@joshuafolkken/kit 1.1471.0 → 1.1514.0

package/scripts/run/board/run-board-state.ts

@@ -1,4 +1,5 @@
 import type { NamedPlan } from '#scripts/backlog/backlog-plan'
+import type { BudgetWait } from '#scripts/gate/core-wait'
 import type { MachineSample } from '#scripts/gate/machine-capacity'
 import type { ClosedAnswer, ClosedIssue } from './run-board-closed'
 import type { Fetch } from './run-board-fetch'
@@ -21,6 +22,8 @@ interface BoardPorts {
 	// `undefined` when no run has started here.
 	read_local: () => Promise<LocalRead | undefined>
 	read_machine: () => Promise<MachineSample>
+	// The claims waiting in the core budget, read on the machine's second; none where it is not given.
+	read_waits?: (() => Array<BudgetWait>) | undefined
 	// Every process and its lane, the last reading's lanes reused (`run-board-usage-read.ts`).
 	read_usage: (before: UsageMark | undefined) => Promise<UsageMark | undefined>
 	// The issues that answered as closed, and whether every issue answered (`run-board-closed.ts`).
@@ -85,6 +88,7 @@ interface BoardState {
 	// them.
 	usage: UsageMark | undefined
 	usages: LaneUsages | undefined
+	budget_waits: ReadonlyArray<BudgetWait>
 	// The reviewers drawn above the legend, the read of them in flight, and when it was last launched.
 	thanks: Thanks
 	thanks_fetch: Fetch<Thanks> | undefined
@@ -112,6 +116,7 @@ const FRESH_STATE: BoardState = {
 	spots: [],
 	usage: undefined,
 	usages: undefined,
+	budget_waits: [],
 	thanks: [],
 	thanks_fetch: undefined,
 	thanks_attempted_ms: undefined,

package/scripts/run/board/run-board-status.ts

@@ -17,11 +17,17 @@ import { run_board_setup, type SetupRead } from './run-board-setup'
 // statuses are laid over is the slow GitHub half, and so is what a child that left the open listing
 // answers when read closed.
 
-type ItemState = 'running' | 'merged' | 'parked' | 'done' | 'waiting' | 'human' | 'stopped'
+type ItemState =
+	'running' | 'merged' | 'parked' | 'done' | 'waiting' | 'human' | 'stopped' | 'withdrawn'
 
 interface ItemStatus {
 	state: ItemState
+	// When the child first launched in this run — a re-dispatch or a restart does not move it, so the
+	// row's time is the lane's whole time.
 	started_ms?: number | undefined
+	// The child's newest launch, present only where it launched again after `started_ms` — what the
+	// GitHub read is weighed against.
+	launched_ms?: number | undefined
 	ended_ms?: number | undefined
 	// The seat-free lane label (`lane <N>`) of a running child, when it holds one — the running test reads
 	// it; the board does not draw it.
@@ -61,25 +67,40 @@ const ENDING_STATES: Readonly<Partial<Record<string, ItemState>>> = {
 	[KIND.PARK]: 'parked',
 	[KIND.SPLIT]: 'done',
 	[KIND.STOP]: 'done',
+	[KIND.WITHDRAW]: 'withdrawn',
 }
 // A cut or a resume says the child is still running, on whatever phase it had reached.
 const CONTINUING_KINDS: ReadonlySet<string> = new Set([KIND.CUT, KIND.RESUME])
-// A person's restart starts the child over in a fresh session, so its track starts over too.
+// A person's restart, and a re-dispatch after an outage, start the child over in a fresh session, so
+// its track starts over too; its time does not (`launched`).
 const LAUNCH_KINDS: ReadonlySet<string> = new Set([KIND.CHILD_LAUNCH, KIND.RESTART])
 // What the GitHub read may still settle: a running child, and one whose lane has no child left in it —
 // a child that merged and then died is drawn merged, not stopped.
 const UNSETTLED_STATES: ReadonlySet<ItemState> = new Set(['running', 'stopped'])
+// A parked child waits on a person, who may close its issue after the park; only a closed read settles
+// it again, so one still open stays parked whatever its labels say (joshuafolkken/kit#3958).
+const PARKED_STATE: ItemState = 'parked'
 
 function moment(event: RunEvent): number {
 	return Date.parse(event.at)
 }
 
-function launched(event: RunEvent): ItemStatus {
+// The newest launch carried on, where the child launched more than once.
+function relaunch_of(status: ItemStatus | undefined): Pick<ItemStatus, 'launched_ms'> {
+	const launched_ms = status?.launched_ms
+
+	return launched_ms === undefined ? {} : { launched_ms }
+}
+
+// joshuafolkken/kit#3971: a launch keeps the start of the child's first one in this run.
+function launched(previous: ItemStatus | undefined, event: RunEvent): ItemStatus {
 	const at_ms = moment(event)
+	const started_ms = previous?.started_ms ?? at_ms
 
 	return {
 		state: 'running',
-		started_ms: at_ms,
+		started_ms,
+		...(started_ms !== at_ms && { launched_ms: at_ms }),
 		track: [run_board_phase.LAUNCHED_PHASE],
 		phase_ms: at_ms,
 	}
@@ -98,7 +119,12 @@ function moved(previous: ItemStatus, track: ReadonlyArray<Phase>, event: RunEven
 function settled_as(previous: ItemStatus | undefined, state: ItemState): ItemStatus {
 	const track = previous?.track
 
-	return { state, started_ms: previous?.started_ms, ...(track !== undefined && { track }) }
+	return {
+		state,
+		started_ms: previous?.started_ms,
+		...relaunch_of(previous),
+		...(track !== undefined && { track }),
+	}
 }
 
 function ended(previous: ItemStatus | undefined, state: ItemState, event: RunEvent): ItemStatus {
@@ -108,7 +134,7 @@ function ended(previous: ItemStatus | undefined, state: ItemState, event: RunEve
 function continued(previous: ItemStatus | undefined): ItemStatus {
 	const { started_ms, track, phase_ms } = previous ?? {}
 
-	return { state: 'running', started_ms, track, phase_ms }
+	return { state: 'running', started_ms, ...relaunch_of(previous), track, phase_ms }
 }
 
 // A stage line carrying its attempt redraws the track of any child launched on this stream — a settled
@@ -143,7 +169,7 @@ function advanced(previous: ItemStatus | undefined, event: RunEvent): ItemStatus
 
 // One event folded into the status of the child it names; an event the board does not track keeps it.
 function next_status(previous: ItemStatus | undefined, event: RunEvent): ItemStatus | undefined {
-	if (LAUNCH_KINDS.has(event.kind)) return launched(event)
+	if (LAUNCH_KINDS.has(event.kind)) return launched(previous, event)
 
 	const ending = ENDING_STATES[event.kind]
 
@@ -165,8 +191,9 @@ function fold_events(events: ReadonlyArray<RunEvent>): Map<number, ItemStatus> {
 	return statuses
 }
 
-// A lane is this run's only when its issue is on the run's stream or in the run's plan, so a lane left
-// over from an earlier day is not drawn as this run's child.
+// A lane is this run's only when its issue is on the run's stream or in `in_run`, so a lane left over
+// from an earlier day is not drawn as this run's child. `in_run` leaves out a planned issue whose lane
+// an earlier run dispatched (`run-board-github.ts`).
 function is_running_lane(
 	issue: number,
 	status: ItemStatus | undefined,
@@ -227,9 +254,14 @@ function is_listed_closed(issue: number, read: OpenRead): boolean {
 	return read.open_numbers !== undefined && !read.open_numbers.has(issue)
 }
 
-// The listing was read after the child launched, so what it says about the child is this run's.
+// When the child last launched — what a GitHub read is weighed against.
+function launch_ms(status: ItemStatus): number | undefined {
+	return status.launched_ms ?? status.started_ms
+}
+
+// The listing was read after the child last launched, so what it says about the child is current.
 function is_read_after_launch(status: ItemStatus, read: OpenRead): boolean {
-	return read.read_ms !== undefined && (status.started_ms ?? 0) <= read.read_ms
+	return read.read_ms !== undefined && (launch_ms(status) ?? 0) <= read.read_ms
 }
 
 // A child launched before the listing was read and missing from it has closed since.
@@ -257,26 +289,30 @@ function labelled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus
 
 // A close dated before the launch is an earlier life of the issue, not how this run's child ended.
 function is_closed_before_launch(status: ItemStatus, closed: ClosedIssue): boolean {
-	if (closed.closed_ms === undefined || status.started_ms === undefined) return false
+	const launch = launch_ms(status)
+
+	if (launch === undefined || closed.closed_ms === undefined) return false
+
+	return closed.closed_ms < launch
+}
+
+function closed_state(closed: ClosedIssue): ItemState {
+	if (closed.is_merged) return 'merged'
 
-	return closed.closed_ms < status.started_ms
+	return closed.is_not_planned ? 'withdrawn' : 'done'
 }
 
-// A running child read closed ends when GitHub says it closed, merged or not.
+// A child read closed ends when GitHub says it closed — merged, withdrawn as not planned, or done.
 function closed_status(
 	status: ItemStatus,
 	closed: ClosedIssue | undefined,
 ): ItemStatus | undefined {
 	if (closed === undefined || is_closed_before_launch(status, closed)) return undefined
 
-	const state = closed.is_merged ? 'merged' : 'done'
-
-	return { ...settled_as(status, state), ended_ms: closed.closed_ms }
+	return { ...settled_as(status, closed_state(closed)), ended_ms: closed.closed_ms }
 }
 
-function settled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus {
-	if (!UNSETTLED_STATES.has(status.state)) return status
-
+function unsettled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus {
 	const from_closed = closed_status(status, read.closed.get(issue))
 
 	if (from_closed !== undefined) return from_closed
@@ -286,11 +322,26 @@ function settled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus
 	return labelled(issue, status, read)
 }
 
+// The closed read is kept for the run, so a parked child a person reopened since is told apart by the
+// listing holding it again.
+function parked_settled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus {
+	if (read.open_numbers?.has(issue) === true) return status
+
+	return closed_status(status, read.closed.get(issue)) ?? status
+}
+
+function settled(issue: number, status: ItemStatus, read: OpenRead): ItemStatus {
+	if (status.state === PARKED_STATE) return parked_settled(issue, status, read)
+
+	return UNSETTLED_STATES.has(status.state) ? unsettled(issue, status, read) : status
+}
+
 // **The stream stays the source of truth; the listing only unsticks it.** A child whose merge never
 // reached the stream would read as running forever, so a running child the plan's open listing no
 // longer holds is drawn finished instead — merged and timed once GitHub was read for it, finished
 // without a time while that read has not answered. One the listing still holds is drawn as its labels
-// say, so a child that stopped with no parent to record it does not read as running.
+// say, so a child that stopped with no parent to record it does not read as running. A parked child is
+// settled again only by a closed read.
 function settle_closed(
 	statuses: ReadonlyMap<number, ItemStatus>,
 	read: OpenRead,

package/scripts/run/board/run-board-tick.ts

@@ -82,8 +82,10 @@ async function resample(state: BoardState, ports: BoardPorts, now_ms: number): P
 	const at_ms = ports.now()
 	const machine = { sample: await ports.read_machine(), at_ms }
 	const gauges = run_board_machine.gauges_of(state.machine, machine)
+	const budget_waits = ports.read_waits?.() ?? []
+	const usages = await read_usages(state, ports)
 
-	return { ...state, ...(await read_usages(state, ports)), machine, gauges, sampled_ms: now_ms }
+	return { ...state, ...usages, machine, gauges, budget_waits, sampled_ms: now_ms }
 }
 
 // The state of the run on screen; a different run starts its plan state from nothing, so no row, count
@@ -136,6 +138,7 @@ function planned_layout(state: BoardState, plan: BoardPlan, local: LocalRead): B
 		statuses,
 		events: local.events,
 		free_lanes: local.free_lanes,
+		occupied_lanes: local.occupied_lanes,
 		is_stopped: activity_here(local).is_stopped,
 	})
 
@@ -192,6 +195,7 @@ function header_of(
 		is_plan_loading: state.plan_fetch !== undefined,
 		machine: state.gauges,
 		usages: state.usages,
+		budget_waits: state.budget_waits,
 		form: redraw.ports.form,
 		repo: state.plan?.context.repo,
 		spinner: redraw.ports.is_tty ? SPOT : undefined,

package/scripts/run/cut/run-cut-cli.ts

@@ -61,6 +61,7 @@ const {
 	report_held_cut,
 	report_incomplete,
 	report_over,
+	report_relaunched_cut,
 	report_reviewer,
 	report_stale,
 	report_under_threshold,
@@ -124,7 +125,7 @@ function relaunch(target: string, lane: LaneInfo, phase: string): number {
 
 	if (notes.length > 0) console.error(notes.join('\n'))
 
-	return report(CUT_VERDICT, SUCCESS_EXIT_CODE)
+	return report_relaunched_cut()
 }
 
 const { is_lane_branch } = run_cut_ready
@@ -199,7 +200,7 @@ async function finish_cut(target: string, lane: LaneInfo, request: CutRequest):
 	if (refused !== undefined) return refused
 
 	return lane_relaunch.is_openai_lane(lane)
-		? report(CUT_VERDICT, SUCCESS_EXIT_CODE)
+		? report_relaunched_cut()
 		: relaunch(target, lane, request.phase)
 }
 

package/scripts/run/cut/run-cut-report.ts

@@ -148,6 +148,20 @@ function report_held_cut(issue: string): number {
 	return report(CUT_VERDICT, SUCCESS_EXIT_CODE)
 }
 
+// **A cut that relaunched its successor says so on this session's own transcript** (joshuafolkken/kit#3936).
+// The successor's `run:cut --resume` can clear the record before this session's turn ends, so the
+// `Stop` hook cannot tell a cut stop by the record alone; it reads this line off the turn instead, a
+// fact no other process can remove. The held cut never prints it — a person resumes that one. **A bare
+// token line**, so it is read off the `run:cut` call's own result (`cost-run-cut.ts`), and a turn that
+// merely quotes it is not read as a relaunch.
+const RELAUNCHED_CUT_MARKER = 'cut-relaunched'
+
+function report_relaunched_cut(): number {
+	console.error(RELAUNCHED_CUT_MARKER)
+
+	return report(CUT_VERDICT, SUCCESS_EXIT_CODE)
+}
+
 // **An implementation cut is never resumed by a session over the threshold**.
 // The cut outside a lane leaves the session that took it open, so a person retyping `fullrun #N` there
 // would be answered `resume-impl`, keep implementing over the threshold, and be cut again on the next
@@ -174,6 +188,7 @@ const run_cut_report = {
 	INCOMPLETE_VERDICT,
 	NOT_A_LANE_VERDICT,
 	OVER_VERDICT,
+	RELAUNCHED_CUT_MARKER,
 	RESUME_IMPL_VERDICT,
 	RESUME_VERDICT,
 	STALE_VERDICT,
@@ -191,6 +206,7 @@ const run_cut_report = {
 	report_held_cut,
 	report_incomplete,
 	report_over,
+	report_relaunched_cut,
 	report_reviewer,
 	report_stale,
 	report_under_threshold,

package/scripts/run/detached-launch.ts

@@ -4,6 +4,7 @@ import { agent_launch_environment } from '#scripts/agent/agent-launch-environmen
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
 import { agent_session_environment } from '#scripts/josh/agent-session-environment'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import { launch_priority } from '#scripts/run/launch-priority'
 
 // Starting a process that outlives this one, and keeping what it writes.
 //
@@ -34,13 +35,18 @@ const UNSAFE_NOTE =
 //
 // A NUL byte is what `execve` treats as the end of a string, so a value carrying one executes as a
 // prefix of itself; the other control characters have no business in a command line and their presence
-// means the value did not come from where it was supposed to.
+// means the value did not come from where it was supposed to. **An agent's prompt is the one element a
+// line break belongs in** — a ship-stop prompt carries the failed output's lines — so a vector marked
+// `ends_with_prompt` lets it into its last element alone (joshuafolkken/kit#3964).
 //
 // The shared value validation lives with the role policy so environment overrides and argv elements
 // cannot disagree about which control characters or lengths are safe.
 interface LaunchArgv {
 	command: string
 	args: ReadonlyArray<string>
+	// Set by an agent argv builder, whose prompt is the last element: that one element may carry line
+	// breaks (`is_safe_prompt`), and every other element is checked as before.
+	ends_with_prompt?: boolean
 }
 
 type LaunchResult = { kind: 'launched'; pid: number } | { kind: 'failed'; note: string }
@@ -65,12 +71,23 @@ interface LaunchRequest {
 	profile?: AgentProfile | undefined
 }
 
-const { is_safe_value } = agent_role_profile
+const { is_safe_prompt, is_safe_value } = agent_role_profile
+const LAST = -1
+
+// An agent vector's prompt, the last element, may break lines; every other element is a value.
+function is_safe_element(argv: LaunchArgv, value: string, index: number): boolean {
+	const is_prompt = argv.ends_with_prompt === true && index === argv.args.length + LAST
+
+	return is_prompt ? is_safe_prompt(value) : is_safe_value(value)
+}
 
 // The single gate every argument vector passes before it reaches the operating system, whoever
 // composed it.
 function is_safe_argv(argv: LaunchArgv): boolean {
-	return is_safe_value(argv.command) && argv.args.every((value) => is_safe_value(value))
+	return (
+		is_safe_value(argv.command) &&
+		argv.args.every((value, index) => is_safe_element(argv, value, index))
+	)
 }
 
 function note_of(error: unknown): string {
@@ -251,6 +268,7 @@ async function attached_spawn(
 		child.once('exit', (exit_code) => {
 			resolve({ kind: 'completed', pid: child.pid ?? 0, exit_code })
 		})
+		launch_priority.lower(child.pid)
 		notify_spawn(child.pid, on_spawn, on_error)
 	})
 }
@@ -287,6 +305,7 @@ function spawned(
 		on_error(note_of(error))
 	})
 	child.unref()
+	launch_priority.lower(child.pid)
 
 	return child.pid === undefined ? { kind: 'failed', note: NO_PID_NOTE } : launched(child.pid)
 }
@@ -341,5 +360,5 @@ const detached_launch = {
 	note_of,
 }
 
-export type { LaunchArgv, LaunchRequest, LaunchResult }
+export type { AttachedLaunchResult, LaunchArgv, LaunchRequest, LaunchResult }
 export { detached_launch }

package/scripts/run/entry/run-entry-cli.ts

@@ -22,6 +22,7 @@ import {
 } from '#scripts/run/run-stage'
 import { run_stage_read, type StageRead } from '#scripts/run/run-stage-read'
 import { run_step } from '#scripts/run/run-step'
+import { run_step_section } from '#scripts/run/run-step-section'
 import { run_entry, type EntryParts } from './run-entry'
 import { run_entry_stop } from './run-entry-stop'
 
@@ -259,7 +260,13 @@ async function proceed(issue_number: string, hold: string, cost: string): Promis
 	// update is measured against (`issue-watch.ts`).
 	await issue_watch.record_baseline_here(issue_number)
 
-	return emit({ issue_number, hold, cost, verdict: reads.verdict, report: reads.report })
+	const code = emit({ issue_number, hold, cost, verdict: reads.verdict, report: reads.report })
+
+	// The entry's own read — the split assessment every run answers before its work — printed here so
+	// the reader does not spend a turn fetching it.
+	if (code !== SUCCESS_EXIT_CODE) return code
+
+	return run_step_section.print_section(run_step_section.ENTRY)
 }
 
 async function claim_run(

package/scripts/run/event/run-event-render.ts

@@ -29,6 +29,7 @@ const KIND_LABELS: Readonly<Record<EventKind, KindLabel>> = {
 	cut: { ja: 'セッション交代', en: 'session cut' },
 	resume: { ja: '実装を再開', en: 'implementation resumed' },
 	restart: { ja: '止めて出し直し', en: 'restarted' },
+	withdraw: { ja: '取り下げ', en: 'withdrawn' },
 	drain: { ja: 'バックログが空', en: 'backlog drained' },
 	stop: { ja: '停止', en: 'stopped' },
 	'pr-opened': { ja: 'PR 作成', en: 'PR opened' },

package/scripts/run/event/run-event-scope.ts

@@ -94,6 +94,7 @@ const KIND = run_event_stream.EVENT_KIND
 const BATCH_RECORD_KINDS: ReadonlySet<string> = new Set([
 	KIND.CHILD_LAUNCH,
 	KIND.RESTART,
+	KIND.WITHDRAW,
 	KIND.PARK,
 	KIND.SPLIT,
 	KIND.RETROSPECTIVE,
@@ -167,12 +168,14 @@ function last_issue_event(
 }
 
 // A child's launch and the endings `run:merge` settles it with — the ones `run:board` stops drawing it
-// running on. A park or a split already ran `run:merge`, so a child closed after one owes nothing.
+// running on. A park or a split already ran `run:merge`, so a child closed after one owes nothing; a
+// withdrawal settles the child itself, its issue closed by the person who withdrew it.
 const LAUNCH_OR_SETTLE_KINDS: ReadonlySet<string> = new Set([
 	KIND.CHILD_LAUNCH,
 	KIND.MERGE,
 	KIND.PARK,
 	KIND.SPLIT,
+	KIND.WITHDRAW,
 ])
 
 // Whether this invocation's newest launch of the issue has not yet been settled.
@@ -186,9 +189,24 @@ function is_merge_owed(events: ReadonlyArray<RunEvent>, scope: EventScope, issue
 	return newest?.kind === KIND.CHILD_LAUNCH
 }
 
+function is_launch_or_withdrawal(event: RunEvent, issue: string): boolean {
+	const is_kind = event.kind === KIND.CHILD_LAUNCH || event.kind === KIND.WITHDRAW
+
+	return is_kind && names_issue(event, issue)
+}
+
+// Whether a person withdrew the issue's newest launch (`lane:withdraw`): its newest launch or withdrawal
+// is a withdrawal. A launch after it is a fresh attempt, which the old withdrawal does not settle.
+function is_withdrawn(events: ReadonlyArray<RunEvent>, issue: string): boolean {
+	const newest = events.findLast((event) => is_launch_or_withdrawal(event, issue))
+
+	return newest?.kind === KIND.WITHDRAW
+}
+
 const run_event_scope = {
 	UNKNOWN_EVENT_SCOPE,
 	is_merge_owed,
+	is_withdrawn,
 	issue_named,
 	last_issue_event,
 	last_scoped_event,

package/scripts/run/event/run-event-stream-emit.ts

@@ -113,10 +113,9 @@ async function emit_heartbeat(line: string): Promise<void> {
 	await emit(run_event_stream.EVENT_KIND.HEARTBEAT, line)
 }
 
-// The events of the invocation now running, for a reader restoring the run from its stream
-// (`backlog:drive`). Fail-quiet like the writers: no repository or an unreadable stream is an empty
-// invocation.
-async function current_events(): Promise<ReadonlyArray<RunEvent>> {
+// The events of the invocation now running, `undefined` where the invocation's scope could not be told
+// — for a reader that must not take "no events" for "nothing launched" (`backlog-occupied.ts`).
+async function scoped_current_events(): Promise<ReadonlyArray<RunEvent> | undefined> {
 	try {
 		const repository = await run_carry.repository_directory()
 
@@ -126,12 +125,19 @@ async function current_events(): Promise<ReadonlyArray<RunEvent>> {
 		const scope = run_event_scope.scope_of(read)
 		const events = run_event_stream.read_events(run_event_stream.target_of(repository))
 
-		return run_event_scope.scoped_events(events, scope) ?? []
+		return run_event_scope.scoped_events(events, scope)
 	} catch {
-		return []
+		return undefined
 	}
 }
 
+// The events of the invocation now running, for a reader restoring the run from its stream
+// (`backlog:drive`). Fail-quiet like the writers: no repository, an unreadable stream or an
+// undetermined scope is an empty invocation.
+async function current_events(): Promise<ReadonlyArray<RunEvent>> {
+	return (await scoped_current_events()) ?? []
+}
+
 // The invocation's events for a writer deciding whether a marker is already there: unlike
 // `current_events`, an undetermined scope keeps the whole stream, so a run with no carry record skips a
 // marker it already wrote rather than writing it twice.
@@ -167,6 +173,7 @@ const run_event_stream_emit = {
 	emit_once,
 	emit_once_since,
 	invocation_or_all_events,
+	scoped_current_events,
 	stream_target,
 }
 

package/scripts/run/event/run-event-stream.ts

@@ -64,6 +64,10 @@ const EVENT_KIND = {
 	// (`lane:restart`). It follows the fresh dispatch's `CHILD_LAUNCH`, so it is a launch to the parent and
 	// the board, and — like that launch — a batch record a lane child never reads as its own position.
 	RESTART: 'restart',
+	// A person withdrew a lane child — stopped it and closed its issue as not planned (`lane:withdraw`).
+	// It is written before the stop, so `run:merge` settles the child as withdrawn whatever GitHub says
+	// by the time the parent collects it, and counts it as neither a merge, a failure nor an outage.
+	WITHDRAW: 'withdraw',
 	// The backlog emptied while nothing of the run's own was in flight — the drain. It marks the position
 	// at which the end-of-run retrospective is owed, *before* the idle watch opens, so `run:step` fires
 	// the retrospective at the drain rather than after the watch runs its course. It is not itself a

package/scripts/run/hold/run-hold-session.ts

@@ -0,0 +1,46 @@
+import { stamp_file } from '#scripts/josh/stamp-file'
+import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
+import { run_hold, type RunHold, type SessionOwner } from './run-hold'
+
+// What the `Stop` hook asks of a hold beyond "is one in place" (joshuafolkken/kit#3961): whether it is
+// this session's own run's, and whether its pause was already announced.
+//
+// **Another run's hold is not this session's pause.** A `kickoff`, or a question answered while a
+// `backlogrun` parent holds the same tree, stops in a session that holds nothing — announcing that stop
+// as the held run's "confirmation required" reports a decision nobody is waiting on.
+//
+// **Unknown is this session's own.** A record written outside an agent session, or a hook that cannot
+// read its own session, keeps the behavior the hold had before ownership was recorded: a missed notify
+// costs a person a silent pause, a wrong one only a needless Telegram.
+
+function is_same_start(recorded: string | undefined, own: string | undefined): boolean {
+	return recorded === undefined || own === undefined || recorded === own
+}
+
+function is_session_hold(hold: RunHold, owner: SessionOwner = run_hold.session_owner()): boolean {
+	if (hold.owner_pid === undefined || owner.owner_pid === undefined) return true
+
+	return hold.owner_pid === owner.owner_pid && is_same_start(hold.owner_start, owner.owner_start)
+}
+
+// **A pause is announced once, and a person's prompt ends it.** The hook's own send is recorded on the
+// hold, so a later stop of the same pause — a background notice that woke the session — finds it; a send before `pause_start` belongs to an earlier pause. An unknown start
+// announces again: a needless Telegram costs less than a silent wait.
+function is_notified_since(hold: RunHold, pause_start: string | undefined): boolean {
+	if (pause_start === undefined || hold.notified_at === undefined) return false
+
+	return Date.parse(hold.notified_at) >= Date.parse(pause_start)
+}
+
+// Stamps the send on the record in place; a tree no longer held has nothing to stamp. A stale record is
+// stamped too: the hook reads it as the hold (`hold_of`), so a run past the expiry age still finds its send.
+function mark_notified(target: string, now: Date = new Date()): void {
+	const hold = run_halfrun_resume.hold_of(run_hold.read_hold(target, now))
+	if (hold === undefined) return
+
+	stamp_file.write_stamp(target, { ...hold, notified_at: now.toISOString() })
+}
+
+const run_hold_session = { is_notified_since, is_session_hold, mark_notified }
+
+export { run_hold_session }

package/scripts/run/hold/run-hold.ts

@@ -65,6 +65,10 @@ interface RunHold {
 	// fields, or by a claim made outside an agent session.
 	owner_pid?: number | undefined
 	owner_start?: string | undefined
+	// When the `Stop` hook last sent this run's `confirmation` Telegram — its own send leaves no command
+	// on the transcript, so the record is what keeps one pause from being announced twice
+	// (`run-hold-session.ts`).
+	notified_at?: string | undefined
 }
 
 type HoldRead =
@@ -107,6 +111,7 @@ const run_hold_schema = z.object({
 	prrun_stop_head: z.string().optional(),
 	owner_pid: z.number().optional(),
 	owner_start: z.string().optional(),
+	notified_at: z.string().optional(),
 })
 
 // `undefined` for anything that is not a well-formed record, so the caller decides what a broken one
@@ -342,6 +347,7 @@ const run_hold = {
 	race_message,
 	read_hold,
 	release_hold,
+	session_owner,
 	stale_message,
 	uncommitted_message,
 	unknown_message,
@@ -350,5 +356,5 @@ const run_hold = {
 	write_hold,
 }
 
-export type { HoldRead, RunHold, StopMarkFields }
+export type { HoldRead, RunHold, SessionOwner, StopMarkFields }
 export { run_hold }

package/scripts/run/launch-priority.ts

@@ -0,0 +1,32 @@
+import { setPriority } from 'node:os'
+
+// **A launched session runs below the interactive one, so a saturated machine still answers the
+// user.** Every headless session and everything it starts — gates, tests, builds — used to share the
+// interactive session's priority, and at a load of ~30 the lanes took the terminal's responsiveness
+// with them (#3947). The niceness is set on the child right after `spawn` returns: a process inherits
+// its parent's niceness at fork, and an agent CLI boots for far longer than this takes before it forks
+// anything, so every descendant inherits it. Efficiency-core confinement (`taskpolicy -b`) is not
+// used — it throttles a lane far beyond yielding to the user.
+const LANE_NICENESS = 10
+
+type SetPriority = (pid: number, priority: number) => void
+
+// **A priority that cannot be lowered starts the session as before.** A platform without the call, or
+// a child that already runs at a lower priority than this, is not a reason to fail the launch.
+function lower(pid: number | undefined, set_priority: SetPriority = setPriority): void {
+	if (pid === undefined) return
+
+	try {
+		set_priority(pid, LANE_NICENESS)
+	} catch {
+		// the session keeps the priority it was started with
+	}
+}
+
+const launch_priority = {
+	LANE_NICENESS,
+	lower,
+}
+
+export type { SetPriority }
+export { launch_priority }