@joshuafolkken/kit 1.3044.0 → 1.3092.0

package/scripts/run/add/run-add-cli.ts

@@ -11,6 +11,7 @@ import { run_event_retry } from '#scripts/run/event/run-event-retry'
 import { run_event_stream } from '#scripts/run/event/run-event-stream'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { run_invocation } from '#scripts/run/run-invocation'
+import { run_repair_attempt } from '#scripts/run/run-repair-attempt'
 import { run_add, type AddContext, type AddOutcome, type AddPorts, type IssueView } from './run-add'
 import { run_add_epic } from './run-add-epic'
 import { run_add_issue } from './run-add-issue'
@@ -136,6 +137,17 @@ async function announce(
 	await announce(rest, roots, is_retry)
 }
 
+async function prepare_repairs(request: AddRequest): Promise<ReadonlySet<number>> {
+	if (!request.is_retry) return new Set()
+	const prepared = await Promise.all(
+		request.issues.map(async (issue) =>
+			(await run_repair_attempt.prepare(String(issue))) ? issue : undefined,
+		),
+	)
+
+	return new Set(prepared.filter((issue) => issue !== undefined))
+}
+
 // The blockers still open. A blocker whose state did not come back counts as open, so an issue is
 // never reported free to run on a read that did not say so.
 function view_of(issue: EpicIssue): IssueView {
@@ -166,7 +178,11 @@ async function clear_label(issue: number, label: string): Promise<boolean> {
 
 const GH_PORTS: AddPorts = { read_issue, apply_label, clear_label }
 
-async function context_of(live: LiveRun, is_retry: boolean): Promise<AddContext> {
+async function context_of(
+	live: LiveRun,
+	is_retry: boolean,
+	repairs: ReadonlySet<number>,
+): Promise<AddContext> {
 	const lanes = await lane_spent.lanes_in_use()
 	const events = await run_event_stream_emit.current_events(is_retry)
 	const active = backlog_drive_restore.active_issues(events)
@@ -174,6 +190,7 @@ async function context_of(live: LiveRun, is_retry: boolean): Promise<AddContext>
 
 	return {
 		is_retry,
+		repairs,
 		done: live.carry.done ?? [],
 		active: new Set([...active, ...lanes.working, ...lanes.unread]),
 		settled: new Set([
@@ -191,11 +208,12 @@ function report(outcomes: ReadonlyArray<AddOutcome>, is_priority: boolean): numb
 }
 
 async function add(request: AddRequest, live: LiveRun, ports: AddPorts): Promise<number> {
+	const repairs = await prepare_repairs(request)
 	const outcomes: ReadonlyArray<AddOutcome> = await run_add.add_all(
 		request.issues,
 		request.is_priority,
 		ports,
-		await context_of(live, request.is_retry),
+		await context_of(live, request.is_retry, repairs),
 	)
 	const additions = run_add.additions_of(outcomes, request.is_priority)
 	const roots = run_add.roots_of(outcomes)
@@ -203,7 +221,7 @@ async function add(request: AddRequest, live: LiveRun, ports: AddPorts): Promise
 	if (additions.length === 0) return report(outcomes, request.is_priority)
 
 	await announce(
-		additions.map((addition) => addition.issue),
+		additions.map((addition) => addition.issue).filter((issue) => !repairs.has(issue)),
 		roots,
 		request.is_retry,
 	)

package/scripts/run/add/run-add.ts

@@ -4,6 +4,7 @@ import {
 	has_label_name,
 	IN_PROGRESS_LABEL,
 	NEEDS_DECISION_LABEL,
+	NEEDS_HUMAN_MERGE_LABEL,
 	NEEDS_HUMAN_REVIEW_LABEL,
 	PRIORITY_HIGH_LABEL,
 	RUN_LANE_LABEL,
@@ -44,6 +45,8 @@ interface AddContext {
 	settled?: ReadonlySet<number>
 	// What the run already tracks, so an epic root is never recorded twice (`run_add_epic.tracked_of`).
 	tracked?: ReadonlySet<number>
+	// The issues whose repair attempt this call recorded (`run_repair_attempt.prepare`).
+	repairs?: ReadonlySet<number>
 }
 
 const DEFAULT_CONTEXT: AddContext = { is_retry: false, done: [], active: new Set() }
@@ -73,20 +76,34 @@ function labels_for(
 		: opted_in
 }
 
-// The first label that would not apply, or `undefined` once every one landed. Sequential, so a
+// The first label whose write failed, or `undefined` once every one landed. Sequential, so a
 // refused write stops the rest rather than leaving a half-labelled issue the pool reads differently.
-async function first_unapplied(
+async function first_failed(
 	issue: number,
 	labels: ReadonlyArray<string>,
-	ports: AddPorts,
+	write: AddPorts['apply_label'],
 ): Promise<string | undefined> {
 	const [label, ...rest] = labels
 
 	if (label === undefined) return undefined
 
-	if (!(await ports.apply_label(issue, label))) return label
+	if (!(await write(issue, label))) return label
+
+	return await first_failed(issue, rest, write)
+}
 
-	return await first_unapplied(issue, rest, ports)
+// The stops a retry clears: `run:stalled` always, and `needs-human-merge` only for an issue whose
+// repair attempt was recorded — a merge wait with no repair stays a person's (joshuafolkken/kit#7487).
+// The ship re-parks it while the diff still needs a person's merge (`followup-human-merge.ts`).
+// A recorded repair also clears the ended lane's `in-progress`, which the offer otherwise reads as
+// another session's work (joshuafolkken/kit#7493): the record is made only once no process holds
+// the issue and its lane tree is clean (`run-repair-attempt.ts`).
+function stops_of(issue: number, context: AddContext): ReadonlyArray<string> {
+	if (!context.is_retry) return []
+
+	return context.repairs?.has(issue) === true
+		? [RUN_STALLED_LABEL, NEEDS_HUMAN_MERGE_LABEL, IN_PROGRESS_LABEL]
+		: [RUN_STALLED_LABEL]
 }
 
 function retry_required(
@@ -131,13 +148,13 @@ async function label_one(
 	ports: AddPorts,
 	context: AddContext,
 ): Promise<AddOutcome> {
-	const label = await first_unapplied(issue, labels, ports)
+	const label = await first_failed(issue, labels, ports.apply_label)
 
 	if (label !== undefined) return { kind: 'unlabeled', issue, label }
 
-	if (context.is_retry && !(await ports.clear_label(issue, RUN_STALLED_LABEL))) {
-		return { kind: 'refused', issue, reason: 'could not clear run:stalled' }
-	}
+	const stop = await first_failed(issue, stops_of(issue, context), ports.clear_label)
+
+	if (stop !== undefined) return { kind: 'refused', issue, reason: `could not clear ${stop}` }
 
 	return { kind: 'queued', issue, blockers: [] }
 }

package/scripts/run/board/run-board-layout.ts

@@ -13,9 +13,9 @@ import { run_board_decision } from './run-board-decision'
 import { run_board_earlier, type EarlierLanes } from './run-board-earlier'
 import { run_board_ending_reason } from './run-board-ending-reason'
 import { run_board_human } from './run-board-human'
-import { run_board_human_merge } from './run-board-human-merge'
 import { run_board_kind, type BoardPriority } from './run-board-kind'
 import type { PauseRead } from './run-board-pause'
+import { run_board_retry_wait } from './run-board-retry-wait'
 import { run_board_standing_waits } from './run-board-standing-waits'
 import type { ItemState, ItemStatus } from './run-board-status'
 
@@ -327,7 +327,7 @@ function layout_of(
 	reason_of?: ReasonOf,
 	earlier: EarlierLanes = run_board_earlier.NO_EARLIER,
 ): BoardLayout {
-	const current = run_board_human_merge.overlay_of(input_plan, input_statuses)
+	const current = run_board_retry_wait.overlay_of(input_plan, input_statuses)
 	const { plan, statuses } = current
 	const overlay = { plan, statuses, reason_of }
 	const queue = plan.waves.waves.flat().filter((child) => is_untouched(child, overlay))

package/scripts/run/board/run-board-reason.ts

@@ -5,6 +5,7 @@ import { epic_solo, type Labelled, type SoloQueue } from '#scripts/epic/epic-sol
 import { epic_triage } from '#scripts/epic/epic-triage'
 import { has_label_name, has_parked_label, IN_PROGRESS_LABEL } from '#scripts/issue/issue-labels'
 import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_observation_gate } from '#scripts/issue/issue-observation-gate'
 import { issue_sample_gate } from '#scripts/issue/issue-sample-gate'
 import { lane_state } from '#scripts/lane/lane-state'
 import type { RunCarry } from '#scripts/run/carry/run-carry'
@@ -266,6 +267,17 @@ function offer_wait(child: EpicChild, read: ReasonRead, pool: Pool): RowReason |
 // waits on; `📅 4313` while that pull request has not merged or its merge is unread — the cited issue
 // for a condition waiting on the pull request that closes it.
 function sample_wait_of(child: EpicChild): RowReason | undefined {
+	const observation = issue_observation_gate.wait_of(child.body)
+
+	if (observation !== undefined) {
+		return {
+			icon: WAIT_ICONS.not_before,
+			value: 'evidence',
+			tail: observation.reason,
+			evidence_url: observation.url,
+		}
+	}
+
 	const wait = issue_sample_gate.wait_of(child.body)
 
 	if (wait === undefined) return undefined

package/scripts/run/board/run-board-retry-wait.ts

@@ -0,0 +1,35 @@
+import { run_board_human_merge } from './run-board-human-merge'
+import type { BoardPlan } from './run-board-layout'
+import type { ItemStatus } from './run-board-status'
+
+type Statuses = ReadonlyMap<number, ItemStatus>
+
+// A `run:add --retry` settles an issue as waiting before it ever launched (`run-board-status.ts`). The
+// plan, classified as `backlog:next` classifies it, is what says whether it starts next or waits: one the
+// plan leaves unreached waits on something, so its status is dropped and it draws as the plan row it
+// is — in the waiting section with its reason — rather than as an empty ⏳ lane (joshuafolkken/kit#7488).
+function is_retry_wait(status: ItemStatus): boolean {
+	return status.state === 'waiting' && status.started_ms === undefined
+}
+
+function released(unreached: ReadonlyArray<{ number: number }>, statuses: Statuses): Statuses {
+	const waits = new Set(unreached.map((child) => child.number))
+
+	return new Map(
+		[...statuses].filter(([issue, status]) => !(waits.has(issue) && is_retry_wait(status))),
+	)
+}
+
+// The human-merge overlay, then the retry waits the plan leaves unreached released to their plan rows.
+function overlay_of(
+	plan: BoardPlan,
+	statuses: Statuses,
+): ReturnType<typeof run_board_human_merge.overlay_of> {
+	const current = run_board_human_merge.overlay_of(plan, statuses)
+
+	return { ...current, statuses: released(current.plan.waves.unreached, current.statuses) }
+}
+
+const run_board_retry_wait = { overlay_of }
+
+export { run_board_retry_wait }

package/scripts/run/board/run-board-seat.ts

@@ -16,6 +16,8 @@ const { STAGE } = run_event_setup
 const { WAIT_ICONS } = run_board_labels
 const NO_CANDIDATE = 'no issue ready to start'
 const HELD = 'held'
+// A runnable row waits only for the driver a session restarts, not for a person (joshuafolkken/kit#7510).
+const RESTART_PENDING = 'driver restart pending'
 // The row waits that a free seat itself, or the driver's hold, answers — the row could run in the seat.
 const ROOM_ICONS: ReadonlySet<string> = new Set([
 	WAIT_ICONS.lane,
@@ -77,6 +79,11 @@ function with_hold(lead: string, hold: string | undefined): string {
 	return hold === undefined ? lead : `${lead} — ${backlog_hold_text.text_of(hold)}`
 }
 
+// What keeps a runnable row out: the driver's absence a session restart ends, or a hold.
+function held_lead(hold: string): string {
+	return backlog_hold_text.is_driver_restart(hold) ? RESTART_PENDING : HELD
+}
+
 // What a seat no refusal explains says: no runnable row, or the hold that keeps a runnable one out —
 // the hold as a sentence, never its ledger code (`backlog-hold-text.ts`).
 function idle_reason(room: SeatRoom): string | undefined {
@@ -84,7 +91,7 @@ function idle_reason(room: SeatRoom): string | undefined {
 
 	if (!has_candidate(room.layout)) return with_hold(NO_CANDIDATE, hold)
 
-	return hold === undefined ? undefined : with_hold(HELD, hold)
+	return hold === undefined ? undefined : with_hold(held_lead(hold), hold)
 }
 
 // No seat line where the seats are unread — before the plan is read, or once the run stopped.
@@ -101,7 +108,7 @@ function reasons_of(room: SeatRoom): Array<string> {
 	return reasons.filter((reason) => reason !== undefined)
 }
 
-const run_board_seat = { NO_CANDIDATE, read_of, reasons_of }
+const run_board_seat = { NO_CANDIDATE, RESTART_PENDING, read_of, reasons_of }
 
 export { run_board_seat }
 export type { SeatRead, SeatRoom }

package/scripts/run/board/run-board-setup.ts

@@ -50,11 +50,13 @@ function has_launched(events: ReadonlyArray<RunEvent>): boolean {
 	return events.some((event) => event.kind === KIND.CHILD_LAUNCH)
 }
 
-// The start is over at the first launch, or at a drain that came before one: a run whose backlog
-// emptied with nothing launched is watching, and the hand-off each wake of that watch writes is not a
-// run getting ready.
+// An idle decision ends preparation before the drain's maintenance finishes.
+function is_idle_decision(event: RunEvent): boolean {
+	return event.kind === KIND.DRAIN || (is_setup(event) && event.text === STAGE.WATCHING)
+}
+
 function has_started(events: ReadonlyArray<RunEvent>): boolean {
-	return has_launched(events) || events.some((event) => event.kind === KIND.DRAIN)
+	return has_launched(events) || events.some((event) => is_idle_decision(event))
 }
 
 // A lane is opening while the stage naming its issue is newer than the run's newest position: the

package/scripts/run/carry/run-carry-reclaim.ts

@@ -1,5 +1,5 @@
 import { stamp_file } from '#scripts/josh/stamp-file'
-import { run_carry, type CarryOwner } from './run-carry'
+import { run_carry, type CarryOwner, type RunCarry } from './run-carry'
 import { run_carry_conversation } from './run-carry-conversation'
 
 // **A resumed conversation has to take its record back before it falls quiet**.
@@ -12,12 +12,22 @@ import { run_carry_conversation } from './run-carry-conversation'
 
 // Writes the record back under the caller's process when the caller is the record's own conversation
 // in a new one; answers whether it did.
+function reclaimed_owner(carry: RunCarry, owner: CarryOwner): RunCarry {
+	if (owner.session === undefined || owner.session !== carry.owner_session) {
+		return run_carry_conversation.reclaim_owner(carry, owner)
+	}
+
+	if (owner.pid === undefined || carry.is_handed_off === true) return carry
+
+	return { ...carry, owner_pid: owner.pid, owner_start: owner.start }
+}
+
 function reclaim_at(target: string, owner: CarryOwner): boolean {
 	const read = run_carry.read_carry(target)
 
 	if (read.kind !== 'carried') return false
 
-	const reclaimed = run_carry_conversation.reclaim_owner(read.carry, owner)
+	const reclaimed = reclaimed_owner(read.carry, owner)
 
 	if (reclaimed === read.carry) return false
 

package/scripts/run/carry/run-carry-session.ts

@@ -0,0 +1,48 @@
+// A launch identity survives Codex's shell environment filtering without guessing its session PID.
+import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { run_headless_keys } from '#scripts/run/run-headless-keys'
+import type { CarryOwner, RunCarry } from './run-carry'
+import { run_carry_conversation } from './run-carry-conversation'
+
+const KEY = 'JOSH_CARRY_SESSION'
+
+function own(): string | undefined {
+	if (
+		lane_child_marker.marked_issue(process.env) !== undefined ||
+		process.env[run_headless_keys.BESIDE_CHILD_KEY] === '1' ||
+		process.env[run_headless_keys.HANDOFF_CHILD_KEY] === '1'
+	) {
+		return undefined
+	}
+
+	return process.env[KEY]
+}
+
+function is_owned_by(carry: RunCarry, owner: CarryOwner): boolean {
+	if (carry.owner_session !== undefined) return carry.owner_session === owner.session
+	if (run_carry_conversation.is_same_conversation(carry, owner)) return true
+
+	return carry.owner_pid === owner.pid && carry.owner_start === owner.start
+}
+
+function retain_execution(carry: RunCarry, owner: CarryOwner): CarryOwner {
+	if (
+		owner.session === undefined ||
+		owner.session !== carry.owner_session ||
+		owner.pid !== undefined
+	) {
+		return owner
+	}
+
+	return {
+		...owner,
+		pid: carry.owner_pid,
+		start: carry.owner_start,
+		provider: carry.scheduler_provider,
+		is_headless: carry.is_owner_headless,
+	}
+}
+
+const run_carry_session = { KEY, own, is_owned_by, retain_execution }
+
+export { run_carry_session }

package/scripts/run/carry/run-carry.ts

@@ -10,6 +10,7 @@ import { z } from 'zod'
 import { run_carry_added, type CarryAddition } from './run-carry-added'
 import { run_carry_change } from './run-carry-change'
 import { run_carry_conversation } from './run-carry-conversation'
+import { run_carry_session } from './run-carry-session'
 
 // A `backlogrun` declares a budget — `--max` and `--idle` — and the session
 // cut ends the session, so the next one would start from nothing. **The cut is an execution detail of
@@ -99,6 +100,7 @@ interface RunCarry {
 	// `undefined`, so absent and explicitly-undefined are the *same* record on disk — a type that told
 	// them apart would be asserting a distinction nothing here can observe.
 	owner_pid?: number | undefined
+	owner_session?: string | undefined
 	owner_start?: string | undefined
 	// The owner conversation's transcript, which outlives a restart of its process
 	// (`run-carry-conversation.ts`). Optional for the same reason as the pid.
@@ -142,6 +144,7 @@ interface RunCarry {
 // token, so a reissued pid is never mistaken for the process that wrote the record — and the
 // transcript of the conversation that process runs, which outlives it (`run-carry-conversation.ts`).
 interface CarryOwner {
+	session?: string | undefined
 	provider?: AgentProvider | undefined
 	pid?: number | undefined
 	start?: string | undefined
@@ -207,6 +210,7 @@ const run_carry_schema = z.object({
 	// An absent owner reads as "no owner declared", which is the not-provably-live answer rather than a
 	// live one.
 	owner_pid: z.number().optional(),
+	owner_session: z.string().optional(),
 	owner_start: z.string().optional(),
 	owner_transcript: z.string().optional(),
 	is_owner_headless: z.boolean().optional(),
@@ -269,8 +273,10 @@ function owner_of(
 // none exported, no owner is declared.
 function session_owner(): CarryOwner {
 	const pid = agent_session_environment.own_session_pid()
+	const owner = pid === undefined ? NO_OWNER : owner_of(pid)
+	const session = run_carry_session.own()
 
-	return pid === undefined ? NO_OWNER : owner_of(pid)
+	return session === undefined ? owner : { ...owner, session }
 }
 
 function fresh_carry(invocation: string, owner: CarryOwner, now: Date): RunCarry {
@@ -284,6 +290,7 @@ function fresh_carry(invocation: string, owner: CarryOwner, now: Date): RunCarry
 		failures: NO_INCREMENT,
 		outages: NO_INCREMENT,
 		owner_pid: owner.pid,
+		owner_session: owner.session,
 		owner_start: owner.start,
 		owner_transcript: owner.transcript,
 		is_owner_headless: owner.is_headless,
@@ -318,17 +325,19 @@ function adopt_carry(
 	carry: RunCarry,
 	owner: CarryOwner = NO_OWNER,
 ): RunCarry | undefined {
+	const next_owner = run_carry_session.retain_execution(carry, owner)
 	// The run's own fields carry across untouched — the counters, the outage fold timestamp, `done` so the successor does not re-run what the cut session finished,
 	// and `retrospective` so a run resumed after a cut does not repeat its retrospective. Only the
 	// ownership fields are overridden: the new owner replaces the old — a caller that declared none
 	// writes `undefined`, so the previous owner cannot survive — and the declared hand-off is spent.
 	const next: RunCarry = {
 		...carry,
-		scheduler_provider: owner.provider,
-		owner_pid: owner.pid,
-		owner_start: owner.start,
+		scheduler_provider: next_owner.provider,
+		owner_pid: next_owner.pid,
+		owner_session: owner.session,
+		owner_start: next_owner.start,
 		owner_transcript: owner.transcript,
-		is_owner_headless: owner.is_headless,
+		is_owner_headless: next_owner.is_headless,
 		is_handed_off: false,
 	}
 
@@ -352,11 +361,7 @@ function is_owner_live(
 	return carry.is_owner_headless !== true && run_carry_conversation.is_conversation_live(carry, now)
 }
 
-function is_owned_by(carry: RunCarry, owner: CarryOwner): boolean {
-	if (run_carry_conversation.is_same_conversation(carry, owner)) return true
-
-	return carry.owner_pid === owner.pid && carry.owner_start === owner.start
-}
+const { is_owned_by } = run_carry_session
 
 // The one case that is not this caller's to touch: the record's owner is still running and it is
 // somebody else. **The invocation text is not consulted** — a live owner holds the budget whatever
@@ -370,14 +375,15 @@ function is_foreign_live_owner(carry: RunCarry, owner: CarryOwner): boolean {
 // conversation match would read that live session's record as the supervisor's own. The driver adopts
 // the record for the supervisor's process (`run-wake-driver.ts` → `claim_record`), so without this a
 // supervisor reads itself as a session at work.
+function is_held_by_self(carry: RunCarry, caller: CarryOwner = owner_of(process.pid)): boolean {
+	return carry.owner_pid === caller.pid && carry.owner_start === caller.start
+}
+
 function is_held_by_another(
 	carry: RunCarry,
 	is_live: (carry: RunCarry) => boolean = is_owner_live,
 ): boolean {
-	const caller = owner_of(process.pid)
-	const is_own = carry.owner_pid === caller.pid && carry.owner_start === caller.start
-
-	return !is_own && is_live(carry)
+	return !is_held_by_self(carry) && is_live(carry)
 }
 
 function is_handed_off_to(carry: RunCarry, invocation: string): boolean {
@@ -552,6 +558,7 @@ const run_carry = {
 	is_count_refused,
 	is_foreign_live_owner,
 	is_held_by_another,
+	is_held_by_self,
 	is_owner_live,
 	lost_message,
 	nothing_to_resume_message,

package/scripts/run/cut/run-cut-resume.ts

@@ -3,6 +3,7 @@ import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
 import { issue_cite } from '#scripts/issue/issue-cite'
 import { run_event_stream } from '#scripts/run/event/run-event-stream'
 import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
+import { run_repair_attempt } from '#scripts/run/run-repair-attempt'
 import { run_cut, type RunCut } from './run-cut'
 import { run_cut_report } from './run-cut-report'
 import { run_cut_review } from './run-cut-review'
@@ -110,6 +111,19 @@ async function verify_and_adopt(
 	return await adopt(target, cut_record)
 }
 
+async function resume_carried(
+	target: string,
+	cut: RunCut,
+	issue: string,
+	is_expired: boolean,
+): Promise<number> {
+	if (await run_repair_attempt.prepare(issue, target)) {
+		return report(FRESH_VERDICT, SUCCESS_EXIT_CODE)
+	}
+
+	return is_expired ? report_stale(cut) : await verify_and_adopt(target, cut, issue)
+}
+
 async function resume(target: string, issue: string): Promise<number> {
 	const read = run_cut.read_cut(target)
 
@@ -117,9 +131,7 @@ async function resume(target: string, issue: string): Promise<number> {
 
 	if (read.kind === 'unreadable') return report_unreadable()
 
-	if (read.kind === 'expired') return report_stale(read.cut)
-
-	return await verify_and_adopt(target, read.cut, issue)
+	return await resume_carried(target, read.cut, issue, read.kind === 'expired')
 }
 
 const run_cut_resume = {

package/scripts/run/cut/run-cut.ts

@@ -450,7 +450,7 @@ function busy_message(cut: RunCut): string {
 // A successor already resumed this cut, so a process that reaches `--resume` after its own hand-off is
 // told to stop quietly rather than to investigate a tree that is not wrong.
 function handed_off_message(cut: RunCut): string {
-	return `This cut was already handed off to a successor — ${describe_cut(cut)}. Nothing was resumed here; the run is being carried on by the process that adopted it, so this one has nothing to do.`
+	return `This cut was already adopted — ${describe_cut(cut)}. Nothing was resumed here; the record alone does not establish whether its owner is still running. After a trusted repair request on an open PR and confirmed owner exit, use \`pnpm josh run:add ${cut.issue} --retry\` in a live backlogrun, or \`pnpm josh run:entry ${cut.issue}\` in its lane. Active or unreadable owners remain protected.`
 }
 
 // The record does not match the tree the fresh process is in — wrong branch, a clean tree, an expired

package/scripts/run/detached-launch.ts

@@ -3,6 +3,7 @@ import { closeSync, constants, openSync, writeSync } from 'node:fs'
 import { agent_launch_environment } from '#scripts/agent/agent-launch-environment'
 import { agent_profile_schema, type AgentProfile } from '#scripts/agent/agent-profile-schema'
 import { agent_safe_text } from '#scripts/agent/agent-safe-text'
+import { codex_launch_identity } from '#scripts/agent/codex-launch-identity'
 import { agent_session_environment } from '#scripts/josh/agent-session-environment'
 import { stamp_file } from '#scripts/josh/stamp-file'
 import { launch_priority } from '#scripts/run/launch-priority'
@@ -25,9 +26,8 @@ const NO_PID_NOTE = 'the process started without a pid'
 const UNSAFE_NOTE =
 	'the wake command or its arguments are empty, over length, or contain characters that are not safe to execute'
 
-// Provider-specific commands and flags are composed before this boundary. This module accepts only
-// an argv vector and never infers policy from it; role/model/effort arrive separately as log metadata.
-// The provider adapter keeps the fixed binary and permission flags in one reviewed place.
+// Provider adapters own commands and flags. At this boundary the Codex adapter binds the launcher's
+// explicit lane identity to shell configuration before the final argv safety check.
 // **The inputs that reach `spawn` are validated rather than trusted, and that is a control rather than
 // a formality.** Two things already bound this — the argument vector never goes through a shell, so
 // there is no shell to inject into, and the invocation travels as exactly one argv element rather than
@@ -319,7 +319,15 @@ function spawned(
 // execs before it returns, so the child already holds its own duplicate of the descriptor by then;
 // what is closed here is this process's copy. Left open it would outlive the launch in a supervisor
 // that runs for hours and launches once per cut.
-function launch(request: LaunchRequest, on_error: (note: string) => void): LaunchResult {
+function prepared_request(request: LaunchRequest): LaunchRequest {
+	return {
+		...request,
+		argv: { ...request.argv, args: codex_launch_identity.arguments_for(request) },
+	}
+}
+
+function launch(input: LaunchRequest, on_error: (note: string) => void): LaunchResult {
+	const request = prepared_request(input)
 	if (!is_safe_argv(request.argv)) return { kind: 'failed', note: UNSAFE_NOTE }
 
 	const log = open_log(request.log_path, on_error)
@@ -336,10 +344,11 @@ function launch(request: LaunchRequest, on_error: (note: string) => void): Launc
 }
 
 async function launch_attached(
-	request: LaunchRequest,
+	input: LaunchRequest,
 	on_error: (note: string) => void,
 	on_spawn: (pid: number) => void = ignore_spawn,
 ): Promise<AttachedLaunchResult> {
+	const request = prepared_request(input)
 	if (!is_safe_argv(request.argv)) return { kind: 'failed', note: UNSAFE_NOTE }
 	const log = open_log(request.log_path, on_error)
 

package/scripts/run/early-push-record.ts

@@ -2,15 +2,19 @@ import { git_branch } from '#scripts/git/git-branch'
 import { git_command } from '#scripts/git/git-command'
 import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
 
-// Measurement is best-effort, including the branch read outside a repository.
-async function record(source: 'review' | 'ship', result: string): Promise<void> {
+// Measurement is best-effort, including the branch read outside a repository. `slots` is the review
+// round's slot count, where the caller knows it.
+async function record(source: 'review' | 'ship', result: string, slots?: number): Promise<void> {
 	try {
 		const issue = git_branch.issue_from_branch(await git_command.branch())
+		const head = await git_command.head_commit()
 
 		await lane_ledger_write.record_early_push({
 			source,
 			result,
+			head,
 			...(issue !== undefined && { issue }),
+			...(slots !== undefined && { slots }),
 		})
 	} catch {
 		// A missing measurement never blocks a push.

package/scripts/run/event/run-event-setup.ts

@@ -17,6 +17,8 @@ const STAGE = {
 	PLANNING: 'planning',
 	// The supervisor took the run over from the parent and is asking for the first offer.
 	HANDING_OFF: 'handing off',
+	// No child is runnable; maintenance may still be finishing before the replaceable drain.
+	WATCHING: 'watching',
 	// The driver answered something only a session can act on — an untriaged child, an epic left to a
 	// person — and the supervisor is waking one. The next hand-off replaces it.
 	JUDGING: 'waiting on judgment',