@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/run/cut/run-cut-report.ts

@@ -38,6 +38,7 @@ const UNKNOWN_VERDICT = 'unknown'
 // The asking session is over the shared context-cut threshold, so an implementation cut was not
 // resumed into it — the same refusal `run:carry` answers `over` with.
 const OVER_VERDICT = 'over'
+const SPLIT_UNRESOLVED_VERDICT = 'split-unresolved'
 
 function report(verdict: string, code: number): number {
 	console.info(verdict)
@@ -127,12 +128,13 @@ function report_under_threshold(): number {
 }
 
 // **A ship reviewer takes no cut, of either phase** (joshuafolkken/kit#3623). Its supervisor is waiting
-// on the findings file it has yet to write, so a relaunch would stand a second child in the lane beside
+// on the findings it has yet to submit, so a relaunch would stand a second child in the lane beside
 // the one the supervisor repairs with. Answered `not-a-lane`, the verdict that already means "nothing
-// was cut and this process carries on".
+// was cut and this process carries on". The message names no sink: its review prompt says whether it
+// submits through `review:submit` or, on a lane that predates it, writes a path (joshuafolkken/kit#4799).
 function report_reviewer(): number {
 	console.error(
-		'This session is a ship reviewer, which its supervisor is waiting on, so nothing was cut and nothing was relaunched. Write the findings file and finish the review in this process.',
+		'This session is a ship reviewer, which its supervisor is waiting on, so nothing was cut and nothing was relaunched. Finish the review in this process and submit its findings the way your review prompt says.',
 	)
 
 	return report(NOT_A_LANE_VERDICT, SUCCESS_EXIT_CODE)
@@ -174,6 +176,22 @@ function report_over(): number {
 	return report(OVER_VERDICT, FAILURE_EXIT_CODE)
 }
 
+function report_missing_supervisor(issue: string): number {
+	console.error(
+		`The OpenAI supervisor for ${session_cite.issue(issue)} is not live, so this nested process was not cut and can continue. Re-dispatch the lane to recover the supervisor.`,
+	)
+
+	return report(FAILED_VERDICT, FAILURE_EXIT_CODE)
+}
+
+// The lane got the split notice and has answered it neither way, so nothing was cut and the run does
+// not go on to the gate until it does (joshuafolkken/kit#4695). `note` says which answers it takes.
+function report_split_unresolved(note: string): number {
+	console.error(note)
+
+	return report(SPLIT_UNRESOLVED_VERDICT, FAILURE_EXIT_CODE)
+}
+
 const run_cut_report = {
 	BAD_HANDOFF_VERDICT,
 	BUSY_VERDICT,
@@ -191,6 +209,7 @@ const run_cut_report = {
 	RELAUNCHED_CUT_MARKER,
 	RESUME_IMPL_VERDICT,
 	RESUME_VERDICT,
+	SPLIT_UNRESOLVED_VERDICT,
 	STALE_VERDICT,
 	SUCCESS_EXIT_CODE,
 	UNDER_THRESHOLD_VERDICT,
@@ -205,9 +224,11 @@ const run_cut_report = {
 	report_handed_off,
 	report_held_cut,
 	report_incomplete,
+	report_missing_supervisor,
 	report_over,
 	report_relaunched_cut,
 	report_reviewer,
+	report_split_unresolved,
 	report_stale,
 	report_under_threshold,
 	report_unknown,

package/scripts/run/cut/run-cut-resume.ts

@@ -0,0 +1,129 @@
+import { cost_cli } from '#scripts/cost-runtime/cost-cli'
+import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { run_event_stream } from '#scripts/run/event/run-event-stream'
+import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+import { run_cut, type RunCut } from './run-cut'
+import { run_cut_report } from './run-cut-report'
+import { run_cut_review } from './run-cut-review'
+
+// `josh run:cut --resume <N>` — a fresh process asking whether it resumes a cut: it verifies the tree
+// against the record and adopts it, answering which phase it resumes into. Taking a cut is
+// `run-cut-cli.ts`'s.
+
+const {
+	FRESH_VERDICT,
+	HANDED_OFF_VERDICT,
+	INCOMPLETE_VERDICT,
+	RESUME_IMPL_VERDICT,
+	RESUME_VERDICT,
+	SUCCESS_EXIT_CODE,
+	report,
+	report_busy,
+	report_handed_off,
+	report_incomplete,
+	report_over,
+	report_stale,
+	report_unreadable,
+} = run_cut_report
+
+// **The adoption is the resume-uniqueness guarantee**: it removes and creates exclusively, so of two
+// racing resumes only one wins the create and the loser is answered `busy`.
+// An implementation cut resumes back into implementation; a pre-gate one into the gate. The resuming
+// child is told which by the verdict rather than reconstructing it from the record.
+function resume_verdict_for(cut_record: RunCut): string {
+	return run_cut.resumes_into_implementation(cut_record.phase)
+		? RESUME_IMPL_VERDICT
+		: RESUME_VERDICT
+}
+
+// **An implementation resume removes the record; a pre-gate one marks it handed off**.
+// The cuts have different multiplicities sharing one record: the pre-gate cut fires once per lane, so
+// its record must survive to answer a second resume `handed-off`; the implementation cut is guarded by the run's
+// event stream rather than the cut record, so its record is cleared on resume — a lingering record
+// would keep the pre-gate guard, which reads `carried_cut_sync`, silent for the rest of the run. A double
+// cut stays impossible either way: `begin_cut`'s exclusive create is what prevents it.
+function take_over(target: string, cut_record: RunCut): RunCut | undefined {
+	if (!run_cut.resumes_into_implementation(cut_record.phase)) {
+		return run_cut.adopt_cut(target, cut_record)
+	}
+
+	run_cut.end_cut(target)
+
+	return cut_record
+}
+
+// **An implementation resume appends a `resume` event**. It clears the record
+// the `cut` event stood for, so the stream is what moves `run:step` back to implementation; a pre-gate
+// resume keeps its record and appends nothing. Best-effort, as the cut's own append is.
+async function emit_resume_event(issue: string, verdict: string): Promise<void> {
+	if (verdict !== RESUME_IMPL_VERDICT) return
+
+	await run_event_stream_emit.emit(
+		run_event_stream.EVENT_KIND.RESUME,
+		`${issue_cite.plain(issue)} resumed`,
+	)
+}
+
+async function adopt(target: string, cut_record: RunCut): Promise<number> {
+	const taken = take_over(target, cut_record)
+
+	if (taken === undefined) return report_busy(cut_record)
+
+	const verdict = resume_verdict_for(cut_record)
+
+	await run_cut_review.announce_resume(cut_record, verdict === RESUME_IMPL_VERDICT)
+	await emit_resume_event(cut_record.issue, verdict)
+
+	return report(verdict, SUCCESS_EXIT_CODE)
+}
+
+// A relaunched lane child and a fresh session both measure `under`, so only the session that took an
+// implementation cut resumes over the threshold; unmeasurable is not refused.
+function is_over_threshold_resume(cut_record: RunCut): boolean {
+	if (!run_cut.resumes_into_implementation(cut_record.phase)) return false
+
+	return cost_cli.session_verdict() === cost_verdict.OVER_VERDICT
+}
+
+async function verify_and_adopt(
+	target: string,
+	cut_record: RunCut,
+	issue: string,
+): Promise<number> {
+	const state = await run_cut.current_state()
+	const verdict = run_cut.classify_resume(cut_record, {
+		issue,
+		current_branch: state.branch,
+		is_dirty: state.is_dirty,
+		is_held: state.is_held,
+	})
+
+	if (verdict === HANDED_OFF_VERDICT) return report_handed_off(cut_record)
+
+	if (verdict === 'stale') return report_stale(cut_record)
+
+	if (verdict === INCOMPLETE_VERDICT) return report_incomplete(cut_record)
+
+	if (is_over_threshold_resume(cut_record)) return report_over()
+
+	return await adopt(target, cut_record)
+}
+
+async function resume(target: string, issue: string): Promise<number> {
+	const read = run_cut.read_cut(target)
+
+	if (read.kind === 'none') return report(FRESH_VERDICT, SUCCESS_EXIT_CODE)
+
+	if (read.kind === 'unreadable') return report_unreadable()
+
+	if (read.kind === 'expired') return report_stale(read.cut)
+
+	return await verify_and_adopt(target, read.cut, issue)
+}
+
+const run_cut_resume = {
+	resume,
+}
+
+export { run_cut_resume }

package/scripts/run/cut/run-cut-review.ts

@@ -0,0 +1,105 @@
+import { git_command } from '#scripts/git/git-command'
+import { review_attest } from '#scripts/review/review-attest'
+import { review_prior_findings } from '#scripts/review/review-prior-findings'
+import { review_record } from '#scripts/review/review-record'
+import { run_cut, type RunCut } from './run-cut'
+import { run_cut_digest } from './run-cut-digest'
+import { run_cut_handoff, type Handoff } from './run-cut-handoff'
+
+// The review round an implementation cut has to carry across the process boundary
+// (joshuafolkken/kit#4868). A lane child's in-session reviewer returns its findings into the
+// conversation, and `review:record` is run after the fixes — so a cut between the two dropped the
+// findings with the conversation, and the resumed child reran round 1 in full. The cut is refused
+// until the round is recorded or its findings ride in the handoff, and the resume prints a recorded
+// round back so it is continued, not rerun.
+
+function unrecorded_note(issue: string): string {
+	return (
+		'a review round is attested on this branch but not recorded, and the handoff carries no ' +
+		`"findings" — run \`pnpm josh review:record --issue ${issue} [<finding> ...]\` before the cut, ` +
+		'or list the round\'s findings under "findings" in the handoff, so the resumed run does not ' +
+		'rerun round 1'
+	)
+}
+
+const RECORDED_ROUND_HEADING =
+	'Round 1 is recorded for this issue — do not rerun it; continue the fixes, then the ship, ' +
+	'which reviews only what moved since:'
+
+interface CutScope {
+	issue: string
+	branch: string
+	phase: string
+}
+
+// Attested on this branch, with no `review:record` line for the issue — the round the cut would lose.
+async function has_unrecorded_round(issue: string, branch: string): Promise<boolean> {
+	const root = await git_command.repository_root()
+
+	if (!review_attest.is_attested_on({ branch }, root)) return false
+
+	const recorded = await review_record.check(Number(issue))
+
+	return recorded.status === 'missing'
+}
+
+// Only an implementation cut without carried findings can lose a round: a pre-gate cut is taken
+// before any review.
+function may_drop_round(scope: CutScope, handoff: Handoff | undefined): boolean {
+	if (!run_cut.resumes_into_implementation(scope.phase)) return false
+
+	return run_cut_handoff.carried_findings(handoff).length === 0
+}
+
+// The note an implementation cut is refused with when it would drop an unrecorded round, else
+// `undefined`.
+async function unrecorded_refusal(
+	scope: CutScope,
+	handoff: Handoff | undefined,
+): Promise<string | undefined> {
+	if (!may_drop_round(scope, handoff)) return undefined
+
+	const is_unrecorded = await has_unrecorded_round(scope.issue, scope.branch)
+
+	return is_unrecorded ? unrecorded_note(scope.issue) : undefined
+}
+
+// What an implementation resume prints about a round recorded before the cut: the heading and the
+// findings the stop log kept with their reasons; nothing when no round is recorded.
+async function recorded_round_lines(issue: string): Promise<ReadonlyArray<string>> {
+	const recorded = await review_record.check(Number(issue))
+
+	if (recorded.status !== 'ok') return []
+
+	const findings = review_prior_findings.latest(issue, () => true)
+
+	return [RECORDED_ROUND_HEADING, ...findings.map((finding) => `  - ${finding}`)]
+}
+
+// The carried instruction and work state, printed to standard error so the resumed session continues
+// on what the run was told to do rather than on the tree alone — and, for an implementation resume,
+// the round recorded before the cut. The record is cleared on adoption, so this is where it reaches
+// the fresh process.
+async function announce_resume(cut_record: RunCut, is_implementation: boolean): Promise<void> {
+	if (cut_record.handoff !== undefined) {
+		console.error(run_cut_handoff.describe_handoff(cut_record.handoff))
+	}
+
+	const digest = run_cut_digest.describe_digest(cut_record.digest)
+
+	if (digest !== undefined) console.error(digest)
+
+	if (!is_implementation) return
+
+	const lines = await recorded_round_lines(cut_record.issue)
+
+	if (lines.length > 0) console.error(lines.join('\n'))
+}
+
+const run_cut_review = {
+	RECORDED_ROUND_HEADING,
+	announce_resume,
+	unrecorded_refusal,
+}
+
+export { run_cut_review }

package/scripts/run/cut/run-cut.ts

@@ -1,6 +1,5 @@
 import { agent_role_profile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
-import { CONTEXT_CUT_THRESHOLD } from '#scripts/cost-runtime/context-cut-threshold'
 import { git_command } from '#scripts/git/git-command'
 import { git_common_directory } from '#scripts/git/git-common-directory'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -9,6 +8,7 @@ import { lane_child_invocation } from '#scripts/lane/lane-child-invocation'
 import { json_value } from '#scripts/lib/json-value'
 import { run_hold, type RunHold } from '#scripts/run/hold/run-hold'
 import { z } from 'zod'
+import { run_cut_digest, type SessionDigest } from './run-cut-digest'
 import { run_cut_handoff, type Handoff } from './run-cut-handoff'
 
 // A lane child is a detached `fullrun #<N>` process, and the thinking it accumulates while
@@ -45,11 +45,6 @@ const CUT_PREFIX = 'josh-run-cut-'
 // `IMPLEMENTATION_PHASE` drops the thinking accumulated *during* implementation and resumes back into
 // implementation (`resumes_into_implementation`); only the pre-gate cut resumes into the gate.
 const { PRE_GATE_PHASE, IMPLEMENTATION_PHASE } = agent_role_profile
-// **The measurement is the parent hand-off's, never a second one.** The lane child decides whether
-// to take this cut with `pnpm josh cost --cut` — the same per-request billed-input measurement (`cost_verdict.per_request_cost`) the parent's
-// `pnpm josh cost --cut` hand-off uses (`backlogrun-progress.md` → "The hand-off"). The shared
-// threshold prevents the scheduler and worker boundaries from drifting apart.
-const IMPLEMENTATION_CONTEXT_THRESHOLD = CONTEXT_CUT_THRESHOLD
 // **The bound is `backlog-budget.ts`'s idle wait, imported rather than restated**, so the eight hours
 // stay written once. A resume is expected within seconds of the cut, so this age is only a backstop
 // against a fresh process that never started; an expired record is cleared and replaced by the next
@@ -92,6 +87,8 @@ interface RunCut {
 	// record of the scalar fields alone parses, while a resume into implementation refuses to continue without it (`classify_resume`
 	// → `incomplete`), so a session is never silently continued lacking the instruction it needs.
 	handoff?: Handoff | undefined
+	// What the cut session read and decided, printed on the resume (joshuafolkken/kit#5040).
+	digest?: SessionDigest | undefined
 	// Set when `run:merge` found this cut still unadopted after every process of the lane had gone and
 	// relaunched its successor itself. The fallback fires once per cut: a
 	// successor that dies again before adopting is not relaunched a second time, so a lane that keeps
@@ -121,6 +118,8 @@ interface CutSpec {
 	// The instruction and work state to carry, absent for a pre-gate cut that resumes into the gate
 	// rather than into implementation.
 	handoff?: Handoff | undefined
+	// What the cut session read and decided, derived from its transcript (`run-cut-digest.ts`).
+	digest?: SessionDigest | undefined
 }
 
 // What the resume classifier is asked about, gathered from the fresh process's own git state so the
@@ -155,6 +154,7 @@ const run_cut_schema = z.object({
 	cut_at: z.string(),
 	is_handed_off: z.boolean().optional(),
 	handoff: run_cut_handoff.handoff_schema.optional(),
+	digest: run_cut_digest.session_digest_schema.optional(),
 	is_merge_relaunched: z.boolean().optional(),
 })
 
@@ -261,6 +261,7 @@ function fresh_cut(spec: CutSpec, now: Date): RunCut {
 		cut_at: now.toISOString(),
 		is_handed_off: true,
 		handoff: spec.handoff,
+		digest: spec.digest,
 	}
 }
 
@@ -285,6 +286,16 @@ function record_within_bound(spec: CutSpec, now: Date = new Date()): boolean {
 	return within_handoff_bound(fresh_cut(spec, now))
 }
 
+// An implementation cut carries what the session read and decided (`run-cut-digest.ts`); a digest the
+// bound cannot hold is dropped, so a cut is never refused for it, and a pre-gate cut never derives one.
+function with_digest(spec: CutSpec, digest_of: () => SessionDigest | undefined): CutSpec {
+	if (spec.handoff === undefined) return spec
+
+	const digested = { ...spec, digest: digest_of() }
+
+	return record_within_bound(digested) ? digested : spec
+}
+
 // **Create-exclusively, exactly as `run-hold.ts` claims a tree.** A record already here means a cut is
 // already in flight for this tree, so `undefined` is "do not launch a second one" rather than an
 // error — the exclusive create is what makes a double cut, and so a double relaunch, impossible. A
@@ -455,7 +466,6 @@ const run_cut = {
 	CUT_MAX_AGE_HOURS,
 	CUT_MAX_AGE_MS,
 	END_COMMAND,
-	IMPLEMENTATION_CONTEXT_THRESHOLD,
 	IMPLEMENTATION_PHASE,
 	MAX_HANDOFF_BYTES,
 	PRE_GATE_PHASE,
@@ -466,6 +476,7 @@ const run_cut = {
 	classify,
 	classify_resume,
 	current_state,
+	with_digest,
 	cut_path,
 	describe_cut,
 	end_cut,

package/scripts/run/detached-launch.ts

@@ -21,7 +21,7 @@ import { launch_priority } from '#scripts/run/launch-priority'
 
 const NO_PID_NOTE = 'the process started without a pid'
 const UNSAFE_NOTE =
-	'the wake command or its arguments contain characters that are not safe to execute'
+	'the wake command or its arguments are empty, over length, or contain characters that are not safe to execute'
 
 // Provider-specific commands and flags are composed before this boundary. This module accepts only
 // an argv vector and never infers policy from it; role/model/effort arrive separately as log metadata.

package/scripts/run/entry/run-entry-cli.ts

@@ -5,13 +5,14 @@ import { issue_watch } from '#scripts/issue/issue-watch'
 import { session_cite } from '#scripts/issue/session-cite'
 import { josh_command } from '#scripts/josh/josh-run'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { lane_plan_check } from '#scripts/lane/lane-plan-check'
 import { run_cut_report } from '#scripts/run/cut/run-cut-report'
 import { run_event_plan } from '#scripts/run/event/run-event-plan'
 import { run_hold_cli } from '#scripts/run/hold/run-hold-cli'
 import { run_halfrun_resume } from '#scripts/run/run-halfrun-resume'
 import { run_label } from '#scripts/run/run-label'
 import { run_next } from '#scripts/run/run-next'
-import { run_prep } from '#scripts/run/run-prep'
+import type { PrepParts } from '#scripts/run/run-prep'
 import { run_prep_cli } from '#scripts/run/run-prep-cli'
 import { run_prrun_resume } from '#scripts/run/run-prrun-resume'
 import {
@@ -24,7 +25,9 @@ import { run_stage_read, type StageRead } from '#scripts/run/run-stage-read'
 import { run_step } from '#scripts/run/run-step'
 import { run_step_section } from '#scripts/run/run-step-section'
 import { run_entry, type EntryParts } from './run-entry'
+import { run_entry_spill } from './run-entry-spill'
 import { run_entry_stop } from './run-entry-stop'
+import { run_entry_trust, type TrustStop } from './run-entry-trust'
 
 // `josh run:entry <N>` — one call for the fixed entry sequence a lane opens on. Rather than a round
 // trip each on `run:hold`, `cost --cut`, `run:prep` and `run:step`, re-billing a lane's full context
@@ -50,6 +53,8 @@ const NEWLINE = '\n'
 const HOLD_STOP_NOTE =
 	'(tree not held — see the reason above; clean up and retry, or release with `pnpm josh run:release`)'
 const COST_STOP_NOTE = '(session budget spent — see the figure above; resume in a fresh session)'
+const YIELD_NOTE =
+	'(lane given back at the entry — see the overlap above; end the session now, with no edit)'
 const { BUDGET_REASON, HOLD_REASON } = run_entry_stop
 const HALFRUN_RESUME_TOKEN = 'halfrun'
 
@@ -123,8 +128,9 @@ async function check_cost(): Promise<string> {
 }
 
 interface Reads {
-	report: string
+	prep: PrepParts
 	verdict: string
+	trust_stop: TrustStop | undefined
 }
 
 // The issue reads and the pre-implementation verdict, from the one gather `run:prep` and `run:next`
@@ -132,20 +138,33 @@ interface Reads {
 // formatter, the verdict is `run:step`'s `pre_verdict` over the same parts.
 async function gather_reads(issue_number: string): Promise<Reads> {
 	const reads = await run_prep_cli.gather(issue_number)
-	const parts = run_prep_cli.to_parts(issue_number, reads)
-	const verdict = run_step.pre_verdict(run_next.to_input(parts))
+	const prep = run_prep_cli.to_parts(issue_number, reads)
+	const verdict = run_step.pre_verdict(run_next.to_input(prep))
+	const trust_stop = run_entry_trust.stop_of(reads.content, reads.state, issue_number)
 
-	return { report: run_prep.format_report(parts), verdict }
+	return { prep, verdict, trust_stop }
+}
+
+function entry_text(parts: EntryParts): string {
+	return session_cite.text(run_entry.format_report(parts))
 }
 
 function emit(parts: EntryParts): number {
-	console.info(session_cite.text(run_entry.format_report(parts)))
+	console.info(entry_text(parts))
 
 	return run_entry.exit_code(parts)
 }
 
-// The summary of a run that stopped before it read the issue: the token that stopped it, no verdict,
-// and the note that stands in for the report body.
+// The bundle emitted as it fits the Bash result, measured on the composite `emit` prints.
+function emit_fitted(entry: Omit<EntryParts, 'report'>, prep: PrepParts): number {
+	const report = run_entry_spill.fit(prep, (text) => entry_text({ ...entry, report: text }))
+
+	return emit({ ...entry, report })
+}
+
+// The summary of a run that stopped without a report — before it read the issue, or after reading an
+// issue it will not run: the token that stopped it, no verdict, and the note that stands in for the
+// report body.
 function stop_report(issue_number: string, hold: string, cost: string, report: string): number {
 	return emit({ issue_number, hold, cost, verdict: run_entry.NO_VERDICT, report })
 }
@@ -157,16 +176,37 @@ interface StopCall {
 	command: StageCommand
 	reason: string
 	should_release: boolean
+	recommended?: string
 }
 
-async function stop_run({ parts, command, reason, should_release }: StopCall): Promise<number> {
+async function stop_run({ parts, command, ...notice }: StopCall): Promise<number> {
 	const code = stop_report(parts.issue_number, parts.hold, parts.cost, parts.report)
 
-	await run_entry_stop.stop({ issue_number: parts.issue_number, command, reason, should_release })
+	await run_entry_stop.stop({ issue_number: parts.issue_number, command, ...notice })
 
 	return code
 }
 
+// **An untrusted author's issue stops after the reads, not before the claim** — the trust is decided
+// by the read `run:prep` already makes, so the gate adds no call; the hold this call claimed is
+// released. It exits non-zero though the hold and the budget both allowed the run. A trust read that
+// failed stops here too, under its own reason (`run-entry-trust.ts`).
+async function stop_untrusted(
+	{ issue_number, command }: EntryRequest,
+	{ hold, cost }: Pick<EntryParts, 'hold' | 'cost'>,
+	{ reason, report, recommended }: TrustStop,
+): Promise<number> {
+	await stop_run({
+		parts: { issue_number, hold, cost, report },
+		command,
+		reason,
+		should_release: true,
+		recommended,
+	})
+
+	return FAILURE_EXIT_CODE
+}
+
 interface Resume {
 	token: string
 	code: number
@@ -250,17 +290,50 @@ async function mark_planned(issue_number: string, state: StageState): Promise<vo
 	if (state === run_stage.PLANNED) await run_event_plan.emit_plan(issue_number)
 }
 
+// **A lane child probes its declared paths before the investigation** (joshuafolkken/kit#5211): a running
+// lane that planned one of them since dispatch takes the lane back here, at the cost of the entry
+// alone, rather than after the investigation `lane:plan` would otherwise yield on. `lane:plan` has
+// already released the hold and noted the yield, so this only reports it — no stop notice, as for
+// any yield.
+async function yields_at_entry(issue_number: string): Promise<boolean> {
+	if (!lane_child_marker.is_child_of(process.cwd())) return false
+
+	return await lane_plan_check.yield_at_entry(Number(issue_number))
+}
+
+// The report of a lane given back at the entry, exiting as `lane:plan` does on a yield.
+function yield_report(
+	issue_number: string,
+	{ hold, cost }: Pick<EntryParts, 'hold' | 'cost'>,
+): number {
+	stop_report(issue_number, hold, cost, YIELD_NOTE)
+
+	return lane_plan_check.YIELD_EXIT_CODE
+}
+
 // The tree is held and the budget allows the run, so the issue is marked as running before its reads
 // — the label then shows in the `labels:` line the report below carries.
-async function proceed(issue_number: string, hold: string, cost: string): Promise<number> {
+// The plan event is written only once the run passed the trust gate.
+async function proceed(
+	request: EntryRequest,
+	{ hold, cost }: Pick<EntryParts, 'hold' | 'cost'>,
+	state: StageState,
+): Promise<number> {
+	const { issue_number } = request
+
 	await run_label.mark(issue_number)
 	const reads = await gather_reads(issue_number)
 
+	if (reads.trust_stop) return await stop_untrusted(request, { hold, cost }, reads.trust_stop)
+	if (await yields_at_entry(issue_number)) return yield_report(issue_number, { hold, cost })
+
+	await mark_planned(issue_number, state)
+
 	// The issue the report prints is the one the run has read, so it is the baseline a person's later
 	// update is measured against (`issue-watch.ts`).
 	await issue_watch.record_baseline_here(issue_number)
 
-	const code = emit({ issue_number, hold, cost, verdict: reads.verdict, report: reads.report })
+	const code = emit_fitted({ issue_number, hold, cost, verdict: reads.verdict }, reads.prep)
 
 	// The entry's own read — the split assessment every run answers before its work — printed here so
 	// the reader does not spend a turn fetching it.
@@ -269,10 +342,8 @@ async function proceed(issue_number: string, hold: string, cost: string): Promis
 	return run_step_section.print_section(run_step_section.ENTRY)
 }
 
-async function claim_run(
-	{ issue_number, command }: EntryRequest,
-	state: StageState,
-): Promise<number> {
+async function claim_run(request: EntryRequest, state: StageState): Promise<number> {
+	const { issue_number, command } = request
 	const hold = await claim_hold(issue_number, command)
 
 	if (hold !== run_hold_cli.HOLD_VERDICT) {
@@ -289,9 +360,7 @@ async function claim_run(
 		return await stop_run({ parts, command, reason: BUDGET_REASON, should_release: true })
 	}
 
-	await mark_planned(issue_number, state)
-
-	return await proceed(issue_number, hold, cost)
+	return await proceed(request, { hold, cost }, state)
 }
 
 // A carried cut is asked first, before anything is read (`run:cut --resume`); `kickoff` claims and cuts