@joshuafolkken/kit 1.1240.0 → 1.1373.0

package/scripts/run/hold/run-hold-cli.ts

@@ -1,5 +1,7 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { issue_number_shape } from '#scripts/issue/issue-number-shape'
+import { run_cli_fault } from '#scripts/run/run-cli-fault'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_label } from '#scripts/run/run-label'
 import { run_preflight, type PreflightDecision } from '#scripts/run/run-preflight'
@@ -8,32 +10,28 @@ import { run_tidy_cli } from '#scripts/run/tidy/run-tidy-cli'
 import { run_hold, type HoldRead, type RunHold } from './run-hold'
 
 // `josh run:hold [<N>]` and `josh run:release [<N> | --force]` — the working-tree guard the typed
-// entry points ask before they start (joshuafolkken/kit#1091).
+// entry points ask before they start.
 //
-// **A numbered claim asks the preflight question first** (joshuafolkken/kit#1965). `run:preflight`
-// was a separate command a run had to ask before this one; the two-step "preflight, then hold" was
-// one call too many, so the claim now runs the check itself and hands back a hold only on a `clean`
-// tree. A `reclaim` / `resume` / `park` tree is returned as that verdict without a record being
-// written, and the read-only check stays re-askable — clean up what it named, ask `run:hold` again.
-// The decision logic itself lives on in `run-preflight.ts` for `run:progress` to reuse; only its CLI
-// went away.
+// **A numbered claim asks the preflight question first**: the claim runs the check itself and hands
+// back a hold only on a `clean` tree. A `reclaim` / `resume` / `park` tree is returned as that verdict
+// without a record being written, and the read-only check stays re-askable — clean up what it named,
+// ask `run:hold` again. The decision logic lives in `run-preflight.ts` for `run:progress` to reuse.
 //
-// **A release names the run it belongs to, exactly as the claim did** (joshuafolkken/kit#1799). The
-// record carries no owner until then, so `run:release` removed whatever was there — and the `busy`
-// stop message tells a person to type it when they judge a record stale, which is a judgement made
-// from outside the run that wrote it. That made the guard's own recovery instruction a way to free a
-// live run's tree: the incident of 2026-08-30, reached through the guard meant to prevent it.
+// **A release names the run it belongs to, exactly as the claim did.** The `busy` stop message tells
+// a person to release when they judge a record stale — a judgement made from outside the run that
+// wrote it — so an unowned release would make the guard's own recovery instruction a way to free a
+// live run's tree.
 //
 // **It answers, so the entry point does not judge.** "This one is a small change, it will be fine" is
-// the judgement made under time pressure that produced the incident, and it is the same shape
-// `delegation-policy.ts` refuses to leave to an agent. A token on standard output is what the entry
+// a judgement made under time pressure, and it is the same shape `delegation-policy.ts` refuses to
+// leave to an agent. A token on standard output is what the entry
 // point obeys.
 //
 // The contract is `epic:next`'s: **standard output carries exactly one token** — `hold`, `busy` or
 // `unknown` — and every explanation goes to standard error, so `answer=$(pnpm josh run:hold 1091)`
 // captures something a loop can branch on.
 //
-// **A successful claim then sweeps merged residue** — `run:tidy` (joshuafolkken/kit#2701). After the
+// **A successful claim then sweeps merged residue** — `run:tidy`. After the
 // claim rather than before it: the sweep may append to the primary checkout's observation ledger, and
 // doing that ahead of the preflight would turn a clean primary checkout into a `reclaim`.
 
@@ -41,23 +39,23 @@ const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const ARGV_OFFSET = 2
 const RELEASE_FLAG = '--release'
-// What removes a record this run did not write. **The deliberate friction of the whole change**
-// (joshuafolkken/kit#1799): every release now names the run it belongs to, and the one act that
-// cannot — clearing a record somebody else left behind — is spelled out rather than reached by
-// typing the ordinary command.
+// What removes a record this run did not write. **Deliberate friction**: every release names the run
+// it belongs to, and the one act that cannot — clearing a record somebody else left behind — is
+// spelled out rather than reached by typing the ordinary command.
 const FORCE_FLAG = '--force'
 // What `fullrun #N`'s entry claims with, so the record says the run is a `fullrun` — the one run whose
-// implementation cut outside a lane resumes as `fullrun #N` (joshuafolkken/kit#2760).
+// implementation cut outside a lane resumes as `fullrun #N`.
 const FULLRUN_FLAG = '--fullrun'
 const HALFRUN_STOP_FLAG = '--halfrun-stop'
-// A `prrun`'s stop before merge (joshuafolkken/kit#3023): its record keeps the commit it stopped on.
+// A `prrun`'s stop before merge: its record keeps the commit it stopped on.
 const PRRUN_STOP_FLAG = '--prrun-stop'
 // The most a claim reads: the issue number and the one flag after it.
 const MAX_CLAIM_ARGUMENTS = 2
-const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
 const USAGE =
 	'Usage: josh run:hold [<issue-number> [--fullrun | --halfrun-stop | --prrun-stop]] | josh run:release [<issue-number> | --force]'
 
+const COMMAND = 'run:hold'
+
 const HOLD_VERDICT = 'hold'
 const BUSY_VERDICT = 'busy'
 const UNKNOWN_VERDICT = 'unknown'
@@ -121,7 +119,9 @@ function parse_claim(argv: ReadonlyArray<string>): HoldRequest | undefined {
 
 	if (first === undefined) return { kind: 'claim', issue: run_hold.UNNUMBERED_ISSUE }
 
-	if (argv.length > MAX_CLAIM_ARGUMENTS || !ISSUE_NUMBER_PATTERN.test(first)) return undefined
+	if (argv.length > MAX_CLAIM_ARGUMENTS || !issue_number_shape.ISSUE_NUMBER_PATTERN.test(first)) {
+		return undefined
+	}
 
 	return numbered_claim(first, flag)
 }
@@ -129,7 +129,7 @@ function parse_claim(argv: ReadonlyArray<string>): HoldRequest | undefined {
 function parse_release_argument(first: string): HoldRequest | undefined {
 	if (first === FORCE_FLAG) return FORCE_RELEASE_REQUEST
 
-	return ISSUE_NUMBER_PATTERN.test(first) ? release_request(first) : undefined
+	return issue_number_shape.ISSUE_NUMBER_PATTERN.test(first) ? release_request(first) : undefined
 }
 
 // **A bare `run:release` is the unnumbered run's release, not a release of whatever is there.** It
@@ -171,8 +171,13 @@ function report_hold(): number {
 // that wrote it is the one whose uncommitted work would be trampled, so a record that cannot be
 // parsed is never read as an idle tree. **And an expired record still stops it while the tree is
 // dirty** — that is a run which stopped for a person, and the work is right there in the tree.
-async function blocking_message(read: HoldRead): Promise<string | undefined> {
-	if (read.kind === 'held') return run_hold.held_message(read.hold)
+// **A live record stops every claim but its own run's.**
+function held_block(hold: RunHold, issue: string): string | undefined {
+	return run_hold.is_reentry(hold, issue) ? undefined : run_hold.held_message(hold)
+}
+
+async function blocking_message(read: HoldRead, issue: string): Promise<string | undefined> {
+	if (read.kind === 'held') return held_block(read.hold, issue)
 
 	if (read.kind === 'unreadable') return run_hold.unreadable_message()
 
@@ -193,7 +198,7 @@ function take_free_tree(target: string, request: ClaimRequest): number {
 
 // **The stale path takes the tree the same exclusive way the free path does.** Replacing an expired
 // record with a plain write would tell two sessions that both found it expired that they both won —
-// the race the free path was just fixed for, reintroduced one branch over. Removing it first is what
+// the race the free path guards against. Removing it first is what
 // turns the expired record into a free tree; the create is what decides between the two claimants.
 function replace_stale(target: string, request: ClaimRequest, hold: RunHold): number {
 	console.error(run_hold.stale_message(hold))
@@ -202,9 +207,19 @@ function replace_stale(target: string, request: ClaimRequest, hold: RunHold): nu
 	return take_free_tree(target, request)
 }
 
+// The claim on a tree nothing blocks. A `held` record that got this far is the run's own, so it is
+// kept as written — its stop marks included — and answered `hold`.
+function take_tree(target: string, request: ClaimRequest, read: HoldRead): number {
+	if (read.kind === 'held') return report_hold()
+
+	return read.kind === 'stale'
+		? replace_stale(target, request, read.hold)
+		: take_free_tree(target, request)
+}
+
 // A non-clean preflight verdict is not an error: it is an answer a loop branches on, exactly as
 // `busy` is, so it prints the reason and advice the check composed and exits zero. Only an unreadable
-// tree is `unknown`, and that reaches `report_unknown` through `run`'s catch, as it always did.
+// tree is `unknown`, and that reaches `report_unknown` through `answer`'s directory read.
 function report_preflight(decision: PreflightDecision): number {
 	console.error(`${decision.reason}\n${decision.advice}`)
 	console.info(decision.verdict)
@@ -232,14 +247,11 @@ async function claim(target: string, request: ClaimRequest, is_linked: boolean):
 	if (gate !== undefined) return gate
 
 	const read = run_hold.read_hold(target)
-	const blocked = await blocking_message(read)
+	const blocked = await blocking_message(read, request.issue)
 
 	if (blocked !== undefined) return report_busy(blocked)
 
-	const code =
-		read.kind === 'stale'
-			? replace_stale(target, request, read.hold)
-			: take_free_tree(target, request)
+	const code = take_tree(target, request, read)
 
 	if (code === SUCCESS_EXIT_CODE) await run_tidy_cli.sweep()
 
@@ -257,30 +269,28 @@ function report_held(hold: RunHold): number {
 	return report(run_hold.foreign_release_message(hold), HELD_VERDICT, FAILURE_EXIT_CODE)
 }
 
-// A record nothing can parse names no run, so no claimant can match it — and removing it anyway is
-// the one thing this path exists to refuse. It answers `unknown` for the reason every other
+// A record nothing can parse names no run, so no claimant can match it — and removing it, or marking
+// a stop on it, is what these paths refuse. It answers `unknown` for the reason every other
 // unreadable state here does: nothing was established, so nothing may be concluded.
-function report_unreadable_release(): number {
+function report_unreadable_record(): number {
 	return report(run_hold.unreadable_message(), UNKNOWN_VERDICT, FAILURE_EXIT_CODE)
 }
 
-// **A release removes the record only where the record names the run asking** (joshuafolkken/kit#1799).
-// Until then this removed whatever was there, and the `busy` stop message sent a person here to clear
-// a record they had judged stale from outside the run that wrote it — so the guard's own recovery
-// instruction was a way to free a live run's tree, which is the incident it was written after.
+// **A release removes the record only where the record names the run asking**, so the `busy` stop
+// message's recovery instruction cannot free a live run's tree.
 function release_record(target: string, claimant: string): number {
 	const read = run_hold.read_hold(target)
 
 	if (read.kind === 'free') return remove_record(target, false)
 
-	if (read.kind === 'unreadable') return report_unreadable_release()
+	if (read.kind === 'unreadable') return report_unreadable_record()
 
 	if (!run_hold.is_own_hold(read.hold, claimant)) return report_held(read.hold)
 
 	return remove_record(target, true)
 }
 
-// **A numbered run's own release takes its `in-progress` marker back off** (joshuafolkken/kit#3182),
+// **A numbered run's own release takes its `in-progress` marker back off**,
 // whether or not a record was still there — the stop that releases is the run ending its hold on the
 // issue. A refused release (another run's record, an unreadable one) touches no label, and an
 // unnumbered run names no issue to touch.
@@ -318,17 +328,9 @@ function report_usage(): number {
 	return FAILURE_EXIT_CODE
 }
 
-async function read_worktree(): Promise<string | undefined> {
-	try {
-		return await run_hold.worktree_directory()
-	} catch {
-		return undefined
-	}
-}
-
-// **A `halfrun` stop marks its own record** (joshuafolkken/kit#2796) — the positive "this run has ended
-// over its verified diff" that `run:entry` adopts on `fullrun #N`. Another run's record is left alone.
-// A `prrun` stop marks its record the same way, with the commit it stopped on (joshuafolkken/kit#3023).
+// **A `halfrun` stop marks its own record** — the positive "this run has ended over its verified diff"
+// that `run:entry` adopts on `fullrun #N`. Another run's record is left alone. A `prrun` stop marks
+// its record the same way, with the commit it stopped on.
 async function mark_stop(target: string, request: StopRequest): Promise<number> {
 	const mark =
 		request.kind === PRRUN_STOP_KIND
@@ -337,7 +339,7 @@ async function mark_stop(target: string, request: StopRequest): Promise<number>
 
 	if (mark === run_halfrun_resume.MARKED) return report_hold()
 
-	if (mark === run_halfrun_resume.UNREADABLE) return report_unknown()
+	if (mark === run_halfrun_resume.UNREADABLE) return report_unreadable_record()
 
 	return report_busy(run_hold.race_message(run_hold.read_hold(target), target))
 }
@@ -353,7 +355,7 @@ async function dispatch(request: HoldRequest, target: string, is_linked: boolean
 }
 
 async function answer(request: HoldRequest): Promise<number> {
-	const directory = await read_worktree()
+	const directory = await run_cli_fault.directory_of(COMMAND, run_hold.worktree_directory)
 
 	if (directory === undefined) return report_unknown()
 
@@ -362,10 +364,11 @@ async function answer(request: HoldRequest): Promise<number> {
 	return await dispatch(request, run_hold.hold_path(directory), is_linked)
 }
 
-// **Every path out of here prints exactly one token**, including the ones nobody planned: a permission
-// error on the record, or a git binary that is not there, used to leave standard output empty — and an
-// empty `$answer` matches none of the three tokens, which an entry point reads as "not busy" before
-// walking straight past the guard.
+// **Every path out of here prints exactly one token**, including the ones nobody planned — a
+// permission error on the record, or a git binary that is not there: an empty `$answer` matches none
+// of the three tokens, which an entry point would read as "not busy" and walk straight past the guard.
+// The token stays `unknown`, and the failure says what it was rather than borrowing the
+// unreadable-git-directory message.
 async function run(argv: ReadonlyArray<string>): Promise<number> {
 	const request = parse_request(argv)
 
@@ -373,8 +376,8 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 
 	try {
 		return await answer(request)
-	} catch {
-		return report_unknown()
+	} catch (error) {
+		return report(run_cli_fault.message(COMMAND, error), UNKNOWN_VERDICT, FAILURE_EXIT_CODE)
 	}
 }
 

package/scripts/run/hold/run-hold.ts

@@ -1,13 +1,17 @@
 import { git_command } from '#scripts/git/git-command'
+import { session_cite } from '#scripts/issue/session-cite'
+import { agent_session_environment } from '#scripts/josh/agent-session-environment'
+import { process_identity } from '#scripts/josh/process-identity'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import { stamp_record } from '#scripts/josh/stamp-record'
 import { error_text } from '#scripts/lib/error-message'
+import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 
-// joshuafolkken/kit#1091: `epicrun` asks `epic-busy.ts` whether a *repository* already has a child in
-// flight, and the entry points a person types — `fullrun`, `halfrun`, `kickoff` — never reach that
-// guard, because they do not go through `epic:next`. On 2026-08-30 two sessions therefore implemented
-// two issues in one checkout at once, and the second was one command away from committing nine files
-// onto the first one's branch.
+// One run at a time per working tree. The entry points a person types — `fullrun`, `halfrun`,
+// `kickoff` — never reach `epic-busy.ts`'s guard, because they do not go through `epic:next`, so
+// without this two sessions could implement two issues in one checkout and commit onto each other's
+// branch.
 //
 // **The unit is the working tree, not the repository.** What these entries contend for is one branch,
 // one index and one uncommitted diff; a linked work tree has its own three, so a second run there is
@@ -30,11 +34,9 @@ const MILLISECONDS_PER_HOUR = 3_600_000
 const HOLD_MAX_AGE_MS = HOLD_MAX_AGE_HOURS * MILLISECONDS_PER_HOUR
 
 const RELEASE_COMMAND = 'pnpm josh run:release'
-// The spelling that removes a record this run did not write (joshuafolkken/kit#1799). **It is a
-// separate spelling rather than the same one** because a stop message has to name something a person
-// can type when a record really has been abandoned — and the one it named until now removed a *live*
-// run's record just as readily, which is the incident this guard was written after, reached through
-// the guard's own recovery instruction.
+// The spelling that removes a record this run did not write. **It is a separate spelling rather than
+// the same one** because a stop message has to name something a person can type when a record really
+// has been abandoned, without the plain release removing a *live* run's record just as readily.
 const FORCE_RELEASE_COMMAND = `${RELEASE_COMMAND} --force`
 // The sentence `epic-busy.ts` prints for the same reason: a guard that cannot read its record has not
 // established that the tree is free, and reporting it as free is the one failure that matters here.
@@ -44,19 +46,25 @@ interface RunHold {
 	issue: string
 	taken_at: string
 	pid: number
-	// Set only by `fullrun #N`'s entry (`run:entry` claims with `--fullrun`, joshuafolkken/kit#2760).
-	// The implementation cut outside a lane resumes as `fullrun #N`, so a `halfrun` or an in-session
-	// `backlogrun` child — which hold the tree just the same — must not be read as one. Optional and
-	// `| undefined` because a record written before this field existed is simply not a `fullrun`'s.
+	// Set only by `fullrun #N`'s entry (`run:entry` claims with `--fullrun`). The implementation cut
+	// outside a lane resumes as `fullrun #N`, so a `halfrun` or an in-session `backlogrun` child — which
+	// hold the tree just the same — must not be read as one. Optional and `| undefined` because a record
+	// without this field is simply not a `fullrun`'s.
 	is_fullrun?: boolean | undefined
-	// Set only at a `halfrun`'s stop before commit (`run:hold <N> --halfrun-stop`, joshuafolkken/kit#2796):
-	// the positive record that the run has *ended* over its verified diff, which is what lets
-	// `fullrun #N` adopt the hold. A running `halfrun` or a `backlogrun` child never carries it.
+	// Set only at a `halfrun`'s stop before commit (`run:hold <N> --halfrun-stop`): the positive record
+	// that the run has *ended* over its verified diff, which is what lets `fullrun #N` adopt the hold. A
+	// running `halfrun` or a `backlogrun` child never carries it.
 	is_halfrun_stop?: boolean | undefined
-	// Set only at a `prrun`'s stop before merge (`run:hold <N> --prrun-stop`, joshuafolkken/kit#3023): the
-	// commit the green pull request stood on, so `fullrun #N` can tell an untouched branch — merge it —
-	// from one that moved since and has to pass the gate and the review again.
+	// Set only at a `prrun`'s stop before merge (`run:hold <N> --prrun-stop`): the commit the green pull
+	// request stood on, so `fullrun #N` can tell an untouched branch — merge it — from one that moved
+	// since and has to pass the gate and the review again.
 	prrun_stop_head?: string | undefined
+	// The agent session the claim ran under — `pid` is the short-lived `josh run:hold` itself, gone
+	// before anything reads it back, so it can never say whether the run is still there. The pair with
+	// its start time is the identity `process-identity.ts` defines. Optional for a record without these
+	// fields, or by a claim made outside an agent session.
+	owner_pid?: number | undefined
+	owner_start?: string | undefined
 }
 
 type HoldRead =
@@ -83,8 +91,7 @@ async function worktree_directory(): Promise<string | undefined> {
 // A linked work tree — a lane — reports its own git directory as the first path and the common
 // directory every work tree of the repository shares as the second; the primary checkout reports one
 // path for both. Comparing the two detects a lane without assuming the git directory is named `.git`:
-// a `--separate-git-dir` clone or a bare repository defeats any `.git`-segment match
-// (joshuafolkken/kit#1106).
+// a `--separate-git-dir` clone or a bare repository defeats any `.git`-segment match.
 async function is_linked_worktree(): Promise<boolean> {
 	const directories = await git_command.git_directories()
 
@@ -98,18 +105,14 @@ const run_hold_schema = z.object({
 	is_fullrun: z.boolean().optional(),
 	is_halfrun_stop: z.boolean().optional(),
 	prrun_stop_head: z.string().optional(),
+	owner_pid: z.number().optional(),
+	owner_start: z.string().optional(),
 })
 
 // `undefined` for anything that is not a well-formed record, so the caller decides what a broken one
 // means. It means blocked, not free — see `classify`.
 function parse_hold(raw: string): RunHold | undefined {
-	try {
-		const parsed = run_hold_schema.safeParse(JSON.parse(raw))
-
-		return parsed.success ? parsed.data : undefined
-	} catch {
-		return undefined
-	}
+	return json_value.parse_with(raw, run_hold_schema)
 }
 
 // **A `taken_at` that is not a date is stale, not current.** It passes the schema — it is a string —
@@ -117,12 +120,25 @@ function parse_hold(raw: string): RunHold | undefined {
 // state the expiry exists to make impossible. Fail-closed is still the answer for the *tree*: a stale
 // record only lets a claim through once `run-hold-cli.ts`'s `blocking_message` has also found the
 // tree clean.
-function is_stale(hold: RunHold, now: Date): boolean {
-	const taken = Date.parse(hold.taken_at)
+function is_expired(hold: RunHold, now: Date): boolean {
+	return stamp_record.is_older_than(hold.taken_at, HOLD_MAX_AGE_MS, now)
+}
 
-	if (Number.isNaN(taken)) return true
+// **A record whose session has ended is stale before its age says so**: the run
+// that wrote it cannot release it any more, so waiting out the eight hours only stops the next run for
+// nothing. Only a recorded session that is provably gone counts — no owner, or a live pid whose start
+// cannot be read, leaves the age as the whole test. **A stop-marked record is exempt**: a `halfrun` or
+// `prrun` stop is held across a person's latency on purpose, long after its session ends.
+function is_owner_gone(hold: RunHold): boolean {
+	const is_stop_mark = hold.is_halfrun_stop === true || hold.prrun_stop_head !== undefined
 
-	return now.getTime() - taken > HOLD_MAX_AGE_MS
+	if (is_stop_mark || hold.owner_pid === undefined) return false
+
+	return process_identity.is_same_process(hold.owner_pid, hold.owner_start) === false
+}
+
+function is_stale(hold: RunHold, now: Date): boolean {
+	return is_expired(hold, now) || is_owner_gone(hold)
 }
 
 // **A record that cannot be read is `unreadable`, never `free`.** Absent is free; present and
@@ -142,8 +158,22 @@ function read_hold(target: string, now: Date = new Date()): HoldRead {
 	return classify(stamp_file.read_stamp_text(target), now)
 }
 
+type Environment = Readonly<Record<string, string | undefined>>
+type SessionOwner = Pick<RunHold, 'owner_pid' | 'owner_start'>
+
+// The agent session's own process, which Claude Code exports to every command it runs. Absent or
+// malformed is no owner at all, never a guess at an ancestor: a wrong owner read as gone frees a live
+// run's tree, which is the one failure this guard exists to prevent.
+function session_owner(environment: Environment = process.env): SessionOwner {
+	const pid = Number(environment[agent_session_environment.AGENT_PID_KEY])
+
+	if (!Number.isSafeInteger(pid) || pid <= 0) return {}
+
+	return { owner_pid: pid, owner_start: process_identity.read_start(pid) }
+}
+
 function build_hold(issue: string, now: Date, is_fullrun?: boolean): RunHold {
-	return { issue, taken_at: now.toISOString(), pid: process.pid, is_fullrun }
+	return { issue, taken_at: now.toISOString(), pid: process.pid, is_fullrun, ...session_owner() }
 }
 
 function write_hold(target: string, issue: string, now: Date = new Date()): RunHold {
@@ -155,9 +185,8 @@ function write_hold(target: string, issue: string, now: Date = new Date()): RunH
 }
 
 // The claim on a tree that read as free. **Exclusive rather than a plain write**: two sessions typing
-// an entry point in the same second both read `free`, and a write would tell both of them they won —
-// which is the incident this guard was written after, reproduced by the guard itself. `false` means
-// the other one got there first.
+// an entry point in the same second both read `free`, and a write would tell both of them they won.
+// `false` means the other one got there first.
 function create_hold(
 	target: string,
 	issue: string,
@@ -168,7 +197,7 @@ function create_hold(
 }
 
 // What a stopped run's record carries on top of the claim: the `halfrun` stop's flag, or the commit a
-// `prrun` stop stood on (joshuafolkken/kit#3023).
+// `prrun` stop stood on.
 type StopMarkFields = Pick<RunHold, 'is_halfrun_stop' | 'prrun_stop_head'>
 
 const HALFRUN_STOP_FIELDS: StopMarkFields = { is_halfrun_stop: true }
@@ -208,14 +237,15 @@ function release_hold(target: string): void {
 	stamp_file.remove_stamp(target)
 }
 
-// The pid is recorded for the person reading the stop message, never as the liveness test: the process
-// that claims the tree is a short-lived `josh run:hold`, so it has exited by the time anything reads
-// the record back. Age is what expires a record; `pnpm josh run:release --force` is what clears
-// somebody else's early, and `pnpm josh run:release <N>` what the run that wrote it types.
+// The pid named is the session's where the record has one: the claiming `josh run:hold` has exited by
+// the time anything reads the record back, so its own pid tells a person nothing. Age or an ended
+// session is what expires a record; `pnpm josh run:release --force` is what clears somebody else's
+// early, and `pnpm josh run:release <N>` what the run that wrote it types.
 function describe_holder(hold: RunHold): string {
-	const holder = hold.issue === UNNUMBERED_ISSUE ? 'an unnumbered run' : `#${hold.issue}`
+	const holder =
+		hold.issue === UNNUMBERED_ISSUE ? 'an unnumbered run' : session_cite.issue(hold.issue)
 
-	return `${holder}, recorded ${hold.taken_at} (pid ${String(hold.pid)})`
+	return `${holder}, recorded ${hold.taken_at} (pid ${String(hold.owner_pid ?? hold.pid)})`
 }
 
 // The command the run that *wrote* a record types to remove it — the claim's own spelling, mirrored,
@@ -232,6 +262,13 @@ function is_own_hold(hold: RunHold, claimant: string): boolean {
 	return hold.issue === claimant
 }
 
+// **A claim for the issue the record already names is the same run asking again** — a second
+// `run:entry` in one session must not answer `busy` to its own hold. The unnumbered `new` claim names
+// no run, so two of them are still two runs.
+function is_reentry(hold: RunHold, claimant: string): boolean {
+	return claimant !== UNNUMBERED_ISSUE && is_own_hold(hold, claimant)
+}
+
 function held_message(hold: RunHold): string {
 	return `This working tree is already held by ${describe_holder(hold)}. One run at a time per working tree: a second run here commits its files onto the other run's branch. If that record is stale, run \`${FORCE_RELEASE_COMMAND}\` in this working tree — it removes a record this run did not write, so be sure the run that did has ended — and ask again.`
 }
@@ -252,11 +289,15 @@ function unreadable_message(): string {
 }
 
 function stale_message(hold: RunHold): string {
-	return `Replaced a stale run record held by ${describe_holder(hold)}: older than ${String(HOLD_MAX_AGE_HOURS)} hours, so the run that wrote it has ended without releasing it.`
+	const why = is_owner_gone(hold)
+		? 'the session that wrote it has ended'
+		: `older than ${String(HOLD_MAX_AGE_HOURS)} hours`
+
+	return `Replaced a stale run record held by ${describe_holder(hold)}: ${why}, so the run that wrote it has ended without releasing it.`
 }
 
 function uncommitted_message(hold: RunHold): string {
-	return `This working tree still has uncommitted changes, and its run record — held by ${describe_holder(hold)} — has expired. That is a run which stopped for a person rather than one that finished, so the tree is not free: commit or stash the work, or run \`${own_release_command(hold.issue)}\` once you are done with it, then ask again.`
+	return `This working tree still has uncommitted changes, and its run record — held by ${describe_holder(hold)} — has expired or outlived its session. That is a run which stopped for a person rather than one that finished, so the tree is not free: commit or stash the work, or run \`${own_release_command(hold.issue)}\` once you are done with it, then ask again.`
 }
 
 // The exclusive claim lost: another process wrote the record between this one's read and its write.
@@ -292,6 +333,7 @@ const run_hold = {
 	hold_path,
 	is_linked_worktree,
 	is_own_hold,
+	is_reentry,
 	is_tree_dirty,
 	own_release_command,
 	race_message,