@joshuafolkken/kit 1.1240.0 → 1.1373.0

package/scripts/rules/destructive-command.ts

@@ -3,8 +3,8 @@ import { gh_api } from './gh-api'
 import { git_argv } from './git-argv'
 import { shell_segments } from './shell-segments'
 
-// The trigger and the delivered text behind the `destructive-command` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2983): a recursive forced `rm`, and the `gh` calls that delete or close shared
+// The trigger and the delivered text behind the `destructive-command` row of `delivered-rules.ts`:
+// a recursive forced `rm`, and the `gh` calls that delete or close shared
 // state — none of which the deny list stopped, or stopped only in one spelling (`Bash(rm -rf *)`
 // misses `rm -fr`, `rm -r -f` and `rm --recursive --force`). The argv is read through `git-argv.ts`'s
 // wrapper cut, so `sudo rm -fr` and `env gh pr close` are seen too.

package/scripts/rules/direct-filing.ts

@@ -1,11 +1,11 @@
 import { bash_triggers } from './bash-triggers'
 
-// The `direct-filing` row of `delivered-rules.ts` (joshuafolkken/kit#2808). Filing an Issue owes a
+// The `direct-filing` row of `delivered-rules.ts`. Filing an Issue owes a
 // duplicate scout, a body lint, the classification / depth / `route:` labels, a `## Origin` on a
 // cross-repository filing and an `epic:bundle` afterwards — steps spread over as many documents, each
-// with its own guard, and joshuafolkken/kit#2805 ran two of them and skipped the rest. `josh issue:file`
-// runs them all in one command, so a hand-built `gh api …/issues` / `gh issue create` filing is refused
-// outright and pointed there; the step-by-step guards that used to sit on the direct call went with it.
+// with its own guard, so a run can take some and skip the rest. `josh issue:file` runs them all in one
+// command, so a hand-built `gh api …/issues` / `gh issue create` filing is refused outright and
+// pointed there.
 
 const DIRECT_FILING_REASON =
 	'⛔ direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> ' +

package/scripts/rules/direct-pr-create.ts

@@ -3,8 +3,8 @@ import { gh_api } from './gh-api'
 import { git_argv } from './git-argv'
 import { shell_segments } from './shell-segments'
 
-// The trigger and the delivered text behind the `direct-pr-create` row of `delivered-rules.ts`
-// (joshuafolkken/kit#3183). A PR opened outside `pnpm josh pr` skips `build_body`, which writes the
+// The trigger and the delivered text behind the `direct-pr-create` row of `delivered-rules.ts`.
+// A PR opened outside `pnpm josh pr` skips `build_body`, which writes the
 // `closes #N` line — so the Issue stays open after the merge. `CLAUDE.md` forbade the call in prose
 // only; this row reads the argv instead, through `git-argv.ts`'s wrapper cut, so `env gh pr create`
 // is seen too. `pnpm josh pr` itself is never claimed: its first word after the wrapper is `pnpm`,

package/scripts/rules/early-heartbeat.ts

@@ -6,20 +6,17 @@ import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { time_shell } from '#scripts/time-runtime/time-shell'
 import { shell_segments } from './shell-segments'
 
-// The trigger and the decision behind the `early-heartbeat` row of `delivered-rules.ts`
-// (joshuafolkken/kit#1570).
+// The trigger and the decision behind the `early-heartbeat` row of `delivered-rules.ts`.
 //
-// **The promise was kept and the interval was not.** `josh run:progress --mark` was called at every
-// real report exactly as `backlogrun.md` requires, and reports still arrived 3–5 minutes apart on a
-// 15-minute setting. The clock was never the problem: the parent armed a wait timer of its own on the
-// turn a timer fired **and** on the turn a delegated child's completion woke it, so two timers ran at
-// once and each produced a report the other knew nothing about. Nothing read the marked clock before
-// writing — `run:progress` refuses its own early lines, and there was no such refusal in front of the
-// parent's own prose.
+// **A second wait timer breaks the interval.** A parent that arms a wait timer of its own on the turn
+// a timer fires **and** on the turn a delegated child's completion wakes it runs two timers at once,
+// each producing a report the other knows nothing about — reports arrive minutes apart whatever the
+// setting. `run:progress` refuses its own early lines, but nothing refuses an early report written in
+// the parent's own prose.
 //
 // **So the refusal is put in front of the arm, not in front of the report.** A report is written in
 // prose and no hook can see it coming; the `Bash` call that sleeps is a call, and a call can be
-// refused — the same reading joshuafolkken/kit#1556 took for a verification behind a pipe.
+// refused — the same reading `piped-verification.ts` takes for a verification behind a pipe.
 //
 // **An explicit ask is not a heartbeat, and it is exempt by construction rather than by exception.**
 // What is refused here is arming a *timer*; a person asking "how is it going" arrives as a turn with
@@ -145,7 +142,7 @@ function landing_ms(command: string, now_ms: number, last_report_ms: number): nu
  *
  * **No progress record means no clock, and no clock means no rule.** An ordinary conversational
  * session never starts the watcher and never marks, so it reads `undefined` here and nothing is
- * refused — the scope joshuafolkken/kit#1570 set out of bounds, held by the absence of a record rather
+ * refused — out of the rule's scope, held by the absence of a record rather
  * than by a second judgement about what kind of session this is.
  *
  * **A live timer is counted from the record this function writes, never from the processes on the
@@ -181,8 +178,8 @@ function decide(call: GuardedCall, run: GuardRun, can_record: boolean): boolean
 }
 
 // The instruction in the shape a refusal can carry: what the call is about to do, what already does it
-// properly, and the one command an explicit ask is answered with. The measurement is named because it
-// is the half that makes the rule believable — the promise was kept and the interval was not.
+// properly, and the one command an explicit ask is answered with. The observed failure is named
+// because it is what makes the rule believable.
 const EARLY_HEARTBEAT_REASON =
 	'⛔ early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours ' +
 	'to keep. `pnpm josh run:progress --wait` keeps it for you ' +
@@ -194,8 +191,8 @@ const EARLY_HEARTBEAT_REASON =
 	'(joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a ' +
 	"child's completion woke the run, and `--mark` recorded each report without anything refusing the " +
 	'early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run ' +
-	'`pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says. ' +
-	'If you are ' +
+	'`pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says — ' +
+	'under `backlogrun`, `pnpm josh run:board --chat` instead. If you are ' +
 	'waiting on something rather than on a clock, wait on the thing itself — `pnpm josh followup` ' +
 	'waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` → "Progress while ' +
 	'the run is quiet". **This rule fires on every early arm, not once per run**, so reissuing the ' +
@@ -205,8 +202,7 @@ const EARLY_HEARTBEAT_REASON =
 // the interval out, and `--once` answers an explicit ask. `--mark` is neither: it records a report
 // that has already gone out rather than waiting for the next one, and crediting it would score every
 // run that reported at all as having kept a rule about waiting.
-// The canonical name; both spellings match, because the alias is expanded where the command is read
-// (joshuafolkken/kit#1789).
+// The canonical name; both spellings match, because the alias is expanded where the command is read.
 const PROGRESS_NAMES: ReadonlySet<string> = new Set(['run:progress'])
 const WATCH_FLAG = /(?:^|\s)--(?:wait|once)(?=\s|$)/u
 
@@ -222,8 +218,8 @@ function is_progress_watch(command: string): boolean {
 	)
 }
 
-// **The occasion this rule governs: waiting for the run's next progress report**, in either spelling
-// (joshuafolkken/kit#1643). The trigger fires only on the hand-armed timer, so a run that always let
+// **The occasion this rule governs: waiting for the run's next progress report**, in either spelling.
+// The trigger fires only on the hand-armed timer, so a run that always let
 // the watcher wait would never appear in the reading at all.
 function waits_for_progress(command: string): boolean {
 	return is_wait_timer(command) || is_progress_watch(command)

package/scripts/rules/file-body.ts

@@ -3,10 +3,9 @@ import { time_shell } from '#scripts/time-runtime/time-shell'
 import { bash_triggers } from './bash-triggers'
 import { shell_segments } from './shell-segments'
 
-// The trigger and the delivered text behind the `file-body` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2120). Group 3 of the three Bash-string gaps: a file's new body carried inline in
-// a shell command, the form `CLAUDE.md` → "Never carry a file's new text inside a shell command" and
-// `file-edits.md` forbid.
+// The trigger and the delivered text behind the `file-body` row of `delivered-rules.ts`.
+// Group 3 of the three Bash-string gaps: a file's new body carried inline in
+// a shell command, the form `prompts/collaboration-workflow/file-edits.md` forbids.
 //
 // **The detector existed for measurement and refused nothing.** `time-writes.ts` already knew a
 // redirection and a heredoc write a file; nothing turned that knowledge into a refusal. This row does,
@@ -39,7 +38,7 @@ function has_heredoc(command: string): boolean {
 // The lines the shell reads as commands — every physical line outside a heredoc body — each paired with
 // the heredoc body it opened. A command, its redirect and its heredoc marker share one of these; the body
 // follows up to the delimiter line. Reading only the first physical line missed the interpreter a run
-// opened after a `cd <lane>` line (joshuafolkken/kit#3155), so every command line is read, a body line is
+// opened after a `cd <lane>` line, so every command line is read, a body line is
 // never mistaken for one, and a write is judged only in the body its own command opened.
 interface CommandLine {
 	text: string
@@ -118,7 +117,7 @@ function body_writes(body: string): boolean {
 
 // A script file for one of the body interpreters. Creating one is a new-file creation, but a script
 // whose body writes is the interpreter rewrite moved one call later — `cat > edit.py <<EOF` then
-// `python3 edit.py` carries the same replacement text (joshuafolkken/kit#3155).
+// `python3 edit.py` carries the same replacement text.
 const SCRIPT_FILE = /\.(?:py|rb|pl|php|js|mjs|cjs)$/u
 
 // Shapes 1 and 4: a heredoc write whose target already exists, or whose target is a script that writes.

package/scripts/rules/filing-cap.ts

@@ -5,8 +5,7 @@ import { time_transcript_line, type Block } from '#scripts/time-runtime/time-tra
 import { bash_triggers } from './bash-triggers'
 import { tail_commands } from './tail-commands'
 
-// The trigger and the decision behind the `filing-cap` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2119).
+// The trigger and the decision behind the `filing-cap` row of `delivered-rules.ts`.
 //
 // **Automatic filing is capped at 10 Issues per run, refused at the eleventh filing.** `prerequisite.md` and
 // `observation-filing.md` state the ceiling; nothing counted it, so a run that over-filed was held
@@ -15,13 +14,13 @@ import { tail_commands } from './tail-commands'
 // `bash_triggers.is_issue_filing`, reused verbatim.
 //
 // **It fires on every filing past the cap, not once per run.** The subject is a recurring act — one
-// more filing — so `DeliveredRule.decide` is the right disposition (joshuafolkken/kit#1570): refused
+// more filing — so `DeliveredRule.decide` is the right disposition: refused
 // once and free afterwards would put the enforcement back on the self-restraint that failed.
 //
 // **A guard-refused filing does not count.** Claude Code writes a denied call to the transcript as a
 // `tool_use` block with an errored `tool_result`, so the WIP cap's own reissue would otherwise
-// double-count one Issue — the same exclusion `investigation-reads.ts` makes for a refused read
-// (joshuafolkken/kit#1764). **Nor does one `issue:file` held itself** (joshuafolkken/kit#2808): a lint
+// double-count one Issue — the same exclusion `investigation-reads.ts` makes for a refused read.
+// **Nor does one `issue:file` held itself**: a lint
 // problem or an unacknowledged duplicate exits non-zero having filed nothing, and the reissue is the
 // same Issue. The filing is counted only where its result did not fail.
 
@@ -82,8 +81,8 @@ function is_prompt_line(line: string): boolean {
 	return parsed.blocks.every((block) => block.result_id === '')
 }
 
-// The tail from the last prompt on, so a filing an earlier turn made does not answer for this one
-// (joshuafolkken/kit#2422). A tail with no prompt on it is returned whole.
+// The tail from the last prompt on, so a filing an earlier turn made does not answer for this one.
+// A tail with no prompt on it is returned whole.
 function current_turn(tail: string): string {
 	const lines = tail.split('\n')
 	const start = lines.findLastIndex((line) => is_prompt_line(line))

package/scripts/rules/filing-offer.ts

@@ -1,7 +1,7 @@
 import { repo_party } from '#scripts/discovery/repo-party'
 import { issue_citation } from './issue-citation'
 
-// The predicates behind the `filing-offer` row of the stop guard (joshuafolkken/kit#2422).
+// The predicates behind the `filing-offer` row of the stop guard.
 //
 // **A first-party filing is Tier A, and an offer to file is that filing deferred to the user.**
 // `observation-filing.md` says a run that judges something worth filing files it without asking, yet a reply

package/scripts/rules/firing-point.ts

@@ -1,14 +1,14 @@
 // A behavior-change Issue names its **firing point** — the tool call first invoked at the moment
 // the rule it changes would break (`prompts/collaboration-workflow/issue-template.md`). This
-// classifies that name against the rule-delivery table (joshuafolkken/kit#2212).
+// classifies that name against the delivered-rule list.
 //
-// **Why the name matters.** joshuafolkken/kit#2201 placed a correct rule whose named tool call was
-// one call behind the one that actually broke it: the lane child's turn ended at `AskUserQuestion`,
-// which the guard never saw. A rule delivered by a hook can only fire on a tool the hook is wired to;
+// **Why the name matters.** A correct rule whose named tool call is one call behind the one that
+// actually breaks it never fires — a lane child's turn that ends at `AskUserQuestion` is a call the
+// guard never sees. A rule delivered by a hook can only fire on a tool the hook is wired to;
 // a firing point naming a tool outside that set is a rule no hook can enforce, and saying so at filing
 // time is the whole point of the check.
 
-// **The hook-deliverable set — the single source is `rule-delivery.md`'s delivery table.** The
+// **The hook-deliverable set — the single source is the list `pnpm josh rule:list` renders.** The
 // `PreToolUse` guard is wired to `Bash|Edit|Read|Write` (`scripts/hooks/pretool-guard.ts`), and the
 // lane-child interactive-ask row triggers on `AskUserQuestion`. A firing point naming one of these can
 // be delivered at the moment it binds; anything else cannot.
@@ -22,7 +22,7 @@ const HOOK_DELIVERABLE_TOOLS: ReadonlyArray<string> = [
 
 // **Known Claude Code tool calls that a hook cannot deliver a rule on.** They are real tools, so a
 // firing point naming one is not a typo — it is a rule whose enforcement stays with the parent's
-// self-restraint, the thing that failed in joshuafolkken/kit#2201. Kept apart from
+// self-restraint. Kept apart from
 // `HOOK_DELIVERABLE_TOOLS` so `not-delivered` (a real but undeliverable tool) reads differently from
 // `unknown` (not a tool call name at all).
 const KNOWN_UNDELIVERABLE_TOOLS: ReadonlyArray<string> = [

package/scripts/rules/gh-api.ts

@@ -1,5 +1,5 @@
 // The one reading of a `gh api` segment shared by the rows of `delivered-rules.ts` that judge such a
-// call by its spelling (joshuafolkken/kit#2122): the issue-body-read guard classifies read vs write,
+// call by its spelling: the issue-body-read guard classifies read vs write,
 // and the third-party-write guard needs the same classification plus the target `owner/repo`. Two
 // copies of the flag regexes would be the clone `CLAUDE.md` prohibits, and the copy that forgot `-F`
 // or `--raw-field` would be the one that let a write through.
@@ -31,7 +31,7 @@ const OWNER_GROUP = 1
 const REPO_GROUP = 2
 
 // The placeholders `gh api` expands to its base repository's owner before it sends the request
-// (joshuafolkken/kit#3188) — `{owner}`, and the legacy `:owner` it still accepts. Which owner that is
+//  — `{owner}`, and the legacy `:owner` it still accepts. Which owner that is
 // depends on the checkout's remotes, so the caller resolves it rather than this parser.
 const OWNER_PLACEHOLDERS: ReadonlySet<string> = new Set(['{owner}', ':owner'])
 

package/scripts/rules/git-argv.ts

@@ -1,5 +1,5 @@
 // The one reading of a shell segment as a `git` invocation, shared by the two Bash-string rows that
-// judge a git command by its spelling (joshuafolkken/kit#2120): `git-force.ts` refuses a force push or
+// judge a git command by its spelling: `git-force.ts` refuses a force push or
 // a branch delete, and `worktree-guard.ts` refuses an unauthorized working-tree change. Both have to
 // skip the same wrapper and the same git global options before the subcommand is even in hand, so the
 // cut lives here rather than beside whichever row needed it first — two copies of it would be the clone
@@ -14,7 +14,7 @@
 // The wrapper words that may stand in front of `git`, the same ones `run-tail-rule.ts` skips in front of
 // `josh`: environment assignments, the package-manager launchers, `sudo`, `env`, and an opening
 // subshell parenthesis. Left in, `sudo git push --force`, `env git commit` and `(git push -f)` are
-// silently not a git command (joshuafolkken/kit#2983).
+// silently not a git command.
 const ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u
 const WRAPPER_WORDS: ReadonlySet<string> = new Set([
 	'pnpm',
@@ -95,7 +95,7 @@ function after_globals(words: ReadonlyArray<string>, start: number): number {
 }
 
 // The words after `command` once the wrapper is skipped, or `undefined` when the segment does not
-// invoke it. `gh` and `rm` are judged by the same wrapper cut as `git` (joshuafolkken/kit#2983), so
+// invoke it. `gh` and `rm` are judged by the same wrapper cut as `git`, so
 // `env gh pr close` and `sudo rm -rf` are read as the calls they are.
 function arguments_of(segment: string, command: string): Array<string> | undefined {
 	const words = words_of(segment)

package/scripts/rules/git-force.ts

@@ -2,8 +2,8 @@ import { bash_triggers } from './bash-triggers'
 import { git_argv } from './git-argv'
 import { shell_segments } from './shell-segments'
 
-// The trigger and the delivered text behind the `git-force` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2120). Group 1 of the three Bash-string gaps: a force push or a branch delete
+// The trigger and the delivered text behind the `git-force` row of `delivered-rules.ts`.
+// Group 1 of the three Bash-string gaps: a force push or a branch delete
 // spelled in a way the `deny` glob cannot express.
 //
 // **The deny list stops the spellings a glob can reach and no others.** `Bash(git push *--force*)` and

package/scripts/rules/hook-context-line.ts

@@ -0,0 +1,31 @@
+import { json_value } from '#scripts/lib/json-value'
+
+// The context a `PreToolUse` hook attached to a call, read off one transcript line.
+// The harness writes a hook's `additionalContext` as an `attachment` line of
+// this type, which is the only trace a rewritten call leaves: the call itself is recorded as it was
+// typed, and no refusal comes back for it. `rule-value.ts` reads a rewrite's note from here so the
+// rewrite is counted as the delivery it is.
+const HOOK_CONTEXT_TYPE = 'hook_additional_context'
+
+function strings_of(value: unknown): Array<string> {
+	if (!Array.isArray(value)) return []
+
+	return value.filter((one): one is string => typeof one === 'string')
+}
+
+// The substring test first, so the ordinary line is never parsed twice — `rule-value.ts` has already
+// parsed every line once through `time_transcript_line`.
+function hook_contexts_of(line: string): Array<string> {
+	if (!line.includes(HOOK_CONTEXT_TYPE)) return []
+
+	const parsed = json_value.parse_or_undefined(line)
+	const attachment = json_value.is_record(parsed) ? parsed['attachment'] : undefined
+
+	if (!json_value.is_record(attachment) || attachment['type'] !== HOOK_CONTEXT_TYPE) return []
+
+	return strings_of(attachment['content'])
+}
+
+const hook_context_line = { HOOK_CONTEXT_TYPE, hook_contexts_of }
+
+export { hook_context_line }

package/scripts/rules/implementation-cut-verdict.ts

@@ -1,9 +1,9 @@
 import type { CostVerdict } from '#scripts/cost-runtime/cost-cli'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 
-// A short reuse window over the transcript-priced verdict `implementation-cut.ts` reads
-// (joshuafolkken/kit#2385).
+// A short reuse window over the transcript-priced verdict `implementation-cut.ts` reads.
 //
 // **The read is a whole-transcript price and its caller is asked of every edit.**
 // `is_over_threshold_edit` reads `cost_cli.session_verdict` — which loads and parses the session
@@ -46,13 +46,10 @@ function cached_verdict(target: string, now_ms: number): CostVerdict | undefined
 
 	if (raw === undefined) return undefined
 
-	try {
-		const { read_at_ms, verdict } = cache_schema.parse(JSON.parse(raw))
+	const cached = json_value.parse_with(raw, cache_schema)
+	if (cached === undefined) return undefined
 
-		return now_ms - read_at_ms < VERDICT_REUSE_MS ? verdict : undefined
-	} catch {
-		return undefined
-	}
+	return now_ms - cached.read_at_ms < VERDICT_REUSE_MS ? cached.verdict : undefined
 }
 
 // The verdict, read through the window: the stored value inside it, a fresh `read()` past it. The

package/scripts/rules/implementation-cut.ts

@@ -1,3 +1,4 @@
+import { agent_session_role } from '#scripts/agent/agent-session-role'
 import { CONTEXT_CUT_THRESHOLD } from '#scripts/cost-runtime/context-cut-threshold'
 import { cost_cli, type CostVerdict } from '#scripts/cost-runtime/cost-cli'
 import { cost_format } from '#scripts/cost-runtime/cost-format'
@@ -12,23 +13,16 @@ import { bash_triggers } from './bash-triggers'
 import { implementation_cut_verdict } from './implementation-cut-verdict'
 import { shell_segments } from './shell-segments'
 
-// The implementation-phase cut, delivered at the call it binds on (joshuafolkken/kit#2310).
+// The implementation-phase cut, delivered at the call it binds on.
 //
-// **The mechanism was there and the verdict was taken at the wrong time.** joshuafolkken/kit#1933
-// built the second cut boundary — a lane child ends its process *during* implementation once its
-// recent-context cost crosses the shared threshold, and a fresh one resumes back into implementation —
-// and left the child to run `pnpm josh cost --cut` at each working-tree boundary itself. It never did.
-// The five lanes joshuafolkken/kit#2310 measured (#2304 #2294 #2297 #2296 #2298) each read the verdict
-// exactly once, at session entry where the context has not yet grown — so the check answered `under`
-// by construction and the cut fired 0 times while 33.9% of their requests ran past 200,000 tokens.
-//
-// **This is the same lesson pre-gate-cut.ts records, one boundary earlier.** joshuafolkken/kit#1864
-// measured the pre-gate cut taken 0 times while it was carried as prose, and a `PreToolUse` refusal is
-// what took it. joshuafolkken/kit#1933 had reasoned the implementation cut *could not* be a guard,
-// because the per-request cost was read asynchronously; but `cost_cli.session_verdict` is synchronous
-// and is the very verdict `pnpm josh cost --cut` prints, so the guard reads it directly rather than
-// approximating it — the same statistic and the same threshold, never the second measurement #1933
-// forbids.
+// **The verdict is read at the working-tree boundary, not at the entry.** A lane child ends its
+// process *during* implementation once its recent-context cost crosses the shared threshold, and a
+// fresh one resumes back into implementation. Read only at session entry, where the context has not
+// yet grown, the verdict answers `under` by construction; so the guard reads it at each edit, the
+// same way `pre-gate-cut.ts` binds the boundary one step later. `cost_cli.session_verdict` is
+// synchronous and is the very verdict `pnpm josh cost --cut` prints, so the guard reads it directly
+// rather than approximating it — the same statistic and the same threshold, never a second
+// measurement.
 
 // The two edit tools the `PreToolUse` matcher routes here, and the working-tree boundary the cut is
 // taken at. A `PreToolUse` refusal fires *before* the edit lands, so the tree is at the consistent
@@ -59,12 +53,12 @@ function takes_the_impl_cut(command: string): boolean {
 // What the trigger has to know about the world, passed in so the decision is testable without a lane on
 // disk, a cut record, or a session transcript. `verdict` is the synchronous `pnpm josh cost --cut`
 // reading — the same per-request billed-input statistic against the same threshold — so the guard
-// prices its cut on exactly what the parent hand-off does (joshuafolkken/kit#1933).
+// prices its cut on exactly what the parent hand-off does.
 interface LaneCostState {
 	directory: string
 	source: MarkerSource
 	carried: (now?: Date) => RunCut | undefined
-	// The issue whose run hold stands over this checkout (joshuafolkken/kit#2760) — how a `fullrun`
+	// The issue whose run hold stands over this checkout — how a `fullrun`
 	// held outside a lane is told apart from a person's tree.
 	held_issue: () => string | undefined
 	verdict: () => CostVerdict
@@ -76,7 +70,7 @@ function current_state(): LaneCostState {
 		source: process.env,
 		carried: run_cut.carried_cut_sync,
 		held_issue: run_cut.held_issue_sync,
-		// **Read through the short reuse window** (joshuafolkken/kit#2385). The row now fires per
+		// **Read through the short reuse window**. The row now fires per
 		// threshold crossing rather than once per run, so this predicate is a candidate on every edit;
 		// the window collapses one turn's burst of edits to a single whole-transcript price.
 		verdict: (): CostVerdict =>
@@ -85,7 +79,7 @@ function current_state(): LaneCostState {
 }
 
 // A dispatched lane child's issue for this checkout. The dispatch mark is what tells a child apart from
-// a person (joshuafolkken/kit#1904), read from the environment against this lane's own issue so a
+// a person, read from the environment against this lane's own issue so a
 // leaked mark for another issue reads as a person.
 function lane_child_issue(state: LaneCostState): string | undefined {
 	if (!lane_child_marker.is_child_of(state.directory, state.source)) return undefined
@@ -101,15 +95,25 @@ function held_run_issue(state: LaneCostState): string | undefined {
 	return state.held_issue()
 }
 
+// **A ship reviewer is not the run, though it carries its mark and its hold**
+// (joshuafolkken/kit#3623). The supervisor launches it in the implementing child's own checkout and
+// waits on it, so a cut would end the one session whose findings file the supervisor reads and relaunch
+// a second child beside the supervisor's repair. `agent_session_role` is what tells the two apart.
+function implementing_run_issue(state: LaneCostState): string | undefined {
+	if (agent_session_role.is_reviewer(state.source)) return undefined
+
+	return lane_child_issue(state) ?? held_run_issue(state)
+}
+
 // The run this checkout's edits belong to, with no cut already carried — a dispatched lane child, or
-// **a `fullrun` held in its own checkout** (joshuafolkken/kit#2760): the cut was lane-only, so a run a
+// **a `fullrun` held in its own checkout**: the cut was lane-only, so a run a
 // person started grew without a bound mid-implementation. The run hold naming an issue is what marks
 // such a run, and a person's tree holds nothing, so it still sees no refusal. **The carried-cut half
 // keeps the guard silent between a cut and its resume**, exactly as `pre-gate-cut.ts`'s does: a record
 // naming this issue means a cut is already in flight, and `begin_cut`'s exclusive create would refuse
 // a second one anyway.
 function uncut_run_issue(state: LaneCostState): string | undefined {
-	const issue = lane_child_issue(state) ?? held_run_issue(state)
+	const issue = implementing_run_issue(state)
 
 	if (issue === undefined) return undefined
 
@@ -133,7 +137,7 @@ function warrants_the_cut(state: LaneCostState): boolean {
 // a dispatched child makes in an uncut lane — where crossing the threshold is exactly the event this
 // guard exists to catch.
 //
-// **The unmeasurable direction matches the pre-gate cut** (joshuafolkken/kit#2385). A session that
+// **The unmeasurable direction matches the pre-gate cut**. A session that
 // cannot be priced reads as warranting the cut, the same safety-net direction `pre-gate-cut.ts`'s
 // `warrants_the_cut` takes (`verdict !== UNDER_VERDICT`): the two rules read one statistic against one
 // threshold, so they must not disagree about whether an unmeasurable session is due a cut.
@@ -146,10 +150,9 @@ function is_over_threshold_edit(
 	return warrants_the_cut(state)
 }
 
-// **The threshold in the refusal text is assembled from the constant, never spelled** (joshuafolkken/kit#2385).
-// joshuafolkken/kit#2374 lowered the shared threshold and the literal `200,000` stayed behind in this
-// text, telling agents the wrong number; building it from `CONTEXT_CUT_THRESHOLD` is what keeps the two
-// from ever drifting again. `cost_format.format_tokens` renders it the way every cost report does.
+// **The threshold in the refusal text is assembled from the constant, never spelled**.
+// A spelled literal is left behind when the shared threshold moves, telling agents the wrong number;
+// building it from `CONTEXT_CUT_THRESHOLD` keeps the two from drifting. `cost_format.format_tokens` renders it the way every cost report does.
 const THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`
 
 // The instruction in the shape a refusal can carry: what the cut is for, what each verdict means, and
@@ -161,7 +164,7 @@ const IMPLEMENTATION_CUT_REASON =
 	'this issue (joshuafolkken/kit#2760), and its recent-context ' +
 	`cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated ` +
 	'so far is now re-read on every later request. Take the cut before this edit. ' +
-	'First write a handoff file with the Write tool — the user’s instruction verbatim, what you have ' +
+	`First write a handoff file at \`${run_cut_handoff.HANDOFF_PATH}\` (ignored, so it is never committed) with the Write tool — the user’s instruction verbatim, what you have ` +
 	'completed, what remains, and what you deliberately did not touch, as ' +
 	`${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) — and pass it as \`--handoff <path>\`, ` +
 	'so the fresh process resumes on the original instruction rather than the working tree alone ' +
@@ -183,7 +186,7 @@ const IMPLEMENTATION_CUT_REASON =
 	'answered — an edit reissued right after this refusal passes, so `busy` / `failed` cannot wedge the ' +
 	'run edit after edit; this fires again on the next threshold crossing rather than once per run.'
 
-// **A refusal younger than this window is this edit's own refusal being answered** (joshuafolkken/kit#2385).
+// **A refusal younger than this window is this edit's own refusal being answered**.
 // A `decide` row that refused every over-threshold edit would wedge a run whose cut came back `busy` /
 // `failed` / `unready` — the very cases once-per-run relied on the reissue passing through. So an edit
 // reissued inside this window passes: it is longer than a refusal-then-reissue round trip, so the
@@ -194,7 +197,7 @@ function is_reissued_refusal(now_ms: number, delivered_at_ms: number): boolean {
 	return now_ms - delivered_at_ms < REISSUE_WINDOW_MS
 }
 
-// **Fires on every threshold crossing rather than once per run** (joshuafolkken/kit#2385). Once per run
+// **Fires on every threshold crossing rather than once per run**. Once per run
 // silenced the row for the rest of a process the moment its first refusal landed — and a `busy` /
 // `failed` / `unready` verdict, or an edit reissued unchanged, left the context to grow unwatched to
 // 282,747 tokens with the cut never taken. `decide` re-asks on every over-threshold edit; the reissue
@@ -210,8 +213,8 @@ function decide(
 	return !is_reissued_refusal(run.now_ms, delivered_at_ms)
 }
 
-// The row itself, so `delivered-rules.ts` spreads one entry. `decide` fires it per threshold crossing
-// (joshuafolkken/kit#2385); `keeps` is the implementation cut command, read from a `Bash` call the same
+// The row itself, so `delivered-rules.ts` spreads one entry. `decide` fires it per threshold crossing;
+// `keeps` is the implementation cut command, read from a `Bash` call the same
 // way `pre-gate-cut`'s is.
 const ROW = {
 	id: 'implementation-cut',

package/scripts/rules/index-guard.ts

@@ -3,8 +3,8 @@ import { git_argv } from './git-argv'
 import { shell_segments } from './shell-segments'
 import { worktree_guard } from './worktree-guard'
 
-// The trigger and the delivered text behind the `index-mutation` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2983). `CLAUDE.md` → Git Rules forbids staging or otherwise mutating the git index
+// The trigger and the delivered text behind the `index-mutation` row of `delivered-rules.ts`.
+// `CLAUDE.md` → Git Rules forbids staging or otherwise mutating the git index
 // on the run's own judgement, and `.claude/settings.json` backs it with `Bash(git add*)` /
 // `Bash(git commit*)` and their siblings — but those are prefix globs, so `git -C . commit`,
 // `git -c k=v commit` and `env git commit` all pass them. Reading the argv through `git-argv.ts`, the

package/scripts/rules/issue-citation.ts

@@ -1,6 +1,6 @@
-// The bare-`#N` predicate behind the `issue-citation` row of the stop guard (joshuafolkken/kit#2121),
+// The bare-`#N` predicate behind the `issue-citation` row of the stop guard,
 // and the printing-side formatter that keeps a bare `#N` out of session-facing output in the first
-// place (joshuafolkken/kit#2329).
+// place.
 //
 // **Session-facing output cites an Issue as a number-link, never a bare `#N`.** `CLAUDE.md` and
 // `prompts/collaboration-workflow/issue-citation.md` require `[#<N>](https://github.com/<owner>/<repo>/issues/<N>) — <short summary>`
@@ -8,13 +8,13 @@
 // it is. The stop guard reads `last_assistant_message` — the turn's session-facing text — and this
 // predicate answers whether a bare number slipped into it.
 //
-// **It blocks the stop, so a false positive costs a wasted turn** (joshuafolkken/kit#2247). The nudge
+// **It blocks the stop, so a false positive costs a wasted turn**. The nudge
 // now reaches the model rather than the person, so the detection is tightened to what is genuinely a
 // bare citation: a `#N` inside a fenced code block, inside an inline-code span, on a quote line, or
 // right after `PR` / `pull request` is not a citation slip and is skipped. The scan is line-based so
 // each exclusion is decided from the one line the mention sits on.
 //
-// **`linkify` runs that same scan the other way** (joshuafolkken/kit#2329): a command whose stdout a
+// **`linkify` runs that same scan the other way**: a command whose stdout a
 // run copies into its reply passes the text through it, and every bare `#N` the predicate would flag
 // is rewritten to `[#N](url)` — which the predicate then reads as linked, so the material that fed the
 // duplicate reply is fixed where it is printed rather than scolded after it reaches the screen. The
@@ -40,7 +40,7 @@ const OWNER_REPO = /^[^\s/#]+\/[^\s/#]+$/u
 const MARKDOWN_LINK = /\[[^[\]]*\]\([^()]*\)/gu
 // What continues a `#N` into something longer, read off the two characters after its last digit: a
 // word character (a hex color, `#1e90ff`) or a hyphen and a letter (a heading anchor, `#12-setup`) —
-// never an Issue number (joshuafolkken/kit#2995). A hyphen before a digit or `#` is a range
+// never an Issue number. A hyphen before a digit or `#` is a range
 // (`#12-#15`, `#3-5`), whose first number is still a citation.
 const NUMBER_CONTINUATION = /^(?:\w|-[a-z])/iu
 // The width of the window `NUMBER_CONTINUATION` reads: a hyphen and the letter after it.
@@ -178,7 +178,7 @@ function lines_outside_fences(message: string): ReadonlyArray<string> {
 }
 
 // The run's own prose: the lines outside every fenced-code block and off every quote line. Shared with
-// the filing-offer row of the stop guard (joshuafolkken/kit#2422), which asks the same "is this the
+// the filing-offer row of the stop guard, which asks the same "is this the
 // run speaking, not an example or a quote" question of the same reply.
 function prose_lines(message: string): ReadonlyArray<string> {
 	return lines_outside_fences(message).filter((line) => !QUOTE_LINE.test(line))
@@ -208,7 +208,7 @@ function prompt_references(prompt: string): ReadonlySet<string> {
 	return found
 }
 
-// **A number the person's prompt already carried is quoted, not cited** (joshuafolkken/kit#2819). A
+// **A number the person's prompt already carried is quoted, not cited**. A
 // pasted log from another repository holds its own `#1`…`#7`; `issue:cite` would link them to this
 // repository's unrelated Issues, so following the refusal would make the reply wrong. Only the exact
 // reference the prompt wrote is exempt, so a bare `#N` the run brought in itself is still refused.