmed by a read-back, so
-// a write that landed but answered with an error still launches (joshuafolkken/kit#3312).
+// a write that landed but answered with an error still launches.
 async function mark_in_progress(issue: string): Promise<LabelWrite> {
 	return await git_gh_command.issue_apply_label(issue, IN_PROGRESS_LABEL)
 }
 
-// The dispatch owns both halves of the marker: it applied it, so a launch that never started takes it
-// back off, leaving no `in-progress` on an issue nothing is running. A removal that itself fails is
-// swallowed — the failed launch is already warned about, and `lane:list` / `run:progress` surface a
-// stuck marker — so this never turns a launch failure into a thrown error.
-async function unmark_in_progress(issue: string): Promise<void> {
-	try {
-		await git_gh_command.issue_remove_label(issue, IN_PROGRESS_LABEL)
-	} catch {
-		/* the launch already failed and is warned about; a stuck marker is reported by lane:list */
-	}
-}
-
 // A started child is recorded on the run's stream, which is where the stall detector ages the last
-// dispatch from (joshuafolkken/kit#2464) — unrecorded, every stall read "hours since the last dispatch"
+// dispatch from — unrecorded, every stall read "hours since the last dispatch"
 // minutes after a launch. A failed start records nothing: no child is running. The marker is claimed
 // first, so a refused one starts nothing.
+//
+// The dispatch owns both halves of the marker: it applied it, so a launch that never started takes it
+// back off through `run_label.unmark`, leaving no `in-progress` on an issue nothing is running. That
+// removal warns and never throws, so it cannot turn a launch failure into a thrown error.
+//
+// The lane ledger takes the same instant: `lane:stats` times a lane's implementation from it, and the
+// stream is capped, so a period's earlier dispatches would be gone from there.
+async function record_started(issue: string): Promise<void> {
+	await run_event_stream_emit.emit(
+		run_event_stream.EVENT_KIND.CHILD_LAUNCH,
+		`${issue_cite.plain(issue)} dispatched`,
+	)
+	await lane_ledger.record_dispatch(Number(issue))
+}
+
 async function finish_dispatch(issue: string, request: StartRequest): Promise<DispatchOutcome> {
 	const mark = await mark_in_progress(issue)
 
@@ -336,16 +341,14 @@ async function finish_dispatch(issue: string, request: StartRequest): Promise<Di
 
 	const is_failed = outcome.kind === 'failed'
 
-	await (is_failed
-		? unmark_in_progress(issue)
-		: run_event_stream_emit.emit(run_event_stream.EVENT_KIND.CHILD_LAUNCH, `#${issue} dispatched`))
+	await (is_failed ? run_label.unmark(issue) : record_started(issue))
 
 	return outcome
 }
 
 /** Start `fullrun #<N>` detached in the lane for `#<N>`, recording where it writes as it does so. */
 async function dispatch_child(issue: string): Promise<DispatchOutcome> {
-	run_issue_number.require_issue_number(issue)
+	issue_number_shape.require_issue_number(issue)
 
 	const lane = await lane_registry.find_open_lane(issue)
 
@@ -366,25 +369,11 @@ async function dispatch_child(issue: string): Promise<DispatchOutcome> {
 // The child is running — saying otherwise would send the caller to dispatch a second one into the same
 // lane — but its output is going nowhere, so a message naming the path would point at a file that will
 // never grow, and a poll of that file would book a working child as stopped.
-// The liveness pattern the parent polls with — the shared one, which also finds a detached ship
-// supervisor (joshuafolkken/kit#2428). `describe` never throws, so an issue that is not a number falls
-// back to the launched invocation rather than raising from the validator.
-function poll_pattern(outcome: Dispatched, issue: string): string {
-	if (!run_issue_number.ISSUE_NUMBER_PATTERN.test(issue)) return `${outcome.invocation}$`
-
-	return lane_child_invocation.process_pattern(issue)
-}
-
 function log_sentence(outcome: Dispatched, issue: string): string {
-	// **The pattern matches the child's own command line, not the lane it runs in**
-	// (joshuafolkken/kit#1948). The child is `claude … ${outcome.invocation}` and its argv carries no
-	// path, so `pgrep -laf <lane directory>` found nothing for a living child and a poll booked it
-	// stopped. The invocation is the last argument, so it sits at the end of the command line; the `$`
-	// anchor is what keeps `fullrun #12` from matching a running `fullrun #123`. `run:liveness` takes
-	// `--process` as what the caller *saw*, never as a property of the child's kind — told to pass
-	// `alive`, a parent that never ran `pgrep` would answer `alive` for a child that crashed an hour ago
-	// and poll it for ever.
-	const poll = `run \`pgrep -laf "${poll_pattern(outcome, issue)}"\` and pass what it found to \`pnpm josh run:liveness ${issue} --output ${outcome.log_path} --process alive\` — or \`--process none\` where it found nothing`
+	// **`run:liveness` reads the child's process for itself**, with the shared
+	// pattern that matches the child's own command line and a detached ship supervisor, so no parent
+	// passes `alive` by hand for a child that crashed an hour ago.
+	const poll = `run \`pnpm josh run:liveness ${issue} --output ${outcome.log_path}\` — it reads the child's process for itself`
 
 	if (outcome.notes.length > 0) {
 		return ` Its output is NOT being kept — ${outcome.notes.join(NOTE_SEPARATOR)} — so ${outcome.log_path} will not grow and the process trace is the only answer: ${poll}.`
@@ -394,7 +383,7 @@ function log_sentence(outcome: Dispatched, issue: string): string {
 }
 
 // Whether this dispatch resumed the disconnected child's session or started fresh — the report the
-// `outage` re-dispatch owes (joshuafolkken/kit#2317). A fresh start says so too, so the absence of a
+// `outage` re-dispatch owes. A fresh start says so too, so the absence of a
 // resume is never silent when an outage record was present.
 function resume_sentence(outcome: Dispatched): string {
 	if (outcome.resumed_from === undefined) {
@@ -408,20 +397,20 @@ function resume_sentence(outcome: Dispatched): string {
 // message the warning exists to carry — the pid among it, with the child already running.
 function describe(outcome: DispatchOutcome, issue: string): string {
 	if (outcome.kind === 'no-lane') {
-		return `No lane is open for #${issue}. Run \`pnpm josh lane:open ${issue}\` first, then dispatch into it.`
+		return `No lane is open for ${session_cite.issue(issue)}. Run \`pnpm josh lane:open ${issue}\` first, then dispatch into it.`
 	}
 
 	if (outcome.kind === 'unrecordable') return outcome.reason
 
 	if (outcome.kind === LABEL_UNSET_KIND) {
-		return `The child for #${issue} was not started: the \`${IN_PROGRESS_LABEL}\` label could not be applied (${outcome.reason}), so the lane would be counted as empty. Nothing was launched.`
+		return `The child for ${session_cite.issue(issue)} was not started: the \`${IN_PROGRESS_LABEL}\` label could not be applied (${outcome.reason}), so the lane would be counted as empty. Nothing was launched.`
 	}
 
 	if (outcome.kind === 'failed') {
-		return `The child for #${issue} did not start: ${outcome.note}. Its log is at ${outcome.log_path}.`
+		return `The child for ${session_cite.issue(issue)} did not start: ${outcome.note}.${agent_role_profile.default_notice()} Its log is at ${outcome.log_path}.`
 	}
 
-	return `Dispatched \`${outcome.invocation}\` as process ${String(outcome.pid)} in ${outcome.lane.directory} with ${agent_role_profile.describe(outcome.profile)}.${resume_sentence(outcome)}${log_sentence(outcome, issue)}`
+	return `Dispatched \`${outcome.invocation}\` as process ${String(outcome.pid)} in ${outcome.lane.directory} with ${agent_role_profile.describe(outcome.profile)}.${agent_role_profile.default_notice()}${resume_sentence(outcome)}${log_sentence(outcome, issue)}`
 }
 
 /**
@@ -441,7 +430,7 @@ function is_worth_warning(outcome: DispatchOutcome): boolean {
 // own failures to standard error and never throws, so this cannot turn a refusal into an exception.
 async function warn_of_problem(outcome: DispatchOutcome, issue: string): Promise<void> {
 	await telegram_notify.warn({
-		issue_title: `${WARNING_TITLE} #${issue}`,
+		issue_title: `${WARNING_TITLE} ${issue_cite.plain(issue)}`,
 		body: describe(outcome, issue),
 		recovery: WARNING_RECOVERY,
 	})

package/scripts/lane/lane-environment.ts

@@ -1,7 +1,7 @@
 import { LANE_SEAT_KEY, PORT_SEED_KEY, ports } from '#ports'
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 
-// The lane's `.env`, built from the root's (joshuafolkken/kit#1490, joshuafolkken/kit#1494).
+// The lane's `.env`, built from the root's.
 //
 // **Port separation is required here, not optional.** `ports/index.js` resolves the project root as
 // the nearest ancestor holding a `package.json` — which, inside a linked work tree, is the lane's
@@ -9,8 +9,8 @@ import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role
 // root's runs on the root's exact offset; either way every lane lands on one pair of ports, and a
 // busy port fails without retrying on another. At the default six lanes that turns E2E from "fails
 // sometimes" into "fails nearly always". So the lane's `.env` keeps the project's `PORT_SEED`
-// unchanged and adds `JOSH_LANE_SEAT`, and `ports/index.js` combines them as `seed × 10 + seat`
-// (joshuafolkken/kit#1494): the file plainly shows which number is the project's and which is the
+// unchanged and adds `JOSH_LANE_SEAT`, and `ports/index.js` combines them as `seed × 10 + seat`:
+// the file plainly shows which number is the project's and which is the
 // seat, and the multiplication that separates the bands lives in one place rather than here.
 //
 // **Everything else in the file is carried across verbatim**, comments and blank lines included:
@@ -18,7 +18,7 @@ import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role
 // are as necessary inside a lane as outside one, and a lane that had to have them re-entered would
 // not be a place a run could start unattended.
 
-// Where the delegated unit running this lane's child writes (joshuafolkken/kit#1713). It goes in the
+// Where the delegated unit running this lane's child writes. It goes in the
 // lane's own `.env` — the store `lane-registry.ts` already reads — rather than in a ledger beside the
 // trees, so `git worktree remove` erases the record along with the lane it described and there is
 // nothing left to go stale. `.env` is gitignored in kit and in every consumer `josh sync` reaches,
@@ -149,7 +149,7 @@ function read_lane_ports(content: string): { development: number; preview: numbe
 /**
  * The output path a lane's `.env` records, or `undefined` where it records none.
  *
- * **A blank assignment is `undefined` rather than an empty path** (joshuafolkken/kit#1713). A lane
+ * **A blank assignment is `undefined` rather than an empty path**. A lane
  * whose record was cleared has nothing to poll, and an empty string handed to
  * `pnpm josh run:liveness --output` is a relative path — refused by its own root check, so the
  * child would come back `undetermined` for ever rather than saying the record is missing.

package/scripts/lane/lane-guard-policy.ts

@@ -1,35 +1,21 @@
 import { lane_child_marker, type MarkerSource } from './lane-child-marker'
 
 // How each `PreToolUse` guard behaves in a dispatched lane child, as an enumeration rather than a
-// judgement (joshuafolkken/kit#2138, joshuafolkken/kit#2164).
+// judgement.
 //
 // **The three guards were built for the interactive main line, where a refusal is guidance.** A denial
 // rewrites the next move of a person's session. A dispatched lane child is a headless `claude -p`
-// process, so a *denial* ends the conversation with nothing committed — joshuafolkken/kit#2138 measured
-// a child killed before its commit by two investigation refusals and one batching refusal, every one of
-// them a read of a file the child was about to edit. So a guard whose correction is a denial cannot fire
-// as one in a child.
+// process, so a *denial* ends the conversation with nothing committed. So a guard whose correction is a
+// denial cannot fire as one in a child.
 //
-// **But a denial is not the only way a guard can speak, and that is what kit#2164 tried.** A guard can
-// also raise a *notice* — a non-blocking `additionalContext` that carries the same guidance without a
-// `permissionDecision`, so the turn is never ended. kit#2164 downgraded the batching guard to a notice
-// in the child for exactly that reason. So the choice is three-valued, not two:
+// **But a denial is not the only way a guard can speak.** A guard can also raise a *notice* — a
+// non-blocking `additionalContext` that carries the same guidance without a `permissionDecision`, so the
+// turn is never ended. So the choice is three-valued, not two:
 //
 //   - `refuse` — deny the call (the main-line default; the child keeps this for the safety rules).
 //   - `notice` — let the call through but attach the guidance, so a headless child is nudged, not killed.
 //   - `off`    — say nothing at all, for a guard whose remedy the child cannot carry out.
 //
-// **The notice did not move the number, kit#2178 took it off, and kit#2276 restores it changed.** The
-// lane child that ran right after kit#2164 merged came in at 1.00 calls per turn on both sides of the
-// first notice (transcript `f39efeb5`), so kit#2178 turned the batching notice `off` in the child rather
-// than pay the per-turn context cost of guidance measured not to work. But with it off, the notice fired
-// **zero** times across the 2026-09-21 backlogrun the density was next measured on, so the 1.147 read
-// there is the rate with no guidance at all — not a second measurement of the notice failing. kit#2276
-// therefore restores it as `notice`, with the two things #2164's lacked: it names the concrete recent
-// calls the run issued one-per-turn, and it recurs every single-call turn rather than every three. The
-// mode stays a genuine experiment — the density is re-measured on the next backlogrun, and a notice that
-// still does not move it is redesigned rather than kept.
-//
 // **It is an enumeration and not a judgement, for the reason `delegation-policy.ts` is one.** "This
 // guard's mode in a child" is a call made under the same pressure that produced the misfire. The list is
 // the whole of it, and a guard nobody classified refuses — the safe direction, since a wrongly-silenced
@@ -37,7 +23,7 @@ import { lane_child_marker, type MarkerSource } from './lane-child-marker'
 // survived once. `lane-guard-policy.test.ts` pins that the enumeration and the guards' live behavior
 // cannot disagree.
 
-// The three ways a guard may behave in a lane child (joshuafolkken/kit#2164). Outside a lane child every
+// The three ways a guard may behave in a lane child. Outside a lane child every
 // guard is `refuse`, which is why that is also the fail-safe default below.
 type LaneGuardMode = 'refuse' | 'notice' | 'off'
 type LaneGuardId = 'investigation' | 'batching' | 'rule' | 'duplicate-read'

package/scripts/lane/lane-handoff.ts

@@ -2,12 +2,12 @@ import { git_common_directory } from '#scripts/git/git-common-directory'
 import { run_ship_detach } from '#scripts/run/ship/run-ship-detach'
 import { lane_child_marker, type MarkerSource } from './lane-child-marker'
 
-// Whether a lane has handed its post-implementation region to the detached ship (joshuafolkken/kit#2962).
+// Whether a lane has handed its post-implementation region to the detached ship.
 //
 // **A child that ran `pnpm josh ship --detach` waits on nobody when it ends.** The supervisor drives the
 // gate, the review and the merge, and notifies on its own outcome, so the `Stop` hook's demand for a
 // `confirmation` notify and `lane-park`'s refusal of that notify only bought a "nothing needed"
-// Telegram and a wasted turn — measured on 2026-10-02 as 43 demands, 21 refusals and ~94 extra turns.
+// Telegram and a wasted turn.
 // Both hooks read this one predicate, so they cannot disagree about whether the lane was handed off.
 //
 // **Running, never merely recorded.** A ship that failed hands its region back to the child, whose

package/scripts/lane/lane-install.ts

@@ -3,7 +3,7 @@ import path from 'node:path'
 import { buffered_process } from '#scripts/lib/buffered-process'
 import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 
-// Filling the lane, which is the other half of opening one (joshuafolkken/kit#1554).
+// Filling the lane, which is the other half of opening one.
 //
 // **A work tree with no `node_modules` is not a lane yet.** A linked work tree starts as a checkout
 // and nothing else, and the lane root is a hidden *sibling* of the repository, so nothing above it
@@ -19,7 +19,7 @@ import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 // The child is spawned through `buffered_process` rather than through `execa` here. What this needs
 // is exactly that module's contract — output buffered rather than inherited, a non-zero exit
 // reported rather than thrown, and a bound on how long the child may hang — and a second copy of it
-// is how a fix to one missed the other before (joshuafolkken/kit#914).
+// is how a fix to one missed the other before.
 
 // `--frozen-lockfile` because a lane is cut from `refs/remotes/origin/<default>` and has to build
 // exactly the lock committed there. A lock the install would rather rewrite is a finding, not
@@ -27,8 +27,8 @@ import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 const INSTALL_ARGUMENTS = ['install', '--frozen-lockfile']
 // The manifest whose absence is the whole skip condition. A lane cut from a repository that has no
 // `package.json` has nothing to install, so running `pnpm install` there could only fail on a
-// manifest that was never there — which is exactly the fixture a cross-process lane test needs
-// (joshuafolkken/kit#2148). The condition is strictly "the file does not exist": a manifest that is
+// manifest that was never there — which is exactly the fixture a cross-process lane test needs.
+// The condition is strictly "the file does not exist": a manifest that is
 // present but unreadable or broken still runs the install and still fails as before, so a genuinely
 // broken repository is never passed silently.
 const MANIFEST_FILE_NAME = 'package.json'
@@ -46,10 +46,9 @@ interface InstallResult {
 
 // A lane with no manifest has nothing to install, so the install is skipped rather than run — the
 // seam a cross-process lane test needs, and a root-cause fix rather than a switch, because running
-// an install with no install target was the defect (joshuafolkken/kit#2148). The condition is
-// strictly the file's absence: `existsSync` answers only whether the path is there, never whether
-// its contents parse, so a present-but-broken manifest falls through to the real install and fails
-// exactly as before.
+// an install with no install target is the defect. The condition is strictly the file's absence:
+// `existsSync` answers only whether the path is there, never whether its contents parse, so a
+// present-but-broken manifest falls through to the real install and fails there.
 function has_manifest(directory: string): boolean {
 	return existsSync(path.join(directory, MANIFEST_FILE_NAME))
 }
@@ -58,12 +57,12 @@ function has_manifest(directory: string): boolean {
  * Install the lane's dependencies, and report whether it worked rather than throwing.
  *
  * **A lane with no `package.json` skips the install** — there is nothing to install, so the reported
- * state is installed rather than failed, and no child is spawned (joshuafolkken/kit#2148). This is
+ * state is installed rather than failed, and no child is spawned. This is
  * the only seam: the production call path, its arguments and its environment are all unchanged.
  *
  * **The verdict is the exit code and only the exit code.** `pnpm install` runs `prepare`, which runs
  * the lefthook installer, and in a linked work tree the hooks are shared with the primary repository
- * — so a warning from it is expected and correct (joshuafolkken/kit#1503, #1507). Reading the child's
+ * — so a warning from it is expected and correct. Reading the child's
  * text for a word like "failed" would turn that correct warning into a refusal to open a lane.
  */
 async function install_dependencies(directory: string): Promise<InstallResult> {

package/scripts/lane/lane-launch-cli.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { issue_number_shape } from '#scripts/issue/issue-number-shape'
 import { josh_command } from '#scripts/josh/josh-run'
 import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
 import { lane_vacant } from '#scripts/lane/lane-vacant'
@@ -8,7 +9,7 @@ import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execa } from 'execa'
 
 // `josh lane:launch <issue> [--stash <message>]` — one composite command for a `backlogrun` lane-start
-// event (joshuafolkken/kit#2162). Opening one lane was four to six turns of the parent: `lane:open`,
+// event. Opening one lane was four to six turns of the parent: `lane:open`,
 // then — only the first lane, and only when `josh latest` had stashed — `stash:pop` and a re-install,
 // then `lane:dispatch`. This collapses them into one call that returns the child's pid, or a refusal,
 // the same shape `lane:dispatch` alone has.
@@ -24,7 +25,6 @@ const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const should_forward_stderr = true
 const PNPM = 'pnpm'
-const ISSUE_PATTERN = /^[1-9]\d*$/u
 
 const USAGE = 'Usage: josh lane:launch <issue-number> [--stash <message>]'
 
@@ -44,7 +44,13 @@ function read_context(argv: ReadonlyArray<string>): LaunchContext | undefined {
 
 	const [issue, ...rest] = parsed.positionals
 
-	if (issue === undefined || rest.length > 0 || !ISSUE_PATTERN.test(issue)) return undefined
+	if (
+		issue === undefined ||
+		rest.length > 0 ||
+		!issue_number_shape.ISSUE_NUMBER_PATTERN.test(issue)
+	) {
+		return undefined
+	}
 
 	return { issue, stash: parsed.values.stash }
 }
@@ -82,8 +88,7 @@ async function prepare(stash: string | undefined, directory: string): Promise<bo
 }
 
 // Where the chain ended. `unopened` is a `lane:open` refusal — no lane was taken; `failed` is a step
-// after it, which leaves the opened lane holding a seat, so a caller cannot read the two alike
-// (joshuafolkken/kit#3027).
+// after it, which leaves the opened lane holding a seat, so a caller cannot read the two alike.
 type LaunchOutcome = { kind: 'launched'; pid: string } | { kind: 'unopened' } | { kind: 'failed' }
 
 const UNOPENED: LaunchOutcome = { kind: 'unopened' }
@@ -95,7 +100,7 @@ async function close_if_vacant(lane: LaneInfo | undefined): Promise<void> {
 	await josh_command.josh_run(['lane:close', lane.issue], should_forward_stderr)
 }
 
-// **A lane a park kept open is resumed, not reopened** (joshuafolkken/kit#3228). A child parked before
+// **A lane a park kept open is resumed, not reopened**. A child parked before
 // its commit leaves its uncommitted work in its lane, and `lane:open` refuses that lane as
 // `already-open` — so the released child is dispatched into the kept tree instead. **Only a lane a
 // child was already dispatched into counts as kept**: `lane:dispatch` records the child's output in the
@@ -103,7 +108,7 @@ async function close_if_vacant(lane: LaneInfo | undefined): Promise<void> {
 // `lane:open` and its refusal. So does a stranded lane, whose `.env` is gone with its tree.
 //
 // **A lane no child was dispatched into and that holds nothing is closed and opened afresh**
-// (joshuafolkken/kit#3289) — a run cut between the open and the dispatch leaves one. It is reopened
+// — a run cut between the open and the dispatch leaves one. It is reopened
 // rather than reused because nothing recorded whether its install finished. A lane with work or a live
 // process in it still meets `lane:open`'s refusal.
 async function lane_directory(issue: string): Promise<string | undefined> {
@@ -119,7 +124,7 @@ async function lane_directory(issue: string): Promise<string | undefined> {
 }
 
 // The launch chain in-process. The CLI prints the pid; `backlog:drive` launches through this same
-// chain (joshuafolkken/kit#2508).
+// chain.
 async function launch_lane(context: LaunchContext): Promise<LaunchOutcome> {
 	const directory = await lane_directory(context.issue)