@joshuafolkken/kit 1.1453.0 → 1.1471.0

package/scripts/rules/implementation-cut.ts

@@ -7,7 +7,9 @@ import type { GuardRun } from '#scripts/josh/hook-decision'
 import { lane_child_marker, type MarkerSource } from '#scripts/lane/lane-child-marker'
 import { lane_paths } from '#scripts/lane/lane-paths'
 import { run_cut, type RunCut } from '#scripts/run/cut/run-cut'
+import { run_cut_decline } from '#scripts/run/cut/run-cut-decline'
 import { run_cut_handoff } from '#scripts/run/cut/run-cut-handoff'
+import { run_cut_ready } from '#scripts/run/cut/run-cut-ready'
 import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { bash_triggers } from './bash-triggers'
 import { implementation_cut_verdict } from './implementation-cut-verdict'
@@ -62,6 +64,16 @@ interface LaneCostState {
 	// held outside a lane is told apart from a person's tree.
 	held_issue: () => string | undefined
 	verdict: () => CostVerdict
+	// Whether `run:cut --impl` could take the cut for this issue now — see `can_cut_sync`.
+	can_cut: (issue: string) => boolean
+}
+
+// **The guard asks for a cut only where `run:cut --impl` could take one** (joshuafolkken/kit#3881).
+// A run held on the default branch, or one whose cut was already answered `not-a-lane` / `unready`
+// under this hold, can only be refused again, so each refusal was a round trip that cut nothing. The
+// decline record is a file read and comes first; the tree read spawns git and comes second.
+function can_cut_sync(issue: string): boolean {
+	return !run_cut_decline.is_declined_sync(issue) && run_cut_ready.is_ready_sync()
 }
 
 function current_state(): LaneCostState {
@@ -75,6 +87,7 @@ function current_state(): LaneCostState {
 		// the window collapses one turn's burst of edits to a single whole-transcript price.
 		verdict: (): CostVerdict =>
 			implementation_cut_verdict.reused_verdict(() => cost_cli.session_verdict()),
+		can_cut: can_cut_sync,
 	}
 }
 
@@ -140,14 +153,19 @@ function warrants_the_cut(state: LaneCostState): boolean {
 // **The unmeasurable direction matches the pre-gate cut**. A session that
 // cannot be priced reads as warranting the cut, the same safety-net direction `pre-gate-cut.ts`'s
 // `warrants_the_cut` takes (`verdict !== UNDER_VERDICT`): the two rules read one statistic against one
-// threshold, so they must not disagree about whether an unmeasurable session is due a cut.
+// threshold, so they must not disagree about whether an unmeasurable session is due a cut. Whether the
+// cut could be taken is asked only once it is warranted, so an under-threshold edit spawns no git.
 function is_over_threshold_edit(
 	call: GuardedCall,
 	state: LaneCostState = current_state(),
 ): boolean {
-	if (!is_edit_tool(call.name) || uncut_run_issue(state) === undefined) return false
+	if (!is_edit_tool(call.name)) return false
+
+	const issue = uncut_run_issue(state)
+
+	if (issue === undefined) return false
 
-	return warrants_the_cut(state)
+	return warrants_the_cut(state) && state.can_cut(issue)
 }
 
 // **The threshold in the refusal text is assembled from the constant, never spelled**.
@@ -155,36 +173,14 @@ function is_over_threshold_edit(
 // building it from `CONTEXT_CUT_THRESHOLD` keeps the two from drifting. `cost_format.format_tokens` renders it the way every cost report does.
 const THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`
 
-// The instruction in the shape a refusal can carry: what the cut is for, what each verdict means, and
-// the reissue sentence every delivery needs. The verdicts are spelled out rather than pointed at,
-// because `cut` is the only one that ends the turn and a run told merely to "take the cut" would have to
-// read which of the others leave it implementing — the same reason `pre-gate-cut.ts` spells them out.
+// The instruction in the shape a refusal can carry: the handoff in the format the parser reads, the
+// cut, and the one verdict that ends the turn — `cut` is the only one, so a run told merely to "take
+// the cut" is not left to look it up.
 const IMPLEMENTATION_CUT_REASON =
-	'⛔ implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for ' +
-	'this issue (joshuafolkken/kit#2760), and its recent-context ' +
-	`cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated ` +
-	'so far is now re-read on every later request. Take the cut before this edit. ' +
-	`First write a handoff file at \`${run_cut_handoff.HANDOFF_PATH}\` (ignored, so it is never committed) with the Write tool — the user’s instruction verbatim, what you have ` +
-	'completed, what remains, and what you deliberately did not touch, as ' +
-	`${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) — and pass it as \`--handoff <path>\`, ` +
-	'so the fresh process resumes on the original instruction rather than the working tree alone ' +
-	'(joshuafolkken/kit#2354); a resume that finds no instruction is refused `incomplete` rather than ' +
-	'continuing blind. ' +
-	'`pnpm josh run:cut --impl <N> --handoff <path>` ends this process and relaunches a fresh one that resumes back into ' +
-	'implementation (`resume-impl`), dropping the accumulated context rather than carrying it — ' +
-	'joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times ' +
-	'because the verdict was only ever read at session entry, where the context has not yet grown. The ' +
-	"verdict is `pnpm josh cost --cut`'s exactly — the same per-request billed-input statistic against the " +
-	'same threshold, never a second measurement. Issue `pnpm josh run:cut --impl <N> --handoff <path>` now and read the ' +
-	'verdict: on `cut`, read what the command printed. Where it relaunched a fresh process, **end the turn ' +
-	'immediately** — that process owns the run and continues implementing, so it must not be waited for, ' +
-	'and **no Telegram is owed**: a cut that resumes itself leaves a person nothing to act on. Where it printed that nothing was relaunched, do what it prints, then end the turn; on `not-a-lane`, `unready`, `busy`, `failed` or ' +
-	'`unknown`, this process carries the run on and the edit is simply the next call. Never relaunch a ' +
-	'second process after `busy`. This fired because the dispatch mark names this lane or the run hold ' +
-	'names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The ' +
-	'procedure is `.claude/skills/workflow-commands/pre-gate-cut.md`. Reissue this edit once the cut has ' +
-	'answered — an edit reissued right after this refusal passes, so `busy` / `failed` cannot wedge the ' +
-	'run edit after edit; this fires again on the next threshold crossing rather than once per run.'
+	`⛔ implementation-phase cut: refused on every edit past the ${THRESHOLD_TEXT} line. ` +
+	`Write \`${run_cut_handoff.HANDOFF_PATH}\` as ${run_cut_handoff.HANDOFF_FORMAT}, run ` +
+	'`pnpm josh run:cut --impl <N> --handoff <path>`; `cut`: end the turn immediately, no Telegram ' +
+	'is owed; else reissue the edit (`.claude/skills/workflow-commands/pre-gate-cut.md`).'
 
 // **A refusal younger than this window is this edit's own refusal being answered**.
 // A `decide` row that refused every over-threshold edit would wedge a run whose cut came back `busy` /
@@ -201,7 +197,8 @@ function is_reissued_refusal(now_ms: number, delivered_at_ms: number): boolean {
 // silenced the row for the rest of a process the moment its first refusal landed — and a `busy` /
 // `failed` / `unready` verdict, or an edit reissued unchanged, left the context to grow unwatched to
 // 282,747 tokens with the cut never taken. `decide` re-asks on every over-threshold edit; the reissue
-// window is what keeps that from wedging a run that genuinely cannot cut. `delivered_at_ms` is this
+// window keeps that from wedging a run whose cut came back `busy` / `failed`, and a run that cannot
+// cut at all never reaches here — `can_cut_sync` keeps the trigger silent for it. `delivered_at_ms` is this
 // row's own last refusal, written by `fire_once` only when a refusal actually fired, so a passed
 // reissue does not move it.
 function decide(
@@ -213,8 +210,8 @@ function decide(
 	return !is_reissued_refusal(run.now_ms, delivered_at_ms)
 }
 
-// The row itself, so `delivered-rules.ts` spreads one entry. `decide` fires it per threshold crossing;
-// `keeps` is the implementation cut command, read from a `Bash` call the same
+// The row itself, so `delivered-rules.ts` spreads one entry. `decide` fires it per threshold crossing
+// in a run that can cut; `keeps` is the implementation cut command, read from a `Bash` call the same
 // way `pre-gate-cut`'s is.
 const ROW = {
 	id: 'implementation-cut',
@@ -222,6 +219,11 @@ const ROW = {
 	reason: IMPLEMENTATION_CUT_REASON,
 	decide,
 	keeps: bash_triggers.on_bash_command(takes_the_impl_cut),
+	// The opening the reason carried before it was cut to the action and the next command.
+	former_reasons: [
+		'⛔ implementation-phase cut: this checkout is a lane dispatched',
+		"⛔ implementation-phase cut: this run's context crossed the",
+	],
 }
 
 const implementation_cut = {

package/scripts/rules/index-guard.ts

@@ -51,13 +51,10 @@ function is_index_mutation(command: string): boolean {
 
 const INDEX_MUTATION_REASON =
 	'⛔ git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore ' +
-	"--staged` overwrite the user's staged snapshot, which `CLAUDE.md` → Git Rules forbids on your own " +
-	'judgement (`prompts/collaboration-workflow/operating-rules.md` → "no-self-staging"). The ' +
-	'`.claude/settings.json` deny list matches prefix globs, so it misses `git -C . commit`, `git -c ' +
-	'k=v commit` and `env git commit`; this row reads the argv instead, so the spelling does not matter. ' +
-	'A commit goes through `pnpm josh git -y`; any other staging needs explicit current-turn user ' +
-	'instruction, run by the user in their own terminal. **This rule fires on every occurrence, not once ' +
-	'per run.**'
+	"--staged` overwrite the user's staged snapshot. Commit with `pnpm josh git -y`; any other staging " +
+	"is the user's, on explicit instruction. It fires on every occurrence " +
+	'(`prompts/collaboration-workflow/operating-rules.md` → ' +
+	'"no-self-staging").'
 
 const ROW = {
 	id: 'index-mutation',

package/scripts/rules/issue-comments.ts

@@ -89,21 +89,11 @@ function reads_issue_comments(command: string): boolean {
 // the fix. The label keeps `time_transcript_line.guard_from_refusal` naming this guard, not the command.
 const ISSUE_COMMENTS_REASON =
 	'⛔ issue comments: pnpm josh issue:read <N>\n' +
-	"Run that in place of this read: <N> is the Issue it names, and an Issue's comments are part of " +
-	'the Issue, so the body and every comment come back together. Without josh, add ' +
-	"`gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, " +
-	"body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable.\n" +
-	'Why: a decision recorded after the body was written lives only in a comment — a corrected ' +
-	'diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion ' +
-	'(joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) — and ' +
-	'nothing in the body says it was superseded, so a body-only reader builds the wrong thing and ' +
-	'sees no contradiction. ' +
-	'Then the later text is the agreement in force — a comment supersedes the body it contradicts — ' +
-	"except for two answers that are not the run's to make: work a comment reassigns to another " +
-	'Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a ' +
-	'reason to exist stops the run with a `confirmation` Telegram. The procedure is ' +
-	'`.claude/skills/workflow-commands/issue-comments.md`. ' +
-	'Every body-only read is refused until the comments are read.'
+	"Run that in place of this read — an Issue's comments are part of it, and a later comment " +
+	'supersedes the body it contradicts; refused until that command is on the transcript. Without ' +
+	'josh, read ' +
+	'`gh api repos/{owner}/{repo}/issues/<N>/comments` beside the body ' +
+	'(`.claude/skills/workflow-commands/issue-comments.md`).'
 
 // The enumeration row itself, so `delivered-rules.ts` spreads one entry. `already_satisfied` stands it
 // down once the comments are on the transcript tail, and until then it refuses every body-only read.

package/scripts/rules/josh-git-bare.ts

@@ -52,12 +52,9 @@ function is_bare_josh_git(command: string): boolean {
 // sibling reasons do.
 const JOSH_GIT_BARE_REASON =
 	'⛔ bare `pnpm josh git`: this prompts to confirm the staging, and with no TTY the prompt falls to ' +
-	'its cancel branch — `Checking unstaged files... Found` then `Operation cancelled.` — so the call ' +
-	'throws away the time it takes to fail (about 31 seconds in one measured lane) and you reissue it ' +
-	'with `-y` anyway (joshuafolkken/kit#2297). Run it unattended from the start: ' +
-	'`pnpm josh git -y "<title> #<N>"`. The recovery form that opens the PR for a push that already ' +
-	'landed is `pnpm josh git -y --skip-commit --skip-push`. This rule fires on every occurrence, not ' +
-	'once per run.'
+	'its cancel branch. Run `pnpm josh git -y "<title> #<N>"`, or ' +
+	'`pnpm josh git -y --skip-commit --skip-push` to open the PR for a push that already landed. It ' +
+	'fires on every occurrence.'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `is_trigger` reads the input through
 // `on_bash_command` — the `Bash` tool-name gate every command row shares — and `decide` returns true so

package/scripts/rules/lane-background.ts

@@ -109,9 +109,9 @@ function foreground_input(
 	call: GuardedCall,
 	is_lane_child: () => boolean = () => lane_child_marker.is_child_of(process.cwd()),
 ): Record<string, unknown> | undefined {
-	if (!is_backgrounded_ship(call) || !json_value.is_record(call.input)) return undefined
-
-	if (!is_lane_child()) return undefined
+	if (!is_backgrounded_ship(call) || !json_value.is_record(call.input) || !is_lane_child()) {
+		return undefined
+	}
 
 	return { ...call.input, [BACKGROUND_KEY]: false, [TIMEOUT_KEY]: FOREGROUND_TIMEOUT_MS }
 }
@@ -119,7 +119,7 @@ function foreground_input(
 const FOREGROUND_NOTE =
 	'lane background: this lane child backgrounded `josh ship`, which would die with the headless turn ' +
 	'before its supervisor exists — so it was run in the foreground instead, where it detaches itself ' +
-	'after the preflight. End the turn on `launched` / `busy` (joshuafolkken/kit#3154).'
+	'after the preflight. End the turn on `launched` / `busy`.'
 
 // The launches `launched_ids` reads off the transcript tail that never saw their finish. A launch is
 // read off its own tool result and a finish off the harness notice, both by `time_transcript_line`.
@@ -149,26 +149,15 @@ function pending_agent_ids(tail: string): ReadonlyArray<string> {
 
 const LANE_BACKGROUND_REASON =
 	'⛔ lane background: this session is a dispatched lane child (`JOSH_LANE_CHILD`), a headless ' +
-	'`claude -p` process whose background Bash tasks are killed when the turn ends — so a backgrounded ' +
-	'`josh gate` / `josh git` / `josh followup` / `josh ship` never re-invokes you; it dies at `exit code ' +
-	'143` (joshuafolkken/kit#2704, measured on the #2606 child: implementation, review and live ' +
-	'verification done, the run parked instead of merged). Hand the gate-to-merge region to the detached ' +
-	'supervisor instead: `pnpm josh ship --detach --review "<title> #<N>"` (add `--cite <N>`) issued in ' +
-	'the foreground — its preflight runs in this process before the supervisor exists, so a backgrounded ' +
-	'`ship` dies with the turn (joshuafolkken/kit#3027; a backgrounded `ship` issued alone is moved to ' +
-	'the foreground for you, joshuafolkken/kit#3154) — then end the turn on `launched` / `busy`. ' +
-	'`.claude/skills/workflow-commands/chain-rule.md` step 0 is the single source. A ' +
-	'single check you must read before continuing runs in the foreground within the tool timeout; the ' +
-	'commit-push step does not — in a child it too belongs to the detached ship, in either spelling. This ' +
-	'rule fires on every occurrence, not once per run.'
+	'process whose background tasks die when the turn ends. Hand over to ' +
+	'`pnpm josh ship --detach --review "<title> #<N>"`, issued in the foreground, then end the turn on ' +
+	'`launched` / `busy`. It fires on every occurrence ' +
+	'(`.claude/skills/workflow-commands/chain-rule.md` step 0).'
 
 const LANE_BACKGROUND_STOP_REASON =
 	'⛔ lane background stop: this is a dispatched lane child (`JOSH_LANE_CHILD`) and a background task ' +
-	'it launched has not finished — ending this headless turn kills it, and nothing re-invokes you ' +
-	'afterwards (joshuafolkken/kit#2704). Do not send a notification and do not stop: wait for the task ' +
-	'in the foreground and act on its result, or re-issue the work through `pnpm josh ship --detach`, ' +
-	'whose supervisor outlives the turn (`.claude/skills/workflow-commands/chain-rule.md` step 0). Do ' +
-	'not repeat your previous reply.'
+	'it launched has not finished, and ending this turn kills it. Wait for it in the foreground, or ' +
+	're-issue the work through `pnpm josh ship --detach` — do not notify, stop or repeat your reply.'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. It fires on every occurrence (`decide`
 // returns true): a child must never background these, so the route is always the detached ship, never

package/scripts/rules/lane-carry-conflict.ts

@@ -89,25 +89,15 @@ function is_carry_conflict(
 }
 
 // The instruction in the shape a refusal can carry: what the child cannot do, why the record is not a
-// conflict, and the mechanical branch to take instead — continue, never park or ask. **The procedure
-// is named, not restated** — its single sources are `pre-gate-cut.md` and `backlogrun-progress.md` →
-// "The hand-off", and a second copy here would be the clone `CLAUDE.md` prohibits. Apostrophes are
-// avoided so the single-quoted literal needs no escaping, as the sibling reasons do.
+// conflict, and the mechanical branch to take instead — continue, never park or ask. Its history is
+// `docs/maintainers/rule-delivery-rationale.md` → "Why a refusal is the action and the next command".
+// Apostrophes are avoided so the single-quoted literal needs no escaping, as the sibling reasons do.
 const LANE_CARRY_CONFLICT_REASON =
 	'⛔ lane child carry conflict: this session is a dispatched lane child, and ' +
-	'`pnpm josh run:merge` / `pnpm josh run:carry` are the parent backlogrun budget commands — a child ' +
-	'must never run them. The live carry record here belongs to the parent that launched this child, ' +
-	'not to a competing run: the parent holds the one run budget for the repository, and every lane ' +
-	'shares the common git directory it is keyed on, so a live owner a lane child reads is always its ' +
-	'parent (joshuafolkken/kit#2267, measured 2026-09-21 in backlogrun #2252 — a child read run:merge ' +
-	'`busy` as a competitor and parked #2258 unimplemented). Do not run this command, and do not treat ' +
-	'it as a conflict: no `needs-decision`, no `confirmation` Telegram, no question to a person — a ' +
-	'dispatched child cannot ask, and there is nothing to decide. Continue implementing this Issue; the ' +
-	'parent owns the budget and counts the outcome at the return. The procedure is ' +
-	'`.claude/skills/workflow-commands/pre-gate-cut.md` and `backlogrun-progress.md` → "The hand-off". ' +
-	'Live evidence of `run:carry` is taken with a fresh `JOSH_TEMP_ROOT` prefixed to the call, which this ' +
-	'rule lets through (joshuafolkken/kit#3458); `run:merge` is refused under any root, because it also ' +
-	'syncs main, closes lanes and writes to GitHub. This rule fires on every occurrence, not once per run.'
+	'`run:merge` / `run:carry` are the parent budget commands; the live record belongs to the parent, ' +
+	'not to a competing run. Continue implementing this Issue: no `needs-decision`, no Telegram. ' +
+	'Live `run:carry` evidence takes a fresh `JOSH_TEMP_ROOT`; `run:merge` is refused under any root, ' +
+	'on every occurrence.'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `is_trigger` reads the input through
 // `on_bash_command` — the `Bash` tool-name gate every command row shares — and `decide` returns true

package/scripts/rules/lane-interactive-ask.ts

@@ -41,17 +41,12 @@ function is_interactive_ask(
 // `backlogrun-park.md` → "park and continue", and a second copy here would be the clone `CLAUDE.md`
 // prohibits. The one command is spelled so the child is not left to reconstruct it from a doc read.
 const LANE_INTERACTIVE_ASK_REASON =
-	'⛔ lane child interactive ask: this session is a dispatched lane child and cannot ask a person, so ' +
-	'this call is refused. Left to run it would end the turn with nothing on the Issue — the parent then ' +
-	'finds an OPEN Issue with `in-progress` and no question (joshuafolkken/kit#2201; joshuafolkken/kit#2034 ' +
-	'placed the same rule one tool-call too late). Do not ask: park the decision instead. Apply ' +
-	'`needs-decision` and post a comment carrying the question, the options and whether work was stashed — ' +
-	"`gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=needs-decision'` then " +
-	'`pnpm josh issue:comment <N> --body-file <path>` — then send the ' +
-	'`confirmation` Telegram and stop. The procedure is ' +
-	'`.claude/skills/workflow-commands/pre-gate-cut.md` → "A lane child records its park before it stops", ' +
-	'and the park itself is `backlogrun-park.md` → "park and continue". This rule fires on every ' +
-	'occurrence, not once per run.'
+	'⛔ lane child interactive ask: this session is a dispatched lane child and cannot ask a ' +
+	'person, so park instead: ' +
+	"`gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=needs-decision'`, " +
+	'`pnpm josh issue:comment <N> --body-file <path>`, ' +
+	'the `confirmation` Telegram, stop. It fires on every occurrence ' +
+	'(`.claude/skills/workflow-commands/pre-gate-cut.md`, `backlogrun-park.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `decide` returns true so it refuses every
 // occurrence; it declares no `keeps` — not asking is the absence of a call, not a call, so the row is

package/scripts/rules/lane-park.ts

@@ -108,19 +108,11 @@ function records_the_park(command: string): boolean {
 // single source is `backlogrun-park.md` → "park and continue", and a second copy here would be the
 // clone `CLAUDE.md` prohibits.
 const LANE_PARK_REASON =
-	'⛔ lane child park: this session is a dispatched lane child, and a stop that waits on a person must ' +
-	'leave the question on the Issue before it sends this Telegram — otherwise the parent finds an OPEN ' +
-	'Issue with `in-progress` and no question, and a person cannot tell what to answer ' +
-	'(joshuafolkken/kit#2034 measured this twice in one run). The child is the only process that knows ' +
-	'the question, the options and whether it stashed, so it records the park itself rather than leaving ' +
-	'the parent to guess from a log. Before you notify and stop: apply `needs-decision` and post a ' +
-	'comment carrying the question, the options, and whether work was stashed — ' +
-	"`gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=needs-decision'` then " +
-	'`pnpm josh issue:comment <N> --body-file <path>`. If this stop is a ' +
-	'`needs-human-review` or `already-done` one, that label is already on the Issue and there is nothing ' +
-	'to add. Then reissue this notify — it fires once per run and cannot repeat on the call in hand. The ' +
-	'procedure is `.claude/skills/workflow-commands/pre-gate-cut.md` → "A lane child records its park ' +
-	'before it stops", and the park itself is `backlogrun-park.md` → "park and continue".'
+	'⛔ lane child park: this session is a dispatched lane child, so a stop for a person parks first: ' +
+	"`gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=needs-decision'`; " +
+	'`pnpm josh issue:comment <N> --body-file <path>` (question, options, stash); a ' +
+	'`needs-human-review` / `already-done` stop already is. Reissue this notify, once per run ' +
+	'(`.claude/skills/workflow-commands/pre-gate-cut.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. **Once per run rather than `decide`, and
 // no `already_satisfied`.** The stop ends the turn, so it is not the recurring act `decide` is for. It carries no `already_satisfied` because the park it asks for is a GitHub label a

package/scripts/rules/lane-split-park.ts

@@ -101,13 +101,8 @@ function decide(_call: unknown, run: GuardRun): boolean {
 
 const LANE_SPLIT_PARK_REASON =
 	'⛔ lane split park: this session is a dispatched lane child that promoted its own Issue to an epic ' +
-	'this run, and a split is not a park — do not apply `needs-decision` to the promoted epic and do not ' +
-	'send a `confirmation` Telegram. The parent reads an open Issue carrying `epic` as a split and ' +
-	'continues through its children; a question here has nobody to answer it (joshuafolkken/kit#3296, ' +
-	'measured 2026-10-06 when the child for #3255 parked its promoted epic). If what remains of the ' +
-	'original work needs a person, park that child issue instead, then end the turn. The procedure is ' +
-	'`.claude/skills/workflow-commands/backlogrun-park.md` → "Splitting a child mid-run". This rule fires ' +
-	'on every occurrence, not once per run.'
+	'this run, and a split is not a park: no `needs-decision` on the epic, no `confirmation` Telegram, ' +
+	'on every occurrence. Park a child issue if the rest needs a person, else end the turn (`.claude/skills/workflow-commands/backlogrun-park.md` → "Splitting a child mid-run").'
 
 // It declares no `keeps`: not parking is the absence of a call, so the row is reported unmeasured
 // rather than scored on an act that does not exist (`lane-carry-conflict.ts`).

package/scripts/rules/lane-switch-main.ts

@@ -61,8 +61,12 @@ const FLAG_PREFIX = '-'
 function switch_target(segment: string): string | undefined {
 	const call = git_argv.parse(segment)
 
-	if (call?.subcommand !== SWITCH_SUBCOMMAND) return undefined
-	if (call.args.some((argument) => NON_COLLIDING_FLAGS.has(argument))) return undefined
+	if (
+		call?.subcommand !== SWITCH_SUBCOMMAND ||
+		call.args.some((argument) => NON_COLLIDING_FLAGS.has(argument))
+	) {
+		return undefined
+	}
 
 	return call.args.find((argument) => !argument.startsWith(FLAG_PREFIX))
 }
@@ -103,16 +107,9 @@ function is_switch_away_from_lane(
 // prohibits. Apostrophes are avoided so the single-quoted literal needs no escaping, as the siblings do.
 const LANE_SWITCH_MAIN_REASON =
 	'⛔ lane child on `git switch main`: this session is a dispatched lane child, and switching to the ' +
-	'default branch here always fails — a lane is a linked work tree, the primary checkout holds the ' +
-	'default branch, and git allows one branch in one work tree at a time (`fatal: main is already used ' +
-	'by worktree at <the primary checkout>`, measured 11 times in the 2026-09-21 backlogrun). Do not ' +
-	'switch: the lane is already on its own issue branch, branched from a fresh default before it opened, ' +
-	'and the latest default is brought in during the gate by `pnpm josh main:merge`. So skip this step ' +
-	'and keep implementing on the current branch — no `git switch`, no `git pull`. `pnpm josh main:sync` ' +
-	'(`josh ms`) is refused in a lane for the same reason, and a lane is finished with `pnpm josh ' +
-	'lane:close <issue-number>`. The parent runs `pnpm josh ms` in the primary checkout ' +
-	'before each lane opens, never the child — `backlogrun-lanes.md` and `backlogrun-child.md` are the ' +
-	'single sources. This rule fires on every occurrence, not once per run.'
+	'default branch here always fails (`already used by worktree`: the primary checkout holds it). Skip ' +
+	'this step and keep implementing on the current branch; `pnpm josh main:merge` brings the default ' +
+	'in during the gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `is_trigger` reads the input through
 // `on_bash_command` — the `Bash` tool-name gate every command row shares — and `decide` returns true so

package/scripts/rules/oracle-consulted.ts

@@ -48,11 +48,10 @@ function command_line(oracle: Oracle): string {
 // the single source of the procedure.
 function reason_for(oracle: Oracle, firing_point: FiringPoint): string {
 	return (
-		`⛔ decision oracle not consulted: this is ${firing_point.describes}, but the run has not run ` +
-		`\`${command_line(oracle)}\` first — the oracle that decides ${oracle.decision.toLowerCase()}. ` +
-		`It answers ${oracle.vocabulary.join(' | ')}; single source ${oracle.single_source}. Reissue ` +
-		`after running it and reading its verdict. Every such call is refused until that command is on ` +
-		`the transcript.`
+		`⛔ decision oracle not consulted: this is ${firing_point.describes}. Run ` +
+		`\`${command_line(oracle)}\` first — it decides ${oracle.decision.toLowerCase()} and answers ` +
+		`${oracle.vocabulary.join(' | ')} (${oracle.single_source}). Every such call is refused until ` +
+		`that command is on the transcript.`
 	)
 }
 

package/scripts/rules/piped-verification.ts

@@ -73,20 +73,16 @@ function is_masked_verification(command: string): boolean {
 	return time_shell.discarded_commands(command).some((segment) => is_verification_command(segment))
 }
 
-// The masking, the two ways out of it and the boundary, in the shape a refusal can carry. **The way
+// The masking and the ways out of it, in the shape a refusal can carry; the boundary is the topic file's. **The way
 // out travels with the refusal rather than being named**, because a delivery saying only "do not pipe
 // it" leaves the caller with the same long output and no sanctioned way to read it, which is what put
 // the pipe there in the first place.
 const PIPED_VERIFICATION_REASON =
 	"⛔ piped verification: a pipeline exits with its last command's status, so `pnpm josh gate | " +
-	'tail` reports success on a gate that failed, and the verdict is discarded before anything reads ' +
-	'it. Run the check without the pipe — josh prints its verdict line last, so the harness output cap ' +
-	'keeps it even when the middle is elided. Where the output genuinely has to be narrowed, redirect ' +
-	'it to a file and read ranges from that file, or prefix `set -o pipefail` so the pipeline carries ' +
-	"the check's status. Read the printed verdict either way, never the exit code alone. Read-only " +
-	'listings are untouched — this fires only on a command whose result means pass or fail. The rule ' +
-	'is in `prompts/collaboration-workflow/output-bounds.md`. Reissue this call with no pipe — it ' +
-	'fires once per run and cannot repeat on the call in hand.'
+	'tail` reports success on a gate that failed. Reissue this call with no pipe (josh prints its ' +
+	'verdict last), or redirect it to a file and read ranges from that file, or prefix ' +
+	'`set -o pipefail`; read the verdict line, never the exit code alone ' +
+	'(`prompts/collaboration-workflow/output-bounds.md`).'
 
 // Every command position on the line: the chain cut `shell_segments` makes, each piece of a pipeline
 // inside it taken on its own.
@@ -129,26 +125,34 @@ function keeps_verdict_intact(command: string): boolean {
 // `grep` stopping at its first match — closes the pipe on a check still writing, and under `pipefail` the
 // check's SIGPIPE turns a passing run into exit 141; `head` also cuts the verdict line josh prints last.
 //
-// **Every command on the line is a josh check or a filter after one.** The rewrite answers `allow`, so
-// anything else chained beside the check — `&& rm -r dist`, or a `git log | head` never written for
-// `pipefail` — would skip the permission prompt it would otherwise meet. Those lines are refused as before.
+// **Each masked check is wrapped on its own, and the rest of the line runs as typed.** Most of the
+// refusals left after #3570 were a check chained beside other work — `vitest …; pnpm josh lint:related
+// | tail -5; git status` — so the check's own pipeline becomes `(set -o pipefail; …)` and nothing else
+// on the line is put under a `pipefail` it was not written for (joshuafolkken/kit#3875). The envelope
+// carries no permission decision (`hook_decision.flow_rewrite_envelope`), so whatever else the line runs
+// meets its own permission prompt exactly as the typed call would have.
 //
-// **The raw line is read for what the cut cannot see.** `segments_of` does not split on a lone `&`, and
-// `time_shell.unquoted` blanks a double-quoted `$(…)`, so `| tail & curl …`, `| tail > ~/.zshrc` and
-// `| grep "$(cmd)"` all look like a filter after a check. Any `&`, redirection, backtick or `$(` beyond
-// the `&&` chain and the check's own `2>&1` leaves the line to the refusal.
-const PIPEFAIL_PREFIX = 'set -o pipefail; '
+// **The check's own pipeline is read for what the cut cannot see.** `parts_of` does not split on a lone
+// `&`, so `| tail & curl …`, `| tail > ~/.zshrc` and `| tail -n $(cmd)` look like a filter after a check.
+// Any `&`, redirection, backtick or `$(` there beyond the check's own `2>&1` leaves the line to the
+// refusal, as does a heredoc anywhere on it, whose body lines the cut would read as commands. An
+// unquoted `(` or `)` does too: the cut splits inside a group, so `(cd x && pnpm josh lint) | tail` would
+// wrap the inner check and leave the group's own pipe without `pipefail`.
+const PIPEFAIL_OPEN = '(set -o pipefail; '
+const PIPEFAIL_CLOSE = ')'
+const COMMENT_START = /(?:^|\s)#/u
 const FULL_READING_FILTER = /^(?:tail|grep)\b/u
 const EARLY_EXIT_GREP =
 	/^grep\b.*\s(?:-[a-zA-Z]*[lLmq]|--(?:quiet|silent|max-count|files-with(?:out)?-match))/u
 
 const ALLOWED_OPERATORS = /2>&1|&&/gu
 const SIDE_EFFECT_SYNTAX = /[&<>`]|\$\(/u
+const GROUP_SYNTAX = /[()]/u
 
 const PIPEFAIL_NOTE =
-	'↻ piped verification: the josh check was piped, so `set -o pipefail;` was prefixed and the call ran ' +
-	"with the check's status carried to the exit code. Read the printed verdict, never the exit code " +
-	'alone — `prompts/collaboration-workflow/output-bounds.md` (joshuafolkken/kit#3570).'
+	'↻ piped verification: the josh check was piped, so its pipeline was wrapped in ' +
+	"`(set -o pipefail; …)` to carry the check's status, and the rest of the line ran as typed. Read " +
+	'the printed verdict, never the exit code alone — `prompts/collaboration-workflow/output-bounds.md`.'
 
 function reads_to_the_end(piece: string): boolean {
 	return FULL_READING_FILTER.test(piece) && !EARLY_EXIT_GREP.test(piece)
@@ -164,23 +168,69 @@ function has_side_effect_syntax(command: string): boolean {
 	return SIDE_EFFECT_SYNTAX.test(command.replaceAll(ALLOWED_OPERATORS, ' '))
 }
 
-function is_pipefail_rewritable(command: string): boolean {
-	return (
-		is_masked_verification(command) &&
-		!has_side_effect_syntax(command) &&
-		pipelines_of(command).every((pipeline) => is_filtered_check(pipeline))
-	)
+// The side-effect syntax is read on the typed part, since a double-quoted `$(cmd)` still runs; the pipe
+// cut and the grouping are read on the blanked one, since a quoted `|` or `(` is text.
+function is_rewritable_part(raw: string, judged: string): boolean {
+	const pipeline = judged.split('|').map((piece) => piece.trim())
+
+	return !has_side_effect_syntax(raw) && !GROUP_SYNTAX.test(judged) && is_filtered_check(pipeline)
+}
+
+// Where the part's code ends: an unquoted `#` opens a comment, which would swallow the closing `)`.
+function code_end(judged: string): number {
+	const comment = COMMENT_START.exec(judged)
+
+	return comment === null ? judged.length : comment.index
+}
+
+// The part with its surrounding whitespace and any trailing comment kept outside the subshell, so the
+// line reads as typed.
+function wrapped(raw: string, judged: string): string {
+	const code = raw.slice(0, code_end(judged))
+	const core = code.trim()
+	const lead = code.slice(0, code.indexOf(core))
+
+	return `${lead}${PIPEFAIL_OPEN}${core}${PIPEFAIL_CLOSE}${raw.slice(lead.length + core.length)}`
+}
+
+// One part of the line as it will run: as typed where it masks nothing, wrapped where it masks a check a
+// wrapper can carry, and `undefined` where it masks one no wrapper can.
+function rewritten_part(raw: string, judged: string): string | undefined {
+	if (!is_masked_verification(judged)) return raw
+
+	return is_rewritable_part(raw, judged) ? wrapped(raw, judged) : undefined
 }
 
-// The call's input with the prefix in front, or `undefined` where the call is not a rewritable masking.
+// The command with every masked check wrapped, judged on the quote-blanked line and cut from the typed
+// one at the same offsets — a `|` inside `grep -E "a|b"` is text, and the typed line keeps its quotes.
+function pipefail_command(command: string): string | undefined {
+	const judged = time_shell.blanked(command)
+
+	if (judged === undefined || !is_masked_verification(command)) return undefined
+
+	const offset = { at: 0 }
+	const parts = shell_segments.parts_of(judged).map((part) => {
+		const raw = command.slice(offset.at, offset.at + part.length)
+
+		offset.at += part.length
+
+		return rewritten_part(raw, part)
+	})
+
+	const rewritten = parts.includes(undefined) ? undefined : parts.join('')
+
+	// A line masked as a whole but in no part wraps nothing, so no note may claim a wrap.
+	return rewritten === command ? undefined : rewritten
+}
+
+// The call's input with each masked check wrapped, or `undefined` where the call is not a rewritable
+// masking.
 function pipefail_input(call: GuardedCall): Record<string, unknown> | undefined {
 	if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return undefined
 
-	const command = time_shell.bash_command(call.input)
-
-	if (!is_pipefail_rewritable(command)) return undefined
+	const command = pipefail_command(time_shell.bash_command(call.input))
 
-	return { ...call.input, command: `${PIPEFAIL_PREFIX}${command}` }
+	return command === undefined ? undefined : { ...call.input, command }
 }
 
 const piped_verification = {