@joshuafolkken/kit 1.1784.0 → 1.2114.0

package/scripts/run/cut/run-cut-digest.ts

@@ -0,0 +1,152 @@
+import path from 'node:path'
+import { cost_transcript } from '#scripts/cost-runtime/cost-transcript'
+import { own_session } from '#scripts/cost-runtime/own-session'
+import { duplicate_reads } from '#scripts/delegation/duplicate-read-guard'
+import { json_value } from '#scripts/lib/json-value'
+import { transcript_record, type TranscriptRecord } from '#scripts/lib/transcript-record'
+import { time_spans } from '#scripts/time-runtime/time-spans'
+import { z } from 'zod'
+
+// What the cut session already read and decided, derived from its own transcript so the resumed
+// process does not spend minutes re-reading to rebuild it (joshuafolkken/kit#5040).
+//
+// **Derived, not written by the agent.** The reads are tool calls and the decisions are the
+// `Auto-decided:` lines the session already logs (`CLAUDE.md` → "Decision autonomy") — in its reply,
+// or in the Issue comment a tool call posts — so the cut takes both from the transcript: nothing to
+// forget, and no handoff key the refusal has to spell out.
+
+interface SessionDigest {
+	read: ReadonlyArray<string>
+	decisions: ReadonlyArray<string>
+}
+
+const session_digest_schema = z.object({
+	read: z.array(z.string()),
+	decisions: z.array(z.string()),
+})
+
+// The newest entries are kept: the record has a byte bound, and the last reads are the ones the
+// resumed work continues from.
+const MAX_READ_ENTRIES = 40
+const MAX_DECISIONS = 12
+const MAX_DECISION_CHARS = 240
+const DECISION_PREFIX = 'Auto-decided:'
+// A logged decision wherever it starts a line or follows a quote or `body=`; the space after the colon
+// keeps out the bare prefix a source file spells.
+const DECISION_LINE = /(?:^|[\s'"=])(Auto-decided: [^\n]+)/gu
+// The quote closing a `body='…'` argument.
+const TRAILING_QUOTES = /['"]$/u
+const ASSISTANT = 'assistant'
+const READ_LABEL = 'Already read before the cut — re-read only the lines you need'
+const DECISIONS_LABEL = 'Decided before the cut — do not reopen'
+
+function shown_path(target: string, cwd: string): string {
+	const relative = path.relative(cwd, path.resolve(cwd, target))
+
+	return relative.startsWith('..') ? target : relative
+}
+
+function newest_unique(entries: ReadonlyArray<string>, limit: number): Array<string> {
+	const unique = [...new Set(entries.toReversed())].toReversed()
+
+	return unique.slice(-limit)
+}
+
+function read_files_of(text: string, cwd: string): Array<string> {
+	const reads = time_spans
+		.parse_timeline(text)
+		.spans.filter((span) => duplicate_reads.is_successful_read(span))
+		.flatMap((span) => span.targets.map((target) => shown_path(target, cwd)))
+
+	return newest_unique(reads, MAX_READ_ENTRIES)
+}
+
+// Where a tool call carries an Issue comment: the Bash command posting it, or the body file a `Write`
+// prepared for it. An `Edit`'s strings are source text, so they are not read.
+const COMMENT_INPUT_KEYS = ['command', 'content']
+
+function input_strings(input: unknown): Array<string> {
+	if (!json_value.is_record(input)) return []
+
+	return COMMENT_INPUT_KEYS.map((key) => input[key]).filter((value) => typeof value === 'string')
+}
+
+// What the session wrote: its reply text and the inputs of its tool calls, where an Issue workflow's
+// decision comment travels.
+function assistant_texts(record: TranscriptRecord | undefined): Array<string> {
+	if (record?.type !== ASSISTANT) return []
+
+	return transcript_record
+		.blocks_of(record)
+		.flatMap((block) => [block.text ?? '', ...input_strings(block.input)])
+}
+
+function decisions_of(text: string): Array<string> {
+	const decisions = text
+		.split('\n')
+		.flatMap((line) => assistant_texts(transcript_record.parse(line)))
+		.flatMap((written) => [...written.matchAll(DECISION_LINE)].map((match) => match[1] ?? ''))
+		.map((line) => line.replace(TRAILING_QUOTES, '').slice(0, MAX_DECISION_CHARS))
+
+	return newest_unique(decisions, MAX_DECISIONS)
+}
+
+function digest_of(text: string, cwd: string): SessionDigest {
+	return { read: read_files_of(text, cwd), decisions: decisions_of(text) }
+}
+
+// The running session's own transcript, or `undefined`. Only a session that names itself is read: the
+// newest-file fallback could pick another session filed under the checkout (a Codex lane's reviewer).
+function own_transcript(cwd: string, environment: NodeJS.ProcessEnv): string | undefined {
+	if (own_session.session_id_of(environment) === undefined) return undefined
+
+	const files = cost_transcript.list_sessions_across(cost_transcript.transcript_directories(cwd))
+	const selection = own_session.select_own_session(files, environment)
+	if (selection.kind === 'absent') return undefined
+
+	const file = files[selection.index]
+
+	return file === undefined ? undefined : cost_transcript.read_optional(file)
+}
+
+// The running session's own digest, or `undefined` when its transcript cannot be found — a cut is
+// never refused for want of one.
+function own_digest(
+	cwd: string = process.cwd(),
+	environment: NodeJS.ProcessEnv = process.env,
+): SessionDigest | undefined {
+	const text = own_transcript(cwd, environment)
+
+	return text === undefined ? undefined : digest_of(text, cwd)
+}
+
+function describe_list(label: string, entries: ReadonlyArray<string>): Array<string> {
+	if (entries.length === 0) return []
+
+	const bullets = entries.map((entry) => `  - ${entry}`).join('\n')
+
+	return [`${label}:\n${bullets}`]
+}
+
+// The block the resume prints; nothing for a digest with neither list.
+function describe_digest(digest: SessionDigest | undefined): string | undefined {
+	if (digest === undefined) return undefined
+
+	const blocks = [
+		...describe_list(READ_LABEL, digest.read),
+		...describe_list(DECISIONS_LABEL, digest.decisions),
+	]
+
+	return blocks.length === 0 ? undefined : blocks.join('\n\n')
+}
+
+const run_cut_digest = {
+	DECISION_PREFIX,
+	describe_digest,
+	digest_of,
+	own_digest,
+	session_digest_schema,
+}
+
+export type { SessionDigest }
+export { run_cut_digest }

package/scripts/run/cut/run-cut-handoff.ts

@@ -25,6 +25,9 @@ interface Handoff {
 	completed: ReadonlyArray<string>
 	remaining: ReadonlyArray<string>
 	untouched: ReadonlyArray<string>
+	// An attested review round's findings not yet `review:record`ed — the conversation that held them is
+	// what the cut drops, so without this the resumed run reruns round 1 (joshuafolkken/kit#4868).
+	findings?: ReadonlyArray<string> | undefined
 }
 
 const handoff_schema = z.object({
@@ -32,6 +35,7 @@ const handoff_schema = z.object({
 	completed: z.array(z.string()),
 	remaining: z.array(z.string()),
 	untouched: z.array(z.string()),
+	findings: z.array(z.string()).optional(),
 })
 
 // The label each list is printed under when the handoff is shown to the resumed session, kept beside
@@ -40,23 +44,34 @@ const COMPLETED_LABEL = 'Completed'
 const REMAINING_LABEL = 'Remaining'
 const UNTOUCHED_LABEL = 'Deliberately untouched'
 const INSTRUCTION_LABEL = 'Instruction (verbatim)'
+const FINDINGS_LABEL =
+	'Round-1 findings, attested but not recorded — do not rerun round 1: fix them, then record them with `pnpm josh review:record --issue <N>`'
 const EMPTY_LIST_NOTE = '(none)'
 
 type HandoffKey = keyof Handoff
 
-function describe_key(key: HandoffKey): string {
-	const value = handoff_schema.shape[key] instanceof z.ZodArray ? '["…"]' : '"…"'
-
-	return `"${key}": ${value}`
+// The placeholders each example value is drawn with; `findings`' says which round it carries. They
+// parse, so a copied example is read as entries — `carried_findings` drops them, or a copied
+// `findings` would pass the unrecorded-round refusal.
+const PLACEHOLDER = '…'
+const FINDINGS_PLACEHOLDER = 'unrecorded'
+const EXAMPLE_LIST = `["${PLACEHOLDER}"]`
+
+const EXAMPLE_VALUES: Readonly<Record<HandoffKey, string>> = {
+	instruction: `"${PLACEHOLDER}"`,
+	completed: EXAMPLE_LIST,
+	remaining: EXAMPLE_LIST,
+	untouched: EXAMPLE_LIST,
+	findings: `["${FINDINGS_PLACEHOLDER}"]`,
 }
 
-// The shape a handoff file must have, derived from `handoff_schema` so the refusal that asks for the file
+// The shape a handoff file must have, keyed from `handoff_schema` so the refusal that asks for the file
 // and the error that rejects it can never name a key the parser does not read — a refusal listing the
 // items in prose invites Markdown, which `parse_handoff` rejects.
-const HANDOFF_FORMAT = `a JSON object {${handoff_schema
+const HANDOFF_FORMAT = `{${handoff_schema
 	.keyof()
-	.options.map((key) => describe_key(key))
-	.join(', ')}}`
+	.options.map((key) => `"${key}":${EXAMPLE_VALUES[key]}`)
+	.join(',')}}`
 
 function parse_handoff(raw: string): Handoff | undefined {
 	return json_value.parse_with(raw, handoff_schema)
@@ -115,6 +130,25 @@ function describe_list(label: string, items: ReadonlyArray<string>): string {
 	return `${label}:\n${bullets}`
 }
 
+// The findings a handoff really carries: a blank entry or an example placeholder is no finding.
+function carried_findings(handoff: Handoff | undefined): ReadonlyArray<string> {
+	const findings = handoff?.findings ?? []
+
+	return findings.filter(
+		(finding) => ![PLACEHOLDER, FINDINGS_PLACEHOLDER, ''].includes(finding.trim()),
+	)
+}
+
+// Carried findings are printed only when there are some — a handoff cut before any review says nothing
+// about one.
+function describe_findings(handoff: Handoff): ReadonlyArray<string> {
+	const findings = carried_findings(handoff)
+
+	if (findings.length === 0) return []
+
+	return [describe_list(FINDINGS_LABEL, findings)]
+}
+
 // The block the resume prints to standard error so the fresh process continues on the original
 // instruction rather than the tree alone.
 function describe_handoff(handoff: Handoff): string {
@@ -123,6 +157,7 @@ function describe_handoff(handoff: Handoff): string {
 		describe_list(COMPLETED_LABEL, handoff.completed),
 		describe_list(REMAINING_LABEL, handoff.remaining),
 		describe_list(UNTOUCHED_LABEL, handoff.untouched),
+		...describe_findings(handoff),
 	].join('\n\n')
 }
 
@@ -130,10 +165,19 @@ function describe_handoff(handoff: Handoff): string {
 // untracked non-ignored file, cannot commit the note with the code. A refusal that asked for "a file"
 // and named no place got one written beside the code and committed (joshuafolkken/kit#3603).
 const HANDOFF_PATH = '.josh/tmp/handoff-<N>.json'
+const ISSUE_PLACEHOLDER = '<N>'
+
+// The handoff path for one issue, relative to the checkout — the path `HANDOFF_PATH` tells the run
+// to write, so the implementation-cut guard can let that one write through.
+function handoff_path_of(issue: string): string {
+	return HANDOFF_PATH.replace(ISSUE_PLACEHOLDER, () => issue)
+}
 
 const run_cut_handoff = {
 	HANDOFF_FORMAT,
 	HANDOFF_PATH,
+	handoff_path_of,
+	carried_findings,
 	describe_handoff,
 	handoff_schema,
 	is_complete_handoff,

package/scripts/run/cut/run-cut-report.ts

@@ -38,6 +38,7 @@ const UNKNOWN_VERDICT = 'unknown'
 // The asking session is over the shared context-cut threshold, so an implementation cut was not
 // resumed into it — the same refusal `run:carry` answers `over` with.
 const OVER_VERDICT = 'over'
+const SPLIT_UNRESOLVED_VERDICT = 'split-unresolved'
 
 function report(verdict: string, code: number): number {
 	console.info(verdict)
@@ -127,12 +128,13 @@ function report_under_threshold(): number {
 }
 
 // **A ship reviewer takes no cut, of either phase** (joshuafolkken/kit#3623). Its supervisor is waiting
-// on the findings file it has yet to write, so a relaunch would stand a second child in the lane beside
+// on the findings it has yet to submit, so a relaunch would stand a second child in the lane beside
 // the one the supervisor repairs with. Answered `not-a-lane`, the verdict that already means "nothing
-// was cut and this process carries on".
+// was cut and this process carries on". The message names no sink: its review prompt says whether it
+// submits through `review:submit` or, on a lane that predates it, writes a path (joshuafolkken/kit#4799).
 function report_reviewer(): number {
 	console.error(
-		'This session is a ship reviewer, which its supervisor is waiting on, so nothing was cut and nothing was relaunched. Write the findings file and finish the review in this process.',
+		'This session is a ship reviewer, which its supervisor is waiting on, so nothing was cut and nothing was relaunched. Finish the review in this process and submit its findings the way your review prompt says.',
 	)
 
 	return report(NOT_A_LANE_VERDICT, SUCCESS_EXIT_CODE)
@@ -174,6 +176,22 @@ function report_over(): number {
 	return report(OVER_VERDICT, FAILURE_EXIT_CODE)
 }
 
+function report_missing_supervisor(issue: string): number {
+	console.error(
+		`The OpenAI supervisor for ${session_cite.issue(issue)} is not live, so this nested process was not cut and can continue. Re-dispatch the lane to recover the supervisor.`,
+	)
+
+	return report(FAILED_VERDICT, FAILURE_EXIT_CODE)
+}
+
+// The lane got the split notice and has answered it neither way, so nothing was cut and the run does
+// not go on to the gate until it does (joshuafolkken/kit#4695). `note` says which answers it takes.
+function report_split_unresolved(note: string): number {
+	console.error(note)
+
+	return report(SPLIT_UNRESOLVED_VERDICT, FAILURE_EXIT_CODE)
+}
+
 const run_cut_report = {
 	BAD_HANDOFF_VERDICT,
 	BUSY_VERDICT,
@@ -191,6 +209,7 @@ const run_cut_report = {
 	RELAUNCHED_CUT_MARKER,
 	RESUME_IMPL_VERDICT,
 	RESUME_VERDICT,
+	SPLIT_UNRESOLVED_VERDICT,
 	STALE_VERDICT,
 	SUCCESS_EXIT_CODE,
 	UNDER_THRESHOLD_VERDICT,
@@ -205,9 +224,11 @@ const run_cut_report = {
 	report_handed_off,
 	report_held_cut,
 	report_incomplete,
+	report_missing_supervisor,
 	report_over,
 	report_relaunched_cut,
 	report_reviewer,
+	report_split_unresolved,
 	report_stale,
 	report_under_threshold,
 	report_unknown,

package/scripts/run/cut/run-cut-resume.ts

@@ -0,0 +1,129 @@
+import { cost_cli } from '#scripts/cost-runtime/cost-cli'
+import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { run_event_stream } from '#scripts/run/event/run-event-stream'
+import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+import { run_cut, type RunCut } from './run-cut'
+import { run_cut_report } from './run-cut-report'
+import { run_cut_review } from './run-cut-review'
+
+// `josh run:cut --resume <N>` — a fresh process asking whether it resumes a cut: it verifies the tree
+// against the record and adopts it, answering which phase it resumes into. Taking a cut is
+// `run-cut-cli.ts`'s.
+
+const {
+	FRESH_VERDICT,
+	HANDED_OFF_VERDICT,
+	INCOMPLETE_VERDICT,
+	RESUME_IMPL_VERDICT,
+	RESUME_VERDICT,
+	SUCCESS_EXIT_CODE,
+	report,
+	report_busy,
+	report_handed_off,
+	report_incomplete,
+	report_over,
+	report_stale,
+	report_unreadable,
+} = run_cut_report
+
+// **The adoption is the resume-uniqueness guarantee**: it removes and creates exclusively, so of two
+// racing resumes only one wins the create and the loser is answered `busy`.
+// An implementation cut resumes back into implementation; a pre-gate one into the gate. The resuming
+// child is told which by the verdict rather than reconstructing it from the record.
+function resume_verdict_for(cut_record: RunCut): string {
+	return run_cut.resumes_into_implementation(cut_record.phase)
+		? RESUME_IMPL_VERDICT
+		: RESUME_VERDICT
+}
+
+// **An implementation resume removes the record; a pre-gate one marks it handed off**.
+// The cuts have different multiplicities sharing one record: the pre-gate cut fires once per lane, so
+// its record must survive to answer a second resume `handed-off`; the implementation cut is guarded by the run's
+// event stream rather than the cut record, so its record is cleared on resume — a lingering record
+// would keep the pre-gate guard, which reads `carried_cut_sync`, silent for the rest of the run. A double
+// cut stays impossible either way: `begin_cut`'s exclusive create is what prevents it.
+function take_over(target: string, cut_record: RunCut): RunCut | undefined {
+	if (!run_cut.resumes_into_implementation(cut_record.phase)) {
+		return run_cut.adopt_cut(target, cut_record)
+	}
+
+	run_cut.end_cut(target)
+
+	return cut_record
+}
+
+// **An implementation resume appends a `resume` event**. It clears the record
+// the `cut` event stood for, so the stream is what moves `run:step` back to implementation; a pre-gate
+// resume keeps its record and appends nothing. Best-effort, as the cut's own append is.
+async function emit_resume_event(issue: string, verdict: string): Promise<void> {
+	if (verdict !== RESUME_IMPL_VERDICT) return
+
+	await run_event_stream_emit.emit(
+		run_event_stream.EVENT_KIND.RESUME,
+		`${issue_cite.plain(issue)} resumed`,
+	)
+}
+
+async function adopt(target: string, cut_record: RunCut): Promise<number> {
+	const taken = take_over(target, cut_record)
+
+	if (taken === undefined) return report_busy(cut_record)
+
+	const verdict = resume_verdict_for(cut_record)
+
+	await run_cut_review.announce_resume(cut_record, verdict === RESUME_IMPL_VERDICT)
+	await emit_resume_event(cut_record.issue, verdict)
+
+	return report(verdict, SUCCESS_EXIT_CODE)
+}
+
+// A relaunched lane child and a fresh session both measure `under`, so only the session that took an
+// implementation cut resumes over the threshold; unmeasurable is not refused.
+function is_over_threshold_resume(cut_record: RunCut): boolean {
+	if (!run_cut.resumes_into_implementation(cut_record.phase)) return false
+
+	return cost_cli.session_verdict() === cost_verdict.OVER_VERDICT
+}
+
+async function verify_and_adopt(
+	target: string,
+	cut_record: RunCut,
+	issue: string,
+): Promise<number> {
+	const state = await run_cut.current_state()
+	const verdict = run_cut.classify_resume(cut_record, {
+		issue,
+		current_branch: state.branch,
+		is_dirty: state.is_dirty,
+		is_held: state.is_held,
+	})
+
+	if (verdict === HANDED_OFF_VERDICT) return report_handed_off(cut_record)
+
+	if (verdict === 'stale') return report_stale(cut_record)
+
+	if (verdict === INCOMPLETE_VERDICT) return report_incomplete(cut_record)
+
+	if (is_over_threshold_resume(cut_record)) return report_over()
+
+	return await adopt(target, cut_record)
+}
+
+async function resume(target: string, issue: string): Promise<number> {
+	const read = run_cut.read_cut(target)
+
+	if (read.kind === 'none') return report(FRESH_VERDICT, SUCCESS_EXIT_CODE)
+
+	if (read.kind === 'unreadable') return report_unreadable()
+
+	if (read.kind === 'expired') return report_stale(read.cut)
+
+	return await verify_and_adopt(target, read.cut, issue)
+}
+
+const run_cut_resume = {
+	resume,
+}
+
+export { run_cut_resume }

package/scripts/run/cut/run-cut-review.ts

@@ -0,0 +1,105 @@
+import { git_command } from '#scripts/git/git-command'
+import { review_attest } from '#scripts/review/review-attest'
+import { review_prior_findings } from '#scripts/review/review-prior-findings'
+import { review_record } from '#scripts/review/review-record'
+import { run_cut, type RunCut } from './run-cut'
+import { run_cut_digest } from './run-cut-digest'
+import { run_cut_handoff, type Handoff } from './run-cut-handoff'
+
+// The review round an implementation cut has to carry across the process boundary
+// (joshuafolkken/kit#4868). A lane child's in-session reviewer returns its findings into the
+// conversation, and `review:record` is run after the fixes — so a cut between the two dropped the
+// findings with the conversation, and the resumed child reran round 1 in full. The cut is refused
+// until the round is recorded or its findings ride in the handoff, and the resume prints a recorded
+// round back so it is continued, not rerun.
+
+function unrecorded_note(issue: string): string {
+	return (
+		'a review round is attested on this branch but not recorded, and the handoff carries no ' +
+		`"findings" — run \`pnpm josh review:record --issue ${issue} [<finding> ...]\` before the cut, ` +
+		'or list the round\'s findings under "findings" in the handoff, so the resumed run does not ' +
+		'rerun round 1'
+	)
+}
+
+const RECORDED_ROUND_HEADING =
+	'Round 1 is recorded for this issue — do not rerun it; continue the fixes, then the ship, ' +
+	'which reviews only what moved since:'
+
+interface CutScope {
+	issue: string
+	branch: string
+	phase: string
+}
+
+// Attested on this branch, with no `review:record` line for the issue — the round the cut would lose.
+async function has_unrecorded_round(issue: string, branch: string): Promise<boolean> {
+	const root = await git_command.repository_root()
+
+	if (!review_attest.is_attested_on({ branch }, root)) return false
+
+	const recorded = await review_record.check(Number(issue))
+
+	return recorded.status === 'missing'
+}
+
+// Only an implementation cut without carried findings can lose a round: a pre-gate cut is taken
+// before any review.
+function may_drop_round(scope: CutScope, handoff: Handoff | undefined): boolean {
+	if (!run_cut.resumes_into_implementation(scope.phase)) return false
+
+	return run_cut_handoff.carried_findings(handoff).length === 0
+}
+
+// The note an implementation cut is refused with when it would drop an unrecorded round, else
+// `undefined`.
+async function unrecorded_refusal(
+	scope: CutScope,
+	handoff: Handoff | undefined,
+): Promise<string | undefined> {
+	if (!may_drop_round(scope, handoff)) return undefined
+
+	const is_unrecorded = await has_unrecorded_round(scope.issue, scope.branch)
+
+	return is_unrecorded ? unrecorded_note(scope.issue) : undefined
+}
+
+// What an implementation resume prints about a round recorded before the cut: the heading and the
+// findings the stop log kept with their reasons; nothing when no round is recorded.
+async function recorded_round_lines(issue: string): Promise<ReadonlyArray<string>> {
+	const recorded = await review_record.check(Number(issue))
+
+	if (recorded.status !== 'ok') return []
+
+	const findings = review_prior_findings.latest(issue, () => true)
+
+	return [RECORDED_ROUND_HEADING, ...findings.map((finding) => `  - ${finding}`)]
+}
+
+// The carried instruction and work state, printed to standard error so the resumed session continues
+// on what the run was told to do rather than on the tree alone — and, for an implementation resume,
+// the round recorded before the cut. The record is cleared on adoption, so this is where it reaches
+// the fresh process.
+async function announce_resume(cut_record: RunCut, is_implementation: boolean): Promise<void> {
+	if (cut_record.handoff !== undefined) {
+		console.error(run_cut_handoff.describe_handoff(cut_record.handoff))
+	}
+
+	const digest = run_cut_digest.describe_digest(cut_record.digest)
+
+	if (digest !== undefined) console.error(digest)
+
+	if (!is_implementation) return
+
+	const lines = await recorded_round_lines(cut_record.issue)
+
+	if (lines.length > 0) console.error(lines.join('\n'))
+}
+
+const run_cut_review = {
+	RECORDED_ROUND_HEADING,
+	announce_resume,
+	unrecorded_refusal,
+}
+
+export { run_cut_review }

package/scripts/run/cut/run-cut.ts

@@ -1,6 +1,5 @@
 import { agent_role_profile } from '#scripts/agent/agent-role-profile'
 import { backlog_budget } from '#scripts/backlog/backlog-budget'
-import { CONTEXT_CUT_THRESHOLD } from '#scripts/cost-runtime/context-cut-threshold'
 import { git_command } from '#scripts/git/git-command'
 import { git_common_directory } from '#scripts/git/git-common-directory'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -9,6 +8,7 @@ import { lane_child_invocation } from '#scripts/lane/lane-child-invocation'
 import { json_value } from '#scripts/lib/json-value'
 import { run_hold, type RunHold } from '#scripts/run/hold/run-hold'
 import { z } from 'zod'
+import { run_cut_digest, type SessionDigest } from './run-cut-digest'
 import { run_cut_handoff, type Handoff } from './run-cut-handoff'
 
 // A lane child is a detached `fullrun #<N>` process, and the thinking it accumulates while
@@ -45,11 +45,6 @@ const CUT_PREFIX = 'josh-run-cut-'
 // `IMPLEMENTATION_PHASE` drops the thinking accumulated *during* implementation and resumes back into
 // implementation (`resumes_into_implementation`); only the pre-gate cut resumes into the gate.
 const { PRE_GATE_PHASE, IMPLEMENTATION_PHASE } = agent_role_profile
-// **The measurement is the parent hand-off's, never a second one.** The lane child decides whether
-// to take this cut with `pnpm josh cost --cut` — the same per-request billed-input measurement (`cost_verdict.per_request_cost`) the parent's
-// `pnpm josh cost --cut` hand-off uses (`backlogrun-progress.md` → "The hand-off"). The shared
-// threshold prevents the scheduler and worker boundaries from drifting apart.
-const IMPLEMENTATION_CONTEXT_THRESHOLD = CONTEXT_CUT_THRESHOLD
 // **The bound is `backlog-budget.ts`'s idle wait, imported rather than restated**, so the eight hours
 // stay written once. A resume is expected within seconds of the cut, so this age is only a backstop
 // against a fresh process that never started; an expired record is cleared and replaced by the next
@@ -92,6 +87,8 @@ interface RunCut {
 	// record of the scalar fields alone parses, while a resume into implementation refuses to continue without it (`classify_resume`
 	// → `incomplete`), so a session is never silently continued lacking the instruction it needs.
 	handoff?: Handoff | undefined
+	// What the cut session read and decided, printed on the resume (joshuafolkken/kit#5040).
+	digest?: SessionDigest | undefined
 	// Set when `run:merge` found this cut still unadopted after every process of the lane had gone and
 	// relaunched its successor itself. The fallback fires once per cut: a
 	// successor that dies again before adopting is not relaunched a second time, so a lane that keeps
@@ -121,6 +118,8 @@ interface CutSpec {
 	// The instruction and work state to carry, absent for a pre-gate cut that resumes into the gate
 	// rather than into implementation.
 	handoff?: Handoff | undefined
+	// What the cut session read and decided, derived from its transcript (`run-cut-digest.ts`).
+	digest?: SessionDigest | undefined
 }
 
 // What the resume classifier is asked about, gathered from the fresh process's own git state so the
@@ -155,6 +154,7 @@ const run_cut_schema = z.object({
 	cut_at: z.string(),
 	is_handed_off: z.boolean().optional(),
 	handoff: run_cut_handoff.handoff_schema.optional(),
+	digest: run_cut_digest.session_digest_schema.optional(),
 	is_merge_relaunched: z.boolean().optional(),
 })
 
@@ -261,6 +261,7 @@ function fresh_cut(spec: CutSpec, now: Date): RunCut {
 		cut_at: now.toISOString(),
 		is_handed_off: true,
 		handoff: spec.handoff,
+		digest: spec.digest,
 	}
 }
 
@@ -285,6 +286,16 @@ function record_within_bound(spec: CutSpec, now: Date = new Date()): boolean {
 	return within_handoff_bound(fresh_cut(spec, now))
 }
 
+// An implementation cut carries what the session read and decided (`run-cut-digest.ts`); a digest the
+// bound cannot hold is dropped, so a cut is never refused for it, and a pre-gate cut never derives one.
+function with_digest(spec: CutSpec, digest_of: () => SessionDigest | undefined): CutSpec {
+	if (spec.handoff === undefined) return spec
+
+	const digested = { ...spec, digest: digest_of() }
+
+	return record_within_bound(digested) ? digested : spec
+}
+
 // **Create-exclusively, exactly as `run-hold.ts` claims a tree.** A record already here means a cut is
 // already in flight for this tree, so `undefined` is "do not launch a second one" rather than an
 // error — the exclusive create is what makes a double cut, and so a double relaunch, impossible. A
@@ -455,7 +466,6 @@ const run_cut = {
 	CUT_MAX_AGE_HOURS,
 	CUT_MAX_AGE_MS,
 	END_COMMAND,
-	IMPLEMENTATION_CONTEXT_THRESHOLD,
 	IMPLEMENTATION_PHASE,
 	MAX_HANDOFF_BYTES,
 	PRE_GATE_PHASE,
@@ -466,6 +476,7 @@ const run_cut = {
 	classify,
 	classify_resume,
 	current_state,
+	with_digest,
 	cut_path,
 	describe_cut,
 	end_cut,

package/scripts/run/detached-launch.ts

@@ -21,7 +21,7 @@ import { launch_priority } from '#scripts/run/launch-priority'
 
 const NO_PID_NOTE = 'the process started without a pid'
 const UNSAFE_NOTE =
-	'the wake command or its arguments contain characters that are not safe to execute'
+	'the wake command or its arguments are empty, over length, or contain characters that are not safe to execute'
 
 // Provider-specific commands and flags are composed before this boundary. This module accepts only
 // an argv vector and never infers policy from it; role/model/effort arrive separately as log metadata.