@joshuafolkken/kit 1.1240.0 → 1.1370.0

package/dist/hooks/{chunk-4TZVB44A.js → chunk-4TW4MQUL.js}

@@ -1,84 +1,123 @@
 import {
   duplicate_read_outcome
-} from "./chunk-QVSWU24O.js";
+} from "./chunk-NZBHG6FW.js";
 import {
   ALREADY_DONE_LABEL,
   CONTEXT_CUT_THRESHOLD,
   IN_PROGRESS_LABEL,
   NEEDS_DECISION_LABEL,
   NEEDS_HUMAN_REVIEW_LABEL,
-  PORCELAIN_FLAG,
-  agent_role_profile,
   bash_triggers,
-  cli_flags,
   filing_cap,
-  git_command,
-  git_common_directory,
   git_gh_command,
   git_gh_issue_read,
   git_gh_pr_read,
-  git_spawn_sync,
   has_any_label,
-  issue_cite,
   lane_background,
   lane_park,
-  lane_registry,
-  own_session,
-  parse_json_object_safe,
+  parse_json_object_or_undefined,
   read_json_listing,
-  repo_origin,
   repo_party,
-  run_carry,
   run_cut,
   run_cut_handoff,
-  run_headless,
+  run_event_scope,
+  run_event_stream,
+  run_event_stream_emit,
   run_hold,
   run_tail_rule,
+  session_cite,
   shell_segments,
   tail_commands
-} from "./chunk-KHX4U3BG.js";
+} from "./chunk-MXVQMLDP.js";
 import {
   ancestor_directories,
   find_local_bin_upwards
 } from "./chunk-JBBMAPC4.js";
+import {
+  agent_role_profile,
+  agent_session_role,
+  git_common_directory,
+  issue_cite,
+  lane_registry,
+  repo_origin,
+  run_headless
+} from "./chunk-SYSRHRWU.js";
 import {
   error_text
 } from "./chunk-CDY4NFQG.js";
 import {
   batch_outcome
-} from "./chunk-F3ELQ2AF.js";
+} from "./chunk-DZWZ3DKY.js";
 import {
   investigation_refusal
-} from "./chunk-KRBERBBI.js";
+} from "./chunk-R6CRQEAL.js";
 import {
   investigation_reads
-} from "./chunk-XZYKEM6J.js";
+} from "./chunk-76RK6E3H.js";
 import {
   lane_guard_policy
-} from "./chunk-GPTFMK5E.js";
+} from "./chunk-GG72ANKI.js";
 import {
-  hook_decision,
-  lane_child_marker,
-  run_issue_number
-} from "./chunk-ZQGD4GBY.js";
+  hook_decision
+} from "./chunk-KPM4YIIX.js";
 import {
   cost_attribute,
   cost_blocks,
+  open_issue_schema,
+  time_batch_guard,
+  time_density_hook,
+  time_shell
+} from "./chunk-TLJYAGZK.js";
+import {
+  lane_child_marker
+} from "./chunk-Z5TMJIPW.js";
+import {
+  PORCELAIN_FLAG,
+  cli_flags,
   cost_transcript,
   cost_usage,
   file_reader,
+  git_command,
+  git_spawn_sync,
+  issue_number_shape,
   json_value,
   lane_paths,
-  open_issue_schema,
-  time_batch_guard,
-  time_density_hook,
-  time_shell
-} from "./chunk-WK2XSHSI.js";
+  own_session,
+  run_carry
+} from "./chunk-NZN2UFI6.js";
 import {
   PLATFORM_TEMP_ROOT,
   PROBE_TIMEOUT_MS,
+  platform_temporary,
   stamp_file
-} from "./chunk-ELCN5LCH.js";
+} from "./chunk-NEC4AT4Z.js";
+
+// scripts/run/event/run-event-plan.ts
+var KIND = run_event_stream.EVENT_KIND.PLAN;
+var PLAN_VERB = "planned";
+function plan_text(issue) {
+  return `${PLAN_VERB} ${issue_cite.plain(issue)}`;
+}
+function has_plan(events, issue) {
+  return run_event_scope.since_own_launch(events, issue).some((event) => event.kind === KIND && run_event_scope.issue_named(event) === issue);
+}
+async function emit_plan(issue) {
+  if (has_plan(await run_event_stream_emit.invocation_or_all_events(), issue)) return;
+  await run_event_stream_emit.emit(KIND, plan_text(issue));
+}
+var run_event_plan = { emit_plan, plan_text };
+
+// scripts/lane/lane-phase.ts
+async function mark_implement(directory = process.cwd(), source = process.env) {
+  const issue = lane_child_marker.marked_issue(source);
+  if (issue === void 0 || !lane_child_marker.is_child_of(directory, source)) return;
+  await run_event_plan.emit_plan(issue);
+  await run_event_stream_emit.emit(
+    run_event_stream.EVENT_KIND.LANE_PHASE,
+    `${issue_cite.plain(issue)} implement`
+  );
+}
+var lane_phase = { mark_implement };
 
 // scripts/rules/direct-filing.ts
 var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api \u2026/issues` or `gh issue create`. The command runs every filing step in order \u2014 the duplicate scout, the body lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing into another repository, and `epic:bundle` after the create \u2014 so none of them is a step to remember. When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,\u2026>` for the ones that are separate deliverables. Reference: `docs/josh-commands-backlog.md` \u2192 "`josh issue:file`". **This rule fires on every occurrence, not once per run.**';
@@ -101,6 +140,8 @@ var INTERVAL_KEY = "JOSH_PROGRESS_INTERVAL_MINUTES";
 var MS_PER_MINUTE = 6e4;
 var MS_PER_SECOND = 1e3;
 var DEFAULT_INTERVAL_MS = DEFAULT_INTERVAL_MINUTES * MS_PER_MINUTE;
+var DISABLED_KEY = "JOSH_PROGRESS";
+var DISABLED_VALUE = "0";
 var NO_LANES = "none";
 var NO_CHILD_YET = "no in-progress child yet";
 var NO_NEXT = "none";
@@ -193,9 +234,14 @@ function minutes_from(raw) {
   }
   return minutes;
 }
+function is_disabled() {
+  return process.env[DISABLED_KEY] === DISABLED_VALUE;
+}
 var run_progress = {
   DEFAULT_INTERVAL_MINUTES,
   DEFAULT_INTERVAL_MS,
+  DISABLED_KEY,
+  DISABLED_VALUE,
   INTERVAL_KEY,
   MS_PER_MINUTE,
   MS_PER_SECOND,
@@ -208,6 +254,7 @@ var run_progress = {
   format_next_line,
   format_next_report,
   format_report,
+  is_disabled,
   is_due,
   minutes_from,
   next_state,
@@ -234,11 +281,7 @@ function parse_stamp(raw) {
 function read_last_line(target) {
   const raw = stamp_file.read_stamp_text(target);
   if (raw === void 0) return void 0;
-  try {
-    return report_stamp_schema.safeParse(JSON.parse(raw)).data?.line;
-  } catch {
-    return void 0;
-  }
+  return json_value.parse_with(raw, report_stamp_schema)?.line;
 }
 function read_last_report(target) {
   const raw = stamp_file.read_stamp_text(target);
@@ -351,8 +394,7 @@ var package_schema = z2.object({
 function read_declared_minutes(directory) {
   try {
     const raw = readFileSync(path.join(directory, PACKAGE_FILE), "utf8");
-    const parsed = package_schema.safeParse(JSON.parse(raw));
-    return parsed.success ? parsed.data.josh?.progress_interval_minutes : void 0;
+    return json_value.parse_with(raw, package_schema)?.josh?.progress_interval_minutes;
   } catch {
     return void 0;
   }
@@ -437,7 +479,7 @@ function decide(call, run2, can_record) {
   if (can_record) ARM_RECORD.record(target, lands_ms);
   return false;
 }
-var EARLY_HEARTBEAT_REASON = "\u26D4 early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours to keep. `pnpm josh run:progress --wait` keeps it for you (`JOSH_PROGRESS_INTERVAL_MINUTES`, or `josh.progress_interval_minutes` in `package.json`, default 20 minutes): start it once in the background and it reports the five labelled lines to the run's event stream on its own, without waking you \u2014 relay nothing, and start it again only after it exits, which it does when newly runnable work arrives. Two timers armed at once is what produced reports 3\u20135 minutes apart on a 15-minute setting (joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a child's completion woke the run, and `--mark` recorded each report without anything refusing the early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run `pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says. If you are waiting on something rather than on a clock, wait on the thing itself \u2014 `pnpm josh followup` waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` \u2192 \"Progress while the run is quiet\". **This rule fires on every early arm, not once per run**, so reissuing the same sleep will be refused again.";
+var EARLY_HEARTBEAT_REASON = "\u26D4 early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours to keep. `pnpm josh run:progress --wait` keeps it for you (`JOSH_PROGRESS_INTERVAL_MINUTES`, or `josh.progress_interval_minutes` in `package.json`, default 20 minutes): start it once in the background and it reports the five labelled lines to the run's event stream on its own, without waking you \u2014 relay nothing, and start it again only after it exits, which it does when newly runnable work arrives. Two timers armed at once is what produced reports 3\u20135 minutes apart on a 15-minute setting (joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a child's completion woke the run, and `--mark` recorded each report without anything refusing the early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run `pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says \u2014 under `backlogrun`, `pnpm josh run:board --chat` instead. If you are waiting on something rather than on a clock, wait on the thing itself \u2014 `pnpm josh followup` waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` \u2192 \"Progress while the run is quiet\". **This rule fires on every early arm, not once per run**, so reissuing the same sleep will be refused again.";
 var PROGRESS_NAMES = /* @__PURE__ */ new Set(["run:progress"]);
 var WATCH_FLAG = /(?:^|\s)--(?:wait|once)(?=\s|$)/u;
 function is_progress_watch_segment(segment) {
@@ -931,7 +973,8 @@ function report_empty(cwd, session_id) {
 }
 function provider_of(environment) {
   const resolved = agent_role_profile.resolve_provider(environment);
-  return resolved.kind === "provider" ? resolved.provider : void 0;
+  if (resolved.kind !== "provider" || resolved.is_default === true) return void 0;
+  return resolved.provider;
 }
 function measurement_of(session) {
   return {
@@ -1060,12 +1103,9 @@ function cache_path(directory) {
 function cached_verdict(target, now_ms) {
   const raw = stamp_file.read_stamp_text(target);
   if (raw === void 0) return void 0;
-  try {
-    const { read_at_ms, verdict } = cache_schema.parse(JSON.parse(raw));
-    return now_ms - read_at_ms < VERDICT_REUSE_MS ? verdict : void 0;
-  } catch {
-    return void 0;
-  }
+  const cached = json_value.parse_with(raw, cache_schema);
+  if (cached === void 0) return void 0;
+  return now_ms - cached.read_at_ms < VERDICT_REUSE_MS ? cached.verdict : void 0;
 }
 function reused_verdict(read2, directory = process.cwd(), now_ms = Date.now()) {
   const target = cache_path(directory);
@@ -1100,7 +1140,7 @@ function current_state() {
     source: process.env,
     carried: run_cut.carried_cut_sync,
     held_issue: run_cut.held_issue_sync,
-    // **Read through the short reuse window** (joshuafolkken/kit#2385). The row now fires per
+    // **Read through the short reuse window**. The row now fires per
     // threshold crossing rather than once per run, so this predicate is a candidate on every edit;
     // the window collapses one turn's burst of edits to a single whole-transcript price.
     verdict: () => implementation_cut_verdict.reused_verdict(() => cost_cli.session_verdict())
@@ -1114,8 +1154,12 @@ function held_run_issue(state) {
   if (lane_paths.lane_issue_of(state.directory, { ...state.source }) !== void 0) return void 0;
   return state.held_issue();
 }
+function implementing_run_issue(state) {
+  if (agent_session_role.is_reviewer(state.source)) return void 0;
+  return lane_child_issue(state) ?? held_run_issue(state);
+}
 function uncut_run_issue(state) {
-  const issue = lane_child_issue(state) ?? held_run_issue(state);
+  const issue = implementing_run_issue(state);
   if (issue === void 0) return void 0;
   return state.carried()?.issue === issue ? void 0 : issue;
 }
@@ -1129,7 +1173,7 @@ function is_over_threshold_edit(call, state = current_state()) {
   return warrants_the_cut(state);
 }
 var THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`;
-var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch, as ${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
+var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file at \`${run_cut_handoff.HANDOFF_PATH}\` (ignored, so it is never committed) with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch, as ${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
 var REISSUE_WINDOW_MS = 9e4;
 function is_reissued_refusal(now_ms, delivered_at_ms) {
   return now_ms - delivered_at_ms < REISSUE_WINDOW_MS;
@@ -1201,7 +1245,6 @@ var gh_api = {
 var ISSUE_PATH_NUMBER = /issues\/(\d+)/gu;
 var ISSUE_VIEW_NUMBER = /\bissue\s+view\s+(?:-{1,2}\S+\s+)*(\d+)/u;
 var ISSUE_READ_ARGUMENTS = /\bissue:read\b([\s\d]*)/u;
-var A_NUMBER = /^\d+$/u;
 var COMMENTS_ENDPOINT = /issues\/\d+\/comments\b/u;
 var VIEW_WITH_COMMENTS = /\bissue\s+view\b[^\n]*--comments\b/u;
 var ISSUE_READ_COMMAND = /\bissue:read\b/u;
@@ -1210,7 +1253,7 @@ function add_issue_read_numbers(command, numbers) {
   if (match === null) return;
   const tokens = (match[1] ?? "").split(/\s+/u);
   for (const token of tokens) {
-    if (A_NUMBER.test(token)) numbers.add(Number(token));
+    if (issue_number_shape.ISSUE_NUMBER_PATTERN.test(token)) numbers.add(Number(token));
   }
 }
 function issue_numbers_of(command) {
@@ -1275,13 +1318,15 @@ function is_body_only_issue_read(command) {
 function reads_issue_comments(command) {
   return shell_segments.segments_of(command).some((segment) => fetches_issue_comments(segment));
 }
-var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/issue-comments.md`. Every body-only read is refused until the comments are read.";
+var ISSUE_COMMENTS_REASON = "\u26D4 issue comments: pnpm josh issue:read <N>\nRun that in place of this read: <N> is the Issue it names, and an Issue's comments are part of the Issue, so the body and every comment come back together. Without josh, add `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable.\nWhy: a decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/issue-comments.md`. Every body-only read is refused until the comments are read.";
 var ROW5 = {
   id: "issue-comments",
   is_trigger: bash_triggers.on_bash_command(is_body_only_issue_read),
   reason: ISSUE_COMMENTS_REASON,
   already_satisfied: prior_comment_read.already_read_for_call,
-  keeps: bash_triggers.on_bash_command(reads_issue_comments)
+  keeps: bash_triggers.on_bash_command(reads_issue_comments),
+  // The opening the reason carried before it led with the command.
+  former_reasons: ["\u26D4 an Issue's comments are part of the Issue: read them before implementing"]
 };
 var issue_comments = {
   ISSUE_COMMENTS_REASON,
@@ -1289,25 +1334,6 @@ var issue_comments = {
   is_body_only_issue_read
 };
 
-// scripts/rules/issue-fold-rule.ts
-var FOLD_NAMES = /* @__PURE__ */ new Set(["issue:fold"]);
-function runs_the_fold(command) {
-  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, FOLD_NAMES));
-}
-function already_folded(tail, _call) {
-  if (filing_cap.prior_filing_count(tail) === 0) return true;
-  return tail_commands.prior_bash_commands(tail).some((command) => runs_the_fold(command));
-}
-var ISSUE_FOLD_REASON = '\u26D4 issue fold: this run has filed an Issue before and is filing another with no `pnpm josh issue:fold` between them. Several findings from one session fold into one Issue by default \u2014 the filing-time counterpart to the split assessment, whose two questions it reuses: are the findings separable, and does the whole clearly exceed one verification gate (the size half is `split:assess`, called not recomputed). Reissue after folding: `pnpm josh issue:fold "<title>" "<title>" \u2026` \u2014 `fold` means file one Issue covering them, `separate` means file them apart (separable findings whose combined size clears the split guide), and the default is `fold`. Add `--not-separable` when they are really one deliverable. The procedure is `.claude/skills/workflow-commands/split-assessment.md` \u2192 "The question". Every later filing is refused until the fold is on the transcript.';
-var ROW6 = {
-  id: "issue-fold",
-  is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
-  reason: ISSUE_FOLD_REASON,
-  already_satisfied: already_folded,
-  keeps: bash_triggers.on_bash_command(runs_the_fold)
-};
-var issue_fold_rule = { ISSUE_FOLD_REASON, ROW: ROW6, already_folded, runs_the_fold };
-
 // scripts/rules/josh-git-bare.ts
 var GIT_COMMAND2 = /* @__PURE__ */ new Set(["git"]);
 var CONFIRM_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes"]);
@@ -1322,7 +1348,7 @@ function is_bare_josh_git(command) {
   return shell_segments.segments_of(command).some((segment) => is_bare_segment(segment));
 }
 var JOSH_GIT_BARE_REASON = '\u26D4 bare `pnpm josh git`: this prompts to confirm the staging, and with no TTY the prompt falls to its cancel branch \u2014 `Checking unstaged files... Found` then `Operation cancelled.` \u2014 so the call throws away the time it takes to fail (about 31 seconds in one measured lane) and you reissue it with `-y` anyway (joshuafolkken/kit#2297). Run it unattended from the start: `pnpm josh git -y "<title> #<N>"`. The recovery form that opens the PR for a push that already landed is `pnpm josh git -y --skip-commit --skip-push`. This rule fires on every occurrence, not once per run.';
-var ROW7 = {
+var ROW6 = {
   id: "josh-git-bare",
   is_trigger: bash_triggers.on_bash_command(is_bare_josh_git),
   reason: JOSH_GIT_BARE_REASON,
@@ -1330,21 +1356,32 @@ var ROW7 = {
 };
 var josh_git_bare = {
   JOSH_GIT_BARE_REASON,
-  ROW: ROW7,
+  ROW: ROW6,
   is_bare_josh_git
 };
 
 // scripts/rules/lane-carry-conflict.ts
 var RUN_BUDGET_COMMANDS = /* @__PURE__ */ new Set(["run:merge", "run:carry"]);
+var LEADING_ASSIGNMENT = String.raw`[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\$\((?:[^()]|\([^()]*\))*\)|[^\s"'])*\s+`;
+var REDIRECTED_PREFIX = new RegExp(
+  String.raw`^(?:${LEADING_ASSIGNMENT})*${platform_temporary.TEMP_ROOT_KEY}=(?!""|''|\s|$|"?\$\{?[A-Za-z_])`,
+  "u"
+);
+var SHARED_STATE_COMMANDS = /* @__PURE__ */ new Set(["run:merge"]);
+var LEADING_ASSIGNMENTS = new RegExp(`^(?:${LEADING_ASSIGNMENT})*`, "u");
+function is_budget_segment(segment) {
+  const commands = REDIRECTED_PREFIX.test(segment) ? SHARED_STATE_COMMANDS : RUN_BUDGET_COMMANDS;
+  return shell_segments.is_josh_command(segment.replace(LEADING_ASSIGNMENTS, ""), commands);
+}
 function invokes_budget_command(command) {
-  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, RUN_BUDGET_COMMANDS));
+  return shell_segments.segments_of(command).some((segment) => is_budget_segment(segment));
 }
 function is_carry_conflict(command, is_lane_child = lane_child_marker.is_child_of(process.cwd())) {
   if (!invokes_budget_command(command)) return false;
   return is_lane_child;
 }
-var LANE_CARRY_CONFLICT_REASON = '\u26D4 lane child carry conflict: this session is a dispatched lane child, and `pnpm josh run:merge` / `pnpm josh run:carry` are the parent backlogrun budget commands \u2014 a child must never run them. The live carry record here belongs to the parent that launched this child, not to a competing run: the parent holds the one run budget for the repository, and every lane shares the common git directory it is keyed on, so a live owner a lane child reads is always its parent (joshuafolkken/kit#2267, measured 2026-09-21 in backlogrun #2252 \u2014 a child read run:merge `busy` as a competitor and parked #2258 unimplemented). Do not run this command, and do not treat it as a conflict: no `needs-decision`, no `confirmation` Telegram, no question to a person \u2014 a dispatched child cannot ask, and there is nothing to decide. Continue implementing this Issue; the parent owns the budget and counts the outcome at the return. The procedure is `.claude/skills/workflow-commands/pre-gate-cut.md` and `backlogrun-progress.md` \u2192 "The hand-off". This rule fires on every occurrence, not once per run.';
-var ROW8 = {
+var LANE_CARRY_CONFLICT_REASON = '\u26D4 lane child carry conflict: this session is a dispatched lane child, and `pnpm josh run:merge` / `pnpm josh run:carry` are the parent backlogrun budget commands \u2014 a child must never run them. The live carry record here belongs to the parent that launched this child, not to a competing run: the parent holds the one run budget for the repository, and every lane shares the common git directory it is keyed on, so a live owner a lane child reads is always its parent (joshuafolkken/kit#2267, measured 2026-09-21 in backlogrun #2252 \u2014 a child read run:merge `busy` as a competitor and parked #2258 unimplemented). Do not run this command, and do not treat it as a conflict: no `needs-decision`, no `confirmation` Telegram, no question to a person \u2014 a dispatched child cannot ask, and there is nothing to decide. Continue implementing this Issue; the parent owns the budget and counts the outcome at the return. The procedure is `.claude/skills/workflow-commands/pre-gate-cut.md` and `backlogrun-progress.md` \u2192 "The hand-off". Live evidence of `run:carry` is taken with a fresh `JOSH_TEMP_ROOT` prefixed to the call, which this rule lets through (joshuafolkken/kit#3458); `run:merge` is refused under any root, because it also syncs main, closes lanes and writes to GitHub. This rule fires on every occurrence, not once per run.';
+var ROW7 = {
   id: "lane-carry-conflict",
   is_trigger: bash_triggers.on_bash_command(is_carry_conflict),
   reason: LANE_CARRY_CONFLICT_REASON,
@@ -1352,7 +1389,7 @@ var ROW8 = {
 };
 var lane_carry_conflict = {
   LANE_CARRY_CONFLICT_REASON,
-  ROW: ROW8,
+  ROW: ROW7,
   invokes_budget_command,
   is_carry_conflict
 };
@@ -1405,13 +1442,13 @@ function is_interactive_ask(call, is_lane_child = lane_child_marker.is_child_of(
   return is_lane_child;
 }
 var LANE_INTERACTIVE_ASK_REASON = '\u26D4 lane child interactive ask: this session is a dispatched lane child and cannot ask a person, so this call is refused. Left to run it would end the turn with nothing on the Issue \u2014 the parent then finds an OPEN Issue with `in-progress` and no question (joshuafolkken/kit#2201; joshuafolkken/kit#2034 placed the same rule one tool-call too late). Do not ask: park the decision instead. Apply `needs-decision` and post a comment carrying the question, the options and whether work was stashed \u2014 `gh api repos/{owner}/{repo}/issues/<N>/labels -f \'labels[]=needs-decision\'` then `pnpm josh issue:comment <N> --body-file <path>` \u2014 then send the `confirmation` Telegram and stop. The procedure is `.claude/skills/workflow-commands/pre-gate-cut.md` \u2192 "A lane child records its park before it stops", and the park itself is `backlogrun-park.md` \u2192 "park and continue". This rule fires on every occurrence, not once per run.';
-var ROW9 = {
+var ROW8 = {
   id: "lane-interactive-ask",
   is_trigger: is_interactive_ask,
   reason: LANE_INTERACTIVE_ASK_REASON,
   decide: () => true
 };
-var lane_interactive_ask = { LANE_INTERACTIVE_ASK_REASON, ROW: ROW9, is_interactive_ask };
+var lane_interactive_ask = { LANE_INTERACTIVE_ASK_REASON, ROW: ROW8, is_interactive_ask };
 
 // scripts/rules/lane-split-park.ts
 var EPIC_COMMANDS = /* @__PURE__ */ new Set(["epic"]);
@@ -1461,7 +1498,7 @@ function decide3(_call, run2) {
   return issue !== void 0 && promoted_issues(commands).has(issue);
 }
 var LANE_SPLIT_PARK_REASON = '\u26D4 lane split park: this session is a dispatched lane child that promoted its own Issue to an epic this run, and a split is not a park \u2014 do not apply `needs-decision` to the promoted epic and do not send a `confirmation` Telegram. The parent reads an open Issue carrying `epic` as a split and continues through its children; a question here has nobody to answer it (joshuafolkken/kit#3296, measured 2026-10-06 when the child for #3255 parked its promoted epic). If what remains of the original work needs a person, park that child issue instead, then end the turn. The procedure is `.claude/skills/workflow-commands/backlogrun-park.md` \u2192 "Splitting a child mid-run". This rule fires on every occurrence, not once per run.';
-var ROW10 = {
+var ROW9 = {
   id: "lane-split-park",
   is_trigger: bash_triggers.on_bash_command(is_candidate),
   reason: LANE_SPLIT_PARK_REASON,
@@ -1469,7 +1506,7 @@ var ROW10 = {
 };
 var lane_split_park = {
   LANE_SPLIT_PARK_REASON,
-  ROW: ROW10,
+  ROW: ROW9,
   promoted_issues
 };
 
@@ -1501,8 +1538,8 @@ function is_switch_away_from_lane(command, is_lane_child = lane_child_marker.is_
   if (!is_lane_child || own_branch === void 0) return false;
   return switch_targets(command).some((target) => target !== own_branch);
 }
-var LANE_SWITCH_MAIN_REASON = "\u26D4 lane child on `git switch main`: this session is a dispatched lane child, and switching to the default branch here always fails \u2014 a lane is a linked work tree, the primary checkout holds the default branch, and git allows one branch in one work tree at a time (`fatal: main is already used by worktree at <the primary checkout>`, measured 11 times in the 2026-09-21 backlogrun). Do not switch: the lane is already on its own issue branch, branched from a fresh default before it opened, and the latest default is brought in during the gate by `pnpm josh main:merge`. So skip this step and keep implementing on the current branch \u2014 no `git switch`, no `git pull`. `pnpm josh main:sync` (`josh ms`) is refused in a lane for the same reason, and a lane is finished with `pnpm josh lane:close <issue-number>`. The parent runs `git switch main && git pull` in the primary checkout before each lane opens, never the child \u2014 `backlogrun-lanes.md` and `backlogrun-child.md` are the single sources. This rule fires on every occurrence, not once per run.";
-var ROW11 = {
+var LANE_SWITCH_MAIN_REASON = "\u26D4 lane child on `git switch main`: this session is a dispatched lane child, and switching to the default branch here always fails \u2014 a lane is a linked work tree, the primary checkout holds the default branch, and git allows one branch in one work tree at a time (`fatal: main is already used by worktree at <the primary checkout>`, measured 11 times in the 2026-09-21 backlogrun). Do not switch: the lane is already on its own issue branch, branched from a fresh default before it opened, and the latest default is brought in during the gate by `pnpm josh main:merge`. So skip this step and keep implementing on the current branch \u2014 no `git switch`, no `git pull`. `pnpm josh main:sync` (`josh ms`) is refused in a lane for the same reason, and a lane is finished with `pnpm josh lane:close <issue-number>`. The parent runs `pnpm josh ms` in the primary checkout before each lane opens, never the child \u2014 `backlogrun-lanes.md` and `backlogrun-child.md` are the single sources. This rule fires on every occurrence, not once per run.";
+var ROW10 = {
   id: "lane-switch-main",
   is_trigger: bash_triggers.on_bash_command(is_switch_away_from_lane),
   reason: LANE_SWITCH_MAIN_REASON,
@@ -1510,7 +1547,7 @@ var ROW11 = {
 };
 var lane_switch_main = {
   LANE_SWITCH_MAIN_REASON,
-  ROW: ROW11,
+  ROW: ROW10,
   is_switch_away_from_lane,
   switch_target,
   switch_targets
@@ -1693,12 +1730,12 @@ function next_commands(command) {
   return COMMANDS.slice(COMMANDS.indexOf(command) + 1);
 }
 function next_line(command, issue) {
-  const commands = next_commands(command).map((next) => `${next} #${issue}`);
+  const commands = next_commands(command).map((next) => `${next} ${issue_cite.plain(issue)}`);
   return `${NEXT_PREFIX}${commands.join(NEXT_SEPARATOR)}`;
 }
 function format_decision(issue, decision) {
   const fields = [`at: ${decision.state}`, `to: ${decision.command}`, `start: ${decision.start}`];
-  return `stage #${issue} \u2014 ${fields.join(" \xB7 ")}`;
+  return `stage ${issue_cite.plain(issue)} \u2014 ${fields.join(" \xB7 ")}`;
 }
 function cell(state, command) {
   const decision = decide4(state, command);
@@ -1838,7 +1875,7 @@ var DECISION_ORACLES = [
     name: "issue:fold",
     decision: "Whether findings filed from one session fold into one issue or stay separate",
     args: "<title...>",
-    vocabulary: ["fold", "separate", "no-fold-needed"],
+    vocabulary: ["fold", "separate", "no-fold-needed", "undetermined"],
     single_source: SPLIT_ASSESSMENT_QUESTION
   },
   {
@@ -1960,10 +1997,7 @@ var NOT_NAMED = /* @__PURE__ */ new Map([
   ["epic:bundle", FILING_STEP_REASON],
   ["issue:scout", FILING_STEP_REASON],
   ["issue:lint", FILING_STEP_REASON],
-  [
-    "issue:fold",
-    "the second filing it governs is already gated by the `issue-fold` delivered rule"
-  ],
+  ["issue:fold", "`issue:file` asks the fold question itself on the second filing it governs"],
   ["cases", READ],
   ["issue:state", READ],
   ["run:cut:resume", SELF],
@@ -2083,13 +2117,13 @@ function is_destructive_command(command) {
   return shell_segments.segments_of(command).some((segment) => is_destructive_segment2(segment));
 }
 var DESTRUCTIVE_COMMAND_REASON = "\u26D4 destructive command: a recursive forced `rm` (`rm -rf`, `rm -fr`, `rm -r -f`, `rm --recursive --force`), `gh repo delete` / `archive`, `gh repo edit --visibility`, `gh pr close`, or a `gh api -X DELETE repos/\u2026` call deletes or closes something that cannot be restored, which is Tier C and needs explicit current-turn user instruction (`prompts/collaboration-workflow/operating-rules.md`). The `.claude/settings.json` deny list matches prefix globs, so it misses these spellings; this row reads the argv instead. Remove a file or directory one path at a time without `-f`, or ask the user to run the command in their own terminal. `gh issue close` and removing a label from an Issue (`DELETE repos/<o>/<r>/issues/<N>/labels/<name>`) are not refused. **This rule fires on every occurrence, not once per run.**";
-var ROW12 = {
+var ROW11 = {
   id: "destructive-command",
   is_trigger: bash_triggers.on_bash_command(is_destructive_command),
   reason: DESTRUCTIVE_COMMAND_REASON,
   decide: () => true
 };
-var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW12, is_destructive_command };
+var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW11, is_destructive_command };
 
 // scripts/rules/direct-pr-create.ts
 var GH_COMMAND2 = "gh";
@@ -2144,13 +2178,13 @@ function is_direct_pr_create(command) {
   return shell_segments.segments_of(command).some((segment) => is_pr_create_segment(segment));
 }
 var DIRECT_PR_CREATE_REASON = "\u26D4 direct PR creation: `gh pr create` (or a `gh api` POST to `repos/<o>/<r>/pulls`) bypasses `build_body`, which writes the `closes #N` line \u2014 the Issue would stay open after the merge (`CLAUDE.md` \u2192 Git Rules). Open the PR with `pnpm josh pr` instead; after a failed push, fix, push, then run `pnpm josh pr`. **This rule fires on every occurrence, not once per run.**";
-var ROW13 = {
+var ROW12 = {
   id: "direct-pr-create",
   is_trigger: bash_triggers.on_bash_command(is_direct_pr_create),
   reason: DIRECT_PR_CREATE_REASON,
   decide: () => true
 };
-var direct_pr_create = { DIRECT_PR_CREATE_REASON, ROW: ROW13, is_direct_pr_create };
+var direct_pr_create = { DIRECT_PR_CREATE_REASON, ROW: ROW12, is_direct_pr_create };
 
 // scripts/rules/worktree-guard.ts
 var CHECKOUT_SUBCOMMAND = "checkout";
@@ -2211,15 +2245,15 @@ function is_unauthorized_segment(segment) {
 function is_unauthorized_worktree_change(command) {
   return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
 }
-var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced `git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
-var ROW14 = {
+var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced `git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. A plan that restores a handed-over stash with `git stash apply` / `git stash pop` is read as `pnpm josh stash:pop "<message>"`: apply it that way, continue, and record the substitution on the Issue \u2014 Tier A, never a `needs-decision` park unless the plan says why the owner keeps the stash: then stop and confirm (`operating-rules.md` \u2192 "no-self-staging"). **This rule fires on every occurrence, not once per run.**';
+var ROW13 = {
   id: "worktree-mutation",
   is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
   reason: WORKTREE_MUTATION_REASON,
   decide: () => true
 };
 var worktree_guard = {
-  ROW: ROW14,
+  ROW: ROW13,
   WORKTREE_MUTATION_REASON,
   is_unauthorized_worktree_change,
   touches_worktree
@@ -2248,13 +2282,13 @@ function is_index_mutation(command) {
   return shell_segments.segments_of(command).some((segment) => is_index_segment(segment));
 }
 var INDEX_MUTATION_REASON = '\u26D4 git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore --staged` overwrite the user\'s staged snapshot, which `CLAUDE.md` \u2192 Git Rules forbids on your own judgement (`prompts/collaboration-workflow/operating-rules.md` \u2192 "no-self-staging"). The `.claude/settings.json` deny list matches prefix globs, so it misses `git -C . commit`, `git -c k=v commit` and `env git commit`; this row reads the argv instead, so the spelling does not matter. A commit goes through `pnpm josh git -y`; any other staging needs explicit current-turn user instruction, run by the user in their own terminal. **This rule fires on every occurrence, not once per run.**';
-var ROW15 = {
+var ROW14 = {
   id: "index-mutation",
   is_trigger: bash_triggers.on_bash_command(is_index_mutation),
   reason: INDEX_MUTATION_REASON,
   decide: () => true
 };
-var index_guard = { INDEX_MUTATION_REASON, ROW: ROW15, is_index_mutation };
+var index_guard = { INDEX_MUTATION_REASON, ROW: ROW14, is_index_mutation };
 
 // scripts/rules/protected-files.ts
 import path5 from "node:path";
@@ -2382,7 +2416,9 @@ var doctor_consumer = {
 // scripts/rules/protected-files.ts
 var READ_TOOL = "Read";
 var EDIT_TOOLS2 = /* @__PURE__ */ new Set(["Edit", "Write"]);
-var ENVIRONMENT_FILE = ".env";
+var SECRET_FILES = /* @__PURE__ */ new Set([".env", ".dev.vars"]);
+var ENVIRONMENT_VARIANT_PREFIX = ".env.";
+var TRACKED_VARIANTS = /* @__PURE__ */ new Set([".env.example", ".env.test"]);
 var SETTINGS_FILE = path5.join(".claude", "settings.json");
 var WHITESPACE3 = /\s+/u;
 var TOKEN_QUOTES = /["']/gu;
@@ -2413,7 +2449,9 @@ function file_path_of(call) {
   return typeof value === "string" ? value : "";
 }
 function is_environment_path(token) {
-  return path5.basename(token.replaceAll(TOKEN_QUOTES, "")) === ENVIRONMENT_FILE;
+  const name = path5.basename(token.replaceAll(TOKEN_QUOTES, ""));
+  if (TRACKED_VARIANTS.has(name)) return false;
+  return SECRET_FILES.has(name) || name.startsWith(ENVIRONMENT_VARIANT_PREFIX);
 }
 function is_environment_read_segment(segment) {
   const words = segment.replaceAll(INPUT_REDIRECT, " < ").split(WHITESPACE3).filter((word) => word !== "");
@@ -2439,14 +2477,14 @@ function is_consumer_settings_edit(call, is_kit_consumer2) {
 function is_protected_file_call(call, is_kit_consumer2 = doctor_consumer.is_kit_consumer) {
   return is_environment_read(call) || is_consumer_settings_edit(call, is_kit_consumer2);
 }
-var PROTECTED_FILE_REASON = '\u26D4 protected file: `.env` holds the Telegram bot token, so reading it \u2014 with the Read tool or a shell reader such as `cat` / `grep` / `source` \u2014 puts a secret in the transcript \u2014 the scripts that need it load it in their own process. `.claude/settings.json` in a consumer repository is the deny list and the hooks every other rule rests on, so a run must not rewrite it; `josh sync` owns it, and a change belongs upstream in kit (`CLAUDE.md` \u2192 "Route distributed-doc / config changes upstream to kit"). Leave both files alone, or ask the user. **This rule fires on every occurrence, not once per run.**';
-var ROW16 = {
+var PROTECTED_FILE_REASON = '\u26D4 protected file: `.env` holds the Telegram bot token, and a `.env.*` variant or `.dev.vars` holds the same kind of secret, so reading one \u2014 with the Read tool or a shell reader such as `cat` / `grep` / `source` \u2014 puts a secret in the transcript \u2014 the scripts that need it load it in their own process (the tracked `.env.example` and `.env.test` stay readable). `.claude/settings.json` in a consumer repository is the deny list and the hooks every other rule rests on, so a run must not rewrite it; `josh sync` owns it, and a change belongs upstream in kit (`CLAUDE.md` \u2192 "Route distributed-doc / config changes upstream to kit"). Leave these files alone, or ask the user. **This rule fires on every occurrence, not once per run.**';
+var ROW15 = {
   id: "protected-file",
   is_trigger: is_protected_file_call,
   reason: PROTECTED_FILE_REASON,
   decide: () => true
 };
-var protected_files = { ROW: ROW16, is_protected_file_call };
+var protected_files = { ROW: ROW15, is_protected_file_call };
 
 // scripts/rules/permission-guards.ts
 var ROWS2 = [
@@ -2482,8 +2520,11 @@ function is_masked_verification(command) {
   return time_shell.discarded_commands(command).some((segment) => is_verification_command(segment));
 }
 var PIPED_VERIFICATION_REASON = "\u26D4 piped verification: a pipeline exits with its last command's status, so `pnpm josh gate | tail` reports success on a gate that failed, and the verdict is discarded before anything reads it. Run the check without the pipe \u2014 josh prints its verdict line last, so the harness output cap keeps it even when the middle is elided. Where the output genuinely has to be narrowed, redirect it to a file and read ranges from that file, or prefix `set -o pipefail` so the pipeline carries the check's status. Read the printed verdict either way, never the exit code alone. Read-only listings are untouched \u2014 this fires only on a command whose result means pass or fail. The rule is in `prompts/collaboration-workflow/output-bounds.md`. Reissue this call with no pipe \u2014 it fires once per run and cannot repeat on the call in hand.";
+function pipelines_of(command) {
+  return shell_segments.segments_of(time_shell.unquoted(command)).map((segment) => segment.split("|").map((piece) => piece.trim()));
+}
 function command_pieces(command) {
-  return shell_segments.segments_of(time_shell.unquoted(command)).flatMap((segment) => segment.split("|")).map((piece) => piece.trim());
+  return pipelines_of(command).flat();
 }
 function runs_verification(command) {
   return command_pieces(command).some((piece) => is_verification_command(piece));
@@ -2491,11 +2532,38 @@ function runs_verification(command) {
 function keeps_verdict_intact(command) {
   return runs_verification(command) && !is_masked_verification(command);
 }
+var PIPEFAIL_PREFIX = "set -o pipefail; ";
+var FULL_READING_FILTER = /^(?:tail|grep)\b/u;
+var EARLY_EXIT_GREP = /^grep\b.*\s(?:-[a-zA-Z]*[lLmq]|--(?:quiet|silent|max-count|files-with(?:out)?-match))/u;
+var ALLOWED_OPERATORS = /2>&1|&&/gu;
+var SIDE_EFFECT_SYNTAX = /[&<>`]|\$\(/u;
+var PIPEFAIL_NOTE = "\u21BB piped verification: the josh check was piped, so `set -o pipefail;` was prefixed and the call ran with the check's status carried to the exit code. Read the printed verdict, never the exit code alone \u2014 `prompts/collaboration-workflow/output-bounds.md` (joshuafolkken/kit#3570).";
+function reads_to_the_end(piece) {
+  return FULL_READING_FILTER.test(piece) && !EARLY_EXIT_GREP.test(piece);
+}
+function is_filtered_check(pipeline) {
+  const [head = "", ...filters] = pipeline;
+  return is_verification_command(head) && filters.every((piece) => reads_to_the_end(piece));
+}
+function has_side_effect_syntax(command) {
+  return SIDE_EFFECT_SYNTAX.test(command.replaceAll(ALLOWED_OPERATORS, " "));
+}
+function is_pipefail_rewritable(command) {
+  return is_masked_verification(command) && !has_side_effect_syntax(command) && pipelines_of(command).every((pipeline) => is_filtered_check(pipeline));
+}
+function pipefail_input(call) {
+  if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return void 0;
+  const command = time_shell.bash_command(call.input);
+  if (!is_pipefail_rewritable(command)) return void 0;
+  return { ...call.input, command: `${PIPEFAIL_PREFIX}${command}` };
+}
 var piped_verification = {
   PIPED_VERIFICATION_REASON,
+  PIPEFAIL_NOTE,
   VERIFICATION_COMMANDS,
   is_masked_verification,
   keeps_verdict_intact,
+  pipefail_input,
   runs_verification
 };
 
@@ -2525,7 +2593,7 @@ function is_poll_loop(command) {
   return LOOP_KEYWORD2.test(plain) && SLEEP_COMMAND.test(plain);
 }
 var POLL_LOOP_REASON = '\u26D4 output poll loop: this hand-writes a `while`/`until` wait loop over a command\'s output, a marker file or a process \u2014 with a `sleep` or, worse, without one \u2014 and the loop does not know when the command finished. A regex that never matches waits to the harness block limit; one that matches a mid-run line exits too early \u2014 either way the command exit is not what ends the wait, and each pass spends a full-context round trip (joshuafolkken/kit#2371 measured about 45 minutes, 13% of six lanes, lost to exactly this). Do not poll the output file. A command known to take minutes \u2014 `pnpm josh gate`, `pnpm josh followup`, `pnpm josh format` \u2014 is started detached from the first with `run_in_background` set, and the harness re-invokes you when it exits: its completion notification is what ends the wait, on the task exit rather than a regex or the block limit. So issue the long command in the background and end the turn \u2014 do not arm a loop; the wake-up brings you back. To glance at interim output, `Read` the output file once, never in a sleep loop. If you are waiting on CI, `pnpm josh followup` waits on it for you. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every occurrence, not once per run.**';
-var ROW17 = {
+var ROW16 = {
   id: "poll-loop",
   is_trigger: bash_triggers.on_bash_command(is_poll_loop),
   reason: POLL_LOOP_REASON,
@@ -2533,7 +2601,7 @@ var ROW17 = {
 };
 var poll_loop = {
   POLL_LOOP_REASON,
-  ROW: ROW17,
+  ROW: ROW16,
   is_poll_loop
 };
 
@@ -2565,13 +2633,17 @@ function current_state2() {
     directory: process.cwd(),
     carried: run_cut.carried_cut_sync,
     marked_issue: lane_child_marker.marked_issue(),
+    is_reviewer: agent_session_role.is_reviewer(),
     context_verdict: cost_cli.session_verdict
   };
 }
+function dispatched_issue(state) {
+  return state.is_reviewer ? void 0 : state.marked_issue;
+}
 function uncut_lane_issue(state) {
   const issue = lane_paths.lane_issue_of(state.directory);
   if (issue === void 0) return void 0;
-  if (state.marked_issue !== issue) return void 0;
+  if (dispatched_issue(state) !== issue) return void 0;
   return state.carried()?.issue === issue ? void 0 : issue;
 }
 function warrants_the_cut2(verdict) {
@@ -2603,13 +2675,13 @@ function posts_at_path_literally(command) {
   return RAW_FIELD_BODY_AT.test(command);
 }
 var RAW_FIELD_BODY_REASON = "\u26D4 literal @path body: this passes `body=@<path>` to `gh api` with a raw field flag (`-f` / `--raw-field`), which sends the value verbatim \u2014 the string `@<path>` is posted as the comment, not the file it points at. `-F` / `--field` is the flag that reads the file, and the two spellings differ by one character while `gh` exits 0 and returns a comment URL either way, so the break is invisible until a person reads the issue (joshuafolkken/kit#2304 lost two park comments this way). Post an issue or PR comment with `pnpm josh issue:comment <N> --body-file <path>` \u2014 the one spelling, which cannot take the wrong flag. The rule and the safe forms are in `prompts/collaboration-workflow/shell-body.md`. This rule fires on every occurrence, not once per run.";
-var ROW18 = {
+var ROW17 = {
   id: "raw-field-body",
   is_trigger: bash_triggers.on_bash_command(posts_at_path_literally),
   reason: RAW_FIELD_BODY_REASON,
   decide: () => true
 };
-var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW18, posts_at_path_literally };
+var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW17, posts_at_path_literally };
 
 // scripts/rules/rule-body-guard.ts
 var EDIT_TOOL = "Edit";
@@ -2680,7 +2752,7 @@ function runs_placement_oracle(command) {
     (names) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
   );
 }
-var ROW19 = {
+var ROW18 = {
   id: "rule-body",
   is_trigger: writes_rule_prose,
   reason: RULE_BODY_REASON,
@@ -2689,7 +2761,7 @@ var ROW19 = {
 };
 var rule_body_guard = {
   RULE_BODY_REASON,
-  ROW: ROW19,
+  ROW: ROW18,
   answered_placement,
   is_rule_document,
   writes_rule_prose
@@ -2925,6 +2997,9 @@ function project_root(directory) {
     (candidate) => existsSync4(path7.join(candidate, PACKAGE_JSON))
   ) ?? directory;
 }
+function is_kit_repository(directory) {
+  return !doctor_consumer.is_kit_consumer(project_root(directory));
+}
 function is_ignored(entry) {
   return entry.split(/[/\\]/u).some((part) => IGNORED_DIRS.has(part));
 }
@@ -2998,6 +3073,7 @@ var project_checks = {
   has_config,
   has_files,
   is_basic,
+  is_kit_repository,
   prettier_skip_reason,
   project_root,
   skip_notice,
@@ -3121,8 +3197,8 @@ function is_untested_commit(call) {
   return test_declared_changed.current_verdict() === "required";
 }
 var REASON = '\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads the working tree as `required` (a changed file that is neither a test \u2014 `*.test.ts` / `*.e2e.ts` \u2014 nor a mechanically-exempt non-runtime path). `CLAUDE.md` \u2192 Code Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an E2E. Add the declared test and reissue this commit. **If the change genuinely touches no executable runtime path** it is the pre-approved non-runtime exception \u2014 declare it in your Step 0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` \u2192 "\u914D\u9001\u3055\u308C\u3066\u3044\u308B\u898F\u5247". This fires once per run, so reissuing will not repeat on the call in hand.';
-var ROW20 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
-var test_declared_commit = { REASON, ROW: ROW20 };
+var ROW19 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
+var test_declared_commit = { REASON, ROW: ROW19 };
 
 // scripts/rules/third-party-write.ts
 function is_third_party_write_segment(segment, session_owner, resolve_placeholder_owners) {
@@ -3160,67 +3236,30 @@ function writes_third_party(command, resolve_owner = repo_party.current_owner, r
   );
 }
 var THIRD_PARTY_WRITE_REASON = '\u26D4 third-party write: this `gh api` call writes to a repository whose owner is not this session \u2014 a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, is not that instruction (`CLAUDE.md` \u2192 "Third-party repositories are Tier C", `prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with `pnpm josh repo:party <owner/repo>` \u2014 owner equality, computed not judged. A read (`-X GET`, or no field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or `-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact for a person to post \u2014 do not publish it yourself. **This rule fires on every occurrence, not once per run.**';
-var ROW21 = {
+var ROW20 = {
   id: "third-party-write",
   is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
   reason: THIRD_PARTY_WRITE_REASON,
   decide: () => true
 };
 var third_party_write = {
-  ROW: ROW21,
+  ROW: ROW20,
   THIRD_PARTY_WRITE_REASON,
   writes_third_party
 };
 
-// scripts/rules/wip-cap.ts
-var WIP_CAP = 30;
-var WIP_CAP_REASON = `\u26D4 backlog WIP cap: \`pnpm josh issue:file\` counts the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file \u2014 the command holds such a filing. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by (\`--over-cap\`, or the \`tier-a\` / \`split\` route), and an interrupt (\`--route interrupt\`), decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. Both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call and let the command count \u2014 it fires once per run and cannot repeat on the call in hand.`;
-var ISSUE_LISTING = /^gh\s+(?:-{1,2}[\w-]+(?:[= ]\S+)?\s+)*issue\s+list\b/u;
-var ISSUES_QUERY = /repos\/[^\s'"]*\/issues\?[^\s'"]*state=open/u;
-var OPEN_STATE = /--state[= ]open|state=open/u;
-var LABEL_FILTER = /--label\b|[?&]labels=/u;
-function counts_open_issues(command) {
-  return shell_segments.segments_of(command).some((segment) => {
-    if (LABEL_FILTER.test(segment)) return false;
-    return ISSUE_LISTING.test(segment) && OPEN_STATE.test(segment) || ISSUES_QUERY.test(segment);
-  });
-}
-var ROW22 = {
-  id: "wip-cap",
-  is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
-  reason: WIP_CAP_REASON,
-  keeps: bash_triggers.on_bash_command(counts_open_issues)
-};
-var wip_cap = { ROW: ROW22, WIP_CAP, WIP_CAP_REASON };
-
 // scripts/rules/delivered-rules.ts
 var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
 var STAMP_PREFIX = "josh-rule-guard-";
 var { is_issue_filing, on_bash_command } = bash_triggers;
 var { SHELL_BODY_REASON: SHELL_BODY_REASON2, carries_a_body: carries_a_body2, is_shell_evaluated_body: is_shell_evaluated_body2, keeps_body_safe: keeps_body_safe2 } = shell_body_trigger;
 var DELIVERED_RULES = [
-  // **Listed first, ahead of the filing trigger it overlaps** (joshuafolkken/kit#2122). A `gh api`
-  // that files an Issue into a repository we do not own trips both this row and `wip-cap` /
-  // `issue-scout` / `filing-cap` — but the backlog count, the scout and the per-run cap are all about
-  // filing into *our own* backlog, so on a third-party target the right answer is to stop the write
-  // entirely rather than to count anything. Placing it first means a third-party write is refused
-  // before any of those speak; on a first-party filing it is silent (the owners match), so `wip-cap`
-  // still speaks first, exactly as before. It fires on every occurrence (`git-force.ts`).
+  // First: a third-party write is stopped before the first-party filing rows count anything.
   third_party_write.ROW,
-  // **A hand-built filing is refused on every occurrence** (joshuafolkken/kit#2808) and pointed at
-  // `josh issue:file`, which runs the scout, the lint, the labels, the `## Origin` check and
-  // `epic:bundle` itself. It claims the direct call only, so the rows below — which trigger on the
-  // `issue:file` call — never overlap it.
+  // The direct call only; `filing-cap` below triggers on `issue:file`. The WIP cap and the fold
+  // question are `issue:file`'s own steps, so no row gates them.
   direct_filing.ROW,
-  wip_cap.ROW,
-  // **Two more rows share the filing trigger** (joshuafolkken/kit#2119, joshuafolkken/kit#2213), listed
-  // after `wip-cap` so the backlog count still speaks first: `filing-cap` refuses every filing past
-  // the per-run ceiling, and `issue-fold` refuses a *second* filing the run has not folded. Each is a
-  // real instance of the admissible overlap the comment on `delivery` describes — the losing rule's
-  // delivery is still correct one reissue later — so an unfolded, over-cap second filing is delivered
-  // `wip-cap`, then `filing-cap`, then `issue-fold` across its reissues.
   filing_cap.ROW,
-  issue_fold_rule.ROW,
   issue_comments.ROW,
   {
     id: "shell-body",
@@ -3229,19 +3268,15 @@ var DELIVERED_RULES = [
     keeps: on_bash_command(keeps_body_safe2),
     reaches: on_bash_command(carries_a_body2)
   },
-  // **The sibling of `shell-body`, one call further along** (joshuafolkken/kit#2304). `shell-body`
-  // refuses a body passed inline so the shell evaluates it; this refuses a body passed by path with
-  // the raw field flag (`-f` / `--raw-field body=@<path>`), which posts the literal `@<path>`. It
-  // claims no command any row above does — `shell-body` triggers on a backtick or `$`, which the
-  // `@<path>` misfire carries neither, and `is_issue_filing` leaves the comment endpoint alone — so
-  // the exactly-one-rule invariant over its fixtures holds. It fires on every occurrence (`git-force.ts`).
   raw_field_body.ROW,
   {
     id: "piped-verification",
     is_trigger: on_bash_command(piped_verification.is_masked_verification),
     reason: piped_verification.PIPED_VERIFICATION_REASON,
     keeps: on_bash_command(piped_verification.keeps_verdict_intact),
-    reaches: on_bash_command(piped_verification.runs_verification)
+    reaches: on_bash_command(piped_verification.runs_verification),
+    // A `| tail` / `| grep` masking is rewritten under `pipefail` by `pretool-guard.ts`, never refused.
+    rewrite_note: piped_verification.PIPEFAIL_NOTE
   },
   {
     id: "early-heartbeat",
@@ -3251,29 +3286,11 @@ var DELIVERED_RULES = [
     keeps: on_bash_command(early_heartbeat.is_progress_watch),
     reaches: on_bash_command(early_heartbeat.waits_for_progress)
   },
-  // **Listed before `run-tail`, the one row it deliberately overlaps** (joshuafolkken/kit#2118). A
-  // foreground `pnpm josh git -y` with no test beside the change is claimed by both: `test-declared`
-  // decides whether the commit should happen at all, so it is listed first, exactly as `wip-cap`
-  // precedes `shell-body` for deciding whether an Issue should exist. Nothing is lost by `run-tail`
-  // losing the race — the stamps are keyed per `id`, so the reissued push is delivered `run-tail`,
-  // which is asserted rather than assumed. The overlap only arises in a real checkout where the
-  // verdict is `required`; in the hermetic non-repo suite the git read fails to `exempt`, so
-  // `test-declared` claims nothing and the "exactly one rule" invariant over `run-tail`'s fixture holds.
+  // Before `run-tail`: whether to commit at all is decided before how to push.
   test_declared_commit.ROW,
-  // **The long-running josh command a lane child backgrounds and loses** (joshuafolkken/kit#2704). A
-  // headless child's background tasks die with its turn, so a backgrounded `josh gate` / `git` /
-  // `followup` is killed before it reports; this refuses the launch and hands back `josh ship
-  // --detach`, whose supervisor outlives the turn. **Listed before `run-tail`, whose push it claims in
-  // a child**: that row answers a foreground push with "reissue it backgrounded", the reissue this row
-  // refuses, so a child is sent to the detached ship on its first refusal instead of through both.
-  // Outside a child it claims nothing. A backgrounded bare `josh git` also trips `josh-git-bare`
-  // below; this row wins, and `ship --detach` satisfies both. It fires on every occurrence.
+  // Before `run-tail`, so a lane child goes straight to `ship --detach` instead of through both.
   lane_background.ROW,
-  // **The one row whose trigger reads a field of the input beside the command**, so it supplies its
-  // own tool-name check rather than going through `on_bash_command`: a push step already issued with
-  // `run_in_background` is the rule obeyed, and refusing it would charge a run for doing the right
-  // thing. It supplies `decide` because a push is a recurring act — one per child in a batch, and a
-  // second inside one `fullrun` when round 2 fixes a finding in place.
+  // Reads `run_in_background` beside the command; `decide`, since a push recurs.
   {
     id: "run-tail",
     is_trigger: run_tail_rule.is_foreground_push_step,
@@ -3282,36 +3299,10 @@ var DELIVERED_RULES = [
     keeps: run_tail_rule.is_backgrounded_push_step,
     reaches: run_tail_rule.is_push_step_call
   },
-  // **The one row whose trigger consults the world beside the command**, because "is this a lane that
-  // has not cut" is not readable from the call: it is the working directory's own name and the cut
-  // record on disk. Both reads are synchronous, and the command match runs first, so a run that never
-  // types `pnpm josh gate` pays nothing for it.
-  //
-  // **Once per run rather than `decide`, and the direction of the error is why.** Taking the cut ends
-  // the process, so this is not the recurring act joshuafolkken/kit#1570 wrote `decide` for — and the
-  // five verdicts that legitimately leave a run at the gate (`not-a-lane`, `unready`, `busy`,
-  // `failed`, `unknown`) all need the reissue to go through. A row that refused every time would wedge exactly
-  // those runs; a row that refuses once cannot.
-  //
-  // **`pnpm josh rule:value` read this row with a ceiling of about 50%, and joshuafolkken/kit#1867 is
-  // what removed it** (the ceiling was recorded here by joshuafolkken/kit#1864's review round 2). A
-  // cut relaunches a *new session*, which the measurement groups as a run of its own, and that
-  // resumed run issues the entry check — so scored on the asking alone it joined the denominator
-  // while never being able to satisfy `keeps`, which only the cutting run can, and ten perfectly
-  // obedient children read as ten kept out of twenty. **The two halves are separable, just not from
-  // one call**: both processes issue byte-identical `--resume` strings, but the `fresh` verdict sends
-  // a run on to claim the working-tree hold while the `resume` verdict tells its counterpart to skip
-  // that claim. `reaches_the_pre_gate_boundary` is that conjunction, and it is why `CallTest` is
-  // handed the run's calls beside the turn's rather than a second predicate slot of its own.
-  // Dropping `reaches` altogether is still strictly worse — the trigger evaluates against the
-  // *measuring* process's working directory, so it is always false from the main checkout and the row
-  // would read as no runs at all.
-  //
-  // **It overlaps `piped-verification` on a piped gate call, and the order is safe in both
-  // directions.** `pnpm josh gate | tail` in an uncut lane is a real instance of both defects; the
-  // earlier row speaks, its own reason says to reissue, and this one delivers on the reissue — the
-  // reading "the losing rule's delivery is still correct one call later" that the comment below
-  // requires of any admissible overlap.
+  // Reads the lane name and the cut record. Once per run, not `decide`: taking the cut ends the
+  // process, and the verdicts that leave a run at the gate all need the reissue through. `reaches`
+  // tells the cutting run from the resumed one by the run's calls. Overlaps `piped-verification`
+  // safely: that row speaks first and this one delivers on the reissue.
   {
     id: "pre-gate-cut",
     is_trigger: on_bash_command(pre_gate_cut.is_uncut_gate),
@@ -3319,125 +3310,25 @@ var DELIVERED_RULES = [
     keeps: on_bash_command(pre_gate_cut.takes_the_cut),
     reaches: pre_gate_cut.reaches_the_pre_gate_boundary
   },
-  // **The second row whose trigger consults the world beside the command** (joshuafolkken/kit#2034):
-  // "is this a dispatched lane child" is the dispatch mark against this checkout's own issue, read
-  // synchronously by `lane_child_marker.is_child_of`, and the command match runs first so an ordinary
-  // run pays nothing for it.
-  // Its once-per-run disposition is stated beside the row in `lane-park.ts`.
-  //
-  // **A split child's park is refused first** (joshuafolkken/kit#3296): a lane child that promoted its
-  // own Issue to an epic this run has nothing to park, so `lane-split-park` refuses the label write
-  // and the confirmation notify onto that epic on every occurrence. It shares the notify with
-  // `lane-park` and is listed first; a run that promoted nothing falls through to `lane-park`.
+  // A split child's park is refused before `lane-park` sees it.
   lane_split_park.ROW,
   lane_park.ROW,
-  // **joshuafolkken/kit#2034's rule, one tool-call earlier** (joshuafolkken/kit#2201). `lane-park`
-  // fires on the `confirmation` notify a routed child reaches; a child that reaches for
-  // `AskUserQuestion` never gets there, because the harness ends its turn at the refused ask. This
-  // row's trigger is that ask, so the refusal becomes an instruction — park the question — instead of
-  // the child's death. Its trigger reads the input's tool name and consults the dispatch mark, like
-  // `lane-park`, and shares no command with any Bash row, so it claims no `gh` / `git` / `josh` call.
-  // It fires on every occurrence (`decide` returns true), the disposition `git-force.ts` takes: an
-  // interactive ask must never succeed in a child, and the route is always the park, never a reissue.
   lane_interactive_ask.ROW,
-  // **The parent budget commands a lane child must never run** (joshuafolkken/kit#2267). A dispatched
-  // child that ran `pnpm josh run:merge` read its `busy` as a competing session and parked its Issue
-  // unimplemented — but the live carry record is the parent that launched it, never a competitor. This
-  // row refuses `run:merge` / `run:carry` in a lane child and hands back the mechanical branch: the
-  // record is the parent's, so continue implementing rather than park or ask. Its trigger claims a
-  // `josh` subcommand no other row does (the filing rows are `gh`, `run-tail` is `git push`), so it
-  // overlaps nothing. It fires on every occurrence (`decide` returns true): a child must never run
-  // these, and the route is always "continue", never a reissue (`git-force.ts`).
   lane_carry_conflict.ROW,
-  // **The `git switch main` a lane child can never succeed at** (joshuafolkken/kit#2313), the fifth of
-  // the "always fails" misfires joshuafolkken/kit#2297 catalogued. A lane is a linked work tree and the
-  // primary checkout holds the default branch, so a child's `git switch main` fails structurally
-  // (`already used by worktree`); this refuses it before it fails and hands back the next command —
-  // skip the step, `pnpm josh main:merge` brings the default in during the gate. Its trigger reads the
-  // dispatch mark and the lane branch like `lane-carry-conflict`, and claims a `git switch` no row
-  // above matches — `git-force` is `git push` / `git branch`, `worktree-mutation` is `git checkout --`
-  // / `restore` / `stash` — so no two rows claim one command. It fires on every occurrence (`decide`
-  // returns true): a child must never run this, and the route is always "continue" (`git-force.ts`).
   lane_switch_main.ROW,
-  // **A `pnpm josh git` with no `-y` cannot succeed from an agent** (joshuafolkken/kit#2297). It
-  // prompts to confirm the staging, the no-TTY prompt cancels, and the run reissues with `-y` after
-  // throwing away the time it took to fail. This row refuses the bare call and hands back the `-y`
-  // form. It is disjoint from `run-tail` by the flag — that row requires `-y`, this refuses its
-  // absence — so no two rows claim one command. It fires on every occurrence (`decide` returns true):
-  // a bare call wastes the same time each time, so the route is always the `-y` reissue
-  // (`git-force.ts`).
+  // Disjoint from `run-tail` by the `-y` flag.
   josh_git_bare.ROW,
-  // **The three Bash-string gaps the deny glob cannot express** (joshuafolkken/kit#2120), each reading
-  // the command's argv rather than a literal a glob keys on. They share no trigger with any row above —
-  // force/delete is `git push` / `git branch`, the worktree change is `git checkout` / `restore` /
-  // `stash`, and the file body is a heredoc / `node -e` / `perl -i` — so no two rows claim one command,
-  // which `delivered-rules-bash.test.ts` pins. Each declares `decide` returning true: a destructive or
-  // billed act is refused on every occurrence, never once per run (`git-force.ts`).
+  // The Bash-string gaps the deny glob cannot express, read by argv; `delivered-rules-bash.test.ts`
+  // pins that no two rows claim one command.
   git_force.ROW,
   worktree_guard.ROW,
   file_body.ROW,
-  // **The deny-list bypasses closed by argv and path rather than glob** (joshuafolkken/kit#2983) — an
-  // index mutation, a recursive forced `rm` or destructive `gh` call, and a protected file. Each
-  // claims a command or file no row above does and refuses every occurrence (`permission-guards.ts`).
   ...permission_guards.ROWS,
-  // **The hand-written wait loop a lane child improvises over a backgrounded command's output**
-  // (joshuafolkken/kit#2371). `early-heartbeat` refuses a bare `sleep` and stands down on any loop
-  // keyword; this is the loop it left — a `while`/`until` that sleeps between probes of an output
-  // file. Its trigger claims a command no row above matches: the loop-plus-`sleep` shape carries no
-  // `gh` / `git` / `josh` subcommand any other trigger keys on, and a poll loop is never a bare
-  // `sleep` (the loop keyword makes `early-heartbeat.is_wait_timer` false), so the Bash
-  // `rules_claiming` invariant holds. It fires on every occurrence (`decide` returns true): a poll
-  // loop wastes the same round trips each time, so the route is always "background it and end the
-  // turn", never a reissue (`git-force.ts`).
   poll_loop.ROW,
-  // **The second row whose trigger is an `Edit` / `Write` rather than a shell call**
-  // (joshuafolkken/kit#2310), and the third that consults the world beside the call: "is this a lane
-  // child whose recent-context cost has crossed the threshold" reads the dispatch mark, the cut record
-  // on disk and the synchronous `pnpm josh cost --cut` verdict — the same measurement the parent
-  // hand-off uses, never a second one (joshuafolkken/kit#1933). The `Edit` / `Write` name match runs
-  // first, then the lane read, then the transcript-priced verdict, so a run that is not a dispatched
-  // child in an uncut lane pays nothing for it. It self-gates on the tool name, so it claims no `Bash`
-  // command any row above matches — the Bash `rules_claiming` invariant is untouched.
-  //
-  // **Listed before `rule-body`, the one row it can overlap.** Both trigger on an `Edit` / `Write`; a
-  // rule-document edit made in a lane child that is already over threshold trips both. The cut is the
-  // right thing to do first — end the process and drop the accumulated context — and on the reissue in
-  // the fresh, under-threshold process this row is silent and `rule-body` delivers, the "losing rule's
-  // delivery still correct one reissue later" reading any admissible overlap needs.
-  //
-  // **It carries `decide`, and the inversion of the pre-gate cut's reasoning is why** (joshuafolkken/kit#2385).
-  // `pre-gate-cut` and `lane-park` are once per run because taking the cut, or the park, *ends the
-  // process* — the one act is not a recurring one, and the five verdicts that leave a run holding it
-  // all need the one reissue to go through. This cut ends the process too, but its *trigger* does not:
-  // crossing the threshold mid-implementation is a recurring state that once-per-run silenced for the
-  // rest of a process the moment its first refusal landed — so a `busy` / `failed` / `unready` verdict,
-  // or an edit the model reissued unchanged, left the context to grow unwatched (joshuafolkken/kit#2382
-  // ran to 282,747 tokens with the cut never taken). `decide` re-asks on every over-threshold edit, and
-  // its `delivered_at_ms` lets an edit reissued right after a refusal through, so `busy` / `failed`
-  // cannot wedge the run edit after edit — the reissue path once-per-run gave for free, now made
-  // explicit. The fresh process after a successful cut reads its own transcript under threshold, so it
-  // is silent without needing a carried record to quiet it.
-  //
-  // **No `reaches`, because the occasion is live-only.** `pre-gate-cut` gives a `reaches` because both
-  // its halves leave a command-string trace (`run:cut --resume` at entry); this row's occasion —
-  // crossing the threshold mid-implementation — is the working directory, the cut record and the cost
-  // verdict, none of which a transcript records. `pnpm josh rule:value` therefore reads it as no runs
-  // rather than as 0% kept (`keeps` stays, so the compliance act is named for a future measurement
-  // redesign), the same honest-unmeasured stance the batching and investigation rows take for the same
-  // reason: a trigger no transcript can reconstruct. The row itself lives in `implementation-cut.ts`.
+  // Before `rule-body`, its one overlap: the cut is the right first act, and `rule-body` delivers on
+  // the reissue in the fresh process.
   implementation_cut.ROW,
-  // **The first row whose trigger is an `Edit` / `Write` rather than a shell call**
-  // (joshuafolkken/kit#2272). It delivers the residency questions at the edit that writes a rule into
-  // prose, and self-gates on the tool name and the file path, so it claims no `Bash` command any row
-  // above matches — the `rules_claiming` invariant over Bash fixtures is untouched. It carries no
-  // `decide`, so it is once per run and takes the batching stand-aside `is_first_delivery` gives every
-  // default row: the batching guard treats an `Edit` as a candidate, exactly as it treats an Issue
-  // read, so this row stands aside on a batched turn and delivers on the reissue.
   rule_body_guard.ROW,
-  // **The generic oracle-consulted rows, one per oracle that declared a firing point**
-  // (joshuafolkken/kit#2324). Each refuses the action the oracle governs when the run has not run that
-  // oracle's command first, stood down once it has. Listed last; the one firing point left
-  // (`pkg:scout` on a package add) claims a command no row above matches.
   ...oracle_consulted.ROWS
 ];
 var ALONE_IN_TURN = 1;
@@ -3511,7 +3402,6 @@ var delivered_rules = {
   FILING_CAP_REASON: filing_cap.FILING_CAP_REASON,
   GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
   ISSUE_COMMENTS_REASON: issue_comments.ISSUE_COMMENTS_REASON,
-  ISSUE_FOLD_REASON: issue_fold_rule.ISSUE_FOLD_REASON,
   LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,
   LANE_PARK_REASON: lane_park.LANE_PARK_REASON,
   MEASURED_RULES,
@@ -3523,8 +3413,6 @@ var delivered_rules = {
   SHELL_BODY_REASON: SHELL_BODY_REASON2,
   SWITCH_ENV_KEY,
   THIRD_PARTY_WRITE_REASON: third_party_write.THIRD_PARTY_WRITE_REASON,
-  WIP_CAP: wip_cap.WIP_CAP,
-  WIP_CAP_REASON: wip_cap.WIP_CAP_REASON,
   WORKTREE_MUTATION_REASON: worktree_guard.WORKTREE_MUTATION_REASON,
   delivery,
   delivery_path,
@@ -3539,17 +3427,23 @@ import { loadavg } from "node:os";
 // scripts/epic/epic-busy.ts
 var LISTING_LIMIT = 100;
 var PARKED_LABELS = /* @__PURE__ */ new Set([NEEDS_DECISION_LABEL, ALREADY_DONE_LABEL]);
-function format_holders(issues) {
-  return issues.map((issue) => `#${String(issue.number)} ${issue.title}`).join(", ");
+var NO_AGES = /* @__PURE__ */ new Map();
+function format_holder(issue, repo, ages) {
+  const cite = session_cite.issue(issue.number, issue.title, repo);
+  const age = ages.get(issue.number);
+  return age === void 0 ? cite : `${cite} (${age})`;
+}
+function format_holders(issues, repo, ages) {
+  return issues.map((issue) => format_holder(issue, repo, ages)).join(", ");
 }
 function occupied_lanes(read2) {
   return read2.kind === "busy" ? read2.issues.length : 0;
 }
-function occupancy_message(issues, repo, limit) {
-  return `${String(issues.length)} of ${String(limit)} lanes in use in ${repo}: ${format_holders(issues)}.`;
+function occupancy_message(issues, repo, limit, ages = NO_AGES) {
+  return `${String(issues.length)} of ${String(limit)} lanes in use in ${repo}: ${format_holders(issues, repo, ages)}.`;
 }
-function lanes_full_message(issues, repo, limit) {
-  return `${occupancy_message(issues, repo, limit)} No lane is free, so nothing is offered here. A lane is released when its child merges or is parked; if a label is stale, remove it and ask again, and \`JOSH_LANE_LIMIT\` is what raises the ceiling.`;
+function lanes_full_message(issues, repo, limit, ages = NO_AGES) {
+  return `${occupancy_message(issues, repo, limit, ages)} No lane is free, so nothing is offered here. A lane is released when its child merges or is parked; if a label is stale, remove it and ask again, and \`JOSH_LANE_LIMIT\` is what raises the ceiling.`;
 }
 function unreadable_message(repo) {
   return `Could not read the \`${IN_PROGRESS_LABEL}\` listing for ${repo}. That is not "nothing is running" \u2014 check \`gh auth status\` and ask again.`;
@@ -3561,8 +3455,8 @@ var BUSY_REASONS = {
   unreadable: unreadable_message,
   truncated: truncated_message
 };
-function busy_reason(read2, repo, limit) {
-  if (read2.kind === "busy") return lanes_full_message(read2.issues, repo, limit);
+function busy_reason(read2, repo, limit, ages = NO_AGES) {
+  if (read2.kind === "busy") return lanes_full_message(read2.issues, repo, limit, ages);
   if (read2.kind === "idle") return "";
   return BUSY_REASONS[read2.kind](repo);
 }
@@ -3792,7 +3686,7 @@ var issue_state_schema = z10.looseObject({
 });
 function parse_issue_state(json) {
   try {
-    const parsed = parse_json_object_safe(json, issue_state_schema);
+    const parsed = parse_json_object_or_undefined(json, issue_state_schema);
     if (parsed === void 0) return void 0;
     const labels = parsed.labels ?? [];
     return {
@@ -3835,7 +3729,7 @@ var DEFAULT_SILENT_MINUTES = 30;
 var DEFAULT_GAP_SECONDS = 5;
 var MS_PER_MINUTE3 = 6e4;
 var MS_PER_SECOND2 = 1e3;
-var OPEN_STATE2 = "OPEN";
+var OPEN_STATE = "OPEN";
 var STATE_FIELDS = "state,labels";
 var REASONS = {
   [ALIVE_VERDICT]: "The unit is still working: its output moved, or a process of the child is alive.",
@@ -3847,7 +3741,7 @@ var ALIVE_ADVICE = "Keep polling; do not touch the child.";
 var SETTLED_ADVICE = "Read the child with `pnpm josh issue:state <N>` and take the branch its state says.";
 var STOPPED_CLEAN_ADVICE = 'The unit ended \u2014 classify how before booking it. Run `pnpm josh run:merge <N> --output <path>` (add `--epic <E> --repo <owner/repo> --owner "$PPID"` for a named epic): it reads the child\'s exit record without waiting for the unit to return, re-dispatches a child that could not reach the API (counting the outage; a run of them trips the environment guard and stops the run), and parks an abandoned child with `needs-decision` against the consecutive-failure guard. The checkout is clean, so there is nothing to stash.';
 var STOPPED_DIRTY_ADVICE = 'Stash the half-finished work with `git stash push -u -m "backlogrun: stopped unit for #<N>"` and record it on the Issue, then classify how the unit ended with `pnpm josh run:merge <N> --output <path>` (add `--epic <E> --repo <owner/repo> --owner "$PPID"` for a named epic): it re-dispatches an API-outage child (counting the outage; a run of them trips the environment guard) and parks an abandoned child with `needs-decision` against the consecutive-failure guard, without waiting for the unit to return.';
-var UNDETERMINED_ADVICE = "Read the trace that failed and ask again. Where the process trace was never given, run the `pgrep` against the checkout the unit was given and pass `--process alive` or `--process none`. Two of these in a row is a fault in the check itself rather than a slow unit: stop polling and report it.";
+var UNDETERMINED_ADVICE = "Read the trace that failed and ask again. Where the process trace was given as `unknown`, leave `--process` out so the command reads it. Two of these in a row is a fault in the check itself rather than a slow unit: stop polling and report it.";
 function is_output_moving(traces) {
   return traces.is_output_frozen === false;
 }
@@ -3954,7 +3848,7 @@ async function read_child_settled(issue, repo) {
   if (json === void 0) return void 0;
   const state = issue_state.parse_issue_state(json);
   if (state === void 0) return void 0;
-  return state.state !== OPEN_STATE2 || carries_settled_label(state.labels);
+  return state.state !== OPEN_STATE || carries_settled_label(state.labels);
 }
 async function read_traces(request) {
   const [is_initial_child_settled, is_output_frozen, is_tree_dirty] = await Promise.all([
@@ -3979,7 +3873,7 @@ async function read_traces(request) {
   };
 }
 async function check(request) {
-  run_issue_number.require_issue_number(request.issue);
+  issue_number_shape.require_issue_number(request.issue);
   return decide5(await read_traces(request));
 }
 var run_liveness = {
@@ -3994,14 +3888,14 @@ var run_liveness = {
 
 // scripts/lane/lane-report.ts
 var NO_LANES2 = "No lanes are open.";
-var OPEN_STATE3 = "open";
+var OPEN_STATE2 = "open";
 var STRANDED_STATE = "stranded";
 var UNREADABLE_STATE = "unreadable";
 var UNKNOWN_VALUE = "-";
 var COLUMN_SEPARATOR = "  ";
 function lane_state(lane) {
   if (lane.is_stranded) return STRANDED_STATE;
-  return lane.seat === void 0 ? UNREADABLE_STATE : OPEN_STATE3;
+  return lane.seat === void 0 ? UNREADABLE_STATE : OPEN_STATE2;
 }
 function value_or_unknown(value) {
   return value === void 0 ? UNKNOWN_VALUE : String(value);
@@ -4041,11 +3935,11 @@ function describe_ports(lane) {
   return `seat ${String(lane.seat)}, dev ${value_or_unknown(lane.development_port)}, preview ${value_or_unknown(lane.preview_port)}`;
 }
 function describe_opened(lane) {
-  return `Opened a lane for #${lane.issue} on ${lane.branch}: ${describe_ports(lane)}.`;
+  return `Opened a lane for ${session_cite.issue(lane.issue)} on ${lane.branch}: ${describe_ports(lane)}.`;
 }
 var lane_report = {
   NO_LANES: NO_LANES2,
-  OPEN_STATE: OPEN_STATE3,
+  OPEN_STATE: OPEN_STATE2,
   STRANDED_STATE,
   UNREADABLE_STATE,
   describe_lane,
@@ -4076,7 +3970,7 @@ var CLEAN_ADVICE = "Start the child.";
 var RESUME_ADVICE = "Reuse the branch and run the whole verification gate from the start \u2014 refactor, `pnpm josh gate`, `/code-review` \u2014 never only the part the interrupted run had not reached. Nobody verified what it already committed.";
 var PARK_ADVICE = "Park the child: add `needs-decision` and comment what was found. Do not delete the branch, do not reopen the pull request, and do not commit on top of it.";
 var STASH_LABEL_PREFIX = "run:hold reclaimed before #";
-var { require_issue_number } = run_issue_number;
+var { require_issue_number } = issue_number_shape;
 var UNREADABLE_PR_MESSAGE = "The pull request could not be read for branch ";
 function needs_reclaim(tree) {
   return tree.is_dirty || tree.branch !== tree.default_branch;
@@ -4118,13 +4012,13 @@ function reclaim_steps(tree, issue) {
   if (!tree.is_dirty) return [];
   return [
     `git stash push -u -m "${STASH_LABEL_PREFIX}${issue}"`,
-    `Record the stash on #${issue} \u2014 the comment is what gets it popped; nothing pops it for you.`
+    `Record the stash on ${session_cite.issue(issue)} \u2014 the comment is what gets it popped; nothing pops it for you.`
   ];
 }
 function reclaim_advice(tree, issue) {
   return [
     ...reclaim_steps(tree, issue),
-    `git switch ${tree.default_branch} && git pull`,
+    "pnpm josh ms",
     "Then ask this command again: it is re-askable, and the clean tree gets its own answer."
   ].join("\n");
 }
@@ -4143,11 +4037,7 @@ function decide6(tree, child, issue) {
   };
 }
 function read_pr_field(raw) {
-  try {
-    return pr_info_schema.parse(JSON.parse(raw)).state;
-  } catch {
-    return void 0;
-  }
+  return json_value.parse_with(raw, pr_info_schema)?.state;
 }
 function to_pr_state(raw) {
   const state = read_pr_field(raw);
@@ -4372,12 +4262,7 @@ var SWITCH_ENV_KEY2 = "JOSH_WATCHER_GUARD";
 var STAMP_PREFIX2 = "josh-watcher-guard-";
 var payload_schema = z12.object({ transcript_path: z12.string().min(1) });
 function transcript_of(raw_payload) {
-  try {
-    const parsed = payload_schema.safeParse(JSON.parse(raw_payload));
-    return parsed.success ? parsed.data.transcript_path : void 0;
-  } catch {
-    return void 0;
-  }
+  return json_value.parse_with(raw_payload, payload_schema)?.transcript_path;
 }
 function fires_once(transcript, now_ms) {
   const stamp = hook_decision.create_refusal_stamp(STAMP_PREFIX2);
@@ -4415,7 +4300,7 @@ var THRESHOLD_TEXT2 = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token
 var PARENT_CUT_REASON = `\u26D4 backlogrun parent hand-off: this session drives a \`backlogrun\` (it owns the live carry record) and its recent-context cost has crossed the shared ${THRESHOLD_TEXT2} threshold between merges, so every later request re-reads the accumulated context (joshuafolkken/kit#2947). Take the hand-off now rather than at the next merge: follow \`.claude/skills/workflow-commands/backlogrun-progress.md\` \u2192 "The hand-off" from its \`over\` branch \u2014 open no new lane and take no new child, read \`pnpm josh lane:list\`, make sure every lane in flight records an output path, then run \`pnpm josh run:carry --cut --owner "$PPID"\` and, unless it answers \`capped\`, \`pnpm josh run:wake\`, post the progress comment and end the turn. A lane nobody can poll means the cut does not happen; carry on and this asks again later. Reissue this call when the hand-off is done or cannot be taken \u2014 the guard stays quiet for a while after it refuses, so the hand-off calls themselves are not refused.`;
 async function is_due2(state) {
   const carry = await state.carry();
-  if (carry === void 0 || run_carry.is_at_cut_cap(carry)) return false;
+  if (carry === void 0 || run_headless.is_cut_capped(carry)) return false;
   return state.verdict() === cost_verdict.OVER_VERDICT;
 }
 function is_quiet(target, now_ms) {
@@ -4522,6 +4407,9 @@ function guard_outcome(raw_payload) {
 function pretool_outcome(raw_payload) {
   return with_step_zero_notice(guard_outcome(raw_payload), raw_payload);
 }
+async function mark_phase(outcome) {
+  if (outcome.notice === step_zero_notice.NOTICE) await lane_phase.mark_implement();
+}
 async function async_reason(raw_payload) {
   const watcher = await run_watcher_hook.watcher_hook_reason(raw_payload);
   return watcher ?? await run_parent_cut_hook.parent_cut_reason(raw_payload);
@@ -4531,7 +4419,9 @@ async function pretool_outcome_async(raw_payload) {
   if (!is_clear(base)) return base;
   const reason = await async_reason(raw_payload);
   if (reason !== void 0) return { reason, notice: void 0, fault: void 0 };
-  return with_step_zero_notice(base, raw_payload);
+  const outcome = with_step_zero_notice(base, raw_payload);
+  await mark_phase(outcome);
+  return outcome;
 }
 function guarded_call(raw_payload) {
   try {
@@ -4541,23 +4431,55 @@ function guarded_call(raw_payload) {
     return void 0;
   }
 }
+function rewrite_context(note, outcome) {
+  return [note, outcome.notice ?? outcome.fault].filter(Boolean).join("\n\n");
+}
 function foreground_rewrite(outcome, raw_payload, is_lane_child) {
   if (outcome.reason !== void 0) return void 0;
   const call = guarded_call(raw_payload);
   const input = call === void 0 ? void 0 : lane_background.foreground_input(call, is_lane_child);
   if (input === void 0) return void 0;
-  const context = [lane_background.FOREGROUND_NOTE, outcome.notice ?? outcome.fault];
-  return hook_decision.rewrite_envelope(input, context.filter(Boolean).join("\n\n"));
+  return hook_decision.rewrite_envelope(
+    input,
+    rewrite_context(lane_background.FOREGROUND_NOTE, outcome)
+  );
 }
-function emit(raw_payload, outcome) {
-  const rewrite = foreground_rewrite(outcome, raw_payload);
+function pipefail_rewrite(raw_payload) {
+  if (!delivered_rules.is_enabled()) return void 0;
+  const call = guarded_call(raw_payload);
+  const input = call === void 0 ? void 0 : piped_verification.pipefail_input(call);
+  const payload = json_value.parse_or_undefined(raw_payload);
+  if (input === void 0 || !json_value.is_record(payload)) return void 0;
+  return { payload: JSON.stringify({ ...payload, tool_input: input }), input };
+}
+function pipefail_envelope(outcome, input) {
+  if (input === void 0 || outcome.reason !== void 0) return void 0;
+  return hook_decision.rewrite_envelope(
+    input,
+    rewrite_context(piped_verification.PIPEFAIL_NOTE, outcome)
+  );
+}
+function emit(raw_payload, outcome, pipefail_input2) {
+  const rewrite = pipefail_envelope(outcome, pipefail_input2) ?? foreground_rewrite(outcome, raw_payload);
   if (rewrite === void 0) hook_decision.emit_outcome(outcome);
   else process.stdout.write(`${rewrite}
 `);
 }
-var pretool_guard = { combine_outcomes, emit, foreground_rewrite, pretool_outcome };
+async function respond(raw_payload) {
+  const pipefail = pipefail_rewrite(raw_payload);
+  const judged = pipefail?.payload ?? raw_payload;
+  emit(judged, await pretool_outcome_async(judged), pipefail?.input);
+}
+var pretool_guard = {
+  combine_outcomes,
+  emit,
+  foreground_rewrite,
+  mark_phase,
+  pipefail_rewrite,
+  pretool_outcome,
+  respond
+};
 
 export {
-  pretool_outcome_async,
   pretool_guard
 };