@joshuafolkken/kit 1.1784.0 → 1.2114.0

package/scripts/rules/lane-background.ts

@@ -35,10 +35,15 @@ import { run_tail_rule } from './run-tail-rule'
 
 // The josh subcommands that run long enough to be backgrounded, as `time_shell` names them — canonical,
 // so the `ga` / `g` / `fu` aliases are covered by the one spelling.
-const SHIP_COMMAND = `${time_shell.JOSH_PREFIX}ship`
+// `ship`, `ship:wait` and `lane:plan` are run in the foreground at the cap rather than refused: a
+// `ship:wait` left at the two-minute default is moved aside mid-chunk and dies with the turn, its verdict
+// unread, and a cut `lane:plan` leaves its plan recorded with the check it gates unanswered.
+const FOREGROUND_COMMANDS: ReadonlySet<string> = new Set(
+	['ship', 'ship:wait', 'lane:plan'].map((name) => `${time_shell.JOSH_PREFIX}${name}`),
+)
 const LONG_RUNNING_COMMANDS: ReadonlySet<string> = new Set([
 	...['gate', 'git', 'followup'].map((name) => `${time_shell.JOSH_PREFIX}${name}`),
-	SHIP_COMMAND,
+	...FOREGROUND_COMMANDS,
 ])
 
 const BACKGROUND_KEY = 'run_in_background'
@@ -57,13 +62,13 @@ function long_commands_of(command: string): Array<string> {
 	return time_shell.josh_commands_of(command).filter((name) => LONG_RUNNING_COMMANDS.has(name))
 }
 
-// A call whose long-running work is `ship` alone. In a child a foreground `ship` already detaches
-// itself after its preflight (`run-ship-cli.ts` → `should_detach`), so the only fault in backgrounding
-// it is the flag — and the flag is what the hook rewrites.
+// A call whose long-running work is `ship` or `ship:wait` alone. In a child a foreground `ship` already
+// detaches itself after its preflight (`run-ship-cli.ts` → `should_detach`), so the only fault in
+// backgrounding it is the flag — and the flag is what the hook rewrites.
 function ships_alone(command: string): boolean {
 	const names = long_commands_of(command)
 
-	return names.length > 0 && names.every((name) => name === SHIP_COMMAND)
+	return names.length > 0 && names.every((name) => FOREGROUND_COMMANDS.has(name))
 }
 
 function backgrounded_bash_command(call: GuardedCall): string | undefined {
@@ -135,10 +140,10 @@ function foreground_input(
 }
 
 const FOREGROUND_NOTE =
-	"lane background: a lane child's `josh ship` backgrounded, by its flag or by outrunning the Bash " +
-	'timeout, dies with the headless turn before its supervisor exists — so it was run in the ' +
-	'foreground at the 600000 ms cap, where it detaches itself after the preflight. End the turn on ' +
-	'`launched` / `busy`.'
+	"lane background: a lane child's `josh ship`, `josh ship:wait` or `josh lane:plan` backgrounded, by its flag or by " +
+	'outrunning the Bash timeout, dies with the headless turn — so it was run in the foreground at the ' +
+	'600000 ms cap, where `ship` detaches itself after the preflight. Then follow ' +
+	'`chain-rule.md` step 0 (`josh ship:wait` on `launched`).'
 
 type LaunchedIds = (block: TranscriptBlock) => ReadonlyArray<string>
 
@@ -182,11 +187,17 @@ function pending_agent_ids(tail: string): ReadonlyArray<string> {
 	return unfinished_ids(tail, (block) => [block.agent_id])
 }
 
+// The backgrounded commands alone — what tells a stop with only subagents left apart from one a
+// command still holds.
+function pending_command_ids(tail: string): ReadonlyArray<string> {
+	return unfinished_ids(tail, (block) => [block.background_id])
+}
+
 const LANE_BACKGROUND_REASON =
 	'⛔ lane background: this session is a dispatched lane child (`JOSH_LANE_CHILD`), a headless ' +
 	'process whose background tasks die when the turn ends. Hand over to ' +
-	'`pnpm josh ship --detach --review "<title> #<N>"`, issued in the foreground, then end the turn on ' +
-	'`launched` / `busy`. It fires on every occurrence ' +
+	'`pnpm josh ship --detach --review "<title> #<N>"`, issued in the foreground, then `josh ship:wait <N>` on ' +
+	'`launched` or end the turn. It fires on every occurrence ' +
 	'(`.claude/skills/workflow-commands/chain-rule.md` step 0).'
 
 const LANE_BACKGROUND_STOP_REASON =
@@ -194,6 +205,15 @@ const LANE_BACKGROUND_STOP_REASON =
 	'it launched has not finished, and ending this turn kills it. Wait for it in the foreground, or ' +
 	're-issue the work through `pnpm josh ship --detach` — do not notify, stop or repeat your reply.'
 
+// **Only subagents left: the wait that receives their answer** (joshuafolkken/kit#4803). Their completion
+// notice is delivered only when a tool call ends, so one long hand-written loop holds it back until the
+// loop itself gives up; short foreground calls, one at a time, let it in at the first one to end.
+const LANE_AGENT_STOP_REASON =
+	'⛔ lane agent stop: this is a dispatched lane child (`JOSH_LANE_CHILD`) and a subagent it launched ' +
+	'has not finished; ending this turn kills it. Its completion notice arrives only when a tool call ' +
+	'ends: wait with one short foreground call at a time (`sleep 20`) until it arrives — never a loop ' +
+	'over its `.output`. Do not notify, stop or repeat your reply.'
+
 // The row itself, so `delivered-rules.ts` spreads one entry. It fires on every occurrence (`decide`
 // returns true): a child must never background these, so the route is always the detached ship, never
 // a reissue. It declares no `keeps`: the detached ship is a different command, not this call made right.
@@ -202,17 +222,24 @@ const ROW = {
 	is_trigger: (call: GuardedCall): boolean => is_background_long_run(call),
 	reason: LANE_BACKGROUND_REASON,
 	decide: (): boolean => true,
+	// `pretool-guard.ts` rewrites a lone `josh ship` to the foreground rather than refusing it; this is
+	// the note it attaches, so `rule-value.ts` counts that rewrite as this row's delivery.
+	rewrite_note: FOREGROUND_NOTE,
+	// The Stop hook delivers the same rule at the turn's end, for the background task or subagent the
+	// turn would kill.
+	stop_reasons: [LANE_BACKGROUND_STOP_REASON, LANE_AGENT_STOP_REASON],
 	about: {
 		title: 'Lane child background push',
 		topic: '`.claude/skills/workflow-commands/background-commands.md`',
 		fires:
-			'a dispatched lane child backgrounding `josh gate` / `git` / `followup` / `ship`; it hands over `pnpm josh ship --detach`. Every occurrence',
+			'a dispatched lane child backgrounding `josh gate` / `git` / `followup` / `ship`; it hands over `pnpm josh ship --detach`; the Stop hook also blocks ending a turn with its background task or subagent unfinished. Every occurrence',
 		quiet: 'not a lane child, or the foreground `ship --detach`',
 	},
 }
 
 const lane_background = {
 	FOREGROUND_NOTE,
+	LANE_AGENT_STOP_REASON,
 	LANE_BACKGROUND_REASON,
 	LANE_BACKGROUND_STOP_REASON,
 	ROW,
@@ -220,6 +247,7 @@ const lane_background = {
 	is_background_long_run,
 	pending_agent_ids,
 	pending_background_ids,
+	pending_command_ids,
 }
 
 export { lane_background }

package/scripts/rules/lane-direct-tool.ts

@@ -1,6 +1,13 @@
-import { command_memory } from '#scripts/gate/command-memory'
+import os from 'node:os'
+import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
+import { command_memory, type ToolCall } from '#scripts/gate/command-memory'
+import { core_weights } from '#scripts/gate/core-weights'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { json_value } from '#scripts/lib/json-value'
+import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
+import { time_shell } from '#scripts/time-runtime/time-shell'
 import { bash_triggers } from './bash-triggers'
+import { timed_rerun } from './timed-rerun'
 
 // A dispatched lane child is stopped from running a heavy tool directly. The core budget
 // (`scripts/gate/core-budget.ts`) counts only what a `josh` command reserves, so an `eslint`, `vitest`,
@@ -20,16 +27,102 @@ import { bash_triggers } from './bash-triggers'
 //
 // **Lane children only.** An interactive session outside a lane keeps its direct runs; the overlap this
 // prevents is between concurrently dispatched lanes.
+//
+// **The commonest direct run is rewritten rather than refused** (joshuafolkken/kit#5147): the refusal's
+// reissue was the same line behind `pnpm josh reserved-run <weight> --`, a round trip the hook can make
+// itself. The weight is the gate's own for that tool — `core_weights.CORE_WEIGHTS`, and for vitest the
+// workers `command_memory.workers_of` reads — so the claim matches what the gate claims. `reserved-run`
+// runs its command as an argv, not a shell line, so only a line that is one command is wrapped: any
+// chain, pipe, redirection, group, substitution, comment, env prefix or timer leaves it to the refusal,
+// as does a multi-worker eslint, which no reservation makes safe. The wrapped line runs in the directory
+// it was typed in (`reserved-run.ts` → `command_directory`).
 
-const HEAVY_TOOLS: ReadonlySet<string> = new Set(['eslint', 'vitest', 'cspell', 'tsc'])
+const ESLINT = 'eslint'
+const VITEST = 'vitest'
+const HEAVY_TOOLS: ReadonlySet<string> = new Set([ESLINT, VITEST, 'cspell', 'tsc'])
+const TOOL_WEIGHTS: Readonly<Partial<Record<string, number>>> = {
+	[ESLINT]: core_weights.CORE_WEIGHTS.lint,
+	tsc: core_weights.CORE_WEIGHTS.type_check,
+	cspell: core_weights.CORE_WEIGHTS.spell_check,
+}
+const SINGLE_CORE = 1
+const RESERVED_RUN = 'pnpm josh reserved-run'
+// Read on the quote-blanked line: a quoted `;` or `|` is text. `2>&1` applies to the wrapper alike.
+const MULTI_COMMAND_SYNTAX = /[;|&<>()`#\n]|\$\(/u
+const KEPT_REDIRECT = /2>&1/gu
+const ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u
 
-// True when any command on the shell line launches one of the heavy tools outside a `reserved-run`.
-// The cut is quote-aware, so a tool name inside a quoted argument (`git commit -m "run eslint"`) is
-// never read as a command; a quoted script handed to a shell is.
-function runs_heavy_tool(command: string): boolean {
+const RESERVED_NOTE =
+	'↻ lane direct tool: a lane child ran a heavy tool directly, so the line was wrapped in ' +
+	'`pnpm josh reserved-run <weight> --` to claim its cores beside the other lanes. Prefer ' +
+	'`pnpm josh lint:related` / `test:related` / `cspell:dot` — `docs/josh-commands-automation.md`.'
+
+// The heavy tools the line launches outside a `reserved-run`. The cut is quote-aware, so a tool name
+// inside a quoted argument (`git commit -m "run eslint"`) is never read as a command; a quoted script
+// handed to a shell is.
+function direct_calls(command: string): Array<ToolCall> {
 	return command_memory
 		.tool_calls_of(command)
-		.some((call) => !call.is_reserved && HEAVY_TOOLS.has(call.name))
+		.filter((call) => !call.is_reserved && HEAVY_TOOLS.has(call.name))
+}
+
+// True when any command on the shell line launches one of the heavy tools outside a `reserved-run`.
+function runs_heavy_tool(command: string): boolean {
+	return direct_calls(command).length > 0
+}
+
+function weight_of(call: ToolCall, cores: number): number {
+	if (call.name === VITEST) return command_memory.workers_of(call, cores)
+
+	return TOOL_WEIGHTS[call.name] ?? SINGLE_CORE
+}
+
+// True when the whole line is one command, so a `reserved-run` can carry it as its argv.
+function is_one_command(command: string): boolean {
+	const judged = time_shell.blanked(command)
+
+	if (judged === undefined) return false
+
+	return (
+		!MULTI_COMMAND_SYNTAX.test(judged.replaceAll(KEPT_REDIRECT, ' ')) &&
+		!ENV_ASSIGNMENT.test(judged)
+	)
+}
+
+// A timed line stays as typed: `timed-rerun` reads the timer at the segment start, and a wrapper in front
+// would hide it from that row.
+function can_wrap(line: string, cores: number): boolean {
+	if (!is_one_command(line) || timed_rerun.is_timed_run(line)) return false
+
+	return !command_memory.runs_multi_worker_eslint(line, cores)
+}
+
+// The line behind `reserved-run` at its largest tool's weight, or `undefined` where it must be refused.
+function reserved_command(
+	command: string,
+	cores: number = os.availableParallelism(),
+): string | undefined {
+	const line = command.trim()
+	const calls = direct_calls(line)
+
+	if (!can_wrap(line, cores) || calls.length === 0) return undefined
+
+	const weight = Math.max(...calls.map((call) => weight_of(call, cores)))
+
+	return `${RESERVED_RUN} ${String(weight)} -- ${line}`
+}
+
+function is_lane_bash(call: GuardedCall): boolean {
+	return call.name === cost_blocks.BASH_TOOL && lane_child_marker.is_child_of(process.cwd())
+}
+
+// The call's input with its line wrapped, for a lane child alone; `undefined` where nothing is rewritten.
+function reserved_input(call: GuardedCall): Record<string, unknown> | undefined {
+	if (!is_lane_bash(call) || !json_value.is_record(call.input)) return undefined
+
+	const command = reserved_command(time_shell.bash_command(call.input))
+
+	return command === undefined ? undefined : { ...call.input, command }
 }
 
 // True when this session is a dispatched lane child launching a heavy tool directly, or eslint with
@@ -47,7 +140,7 @@ const LANE_DIRECT_TOOL_REASON =
 	'⛔ lane child running `eslint` / `vitest` / `cspell` / `tsc` directly, or multi-worker eslint: ' +
 	'it overlaps the other lanes. Run `pnpm josh lint:related`, `pnpm josh test:related`, ' +
 	'`pnpm josh cspell:dot` or `pnpm josh reserved-run <weight> -- <command>`, eslint at ' +
-	'`--concurrency off`; measure concurrency outside a lane. Refused on every occurrence.'
+	'`--concurrency off`. Only a one-command line is wrapped for you. Refused on every occurrence.'
 
 // The row itself, so `delivered-rules.ts` spreads one entry; the shape is `lane-switch-main.ts`'s.
 const ROW = {
@@ -55,19 +148,24 @@ const ROW = {
 	is_trigger: bash_triggers.on_bash_command(is_lane_direct_tool),
 	reason: LANE_DIRECT_TOOL_REASON,
 	decide: (): boolean => true,
+	rewrite: reserved_input,
+	rewrite_note: RESERVED_NOTE,
 	about: {
 		title: 'Lane child running a heavy tool directly',
 		topic: '`docs/josh-commands-automation.md` → `josh reserved-run`',
 		fires:
-			'a dispatched lane child launching `eslint` / `vitest` / `cspell` / `tsc` (bare, `pnpm exec`, `npx`, inside `sh -c`), or eslint with `--concurrency` other than `off` / `1` by any path, `reserved-run` included. Every occurrence',
+			"a dispatched lane child launching `eslint` / `vitest` / `cspell` / `tsc` (bare, `pnpm exec`, `npx`, inside `sh -c`), or eslint with `--concurrency` other than `off` / `1` by any path, `reserved-run` included. A one-command line is rewritten behind `pnpm josh reserved-run <weight> --` at the gate's weight; a chained, piped, redirected or env-prefixed line and a multi-worker eslint are refused, every occurrence",
 		quiet: 'not a lane child, or the run goes through `pnpm josh` with single-worker eslint',
 	},
 }
 
 const lane_direct_tool = {
 	LANE_DIRECT_TOOL_REASON,
+	RESERVED_NOTE,
 	ROW,
 	is_lane_direct_tool,
+	reserved_command,
+	reserved_input,
 	runs_heavy_tool,
 }
 

package/scripts/rules/lane-interactive-ask.ts

@@ -1,6 +1,7 @@
 import { interactive_ask } from '#scripts/agent/interactive-ask'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
+import { stop_rules } from './stop-rules'
 
 // A dispatched lane child's interactive ask is refused and routed to the park procedure, delivered at
 // the call it binds on.
@@ -55,12 +56,14 @@ const ROW = {
 	is_trigger: is_interactive_ask,
 	reason: LANE_INTERACTIVE_ASK_REASON,
 	decide: (): boolean => true,
+	// A reply asking a person for the git index is the same ask, delivered by the Stop hook.
+	stop_reasons: [stop_rules.LANE_INDEX_REASON],
 	about: {
 		title: 'Lane child interactive ask',
 		topic:
 			'`.claude/skills/workflow-commands/pre-gate-cut.md` → "The interactive ask is refused one call earlier"',
 		fires:
-			"a dispatched lane child's `AskUserQuestion`; it hands over the park procedure. Every occurrence",
+			"a dispatched lane child's `AskUserQuestion`; it hands over the park procedure; the Stop hook also blocks a reply asking a person for the git index. Every occurrence",
 		quiet: 'not a lane child, or not an interactive tool',
 	},
 }

package/scripts/rules/lane-park.ts

@@ -122,14 +122,16 @@ function records_the_park(command: string): boolean {
 }
 
 // The instruction in the shape a refusal can carry: what the stop must leave behind, how to record it,
-// and the reissue sentence every delivery needs. **The park procedure is named, not restated** — the
+// and that the park is the stop itself — no notify follows it, since the `Stop` hook sends one still owed
+// on the hold (`stop-rules.ts` → `needs_notify`). **The park procedure is named, not restated** — the
 // single source is `backlogrun-park.md` → "park and continue", and a second copy here would be the
 // clone `CLAUDE.md` prohibits.
 const LANE_PARK_REASON =
 	'⛔ lane child park: this session is a dispatched lane child, so a stop for a person parks first: ' +
 	'`pnpm josh run:park <N> --body-file <path>` (question, options, stash — it applies ' +
 	'`needs-decision`); a ' +
-	'`needs-human-review` / `already-done` stop already is. Reissue this notify, once per run ' +
+	'`needs-human-review` / `already-done` stop already is. The park is the stop: no notify ' +
+	'after it. Refused once per run ' +
 	'(`.claude/skills/workflow-commands/pre-gate-cut.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. **Once per run rather than `decide`.** The

package/scripts/rules/lane-spilled-read.ts

@@ -0,0 +1,90 @@
+import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { json_value } from '#scripts/lib/json-value'
+import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
+
+// A dispatched lane child's whole `Read` of a spilled Bash result is refused and pointed at a narrowed
+// read (joshuafolkken/kit#5040).
+//
+// **The spill is the largest single result a cut session carries.** A Bash result over the harness cap
+// is saved to `tool-results/<id>.txt` and previewed; reading that file back whole put 10,000–18,000
+// characters into the context in one call, 10–40% of a cut session's tool results. A `grep` or
+// `sed -n` over the same file reads only the lines the run needs.
+//
+// **Lane children only, every occurrence.** The cut that the context growth triggers is a lane
+// child's; a person in an interactive session keeps the whole read. A paginated `Read` (an `offset` or
+// a `limit`) is already narrowed and passes.
+
+const SPILLED_RESULT = /\/tool-results\/[^/]+\.txt$/u
+
+function read_input(call: GuardedCall): Record<string, unknown> | undefined {
+	if (call.name !== 'Read' || !json_value.is_record(call.input)) return undefined
+
+	return call.input
+}
+
+function reads_spilled_result(input: Record<string, unknown>): boolean {
+	const { file_path } = input
+
+	return typeof file_path === 'string' && SPILLED_RESULT.test(file_path)
+}
+
+function is_paginated(input: Record<string, unknown>): boolean {
+	return input['offset'] !== undefined || input['limit'] !== undefined
+}
+
+// The occasion the rule governs: any `Read` of a spilled result, whole or narrowed.
+function reaches_spilled_result(call: GuardedCall): boolean {
+	const input = read_input(call)
+
+	return input !== undefined && reads_spilled_result(input)
+}
+
+// Keeping the rule: the spilled result read with a page, never whole.
+function keeps_narrowed_read(call: GuardedCall): boolean {
+	const input = read_input(call)
+
+	return input !== undefined && reads_spilled_result(input) && is_paginated(input)
+}
+
+function is_whole_spilled_read(
+	call: GuardedCall,
+	is_lane_child: boolean = lane_child_marker.is_child_of(process.cwd()),
+): boolean {
+	if (!reaches_spilled_result(call) || keeps_narrowed_read(call)) return false
+
+	return is_lane_child
+}
+
+const LANE_SPILLED_READ_REASON =
+	'⛔ lane child reading a spilled Bash result whole: `tool-results/<id>.txt` is the output that ' +
+	'overflowed the cap, and reading it back whole fills the context the cut is measured on. Read only ' +
+	'the lines you need: `grep -n <pattern> <path>` or `sed -n <from>,<to>p <path>`. ' +
+	'Refused on every occurrence.'
+
+// The row itself, so `delivered-rules.ts` spreads one entry; the shape is `lane-direct-tool.ts`'s, with
+// the narrowed read as its compliance call.
+const ROW = {
+	id: 'lane-spilled-read',
+	is_trigger: is_whole_spilled_read,
+	reason: LANE_SPILLED_READ_REASON,
+	decide: (): boolean => true,
+	keeps: keeps_narrowed_read,
+	reaches: reaches_spilled_result,
+	about: {
+		title: 'Lane child reading a spilled Bash result whole',
+		topic: '`prompts/collaboration-workflow/output-bounds.md`',
+		fires:
+			"a dispatched lane child's `Read` of a `tool-results/<id>.txt` file with no `offset` or `limit`. Every occurrence",
+		quiet: 'not a lane child, another file, or a paginated `Read`',
+	},
+}
+
+const lane_spilled_read = {
+	LANE_SPILLED_READ_REASON,
+	ROW,
+	is_whole_spilled_read,
+	keeps_narrowed_read,
+	reaches_spilled_result,
+}
+
+export { lane_spilled_read }

package/scripts/rules/lane-split-park.ts

@@ -17,7 +17,7 @@ import { tail_commands } from './tail-commands'
 // carries `epic` as a split (`run-merge.ts`), so the label is never what tells it.
 //
 // **The material is the run's own calls.** The promotion is a `josh epic --promote <N>` this run issued,
-// read off the transcript tail as `filing-cap.ts` reads its filings — a tool call, never prose, so a
+// read off the transcript tail as `turn-filings.ts` reads its filings — a tool call, never prose, so a
 // child that merely read a document quoting the command is not mistaken for one that ran it. Only a
 // promotion of the dispatched issue counts: the epic a mid-run split promotes is the child's own Issue.
 

package/scripts/rules/lane-switch-main.ts

@@ -19,8 +19,8 @@ import { shell_segments } from './shell-segments'
 //
 // **It refuses rather than rewrites, because a `PreToolUse` guard can only `allow` / `deny` a command,
 // never substitute a different one**. So the refusal hands back the next command: the lane is already on its own issue
-// branch, branched from a fresh default before it opened, and the latest default is brought in during the
-// gate by `pnpm josh main:merge` — so skip the step and keep implementing on the current branch.
+// branch, branched from a fresh default before it opened, and the latest default is brought in before the
+// gate by `josh ship`'s sync — so skip the step and keep implementing on the current branch.
 //
 // **The branch is judged against the lane's own, not the name `main`.** `already used by worktree` is a
 // property of any branch the primary work tree holds, not of the literal `main`, and the default branch
@@ -108,8 +108,8 @@ function is_switch_away_from_lane(
 const LANE_SWITCH_MAIN_REASON =
 	'⛔ lane child on `git switch main`: this session is a dispatched lane child, and switching to the ' +
 	'default branch here always fails (`already used by worktree`: the primary checkout holds it). Skip ' +
-	'this step and keep implementing on the current branch; `pnpm josh main:merge` brings the default ' +
-	'in during the gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).'
+	"this step and keep implementing on the current branch; `pnpm josh ship`'s sync brings the default " +
+	'in before its gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `is_trigger` reads the input through
 // `on_bash_command` — the `Bash` tool-name gate every command row shares — and `decide` returns true so

package/scripts/rules/last-prompt.ts

@@ -1,32 +1,18 @@
 import { json_value } from '#scripts/lib/json-value'
 import { time_reported_failure } from '#scripts/time-runtime/time-reported-failure'
 import { z } from 'zod'
-import { filing_cap } from './filing-cap'
+import { turn_filings } from './turn-filings'
 
-// The text of the person's last prompt on a transcript tail — what the stop guard's citation row
-// reads to tell a `#N` the person quoted from one the run brought in itself.
+// The person's prompts on a transcript tail — what the stop guard reads to tell a question it answers
+// and the pause a recorded notify belongs to.
 //
-// **A prompt is `filing_cap`'s prompt line, minus what the harness wrote there.** A skill's body is a
+// **A prompt is `turn_filings`' prompt line, minus what the harness wrote there.** A skill's body is a
 // `user` line with no tool result too, but it carries `isMeta`; a background task's completion notice
 // and a subagent's hand-back carry an `origin` whose `kind` is not `human`. Each is the harness
-// speaking, not the person — and a notice can name the very Issue the run filed — so only a line with
-// no `origin` (an SDK prompt) or a `human` one is read.
-//
-// **A workflow invocation quotes nothing.** `fullrun #2819` names this repository's own Issue, so a
-// bare `#2819` in that run's report is a citation slip like any other, and the prompt yields no text —
-// a resumed lane child's prompt included, since it ends on the same invocation.
-
-const WORKFLOW_KEYWORDS: ReadonlySet<string> = new Set([
-	'kickoff',
-	'fullrun',
-	'halfrun',
-	'prrun',
-	'backlogrun',
-])
+// speaking, not the person, so only a line with no `origin` (an SDK prompt) or a `human` one is read.
+
 const NO_PROMPT = ''
 const HUMAN_ORIGIN = 'human'
-// The word before the prompt's last one — where a trailing `fullrun #N` puts its keyword.
-const KEYWORD_BEFORE_ARGUMENT = -2
 
 const PROMPT_LINE_SCHEMA = z.object({
 	isMeta: z.boolean().nullish(),
@@ -61,45 +47,32 @@ function person_text(line: string): string | undefined {
 	return time_reported_failure.result_text(person.message.content)
 }
 
-// A keyword opening the prompt is what a person types; a keyword before its one trailing argument is a
-// lane child's resume prompt, whose preamble ends on `fullrun #N` (`lane-child-invocation.ts`).
-function is_invocation(prompt: string): boolean {
-	const words = prompt.trim().split(/\s+/u)
-
-	return [words.at(0), words.at(KEYWORD_BEFORE_ARGUMENT)].some((word) =>
-		WORKFLOW_KEYWORDS.has(word ?? NO_PROMPT),
-	)
-}
-
-function prompt_line_text(line: string): string | undefined {
-	return filing_cap.is_prompt_line(line) ? person_text(line) : undefined
-}
-
-// The last person prompt on the tail; '' when none is on it or it is an invocation.
-function prompt_text(tail: string): string {
-	const text = tail
-		.split('\n')
-		.map((line) => prompt_line_text(line))
-		.findLast((one) => one !== undefined)
-
-	return text === undefined || is_invocation(text) ? NO_PROMPT : text
-}
-
 // **The prompt that opened this turn, when a person typed it** — '' when the harness opened it (a task
 // notification, a subagent's hand-back), so a question asked turns ago does not answer for a stop the
 // run reached on its own since (`stop-decision.ts` → `is_question`).
 function turn_prompt(tail: string): string {
-	const opener = tail.split('\n').findLast((line) => filing_cap.is_prompt_line(line))
+	const opener = tail.split('\n').findLast((line) => turn_filings.is_prompt_line(line))
 	if (opener === undefined) return NO_PROMPT
 
 	return person_text(opener) ?? NO_PROMPT
 }
 
+// **The person's last prompt on the tail**, past what the harness wrote after it (a skill body, a task
+// notification) — `undefined` when no prompt of theirs is on it, so an unread prompt is told apart
+// from one that asked nothing.
+function person_prompt(tail: string): string | undefined {
+	return tail
+		.split('\n')
+		.filter((line) => turn_filings.is_prompt_line(line))
+		.map((line) => person_text(line))
+		.findLast((text) => text !== undefined)
+}
+
 // When the person last prompted on the tail, or `undefined` when no prompt of theirs is on it.
 function prompt_time(tail: string): string | undefined {
 	return tail
 		.split('\n')
-		.filter((line) => filing_cap.is_prompt_line(line))
+		.filter((line) => turn_filings.is_prompt_line(line))
 		.map((line) => person_line(line)?.timestamp ?? undefined)
 		.findLast((time) => time !== undefined)
 }
@@ -120,6 +93,6 @@ function pause_start(tail: string): string | undefined {
 	return prompt_time(tail) ?? tail_time(tail)
 }
 
-const last_prompt = { pause_start, prompt_text, turn_prompt }
+const last_prompt = { pause_start, person_prompt, turn_prompt }
 
 export { last_prompt }

package/scripts/rules/oracle-consulted.ts

@@ -80,7 +80,7 @@ function row_for(oracle: Oracle, firing_point: FiringPoint): DeliveredRule {
 
 // One row per oracle that declared a firing point, in registry order. Spread into `DELIVERED_RULES`
 // after the filing rows, so a firing point that overlaps a filing (`issue:lint`) delivers on the
-// reissue rather than ahead of `filing-cap`.
+// reissue rather than ahead of the filing rows.
 const ROWS: ReadonlyArray<DeliveredRule> = oracle_firing
 	.firing_oracles()
 	.map(({ oracle, firing_point }) => row_for(oracle, firing_point))

package/scripts/rules/permission-guards.ts

@@ -3,6 +3,7 @@ import { direct_pr_create } from './direct-pr-create'
 import { index_guard } from './index-guard'
 import { pr_merge } from './pr-merge'
 import { protected_files } from './protected-files'
+import { repo_admin } from './repo-admin'
 
 // The three rows that close the deny-list bypasses, gathered so
 // `delivered-rules.ts` spreads one entry. Each reads argv or a file path rather than a glob: an index
@@ -11,13 +12,16 @@ import { protected_files } from './protected-files'
 // other row's — `git restore` is split with `worktree-mutation` by `--staged` alone. The fourth row,
 // `direct-pr-create`, closes the same kind of gap for `gh pr create`, which
 // the deny list never listed: it claims `gh pr create` and a `gh api` write to the pulls collection.
-// The fifth, `pr-merge`, claims a merge in every spelling the `gh pr merge*` glob misses.
+// The fifth, `pr-merge`, claims a merge in every spelling the `gh pr merge*` glob misses. The sixth,
+// `repo-admin`, claims a non-`DELETE` write to the repository's administration, which
+// `destructive-command` leaves open.
 const ROWS = [
 	index_guard.ROW,
 	destructive_command.ROW,
 	protected_files.ROW,
 	direct_pr_create.ROW,
 	pr_merge.ROW,
+	repo_admin.ROW,
 ] as const
 
 const permission_guards = { ROWS }