@joshuafolkken/kit 1.1455.0 → 1.1514.0

package/scripts/rules/shell-body-trigger.ts

@@ -187,12 +187,10 @@ function carries_a_body(command: string): boolean {
 // (`git-force.ts`, `lane-carry-conflict.ts`).
 const SHELL_BODY_REASON =
 	'⛔ shell-evaluated body: this command carries a body inline in double quotes, and that body ' +
-	'contains a backtick or a `$`, so the shell runs it — the text is executed rather than merely ' +
-	'mangled (joshuafolkken/kit#1198). Write the body to a file and pass it by path: `pnpm josh ' +
-	'issue:comment <N> --body-file <path>`, `pnpm josh followup --notify-message-file <path>`, or ' +
-	"`--body-file <path>` wherever offered. `$'…'` quoting is the other safe form; the rule and the " +
-	"trigger's blind spots are in `prompts/collaboration-workflow/shell-body.md`. Reissue this call " +
-	'once the body is in a file — it fires once per run and cannot repeat on the call in hand.'
+	'contains a backtick or a `$`, so the shell executes it. Reissue this call once the body is in a ' +
+	'file, passed by path (`pnpm josh issue:comment <N> --body-file <path>`, ' +
+	"`--notify-message-file <path>`), or use `$'…'` quoting " +
+	'(`prompts/collaboration-workflow/shell-body.md`).'
 
 const shell_body_trigger = {
 	SHELL_BODY_REASON,

package/scripts/rules/shell-segments.ts

@@ -14,12 +14,32 @@ import { time_shell } from '#scripts/time-runtime/time-shell'
 // because `sleep 1200 &` is an armed timer sent to the background and has to be seen as one. That is
 // a different question about a different character, not a second copy of this answer.
 const SEGMENT_SEPARATOR = /&&|\|\||;|\n/u
+const SEGMENT_PARTS = new RegExp(`(${SEGMENT_SEPARATOR.source})`, 'u')
 
 /** The line's commands, trimmed. Empty segments are kept: a caller anchoring at `^` rejects them. */
 function segments_of(command: string): Array<string> {
 	return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim())
 }
 
+/** The same cut, untrimmed and with each separator kept between its commands, so the parts join back to the line. */
+function parts_of(command: string): Array<string> {
+	return command.split(SEGMENT_PARTS)
+}
+
+/**
+ * The line's first command as the shell runs it — cut where the quote-blanked line puts the first
+ * separator, so one inside a quoted string does not cut it — or `undefined` for a heredoc line.
+ */
+function first_of(command: string): string | undefined {
+	const plain = time_shell.blanked(command)
+
+	if (plain === undefined) return undefined
+
+	const cut = plain.search(SEGMENT_SEPARATOR)
+
+	return (cut === -1 ? command : command.slice(0, cut)).trim()
+}
+
 // **Both spellings match, and the expansion is not this file's.** `josh_command_of` expands the alias
 // in the command it reads, so `pnpm josh ga` arrives as `josh gate` and a caller's canonical set
 // matches it as it is. Widening as well would be a second copy of one rule, and the caller that
@@ -35,7 +55,9 @@ function is_josh_command(segment: string, names: ReadonlySet<string>): boolean {
 }
 
 const shell_segments = {
+	first_of,
 	is_josh_command,
+	parts_of,
 	segments_of,
 }
 

package/scripts/rules/stop-decision.ts

@@ -0,0 +1,77 @@
+// What a held stop is waiting on, read from records rather than guessed from prose
+// (joshuafolkken/kit#3961): the decision lines the reply states, and whether the person's own prompt
+// this turn was a question.
+//
+// **The recommended choice is the reply's, never a fixed placeholder.** A `confirmation` reaches a
+// person away from the session, and "read the reply" tells them nothing about what they are asked to
+// decide. The reply names it on a line of its own — `Recommended: <choice>`, with an optional
+// `Alternative: <choice>` — the same two fields `josh notify` takes, so the hook copies them rather
+// than inferring them.
+//
+// **A turn the person opened with a question is answered in the session they are at.** Its stop is
+// the answer, not a pause, so a Telegram saying "confirmation required" only buries the ones that are.
+
+interface StopDecision {
+	recommended: string
+	alternative: string | undefined
+}
+
+// A label may close its emphasis before or after the colon: `**Recommended:**`, `**Recommended**:`.
+const RECOMMENDED_LABEL = /^recommended[*_]*:/iu
+const ALTERNATIVE_LABEL = /^alternative[*_]*:/iu
+// The list bullet and the Markdown emphasis a decision line may be written with. Emphasis is
+// stripped only at the edges of the label and the choice: an underscore inside a choice belongs to
+// a `snake_case` name the person is asked to approve.
+const LEADING_EMPHASIS = /^[*_]+/u
+const TRAILING_EMPHASIS = /(?<![*_])[*_]+$/u
+const BULLET = /^[-*]\s+/u
+
+// A prompt that ends asking: a question mark, or a Japanese sentence-final question particle, before
+// any trailing full stop or space.
+const QUESTION_ENDING = /(?:[?？]|か|かな|かね)[\s。.]*$/u
+
+function unwrapped(text: string): string {
+	return text.trim().replace(LEADING_EMPHASIS, '').replace(TRAILING_EMPHASIS, '').trim()
+}
+
+function bare_line(line: string): string {
+	return unwrapped(line.trim().replace(BULLET, ''))
+}
+
+// The choice on the reply's first line labelled `label`, or `undefined` when none carries one.
+function choice_of(message: string, label: RegExp): string | undefined {
+	const line = message
+		.split('\n')
+		.map((one) => bare_line(one))
+		.find((one) => label.test(one))
+	const choice = line === undefined ? undefined : unwrapped(line.replace(label, ''))
+
+	return choice === '' ? undefined : choice
+}
+
+// The decision the reply asks for, or `undefined` when it names no recommended choice.
+function decision_of(message: string): StopDecision | undefined {
+	const recommended = choice_of(message, RECOMMENDED_LABEL)
+	if (recommended === undefined) return undefined
+
+	return { recommended, alternative: choice_of(message, ALTERNATIVE_LABEL) }
+}
+
+function is_question(prompt: string): boolean {
+	return QUESTION_ENDING.test(prompt.trim())
+}
+
+// **A held stop with no decision line is sent back once rather than announced.** Either it waits on a
+// person and has to say on what, or it waits on nobody and the notify would be the noise this rule
+// exists to end; only the run can tell which, so the reason hands it both answers.
+const DECISION_REASON =
+	'⛔ stop decision: this working tree is held by your run and your reply names no decision. If the ' +
+	'run waits on a person, end the reply with a `Recommended: <choice>` line and, where there is ' +
+	'one, an `Alternative: <choice>` line — the hook sends the `confirmation` Telegram from them. If ' +
+	'it waits on nobody, continue the run, or say in one line that nothing is awaited. Do not repeat ' +
+	'your previous reply.'
+
+const stop_decision = { DECISION_REASON, decision_of, is_question }
+
+export type { StopDecision }
+export { stop_decision }

package/scripts/rules/stop-rules.ts

@@ -4,6 +4,7 @@ import { filing_offer } from './filing-offer'
 import { issue_citation } from './issue-citation'
 import { lane_background } from './lane-background'
 import { reply_language } from './reply-language'
+import { stop_decision, type StopDecision } from './stop-decision'
 
 // The stop-time rules, delivered on the `Stop` hook.
 //
@@ -19,11 +20,14 @@ import { reply_language } from './reply-language'
 // permission envelope. The stop guard is a second *entry* on the one foundation, exactly as
 // `pretool-guard` is one — not a second copy of the plumbing.
 //
-// **Every rule refuses**. Missing the stop notification or leaving a hold
-// on a clean tree costs a person a silent wait or a trampled tree; a bare `#N` in the reply reaches
-// the person watching but not the model that could fix it, so it too blocks — `{"decision":"block"}`
-// is the one channel a `Stop` hook has to the model, and `stop_hook_active` caps a false positive at a
-// single wasted turn. The detection is tightened to match (`issue-citation.ts`, `filing-offer.ts`).
+// **A rule whose answer is fixed acts; only a rule that needs judgement refuses** (joshuafolkken/kit#3919).
+// The stop notification, the hold release and the citation lines are each one mechanical operation the
+// hook can run itself, so they come back as `actions` and the stop goes through: a refusal is a whole
+// model turn spent re-reading the context to run a command the hook already knew. `stop-actions.ts`
+// runs them, and only an action that fails falls back to its refusal. The rest — the reply's language,
+// an unattended filing offer, a lane's index request or running task, a headless parent's wait — need
+// the model, so they still block with `{"decision":"block"}`, the one channel a `Stop` hook has to it;
+// `stop_hook_active` caps a false positive at a single wasted turn.
 
 const SWITCH_ENV_KEY = 'JOSH_STOP_GUARD'
 const BLOCK_DECISION = 'block'
@@ -40,14 +44,22 @@ type StopPayload = z.infer<typeof stop_payload_schema>
 
 // What one stop looks like to the rules, computed once by the CLI from the payload and the world.
 interface StopContext {
-	// The `run:hold` record for this working tree is still in place (`held` or `stale`).
-	hold_present: boolean
+	// The Issue the `run:hold` record for this working tree names (`held` or `stale`) — `new` for an
+	// unnumbered entry — or `undefined` when no record is in place.
+	hold_issue: string | undefined
+	// That record is this session's own run's, or its owner cannot be told (`run-hold-session.ts`). A
+	// hold another run took is that run's pause to announce and release, never this session's.
+	hold_owned: boolean
+	// The person opened this turn with a question: the reply answers someone at the session, not a
+	// pause waiting on them (`stop-decision.ts` → `is_question`).
+	answers_question: boolean
 	// `git status --porcelain` came back empty.
 	tree_clean: boolean
 	// That record carries a `prrun` stop mark: the run stopped at a green pull
 	// request and keeps the hold over a clean tree on purpose, so a person can look before it merges.
 	prrun_stopped: boolean
-	// A `confirmation` notify is on this run's transcript tail.
+	// A `confirmation` notify is on this run's transcript tail, or the hook's own send is recorded on the
+	// hold since the pause began (`run-hold-session.ts` → `is_notified_since`).
 	notified: boolean
 	// The turn's session-facing reply text.
 	message: string
@@ -56,7 +68,8 @@ interface StopContext {
 	// This stop already forced a continuation earlier in the prompt — the loop-breaker Claude Code
 	// documents, so a run that will not comply is not blocked forever.
 	stop_hook_active: boolean
-	// A pre-gate cut record is in place for this work tree. A dispatched lane child ends its turn at
+	// This turn ended at a cut — its record is in place, or this turn relaunched the successor that may
+	// already have cleared it (`stop-guard.ts` → `is_cut_stop`). A dispatched lane child ends its turn at
 	// the cut holding the tree by design and hands off to a fresh process (`pre-gate-cut.md`), so that
 	// turn-end is an automatic continuation, not the person-waiting pause the block rules are for.
 	cut_pending: boolean
@@ -90,38 +103,44 @@ interface StopContext {
 	backlog_parent: boolean
 }
 
+// The operations the hook runs itself instead of refusing — each carries what it acts on.
+type StopAction =
+	| { kind: 'notify'; issue: string; message: string; decision: StopDecision }
+	| { kind: 'release'; issue: string }
+	| { kind: 'cite'; references: ReadonlyArray<string> }
+
+// `reason` refuses the stop; otherwise `actions` run, and `blocks_on_failure` says whether a failed one
+// falls back to its refusal — never past the loop-breaker.
 interface StopOutcome {
 	reason: string | undefined
+	actions: ReadonlyArray<StopAction>
+	blocks_on_failure: boolean
 }
 
-const NO_OUTCOME: StopOutcome = { reason: undefined }
+const NO_OUTCOME: StopOutcome = { reason: undefined, actions: [], blocks_on_failure: false }
 
 // **A mid-workflow stop is announced off-screen before it happens.** `CLAUDE.md` → "Mid-workflow stop
 // notification" requires the `confirmation` Telegram before any pause; the hold is what says a run is
-// mid-workflow, and the transcript is what says the notify was sent.
+// mid-workflow, and the transcript is what says the notify was sent. The hook sends it; this reason is
+// only the fallback for a send that failed.
 const STOP_NOTIFY_REASON =
 	'⛔ mid-workflow stop notification: this working tree is still held by a run and no `confirmation` ' +
-	'Telegram was sent this turn, so a person is being left to wait off-screen without knowing the run ' +
-	'paused. `CLAUDE.md` → "Mid-workflow stop notification" requires ' +
+	'Telegram was sent this turn. Send ' +
 	'`pnpm josh notify --task-type confirmation --issue-url "<url>" --body=$\'<reason>\' ' +
-	'--recommended "<choice>" --alternative "<choice>"` before any ' +
-	'mid-workflow pause. Send it, then end with a one-line confirmation that it was sent — do not repeat ' +
-	'your previous reply. This fires only while the hold is held and no notify is on the transcript, and ' +
-	'`stop_hook_active` lets a second stop through so a run is never wedged.'
+	'--recommended "<choice>" --alternative "<choice>"` (`CLAUDE.md` → "Mid-workflow stop ' +
+	'notification"), then confirm in one line that it was sent — do not repeat your previous reply.'
 
 // **A clean tree that still holds is a tree the next run will trample.** `working-tree-hold.md`: a stop that
 // leaves the tree clean releases the hold; a `halfrun` pre-commit stop and a `needs-human-review` stop
 // keep it because their tree is dirty, which is why this row is silent whenever the tree is not clean.
+// The hook releases it; this reason is only the fallback for a release that failed.
 const HOLD_RELEASE_REASON =
 	'⛔ working-tree hold not released: this working tree is clean but its `run:hold` record is still in ' +
-	'place, so the next run here runs `pnpm josh ms` believing the tree is free while ' +
-	'you hold it. The workflow-commands skill → `working-tree-hold.md`: a stop that leaves the tree clean ' +
-	'releases the hold with `pnpm josh run:release <N>` (bare for a `new` entry). A `halfrun` ' +
-	'pre-commit stop and a `needs-human-review` stop keep the hold because their tree is dirty, and a ' +
-	'`prrun` stop keeps it by its stop mark — this row is silent there. Release it, then end with a one-line confirmation that it was released — do ' +
-	'not repeat your previous reply.'
-
-// **A refusal that corrects rather than advises**. The bare `#N` is already
+	'place. Release it with `pnpm josh run:release <N>` (bare for a `new` entry; ' +
+	'`working-tree-hold.md`), then confirm in one line that it was released — do not repeat your ' +
+	'previous reply.'
+
+// **The fallback when the hook could not print the citation lines itself**. The bare `#N` is already
 // on screen and the hook cannot unsay it, so the reason does the one thing that helps the *next* reply:
 // it names the numbers it detected and hands over the exact `issue:cite` call that prints the
 // paste-ready lines, then asks for the corrected citation lines alone — not the whole reply reissued.
@@ -149,13 +168,10 @@ function build_citation_reason(references: ReadonlyArray<string>): string {
 // first**: there the offer is the correct reply, so `needs_filing` is silent.
 const FILING_OFFER_REASON =
 	'⛔ filing offer: your reply offers to file an Issue instead of filing it, and this run is ' +
-	'unattended — nobody is there to answer. Filing into a first-party repository there is Tier A — ' +
-	"the trigger is the judgement that it is worth filing, not the run's progress (the " +
-	'workflow-commands skill → `observation-filing.md`). Run ' +
-	'`pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2>` — it scouts, lints, labels and ' +
-	'runs `epic:bundle` itself — then end with the one-line citation of what was filed; do not repeat ' +
-	'your previous reply. If it is not worth filing ' +
-	'after all, say so in one line instead.'
+	'unattended — nobody is there to answer. Run ' +
+	'`pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2>` (Tier A, ' +
+	'`observation-filing.md`), then end with the one-line citation of what was filed; do not repeat ' +
+	'your previous reply. If it is not worth filing after all, say so in one line instead.'
 
 // **A headless parent's turn-end is its process's end**. Under `claude -p` the
 // background waits die with the turn, so the lanes lose their parent and nothing re-invokes it. The
@@ -176,12 +192,10 @@ const HEADLESS_REFUSAL_CAP = 3
 const HEADLESS_WAIT_CALLS = ['"command":"pnpm josh lane:await']
 
 const HEADLESS_WAIT_BODY =
-	' this is a `claude -p` `backlogrun` parent (`JOSH_RUN_HEADLESS`) with lanes still ' +
-	'in flight, and ending this turn ends the process — its background waits are killed with it and the ' +
-	"lanes are left without a parent. Do not watch them yourself: the `run:wake` supervisor's driver " +
-	'watches the lanes and wakes a session only for a branch that needs judging. Hand the loop back with ' +
+	' this is a `claude -p` `backlogrun` parent with lanes in flight, and ending this turn kills the ' +
+	'process and its background waits. Hand the loop back with ' +
 	'`pnpm josh run:carry --cut --owner "$PPID"` (or `--end` when the run is over), then end the turn ' +
-	'(`backlogrun-progress.md` → "Picking the lanes up in the fresh session").'
+	'(`backlogrun-progress.md`).'
 
 const HEADLESS_WAIT_REASON = `${HEADLESS_WAIT_MARKER}${HEADLESS_WAIT_BODY}`
 
@@ -195,11 +209,9 @@ const PERMISSION_PATTERN = /許可|承認|permission|approve|approval|authorizat
 
 const LANE_INDEX_REASON =
 	'⛔ lane index permission: this is a dispatched lane child (`JOSH_LANE_CHILD`) and your reply asks ' +
-	"a person for permission to change the git index. A lane is a per-run work tree with no person's " +
-	'staging to protect, and the sanctioned commit flow is already authorized: remove any conflict ' +
-	'markers, then run `pnpm josh git -y`, which stages and commits them — a conflicted merge included. ' +
-	'This is Tier A (`.claude/skills/workflow-commands/chain-rule.md` → "origin/main is merged in before ' +
-	'the gate"). Do it and continue the run — do not repeat your previous reply.'
+	'a person for permission to change the git index. That is Tier A here (`chain-rule.md`): remove any ' +
+	'conflict markers, run `pnpm josh git -y` (it stages and commits, a conflicted merge included) and ' +
+	'continue the run — do not repeat your previous reply.'
 
 function asks_index_permission(message: string): boolean {
 	return INDEX_COMMAND_PATTERN.test(message) && PERMISSION_PATTERN.test(message)
@@ -259,42 +271,52 @@ function needs_filing(context: StopContext): boolean {
 //
 // **A lane handed to the detached ship stands them down too**: the hold now
 // belongs to the supervisor driving the merge, and the person hears from that supervisor's own notify.
+//
+// **Another run's hold stands them down as well**: the pause and the claim are that run's.
 function is_held_idle(context: StopContext): boolean {
-	return context.hold_present && !context.agent_pending && !context.handed_off
+	if (context.hold_issue === undefined || !context.hold_owned) return false
+
+	return !context.agent_pending && !context.handed_off
 }
 
+// **A stop that answers the person's question is no pause** (joshuafolkken/kit#3961): they are reading
+// the reply where it was written, whatever the tree's hold says.
 function needs_notify(context: StopContext): boolean {
-	return is_held_idle(context) && !context.notified
+	return is_held_idle(context) && !context.notified && !context.answers_question
 }
 
-function needs_release(context: StopContext): boolean {
-	return is_held_idle(context) && context.tree_clean && !context.prrun_stopped
+// The notify a stop owes but cannot send: its reply names no decision to announce.
+function needs_decision(context: StopContext): boolean {
+	return needs_notify(context) && stop_decision.decision_of(context.message) === undefined
 }
 
-function citation_reason(context: StopContext): string | undefined {
-	const references = issue_citation.unquoted_references(context.message, context.prompt)
-	if (references.length === 0) return undefined
-
-	return build_citation_reason(references)
+function needs_release(context: StopContext): boolean {
+	return is_held_idle(context) && context.tree_clean && !context.prrun_stopped
 }
 
-// The two rules on how a reply is written. **A headless agent's reply has no reader**:
-// its text lands in a stream-json log, so correcting its citations or its
-// language costs a turn and reaches nobody. The artifacts a person does read — a Telegram, an Issue, a
-// pull request — are held to the same rules by their own guards, not here.
-function wording_reason(context: StopContext): string | undefined {
-	if (context.headless_agent) return undefined
+// The bare references the citation lines are printed for. **A headless agent's reply has no reader**:
+// its text lands in a stream-json log, so correcting its citations or its language costs a turn and
+// reaches nobody. The artifacts a person does read — a Telegram, an Issue, a pull request — are held
+// to the same rules by their own guards, not here.
+function bare_references(context: StopContext): ReadonlyArray<string> {
+	if (context.headless_agent) return []
 
-	return citation_reason(context) ?? language_reason(context)
+	return issue_citation.unquoted_references(context.message, context.prompt)
 }
 
-// The three rules that read the reply itself, filing offer first and the language last. A drifted reply
+// The two rules that read the reply and need the model, the filing offer first. A drifted reply
 // refused for another reason is not rewritten, but the drift still ends: `block_envelope` appends the
 // session-language note to every refusal, so the turn it continues is written in the session language.
 function reply_reason(context: StopContext): string | undefined {
 	if (needs_filing(context)) return FILING_OFFER_REASON
+	if (context.headless_agent) return undefined
+
+	return language_reason(context)
+}
 
-	return wording_reason(context)
+// Sent back once; past the loop-breaker the run has said nothing is awaited, and nothing is sent.
+function decision_reason(context: StopContext): string | undefined {
+	return needs_decision(context) ? stop_decision.DECISION_REASON : undefined
 }
 
 // The headless wait holds past the loop-breaker until the spin bound is reached.
@@ -319,24 +341,56 @@ function needs_background_wait(context: StopContext): boolean {
 	return context.lane_child && context.background_pending
 }
 
-// The two hold rules, notify ahead of release — behind the lane index route
-// and the lane background wait, since the notify they would ask for announces
-// a pause the run has no reason to take.
-function hold_reason(context: StopContext): string | undefined {
+// The two lane rules that mean the run is not pausing at all — ahead of every action, since the notify
+// would announce a pause the run has no reason to take.
+function lane_reason(context: StopContext): string | undefined {
 	if (needs_index_route(context)) return LANE_INDEX_REASON
 	if (needs_background_wait(context)) return lane_background.LANE_BACKGROUND_STOP_REASON
-	if (needs_notify(context)) return STOP_NOTIFY_REASON
-	if (needs_release(context)) return HOLD_RELEASE_REASON
 
 	return undefined
 }
 
-// First-wins across every rule. Two things stand every rule down: `stop_hook_active` (the
-// loop-breaker, so a run that already got one continuation this prompt may stop) and a pre-gate cut in
-// flight (a lane child's automatic turn-end, not a person-waiting pause). The two hold rules keep their
-// order ahead of the reply rules, so a stop that both still owes its notify and holds a bare `#N` still
-// reports the notify first; the filing offer goes ahead of the citation, since the filing it forces
-// produces the citation the reply then needs.
+// The refusals that need the model: the lane rules alone, else the reply's own and the decision
+// together. **Joined, since the loop-breaker grants one continuation**: a decision refusal queued behind
+// a language or filing refusal would never be sent, and its stop would pass with no notify.
+function model_reason(context: StopContext): string | undefined {
+	const lane = lane_reason(context)
+	if (lane !== undefined) return lane
+
+	const reasons = [reply_reason(context), decision_reason(context)].filter(
+		(reason) => reason !== undefined,
+	)
+
+	return reasons.length === 0 ? undefined : reasons.join('\n\n')
+}
+
+// The notify carries the reply's own decision; a reply with none sends nothing (`needs_decision`).
+function notify_actions(context: StopContext, issue: string): Array<StopAction> {
+	const decision = stop_decision.decision_of(context.message)
+	if (decision === undefined || !needs_notify(context)) return []
+
+	return [{ kind: 'notify', issue, message: context.message, decision }]
+}
+
+function hold_actions(context: StopContext): Array<StopAction> {
+	const issue = context.hold_issue
+	if (issue === undefined) return []
+
+	const notify = notify_actions(context, issue)
+
+	return needs_release(context) ? [...notify, { kind: 'release', issue }] : notify
+}
+
+// The actions in the order they run: the notify ahead of the release that ends the hold it reports.
+function stop_actions(context: StopContext): ReadonlyArray<StopAction> {
+	const references = bare_references(context)
+	const cite: Array<StopAction> = references.length > 0 ? [{ kind: 'cite', references }] : []
+
+	return [...hold_actions(context), ...cite]
+}
+
+// First-wins across the refusals. `stop_hook_active` is the loop-breaker, so a run that already got one
+// continuation this prompt may stop; the lane rules go first, then the filing offer, then the language.
 //
 // **The headless wait comes first and outlasts `stop_hook_active` up to its spin bound**.
 // The loop-breaker exists so a person is not wedged behind a rule the run will not satisfy; a headless
@@ -347,18 +401,49 @@ function block_reason(context: StopContext): string | undefined {
 	if (is_headless_held(context)) return HEADLESS_WAIT_REASON
 	if (context.stop_hook_active || context.cut_pending) return undefined
 
-	return hold_reason(context) ?? reply_reason(context)
+	return model_reason(context)
+}
+
+// **The actions run only on the stop that goes through**, so a refused stop never notifies a pause its
+// continuation then cancels, while the continuation's own stop, past the loop-breaker, still runs them
+// and a failure there no longer refuses. A lane child still waiting on its own work runs none, and a
+// pre-gate cut in flight stands everything but the headless wait down: it is a lane child's automatic
+// turn-end, not a person-waiting pause.
+function runs_actions(context: StopContext, reason: string | undefined): boolean {
+	return reason === undefined && !context.cut_pending && lane_reason(context) === undefined
 }
 
 function stop_outcome(context: StopContext): StopOutcome {
-	return { reason: block_reason(context) }
+	const reason = block_reason(context)
+	if (!runs_actions(context, reason)) return { ...NO_OUTCOME, reason }
+
+	const actions = stop_actions(context)
+	if (actions.length === 0) return NO_OUTCOME
+
+	return { reason, actions, blocks_on_failure: !context.stop_hook_active }
+}
+
+// The refusal an action falls back to when the hook could not run it.
+function fallback_reason(action: StopAction): string {
+	if (action.kind === 'notify') return STOP_NOTIFY_REASON
+	if (action.kind === 'release') return HOLD_RELEASE_REASON
+
+	return build_citation_reason(action.references)
 }
 
 // The documented shape a `Stop` hook blocks with: `reason` is fed back to Claude, which then continues
 // instead of stopping. Plain stdout is not it — only this envelope holds the stop. Every reason leaves
 // with the session-language note, so no rule can hand the model an English-only turn.
-function block_envelope(reason: string, lang: string): string {
-	return JSON.stringify({ decision: BLOCK_DECISION, reason: `${reason} ${language_note(lang)}` })
+// `notice` is what the hook already did on this stop, shown to the person alongside.
+function block_envelope(reason: string, lang: string, notice?: string): string {
+	const refusal = { decision: BLOCK_DECISION, reason: `${reason} ${language_note(lang)}` }
+
+	return JSON.stringify(notice === undefined ? refusal : { ...refusal, systemMessage: notice })
+}
+
+// The shape a `Stop` hook shows the person a line in without holding the stop: `systemMessage` alone.
+function notice_envelope(notice: string): string {
+	return JSON.stringify({ systemMessage: notice })
 }
 
 function parse_stop_payload(raw_payload: string): StopPayload | undefined {
@@ -384,10 +469,12 @@ const stop_rules = {
 	block_envelope,
 	build_language_reason,
 	count_headless_refusals,
+	fallback_reason,
 	is_enabled,
+	notice_envelope,
 	parse_stop_payload,
 	stop_outcome,
 }
 
-export type { StopContext, StopOutcome }
+export type { StopAction, StopContext, StopOutcome }
 export { stop_rules }

package/scripts/rules/tail-commands.ts

@@ -30,6 +30,20 @@ function prior_bash_commands(tail: string): ReadonlyArray<string> {
 	return tail.split('\n').flatMap((line) => bash_commands_of(line))
 }
 
-const tail_commands = { is_bash_use, prior_bash_commands }
+// **Whether a call `is_call` names answered with the `token` line** — the call and its own result
+// paired off parsed blocks, so a transcript that merely quotes the command or the token does not
+// count. An unreadable text reads as no answer.
+function answered(text: string, is_call: (command: string) => boolean, token: string): boolean {
+	const blocks = time_transcript_line.parse_text(text).flatMap((line) => line.blocks)
+	const call_ids = new Set(
+		blocks
+			.filter((block) => is_call(time_shell.bash_command(block.input)))
+			.map((block) => block.id),
+	)
+
+	return blocks.some((block) => call_ids.has(block.result_id) && block.token_lines.includes(token))
+}
+
+const tail_commands = { answered, is_bash_use, prior_bash_commands }
 
 export { tail_commands }

package/scripts/rules/test-declared-commit.ts

@@ -30,16 +30,10 @@ function is_untested_commit(call: GuardedCall): boolean {
 
 const REASON =
 	'⛔ test declared: this commits a runtime code change with no test beside it — `pnpm josh ' +
-	'test:declared` reads the working tree as `required` (a changed file that is neither a test — ' +
-	'`*.test.ts` / `*.e2e.ts` — nor a mechanically-exempt non-runtime path). `CLAUDE.md` → Code ' +
-	'Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor ' +
-	'gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an ' +
-	'E2E. Add the declared test and reissue this commit. **If the change genuinely touches no ' +
-	'executable runtime path** it is the pre-approved non-runtime exception — declare it in your Step ' +
-	'0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and ' +
-	'reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the ' +
-	'files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` → ' +
-	'"配送されている規則". This fires once per run, so reissuing will not repeat on the call in hand.'
+	'test:declared` reads it `required` and names the files. Tests are required for ALL code changes: ' +
+	'add the test and reissue, or, for a change that touches no runtime path, declare the non-runtime ' +
+	'exception in your Step 0 work summary and reissue. It fires once per run (`CLAUDE.md` → Code ' +
+	'Change Rules).'
 
 // The enumeration row itself, so `delivered-rules.ts` spreads one entry rather than restating the
 // trigger and reason it already single-sources here. Once per run (the default delivery) for the

package/scripts/rules/third-party-write.ts

@@ -103,16 +103,11 @@ function writes_third_party(
 // to do instead. The command that computes the party is handed over, because the whole point of this
 // Issue is that the test is computed rather than judged.
 const THIRD_PARTY_WRITE_REASON =
-	'⛔ third-party write: this `gh api` call writes to a repository whose owner is not this session — ' +
-	'a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) ' +
-	'needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, ' +
-	'is not that instruction (`CLAUDE.md` → "Third-party repositories are Tier C", ' +
-	'`prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with ' +
-	'`pnpm josh repo:party <owner/repo>` — owner equality, computed not judged. A read (`-X GET`, or no ' +
-	'field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or ' +
-	'`-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact ' +
-	'for a person to post — do not publish it yourself. **This rule fires on every occurrence, not once ' +
-	'per run.**'
+	'⛔ third-party write: this `gh api` call writes to a repository whose owner is not this session, ' +
+	'which is Tier C and needs explicit current-turn user instruction. Check with ' +
+	'`pnpm josh repo:party <owner/repo>`, then record the finding on our own Issue and draft the ' +
+	'artifact for a person to post. This rule fires on every occurrence ' +
+	'(`prompts/collaboration-workflow/upstream-interrupt.md`).'
 
 // `decide` returns true so it refuses every occurrence; it declares no `keeps` — not writing to
 // another owner's tracker is the absence of a call, not a call, so the row is reported unmeasured

package/scripts/rules/worktree-guard.ts

@@ -124,18 +124,11 @@ function is_unauthorized_worktree_change(command: string): boolean {
 // and — for a stash — the message form that is allowed. `pnpm josh git` and `pnpm josh stash:pop` are
 // invisible to this trigger, so a run that uses them is never refused.
 const WORKTREE_MUTATION_REASON =
-	'⛔ unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced ' +
-	'`git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree ' +
-	'shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run ' +
-	'them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm ' +
-	'josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane ' +
-	'divert. A stash push is authorized only inside a documented flow and only with a findable message ' +
-	'— `git stash push -u -m "<message>"` — which this row allows; a bare `git stash`, a message-less ' +
-	'push, or `pop` / `apply` / `drop` is refused. A plan that restores a handed-over stash with `git ' +
-	'stash apply` / `git stash pop` is read as `pnpm josh stash:pop "<message>"`: apply it that way, ' +
-	'continue, and record the substitution on the Issue — Tier A, never a `needs-decision` park ' +
-	'unless the plan says why the owner keeps the stash: then stop and confirm (`operating-rules.md` ' +
-	'→ "no-self-staging"). **This rule fires on every occurrence, not once per run.**'
+	'⛔ unauthorized working-tree change: `git checkout --`, `git restore`, `git clean -f`, ' +
+	'`git stash`. A documented flow stashes with `git stash push -u -m "<message>"`; a handed-over ' +
+	'stash is `pnpm josh stash:pop "<message>"`; record the substitution on the Issue (Tier A) unless ' +
+	'the plan says why the owner keeps the stash: then stop and confirm. It fires on every occurrence ' +
+	'(`operating-rules.md`).'
 
 const ROW = {
 	id: 'worktree-mutation',