@joshuafolkken/kit 1.872.0

package/scripts/rules/gh-api.ts

@@ -0,0 +1,65 @@
+// The one reading of a `gh api` segment shared by the rows of `delivered-rules.ts` that judge such a
+// call by its spelling (joshuafolkken/kit#2122): the issue-body-read guard classifies read vs write,
+// and the third-party-write guard needs the same classification plus the target `owner/repo`. Two
+// copies of the flag regexes would be the clone `CLAUDE.md` prohibits, and the copy that forgot `-F`
+// or `--raw-field` would be the one that let a write through.
+//
+// **The deny list matches globs; this reads the command.** `gh api` sends a POST as soon as any field
+// flag appears, and a method flag can override the verb either way, so the read/write line is not a
+// literal a glob can key on — parsing the flags is what makes the judgement independent of the
+// spelling.
+
+// A `gh api …` invocation. Global flags may precede the subcommand (`gh --repo o/r api …`), so they
+// are skipped by the same optional-flag prefix `delivered-rules.ts` uses in front of `issue view`.
+const GH_FLAGS = String.raw`(?:-{1,2}[\w-]+(?:[= ][^\s]+)?\s+)*`
+const GH_API_COMMAND = new RegExp(String.raw`^gh\s+${GH_FLAGS}api\s`, 'u')
+
+// The method override, and the field flags that turn a bare `gh api` into a POST. **All four field
+// spellings**, `-F` included — it is `--field`'s short form and reads as a different flag to a
+// pattern that only knows `-f`. A body passed with `--input <file>` counts as a write too: it carries
+// the fields inside the file.
+const API_METHOD = /(?:^|\s)(?:--method|-X)[= ]([A-Za-z]+)/u
+const API_FIELD = /(?:^|\s)(?:--raw-field|--field|--input|-F|-f)(?:[= ]|$)/u
+const READ_METHOD = 'GET'
+
+// `repos/<owner>/<repo>` from an api path, with both halves captured. The path may carry a leading
+// slash, a query string, or further segments (`…/issues/5/comments`), so the owner and repo are taken
+// as the two segments after `repos/` and the rest is ignored. A call that names no repository endpoint
+// (`gh api user`, `gh api graphql`) matches nothing and is left to the caller as "no target".
+const REPO_PATH = /repos\/([^/\s'"?]+)\/([^/\s'"?]+)/u
+const OWNER_GROUP = 1
+const REPO_GROUP = 2
+
+interface RepoTarget {
+	owner: string
+	repo: string
+}
+
+function is_gh_api(segment: string): boolean {
+	return GH_API_COMMAND.test(segment)
+}
+
+// A read is a `GET` — explicit via a method flag, or implicit when no field flag makes it a POST.
+function is_read(segment: string): boolean {
+	const method = API_METHOD.exec(segment)?.[1]
+
+	if (method !== undefined) return method.toUpperCase() === READ_METHOD
+
+	return !API_FIELD.test(segment)
+}
+
+function is_write(segment: string): boolean {
+	return !is_read(segment)
+}
+
+function repo_target(segment: string): RepoTarget | undefined {
+	const match = REPO_PATH.exec(segment)
+
+	if (match === null) return undefined
+
+	return { owner: match[OWNER_GROUP] ?? '', repo: match[REPO_GROUP] ?? '' }
+}
+
+const gh_api = { GH_API_COMMAND, GH_FLAGS, is_gh_api, is_read, is_write, repo_target }
+
+export { gh_api }

package/scripts/rules/git-argv.ts

@@ -0,0 +1,129 @@
+// The one reading of a shell segment as a `git` invocation, shared by the two Bash-string rows that
+// judge a git command by its spelling (joshuafolkken/kit#2120): `git-force.ts` refuses a force push or
+// a branch delete, and `worktree-guard.ts` refuses an unauthorized working-tree change. Both have to
+// skip the same wrapper and the same git global options before the subcommand is even in hand, so the
+// cut lives here rather than beside whichever row needed it first — two copies of it would be the clone
+// `CLAUDE.md` prohibits, and the copy that forgot `git -C <path>` would be the one that stopped seeing
+// the spelling the deny list already cannot express.
+//
+// **The deny list matches globs; this reads argv.** `Bash(git push *--force*)` cannot see a combined
+// short cluster (`git push -uf`), a `-C <path>` prefix, or the colon-form delete (`git push origin
+// :branch`), because none of those put the literal the glob keys on where the glob looks. Parsing the
+// arguments is what makes the judgement independent of the spelling.
+
+// The wrapper words that may stand in front of `git`, the same ones `run-tail.ts` skips in front of
+// `josh`: environment assignments, the package-manager launchers, `sudo`, and an opening subshell
+// parenthesis. Left in, `sudo git push --force` and `(git push -f)` are silently not a git command.
+const ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u
+const WRAPPER_WORDS: ReadonlySet<string> = new Set([
+	'pnpm',
+	'npx',
+	'exec',
+	'run',
+	'sudo',
+	'command',
+])
+const SUBSHELL_OPEN = '('
+
+// The git global options that consume a **separate** following token as their value, so the parser
+// skips two words rather than one. `--opt=value` carries its value inline and is skipped as one word by
+// the ordinary flag branch below.
+const VALUE_TAKING_GLOBALS: ReadonlySet<string> = new Set([
+	'-C',
+	'-c',
+	'--git-dir',
+	'--work-tree',
+	'--namespace',
+	'--exec-path',
+	'--super-prefix',
+])
+
+const FLAG_PREFIX = '-'
+const GIT_COMMAND = 'git'
+const NEXT = 1
+const AFTER_VALUE = 2
+
+interface GitCall {
+	subcommand: string | undefined
+	args: ReadonlyArray<string>
+}
+
+// Split on whitespace alone. A refspec such as `:branch` and a short cluster such as `-uf` are single
+// tokens with no inner spaces, and neither force detection nor stash detection needs to look inside a
+// quoted argument — the one place a quote matters (a commit message) belongs to a subcommand neither
+// caller judges.
+const WHITESPACE = /\s+/u
+
+function words_of(segment: string): Array<string> {
+	return segment.split(WHITESPACE).filter((word) => word !== '')
+}
+
+function is_wrapper_token(word: string): boolean {
+	return word === SUBSHELL_OPEN || ENV_ASSIGNMENT.test(word) || WRAPPER_WORDS.has(word)
+}
+
+// Skip the wrapper: environment assignments, a launcher word, and a leading subshell parenthesis. The
+// first word that is none of these is where `git` has to be, or the segment is not a git command.
+function after_wrapper(words: ReadonlyArray<string>): number {
+	let index = 0
+
+	while (index < words.length && is_wrapper_token(words[index] ?? '')) index += NEXT
+
+	return index
+}
+
+// A value-taking global with no `=` swallows the next word too; every other flag is one word.
+function global_step(flag: string): number {
+	return VALUE_TAKING_GLOBALS.has(flag) ? AFTER_VALUE : NEXT
+}
+
+// Skip git's own global options, so `git -C <path> -c user.name=x push` reaches `push`.
+function after_globals(words: ReadonlyArray<string>, start: number): number {
+	let index = start
+
+	while (index < words.length) {
+		const flag = words[index] ?? ''
+
+		if (!flag.startsWith(FLAG_PREFIX)) return index
+
+		index += global_step(flag)
+	}
+
+	return index
+}
+
+// The subcommand and the arguments after it, or `undefined` when the segment is not a git invocation.
+// **`pnpm josh git` is deliberately not one**: the word after the wrapper is `josh`, not `git`, so a
+// run's own authorized `pnpm josh git -y` push is invisible here — which is exactly what keeps this row
+// off the node route the deny list already leaves alone.
+function parse(segment: string): GitCall | undefined {
+	const words = words_of(segment)
+	const git_index = after_wrapper(words)
+
+	if (words[git_index] !== GIT_COMMAND) return undefined
+
+	const subcommand_index = after_globals(words, git_index + NEXT)
+
+	return { subcommand: words[subcommand_index], args: words.slice(subcommand_index + NEXT) }
+}
+
+// A single-dash cluster of letters (`-uf`, `-D`), never a `--long` flag. The callers ask whether such a
+// cluster carries a given letter — `f` for a force push, `d` for a delete — because the deny list's
+// glob cannot see a letter bundled with others.
+const SHORT_CLUSTER = /^-[A-Za-z]+$/u
+
+function short_cluster_has(token: string, letters: string): boolean {
+	if (!SHORT_CLUSTER.test(token)) return false
+
+	const cluster = token.slice(FLAG_PREFIX.length)
+
+	for (let index = 0; index < letters.length; index += 1) {
+		if (cluster.includes(letters.charAt(index))) return true
+	}
+
+	return false
+}
+
+const git_argv = { parse, short_cluster_has, words_of }
+
+export { git_argv }

package/scripts/rules/git-force.ts

@@ -0,0 +1,104 @@
+import { bash_triggers } from './bash-triggers'
+import { git_argv } from './git-argv'
+import { shell_segments } from './shell-segments'
+
+// The trigger and the delivered text behind the `git-force` row of `delivered-rules.ts`
+// (joshuafolkken/kit#2120). Group 1 of the three Bash-string gaps: a force push or a branch delete
+// spelled in a way the `deny` glob cannot express.
+//
+// **The deny list stops the spellings a glob can reach and no others.** `Bash(git push *--force*)` and
+// `Bash(git push * -f)` catch the flag written after the arguments; `Bash(git branch -d*)` /
+// `Bash(git branch -D*)` catch a delete. But a combined short cluster (`git push -uf`), a `git -C
+// <path>` prefix, and the colon-form delete (`git push origin :branch`) all pass every entry, because
+// none of them puts the literal the glob keys on where the glob looks (`operating-rules.md`). Reading
+// the argv is what makes the judgement independent of the spelling.
+//
+// **It fires on every occurrence, not once per run.** A force push is destructive every time it is
+// issued, so refused-once-and-free-after would put the second one back on the run's self-restraint —
+// the disposition `run-tail.ts` and `filing-cap.ts` take for the same reason.
+
+// A force push. The long forms all open with `--force` (`--force`, `--force-with-lease[=ref]`,
+// `--force-if-includes`); `-f` and any cluster carrying `f` are the short forms; a bare `--delete` and
+// a cluster carrying `d` are the delete flags; and a refspec carries the force or delete in its own
+// spelling — a leading `+` forces the update (`+main:main`, `+:branch`) and an empty source side
+// deletes (`:branch`). Both open the refspec with a character the deny list cannot match as a literal.
+const FORCE_LONG_PREFIX = '--force'
+const DELETE_LONG = '--delete'
+const PUSH_SHORT_LETTERS = 'fd'
+const FORCE_OR_DELETE_REFSPEC = /^[+:]/u
+
+function is_force_or_delete_push(args: ReadonlyArray<string>): boolean {
+	return args.some(
+		(argument) =>
+			argument.startsWith(FORCE_LONG_PREFIX) ||
+			argument === DELETE_LONG ||
+			git_argv.short_cluster_has(argument, PUSH_SHORT_LETTERS) ||
+			FORCE_OR_DELETE_REFSPEC.test(argument),
+	)
+}
+
+// A branch delete: `--delete`, `-d` (delete), or `-D` (force delete), including a cluster carrying
+// either letter. `-m` (rename), `-a` / `-r` (list) and `-f` (force-create) are deliberately not here —
+// this rule is the delete the deny glob misses, not every branch mutation.
+const BRANCH_DELETE_LETTERS = 'dD'
+
+function is_branch_delete(args: ReadonlyArray<string>): boolean {
+	return args.some(
+		(argument) =>
+			argument === DELETE_LONG || git_argv.short_cluster_has(argument, BRANCH_DELETE_LETTERS),
+	)
+}
+
+const PUSH_SUBCOMMAND = 'push'
+const BRANCH_SUBCOMMAND = 'branch'
+
+function is_destructive_segment(segment: string): boolean {
+	const call = git_argv.parse(segment)
+
+	if (call === undefined) return false
+
+	if (call.subcommand === PUSH_SUBCOMMAND) return is_force_or_delete_push(call.args)
+
+	return call.subcommand === BRANCH_SUBCOMMAND && is_branch_delete(call.args)
+}
+
+// A shell line carries several commands, so each segment is judged on its own — a `git push --force`
+// quoted inside another command's argument is read as the write it is not, exactly as every other
+// trigger in this directory reads its own.
+function is_force_or_delete(command: string): boolean {
+	return shell_segments.segments_of(command).some((segment) => is_destructive_segment(segment))
+}
+
+// The instruction in the shape a refusal can carry: what the command does, why the deny list did not
+// stop it, and the one route left. There is no "safe reissue" the way a backgrounded push is for
+// `run-tail` — a force push and a branch delete are Tier C, so the honest next move is a person's, in
+// their own terminal.
+const GIT_FORCE_REASON =
+	'⛔ force push or branch delete: this rewrites or removes shared history, which is Tier C and needs ' +
+	'explicit current-turn user instruction — never an AI decision, even to fix a problem you caused ' +
+	'(`prompts/collaboration-workflow/operating-rules.md`). The `.claude/settings.json` deny list ' +
+	'matches globs, so it misses this spelling: a combined short cluster (`git push -uf`), a `git -C ' +
+	'<path>` prefix, and the colon-form delete (`git push origin :branch`) all pass it. This row reads ' +
+	'the argv instead, so the spelling does not matter. For an ordinary push use `pnpm josh git`; a ' +
+	"force push, a `git push --delete` / `:branch`, or a `git branch -d` / `-D` is the user's to run in " +
+	'their own terminal. **This rule fires on every occurrence, not once per run.**'
+
+// The row itself, so `delivered-rules.ts` spreads one entry. `decide` returns true so it refuses every
+// occurrence; it declares no `keeps` — not force-pushing is the absence of a call, not a call, so the
+// row is reported unmeasured rather than scored on an act that does not exist (`filing-cap.ts`).
+const ROW = {
+	id: 'git-force',
+	is_trigger: bash_triggers.on_bash_command(is_force_or_delete),
+	reason: GIT_FORCE_REASON,
+	decide: (): boolean => true,
+}
+
+const git_force = {
+	GIT_FORCE_REASON,
+	ROW,
+	is_branch_delete,
+	is_force_or_delete,
+	is_force_or_delete_push,
+}
+
+export { git_force }

package/scripts/rules/implementation-cut-verdict.ts

@@ -0,0 +1,84 @@
+import type { CostVerdict } from '#scripts/cost-runtime/cost-cli'
+import { stamp_file } from '#scripts/josh/stamp-file'
+import { z } from 'zod'
+
+// A short reuse window over the transcript-priced verdict `implementation-cut.ts` reads
+// (joshuafolkken/kit#2385).
+//
+// **The read is a whole-transcript price and its caller is asked of every edit.**
+// `is_over_threshold_edit` reads `cost_cli.session_verdict` — which loads and parses the session
+// corpus — and it is asked of every `Edit` / `Write` a lane child makes. Once the row fires per
+// threshold crossing rather than once per run, that read can no longer be paid on every edit, so the
+// verdict is cached beside the instant it was read and a burst of edits shares one read.
+//
+// **An in-memory memo cannot span two edits.** `pnpm josh rule:guard` runs as a fresh process on each
+// `PreToolUse`, so the cache is a per-checkout stamp rather than a module variable — the same handoff
+// shape the refusal stamp itself uses.
+//
+// **The value cannot go stale inside a window this short.** A turn appends no new *request* record
+// between its own edits, so consecutive edits of one turn price identically; and a cut relaunches the
+// process, whose first edit lands far past the window, so a resumed under-threshold session never reads
+// a stale `over` left by the process the cut ended.
+
+const VERDICT_CACHE_PREFIX = 'josh-impl-cut-verdict-'
+// Long enough to collapse one turn's burst of edits to a single read, short enough that the next turn
+// re-reads as the context grows. It sits below the cut-relaunch latency by design (see the header).
+const VERDICT_REUSE_MS = 5000
+
+// The literal spellings, tied to `CostVerdict` by `satisfies` so a change to the union fails this line
+// rather than drifting silently — the namespace constants (`cost_verdict.OVER_VERDICT` …) widen to
+// `string` through the object, so they cannot type a `z.enum` tuple.
+const VERDICT_VALUES = [
+	'over',
+	'under',
+	'unmeasurable',
+] as const satisfies ReadonlyArray<CostVerdict>
+const cache_schema = z.object({ read_at_ms: z.number(), verdict: z.enum(VERDICT_VALUES) })
+
+function cache_path(directory: string): string {
+	return stamp_file.stamp_path(VERDICT_CACHE_PREFIX, directory)
+}
+
+// The stored verdict when it is still inside the reuse window, or `undefined` for a missing, expired or
+// unreadable record — every one of which is a cache miss that reads afresh.
+function cached_verdict(target: string, now_ms: number): CostVerdict | undefined {
+	const raw = stamp_file.read_stamp_text(target)
+
+	if (raw === undefined) return undefined
+
+	try {
+		const { read_at_ms, verdict } = cache_schema.parse(JSON.parse(raw))
+
+		return now_ms - read_at_ms < VERDICT_REUSE_MS ? verdict : undefined
+	} catch {
+		return undefined
+	}
+}
+
+// The verdict, read through the window: the stored value inside it, a fresh `read()` past it. The
+// fresh read rewrites the stamp so the window restarts, and `replace_stamp`'s atomic rename keeps two
+// edits racing the write from tearing the record.
+function reused_verdict(
+	read: () => CostVerdict,
+	directory: string = process.cwd(),
+	now_ms: number = Date.now(),
+): CostVerdict {
+	const target = cache_path(directory)
+	const cached = cached_verdict(target, now_ms)
+
+	if (cached !== undefined) return cached
+
+	const value = read()
+
+	stamp_file.replace_stamp(target, { read_at_ms: now_ms, verdict: value })
+
+	return value
+}
+
+const implementation_cut_verdict = {
+	VERDICT_REUSE_MS,
+	cache_path,
+	reused_verdict,
+}
+
+export { implementation_cut_verdict }

package/scripts/rules/implementation-cut.ts

@@ -0,0 +1,202 @@
+import { CONTEXT_CUT_THRESHOLD } from '#scripts/cost-runtime/context-cut-threshold'
+import { cost_cli, type CostVerdict } from '#scripts/cost-runtime/cost-cli'
+import { cost_format } from '#scripts/cost-runtime/cost-format'
+import { cost_verdict } from '#scripts/cost-runtime/cost-verdict'
+import type { GuardRun } from '#scripts/josh/hook-decision'
+import { lane_child_marker, type MarkerSource } from '#scripts/lane/lane-child-marker'
+import { lane_paths } from '#scripts/lane/lane-paths'
+import { run_cut, type RunCut } from '#scripts/run/run-cut'
+import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
+import { bash_triggers } from './bash-triggers'
+import { implementation_cut_verdict } from './implementation-cut-verdict'
+import { shell_segments } from './shell-segments'
+
+// The implementation-phase cut, delivered at the call it binds on (joshuafolkken/kit#2310).
+//
+// **The mechanism was there and the verdict was taken at the wrong time.** joshuafolkken/kit#1933
+// built the second cut boundary — a lane child ends its process *during* implementation once its
+// recent-context cost crosses the shared threshold, and a fresh one resumes back into implementation —
+// and left the child to run `pnpm josh cost --cut` at each working-tree boundary itself. It never did.
+// The five lanes joshuafolkken/kit#2310 measured (#2304 #2294 #2297 #2296 #2298) each read the verdict
+// exactly once, at session entry where the context has not yet grown — so the check answered `under`
+// by construction and the cut fired 0 times while 33.9% of their requests ran past 200,000 tokens.
+//
+// **This is the same lesson pre-gate-cut.ts records, one boundary earlier.** joshuafolkken/kit#1864
+// measured the pre-gate cut taken 0 times while it was carried as prose, and a `PreToolUse` refusal is
+// what took it. joshuafolkken/kit#1933 had reasoned the implementation cut *could not* be a guard,
+// because the per-request cost was read asynchronously; but `cost_cli.session_verdict` is synchronous
+// and is the very verdict `pnpm josh cost --cut` prints, so the guard reads it directly rather than
+// approximating it — the same statistic and the same threshold, never the second measurement #1933
+// forbids.
+
+// The two edit tools the `PreToolUse` matcher routes here, and the working-tree boundary the cut is
+// taken at. A `PreToolUse` refusal fires *before* the edit lands, so the tree is at the consistent
+// state the previous edit left it — the "between edit batches, never mid-edit" boundary
+// `pre-gate-cut.md` requires, reached without waiting for a check to go green.
+const EDIT_TOOLS: ReadonlySet<string> = new Set(['Edit', 'Write'])
+
+function is_edit_tool(name: string): boolean {
+	return EDIT_TOOLS.has(name)
+}
+
+// The one spelling that takes this cut rather than the pre-gate one: `--impl`. A bare `pnpm josh
+// run:cut <N>` is the pre-gate boundary and `--resume` / `--end` / `--json` ask about a cut rather than
+// take one, so the compliance test looks for the flag that makes it the implementation-phase cut.
+const CUT_COMMANDS: ReadonlySet<string> = new Set(['run:cut'])
+const IMPL_FLAG = /(?:^|\s)--impl(?:[=\s]|$)/u
+
+function is_impl_cut_segment(segment: string): boolean {
+	return shell_segments.is_josh_command(segment, CUT_COMMANDS) && IMPL_FLAG.test(segment)
+}
+
+// Whether this command takes the implementation-phase cut, segment-wise so a spelling quoted inside a
+// body is not read as the call, and alias-expanded so `pnpm josh rct --impl` is the same call.
+function takes_the_impl_cut(command: string): boolean {
+	return shell_segments.segments_of(command).some((segment) => is_impl_cut_segment(segment))
+}
+
+// What the trigger has to know about the world, passed in so the decision is testable without a lane on
+// disk, a cut record, or a session transcript. `verdict` is the synchronous `pnpm josh cost --cut`
+// reading — the same per-request billed-input statistic against the same threshold — so the guard
+// prices its cut on exactly what the parent hand-off does (joshuafolkken/kit#1933).
+interface LaneCostState {
+	directory: string
+	source: MarkerSource
+	carried: (now?: Date) => RunCut | undefined
+	verdict: () => CostVerdict
+}
+
+function current_state(): LaneCostState {
+	return {
+		directory: process.cwd(),
+		source: process.env,
+		carried: run_cut.carried_cut_sync,
+		// **Read through the short reuse window** (joshuafolkken/kit#2385). The row now fires per
+		// threshold crossing rather than once per run, so this predicate is a candidate on every edit;
+		// the window collapses one turn's burst of edits to a single whole-transcript price.
+		verdict: (): CostVerdict =>
+			implementation_cut_verdict.reused_verdict(() => cost_cli.session_verdict()),
+	}
+}
+
+// A dispatched lane child for this checkout with no cut already carried. The dispatch mark is what
+// tells a child apart from a person (joshuafolkken/kit#1904), read from the environment against this
+// lane's own issue so a leaked mark for another issue reads as a person. **The carried-cut half keeps
+// the guard silent between a cut and its resume**, exactly as `pre-gate-cut.ts`'s does: a record naming
+// this issue means a cut is already in flight, and `begin_cut`'s exclusive create would refuse a second
+// one anyway.
+function uncut_lane_child_issue(state: LaneCostState): string | undefined {
+	if (!lane_child_marker.is_child_of(state.directory, state.source)) return undefined
+
+	const issue = lane_paths.lane_issue_of(state.directory, { ...state.source })
+
+	if (issue === undefined) return undefined
+
+	return state.carried()?.issue === issue ? undefined : issue
+}
+
+// **The tool-name test comes first and the world is consulted second, the cost measurement last.** This
+// predicate is asked of every call in the run, so the `Edit` / `Write` string match keeps the lane read
+// off all but the edits, and the lane read keeps the transcript-priced verdict off every edit but those
+// a dispatched child makes in an uncut lane — where crossing the threshold is exactly the event this
+// guard exists to catch.
+//
+// **The unmeasurable direction matches the pre-gate cut** (joshuafolkken/kit#2385). A session that
+// cannot be priced reads as warranting the cut, the same safety-net direction `pre-gate-cut.ts`'s
+// `warrants_the_cut` takes (`verdict !== UNDER_VERDICT`): the two rules read one statistic against one
+// threshold, so they must not disagree about whether an unmeasurable session is due a cut.
+function is_over_threshold_edit(
+	call: GuardedCall,
+	state: LaneCostState = current_state(),
+): boolean {
+	if (!is_edit_tool(call.name) || uncut_lane_child_issue(state) === undefined) return false
+
+	return state.verdict() !== cost_verdict.UNDER_VERDICT
+}
+
+// **The threshold in the refusal text is assembled from the constant, never spelled** (joshuafolkken/kit#2385).
+// joshuafolkken/kit#2374 lowered the shared threshold and the literal `200,000` stayed behind in this
+// text, telling agents the wrong number; building it from `CONTEXT_CUT_THRESHOLD` is what keeps the two
+// from ever drifting again. `cost_format.format_tokens` renders it the way every cost report does.
+const THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`
+
+// The instruction in the shape a refusal can carry: what the cut is for, what each verdict means, and
+// the reissue sentence every delivery needs. The verdicts are spelled out rather than pointed at,
+// because `cut` is the only one that ends the turn and a run told merely to "take the cut" would have to
+// read which of the others leave it implementing — the same reason `pre-gate-cut.ts` spells them out.
+const IMPLEMENTATION_CUT_REASON =
+	'⛔ implementation-phase cut: this checkout is a lane dispatched for this issue and its recent-context ' +
+	`cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated ` +
+	'so far is now re-read on every later request. Take the cut before this edit. ' +
+	'First write a handoff file with the Write tool — the user’s instruction verbatim, what you have ' +
+	'completed, what remains, and what you deliberately did not touch — and pass it as `--handoff <path>`, ' +
+	'so the fresh process resumes on the original instruction rather than the working tree alone ' +
+	'(joshuafolkken/kit#2354); a resume that finds no instruction is refused `incomplete` rather than ' +
+	'continuing blind. ' +
+	'`pnpm josh run:cut --impl <N> --handoff <path>` ends this process and relaunches a fresh one that resumes back into ' +
+	'implementation (`resume-impl`), dropping the accumulated context rather than carrying it — ' +
+	'joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times ' +
+	'because the verdict was only ever read at session entry, where the context has not yet grown. The ' +
+	"verdict is `pnpm josh cost --cut`'s exactly — the same per-request billed-input statistic against the " +
+	'same threshold, never a second measurement. Issue `pnpm josh run:cut --impl <N> --handoff <path>` now and read the ' +
+	'verdict: on `cut`, **end the turn immediately** — the fresh process owns the run and continues ' +
+	'implementing, so it must not be waited for; on `not-a-lane`, `unready`, `busy`, `failed` or ' +
+	'`unknown`, this process carries the run on and the edit is simply the next call. Never relaunch a ' +
+	'second process after `busy`. This fired because the dispatch mark names this lane; a person working ' +
+	'here carries no mark and sees no refusal, so there is no human-or-child judgement left to make. The ' +
+	'procedure is `.claude/skills/workflow-commands/pre-gate-cut.md`. Reissue this edit once the cut has ' +
+	'answered — an edit reissued right after this refusal passes, so `busy` / `failed` cannot wedge the ' +
+	'run edit after edit; this fires again on the next threshold crossing rather than once per run.'
+
+// **A refusal younger than this window is this edit's own refusal being answered** (joshuafolkken/kit#2385).
+// A `decide` row that refused every over-threshold edit would wedge a run whose cut came back `busy` /
+// `failed` / `unready` — the very cases once-per-run relied on the reissue passing through. So an edit
+// reissued inside this window passes: it is longer than a refusal-then-reissue round trip, so the
+// reissue always lands inside it, while a genuinely new crossing past the window refuses again.
+const REISSUE_WINDOW_MS = 90_000
+
+function is_reissued_refusal(now_ms: number, delivered_at_ms: number): boolean {
+	return now_ms - delivered_at_ms < REISSUE_WINDOW_MS
+}
+
+// **Fires on every threshold crossing rather than once per run** (joshuafolkken/kit#2385). Once per run
+// silenced the row for the rest of a process the moment its first refusal landed — and a `busy` /
+// `failed` / `unready` verdict, or an edit reissued unchanged, left the context to grow unwatched to
+// 282,747 tokens with the cut never taken. `decide` re-asks on every over-threshold edit; the reissue
+// window is what keeps that from wedging a run that genuinely cannot cut. `delivered_at_ms` is this
+// row's own last refusal, written by `fire_once` only when a refusal actually fired, so a passed
+// reissue does not move it.
+function decide(
+	_call: GuardedCall,
+	run: GuardRun,
+	_can_record: boolean,
+	delivered_at_ms: number,
+): boolean {
+	return !is_reissued_refusal(run.now_ms, delivered_at_ms)
+}
+
+// The row itself, so `delivered-rules.ts` spreads one entry. `decide` fires it per threshold crossing
+// (joshuafolkken/kit#2385); `keeps` is the implementation cut command, read from a `Bash` call the same
+// way `pre-gate-cut`'s is.
+const ROW = {
+	id: 'implementation-cut',
+	is_trigger: is_over_threshold_edit,
+	reason: IMPLEMENTATION_CUT_REASON,
+	decide,
+	keeps: bash_triggers.on_bash_command(takes_the_impl_cut),
+}
+
+const implementation_cut = {
+	IMPLEMENTATION_CUT_REASON,
+	REISSUE_WINDOW_MS,
+	ROW,
+	decide,
+	is_edit_tool,
+	is_over_threshold_edit,
+	is_reissued_refusal,
+	takes_the_impl_cut,
+	uncut_lane_child_issue,
+}
+
+export type { LaneCostState }
+export { implementation_cut }