@joshuafolkken/kit 1.2116.0 → 1.3000.0

package/scripts/run/carry/run-carry-cli.ts

@@ -1,8 +1,10 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { backlog_preflight } from '#scripts/backlog/backlog-preflight'
 import { backlogrun_launch } from '#scripts/backlog/backlogrun-launch'
 import { cost_cli } from '#scripts/cost-runtime/cost-cli'
 import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
+import { lane_limit_history } from '#scripts/lane/lane-limit-history'
 import { run_event_setup } from '#scripts/run/event/run-event-setup'
 import { run_event_stream } from '#scripts/run/event/run-event-stream'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
@@ -44,6 +46,10 @@ const MISMATCH_VERDICT = 'mismatch'
 const BUSY_VERDICT = 'busy'
 const STANDING_VERDICT = 'standing'
 const UNKNOWN_VERDICT = 'unknown'
+// The launched parent, over the record its launch already handed to the supervisor.
+const DRIVING_VERDICT = 'driving'
+const DRIVING_MESSAGE =
+	'The supervisor `josh backlogrun` started is already driving this run, so this session took no record. Report the plan and settle every `needs-decision` issue, then end the turn — no `run:step` hand-off.'
 const COMMAND = 'run:carry'
 // The invocation has taken its maximum cuts. A benign, non-failing refusal:
 // the run carries on uncut rather than paying a cold preamble the accumulation it would shed no longer
@@ -171,11 +177,35 @@ async function start_fresh(
 
 	if (carry === undefined) return report_lost(is_json)
 
+	// The limit the run starts under, for a run the launcher's preflight did not begin (joshuafolkken/kit#6147).
+	await lane_limit_history.record_launch()
 	await run_event_setup.emit(run_event_setup.STAGE.PLANNING)
 
 	return report_carry(BEGAN_VERDICT, carry, is_json)
 }
 
+// The parent `josh backlogrun` launched, meeting the record its preflight handed to the supervisor:
+// the loop is already driven, so this parent reports the plan and settles `needs-decision` beside the
+// lanes, and takes nothing (`backlog-preflight.ts`).
+async function report_carried(
+	target: string,
+	carry: RunCarry,
+	request: CarryClaimRequest,
+	is_json: boolean,
+): Promise<number> {
+	const directory = await run_carry.repository_directory()
+	const is_driven =
+		directory !== undefined && backlog_preflight.is_driven_for(directory, carry, request.owner)
+
+	if (!is_driven || carry.invocation !== request.invocation) {
+		return report_claim(target, carry, request, is_json)
+	}
+
+	console.error(DRIVING_MESSAGE)
+
+	return report(DRIVING_VERDICT, carry, is_json, SUCCESS_EXIT_CODE)
+}
+
 // **A standing record is never replaced, and never resumed into by something else.** Replacing one
 // would restart the budget the cut exists to carry, and resuming into one would put two parents on a
 // single budget. Its age changes none of that: a record is replaced by nothing but a person's `--end`.
@@ -188,7 +218,7 @@ async function begin(
 
 	if (read.kind === 'unreadable') return report_unreadable(is_json)
 
-	if (read.kind === 'carried') return report_claim(target, read.carry, request, is_json)
+	if (read.kind === 'carried') return await report_carried(target, read.carry, request, is_json)
 
 	return await start_fresh(target, request, is_json)
 }

package/scripts/run/carry/run-carry-conversation.ts

@@ -30,9 +30,16 @@ const CONVERSATION_QUIET_MS = 600_000
 
 type Environment = Readonly<Record<string, string | undefined>>
 
+// The transcript a session writes under `directory` — the one name both the session reading its own
+// and the supervisor naming a session it is about to wake (`run-wake-handoff.ts`) build.
+function transcript_of(session_id: string, directory: string): string {
+	return path.join(directory, `${session_id}${cost_transcript.TRANSCRIPT_EXTENSION}`)
+}
+
 // The calling session's own transcript, or `undefined` outside a session or when its file cannot be
 // found. **The id comes from the environment, which a detached supervisor never inherits**
-// (`agent-session-environment.ts` strips it), so a record the supervisor adopts names no transcript.
+// (`agent-session-environment.ts` strips it), so a record the supervisor adopts for itself names no
+// transcript.
 function own_transcript(
 	environment: Environment = process.env,
 	directories: ReadonlyArray<string> = cost_transcript.transcript_directories(process.cwd()),
@@ -41,9 +48,9 @@ function own_transcript(
 
 	if (session_id === undefined) return undefined
 
-	const name = `${session_id}${cost_transcript.TRANSCRIPT_EXTENSION}`
-
-	return directories.map((directory) => path.join(directory, name)).find((file) => existsSync(file))
+	return directories
+		.map((directory) => transcript_of(session_id, directory))
+		.find((file) => existsSync(file))
 }
 
 function modified_ms(transcript: string): number | undefined {
@@ -89,6 +96,7 @@ function reclaim_owner(carry: RunCarry, owner: CarryOwner): RunCarry {
 
 const run_carry_conversation = {
 	CONVERSATION_QUIET_MS,
+	transcript_of,
 	own_transcript,
 	is_conversation_live,
 	is_same_conversation,

package/scripts/run/carry/run-carry-ended.ts

@@ -1,4 +1,5 @@
 import path from 'node:path'
+import { agent_provider } from '#scripts/agent/agent-provider'
 import { durable_state } from '#scripts/josh/durable-state'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { json_value } from '#scripts/lib/json-value'
@@ -22,6 +23,7 @@ const ENDED_PREFIX = durable_state.PREFIX.ENDED
 const TRANSCRIPT_SUFFIX = '.jsonl'
 
 const ended_run_schema = z.object({
+	scheduler_provider: agent_provider.PROVIDER_SCHEMA.optional(),
 	invocation: z.string(),
 	started_at: z.string(),
 	ended_at: z.string(),
@@ -62,6 +64,7 @@ function record_ended(
 	const ended_at = now.toISOString()
 
 	stamp_file.replace_stamp(target, {
+		...(read.carry.scheduler_provider && { scheduler_provider: read.carry.scheduler_provider }),
 		invocation,
 		started_at,
 		ended_at,

package/scripts/run/carry/run-carry-reclaim.ts

@@ -7,7 +7,8 @@ import { run_carry_conversation } from './run-carry-conversation'
 // counts nothing — `lane:await` blocks in the background and the transcript stays unwritten — so a
 // restart followed by a long wait outlasts the quiet window with the record still naming the dead
 // process, and `run:wake` recovers it as a crash. The wait itself is therefore where the parent
-// declares its owner: `lane:await --owner "$PPID"` reclaims the record before it starts waiting.
+// declares its owner: `lane:await` (its owner the session's `CLAUDE_PID` unless `--owner` names one)
+// reclaims the record before it starts waiting.
 
 // Writes the record back under the caller's process when the caller is the record's own conversation
 // in a new one; answers whether it did.

package/scripts/run/carry/run-carry.ts

@@ -1,4 +1,6 @@
+import { agent_provider, type AgentProvider } from '#scripts/agent/agent-provider'
 import { git_command } from '#scripts/git/git-command'
+import { agent_session_environment } from '#scripts/josh/agent-session-environment'
 import { durable_state } from '#scripts/josh/durable-state'
 import { process_identity } from '#scripts/josh/process-identity'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -41,8 +43,8 @@ const REPOSITORY_DIRECTORY_INDEX = 1
 const NO_INCREMENT = 0
 
 // The most session cuts one invocation may take. This bounds `cuts`, which
-// only `run:carry --cut` increments — a `backlogrun`'s session hand-off at a child's merge (~one per
-// 50 minutes of work), not the `run:cut` phase cuts a lane child takes. Each
+// only `run:carry --cut` increments — a `backlogrun`'s session hand-off at a child's merge,
+// not the `run:cut` phase cuts a lane child takes. Each
 // cut drops the context it accumulated but pays a cold preamble to resume, so past a point the
 // re-establishment costs more than the accumulation it sheds; six sits well under the ~10 a night of
 // work could otherwise take and refuses a run that has begun to churn. `is_at_cut_cap` reads it, and the
@@ -53,11 +55,9 @@ const MAX_CUTS = 6
 const END_COMMAND = 'pnpm josh run:carry --end'
 const RESUME_COMMAND = 'pnpm josh run:carry --resume'
 const READ_COMMAND = 'pnpm josh run:carry --json'
-// The shell variable that names the parent loop's own long-lived process, quoted so the reader can
-// paste the printed command as it stands.
-const OWNER_ARGUMENT = '--owner "$PPID"'
 
 interface RunCarry {
+	scheduler_provider?: AgentProvider | undefined
 	// The invocation the person typed — a `backlogrun` one in `run_invocation.rebuild`'s spelling — so
 	// a resumed session runs the same command rather than one it inferred. `CLAUDE.md` → "Explicit invocation required" forbids inferring; naming the
 	// invocation is what leaves nothing to infer. **It is not the ownership test** — that is
@@ -79,7 +79,7 @@ interface RunCarry {
 	// The consecutive-API-outage streak. It is kept apart from `failures`
 	// because a child that could not reach the API is not a child that failed: an outage is not counted
 	// against the consecutive-failure guard, and this streak is its own environment-broken guard — a run
-	// of outages stops the run rather than re-dispatching into a dead API forever. **A merge or a genuine
+	// of outages holds launches rather than re-dispatching into a dead API. **A merge or a genuine
 	// child failure resets it**, because both prove the API was reachable; only a further outage adds to
 	// it.
 	outages: number
@@ -133,12 +133,16 @@ interface RunCarry {
 	// with, and the record is the one place both it and a person's shell read. Carried across a hand-off
 	// like `done`; optional and `| undefined` for the same disk round-trip reason.
 	lane_limit?: number | undefined
+	// The limit the run started with, read after `lane_limit` so `lane:limit --reset` restores it rather
+	// than the `JOSH_LANE_LIMIT` a shell's `.env` reads now (joshuafolkken/kit#6166).
+	launch_limit?: number | undefined
 }
 
 // The identity of a process, as `process-identity.ts` keeps it: the pid plus an opaque start-time
 // token, so a reissued pid is never mistaken for the process that wrote the record — and the
 // transcript of the conversation that process runs, which outlives it (`run-carry-conversation.ts`).
 interface CarryOwner {
+	provider?: AgentProvider | undefined
 	pid?: number | undefined
 	start?: string | undefined
 	transcript?: string | undefined
@@ -189,6 +193,7 @@ const NO_OWNER: CarryOwner = {}
 const carry_addition_schema = z.object({ issue: z.number(), is_priority: z.boolean() })
 
 const run_carry_schema = z.object({
+	scheduler_provider: agent_provider.PROVIDER_SCHEMA.optional(),
 	invocation: z.string(),
 	started_at: z.string(),
 	merged: z.number(),
@@ -210,6 +215,7 @@ const run_carry_schema = z.object({
 	retrospective: z.boolean().optional(),
 	added: z.array(carry_addition_schema).optional(),
 	lane_limit: z.number().int().positive().optional(),
+	launch_limit: z.number().int().positive().optional(),
 })
 
 function carry_path(git_directory: string): string {
@@ -250,7 +256,7 @@ function read_carry(target: string): CarryRead {
 // The identity to record for a pid the caller declared. `read_start` is what makes the pair an
 // identity rather than a number; injected in tests so the sandbox branch is exercised without
 // changing the machine's process capabilities. The transcript is the calling session's own — the
-// declared pid is that session's process (`--owner "$PPID"`).
+// declared pid is that session's process.
 function owner_of(
 	pid: number,
 	read: (owner_pid: number) => string | undefined = process_identity.read_start,
@@ -259,8 +265,17 @@ function owner_of(
 	return { pid, start: read(pid), transcript }
 }
 
+// The calling session as owner — the pid the session exports, so no caller spells `$PPID`; with
+// none exported, no owner is declared.
+function session_owner(): CarryOwner {
+	const pid = agent_session_environment.own_session_pid()
+
+	return pid === undefined ? NO_OWNER : owner_of(pid)
+}
+
 function fresh_carry(invocation: string, owner: CarryOwner, now: Date): RunCarry {
 	return {
+		...(owner.provider && { scheduler_provider: owner.provider }),
 		invocation,
 		started_at: now.toISOString(),
 		merged: NO_INCREMENT,
@@ -309,6 +324,7 @@ function adopt_carry(
 	// writes `undefined`, so the previous owner cannot survive — and the declared hand-off is spent.
 	const next: RunCarry = {
 		...carry,
+		scheduler_provider: owner.provider,
 		owner_pid: owner.pid,
 		owner_start: owner.start,
 		owner_transcript: owner.transcript,
@@ -420,21 +436,26 @@ function retrospective_done_of(read: CarryRead): boolean {
 	return read.kind === 'carried' && read.carry.retrospective === true
 }
 
+function left_of(carry: RunCarry, declared: ReadonlyArray<number>): ReadonlyArray<number> {
+	const done = carry.done ?? []
+
+	return run_carry_added.ordered(declared, carry.added).filter((issue) => !done.includes(issue))
+}
+
 // **What the resumed session has to be told, computed rather than stored.** A stored remainder would
 // be a second copy of a subtraction the record already determines, free to disagree with it; computed
 // here, `--json` answers the successor's one question — which issues are left, in the order they were
-// declared — so nothing downstream has to subtract two lists by hand. An invocation that named no
-// issues answers `undefined`, which `JSON.stringify` drops. The issues `run:add` put in are folded in by `run_carry_added.ordered`.
+// declared — so nothing downstream has to subtract two lists by hand. The issues `run:add` put in are
+// folded in by `run_carry_added.ordered`. An invocation that named no issues answers `undefined`, which
+// `JSON.stringify` drops, once no issue `run:add` gave it is left: what is left of it then is the pool,
+// not an empty list a reader would take for a finished run.
 function remaining_of(carry: RunCarry | undefined): ReadonlyArray<number> | undefined {
 	if (carry === undefined) return undefined
 
 	const declared = run_invocation.issue_numbers(carry.invocation)
+	const left = left_of(carry, declared ?? [])
 
-	if (declared === undefined) return undefined
-
-	const done = carry.done ?? []
-
-	return run_carry_added.ordered(declared, carry.added).filter((issue) => !done.includes(issue))
+	return declared === undefined && left.length === 0 ? undefined : left
 }
 
 // The finished issues are named rather than counted, because the reader of a `busy` or `standing`
@@ -463,13 +484,11 @@ function busy_message(carry: RunCarry): string {
 	return `A live run holds this budget — ${describe_carry(carry)}, owner pid ${String(carry.owner_pid)} still running. Nothing was established. Wait for that run, or end its record with \`${END_COMMAND}\` once you know it is over.`
 }
 
-// The adoption command, shared by the standing refusal and the judgment wake's hand-off.
-// **`--owner "$PPID"` is part of the command, not an optional extra.** An adoption made without it
-// leaves the record declaring no owner, and from then on every second parent reads it as not provably
-// live and is answered `standing` rather than `busy` — the ownership defense degrading silently
-// through the very message that recommends the command.
+// The adoption command the standing refusal names.
+// It names no `--owner`: the command takes the session's own pid from its environment, so the
+// adoption still declares an owner without a `$PPID` expansion a shell guard refuses.
 function claim_command(invocation: string): string {
-	return `${RESUME_COMMAND} "${invocation}" ${OWNER_ARGUMENT}`
+	return `${RESUME_COMMAND} "${invocation}"`
 }
 
 // The record's owner is gone and no cut handed it off — the crashed run, and the same command
@@ -542,6 +561,7 @@ const run_carry = {
 	remaining_of,
 	repository_directory,
 	retrospective_done_of,
+	session_owner,
 	standing_message,
 	unknown_message,
 	unreadable_message,

package/scripts/run/cut/run-cut-adoption.ts

@@ -0,0 +1,67 @@
+import { agent_profile_schema } from '#scripts/agent/agent-profile-schema'
+import { agent_provider } from '#scripts/agent/agent-provider'
+import { own_session } from '#scripts/cost-runtime/own-session'
+import { stamp_file } from '#scripts/josh/stamp-file'
+import { lane_child_invocation } from '#scripts/lane/lane-child-invocation'
+import type { RunCut } from './run-cut'
+
+// A session id survives separate CLI calls; the CLI's own pid does not.
+function session(): string | undefined {
+	const selected = agent_provider.resolve_provider()
+	if (selected.kind !== 'provider') return undefined
+	const id = agent_provider.trimmed(
+		selected.provider === agent_provider.OPENAI_PROVIDER
+			? process.env[agent_provider.CODEX_SESSION_KEY]
+			: own_session.session_id_of(process.env),
+	)
+
+	return id === undefined ? undefined : `${selected.provider}:${id}`
+}
+
+function is_own_adoption(cut: RunCut): boolean {
+	return (
+		cut.is_handed_off === false &&
+		cut.adopted_session !== undefined &&
+		cut.adopted_session === session()
+	)
+}
+
+function matches_run(previous: RunCut, next: RunCut): boolean {
+	return (
+		previous.issue === next.issue &&
+		previous.branch === next.branch &&
+		previous.invocation === next.invocation
+	)
+}
+
+function can_replace(previous: RunCut, next: RunCut): boolean {
+	return (
+		previous.phase === agent_profile_schema.PRE_GATE_PHASE &&
+		next.phase === agent_profile_schema.IMPLEMENTATION_PHASE &&
+		is_own_adoption(previous) &&
+		matches_run(previous, next)
+	)
+}
+
+// Called only after the lane's workers have stopped. Keep the saved resume point, but let the
+// next worker adopt it again; a waiting or parked worker no longer owns the handoff.
+function release(target: string, cut: RunCut, issue: string): void {
+	if (
+		cut.is_handed_off !== false ||
+		cut.invocation !== lane_child_invocation.child_invocation(issue) ||
+		cut.issue !== issue
+	) {
+		return
+	}
+
+	stamp_file.replace_stamp(target, {
+		...cut,
+		is_handed_off: true,
+		adopted_session: undefined,
+		is_merge_relaunched: undefined,
+	})
+}
+
+const run_cut_adoption = { can_replace, release, session }
+
+export { run_cut_adoption }

package/scripts/run/cut/run-cut-cli.ts

@@ -1,8 +1,9 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
 import { agent_session_role } from '#scripts/agent/agent-session-role'
-import { cost_cli } from '#scripts/cost-runtime/cost-cli'
+import { cost_cli, type CostVerdict } from '#scripts/cost-runtime/cost-cli'
 import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
+import { repository_lock } from '#scripts/git/repository-lock'
 import { issue_cite } from '#scripts/issue/issue-cite'
 import { lane_registry, type LaneInfo } from '#scripts/lane/lane-registry'
 import { lane_relaunch } from '#scripts/lane/lane-relaunch'
@@ -10,12 +11,13 @@ import { openai_lane_supervisor } from '#scripts/lane/openai-lane-supervisor'
 import { run_event_stream } from '#scripts/run/event/run-event-stream'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { run_cli_fault } from '#scripts/run/run-cli-fault'
-import { split_resolution } from '#scripts/split/split-resolution'
+import { run_step_section } from '#scripts/run/run-step-section'
 import { run_cut } from './run-cut'
 import { run_cut_args, type Request } from './run-cut-args'
 import { run_cut_decline } from './run-cut-decline'
 import { run_cut_digest } from './run-cut-digest'
 import { run_cut_handoff } from './run-cut-handoff'
+import { run_cut_next } from './run-cut-next'
 import { run_cut_ready } from './run-cut-ready'
 import { run_cut_report } from './run-cut-report'
 import { run_cut_resume } from './run-cut-resume'
@@ -27,10 +29,11 @@ import { run_cut_review } from './run-cut-review'
 // against the record and hands the run on to the gate. **Turning `argv` into a request is
 // `run-cut-args.ts`'s**; what is here acts on the record and relaunches.
 //
-// The contract is `run:hold`'s and `run:carry`'s: **standard output carries exactly one token** and
-// every explanation goes to standard error, so a loop can branch on `answer=$(pnpm josh run:cut 12)`.
-// `--json` is the one exception, and it is still one line: the whole record has to reach a resuming
-// session.
+// The contract is `run:hold`'s and `run:carry`'s: **the first line of standard output is one token** and
+// every explanation goes to standard error, so a loop can branch on the first line of
+// `answer=$(pnpm josh run:cut 12)`. A non-trivial verdict is followed by the `pre-gate-cut.md` section
+// it acts on (joshuafolkken/kit#5953), so the reader never opens the whole document. `--json` is still
+// one line: the whole record has to reach a resuming session.
 
 const ARGV_OFFSET = 2
 const COMMAND = 'run:cut'
@@ -44,12 +47,12 @@ const {
 	FAILURE_EXIT_CODE,
 	FRESH_VERDICT,
 	HANDOFF_MISSING_NOTE,
+	last_verdict,
 	HANDOFF_OVERFLOW_NOTE,
 	NOT_A_LANE_VERDICT,
 	OVER_VERDICT,
 	RESUME_IMPL_VERDICT,
 	RESUME_VERDICT,
-	SPLIT_UNRESOLVED_VERDICT,
 	SUCCESS_EXIT_CODE,
 	UNDER_THRESHOLD_VERDICT,
 	UNREADY_VERDICT,
@@ -62,29 +65,41 @@ const {
 	report_missing_supervisor,
 	report_relaunched_cut,
 	report_reviewer,
-	report_split_unresolved,
 	report_under_threshold,
 	report_unknown,
 } = run_cut_report
 
+// An unmeasurable session was never priced, so it is not told it is under the threshold; it reaches the
+// gate under the same verdict, since a relaunch could not price it either (joshuafolkken/kit#6576).
+function report_unmeasurable(): number {
+	console.error(
+		'The current context cannot be measured, so nothing was cut; a resume could not measure it either. Continue to the gate.',
+	)
+
+	return report(UNDER_THRESHOLD_VERDICT, SUCCESS_EXIT_CODE)
+}
+
+// Only a measured `over` takes the cut; `under` and an unmeasurable session both continue uncut.
+function verdict_answer(verdict: CostVerdict): number | undefined {
+	if (verdict === cost_verdict.OVER_VERDICT) return undefined
+
+	return verdict === cost_verdict.UNDER_VERDICT ? report_under_threshold() : report_unmeasurable()
+}
+
 // **The pre-gate cut is conditional on the same statistic the implementation-phase cut reads**.
 // `cost_cli.session_verdict` prices the newest request against the `--cut` break-even, so no second
-// threshold is introduced — an `under` session skips the cut, and an unmeasurable one still cuts as
-// the safety net. Only the pre-gate phase is checked here; the implementation-phase caller gates its own
+// threshold is introduced — only an `over` session is cut, an unmeasurable one skips it (joshuafolkken/kit#6576).
+// Only the pre-gate phase is checked here; the implementation-phase caller gates its own
 // `--impl` cut on `pnpm josh cost --cut` before it is ever issued.
 //
-// **A noticed Issue answers the split notice first** (joshuafolkken/kit#4695): the pre-gate cut is the
-// boundary the notice names, so a lane that neither split nor recorded why is refused whether or not
-// the cut itself would be taken. Returns the answer given without cutting, or `undefined`.
-async function pre_gate_answer(issue: string, phase: string): Promise<number | undefined> {
+// **Size never reaches the cut** (joshuafolkken/kit#7183): `lane:plan` warned once, and an overrun is
+// recorded at the merge as a pre-split miss. **Nor does an implementation past its budget**
+// (joshuafolkken/kit#7010): the overrun stays in `lane:stats` / `lane:breakdown` only, and a started
+// Issue is implemented to the end. Returns the answer given without cutting, or `undefined`.
+function pre_gate_answer(phase: string): number | undefined {
 	if (phase !== run_cut.PRE_GATE_PHASE) return undefined
-	const split_note = await split_resolution.ledger_refusal(Number(issue))
-
-	if (split_note !== undefined) return report_split_unresolved(split_note)
 
-	return cost_cli.session_verdict() === cost_verdict.UNDER_VERDICT
-		? report_under_threshold()
-		: undefined
+	return verdict_answer(cost_cli.session_verdict())
 }
 
 // The exclusive create lost, so a cut is already in flight for this tree — the double-cut guard. The
@@ -114,10 +129,10 @@ function report_relaunch_failure(target: string, note: string): number {
 // A pre-gate resume drives the gate, commit, PR and merge — the mechanical
 // ship/bookkeeping region, lowered — while an implementation resume keeps the role default. The
 // phase-aware profile is `agent_argv.resume_argv`'s; a person's `JOSH_WORKER_EFFORT` still wins over it,
-// and a pre-gate resume moves to `JOSH_WORKER_SHIP_MODEL` when that is set.
-function relaunch(target: string, lane: LaneInfo, phase: string): number {
+// and a pre-gate resume moves to the ship model — Sonnet, or `JOSH_WORKER_SHIP_MODEL` when that is set.
+async function relaunch(target: string, lane: LaneInfo, phase: string): Promise<number> {
 	const notes: Array<string> = []
-	const result = lane_relaunch.resume(lane, phase, (note) => {
+	const result = await lane_relaunch.resume(lane, phase, (note) => {
 		notes.push(note)
 	})
 
@@ -131,10 +146,11 @@ function relaunch(target: string, lane: LaneInfo, phase: string): number {
 const { is_lane_branch } = run_cut_ready
 const { declined } = run_cut_decline
 
-// An expired record is a fresh process that never started; it is cleared so the next cut can begin
-// rather than being wedged behind a stale file the exclusive create would refuse forever.
+// An unadopted expired cut may be cleared. An adopted record can still belong to a live session;
+// its age alone never permits another session to delete it.
 function clear_expired(target: string): void {
-	if (run_cut.read_cut(target).kind === 'expired') run_cut.end_cut(target)
+	const read = run_cut.read_cut(target)
+	if (read.kind === 'expired' && read.cut.is_handed_off !== false) run_cut.end_cut(target)
 }
 
 function has_matching_supervisor(lane: LaneInfo, issue: string): boolean {
@@ -159,7 +175,7 @@ interface CutRequest {
 async function emit_cut_event(request: CutRequest): Promise<void> {
 	await run_event_stream_emit.emit(
 		run_event_stream.EVENT_KIND.CUT,
-		`${issue_cite.plain(request.issue)} cut (${request.phase})`,
+		`${issue_cite.plain_for('program', request.issue)} cut (${request.phase})`,
 	)
 }
 
@@ -205,7 +221,7 @@ async function finish_cut(target: string, lane: LaneInfo, request: CutRequest):
 
 	return lane_relaunch.is_openai_lane(lane)
 		? report_relaunched_cut()
-		: relaunch(target, lane, request.phase)
+		: await relaunch(target, lane, request.phase)
 }
 
 // **A `fullrun` held in its own checkout takes the implementation cut too**, so a run a person started
@@ -251,7 +267,7 @@ async function cut(
 		return await declined({ issue, phase }, state, refuse_unready(state))
 	}
 
-	const answered = await pre_gate_answer(issue, phase)
+	const answered = pre_gate_answer(phase)
 
 	if (answered !== undefined) return answered
 
@@ -293,12 +309,31 @@ async function take_cut(target: string, request: CutCommand): Promise<number> {
 	return await cut(target, request.issue, cut_phase(request), request.handoff_path)
 }
 
+// The verdicts that leave nothing to act on beyond carrying on, so no section follows them.
+const TRIVIAL_VERDICTS: ReadonlySet<string> = new Set([
+	NOT_A_LANE_VERDICT,
+	UNDER_THRESHOLD_VERDICT,
+	FRESH_VERDICT,
+])
+
+// The section is printed after the token, never instead of it, and the token's exit code stands.
+function with_section(key: string, code: number): number {
+	if (!TRIVIAL_VERDICTS.has(last_verdict())) run_step_section.print_once(key)
+
+	return code
+}
+
 async function act(target: string, request: Request): Promise<number> {
-	if (request.kind === 'cut') return await take_cut(target, request)
+	// "Taking the cut" is the pre-gate boundary's; an `--impl` cut's caller carries its own instruction.
+	if (request.kind === 'cut' && request.is_implementation) return await take_cut(target, request)
 
-	if (request.kind === 'resume') return await run_cut_resume.resume(target, request.issue)
+	if (request.kind === 'cut') {
+		return with_section(run_step_section.CUT, await take_cut(target, request))
+	}
 
-	if (request.kind === 'read') return read_json(target)
+	if (request.kind === 'resume') {
+		return with_section(run_step_section.RESUME, await run_cut_resume.resume(target, request.issue))
+	}
 
 	return end(target)
 }
@@ -308,7 +343,17 @@ async function answer(request: Request): Promise<number> {
 
 	if (directory === undefined) return report_unknown()
 
-	return await act(run_cut.cut_path(directory), request)
+	const target = run_cut.cut_path(directory)
+	// Atomic record replacement lets diagnostics read a complete snapshot without the mutation lock.
+	if (request.kind === 'read') return read_json(target)
+
+	const result = await repository_lock.with_lock(
+		async () => await act(target, request),
+		`${target}.lock`,
+		0,
+	)
+
+	return result ?? report_cut_exists(target)
 }
 
 function refuse(): number {
@@ -317,6 +362,14 @@ function refuse(): number {
 	return FAILURE_EXIT_CODE
 }
 
+function print_next(request: Request): void {
+	if (request.kind !== 'cut' || request.is_implementation || agent_session_role.is_reviewer()) {
+		return
+	}
+
+	run_cut_next.print_next(last_verdict(), request.issue)
+}
+
 // Every path out prints exactly one token, including the ones nobody planned: an empty standard
 // output matches no verdict, which a resume entry check reads as "not a resume" and would let a fresh
 // process re-implement over a cut it should have carried. The token stays `unknown`, and the failure
@@ -334,6 +387,8 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 		return await answer(request)
 	} catch (error) {
 		return report_fault(run_cli_fault.message(COMMAND, error))
+	} finally {
+		print_next(request)
 	}
 }
 
@@ -352,7 +407,6 @@ const run_cut_cli = {
 	OVER_VERDICT,
 	RESUME_IMPL_VERDICT,
 	RESUME_VERDICT,
-	SPLIT_UNRESOLVED_VERDICT,
 	UNDER_THRESHOLD_VERDICT,
 	UNREADY_VERDICT,
 	run,

package/scripts/run/cut/run-cut-decline.ts

@@ -6,7 +6,7 @@ import { run_cut, type CutState } from './run-cut'
 // The implementation cut a run asked for and was refused — `not-a-lane` or `unready` — recorded so the
 // implementation-cut guard stops asking for it (joshuafolkken/kit#3881).
 //
-// **The reissue window alone re-asked every 90 seconds.** A run whose `run:cut --impl` can only answer
+// **A reissue window alone repeats a question whose answer cannot change.** A run whose `run:cut --impl` can only answer
 // `unready` was refused edit after edit, each refusal a round trip that cut nothing. Neither answer
 // changes while the same hold stands over the tree, so the record names the issue and the hold it
 // answered, and the guard stays silent while both still match; a fresh hold — a new run — asks again.

package/scripts/run/cut/run-cut-handoff.ts

@@ -1,4 +1,5 @@
 import { readFileSync } from 'node:fs'
+import { JOSH_TMP_DIRECTORY } from '#scripts/lib/josh-temporary-directory'
 import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 
@@ -164,7 +165,7 @@ function describe_handoff(handoff: Handoff): string {
 // Where a handoff file is written: `.josh/tmp/` is ignored, so `josh git`, which stages every
 // untracked non-ignored file, cannot commit the note with the code. A refusal that asked for "a file"
 // and named no place got one written beside the code and committed (joshuafolkken/kit#3603).
-const HANDOFF_PATH = '.josh/tmp/handoff-<N>.json'
+const HANDOFF_PATH = `${JOSH_TMP_DIRECTORY}/handoff-<N>.json`
 const ISSUE_PLACEHOLDER = '<N>'
 
 // The handoff path for one issue, relative to the checkout — the path `HANDOFF_PATH` tells the run