@joshuafolkken/kit 1.1514.0 → 1.1784.0

package/scripts/agent/api-auth.ts

@@ -0,0 +1,41 @@
+import { agent_exit_record } from './agent-exit-record'
+import type { ClaudeResultEvent } from './claude-result-event'
+
+// Whether a Claude session's exit record is an authentication failure — measured on 2026-10-19, when
+// an expired OAuth session ended three lane children with `Failed to authenticate: OAuth session
+// expired and could not be refreshed` and the parent parked each as a child that stopped on its own
+// (joshuafolkken/kit#4216).
+//
+// **Kept apart from `api-outage.ts`**: an outage clears on its own, so its child is re-dispatched; an
+// authentication failure lasts until a person runs `/login`, so every dispatch fails the same way and
+// the run has to stop instead. The read is the same mechanical one — the error flag AND a fixed
+// marker in the harness's own `reason`, never the marker alone.
+
+// Matched against `reason`, which carries the record's `result` text — the observed record's
+// `error: 'authentication_failed'` code is not decoded, so it is no marker here.
+const AUTH_MARKERS: ReadonlyArray<string> = ['failed to authenticate']
+
+// The fixed sentence a stop caused by an authentication failure carries, so the tooling that reads a
+// stop back (`run-ship-stop-cause.ts`) tells it from a review finding by this text, not by guessing.
+const AUTH_FAILURE_NOTE = 'the session could not authenticate — a person has to run /login'
+
+function is_auth_failure(record: ClaudeResultEvent | undefined): boolean {
+	if (record === undefined || !record.is_error || record.reason === undefined) return false
+
+	const lower = record.reason.toLowerCase()
+
+	return AUTH_MARKERS.some((marker) => lower.includes(marker))
+}
+
+// The same read over a whole stream-json transcript, such as a reviewer's log: its last exit record.
+// The log is appended across launches, so it is read only when it ends on an exit record: a later
+// session that died before writing its own leaves an earlier session's record behind it — not read.
+function is_auth_failed_transcript(transcript: string | undefined): boolean {
+	if (transcript === undefined || !agent_exit_record.ends_on_exit_record(transcript)) return false
+
+	return is_auth_failure(agent_exit_record.read_exit_record(transcript))
+}
+
+const api_auth = { AUTH_FAILURE_NOTE, is_auth_failed_transcript, is_auth_failure }
+
+export { api_auth }

package/scripts/agent/api-outage.ts

@@ -4,7 +4,7 @@ import type { ClaudeResultEvent } from './claude-result-event'
 // stopped mid-implementation on its own. Measured twice: on 2026-09-15 four
 // children ended `The socket connection was closed unexpectedly`, and on 2026-09-21 a child spent all
 // ten connection retries on `Unable to connect to API (ConnectionRefused)`. The parent read both as
-// ordinary failures — `in-progress` stripped, `needs-decision` applied, counted against the
+// ordinary failures — `in-progress` stripped, a park label applied, counted against the
 // consecutive-failure guard — when the child never reached the API at all.
 //
 // **The read is mechanical, never a similarity judgement.** A terminal `result` event that ends in

package/scripts/auto-ok/auto-ok-cli.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_index, type FetchedEpics } from '#scripts/epic/epic-index'
 import { epic_issue } from '#scripts/epic/epic-issue'
@@ -10,6 +8,8 @@ import { cutoff_cause, cutoff_of, type ScanCutoff } from '#scripts/git/listing-c
 import { read_json_listing } from '#scripts/git/parse-json-array'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_sample_gate } from '#scripts/issue/issue-sample-gate'
 import { session_cite } from '#scripts/issue/session-cite'
 
 // `josh auto-ok:next` — which issue outside the epic an unattended run picks up next.
@@ -20,7 +20,6 @@ import { session_cite } from '#scripts/issue/session-cite'
 // nothing checks it. The contract is `epic:next`'s: one token on standard output, every explanation
 // on standard error, so `answer=$(pnpm josh auto-ok:next)` reads it.
 
-const ARGV_OFFSET = 2
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const EXCLUDE_FLAG = '--exclude'
@@ -210,7 +209,11 @@ async function fetch_opted_in(): Promise<OptedInRead> {
 		LISTING_LIMIT,
 	)
 
-	return json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+	const read = json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+
+	if (read.kind === 'read') await issue_sample_gate.prime(read.issues.map((issue) => issue.body))
+
+	return read
 }
 
 // Whether every issue this one declares as a blocker has closed. `blockedBy` is the same native
@@ -331,10 +334,15 @@ function is_runnable(
 	issue: OpenIssueData,
 	tracked: ReadonlyMap<number, number>,
 	exclude: ReadonlyArray<number>,
+	now: number = Date.now(),
 ): boolean {
 	if (tracked.has(issue.number)) return false
 
-	return is_unblocked(issue) && !exclude.includes(issue.number)
+	return (
+		is_unblocked(issue) &&
+		!exclude.includes(issue.number) &&
+		issue_not_before.is_due(issue.body, now)
+	)
 }
 
 function pick_next(
@@ -351,7 +359,7 @@ function pick_next(
 function none_reason(count: number): string {
 	if (count === 0) return NONE_OPTED_IN_MESSAGE
 
-	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, or the one just merged.`
+	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, not due until its start time, or the one just merged.`
 }
 
 // Said only when the cap actually bit, and worded from the answer rather than before it: the one run
@@ -457,14 +465,6 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	return await answer(read, options.exclude)
 }
 
-// `process.exitCode` rather than `process.exit()`: the answer is written with `console.info`, and on
-// macOS a write to a pipe is asynchronous — `process.exit()` can tear the process down before it has
-// drained, and this command's whole contract is `answer=$(pnpm josh auto-ok:next)`. The same shape
-// is already in `scripts/cost-runtime/cost-cli.ts`, which met the truncation first.
-async function main(argv: ReadonlyArray<string>): Promise<void> {
-	process.exitCode = await run(argv)
-}
-
 const auto_ok_cli = {
 	USAGE,
 	NONE_TOKEN,
@@ -486,7 +486,5 @@ const auto_ok_cli = {
 	run,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
-
 export { auto_ok_cli }
 export type { NextOptions, OptedInRead, PickupContext, TrackingRead }

package/scripts/auto-ok/auto-ok-judge-read.ts

@@ -1,3 +1,4 @@
+import { gh_author_association } from '#scripts/gh/gh-author-association'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_label_schema } from '#scripts/git/git-schemas'
 import { read_json_listing } from '#scripts/git/parse-json-array'
@@ -25,6 +26,8 @@ const row_schema = z.looseObject({
 	body: z.string().nullish(),
 	labels: z.array(issue_label_schema),
 	updatedAt: z.string(),
+	author_association: z.string().nullish(),
+	user: z.looseObject({ login: z.string() }).nullish(),
 })
 
 interface JudgeRow extends JudgeIssue {
@@ -35,13 +38,17 @@ interface JudgeRow extends JudgeIssue {
 // An issue's number to the `updatedAt` it was last seen judged at.
 type JudgedCache = Map<number, string>
 
-function to_row(raw: z.infer<typeof row_schema>): JudgeRow {
+async function to_row(raw: z.infer<typeof row_schema>): Promise<JudgeRow> {
 	return {
 		number: raw.number,
 		title: raw.title,
 		body: raw.body ?? '',
 		labels: raw.labels.map((label) => label.name),
 		updated_at: raw.updatedAt,
+		is_trusted: await gh_author_association.is_trusted({
+			login: raw.user?.login,
+			association: raw.author_association,
+		}),
 	}
 }
 
@@ -55,7 +62,9 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 
 	if (listing.kind !== 'read') return undefined
 
-	return listing.rows.map((raw) => to_row(raw)).filter((row) => auto_ok_judge.is_candidate(row))
+	const rows = await Promise.all(listing.rows.map(async (raw) => await to_row(raw)))
+
+	return rows.filter((row) => auto_ok_judge.is_candidate(row))
 }
 
 // `true` only for an issue known to owe a judgement: a failed comment read learns nothing, so it is
@@ -63,7 +72,7 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 async function owes_judgement(row: JudgeRow, cache: JudgedCache): Promise<boolean> {
 	if (cache.get(row.number) === row.updated_at) return false
 
-	const comments = issue_watch_diff.parse_comments(
+	const comments = await issue_watch_diff.parse_comments(
 		await git_gh_command.issue_list_comments(String(row.number)),
 	)
 

package/scripts/auto-ok/auto-ok-judge-write.ts

@@ -2,11 +2,8 @@ import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_label_schema } from '#scripts/git/git-schemas'
 import { parse_json_object_or_undefined } from '#scripts/git/parse-json-array'
 import { issue_auto_ok, type AutoOkDecision } from '#scripts/issue/issue-auto-ok'
-import { issue_cite } from '#scripts/issue/issue-cite'
-import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { AUTO_OK_LABEL, has_label_name } from '#scripts/issue/issue-labels'
 import { session_cite } from '#scripts/issue/session-cite'
-import { run_event_stream } from '#scripts/run/event/run-event-stream'
-import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { z } from 'zod'
 import { auto_ok_judge } from './auto-ok-judge'
 
@@ -14,17 +11,30 @@ import { auto_ok_judge } from './auto-ok-judge'
 //
 // **An applied judgement still passes the mechanical exclusions** — `issue_auto_ok.exclusion_of` is
 // re-read against the labels as they stand, so a label added since the listing refuses the write
-// rather than racing it. **The run label lands before `auto-ok`**, so the pool never holds an opted-in
-// issue that `backlog:next` would withhold as untriaged. Both answers leave the judgement comment the
-// next listing reads as the record, and an applied one is a `note` on the board's 📌.
+// rather than racing it. **The judgement comment lands before the labels**: a re-run skips an issue
+// that already carries `auto-ok`, so a comment failing after the labels would never be retried, while
+// a label failing after the comment leaves `auto-ok` off and the issue open to an explicit
+// `--apply <N>` — the refusal names it, since the listing reads the comment as judged. **The
+// run label lands before `auto-ok`**, so the pool never holds an opted-in issue that `backlog:next`
+// would withhold as untriaged. Both answers leave the judgement comment the next listing reads as the
+// record; an applied one writes nothing to the run board, which shows the issue once it is dispatched
+// (joshuafolkken/kit#4133).
 
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const UNREADABLE = 'the issue could not be read'
+const CLOSED_STATE = 'CLOSED'
+// The judgement comment is already posted, so the listing will not offer the issue again.
+const RETRY_HINT = 're-run `pnpm josh auto-ok:judge --apply <N>` to finish it'
 
-const issue_schema = z.object({ labels: z.array(issue_label_schema), body: z.string().nullish() })
+const issue_schema = z.object({
+	state: z.string().nullish(),
+	labels: z.array(issue_label_schema),
+	body: z.string().nullish(),
+})
 
 interface IssueRead {
+	is_closed: boolean
 	labels: ReadonlyArray<string>
 	body: string
 }
@@ -35,7 +45,21 @@ async function read_issue(issue: string): Promise<IssueRead | undefined> {
 
 	if (parsed === undefined) return undefined
 
-	return { labels: parsed.labels.map((label) => label.name), body: parsed.body ?? '' }
+	return {
+		is_closed: parsed.state === CLOSED_STATE,
+		labels: parsed.labels.map((label) => label.name),
+		body: parsed.body ?? '',
+	}
+}
+
+// Why an apply has nothing to write: a closed issue is past the pool, and one already opted in was
+// judged once — writing again would repeat the comment (joshuafolkken/kit#4097).
+function settled_of(read: IssueRead): string | undefined {
+	if (read.is_closed) return 'the issue is closed'
+
+	return has_label_name(read.labels, AUTO_OK_LABEL)
+		? `\`${AUTO_OK_LABEL}\` is already applied`
+		: undefined
 }
 
 async function apply_labels(issue: string, run_label: string): Promise<string | undefined> {
@@ -74,18 +98,15 @@ async function apply_to(issue: string, run_label: string, read: IssueRead): Prom
 
 	if (exclusion !== undefined) return refused(issue, issue_auto_ok.line_of(exclusion))
 
-	const problem = await apply_labels(issue, run_label)
-
-	if (problem !== undefined) return refused(issue, problem)
-
 	const reason = `judged by backlogrun: no exclusion holds and no person's judgement is needed (${run_label})`
 
-	await run_event_stream_emit.emit(
-		run_event_stream.EVENT_KIND.NOTE,
-		`${issue_cite.plain(issue)} auto-ok applied (${run_label})`,
-	)
+	if ((await record(issue, { is_applied: true, reason }, read.body)) !== SUCCESS_EXIT_CODE) {
+		return FAILURE_EXIT_CODE
+	}
+
+	const problem = await apply_labels(issue, run_label)
 
-	return await record(issue, { is_applied: true, reason }, read.body)
+	return problem === undefined ? SUCCESS_EXIT_CODE : refused(issue, `${problem}; ${RETRY_HINT}`)
 }
 
 async function apply(issue: string, run_label: string): Promise<number> {
@@ -93,7 +114,13 @@ async function apply(issue: string, run_label: string): Promise<number> {
 
 	if (read === undefined) return refused(issue, UNREADABLE)
 
-	return await apply_to(issue, run_label, read)
+	const settled = settled_of(read)
+
+	if (settled === undefined) return await apply_to(issue, run_label, read)
+
+	console.info(`${session_cite.issue(issue)}: nothing to apply — ${settled}`)
+
+	return SUCCESS_EXIT_CODE
 }
 
 async function decline(issue: string, reason: string): Promise<number> {

package/scripts/auto-ok/auto-ok-judge.ts

@@ -14,11 +14,16 @@ import type { WatchComment } from '#scripts/issue/issue-watch-diff'
 // **The record is the judgement comment itself.** It carries a digest of the body it judged, so an
 // issue is judged again only when its body changed or a person commented after it — the same line
 // `issue_watch_diff` draws between a person's update and an automated one.
+//
+// **Only an author with write access is read** (`gh_author_association`, joshuafolkken/kit#4021): an
+// issue anyone else filed is never a candidate, and a judgement comment or a later comment from anyone
+// else is not counted, so a third party can neither opt an issue in nor mark one judged.
 
 interface JudgeIssue {
 	number: number
 	labels: ReadonlyArray<string>
 	body: string
+	is_trusted: boolean
 }
 
 const MARKER_PREFIX = '<!-- josh:auto-ok-judged body='
@@ -29,7 +34,7 @@ const CRLF = '\r\n'
 const LF = '\n'
 
 function is_candidate(issue: JudgeIssue): boolean {
-	if (has_label_name(issue.labels, AUTO_OK_LABEL)) return false
+	if (!issue.is_trusted || has_label_name(issue.labels, AUTO_OK_LABEL)) return false
 
 	return issue_auto_ok.exclusion_of(issue.labels) === undefined
 }
@@ -42,9 +47,15 @@ function body_digest(body: string): string {
 }
 
 function digest_of(comment: WatchComment): string | undefined {
+	if (!comment.is_trusted) return undefined
+
 	return MARKER_PATTERN.exec(comment.body)?.groups?.['digest']
 }
 
+function is_person_comment(comment: WatchComment): boolean {
+	return comment.is_trusted === true && !comment.is_automated
+}
+
 // Judged when the newest judgement comment covers the body as it stands and no person has commented
 // since. A failed comment read never reaches here — the caller treats it as nothing learned.
 function is_judged(body: string, comments: ReadonlyArray<WatchComment>): boolean {
@@ -52,7 +63,7 @@ function is_judged(body: string, comments: ReadonlyArray<WatchComment>): boolean
 
 	if (judgement === undefined || digest_of(judgement) !== body_digest(body)) return false
 
-	return comments.every((comment) => comment.id <= judgement.id || comment.is_automated)
+	return comments.every((comment) => comment.id <= judgement.id || !is_person_comment(comment))
 }
 
 function comment_of(decision: AutoOkDecision, body: string): string {

package/scripts/auto-ok/auto-ok-main.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { auto_ok_cli } from './auto-ok-cli'
+
+// The `josh auto-ok:next` entry, kept apart from `auto-ok-cli.ts` because other modules import that
+// one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186).
+//
+// `process.exitCode` rather than `process.exit()`: the answer is written with `console.info`, and on
+// macOS a write to a pipe is asynchronous — `process.exit()` can tear the process down before it has
+// drained, and this command's whole contract is `answer=$(pnpm josh auto-ok:next)`. The same shape
+// is already in `scripts/cost-runtime/cost-main.ts`, which met the truncation first.
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await auto_ok_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/backlog/backlog-arrival.ts

@@ -7,11 +7,12 @@ import { backlog_arrival_added } from './backlog-arrival-added'
 import { backlog_next } from './backlog-next'
 import { backlog_ready, type ReadyPorts, type ReadyReading } from './backlog-ready'
 import { backlog_stalled } from './backlog-stalled'
+import { backlog_stalled_detect } from './backlog-stalled-detect'
 
 // The arrival probe a `backlogrun` parent's `--wait` watcher runs while children are in flight.
 // Without it, an issue opted in with `auto-ok` mid-run is picked up only when the parent
 // next wakes — a child's merge, or the progress interval — so in practice the ten-minute stall detector
-// becomes the pick-up, and the person gets a ⏳ notification for the wait.
+// becomes the pick-up, ten minutes late.
 //
 // **The watcher's exit is the only thing that wakes a live parent**, so the probe rides it: once a
 // minute it reads the backlog the pick-up line reads (`backlog_ready.read_ready`, cheap first — a full
@@ -66,15 +67,18 @@ async function bounded_ready_issues(): Promise<ReadonlyArray<string>> {
 	return answered_issues(await backlog_ready.read_backlog_next(COMMAND_TIMEOUT_MS))
 }
 
-// The backlog reads, plus whether `run:add` handed the run an issue since a given instant.
+// The backlog reads, whether `run:add` handed the run an issue since a given instant, and the stall
+// detector's record of whether work and a free lane coexist (joshuafolkken/kit#4349).
 interface ArrivalPorts extends ReadyPorts {
 	is_added_since: (since_ms: number) => Promise<boolean>
+	observe_offerable: (is_offerable: boolean) => Promise<void>
 }
 
 const ARRIVAL_PORTS: ArrivalPorts = {
 	free_lane_count: backlog_ready.free_lane_count,
 	ready_issues: bounded_ready_issues,
 	is_added_since: backlog_arrival_added.is_added_since,
+	observe_offerable: backlog_stalled_detect.observe_offerable,
 }
 
 interface ArrivalProbe {
@@ -94,6 +98,11 @@ function arrivals(
 	return is_raised ? reading.issues : reading.issues.filter((issue) => !baseline.has(issue))
 }
 
+// The stall detector's condition, off the reading the probe already made.
+function is_offerable(reading: ReadyReading): boolean {
+	return reading.issues.length > NONE && reading.free_lanes > NO_FREE
+}
+
 // The baseline is the whole runnable pool, free lane or not: an issue that was waiting for a lane is not
 // new when one frees, and the child's merge that freed it already wakes the parent.
 //
@@ -149,7 +158,7 @@ async function retry_baseline(
 function pool_probe_of(
 	initial: ReadonlySet<string> | undefined,
 	first_ms: number,
-	ports: ReadyPorts,
+	ports: ArrivalPorts,
 	is_raised: () => boolean,
 ): ArrivalProbe {
 	let next_ms = first_ms
@@ -168,6 +177,8 @@ function pool_probe_of(
 
 		const reading = await read_reading(ports)
 
+		if (reading !== undefined) await ports.observe_offerable(is_offerable(reading))
+
 		return reading !== undefined && arrivals(baseline, reading, is_raised()).length > NONE
 	}
 

package/scripts/backlog/backlog-budget-cli.ts

@@ -1,7 +1,6 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { path_decision } from '#scripts/josh/path-decision'
 import { cli_flags } from '#scripts/lib/cli-flags'
+import { MS_PER_MINUTE } from '#scripts/lib/timeouts'
 import {
 	backlog_budget,
 	type BacklogAnswer,
@@ -13,7 +12,6 @@ import {
 // command line, hand it to the pure decision, print the verdict on stdout and the reason on stderr
 // through the printer every mechanically-decided command in this repository already shares.
 
-const ARGV_OFFSET = 2
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const JSON_KEY = 'budget'
@@ -54,19 +52,6 @@ function to_time_ms(raw: string | undefined): number | undefined {
 	return Number.isNaN(parsed) ? undefined : parsed
 }
 
-// Digits and nothing else. `Number('')`, `Number(' ')` and `Number('0x10')` are all safe integers, so
-// a check that only asked `Number.isSafeInteger` would read an unset shell variable — `--max
-// "$max_issues"` — as a maximum of zero and finish the run having done nothing.
-const COUNT_PATTERN = /^\d+$/u
-
-function to_count(raw: string | undefined): number | undefined {
-	if (raw === undefined || !COUNT_PATTERN.test(raw)) return undefined
-
-	const parsed = Number(raw)
-
-	return Number.isSafeInteger(parsed) ? parsed : undefined
-}
-
 // A flag that was given but could not be read makes the whole invocation unreadable. Falling back to
 // the default instead would answer a question nobody asked — a mistyped `--idle 0` would read as the
 // default watch and hold a run open that was asked to finish at its first empty backlog.
@@ -80,10 +65,10 @@ type Counts = Record<(typeof COUNT_NAMES)[number], number | undefined>
 
 function counts_of(values: ParsedValues): Counts {
 	return {
-		idle: to_count(cli_flags.string_of(values.idle)),
-		max: to_count(cli_flags.string_of(values.max)),
-		merged: to_count(cli_flags.string_of(values.merged)),
-		running: to_count(cli_flags.string_of(values.running)),
+		idle: cli_flags.to_count(cli_flags.string_of(values.idle)),
+		max: cli_flags.to_count(cli_flags.string_of(values.max)),
+		merged: cli_flags.to_count(cli_flags.string_of(values.merged)),
+		running: cli_flags.to_count(cli_flags.string_of(values.running)),
 	}
 }
 
@@ -102,7 +87,7 @@ function to_idle_ms(idle_minutes: number | undefined): number | undefined {
 	if (idle_minutes === undefined) return backlog_budget.DEFAULT_IDLE_MS
 	if (idle_minutes === NO_IDLE_MINUTES) return undefined
 
-	return idle_minutes * backlog_budget.MS_PER_MINUTE
+	return idle_minutes * MS_PER_MINUTE
 }
 
 // An idle watch measured from the run's start is not the watch that was asked for. A run already
@@ -117,7 +102,7 @@ function to_idle_ms(idle_minutes: number | undefined): number | undefined {
 // lands on the very first ask, before the run has started anything, and the fix is one flag the loop
 // already holds: it always knows when it last had work.
 function is_watch_readable(values: ParsedValues): boolean {
-	if (to_idle_ms(to_count(cli_flags.string_of(values.idle))) === undefined) return true
+	if (to_idle_ms(cli_flags.to_count(cli_flags.string_of(values.idle))) === undefined) return true
 
 	return cli_flags.string_of(values.active) !== undefined
 }
@@ -197,28 +182,17 @@ function run(argv: ReadonlyArray<string>, now_ms: number = Date.now()): number {
 	return SUCCESS_EXIT_CODE
 }
 
-// `process.exitCode` rather than `process.exit()`, for the reason `backlog:next` records: the whole
-// contract is `answer=$(pnpm josh backlog:budget …)`, and exiting outright can cut the pipe before it
-// has drained.
-function main(argv: ReadonlyArray<string>): void {
-	process.exitCode = run(argv)
-}
-
 const backlog_budget_cli = {
 	JSON_KEY,
 	OPTIONS,
 	SUCCESS_EXIT_CODE,
 	USAGE,
 	build_input,
-	main,
 	read_arguments,
 	run,
 	to_answer,
-	to_count,
 	to_time_ms,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
-
 export { backlog_budget_cli }
 export type { ParsedValues }

package/scripts/backlog/backlog-budget-main.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { backlog_budget_cli } from './backlog-budget-cli'
+
+// The `josh backlog:budget` entry, kept apart from `backlog-budget-cli.ts` because other modules
+// import that one: a bundle is one file, so a main guard there would fire for every command that
+// carries it (joshuafolkken/kit#4186).
+//
+// `process.exitCode` rather than `process.exit()`, for the reason `backlog:next` records: the whole
+// contract is `answer=$(pnpm josh backlog:budget …)`, and exiting outright can cut the pipe before it
+// has drained.
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = backlog_budget_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/backlog/backlog-budget.ts

@@ -1,3 +1,5 @@
+import { MS_PER_MINUTE, MS_PER_SECOND } from '#scripts/lib/timeouts'
+
 // `josh backlog:budget` — whether a `backlogrun` may start more work, keep watching, or finish.
 //
 // `backlog:next` says what may start; it says nothing about when the run itself should end. Without
@@ -17,7 +19,6 @@
 // and `josh review:level` are commands: a count and an elapsed time kept in an agent's head are a
 // one-shot judgement — a threshold asked once and then never again while the run walks past it.
 
-const MS_PER_MINUTE = 60_000
 const MINUTES_PER_HOUR = 60
 
 // **How long a run with nothing to do waits, and the only time bound a run has.** It is counted from
@@ -34,7 +35,6 @@ const DEFAULT_IDLE_MS = DEFAULT_IDLE_MINUTES * MS_PER_MINUTE
 // once, without waiting it out. `backlogrun-progress.md` → "Waiting, and never waiting forever" holds
 // the row; the figure is here because `idle_watch_reason` below has to say it.
 const OFFER_INTERVAL_SECONDS = 60
-const MS_PER_SECOND = 1000
 const OFFER_INTERVAL_MS = OFFER_INTERVAL_SECONDS * MS_PER_SECOND
 
 const RUN_VERDICT = 'run'
@@ -231,7 +231,6 @@ const backlog_budget = {
 	DEFAULT_IDLE_MINUTES,
 	DEFAULT_IDLE_MS,
 	IDLE_WAIT_HOURS,
-	MS_PER_MINUTE,
 	OFFER_INTERVAL_MS,
 	RUN_VERDICT,
 	STOP_VERDICT,

package/scripts/backlog/backlog-defect-priority.ts

@@ -18,10 +18,11 @@ function above_message(measured: DefectRate): string {
 	return `The defect rate ${defect_rate.rate_text(measured)} is above its baseline ${String(defect_rate.BASELINE_RATE)}, so defects are offered first and new mechanisms last.`
 }
 
-// An unreadable body reads as empty: the labels still classify `route:interrupt`, and anything else
-// keeps its usual place rather than being deferred on a read that failed.
+// The body the listing already carried, else one read for it (joshuafolkken/kit#4550). An unreadable
+// body reads as empty: the labels still classify `route:interrupt`, and anything else keeps its usual
+// place rather than being deferred on a read that failed.
 async function kind_of_child(child: EpicChild): Promise<IssueKind> {
-	const body = await git_gh_command.issue_get_body(String(child.number), child.repo)
+	const body = child.body ?? (await git_gh_command.issue_get_body(String(child.number), child.repo))
 
 	return defect_rate.kind_of({ body: body ?? '', labels: child.labels })
 }

package/scripts/backlog/backlog-drive-adopt.ts

@@ -0,0 +1,67 @@
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
+import { run_event_stream } from '#scripts/run/event/run-event-stream'
+import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+import type { DrivePorts, DriveState } from './backlog-drive'
+import { backlog_drive_restore } from './backlog-drive-restore'
+
+// **A lane the drive did not launch is still the run's to collect** (joshuafolkken/kit#4373). The loop
+// held only the lanes it was seeded with and the ones it launched, so a child the parent dispatched
+// itself with `lane:launch` — an interrupt in a named run — finished, merged and was never handed to
+// `run:merge`: no `merge` event and no collected lane until `run:carry --end`, 91 minutes later. The
+// stop was `run_pass` collecting only `state.in_flight` (`backlog-drive.ts`), seeded once at start
+// (`backlog-drive-cli.ts` `seeded_lanes`). Adopted, a child that ends with its pull request unmerged
+// is classified `failed` by `run:merge` (`run-merge.ts` `unfinished_outcome`), which puts it on the
+// stream as a park with its cause (`run-merge-cli.ts` `on_parked_failure`) — the reason a lane left
+// unmerged is recorded.
+
+// The open lanes on a child this run launched and never settled — what the drive adopts while it runs
+// and `run:carry --end` collects once it has stopped.
+async function active_lanes(): Promise<ReadonlyArray<LaneInfo>> {
+	const active = backlog_drive_restore.active_issues(await run_event_stream_emit.current_events())
+	const lanes = await lane_registry.list_lanes()
+
+	return lanes.filter((lane) => !lane.is_stranded && active.has(lane.issue))
+}
+
+function adopted_note(issue: string): string {
+	return `${issue_cite.plain(issue)} adopted by backlog:drive: its lane was launched outside the loop`
+}
+
+async function note_adopted(issue: string): Promise<void> {
+	await run_event_stream_emit.emit(run_event_stream.EVENT_KIND.NOTE, adopted_note(issue))
+}
+
+// The active lanes the loop does not hold, each put on the stream with why it is adopted.
+async function adoptable(in_flight: ReadonlyArray<string>): Promise<ReadonlyArray<string>> {
+	const lanes = await active_lanes()
+	const issues = lanes.map((lane) => lane.issue).filter((issue) => !in_flight.includes(issue))
+
+	await Promise.all(
+		issues.map(async (issue) => {
+			await note_adopted(issue)
+		}),
+	)
+
+	return issues
+}
+
+// The state with every adoptable lane in flight, so its child is collected as soon as it ends. Asked on
+// an offered pass only, not every poll: the read walks the run's whole event stream. A stopping run
+// adopts nothing: the child whose unparked failure stopped it left the stream unsettled, so adopting
+// would collect — and count — it again.
+async function held(
+	state: DriveState,
+	should_offer: boolean,
+	ports: Pick<DrivePorts, 'adoptable'>,
+): Promise<DriveState> {
+	if (!should_offer || state.is_stopping) return state
+
+	const adopting = await ports.adoptable(state.in_flight)
+
+	return adopting.length === 0 ? state : { ...state, in_flight: [...state.in_flight, ...adopting] }
+}
+
+const backlog_drive_adopt = { active_lanes, adoptable, held }
+
+export { backlog_drive_adopt }