@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/.claude/agents/reviewer-verification.md

@@ -0,0 +1,19 @@
+---
+name: reviewer-verification
+description: The pre-commit review's round 2 (the verification pass) in one agent — the `reviewer` agent at the verification effort. Dispatch it for the round `pnpm josh review:brief --round 2` describes, with the `model` the brief prints.
+tools: Read, Grep, Glob, Bash, Edit, Write
+model: sonnet
+effort: high
+---
+
+You are the review itself, not a launcher of one. The brief you are handed is the whole
+`/code-review` invocation: the level on its first line, the rubric it names, the checkout it pins and
+its `review:attest` step.
+
+- Review the diff in this agent, against the rubric the brief names. You carry no `Skill` and no
+  `Agent` tool, so the review never forks a second agent that reads the same diff and brief again.
+- Run `pnpm josh review:attest <nonce>` from the checkout the brief pins, as the brief says. Never run
+  `pnpm josh review:brief` yourself: a new brief drops the attestation you left.
+- Apply a fix only where the brief's level and your dispatcher ask for one; never commit, stage or push.
+- Return the findings in the rubric's output format; check it first with `pnpm josh review:lint`
+  (round 2: `--round 2`; findings on stdin) and fix what it reports.

package/.claude/agents/reviewer.md

@@ -0,0 +1,19 @@
+---
+name: reviewer
+description: The pre-commit review in one agent — reads the `pnpm josh review:brief` it is handed, reviews the diff against the rubric the brief names, and runs the brief's `review:attest` step. Dispatch it for the `/code-review` round of `chain-rule.md` step 1, with the `model` the brief prints.
+tools: Read, Grep, Glob, Bash, Edit, Write
+model: opus
+effort: medium
+---
+
+You are the review itself, not a launcher of one. The brief you are handed is the whole
+`/code-review` invocation: the level on its first line, the rubric it names, the checkout it pins and
+its `review:attest` step.
+
+- Review the diff in this agent, against the rubric the brief names. You carry no `Skill` and no
+  `Agent` tool, so the review never forks a second agent that reads the same diff and brief again.
+- Run `pnpm josh review:attest <nonce>` from the checkout the brief pins, as the brief says. Never run
+  `pnpm josh review:brief` yourself: a new brief drops the attestation you left.
+- Apply a fix only where the brief's level and your dispatcher ask for one; never commit, stage or push.
+- Return the findings in the rubric's output format; check it first with `pnpm josh review:lint`
+  (round 2: `--round 2`; findings on stdin) and fix what it reports.

package/.claude/settings.json

@@ -1,6 +1,5 @@
 {
 	"permissions": {
-		"defaultMode": "bypassPermissions",
 		"allow": ["Bash(*)"],
 		"deny": [
 			"Bash(rm -rf *)",
@@ -54,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision --session-start",
 						"timeout": 180
 					}
 				]
@@ -66,7 +65,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
 						"timeout": 10
 					}
 				]
@@ -78,7 +77,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh pretool-guard",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh pretool-guard",
 						"timeout": 20
 					}
 				]
@@ -90,7 +89,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh format-edited",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh format-edited",
 						"timeout": 90
 					}
 				]
@@ -102,7 +101,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
+						"command": "export JOSH_HOOK_CWD=\"$PWD\" && project_root=\"${CLAUDE_PROJECT_DIR:-$( (unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null) || git rev-parse --show-toplevel)}\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
 						"timeout": 20
 					}
 				]

package/.claude/skills/dependency-update/SKILL.md

@@ -34,16 +34,15 @@ over-bumped entry: restore it immediately, investigate, and report — never kee
 
 ## 3. `devEngines` — the one expected change
 
-**Exception — the `josh latest` lockstep pnpm bump is expected, NOT a violation.** **KEEP** a
-`devEngines.packageManager.version` change **if and only if** it equals everything after `pnpm@` in
-the new `packageManager` pin — **byte-identical, `+sha512…` Corepack integrity suffix included**
-(`scripts/version/latest-corepack.ts` → `sync_development_engines`). Reverting it would re-introduce
-the mismatch.
-
-**Restore + ask** when `devEngines` changed any other way: the version no longer matches
-`packageManager` (a dropped or truncated suffix counts), its structure changed (`name` / `onFail` /
-fields), or something other than `josh latest` touched it. One structural change is expected and
-kept: `josh sync` moving `devEngines.packageManager.onFail` from `"error"` to `"download"`.
+**Read the verdict line, never compare by eye.** `pnpm josh overrides` prints it first, and
+`josh latest` prints it after its pnpm bump — `HEAD`'s `package.json` against the working tree
+(`scripts/version/development-engines-verdict.ts`). Quote it:
+
+- `devEngines: unchanged` / `devEngines: kept` — keep. `kept` is the lockstep pnpm bump (the version
+  byte-identical to the `packageManager` pin, `+sha512…` suffix included) or `josh sync` moving
+  `onFail` from `"error"` to `"download"`.
+- `devEngines: restore (<reason>)` — restore + ask. Also restore when something other than
+  `josh latest` / `josh sync` touched it.
 
 ## 4. When the bump breaks something — fix forward
 

package/.claude/skills/workflow-commands/SKILL.md

@@ -47,7 +47,7 @@ Each is fetched at its named scope, in the same turn, by the named command that
 | ----------------------- | ------------------------------------------------------------------------------ |
 | `latest-gate.md`        | `run:prep` answers `latest: required` — before `josh latest:if-required` runs  |
 | `followup.md` → "Run `pnpm josh followup`" | Before issuing `pnpm josh followup`, in that same turn |
-| `chain-rule.md` → "Run the review-to-merge chain" | Before the first `pnpm josh gate` launch (`fullrun` / `prrun` / `backlogrun`) — the gate overlaps the review, so the section is read before it |
+| `chain-rule.md` → "Run the review-to-merge chain" | Before the first `pnpm josh gate` launch (`fullrun` / `prrun` / `backlogrun`; a lane child reads "A lane child" alone) — the gate overlaps the review |
 | `background-commands.md` → "Background the gate and push" | Before backgrounding `pnpm josh gate` — the first long-running command a run detaches (`fullrun` / `halfrun` / `prrun` / `backlogrun`) |
 
 A `latest: skip` answer reads nothing. **A lane child that parks reads
@@ -75,7 +75,7 @@ from — read at that trigger, never restated here.
 | --- | --- | --- |
 | First call of any entry | `#N`: `pnpm josh run:entry <N> --to <command>` (claims the tree, except `kickoff`); `new` (not `kickoff`): `pnpm josh run:hold`; `busy` / `unknown` stop | `working-tree-hold.md` |
 | `run:entry` prints its stage line | The command sets how far a run goes, the Issue where it starts; **`start: reached` redoes nothing** — stop (at `merged`, the next line answers) | `docs/how-to/run-issues.md` |
-| Same turn as the hold (not a dispatched child, not `kickoff`) | `pnpm josh cost --cut`; `under` continues, `over` stops — `run:entry` notifies and runs `run:release` (by hand for `new`) | `backlogrun-progress.md` → "The hand-off" (shared 135,000 threshold) |
+| Same turn as the hold (not a dispatched child, not `kickoff`) | `pnpm josh cost --cut`; `under` continues, `over` stops — `run:entry` notifies and runs `run:release` (by hand for `new`) | `backlogrun-progress.md` → "The hand-off" (model-priced threshold) |
 | An entry typed with an `owner/repo#` prefix or a short `repo#` name | Resolve the target and its checkout; an explicit foreign owner stops the run | `target-repository.md` |
 | A `new` entry typed with an `into <target>` suffix | Insert the artifact into the named epic with `pnpm josh epic --add <E> <N>` | `into-target.md` |
 | Before any work starts (every entry) | The split assessment; the default is not to split — separability **and** a scope clearly over one gate must hold together; a `fullrun` / `halfrun` that finds a split files the epic and **stops** | `split-assessment.md` → "The question" |
@@ -85,12 +85,12 @@ from — read at that trigger, never restated here.
 | Before delegating any run step | `pnpm josh delegate <step>` decides eligibility, never you | `delegation.md` |
 | The pre-implementation reading reaches 3 unedited files | Delegate the unread investigation; a file this run will edit is read in the main line | `delegation.md` → "The pre-implementation reading" |
 | Immediately before implementation | Present the two-layer work summary (once per Issue); `kickoff` posts a plan instead | `prompts/collaboration-workflow/report-format.md` |
-| While implementing | Re-run one check by name, not the whole gate — `pnpm josh lint:related`, `pnpm josh cspell:dot`, `pnpm josh test:related`; `pnpm josh review:brief` refuses a brief on a tree the last two were not green on | `chain-rule.md` |
-| Implementation is done | Refactor → `pnpm josh main:merge` → `pnpm josh gate` beside a subagent `/code-review`, joined before the commit → round cap → PR → merge | `chain-rule.md` → "Run the review-to-merge chain" |
+| While implementing | Re-run one check by name, not the whole gate — `pnpm josh lint:related`, `pnpm josh cspell:dot`, `pnpm josh test:related --touched` (full reach once the implementation is done); `pnpm josh review:brief` refuses a brief on a tree the last two were not green on | `chain-rule.md` |
+| Implementation is done | Refactor → `main:merge` (no lane child) → `pnpm josh gate` beside a subagent `/code-review`, joined before the commit → round cap → PR → merge | `chain-rule.md` → "Run the review-to-merge chain" |
 | A review has run | Its verdict counts only once `pnpm josh review:attest --check` answers `ok`; `missing` / `mismatch` are refusals `pnpm josh followup` blocks the merge on | `chain-rule.md` → "The brief names the checkout, and a review that read another one is refused" |
 | A command can take minutes | Issue it in the background; the turn never ends at the push (`pnpm josh followup` stays foreground) | `background-commands.md` → "Background the gate and push" |
 | E2E gate | The CI E2E job where the command ends in a PR (`fullrun` / `prrun` / `backlogrun`, enforced by `pnpm josh followup`); you run `pnpm josh test:e2e` yourself where it does not (`halfrun`) | `prompts/testing-guide.md` → "Closing the E2E gate without a human run" |
-| Filing any new Issue | `pnpm josh issue:file` — it runs the `issue:scout` scan first; read its duplicate and epic answers | `issue-scout.md` |
+| Filing any new Issue | `pnpm josh issue:file` — it runs the `issue:scout` scan; read its duplicate and epic answers | `issue-scout.md` |
 | Another Issue here must land first | A prerequisite is a dependency, not a park — file it, stash, record the dependency; `fullrun` / `halfrun` stop, `backlogrun` continues | `prerequisite.md` |
 | Something worth filing, none of the three | Unattended: file it (Tier A, first-party); else ask; a delegated child returns it to the parent instead | `observation-filing.md` |
 | A defect in kit's own verification turns up | It runs alone when all three conditions hold; a batch resumes once it merges | `backlogrun-lanes.md` → "A solo run" |
@@ -98,7 +98,7 @@ from — read at that trigger, never restated here.
 | `backlogrun`'s authorization | The whole `auto-ok` opted-in pool as well as its named items; `pnpm josh backlog:next` offers them | `backlogrun.md` |
 | `run:step` prints the retrospective step (a run drained its backlog and stopped, not a lane child) | Run what it prints once, file 0–2 improvements, then `pnpm josh run:carry --retrospective` | `retrospective.md` |
 | Any artifact prose (Issue bodies, comments, Telegram) | Session language (`JOSH_SESSION_LANG`, default `ja`); Issue/PR titles stay English | `prompts/collaboration-workflow/overview.md` |
-| Any mid-workflow stop | `stop:guard` sends the `confirmation` Telegram; on its refusal, send it | `CLAUDE.md` → "Mid-workflow stop notification" |
+| Any mid-workflow stop | `stop:guard` sends the `confirmation` Telegram; on its refusal, send it | `rule-delivery.md` → "stop-notify" |
 
 ## 3. What stays resident, and what is read from here
 

package/.claude/skills/workflow-commands/background-commands.md

@@ -4,7 +4,9 @@
 
 - **The clean path folds the region into one backgrounded `pnpm josh ship`** (preflight → gate → `git -y` →
   foreground `followup` → `run:tail`). The calls below serve a due second round.
-- Background `pnpm josh gate` beside the review; join it before commit.
+- Background `pnpm josh gate` beside the review; join it before commit. Also `lint:related` /
+  `test:related` / `check:related` / `metrics` with work to overlap: a wait past the 5-min cache TTL
+  rewrites the context.
 - Issue `pnpm josh git -y` in the background; its completion resumes the run, so the turn never ends
   at the push.
 - `pnpm josh followup` stays in the foreground (`followup.md`).
@@ -16,18 +18,19 @@
   session-cost check after the merge.
 - A lane child's hand-off or pre-gate cut is the sole turn boundary before the push (`chain-rule.md`).
 
-Use harness detachment so completion returns to the run. Foreground timeouts stay within the cap.
-
 ## How the wait ends — the task's exit, never a regex over its output
 
 **Background it from the first, then end the turn.** A `run_in_background` command re-invokes the run
 when it *exits* — that completion notification is what ends the wait, not a regex match or the block
-limit.
+limit. A backgrounded `Agent` → the same; in a lane child → the `lane-background` row of `pnpm josh rule:list`.
 
-**Never hand-write a `while`/`until` … `sleep` loop over the output file** — a regex that never matches
+**Never hand-write a `while`/`until` … `sleep` loop over the output file, or a counted `for` that sleeps** — a regex that never matches
 waits to the block limit, one that matches a mid-run line exits early. the `poll-loop` row of `pnpm josh rule:list` refuses it
 (`prompts/collaboration-workflow/rule-delivery.md`).
 
+Nor a `sleep` chain followed by a read before the completion notification (`sleep 20; tail …/x.output`,
+`sleep 20; ps -p <pid>`) — the same poll unrolled; the same row refuses it.
+
 **To glance at interim output, `Read` the output file once**, never in a sleep loop. CI is waited on by
 `pnpm josh followup`; a progress heartbeat is `run:progress --wait`'s job (`early-heartbeat` refuses a
 hand-armed timer).

package/.claude/skills/workflow-commands/backlogrun-child.md

@@ -67,7 +67,7 @@ unit, run the child in the parent's context and still ask the hand-off at every
   number, and that it runs as `fullrun #<N>` under that authorization; the unit refuses a brief without
   it.
 - A child whose ship waits on its merge frees its lane — the next child launches beside it, and a
-  stop at `followup` relaunches the child once a place is free: `scripts/backlog/backlog-occupied.ts`.
+  stop at `followup` relaunches the child at most one lane past the limit: `run-ship-place.ts`.
 
 ### What the summary carries, and how long it may be
 
@@ -78,6 +78,8 @@ unit, run the child in the parent's context and still ask the hand-off at every
   delegated child does not take this route"); decisions not yet logged; what was left undone, on whose
   authority.
 - **Cut**: the changed-file list, per-round review detail, restated rules.
+- Before the final message → `pnpm josh report:lint --child-summary < summary.md` (labels in the
+  session language).
 
 The person-facing report (`prompts/collaboration-workflow/report-format.md` → 「完了報告（セッション向け）」)
 is unchanged.

package/.claude/skills/workflow-commands/backlogrun-lanes.md

@@ -87,7 +87,7 @@ Everything else is unchanged; `pnpm josh followup` releases the lane's hold at t
 **The child is started as a process of its own, not as a subagent of this session** (`lane:dispatch`,
 `lane:launch`'s final step):
 
-- **It records where the child writes** — `<temp>/josh-lane-dispatch-<N>.log`.
+- **It records where the child writes** — `<common git dir>/josh/run-state/josh-lane-dispatch-<N>-<key>.log`, which survives a reboot.
 - **A refusal is an empty capture beside a non-zero exit**, with a `warning` Telegram. **Park that
   child and name the log the message carries**; never re-dispatch into the same lane without reading it.
 - **A child that started with nowhere to write exits zero and warns** — **wait on that lane with

package/.claude/skills/workflow-commands/backlogrun-park.md

@@ -72,7 +72,9 @@ lane:launch <N>`.
 
 - a design choice nobody has made;
 - a Tier B toss-up, or a Tier C action (`CLAUDE.md` → "Decision autonomy");
-- an upstream defect in another package, whose wait-or-defer is the person's (`upstream-interrupt.md`).
+- an upstream defect in another package, whose wait-or-defer is the person's (`upstream-interrupt.md`);
+- information only the web holds — no lane launches a web tool (`scripts/agent/claude-agent-argv.ts`),
+  so a person fetches it.
 
 It never carries:
 
@@ -81,7 +83,8 @@ It never carries:
 - a wait for the next published release — a dependency, `pnpm josh issue:release <N> --wait`
   (`prerequisite.md`);
 - a defect in the running repository's own run tooling — the run fixes it and resumes
-  (`prompts/collaboration-workflow/upstream-interrupt.md` → "実行中のリポジトリ自身のラン機構の不具合");
+  (`prompts/collaboration-workflow/upstream-interrupt.md` → "実行中のリポジトリ自身のラン機構の不具合"),
+  its filing carrying the `- 原因の park:` line when it parked or stopped an Issue (`issue-template.md` → I);
 - a wait on an open blocker or a start date — `run:merge` releases it (`run-merge-steps.ts`);
 - a mechanical failure — the driver applies `run:stalled` (`RUN_STALLED_LABEL` in `issue-labels.ts`).
 

package/.claude/skills/workflow-commands/backlogrun-progress.md

@@ -44,9 +44,8 @@ summary, and who propagates" below.
 **The check is asked at every merge, and delegation does not excuse it** — `pnpm josh cost --cut`
 after every child's merge and `pnpm josh ms`, never wired to `pnpm josh delegate epic-child`. Crossing it **hands the session off to a fresh one,
 carrying the budget** (`backlogrun-steps.md` → "The session cut is inside the invocation"); it is not a
-stop. The threshold is `CONTEXT_CUT_THRESHOLD` in `scripts/cost-runtime/context-cut-threshold.ts`
-(135,000, shared by the scheduler entry, hand-off and the lane worker cut, `pre-gate-cut.md` → "The
-implementation-phase cut").
+stop. The threshold is the one `pnpm josh cost --cut` prints, priced at the session's model and
+shared by the scheduler entry, hand-off and the lane worker cut (`pre-gate-cut.md` → "The threshold").
 
 | It answers | What the run does |
 | --- | --- |

package/.claude/skills/workflow-commands/backlogrun-recovery.md

@@ -44,7 +44,7 @@ On a person's instruction to drop a running child, run `pnpm josh lane:withdraw
 
 ## Conflicts are not predicted
 
-**This path is the fallback**: every `fullrun` runs `pnpm josh main:merge` ahead of the gate
+**This path is the fallback**: every `fullrun` merges origin/main ahead of the gate
 (`chain-rule.md` → "origin/main is merged in before the gate"), so it covers an overlap that lands on
 `main` *after* it. **Nothing here forecasts which children will overlap** — a conflicting pull request
 comes back `mergeStateStatus: DIRTY`, which `git-pr-checks-eval.ts` reads as a **failure**, so `pnpm josh

package/.claude/skills/workflow-commands/backlogrun-steps.md

@@ -26,7 +26,7 @@ judgement** — a Tier B toss-up or a Tier C action inside it; `--no-auto-ok` wi
 | --- | --- | --- |
 | `--max` | merges per invocation — a run's own filing competes for it | `run:carry --merged` |
 | `--idle` (8 hours unless typed) | how long the run waits once nothing can proceed | `--active`, the moment its hands became free |
-| **Ten filings per run** | additions to the pool on **every** filing route (`prerequisite.md`) — `route:tier-a`, `route:interrupt` and a review branch-2 filing are exempt from the depth test (`observation-filing.md`), never from this ceiling | `scripts/rules/filing-cap.ts` |
+| **Ten filings per originating work item** | additions to the pool on **every** filing route (`prerequisite.md`) — `route:tier-a`, `route:interrupt` and a review branch-2 filing are exempt from the depth test (`observation-filing.md`), never from this ceiling | `scripts/issue/issue-file-cap.ts` |
 | The WIP cap on open issues | the pool across invocations | `prompts/collaboration-workflow/wip-cap.md` |
 
 **This section is the single source of how the `epic:bundle` obligation and this boundary meet.**
@@ -39,7 +39,8 @@ runs in a delegated unit"), read back with `pnpm josh issue:state <N>`. `pnpm jo
 #N2 …` renders the order (`scripts/backlog/backlog-named.ts`).
 
 **A named issue that cannot finish parks, and the rest of the named list is skipped**; the run drains
-the pool and reports what was not started (`backlog_named.after_failure`). A `needs-human-review` named
+the pool and reports what was not started (`backlog_named.after_failure`). One already closed or parked
+when offered is booked done alone and skips nothing. A `needs-human-review` named
 issue stops the whole run. **`--only` runs the named list and stops there, draining no pool** — a
 failure ends the run, and `--only` with no named issues is refused (`backlog_named.startup`).
 

package/.claude/skills/workflow-commands/backlogrun.md

@@ -70,7 +70,7 @@ reference is read as a section").
 | Guard | Limit | On reaching it |
 | --- | --- | --- |
 | Children per run | 30 | Stop and report; an epic this large should be split. |
-| Issues filed per run | `prerequisite.md`'s cap | Stop and report. |
+| Issues filed per originating work item | `prerequisite.md`'s cap (`issue:file` refuses the 11th) | Stop and report. |
 | Consecutive child failures | 3 | Stop and report; something is wrong with the environment, not the children. |
 
 A failure that is not consecutive parks its child and the run continues.

package/.claude/skills/workflow-commands/chain-rule.md

@@ -5,48 +5,54 @@
 This is the execution contract for `fullrun` and `backlogrun`, and for `prrun` up to the pull request: a `prrun` never issues `pnpm josh ship` or a merging `pnpm josh followup` — it opens the pull request with `pnpm josh git -y` and ends by `prrun.md` → "The difference — the end of the run". The record below is reference only.
 Review results and successful pushes are never turn boundaries.
 
-0. **A lane child**: `pnpm josh main:merge`, the self-check (`prompts/review.md` → "Before round 1 —
-   the implementer's self-check"), the scoped pair, the ship body draft filled in
-   (`report-format.md` → "PR 本文の受け入れ条件の対応表"), `pnpm josh ship --detach --review
-   "<title> #<N>"` (`--cite <N>`), then **end the turn** on `launched`/`busy`. No `pnpm josh gate`,
-   `check` or `metrics` before it, by hand: ship reuses the scoped pair green on this tree and base
-   and runs the gate after its sync (`scripts/run/ship/run-ship-steps.ts`); a standalone `check` or
-   `metrics` leaves no record it reuses. A stop relaunches a child
+0. **A lane child** (no `main:merge`: ship's sync merges main, stopping `conflict`): the self-check (`prompts/review.md` → "Before round 1 —
+   the implementer's self-check"), `pnpm josh check:related` (a metrics notice → its verdict line), `pnpm josh run:review` — its `--join`'s `test:pinned` lines
+   answer the self-check's question 1 — the ship body draft filled in beside the gate (`report-format.md` → "PR
+   本文の受け入れ条件の対応表"), then its `/code-review` subagent (as `run:review` prints) — on two briefs, two `reviewer`s side by side, the second recorded with `review:record --interaction --issue <N>` — not backgrounded — a turn end kills it — then `run:review --join`, `review:attest --check`, the
+   round's fixes, no `check:related` after them unless a brief follows (one before `--join` is refused, `round-one-check-related`), `pnpm josh review:record --issue <N> [<finding> ...]` (round 2 stays ship's; it stamps the fixed tree, so ship reuses this round 1 and round 2 reads what moved since, unless round 2 would skip a move — never reopen `run:review`, which refuses it; on `Interaction review now due`, record that pass before the ship, running it first if none ran beside round 1; on `test:pinned restarted`, go on to the ship without waiting — its pre-detach reads that check), `pnpm josh ship --detach --review "<title> #<N>"`
+   (`--cite <N>`; `--unpinned-ok "<reason>"` when `run:review` needed it). On `launched` with
+   `pnpm josh cost --cut` `under`, run `pnpm josh ship:wait <N>` (`timeout` 600000) and follow
+   it (`docs/josh-commands-run.md` → "`josh ship:wait`"); else, or on `busy`, **end the turn**. No `pnpm josh gate`,
+   `check:related`, `check` or `metrics` before it or a re-detach, by hand: ship reuses the scoped
+   pair green on this tree and base (no fix, main unmoved) and runs the gate after its sync (`scripts/run/ship/run-ship-steps.ts`); a standalone `check` or
+   `metrics` leaves no record it reuses. A stop no session waits on relaunches a child
    whose prompt carries the failed output's tail and the changed files (`pnpm josh ship --log <N>` when
-   the stage printed nothing) and (Anthropic lane) the re-detach to run after
-   the fix — `pnpm josh ship --detach`, `--review` only if the stopped ship carried it and stopped before
-   round 2, which is final, or the review went stale (`scripts/run/ship/run-ship-next.ts`); the
-   supervisor skips a recorded round 1 unless it went stale.
-   `failed` → step 1. A backgrounded `ship` issued alone is moved to the foreground by the hook
-   rather than refused.
-1. Run `pnpm josh main:merge`. **Then issue `pnpm josh run:cut <N>` alone, before the scoped pair and
+   the stage printed nothing), on a review stop the sweep of each finding's other sites the stop note
+   directs, and (Anthropic lane) the re-detach to run after the fix — `pnpm josh ship --detach`, `--review` only if the stopped ship carried it and stopped before
+   round 2, which is final, or the review went stale (`scripts/run/ship/run-ship-next.ts`).
+   A preflight stop `unplanned: <files>` → take one of the two ways out it prints, then re-detach
+   — unless its `lane:plan` answers `yield` (`docs/josh-commands-run.md` → "`josh ship`").
+   `failed` → step 1.
+1. Run `pnpm josh main:merge`. **Then issue `pnpm josh run:cut <N>` alone, before `check:related` and
    the gate** — the pre-gate cut (a no-op outside a lane). Then answer the self-check
-   (`prompts/review.md` → "Before round 1 — the implementer's self-check"), run the final scoped lint/test pair and
-   `pnpm josh run:review`: it starts `pnpm josh gate` in the background and prints the `/code-review`
-   brief in one call, so the two overlap. Launch the `/code-review` subagent as the `general-purpose`
-   agent type with that brief and its `model` (`delegation.md`) (every tool, so `--fix` applies;
-   never a guessed type name).
+   (`prompts/review.md` → "Before round 1 — the implementer's self-check"), its question 1 left to
+   `run:review --join`, run the final scoped lint/test pair with `pnpm josh check:related` and
+   `pnpm josh run:review`: it starts `pnpm josh test:pinned` and `pnpm josh gate` in the background
+   and writes the `/code-review` brief to a file, printing its path and prompt, in one call, so they overlap; two briefs take two `reviewer`s side by side, the second recorded with
+   `review:record --interaction`. Launch the `/code-review` subagent as the `reviewer`
+   agent type (`kit:reviewer` in a consumer) with that prompt verbatim and its `model` — the alias of the `model=` id the brief prints (`claude-opus-5-5` → `opus`)
+   (`.claude/agents/reviewer.md`; never a guessed type name).
    Never load the review skill in the main line.
 2. Once the review returns, run `pnpm josh run:review --join` to join and read the gate before
-   committing; it exits non-zero on a red gate. Fix any red check, then rerun the affected scoped check
+   committing (`--join --fixing` if round 1 has fixes to make); it exits non-zero on a red gate, `3` on an `unpinned` line (its note names the `--unpinned-ok` call). Fix any red check, then rerun the affected scoped check
    and gate. Never version-bump a child (`pnpm josh release` decides).
 3. Before acting on any review round, run `pnpm josh review:attest --check`. `missing` or `mismatch`
    discards it without counting; rerun against the brief's checkout. A review error receives a
    `confirmation` Telegram and stops.
 4. Route the attested verdict mechanically:
    - Clean or Low-only round 1: no second round. Fix, file, or drop each Low with a one-line reason.
-   - High/Medium round 1: fix it, then ask `pnpm josh review:round2 --round-1-closed`. On `skip`, record
-     the skip on the Issue. On `required`, open the PR first and run the verification pass from
-     `pnpm josh review:brief --round 2` beside CI.
+   - High/Medium round 1: fix and record it (below), then ask `pnpm josh review:round2 --record <N>`
+     (it comments a skip). On `required`, open the PR first and run round 2 from
+     `pnpm josh review:brief --round 2` beside CI as `reviewer-verification` (`kit:` in a consumer).
    - Round 2 is final. Fix a branch-1 finding, run its scoped check, push it, then run the gate. Dispose
      of remaining non-High findings; a confirmed High blocks and receives a `confirmation` Telegram.
-   Any round-1 fix runs its affected scoped check and the gate before `git -y`.
+   Outside step 0, round-1 fixes run one scoped check and the gate before `git -y`.
    Once a round's verdict is attested, record its findings with `pnpm josh review:record --issue <N>
-   [<category>:<severity>:<file> ...]` — a clean round records one zero-finding line. **A round 2 that
+   ['[<disposition> ]<category>:<severity>:<file> — <reason>' ...]` (each one quoted argument; none if
+   clean; dispositions: its usage). **A round 2 that
    passes takes `--comment`** (`observation-ledger.md` → "The commit path").
    **`pnpm josh followup` refuses the merge until the round is recorded**
    (`pnpm josh review:record --check --issue <N>`).
-   A change to the run tooling also takes the interaction review: `prompts/review.md` → "Interaction review".
 5. **The clean path ships in one call** — with no second round due, background
    `pnpm josh ship "<title> #<N>" --body-file <evidence.md>` — the file carries `## 実機証跡` and
    `## 受け入れ条件の対応` (`report-format.md`), both asked at the preflight: PR preflight → gate → `git -y` →
@@ -67,17 +73,20 @@ These are the gate → review → PR → merge facts other documents cite; this
 
 - **The gate runs beside this review, not in front of it** — started with the review, joined before the
   commit. A red gate is fixed and re-run whatever the review concluded.
-- **origin/main is merged in before the gate** — `pnpm josh main:merge` is the last edit, so the scoped
-  pair and the gate run once over it; a conflict fires `backlogrun-recovery.md` → "Conflicts are not
+- **origin/main is merged in before the gate** — `pnpm josh main:merge` (in a lane, ship's sync) is the last edit, so the scoped
+  pair and the gate run once over it (in a lane, ship's, after `run:review`'s over the unmerged tree); a conflict fires `backlogrun-recovery.md` → "Conflicts are not
   predicted" early. **This is the one place a conflicted merge's procedure is written**: `main:merge`
   refuses when uncommitted changes touch a path the default branch also changed, or the index holds
   unresolved or staged paths — commit first with `pnpm josh git -y`, rerun, and **never stash around the
   merge**. A merge stopped on a conflict: remove the markers, then `pnpm josh git -y` stages the
   resolution and records the merge commit — **Tier A**; a lane child never asks a person for `git add`.
-- **A single check answers once per tree** — re-run one check by name (`pnpm josh lint:related`,
-  `pnpm josh cspell:dot`, `pnpm josh test:related`, or the type check) after every edit, never twice
-  over an untouched tree. In kit a detached `pnpm josh ship` also checks the metrics totals; accept a
-  grown total with its reason, as its output names.
+  A lane child's resolution of ship's `conflict` stop: markers removed → the re-detach the stop
+  prints (step 0), which records the merge commit and runs the scoped pair and the gate.
+- **One related-check command answers once per tree** — while implementing re-run one check per edit
+  (`lint:related` / `cspell:dot` / `test:related --touched`), one full-reach `test:related` once the
+  implementation is done (`docs/josh-commands.md` → "`josh test:related`"), then `pnpm josh check:related` once
+  before `run:review`, a review round's fixes once after the last (in a lane, none after `run:review`); `check:related` is those three plus `check`. In kit `lint:related` reports a metrics total past the
+  merge-base; accept it with its reason before `pnpm josh ship`, or its pre-detach check stops.
 - **The pull request opens between the rounds, so CI runs beside round 2** — round 1 runs on the
   uncommitted tree and its High/Medium fixes land before the commit; the verification pass runs against
   the open pull request.

package/.claude/skills/workflow-commands/delegation.md

@@ -46,9 +46,10 @@ forecast** — where the guard refuses, not a budget. Brief the unit on what was
 **Dispatch the unit as the `investigator` agent** (`kit:investigator` in a consumer) — read-only, on
 the `model` its definition names.
 
-**The main line does not idle while the unit reads:** read files this run will edit, then verify the
-unit's cited lines. Independent investigations launch together; a brief that needs another unit's
-answer waits for that answer.
+**The main line does not idle while the unit reads** — the reads of files this run will edit go in
+the same message (the `investigator-foreground` row of `pnpm josh rule:list`); then verify the unit's
+cited lines. Independent investigations launch
+together; a brief that needs another unit's answer waits for that answer.
 
 **When the Issue already names the file, function or rule, read that edit target in the main line.**
 It is not `survey`, and it is not `diagnosis`: the unit describes how the subject works;
@@ -56,6 +57,5 @@ the main line decides what that means and what to change.
 
 ## A `general-purpose` subagent names its model
 
-**A `general-purpose` dispatch → set `model`**: `sonnet` for routine work, `opus` for judgment; a review
-takes the alias of the `model=` id its brief prints (`claude-opus-5-5` → `opus`). Delivered by the
-`agent-model` row of `pnpm josh rule:list`.
+**A `general-purpose` dispatch sets `model`** — `sonnet` for routine work, `opus` for judgment (the
+`agent-model` row of `pnpm josh rule:list`).

package/.claude/skills/workflow-commands/entry-sequence.md

@@ -24,7 +24,7 @@ short-circuits with a non-zero exit. The numbered steps are the detail behind ea
 3. **Ask the session boundary in the same turn as the hold** — `pnpm josh cost --cut`. `under`
    continues; `over` (or unanswerable) stops before the title — `run:entry` sends the `confirmation`
    Telegram and runs `run:release` (`stop notified: …`); by hand only for `new`. **Skip it when
-   dispatched by a batch** (that batch owns the question). The verdict and the shared 135,000 threshold
+   dispatched by a batch** (that batch owns the question). The verdict and the model-priced threshold
    are the command's own.
 4. **Gather the mechanical reads — `pnpm josh run:prep <N>`**: `issue:read`'s body and comments
    (`issue-comments.md`), `issue:state`'s state, labels and `human_review`, and `latest:scope`'s
@@ -54,7 +54,7 @@ lane child starts none and never reads that document (`pnpm josh read:set lane-c
   source of the filing, the pause and the epic:bundle branch.
 - **An observation** — `observation-filing.md` (ask first if interactive).
 
-**The per-run filing cap is `prerequisite.md`'s** (the `filing-cap` row); on its refusal, stop and report.
+**The per-origin filing cap is `prerequisite.md`'s** (`issue:file`'s own step); on its refusal, stop and report.
 
 **The `into <target>` suffix** (a `new` entry) inserts the artifact into a named epic —
 `into-target.md`, read when the suffix is typed.

package/.claude/skills/workflow-commands/followup.md

@@ -22,15 +22,17 @@ request already merged by hand** (a `prrun` stop) runs only the post-merge tail;
 Issue is not posted twice, so re-running is safe. Keep the default Issue target. Ignore a finding only
 after verifying it is inapplicable; rate-limit text is not a finding.
 
-**A red rate-limited CodeRabbit check is cleared by a retrigger, not a bypass.** Wait out the stated
-window, post `@coderabbitai review` on the pull request, and rerun `followup`. Bypassing is Tier C — on
-explicit user instruction only, when the window is impractically long or the retrigger is rate-limited
-again.
+**A red rate-limited CodeRabbit check is cleared by a retrigger, not a bypass.** `followup` waits
+out the window (≤30 min) and posts `@coderabbitai review` once per pull request. On its
+no-retrigger note, do that and rerun `followup`. Bypassing a second rate limit is Tier C.
 
 A pre-merge failure stops the run; an unverifiable AI finding or CI failure needing input sends a
 `confirmation` Telegram. A post-merge cleanup failure is named and does not undo the merge; run the
 named recovery without rerunning `followup`. The printed result is authoritative.
 
+A CI job red only on tests outside the change → `followup` reruns it once, after ship's main merge
+when main moved a failed test (`scripts/followup/followup-main-move.ts`).
+
 After the merge `run:tail` returns to the default branch — `ship` runs it; after a bare `followup`, run
 `pnpm josh run:tail <N>`. In a lane the parent uses `pnpm josh lane:close <N>`. Never delete the branch unless requested. The sections below are read when the output needs reading.
 
@@ -56,7 +58,7 @@ Invoking `fullrun` is itself the explicit authorization to merge.
   reflexively: a SHA pin flagged "not matching the tag" is checked with `gh api
   repos/<owner>/<repo>/commits/<tag> --jq '.sha'`, and the bypass cites that command.
 - **The merge is `followup`'s, not yours** — `.claude/settings.json` refuses `gh pr merge` and its
-  `gh api` spellings (`CLAUDE.md` → "Git Rules"). Do **not** pass `--delete-branch` unless asked.
+  `gh api` spellings (`operating-rules.md` → "git-rules"). Do **not** pass `--delete-branch` unless asked.
 - **A failed merge** (branch protection, a conflict) is reported and stops the run — never retried with
   other flags. To skip the merge, use `kickoff` or say "do not merge" in the same turn and pass
   `--no-merge`.

package/.claude/skills/workflow-commands/fullrun-steps.md

@@ -11,13 +11,13 @@ File Issues with `pnpm josh issue:file` (it applies the classification labels);
    budget allowed the run, and `run:release <N>` takes it back off.
 2. Read the Issue and its comments off `run:entry`'s `run:prep` report (`issue-comments.md`).
 3. **Record the agreed plan** with `pnpm josh issue:plan <N> --body-file <path>`, adding
-   `--title "<title>"` when the title is not in English or can be phrased more clearly (a blank body
-   takes the plan, otherwise it becomes a comment; its `### 影響を受ける既存の利用者` section is drafted
-   with `pnpm josh plan:consumers` — `kickoff.md` step 4).
+   `--title "<title>"` when the title is not in English or can be phrased more clearly (the plan goes
+   into the body when it is blank and its author has write access, otherwise into a comment; its
+   `### 影響を受ける既存の利用者` section is drafted with `pnpm josh plan:consumers` — `kickoff.md` step 4).
 4. Run `pnpm josh ms`, then update dependencies only where the `run:prep` report answers
    `latest: required` — `latest-gate.md` is its single source, and on `required` load the
    `dependency-update` skill afterwards. **A dispatched lane child skips `pnpm josh ms`** — it refuses
-   in a lane, and `pnpm josh main:merge` brings the latest default in during the gate. The parent runs
+   in a lane, and ship's sync brings the latest default in before its gate. The parent runs
    `pnpm josh ms` in the primary checkout, never the child — `backlogrun-lanes.md` and
    `backlogrun-child.md` are the single sources.
 5. Implement. The `plan` event `run:board` draws 📝 from is written by code — by `run:entry` for a
@@ -48,8 +48,8 @@ in the session language: `pnpm josh issue:plan <N> --body-file <path>` (its cons
 `pnpm josh run:prep <N>`; on `latest: required` run `pnpm josh latest:if-required` and load the `dependency-update`
 skill; on `skip` neither runs (`latest-gate.md` is the single source). If (5) answered `stashed`,
 `pnpm josh stash:pop "fullrun new: pre-existing changes"`. (8) Implement. (9) Run the verification gate (as in `chain-rule.md`; only the first review round
-runs here). (9a) **Ask `pnpm josh review:round2 --round-1-closed` whether a second round is due**, once
-round 1's fixes are in and before the commit. (10) Where the tree was edited after the first gate
+runs here). (9a) **Ask `pnpm josh review:round2 --record <N>` whether a second round is due**, once
+round 1 is fixed and recorded, before the commit. (10) Where the tree was edited after the first gate
 started, re-run `pnpm josh gate` and join it. (11) `pnpm josh git -y "<title> #<N>"` — the pull request
 opens here, between the two rounds. (11a) Run the **second round** now beside the CI, where (9a)
 answered `required` (brief `pnpm josh review:brief --round 2`); a finding it fixes in place is pushed

package/.claude/skills/workflow-commands/fullrun.md

@@ -17,7 +17,7 @@ run's next single action. `chain-rule.md`, `followup.md`, `background-commands.m
 
 - **A lane child asks whether it is a resume first — `pnpm josh run:cut --resume <N>`** (`run:entry` asks it
   before the hold); on `resume` it skips the title, plan, hold and implementation and goes to the gate. At the pre-gate
-  boundary — immediately after `pnpm josh main:merge`, before the gate — it takes the cut with
+  boundary of `chain-rule.md` step 1 — step 0's ship fallen through, before the gate — it takes the cut with
   `pnpm josh run:cut <N>` (the ordered step in `chain-rule.md`, which names the cut's single source),
   and it records any park on the Issue before the stop notify. A run that is not a lane child never
   reads the cut's document.

package/.claude/skills/workflow-commands/issue-comments.md

@@ -8,12 +8,17 @@ turn as whatever else the run needs:
 
 ```bash
 pnpm josh issue:read <N> [<N> ...]     # body and comments, one call per batch
-gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'
+gh api repos/<owner>/<repo>/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'
 ```
 
 **Type the first line**; it **says when a comment listing could not be read rather than showing no
-comments**. The `gh api` form is for a **cross-repository** read (the command takes no `--repo`). Never
-`gh issue view <N> --comments` — GraphQL-backed, `403` in a cloud session.
+comments**. The `gh api` form is **cross-repository only** (the command takes no `--repo`); a read
+of this repository's Issue, its comments or its timeline — `repos/{owner}/…` or the repository
+spelled out, and `gh issue view` — is refused (`pnpm josh rule:list` → `direct-issue-read`).
+
+An Issue whose author has no write access stops at `run:entry` until a person with write access
+plans it with `kickoff #N`; the run then follows that plan (`scripts/run/entry/run-entry-trust.ts`).
+A trust read that failed stops there too, naming the failed read.
 
 **This repository writes its agreements into comments and then reads only bodies.** **What the
 reading is for**: the scope boundary — work a comment moved elsewhere or added here; an auto-decision
@@ -83,4 +88,4 @@ and refuses every other body-only read; the Codex adapter refuses them all** (`p
 ## A person's update mid-run
 
 When the hook, `review:attest --check` or `followup` shows an Issue update, read it as above, fix what it
-changes, then `pnpm josh issue:ack <N>`. The watch: `docs/josh-commands-backlog.md` → "`josh issue:ack`".
+changes, then `pnpm josh issue:ack <N>`. A withheld-body notice (author without write access) needs no ack. The watch: `docs/josh-commands-backlog.md` → "`josh issue:ack`".

package/.claude/skills/workflow-commands/issue-fold-existing.md

@@ -21,7 +21,8 @@ pnpm josh issue:fold-existing assessment.json --json > result.json
 jq -e '.verdict == "fold"' result.json
 jq '{body: .body}' result.json > patch.json
 gh api -X PATCH repos/{owner}/{repo}/issues/<N> --input patch.json
+pnpm josh issue:priority <N>
 pnpm josh issue:read <N>
 ```
 
-Re-read it and confirm the original requirements, the decisions recorded in comments, the added requirements and the verification all remain. A failed write or re-read means the fold is not complete. A fold never creates a new Issue. `separate` returns to the ordinary filing path, and `inspect` re-reads the missing information.
+A body edit applies no label: `pnpm josh issue:priority <N>` applies the body's floor (`issue-template.md` → F). Re-read it and confirm the original requirements, the decisions recorded in comments, the added requirements and the verification all remain. A failed write or re-read means the fold is not complete. A fold never creates a new Issue. `separate` returns to the ordinary filing path, and `inspect` re-reads the missing information.