@joshuafolkken/kit 1.3044.0 → 1.3099.0

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.3044.0",
+  "version": "1.3099.0",
   "name": "@joshuafolkken/kit",
   "description": "Hand-off kit for Claude Code and Codex: backlogrun takes your GitHub Issues to tested, reviewed, merged PRs — in parallel and unattended — with the rules, hooks and checks that keep the agent on track",
   "keywords": [
@@ -66,6 +66,9 @@
     "tsconfig.sonar.json",
     "playwright.config.ts",
     "!**/*.test.ts",
+    "scripts/gate/change-scope-action.integration.test.ts",
+    "scripts/gate/path-glob.test.ts",
+    "scripts/gate/toolchain-inputs.consumer.test.ts",
     "!**/*.spec.ts",
     "!**/*-fixture*.ts",
     "!**/__snapshots__",

package/prompts/collaboration-workflow/principles.md

@@ -66,6 +66,9 @@ docs・prompts・skills・拒否文・Issue・PR の文章に適用する。
 ユーザーへの回答に適用する。
 
 - 順序: 結論（1〜2 文）→ 表か箇条書き 1 つ → 次の一手
+- 質問への回答は事実だけで終えず、ユーザーの次の行動を必ず添える。推奨は一つに絞り、必要ならそのまま使えるコマンドや依頼文を示す
+- 待つのが妥当なら「操作不要」と待つ条件・再確認する条件を示す。未確認事項には確認方法を添え、「断定できません」だけで終えない
+- 既に権限がある作業は自律実行し、結果と残る次の一手を示す。不要な再確認やユーザーへの作業の押し戻しを増やさず、実装の引き渡しは本書の「consult-vs-execute」に従う
 - 散文（コードブロック・表・箇条書きの外）の上限は `scripts/rules/concise-reply.ts` の `PROSE_LIMIT`。超えた回答は Stop フックの `pnpm josh stop:guard` が書き直させる
 - 仕組みの説明や同じ内容の言い換えを並べない。詳細はファイルや Issue に書く
 - 対象外: 直前の発話に「詳しく」「具体的に」「詳細」がある回答、`pnpm josh run:board --chat` のような固定出力をコードブロックで返す回答、ファイルや Issue に書く成果物
@@ -77,7 +80,7 @@ docs・prompts・skills・拒否文・Issue・PR の文章に適用する。
 - **相談の主セッションは相談・起票・運用を担当する。実装は実装レーンが担当し、主セッション自身で実装を開始しない。** 「起票して」は起票を実行し、「対応してください」は合意した起票・Issue 更新・レーン操作として処理する。実装が必要なら Issue に範囲と計画を残し、既存の実装レーンへ引き渡す
 - 明示されたワークフローキーワード（`kickoff` / `halfrun` / `prrun` / `fullrun` / `backlogrun`）は `workflow-commands` skill の既存手順へ渡す。主セッションが実装する根拠には読み替えない。`kickoff` は起票・計画で停止し、実装系の実行は実装レーンへ引き渡す
 - 判別できないときは相談として扱う。承認済みの起票・Issue 更新・レーン操作と、実装レーン内の Tier A 判断は再確認せず進める。実行が指示された後の判断点は `CLAUDE.md` → "Decision autonomy" の Tier で決まる
-- 相談スコープのシェルは、取り消せない操作（git・GitHub・依存・共有状態への書き込み）と runtime ファイルへの見える書き込みだけを実行前に拒否し、それ以外の呼び出しが変えた runtime ファイルは実行後に戻す（`scripts/hooks/bash-revert.ts`）。拒否は `scripts/hooks/implementation-shell.ts` が強制する
+- 相談スコープのシェルは、取り消せない操作（git・GitHub・依存・共有状態への書き込み）と runtime ファイルへの見える書き込みだけを実行前に拒否し、それ以外の呼び出しが変えた runtime ファイルは、コマンドがそのパスを名指すときだけ実行後に戻し、名指さないものは別セッションの編集かもしれないので名前だけ報告する（`scripts/hooks/bash-revert.ts`）。拒否は `scripts/hooks/implementation-shell.ts` が強制する
 
 ## latest-first — 最新優先・fix-forward（pin-back は最終手段）
 

package/prompts/collaboration-workflow/rule-delivery.md

@@ -12,7 +12,7 @@
 
 **引き金はシェルのコマンド文字列しか見えない**ので、node 内の REST のように引き金が掛からない経路を持つ規則は、常駐側にトリガ 1 行を残す。各項目の発火しない状態は「規則が守られている状態」と一致させ、一致が取れない規則は常駐に残す。
 
-- 相談スコープのシェルが拒否される → `scripts/hooks/implementation-shell.ts`（拒否リストは `implementation-shell-deny.ts`）。それ以外の runtime 書き込みは `scripts/hooks/bash-revert.ts` が戻す。
+- 相談スコープのシェルが拒否される → `scripts/hooks/implementation-shell.ts`（拒否リストは `implementation-shell-deny.ts`）。それ以外の runtime 書き込みは、コマンドが名指すものを `scripts/hooks/bash-revert.ts` が戻す。
 
 ## stop-notify — 途中停止の通知（`confirmation`）
 

package/scripts/agent/codex-launch-identity.ts

@@ -0,0 +1,70 @@
+import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { lane_paths } from '#scripts/lane/lane-paths'
+import { run_carry_session } from '#scripts/run/carry/run-carry-session'
+import type { LaunchRequest } from '#scripts/run/detached-launch'
+import { run_headless_keys } from '#scripts/run/run-headless-keys'
+import { agent_profile_schema } from './agent-profile-schema'
+
+const CONFIG_FLAG = '-c'
+const SHELL_SET = 'shell_environment_policy.set.'
+
+function identity_environment(request: LaunchRequest): Record<string, string | undefined> {
+	return {
+		[lane_paths.LANE_ROOT_KEY]: process.env[lane_paths.LANE_ROOT_KEY],
+		...request.env,
+	}
+}
+
+function identity_arguments(request: LaunchRequest): ReadonlyArray<string> {
+	const source = identity_environment(request)
+	if (!lane_child_marker.is_child_of(request.cwd, source)) return []
+
+	return [lane_child_marker.KEY, lane_paths.LANE_ROOT_KEY].flatMap((key) =>
+		source[key] === undefined
+			? []
+			: [CONFIG_FLAG, `${SHELL_SET}${key}=${JSON.stringify(source[key])}`],
+	)
+}
+
+function is_codex_worker(request: LaunchRequest): boolean {
+	const { argv, profile } = request
+
+	return (
+		profile?.provider === 'openai' &&
+		profile.role === agent_profile_schema.WORKER &&
+		argv.command === 'codex' &&
+		argv.ends_with_prompt === true
+	)
+}
+
+function scheduler_arguments(request: LaunchRequest): ReadonlyArray<string> {
+	if (request.profile?.role !== agent_profile_schema.SCHEDULER) return []
+	const keys = [run_carry_session.KEY, ...run_headless_keys.MARK_KEYS]
+
+	return keys.flatMap((key) =>
+		request.env?.[key] === undefined
+			? []
+			: [CONFIG_FLAG, `${SHELL_SET}${key}=${JSON.stringify(request.env[key])}`],
+	)
+}
+
+// Only the launcher's explicit mark grants identity; a checkout path or inherited mark cannot.
+function is_codex(request: LaunchRequest): boolean {
+	return request.profile?.provider === 'openai' && request.argv.command === 'codex'
+}
+
+function arguments_for(request: LaunchRequest): ReadonlyArray<string> {
+	const { argv } = request
+
+	if (!is_codex(request) || argv.ends_with_prompt !== true) return argv.args
+
+	const identity = is_codex_worker(request)
+		? identity_arguments(request)
+		: scheduler_arguments(request)
+
+	return [...argv.args.slice(0, -1), ...identity, ...argv.args.slice(-1)]
+}
+
+const codex_launch_identity = { arguments_for }
+
+export { codex_launch_identity }

package/scripts/auto-ok/auto-ok-cli.ts

@@ -10,6 +10,7 @@ import { read_json_listing } from '#scripts/git/parse-json-array'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
 import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_publication_state } from '#scripts/issue/issue-publication-state'
 import { issue_sample_prime } from '#scripts/issue/issue-sample-prime'
 import { session_cite } from '#scripts/issue/session-cite'
 
@@ -344,6 +345,7 @@ interface RunnableOptions {
 
 function is_ready(issue: OpenIssueData, options: RunnableOptions): boolean {
 	return (
+		!issue_publication_state.is_pending(issue.body) &&
 		auto_ok_author.is_author_trusted(issue) &&
 		is_unblocked(issue) &&
 		issue_not_before.is_due(issue.body, options.now ?? Date.now())

package/scripts/auto-ok/auto-ok-judge-write.ts

@@ -3,6 +3,7 @@ import { issue_label_schema } from '#scripts/git/git-schemas'
 import { parse_json_object_or_undefined } from '#scripts/git/parse-json-array'
 import { issue_auto_ok, type AutoOkDecision } from '#scripts/issue/issue-auto-ok'
 import { AUTO_OK_LABEL, has_label_name } from '#scripts/issue/issue-labels'
+import { issue_publication_state } from '#scripts/issue/issue-publication-state'
 import { issue_run_verdict, type RunLabelFlags } from '#scripts/issue/issue-run-verdict'
 import { session_cite } from '#scripts/issue/session-cite'
 import { z } from 'zod'
@@ -116,6 +117,7 @@ async function apply(
 	const read = await read_issue(issue)
 
 	if (read === undefined) return refused(issue, UNREADABLE)
+	if (issue_publication_state.is_pending(read.body)) return refused(issue, 'publication is pending')
 
 	const settled = settled_of(read)
 

package/scripts/auto-ok/auto-ok-judge.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto'
 import { issue_auto_ok, type AutoOkDecision } from '#scripts/issue/issue-auto-ok'
 import { AUTO_OK_LABEL, has_label_name } from '#scripts/issue/issue-labels'
+import { issue_publication_state } from '#scripts/issue/issue-publication-state'
 import type { WatchComment } from '#scripts/issue/issue-watch-diff'
 
 // The pure half of `josh auto-ok:judge`: which open issues `backlogrun` judges for `auto-ok` when a lane
@@ -36,7 +37,8 @@ const CRLF = '\r\n'
 const LF = '\n'
 
 function is_candidate(issue: JudgeIssue): boolean {
-	if (!issue.is_trusted || has_label_name(issue.labels, AUTO_OK_LABEL)) return false
+	const is_excluded = issue_publication_state.is_pending(issue.body) || !issue.is_trusted
+	if (is_excluded || has_label_name(issue.labels, AUTO_OK_LABEL)) return false
 
 	return issue_auto_ok.exclusion_of(issue.labels) === undefined
 }

package/scripts/backlog/backlog-arrival.ts

@@ -25,7 +25,7 @@ import { backlog_stalled_detect } from './backlog-stalled-detect'
 //
 // **The `auto-ok` listing gates the read** (joshuafolkken/kit#7229): each probe first asks the listing
 // check `backlog:drive` asks (`backlog_drive_listing.watcher`), whose 304 spends no REST core, and reads
-// the backlog only once the listing holds a new issue — so the probe shares that check's ten-second
+// the backlog only once the listing holds a new or relabelled issue — so the probe shares that check's ten-second
 // interval. A raised lane limit changes no listing, so it reads regardless, and a listing change whose
 // reading failed is read again at the next probe.
 //

package/scripts/backlog/backlog-budget.ts

@@ -35,7 +35,9 @@ const DEFAULT_IDLE_MS = DEFAULT_IDLE_MINUTES * MS_PER_MINUTE
 // once, without waiting it out. `backlogrun-progress.md` → "Waiting, and never waiting forever" holds
 // the row; the figure is here because `idle_watch_reason` below has to say it. Three minutes keeps the
 // asks within the REST core budget while lanes run (joshuafolkken/kit#6718); the wake supervisor's
-// pause is its own (`run-wake-window.ts`).
+// pause is its own (`run-wake-window.ts`). **It is no dispatch path, so the dispatch bound does not
+// shorten it** (joshuafolkken/kit#7507): with no seat free nothing can start before a child is
+// collected, which asks at once, and with one free the listing check below holds the bound.
 const OFFER_INTERVAL_SECONDS = 180
 const OFFER_INTERVAL_MS = OFFER_INTERVAL_SECONDS * MS_PER_SECOND
 
@@ -50,7 +52,8 @@ const IDLE_OFFER_INTERVAL_MS = IDLE_OFFER_INTERVAL_SECONDS * MS_PER_SECOND
 // **How often a free seat checks the `auto-ok` listing between two asks** (joshuafolkken/kit#7227).
 // The check reads the listing's first page by its ETag, and a 304 spends no REST core, so the floor is
 // the drive's own poll (`backlog-drive-cli.ts` → `POLL_MS`); a changed listing asks at once, an unchanged one waits out the intervals
-// above.
+// above. It stays within what the dispatch bound leaves to notice a change
+// (`backlog-dispatch-bound.ts` → `NOTICE_MS`).
 const LISTING_CHECK_INTERVAL_SECONDS = 10
 const LISTING_CHECK_INTERVAL_MS = LISTING_CHECK_INTERVAL_SECONDS * MS_PER_SECOND
 

package/scripts/backlog/backlog-defect-priority.ts

@@ -20,7 +20,7 @@ function above_message(measured: DefectRate): string {
 }
 
 function should_defer_mechanisms(measured: DefectRate | undefined): boolean {
-	if (measured === undefined) {
+	if (measured === undefined || measured.is_capped) {
 		console.error(UNMEASURED_MESSAGE)
 
 		return false

package/scripts/backlog/backlog-dispatch-bound.ts

@@ -0,0 +1,17 @@
+import { MS_PER_SECOND } from '#scripts/lib/timeouts'
+
+// **The one bound on how long an issue ready to start waits for its `child-launch`**
+// (joshuafolkken/kit#7507): counted from when it became ready, or from when a seat freed if none was free. The driver's and
+// the supervisor's waits are derived from it rather than given figures of their own, so no interval can
+// outgrow it alone. Kept free of the driver's imports, so the supervisor's window reads it cheaply.
+const DISPATCH_BOUND_SECONDS = 60
+const DISPATCH_BOUND_MS = DISPATCH_BOUND_SECONDS * MS_PER_SECOND
+
+// A fresh driver's start up to its first dispatch, as measured in joshuafolkken/kit#7507, rounded up.
+const DRIVER_START_SECONDS = 25
+const DRIVER_START_MS = DRIVER_START_SECONDS * MS_PER_SECOND
+
+// What is left of the bound to notice a change, where a fresh driver may still have to start after it.
+const NOTICE_MS = DISPATCH_BOUND_MS - DRIVER_START_MS
+
+export const backlog_dispatch_bound = { DISPATCH_BOUND_MS, DRIVER_START_MS, NOTICE_MS }

package/scripts/backlog/backlog-drain-flush.ts

@@ -1,11 +1,26 @@
+import { git_common_directory } from '#scripts/git/git-common-directory'
 import { josh_command } from '#scripts/josh/josh-run'
 import { lane_registry } from '#scripts/lane/lane-registry'
 import { error_text } from '#scripts/lib/error-message'
+import { MS_PER_SECOND } from '#scripts/lib/timeouts'
+import { detached_launch, type LaunchArgv } from '#scripts/run/detached-launch'
+import { backlogrun_launch } from './backlogrun-launch'
 
 const FAILURE_PREFIX = 'observations:flush skipped: '
+const DURATION_PREFIX = 'observations:flush finished in '
 const FLUSH_COMMAND = 'observations:flush'
+// The `backlog:offer` flag that runs `flush` alone — the body `start` launches detached. `as const`
+// keeps the key a literal inside `backlog:offer`'s option table.
+const OPTION = 'drain-flush' as const
+const FLUSH_ARGV: LaunchArgv = { command: 'pnpm', args: ['josh', 'backlog:offer', `--${OPTION}`] }
+
+function report_failure(reason: string): void {
+	console.error(`${FAILURE_PREFIX}${reason.replaceAll(/\s+/gu, ' ')}`)
+}
+
+async function flush(now: () => number = Date.now): Promise<void> {
+	const started_ms = now()
 
-async function flush(): Promise<void> {
 	try {
 		const root = await lane_registry.main_repository_root()
 
@@ -15,8 +30,28 @@ async function flush(): Promise<void> {
 			FLUSH_COMMAND,
 		)
 	} catch (error) {
-		console.error(`${FAILURE_PREFIX}${error_text.message_of(error).replaceAll(/\s+/gu, ' ')}`)
+		report_failure(error_text.message_of(error))
 	}
+
+	console.error(`${DURATION_PREFIX}${String((now() - started_ms) / MS_PER_SECOND)}s`)
+}
+
+function log_path_of(cwd: string): string | undefined {
+	const common = git_common_directory.repository(cwd)
+
+	return common === undefined ? undefined : backlogrun_launch.log_path(common)
+}
+
+// The flush pushes through the full pre-push suite, minutes the driver must keep offering through
+// (joshuafolkken/kit#7505). Detached in its own process group, it also outlives a driver that ends or a
+// run `backlogrun` replaces meanwhile, so the ledger is still published; its lines go to the run's log.
+function start(cwd: string = process.cwd()): void {
+	const launched = detached_launch.launch(
+		{ argv: FLUSH_ARGV, cwd, log_path: log_path_of(cwd) },
+		report_failure,
+	)
+
+	if (launched.kind === 'failed') report_failure(launched.note)
 }
 
-export const backlog_drain_flush = { flush }
+export const backlog_drain_flush = { OPTION, flush, start }

package/scripts/backlog/backlog-drive-cli.ts

@@ -239,7 +239,7 @@ function ports_of(
 	return {
 		...child_ports(seeded, context.owner, tick.is_running),
 		begin_tick: tick.begin_tick,
-		offer: async (state) => await offer_for(state, context),
+		offer: holds.answering(async (state) => await offer_for(state, context)),
 		launch: async (issue) => await backlog_drive_launch.launch(issue, context.owner),
 		...room_ports(),
 		judgement_owed: judgement_reader(),

package/scripts/backlog/backlog-drive-hold.ts

@@ -20,14 +20,19 @@ import { backlog_ready } from './backlog-ready'
 // leaves `lane-hand-back-hold.ts`'s mark beside it; the finished run's is written every time.
 
 const NO_FREE_LANES = 0
-const { OFFER_PREFIX, HAND_BACK_PREFIX, REASON_SEPARATOR } = backlog_hold_codes
+const { DRAINED_REASON, OFFER_PREFIX, HAND_BACK_PREFIX, REASON_SEPARATOR, WATCH_VERDICT } =
+	backlog_hold_codes
 // The verdict that starts nothing more: the run is finishing, so the lanes it frees are no hold.
 const STOP_VERDICT = 'stop'
 // The ends that finished the run: nothing is owed a lane after them.
 const FINISHED_REASONS: ReadonlySet<string> = new Set([STOP_VERDICT, 'watch', 'retrospective'])
+const WINDOW_REASON = 'window'
 
 interface HoldRecorder {
 	hold: DrivePorts['hold']
+	// The offer port, its every answer kept — `undefined` for a failed read — so the end reads the
+	// latest verdict (joshuafolkken/kit#7510).
+	answering: (offer: DrivePorts['offer']) => DrivePorts['offer']
 	end: (end: DriveEnd) => Promise<void>
 }
 
@@ -41,9 +46,11 @@ interface HeldDraft extends HeldWaiting {
 	reason: string | undefined
 }
 
-// Whether a hold may still be open — at a driver's start, one an earlier driver's hand-back left.
+// Whether a hold may still be open — at a driver's start, one an earlier driver's hand-back left — and
+// the latest offer verdict this driver read.
 interface HoldLedger {
 	is_open: boolean
+	last_verdict?: string | undefined
 }
 
 // The reason an offer that started nothing holds a free lane, or `undefined` for the run's stop. The
@@ -81,11 +88,20 @@ async function stopped(
 	if (after.is_stopping && !before.is_stopping) await ports.hold(undefined)
 }
 
+// A window that closed while the latest offer found nothing to start is the backlog's drain, not the
+// window's: the drain wins, so the seat names it (joshuafolkken/kit#7510).
+function end_cause(end: DriveEnd, last_verdict: string | undefined): string {
+	const is_drained = last_verdict === WATCH_VERDICT && end.reason === WINDOW_REASON
+
+	return is_drained ? DRAINED_REASON : end.reason
+}
+
 // The reason a driver's end leaves the lanes waiting on a session, or `undefined` for the finished run.
-function hand_back_reason(end: DriveEnd): string | undefined {
+// `last_verdict` is the latest offer verdict the driver read before it ended.
+function hand_back_reason(end: DriveEnd, last_verdict?: string): string | undefined {
 	if (FINISHED_REASONS.has(end.reason)) return undefined
 
-	return [HAND_BACK_PREFIX, end.reason].join(REASON_SEPARATOR)
+	return [HAND_BACK_PREFIX, end_cause(end, last_verdict)].join(REASON_SEPARATOR)
 }
 
 // The free count, or `undefined` where the lane limit is unreadable: no hold is known then. The
@@ -172,8 +188,15 @@ function recorder(
 
 	return {
 		hold: write,
+		answering: (offer) => async (state) => {
+			const read = await offer(state)
+
+			ledger.last_verdict = read?.verdict
+
+			return read
+		},
 		end: async (end) => {
-			const reason = hand_back_reason(end)
+			const reason = hand_back_reason(end, ledger.last_verdict)
 
 			await hand_back(ledger, reason, await free_count(free_lanes, reason))
 		},

package/scripts/backlog/backlog-drive-launch.ts

@@ -1,6 +1,7 @@
 import { git_stash } from '#scripts/git/stash/git-stash'
 import { lane_launch_cli, type LaunchOutcome } from '#scripts/lane/lane-launch-cli'
 import { run_event_setup } from '#scripts/run/event/run-event-setup'
+import { run_startup } from '#scripts/run/startup/run-startup'
 import { backlog_drive_launch_pass, type DriveLaunch } from './backlog-drive-launch-pass'
 import { backlog_drive_owner } from './backlog-drive-owner'
 import { backlog_drive_split_unit } from './backlog-drive-split-unit'
@@ -79,17 +80,7 @@ async function measured(issue: string): Promise<DriveLaunch | undefined> {
 	return outcome === 'wait' ? UNSAMPLED_LAUNCH : undefined
 }
 
-// An issue over the size bar that its split-only unit split takes no lane either
-// (`backlog-drive-split-unit.ts`). The unit runs for minutes, so ownership is asserted again after it:
-// a driver superseded meanwhile opens no lane.
-async function opened(issue: string, owner: string): Promise<DriveLaunch> {
-	await backlog_drive_owner.assert_current(owner)
-
-	const settled = await measured(issue)
-
-	if (settled !== undefined) return settled
-	if ((await backlog_drive_split_unit.run(issue)) === 'split') return SPLIT_LAUNCH
-	await backlog_drive_owner.assert_current(owner)
+async function launch_and_report(issue: string): Promise<DriveLaunch> {
 	await run_event_setup.emit(run_event_setup.opening_lane(issue))
 
 	const outcome = await launch_ready(issue)
@@ -102,12 +93,43 @@ async function opened(issue: string, owner: string): Promise<DriveLaunch> {
 	return outcome.kind
 }
 
+// Ownership is rechecked after the split-only unit, before any lane opens.
+async function opened(issue: string, owner: string): Promise<DriveLaunch> {
+	await backlog_drive_owner.assert_current(owner)
+	const settled = await run_startup.phase('measurement', async () => await measured(issue), {
+		edge_of: (value) => (value === UNSAMPLED_LAUNCH ? 'waiting' : 'done'),
+	})
+	if (settled !== undefined) return settled
+	const split = await run_startup.phase(
+		'split assessment',
+		async () => await backlog_drive_split_unit.run(issue),
+	)
+	if (split === 'split') return SPLIT_LAUNCH
+	await backlog_drive_owner.assert_current(owner)
+
+	return await launch_and_report(issue)
+}
+
+function launch_edge(value: DriveLaunch): 'done' | 'failed' {
+	return value === 'unopened' || value === 'failed' ? 'failed' : 'done'
+}
+
 // The launch opened and closed on the stream (`backlog-drive-trace.ts`).
 async function launch(issue: string, owner: string): Promise<DriveLaunch> {
-	return await backlog_drive_trace.traced(
-		issue,
-		backlog_drive_trace.STEP.LAUNCH,
-		async () => await opened(issue, owner),
+	return await run_startup.phase(
+		'launch',
+		async () =>
+			await backlog_drive_trace.traced(
+				issue,
+				backlog_drive_trace.STEP.LAUNCH,
+				async () => await opened(issue, owner),
+			),
+		{
+			issue,
+			root: true,
+			edge_of: (value) =>
+				value === 'waiting' || value === 'unsampled' ? 'waiting' : launch_edge(value),
+		},
 	)
 }
 

package/scripts/backlog/backlog-drive-listing.ts

@@ -1,50 +1,66 @@
 import { git_gh_issue } from '#scripts/gh/git-gh-issue'
-import { git_gh_issue_rest } from '#scripts/gh/git-gh-issue-rest'
-import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { git_gh_issue_rest, type RestIssue } from '#scripts/gh/git-gh-issue-rest'
+import { AUTO_OK_LABEL, IN_PROGRESS_LABEL } from '#scripts/issue/issue-labels'
+import { z } from 'zod'
 
 type ListingCheck = () => Promise<boolean>
 
-// The issue numbers the `auto-ok` listing's first page holds, its pull requests left out.
-function numbers_of(body: string): ReadonlySet<number> {
+// Each listed issue's label names, joined in order: the part of an issue whose change can make it ready.
+type Listing = ReadonlyMap<number, string>
+
+const labels_schema = z.array(z.looseObject({ name: z.string() })).catch([])
+
+function labels_of(issue: RestIssue): ReadonlyArray<string> {
+	return labels_schema.parse(issue['labels']).map((label) => label.name)
+}
+
+// The `auto-ok` listing's first page, its pull requests and its `in-progress` issues left out: an
+// issue at work in a lane edits its own labels, and none of those edits makes anything ready.
+function listing_of(body: string): Listing {
 	const issues = git_gh_issue_rest.parse_rest_issues(body)
+	const listed = issues
+		.filter((issue) => !git_gh_issue_rest.is_pull_request(issue))
+		.map((issue) => ({ number: issue.number, labels: labels_of(issue) }))
+		.filter((issue) => !issue.labels.includes(IN_PROGRESS_LABEL))
 
-	return new Set(
-		issues
-			.filter((issue) => !git_gh_issue_rest.is_pull_request(issue))
-			.map((issue) => issue.number),
+	return new Map(
+		listed.map((issue) => [
+			issue.number,
+			issue.labels.toSorted((left, right) => left.localeCompare(right)).join(','),
+		]),
 	)
 }
 
-function has_new(seen: ReadonlySet<number> | undefined, numbers: ReadonlySet<number>): boolean {
+function has_change(seen: Listing | undefined, listing: Listing): boolean {
 	if (seen === undefined) return false
 
-	return [...numbers].some((number) => !seen.has(number))
+	return [...listing].some(([number, labels]) => seen.get(number) !== labels)
 }
 
-// Whether the `auto-ok` listing's first page holds an issue the previous read lacked
-// (joshuafolkken/kit#7227). The ETag keeps the read cheap, but a running lane's own comments and
-// label edits change it too, so only a new issue number counts. The first read is the baseline,
-// and a read that fails reads as unchanged: the ask's interval still comes. A first read that fails
-// leaves an empty baseline rather than none, so an issue listed before the next read that answers
-// still counts as new (joshuafolkken/kit#7229).
+// Whether the `auto-ok` listing's first page holds an issue the previous read lacked, or an issue whose
+// labels changed since (joshuafolkken/kit#7227, joshuafolkken/kit#7507). The ETag keeps the read cheap,
+// but a running lane's own comments and label edits change it too, so only a new issue, or a relabelled
+// one outside a lane, counts. The first read is the baseline, and a read that fails reads as unchanged:
+// the ask's interval still comes. A first read that fails leaves an empty baseline rather than none, so
+// an issue listed before the next read that answers still counts as new (joshuafolkken/kit#7229).
 function watcher(): ListingCheck {
-	const memory: { seen?: ReadonlySet<number> } = {}
+	const memory: { seen?: Listing } = {}
 
-	function keep(numbers: ReadonlySet<number>): void {
-		memory.seen = numbers
+	function keep(listing: Listing): void {
+		memory.seen = listing
 	}
 
 	return async function is_changed(): Promise<boolean> {
 		try {
 			const detail = await git_gh_issue.issue_list_label_first_page(AUTO_OK_LABEL)
-			const numbers = numbers_of(detail.body)
-			const is_new = has_new(memory.seen, numbers)
+			const listing = listing_of(detail.body)
+			const is_new = has_change(memory.seen, listing)
 
-			keep(numbers)
+			keep(listing)
 
 			return is_new
 		} catch {
-			keep(memory.seen ?? new Set())
+			keep(memory.seen ?? new Map())
 
 			return false
 		}

package/scripts/backlog/backlog-drive-retrospective-unit.ts

@@ -14,7 +14,8 @@ import { backlog_drive_unit } from './backlog-drive-unit'
 
 // The record is held by the driver's owner (the supervisor, or the attached parent), never by the
 // unit's own session, so the close names that owner or `run:carry` refuses it as `busy`. The unit is
-// no run parent `run:step` answers, so the digest command is named here.
+// no run parent `run:step` answers, so the digest command is named here. The session `run:wake` wakes
+// beside the driver at a `watch` drain reads the same brief (`run-wake-driver.ts`).
 function brief_of(owner: string): string {
 	return [
 		'Run the backlogrun retrospective as the run parent would: `pnpm josh doc:read retrospective.md`;',
@@ -74,7 +75,7 @@ async function run(owner: string, ports: UnitPorts = production_ports()): Promis
 	return ports.is_marked(git_directory)
 }
 
-const backlog_drive_retrospective_unit = { run }
+const backlog_drive_retrospective_unit = { brief_of, run }
 
 export type { UnitPorts }
 export { backlog_drive_retrospective_unit }

package/scripts/backlog/backlog-drive-split-unit.ts

@@ -47,6 +47,7 @@ function brief_of(issue: string): string {
 		`\`pnpm josh doc:section .claude/skills/workflow-commands/split-assessment.md "${split_assess.QUESTION_SECTION}"\`.`,
 		`Separately-mergeable parts → file each child k with \`pnpm josh issue:file "<title>" --body-file .josh/tmp/split-${issue}-<k>.md --route split\`, then`,
 		`\`pnpm josh epic --promote ${issue} <N1> <N2> ... [--ordered]\`.`,
+		'Before publishing, record every child plan with `issue:plan --planned --no-notify`, then `pnpm josh issue:file --publish <E>`; retry the same epic on failure.',
 		`One deliverable → add \`${split_assess.REASON_PREFIX} <理由>\` under 背景 with \`pnpm josh issue:body ${issue} --body-file -\`.`,
 		'Nobody answers this session: end it once either is written.',
 	].join(' ')

package/scripts/backlog/backlog-hold-codes.ts

@@ -10,14 +10,21 @@ const USAGE_LIMIT_REASON = 'usage-limit'
 const MEMORY_REASON = 'memory'
 // Before a hand-back mark's reason no driver recorded (`lane-hand-back-held.ts`).
 const DRIVERLESS_PREFIX = 'driverless:'
+// The offer verdict that started nothing because nothing could start (`backlog-drive.ts`).
+const WATCH_VERDICT = 'watch'
+// The hand-back reason of a window that closed after a `watch` offer: the backlog had drained
+// (joshuafolkken/kit#7510), told apart from a window that closed mid-work.
+const DRAINED_REASON = 'drained'
 
 const backlog_hold_codes = {
+	DRAINED_REASON,
 	DRIVERLESS_PREFIX,
 	HAND_BACK_PREFIX,
 	MEMORY_REASON,
 	OFFER_PREFIX,
 	REASON_SEPARATOR,
 	USAGE_LIMIT_REASON,
+	WATCH_VERDICT,
 }
 
 export { backlog_hold_codes }

package/scripts/backlog/backlog-hold-text.ts

@@ -8,6 +8,7 @@ import { backlog_wait_cause, type WaitCause } from './backlog-wait-cause'
 // The writers' own constants name the codes (`backlog-hold-codes.ts`).
 
 const {
+	DRAINED_REASON,
 	DRIVERLESS_PREFIX,
 	HAND_BACK_PREFIX,
 	MEMORY_REASON,
@@ -26,7 +27,10 @@ const HAND_BACK_TEXT: ReadonlyMap<string, string> = new Map([
 	['launch', 'a lane launch failed; the session restarts the driver'],
 	['offer', 'the backlog offer failed; the session restarts the driver'],
 	['window', "the run's time window closed; the session restarts the driver"],
+	[DRAINED_REASON, 'the backlog had nothing to start; the session restarts the driver'],
 ])
+// The hand-backs only a person ends; every other one ends when the session restarts the driver.
+const PERSON_HAND_BACKS: ReadonlySet<string> = new Set(['judge', 'triage'])
 
 // `offer:<verdict>:<detail>`: the offer started nothing, for its cause or its answer.
 const OFFER_TEXT: ReadonlyMap<string, string> = new Map([
@@ -102,6 +106,15 @@ function text_of(code: string): string {
 	return prefixed_text(code) ?? whole_text(code) ?? code
 }
 
-const backlog_hold_text = { text_of }
+// Whether the hold is the driver's hand-back a session restart ends, a driverless mark's included —
+// told apart from a hand-back that waits on a person (joshuafolkken/kit#7510).
+function is_driver_restart(code: string): boolean {
+	const own = code.startsWith(DRIVERLESS_PREFIX) ? code.slice(DRIVERLESS_PREFIX.length) : code
+	const reason = rest_after(own, HAND_BACK_PREFIX)
+
+	return reason !== undefined && !PERSON_HAND_BACKS.has(reason)
+}
+
+const backlog_hold_text = { is_driver_restart, text_of }
 
 export { backlog_hold_text }

package/scripts/backlog/backlog-measure-close.ts

@@ -58,6 +58,12 @@ function measured(declaration: MeasureDeclaration, source: TrustedBody): Measure
 }
 
 async function declared(issue: string): Promise<Measurement | undefined> {
+	// The REST memo also serves split assessment (10-second TTL, invalidated by writes).
+	// An unverified body may only skip execution; it never authorizes a command.
+	const body = await git_gh_command.issue_get_body(issue)
+
+	if (body !== undefined && measure_declaration.parse(body) === undefined) return undefined
+
 	const read = await trusted_measure.read_trusted_body(issue)
 
 	if (read.kind === 'refused') return undefined