@joshuafolkken/kit 1.972.0 → 1.978.0

package/.claude/skills/workflow-commands/fullrun.md

@@ -63,6 +63,7 @@ call reports `hold`.
   boundary — immediately after `pnpm josh main:merge`, before the gate — it takes the cut with
   `pnpm josh run:cut <N>` (the ordered step in `chain-rule.md`), and it records any park on the Issue before the stop notify.
   `pre-gate-cut.md` is the single source of both.
+- **`resume: halfrun`** adopted a stopped `halfrun` (#2796): gate in full; `working-tree-hold.md`.
 
 ## The stop branches
 

package/.claude/skills/workflow-commands/halfrun.md

@@ -41,12 +41,16 @@ josh latest:scope` and update dependencies only on `required` (`latest-gate.md`;
 start `pnpm josh gate` beside a subagent `/code-review` with the brief `pnpm josh review:brief` prints,
 join the gate before the stop, iterate to no high/medium findings, at most two reviews → `pnpm josh
 test:e2e`, run by **you**, because `halfrun` opens no pull request and there is no CI E2E job; a printed
-skip is the answer where the project has no suite) → send a `confirmation` Telegram with the resume
-commands in the body → **stop**. Plan comments are in the session language. The `confirmation` Telegram
-body MUST include the exact resume commands: `pnpm josh notify --task-type confirmation --issue-url
-"<issue-url>" --body=$'halfrun ready for manual verification\nNext: pnpm josh git -y "<title> #<N>" &&
-pnpm josh followup "<title> #<N>" --notify-message "Implemented <title>\\nCause: ...\\nFix:
-...\\nResult: ...\\n\\nDetails:\\n- <change1>"'`.
+skip is the answer where the project has no suite) → **mark the stop: `pnpm josh run:hold <N>
+--halfrun-stop`** (the record `fullrun #<N>` adopts; `new` passes the filed number) → send a
+`confirmation` Telegram with the resume commands in the body → **stop**. Plan comments are in the session language. The `confirmation` Telegram
+body MUST include the exact resume commands — **`fullrun #<N>` first**, since that is how a verified
+`halfrun` ships (joshuafolkken/kit#2796): its `run:entry` adopts this stop's marked hold and resumes at
+the gate. The direct commands follow for shipping without an agent:
+`pnpm josh notify --task-type confirmation --issue-url "<issue-url>" --body=$'halfrun ready for manual
+verification\nNext: fullrun #<N>\nWithout an agent: pnpm josh git -y "<title> #<N>" && pnpm josh
+followup "<title> #<N>" --notify-message "Implemented <title>\\nCause: ...\\nFix: ...\\nResult:
+...\\n\\nDetails:\\n- <change1>"'`. The stop report names the same two, in the same order.
 **Invoking `halfrun` is _not_ authorization to commit, push, or merge** — do not run `pnpm josh git -y` or `pnpm josh followup` yourself. If the user comes
 back with fixes, treat each as a new round: implement, re-run `pnpm josh gate`, send another
 `confirmation` Telegram, stop again.
@@ -59,7 +63,8 @@ body per `prompts/collaboration-workflow/issue-template.md`) → add `in-progres
 any pre-existing changes with `git stash push -m "halfrun new: pre-existing changes"`, popped by
 message with `pnpm josh stash:pop "halfrun new: pre-existing changes"`, never a positional `git stash pop` →
 `git switch main && git pull` → `pnpm josh latest:scope` → implement → run the gate (as above, `pnpm
-josh test:e2e` run by **you**) → send the `confirmation` Telegram and **stop**.
+josh test:e2e` run by **you**) → `pnpm josh run:hold <N> --halfrun-stop` → send the `confirmation`
+Telegram and **stop**.
 
 ## The stop branches
 

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -55,7 +55,8 @@ clean releases it explicitly**: a `fullrun` / `halfrun` that stops on a split, a
 third-party target ends with `pnpm josh run:release <N>` (bare where that run entered as `new`).
 **`halfrun`'s stop before commit keeps the hold**, and so does a `needs-human-review` stop: the
 uncommitted work still in the tree is exactly what a second run would trample, so the release command
-goes in the stop report and the Telegram for the person to type. **An expired record over a tree that
+goes in the stop report and the Telegram for the person to type. **`fullrun #<N>` of the same issue
+adopts a `halfrun`'s kept hold** rather than being refused `busy` by it — "The halfrun resume" below. **An expired record over a tree that
 still has uncommitted changes does not free it**: the command answers `busy` and says to commit, stash,
 or release once the work is done; only an expired record over a clean tree is replaced.
 
@@ -64,3 +65,17 @@ call it themselves; each child runs the `fullrun` procedure, so it claims on ent
 followup` releases it at that child's merge. The command's behavior and the answer table are
 `docs/josh-commands.md` → "`josh run:hold` / `josh run:release`"; this file is the single source of
 the procedure.
+
+## The halfrun resume
+
+**`fullrun #<N>` after a `halfrun` stop resumes it instead of claiming** (joshuafolkken/kit#2796). The
+stop is **recorded, never inferred**: the `halfrun` ends with `pnpm josh run:hold <N> --halfrun-stop`,
+which marks its own record (re-keying a `halfrun new`'s unnumbered one to the filed issue) — a
+`halfrun` still implementing or a `backlogrun` child leaves the same hold over the same dirty tree, and
+must not be adopted. On a marked hold for `#<N>` over a dirty tree, `run:entry` asks the session budget
+(`over` stops as usual), adopts the hold with the `fullrun` mark and prints `entry #<N> — resume:
+halfrun`. **Skip the title, the plan, the split assessment, `git switch main && git pull`,
+`latest:scope` and the implementation**: the diff in the tree is what the person verified. Re-read the
+issue (`pnpm josh issue:read <N>`), then run the gate **in full** from the refactor (`chain-rule.md` →
+"Run the review-to-merge chain") — a fix made during the manual check has had no gate — and ship as
+any `fullrun` does.

package/README.md

@@ -1,10 +1,10 @@
 # @joshuafolkken/kit
 
-A development toolkit that sets up a repository for AI-assisted work with one command. `josh init` gives an AI assistant (Claude Code, Codex, Gemini, Cursor) the project's rules, and the `josh` CLI runs the checks and the Git / GitHub Issue workflow the same way in every project. You stop copying config between repositories and re-explaining conventions to the assistant. For the problems kit exists to solve, see [why.md](./docs/why.md) (Japanese).
+A development toolkit for AI-assisted work. `josh init` gives an AI assistant (Claude Code, Codex, Gemini, Cursor) the project's rules, formatting and checks in one command. With `kickoff`, `fullrun` and `backlogrun`, the agent then takes a GitHub Issue through plan → implement → verify → PR → merge, the same way in every project. Why kit exists: [why.md](./docs/why.md) (Japanese).
 
 ## What your project gets
 
-kit does not branch by language. It asks one question — does the project use Node tooling? — and picks a [profile](./docs/init.md#project-profiles):
+kit picks a [profile](./docs/init.md#project-profiles) from one question — does the project use Node tooling?
 
 | Your project                             | Profile  | What you get                                                      |
 | ---------------------------------------- | -------- | ----------------------------------------------------------------- |
@@ -12,54 +12,58 @@ kit does not branch by language. It asks one question — does the project use N
 | HTML / CSS (browser JavaScript included) | `static` | Formatting (Prettier), AI assistant files, Git / VS Code settings |
 | Another language (Python, Rust, Go, …)   | `static` | AI assistant files and Git / VS Code settings only                |
 
-kit adds no linter or test runner for languages other than JavaScript and TypeScript; in a `static` project, `josh` skips each check that has nothing to run and says why.
+In a `static` project, `josh` skips each check that has nothing to run and says why.
 
 ## Quick start
 
-In your project directory:
+Requires [Node.js](https://nodejs.org/) 22.19.0+ and [pnpm](https://pnpm.io/) for every profile ([getting-started.md](./docs/getting-started.md)); the [gh CLI](https://cli.github.com/) for `josh version` and the Issue workflow is required by `josh start` and optional otherwise. Run in your project directory.
+
+### The project is already on GitHub, or will not use GitHub
 
 ```bash
-pnpm add -D --allow-build=esbuild --allow-build=unrs-resolver @joshuafolkken/kit
-pnpm exec josh init
+pnpm --allow-build=esbuild dlx @joshuafolkken/kit init
 pnpm josh gate
 ```
 
-`josh init` finishes by running `pnpm install` and `josh format` itself; pass `--no-install` to skip both, for example on CI or offline.
+### The project has no GitHub repository yet, and will use the Issue workflow
 
-`josh init` is the entry without GitHub. To start a new project on the GitHub Issue workflow (`kickoff`), run `pnpm exec josh start` instead of `josh init` — it also creates the Git repository, the GitHub repository and the labels ([init.md → `josh init` or `josh start`](./docs/init.md#josh-init-or-josh-start)).
+```bash
+pnpm add -D --allow-build=esbuild --allow-build=unrs-resolver @joshuafolkken/kit
+pnpm exec josh start
+```
 
-It needs [Node.js](https://nodejs.org/) 22.19.0 or later with [pnpm](https://pnpm.io/), even for a `static` project; [getting-started.md](./docs/getting-started.md) installs both. The global `josh` command ([cli.md](./docs/cli.md)) and the [gh CLI](https://cli.github.com/) for `josh version` and the GitHub Issue workflow are optional.
+`josh start` also runs `git init` when needed and creates and pushes the GitHub repository. Details: [init.md → `josh init` or `josh start`](./docs/init.md#josh-init-or-josh-start).
 
 ## Documentation
 
 **Get started**
 
-- [getting-started.md](./docs/getting-started.md) — first install for an `index.html` site or a non-Node project (`static`)
-- [package.md](./docs/package.md) — add kit to a Node project (`node`)
+- [getting-started.md](./docs/getting-started.md) — first install for a `static` project
+- [package.md](./docs/package.md) — add kit to a Node project
 - [tutorial.md](./docs/tutorial.md) — your first change with an agent, from Issue to merge
-- [how-to.md](./docs/how-to.md) — step-by-step guides by task: update, release, run Issues, fix a failing gate
+- [how-to.md](./docs/how-to.md) — guides by task
 - [overview.md](./docs/overview.md) — what kit sets up and how it works
 
 **Commands and configuration**
 
-- [cli.md](./docs/cli.md) — install the global `josh` command
+- [cli.md](./docs/cli.md) — the global `josh` command
 - [josh-commands.md](./docs/josh-commands.md) — every `josh` command ([catalog](./docs/josh-command-catalog.md))
-- [init.md](./docs/init.md) — what `josh init` creates, per profile
-- [sync.md](./docs/sync.md) — what `josh sync` updates after an upgrade
-- [manual-config.md](./docs/manual-config.md) — use the presets without `josh init`
-- [package-api.md](./docs/package-api.md) — the config presets and libraries the package exports
+- [init.md](./docs/init.md) — what `josh init` creates
+- [sync.md](./docs/sync.md) — what `josh sync` updates
+- [manual-config.md](./docs/manual-config.md) — the presets without `josh init`
+- [package-api.md](./docs/package-api.md) — the package's exports
 
 **AI workflow and operations**
 
-- [scripts-ai.md](./docs/scripts-ai.md) — Telegram notifications and the Issue workflow commands
+- [scripts-ai.md](./docs/scripts-ai.md) — Issue workflow commands and Telegram notifications
 - [cloud-session.md](./docs/cloud-session.md) — running in an agent container
-- [eval.md](./docs/eval.md) — measuring whether the agent rules are followed
+- [eval.md](./docs/eval.md) — measuring rule adherence
 - [troubleshooting.md](./docs/troubleshooting.md) — install and auth errors
 - [authentication.md](./docs/authentication.md) — existing GitHub Packages installs only
 
 ## Contributing
 
-Community standards live in [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md); security reports go through [SECURITY.md](./SECURITY.md). Development conventions are in [CLAUDE.md](./CLAUDE.md); releases are in [publishing.md](./docs/publishing.md), and maintainer records in [docs/maintainers/](./docs/maintainers/).
+Conventions are in [CLAUDE.md](./CLAUDE.md), releases in [publishing.md](./docs/publishing.md). See [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) and [SECURITY.md](./SECURITY.md); maintainer records are in [docs/maintainers/](./docs/maintainers/).
 
 ## License
 

package/dist/hooks/{chunk-BNWIOJFU.js → chunk-BNGGEY3Z.js}

@@ -1,6 +1,7 @@
 import {
   ALREADY_DONE_LABEL,
   BREAKING_CHANGE_LABEL,
+  BUGFIX_LABEL,
   BUG_LABEL,
   CONTEXT_CUT_THRESHOLD,
   ENHANCEMENT_LABEL,
@@ -9,6 +10,7 @@ import {
   NEEDS_DECISION_LABEL,
   NEEDS_HUMAN_REVIEW_LABEL,
   RECENT_REQUEST_WINDOW,
+  RELEASE_CLASSIFICATION_NAMES,
   agent_role_profile,
   agent_session_environment,
   bash_triggers,
@@ -35,7 +37,7 @@ import {
   run_watcher_guard,
   shell_segments,
   tail_commands
-} from "./chunk-WWTMHHZU.js";
+} from "./chunk-Q7LE77CO.js";
 import {
   find_local_bin_upwards
 } from "./chunk-3V37IID6.js";
@@ -3590,16 +3592,7 @@ import { readFileSync as readFileSync6 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { execaSync } from "execa";
 import { z as z8 } from "zod";
-var BUGFIX = "bugfix";
-var BREAKING = "breaking-change";
-var CLASSIFICATION_LABELS2 = [
-  BREAKING,
-  "enhancement",
-  BUGFIX,
-  "other-change",
-  "ignore-for-release"
-];
-var CLASSIFICATION_SET = new Set(CLASSIFICATION_LABELS2);
+var CLASSIFICATION_SET = new Set(RELEASE_CLASSIFICATION_NAMES);
 var ISSUE_BUG_LABEL = "bug";
 var DECLARATION = /^- リリース分類: (.+)$/gmu;
 var LEGACY_LABELS = /* @__PURE__ */ new Set(["semver-major", "semver-minor"]);
@@ -3618,14 +3611,14 @@ function classification_error(labels, author) {
     return `Choose exactly one release classification; found: ${selected.join(", ")}`;
   }
   if (selected.length === 1 || author.endsWith("[bot]")) return void 0;
-  return `Choose one release classification: ${CLASSIFICATION_LABELS2.join(", ")}`;
+  return `Choose one release classification: ${RELEASE_CLASSIFICATION_NAMES.join(", ")}`;
 }
 function is_classification(value) {
   return CLASSIFICATION_SET.has(value);
 }
 function release_candidates(candidates) {
-  if (!candidates.includes(BREAKING)) return candidates;
-  return candidates.filter((candidate) => candidate !== "enhancement");
+  if (!candidates.includes(BREAKING_CHANGE_LABEL)) return candidates;
+  return candidates.filter((candidate) => candidate !== ENHANCEMENT_LABEL);
 }
 function issue_candidates(issue_json) {
   const issue = z8.object({ labels: z8.array(LABEL), body: z8.string().nullable() }).parse(JSON.parse(issue_json));
@@ -3634,8 +3627,8 @@ function issue_candidates(issue_json) {
   const candidates = [...release_candidates([...names, ...declared].filter(is_classification))];
   const unknown = declared.filter((value) => !is_classification(value));
   if (unknown.length > 0) throw new Error(`Unknown release classification: ${unknown.join(", ")}`);
-  if (names.includes(ISSUE_BUG_LABEL) && !candidates.includes(BREAKING)) {
-    candidates.push(BUGFIX);
+  if (names.includes(ISSUE_BUG_LABEL) && !candidates.includes(BREAKING_CHANGE_LABEL)) {
+    candidates.push(BUGFIX_LABEL);
   }
   return candidates;
 }
@@ -3645,7 +3638,7 @@ function select_issue_classification(issue_json) {
   const [label] = selected;
   if (label === void 0 || selected.length > 1) {
     throw new Error(
-      `Choose one release classification before opening the PR: ${CLASSIFICATION_LABELS2.join(", ")}; found: ${selected.join(", ") || "none"}. Add "- \u30EA\u30EA\u30FC\u30B9\u5206\u985E: <label>" to the Issue body.`
+      `Choose one release classification before opening the PR: ${RELEASE_CLASSIFICATION_NAMES.join(", ")}; found: ${selected.join(", ") || "none"}. Add "- \u30EA\u30EA\u30FC\u30B9\u5206\u985E: <label>" to the Issue body.`
     );
   }
   return label;

package/dist/hooks/{chunk-WWTMHHZU.js → chunk-Q7LE77CO.js}

@@ -547,7 +547,8 @@ var run_hold_schema = z.object({
   issue: z.string(),
   taken_at: z.string(),
   pid: z.number(),
-  is_fullrun: z.boolean().optional()
+  is_fullrun: z.boolean().optional(),
+  is_halfrun_stop: z.boolean().optional()
 });
 function parse_hold(raw) {
   try {
@@ -582,6 +583,9 @@ function write_hold(target, issue, now = /* @__PURE__ */ new Date()) {
 function create_hold(target, issue, now = /* @__PURE__ */ new Date(), is_fullrun) {
   return stamp_file.create_stamp(target, build_hold(issue, now, is_fullrun));
 }
+function create_halfrun_stop_hold(target, issue, now = /* @__PURE__ */ new Date()) {
+  return stamp_file.create_stamp(target, { ...build_hold(issue, now), is_halfrun_stop: true });
+}
 async function is_tree_dirty() {
   try {
     const status2 = await git_command.status();
@@ -635,6 +639,7 @@ var run_hold = {
   RELEASE_COMMAND,
   UNNUMBERED_ISSUE,
   classify,
+  create_halfrun_stop_hold,
   create_hold,
   describe_holder,
   foreign_release_message,
@@ -1732,6 +1737,28 @@ var WORKFLOW_LABELS = [
   ...FILING_ROUTE_LABELS,
   ...DEPTH_LABELS
 ];
+var BUGFIX_LABEL = "bugfix";
+var OTHER_CHANGE_LABEL = "other-change";
+var IGNORE_FOR_RELEASE_LABEL = "ignore-for-release";
+var RELEASE_CLASSIFICATION_NAMES = [
+  BREAKING_CHANGE_LABEL,
+  ENHANCEMENT_LABEL,
+  BUGFIX_LABEL,
+  OTHER_CHANGE_LABEL,
+  IGNORE_FOR_RELEASE_LABEL
+];
+var RELEASE_CLASSIFICATION_METADATA = {
+  [BREAKING_CHANGE_LABEL]: { color: "d93f0b", description: "Release: a breaking change (major)" },
+  [ENHANCEMENT_LABEL]: { color: "84b6eb", description: "Release: a new feature (minor)" },
+  [BUGFIX_LABEL]: { color: "d73a4a", description: "Release: a bug fix (patch)" },
+  [OTHER_CHANGE_LABEL]: { color: "c2e0c6", description: "Release: any other change (patch)" },
+  [IGNORE_FOR_RELEASE_LABEL]: { color: "cfd3d7", description: "Release: left out of the notes" }
+};
+var RELEASE_CLASSIFICATION_LABELS = RELEASE_CLASSIFICATION_NAMES.map((name) => ({ name, ...RELEASE_CLASSIFICATION_METADATA[name] }));
+var REPOSITORY_LABELS = [
+  ...WORKFLOW_LABELS,
+  ...RELEASE_CLASSIFICATION_LABELS
+];
 function has_any_label(labels, wanted) {
   return (labels ?? []).some((label) => wanted.has(label.name.toLowerCase()));
 }
@@ -3624,6 +3651,8 @@ export {
   RUN_LANE_LABEL,
   NEEDS_HUMAN_REVIEW_LABEL,
   ALREADY_DONE_LABEL,
+  BUGFIX_LABEL,
+  RELEASE_CLASSIFICATION_NAMES,
   has_any_label,
   has_label_name,
   run_tail,

package/dist/hooks/codex-hook-adapter.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-BNWIOJFU.js";
-import "./chunk-WWTMHHZU.js";
+} from "./chunk-BNGGEY3Z.js";
+import "./chunk-Q7LE77CO.js";
 import {
   build_envelope,
   compose_context,

package/dist/hooks/pretool-guard.js

@@ -3,8 +3,8 @@ import {
   pretool_guard,
   pretool_outcome,
   pretool_outcome_async
-} from "./chunk-BNWIOJFU.js";
-import "./chunk-WWTMHHZU.js";
+} from "./chunk-BNGGEY3Z.js";
+import "./chunk-Q7LE77CO.js";
 import "./chunk-3V37IID6.js";
 import "./chunk-NXL3SBXY.js";
 import "./chunk-BVMSPG3M.js";

package/dist/hooks/stop-guard.js

@@ -19,7 +19,7 @@ import {
   run_hold,
   run_invocation,
   run_watcher_guard
-} from "./chunk-WWTMHHZU.js";
+} from "./chunk-Q7LE77CO.js";
 import {
   session_language
 } from "./chunk-6V5OPIUU.js";

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.972.0",
+  "version": "1.978.0",
   "name": "@joshuafolkken/kit",
   "description": "Development toolkit for AI-assisted projects: formatting, AI assistant rules and a Git/GitHub Issue workflow for any repository, plus lint, type check, tests and hooks for Node projects",
   "keywords": [
@@ -193,7 +193,7 @@
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/node": "^26.6.3",
     "@types/semver": "^7.8.0",
-    "cspell": "^10.3.5",
+    "cspell": "^10.3.6",
     "esbuild": "^0.28.2",
     "eslint": "^10.11.0",
     "eslint-config-prettier": "^10.1.8",

package/scripts/ci/pr-classification.ts

@@ -1,18 +1,15 @@
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
+import {
+	BREAKING_CHANGE_LABEL as BREAKING,
+	BUGFIX_LABEL as BUGFIX,
+	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
+	ENHANCEMENT_LABEL,
+	type ReleaseClassification,
+} from '#scripts/git/issue-labels'
 import { execaSync } from 'execa'
 import { z } from 'zod'
 
-const BUGFIX = 'bugfix'
-const BREAKING = 'breaking-change'
-const CLASSIFICATION_LABELS = [
-	BREAKING,
-	'enhancement',
-	BUGFIX,
-	'other-change',
-	'ignore-for-release',
-] as const
-type ReleaseClassification = (typeof CLASSIFICATION_LABELS)[number]
 const CLASSIFICATION_SET: ReadonlySet<string> = new Set(CLASSIFICATION_LABELS)
 const ISSUE_BUG_LABEL = 'bug'
 const DECLARATION = /^- リリース分類: (.+)$/gmu
@@ -50,7 +47,7 @@ function release_candidates(
 ): ReadonlyArray<ReleaseClassification> {
 	if (!candidates.includes(BREAKING)) return candidates
 
-	return candidates.filter((candidate) => candidate !== 'enhancement')
+	return candidates.filter((candidate) => candidate !== ENHANCEMENT_LABEL)
 }
 
 function issue_candidates(issue_json: string): ReadonlyArray<ReleaseClassification> {
@@ -132,4 +129,8 @@ const pr_classification = {
 	select_issue_classification,
 }
 
-export { pr_classification, CLASSIFICATION_LABELS, type ReleaseClassification }
+export { pr_classification }
+export {
+	RELEASE_CLASSIFICATION_NAMES as CLASSIFICATION_LABELS,
+	type ReleaseClassification,
+} from '#scripts/git/issue-labels'

package/scripts/git/issue-labels.ts

@@ -186,14 +186,16 @@ const DEPTH_LABELS: ReadonlyArray<{
 	},
 ]
 
-// What `josh start` provisions on a new repository so the first `kickoff` finds every label a run
-// applies with its intended color (joshuafolkken/kit#2197). The `epic` and `in-progress` metadata is
-// the one the workflow documents create them with; the labels only a person applies are left out.
-const WORKFLOW_LABELS: ReadonlyArray<{
+interface LabelDefinition {
 	name: string
 	color: string
 	description: string
-}> = [
+}
+
+// What `josh start` provisions on a new repository so the first `kickoff` finds every label a run
+// applies with its intended color (joshuafolkken/kit#2197). The `epic` and `in-progress` metadata is
+// the one the workflow documents create them with; the labels only a person applies are left out.
+const WORKFLOW_LABELS: ReadonlyArray<LabelDefinition> = [
 	{
 		name: EPIC_LABEL,
 		color: '5319e7',
@@ -214,6 +216,41 @@ const WORKFLOW_LABELS: ReadonlyArray<{
 	...DEPTH_LABELS,
 ]
 
+// The pull request release classifications `pr-classification.yml` requires exactly one of
+// (joshuafolkken/kit#2797). The check is distributed by `josh sync`, so the labels it asks for are
+// provisioned from this same list — a repository that never had them would otherwise fail the check
+// on every pull request that is not an `enhancement`.
+const BUGFIX_LABEL = 'bugfix'
+const OTHER_CHANGE_LABEL = 'other-change'
+const IGNORE_FOR_RELEASE_LABEL = 'ignore-for-release'
+const RELEASE_CLASSIFICATION_NAMES = [
+	BREAKING_CHANGE_LABEL,
+	ENHANCEMENT_LABEL,
+	BUGFIX_LABEL,
+	OTHER_CHANGE_LABEL,
+	IGNORE_FOR_RELEASE_LABEL,
+] as const
+type ReleaseClassification = (typeof RELEASE_CLASSIFICATION_NAMES)[number]
+
+const RELEASE_CLASSIFICATION_METADATA: Readonly<
+	Record<ReleaseClassification, Omit<LabelDefinition, 'name'>>
+> = {
+	[BREAKING_CHANGE_LABEL]: { color: 'd93f0b', description: 'Release: a breaking change (major)' },
+	[ENHANCEMENT_LABEL]: { color: '84b6eb', description: 'Release: a new feature (minor)' },
+	[BUGFIX_LABEL]: { color: 'd73a4a', description: 'Release: a bug fix (patch)' },
+	[OTHER_CHANGE_LABEL]: { color: 'c2e0c6', description: 'Release: any other change (patch)' },
+	[IGNORE_FOR_RELEASE_LABEL]: { color: 'cfd3d7', description: 'Release: left out of the notes' },
+}
+
+const RELEASE_CLASSIFICATION_LABELS: ReadonlyArray<LabelDefinition> =
+	RELEASE_CLASSIFICATION_NAMES.map((name) => ({ name, ...RELEASE_CLASSIFICATION_METADATA[name] }))
+
+// Every label kit provisions on a repository — `josh start` on a new one, `josh sync` on every run.
+const REPOSITORY_LABELS: ReadonlyArray<LabelDefinition> = [
+	...WORKFLOW_LABELS,
+	...RELEASE_CLASSIFICATION_LABELS,
+]
+
 // The shape `gh issue list --json labels` returns; narrowed here so the predicate below takes any
 // listing row without importing a schema.
 interface LabelReference {
@@ -295,13 +332,18 @@ const ALL_LABELS: ReadonlySet<string> = new Set([
 	DEPTH_0_LABEL,
 	DEPTH_1_LABEL,
 	DEPTH_2_LABEL,
+	BUGFIX_LABEL,
+	OTHER_CHANGE_LABEL,
+	IGNORE_FOR_RELEASE_LABEL,
 ])
 
+export type { LabelDefinition, ReleaseClassification }
 export {
 	ALL_LABELS,
 	ALREADY_DONE_LABEL,
 	AUTO_OK_LABEL,
 	BUG_LABEL,
+	BUGFIX_LABEL,
 	BREAKING_CHANGE_LABEL,
 	depth_label_of,
 	DEPTH_0_LABEL,
@@ -314,12 +356,17 @@ export {
 	FILING_ROUTE_LABELS,
 	has_any_label,
 	has_label_name,
+	IGNORE_FOR_RELEASE_LABEL,
 	IN_PROGRESS_LABEL,
 	INTERRUPT_ROUTE_LABEL,
 	label_name_of,
 	NEEDS_DECISION_LABEL,
 	NEEDS_HUMAN_REVIEW_LABEL,
 	NOT_DIRECTLY_RUNNABLE_LABELS,
+	OTHER_CHANGE_LABEL,
+	RELEASE_CLASSIFICATION_LABELS,
+	RELEASE_CLASSIFICATION_NAMES,
+	REPOSITORY_LABELS,
 	REVIEW_CAP_ROUTE_LABEL,
 	REVIEW_ROUND2_SKIPPED_LABEL,
 	RUN_LANE_LABEL,

package/scripts/init/init-bootstrap.ts

@@ -0,0 +1,92 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import path from 'node:path'
+import { z } from 'zod'
+import { init_install, type InstallStep } from './init-install'
+import { init_logic_workspace } from './init-logic-workspace'
+
+const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
+const NODE_MODULES = 'node_modules'
+const PACKAGE_JSON = 'package.json'
+// The static template lists exactly the build scripts kit's own dependency tree carries, which is
+// what installing kit alone needs approved (joshuafolkken/kit#2785).
+const KIT_BUILDS_TEMPLATE = 'templates/pnpm-workspace.static.yaml'
+const HANDOFF_FAILURE = 'josh init from the project-installed kit failed — see the output above'
+// Set on the handed-off run, so a kit that still does not find itself installed in the project — pnpm
+// put it somewhere else — stops instead of installing and handing off again without end.
+const HANDOFF_ENV = 'JOSH_INIT_HANDED_OFF'
+const REPEATED_HANDOFF = `the kit this project installed is not at ${NODE_MODULES}/${KIT_PACKAGE_NAME} — run \`pnpm exec josh init\` where it is`
+
+const dependency_fields_schema = z.looseObject({
+	dependencies: z.record(z.string(), z.string()).optional(),
+	devDependencies: z.record(z.string(), z.string()).optional(),
+})
+
+function real_directory(directory: string): string | undefined {
+	return existsSync(directory) ? realpathSync(directory) : undefined
+}
+
+// A `pnpm dlx` (or global) run executes whatever kit its cache held, which may be days behind the
+// registry — and `init` pins the kit it runs as, so a stale cache used to leave its version and its
+// templates in the project for good (joshuafolkken/kit#2794). Only the kit the project itself installs
+// does the setup. Compared by real path, so a global virtual store shared with the project still
+// reads as the project's own kit.
+function is_project_kit(package_directory: string, project_root: string): boolean {
+	const installed = real_directory(path.join(project_root, NODE_MODULES, KIT_PACKAGE_NAME))
+
+	return installed !== undefined && installed === real_directory(package_directory)
+}
+
+function kit_build_flags(template: string): Array<string> {
+	return [...init_logic_workspace.template_build_values(template)]
+		.filter(([, value]) => value === 'true')
+		.map(([name]) => `--allow-build=${name}`)
+}
+
+function has_kit_dependency(project_root: string): boolean {
+	const manifest_path = path.join(project_root, PACKAGE_JSON)
+	if (!existsSync(manifest_path)) return false
+	const parsed: unknown = JSON.parse(readFileSync(manifest_path, 'utf8'))
+	const manifest = dependency_fields_schema.parse(parsed)
+	const names = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies })
+
+	return names.includes(KIT_PACKAGE_NAME)
+}
+
+// A project that already lists kit keeps the version it chose; otherwise pnpm picks it, under the
+// project's own `minimumReleaseAge`, so the version installed is never the cache's decision.
+function kit_install_step(has_kit: boolean, template: string): InstallStep {
+	if (has_kit) return { label: 'pnpm install', command: 'pnpm', args: ['install'] }
+	const args = ['add', '-D', ...kit_build_flags(template), KIT_PACKAGE_NAME]
+
+	return { label: `pnpm ${args.join(' ')}`, command: 'pnpm', args }
+}
+
+function handoff_step(args: ReadonlyArray<string>): InstallStep {
+	const handoff_args = ['exec', 'josh', 'init', ...args]
+
+	return {
+		label: `pnpm ${handoff_args.join(' ')}`,
+		command: 'pnpm',
+		args: handoff_args,
+		env: { [HANDOFF_ENV]: '1' },
+	}
+}
+
+// Returns the failure to report, or undefined once the project-installed kit finished the setup.
+function hand_off(
+	package_directory: string,
+	project_root: string,
+	args: ReadonlyArray<string>,
+): string | undefined {
+	if (process.env[HANDOFF_ENV] !== undefined) return REPEATED_HANDOFF
+	console.info('\n🚀 Installing @joshuafolkken/kit into the project, then running its josh init')
+	const template = readFileSync(path.join(package_directory, KIT_BUILDS_TEMPLATE), 'utf8')
+	const install = kit_install_step(has_kit_dependency(project_root), template)
+	if (!init_install.did_step_succeed(install, project_root)) return `${install.label} failed`
+	if (!init_install.did_step_succeed(handoff_step(args), project_root)) return HANDOFF_FAILURE
+
+	return undefined
+}
+
+const init_bootstrap = { is_project_kit, kit_build_flags, hand_off }
+export { init_bootstrap }

package/scripts/init/init-install.ts

@@ -4,6 +4,7 @@ interface InstallStep {
 	label: string
 	command: string
 	args: ReadonlyArray<string>
+	env?: Readonly<Record<string, string>>
 }
 
 interface InstallRequest {
@@ -40,6 +41,7 @@ function did_step_succeed(step: InstallStep, project_root: string): boolean {
 	console.info(`\n$ ${step.label}`)
 	const result = execaSync(step.command, step.args, {
 		cwd: project_root,
+		env: step.env ?? {},
 		stdio: 'inherit',
 		reject: false,
 	})
@@ -60,5 +62,6 @@ function run_post_init_steps(project_root: string): string | undefined {
 	return undefined
 }
 
-const init_install = { NO_INSTALL_FLAG, split_install_flag, run_post_init_steps }
+const init_install = { NO_INSTALL_FLAG, split_install_flag, did_step_succeed, run_post_init_steps }
 export { init_install }
+export type { InstallStep }

package/scripts/init/init-logic-workspace.ts

@@ -138,6 +138,6 @@ function merge_workspace_yaml(existing: string, template: string): string {
 	return append_user_blocks(cleaned, new_keys, template)
 }
 
-const init_logic_workspace = { merge_workspace_yaml }
+const init_logic_workspace = { merge_workspace_yaml, template_build_values }
 
 export { init_logic_workspace }

package/scripts/init/init.ts

@@ -15,12 +15,13 @@ import { execaSync } from 'execa'
 import { z } from 'zod'
 import { init_actions, PRETTIER_CONFIG_JS, type FileAction } from './init-actions'
 import { init_ai_copy } from './init-ai-copy'
+import { init_bootstrap } from './init-bootstrap'
 import { init_install } from './init-install'
 import { init_logic } from './init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from './init-paths'
 import { init_static } from './init-static'
 import { plugin_install_hint_module } from './plugin-install-hint'
-import { project_profile, type ProjectShape } from './project-profile'
+import { project_profile, type ProjectProfile, type ProjectShape } from './project-profile'
 
 const PACKAGE_JSON = 'package.json'
 const KIT_PACKAGE_NAME = '@joshuafolkken/kit'
@@ -320,10 +321,18 @@ function finish_dependencies(shape: ProjectShape, is_install: boolean): void {
 	if (failure !== undefined) throw new Error(failure)
 }
 
-function main(args: ReadonlyArray<string> = []): void {
-	if (did_refuse_self_run(PACKAGE_DIR, PROJECT_ROOT)) return
-	const { is_install, rest } = init_install.split_install_flag(args)
-	const requested = project_profile.requested_profile(rest, INIT_USAGE)
+// A kit run from outside the project — `pnpm dlx`, a global install — sets nothing up itself: it
+// installs the project's kit and hands the whole run to that one (joshuafolkken/kit#2794). Under
+// `--no-install` nothing is installed, so the running kit does the setup as before.
+function did_hand_off(args: ReadonlyArray<string>): boolean {
+	if (init_bootstrap.is_project_kit(PACKAGE_DIR, PROJECT_ROOT)) return false
+	const failure = init_bootstrap.hand_off(PACKAGE_DIR, PROJECT_ROOT, args)
+	if (failure !== undefined) throw new Error(failure)
+
+	return true
+}
+
+function set_up_project(requested: ProjectProfile | undefined, is_install: boolean): void {
 	const shape = project_profile.inspect_project(PROJECT_ROOT, requested)
 
 	initialize_project(shape)
@@ -331,6 +340,15 @@ function main(args: ReadonlyArray<string> = []): void {
 	console.info('\n✅ Done.\n')
 }
 
+function main(args: ReadonlyArray<string> = []): void {
+	if (did_refuse_self_run(PACKAGE_DIR, PROJECT_ROOT)) return
+	const { is_install, rest } = init_install.split_install_flag(args)
+	// Validated before the hand-off, so a malformed invocation is refused before kit is installed.
+	const requested = project_profile.requested_profile(rest, INIT_USAGE)
+
+	if (!is_install || !did_hand_off(args)) set_up_project(requested, is_install)
+}
+
 function run_cli(args: ReadonlyArray<string>): void {
 	try {
 		main(args)

package/scripts/init/start-plan.ts

@@ -46,7 +46,7 @@ const STEP_LABELS: Readonly<Record<StartStep, string>> = {
 	initialize: 'Initialize kit (the same setup as josh init)',
 	commit: 'Commit every file as the initial commit',
 	repository: 'Create the GitHub repository and push main',
-	labels: 'Add the workflow labels the repository is missing',
+	labels: 'Add the workflow and release-classification labels the repository is missing',
 }
 
 function refused(refusal: string): StepPlan {

package/scripts/init/start-steps.ts

@@ -1,6 +1,6 @@
 import path from 'node:path'
 import { git_gh_exec } from '#scripts/git/git-gh-exec'
-import { WORKFLOW_LABELS } from '#scripts/git/issue-labels'
+import { repository_labels } from '#scripts/repo/repository-labels'
 import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
 import { execaSync } from 'execa'
 import { main as init_main } from './init'
@@ -14,10 +14,7 @@ interface StepContext {
 	visibility: Visibility
 }
 
-type WorkflowLabel = (typeof WORKFLOW_LABELS)[number]
-
 const DEFAULT_BRANCH = 'main'
-const LABELS_ENDPOINT = 'repos/{owner}/{repo}/labels'
 const GH_INSTALL_HINT =
 	'GitHub CLI (gh) is not installed. Install it from https://cli.github.com/, run gh auth login, then run josh start again. Nothing was changed.'
 const GH_AUTH_HINT =
@@ -100,29 +97,10 @@ function create_github_repository(context: StepContext): void {
 	run('gh', ['repo', 'create', name, visibility, ...source], context.root)
 }
 
-// Labels already present are left as they are — only the missing ones are created, so a repository
-// that recolored a label keeps its choice. GitHub compares label names case-insensitively.
-function missing_workflow_labels(existing: ReadonlyArray<string>): ReadonlyArray<WorkflowLabel> {
-	const names = new Set(existing.map((name) => name.toLowerCase()))
-
-	return WORKFLOW_LABELS.filter((label) => !names.has(label.name))
-}
-
-function create_label(label: WorkflowLabel, root: string): void {
-	const fields = [`name=${label.name}`, `color=${label.color}`, `description=${label.description}`]
-
-	run('gh', ['api', LABELS_ENDPOINT, ...fields.flatMap((field) => ['-f', field]), '--silent'], root)
-	console.info(`  ✔ label ${label.name}`)
-}
-
-function add_missing_labels(context: StepContext): void {
-	const listing = execaSync('gh', ['api', '--paginate', LABELS_ENDPOINT, '--jq', '.[].name'], {
-		...git_gh_exec.direct_environment(),
-		cwd: context.root,
-	})
-	const existing = listing.stdout.split('\n').filter((name) => name.length > 0)
-
-	for (const label of missing_workflow_labels(existing)) create_label(label, context.root)
+// The repository was created by the step before, so `gh` resolves the placeholder from the
+// directory `josh start` runs in, which is the root.
+function add_missing_labels(): void {
+	repository_labels.ensure_labels('{owner}/{repo}')
 }
 
 const STEP_ACTIONS: Readonly<Record<StartStep, (context: StepContext) => void>> = {
@@ -160,7 +138,6 @@ const start_steps = {
 	read_git_state,
 	github_cli_refusal,
 	self_run_refusal,
-	missing_workflow_labels,
 	run_steps,
 }
 export { start_steps }

package/scripts/repo/repository-labels.ts

@@ -0,0 +1,91 @@
+import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { REPOSITORY_LABELS, type LabelDefinition } from '#scripts/git/issue-labels'
+
+// Creates the labels kit's workflow and the distributed `pr-classification.yml` rely on, and only
+// those the repository is missing (joshuafolkken/kit#2797). The one place labels are created: `josh
+// start` provisions a new repository through it and `josh sync` brings every existing one up to date.
+//
+// Labels already present are left as they are, so a repository that recolored one keeps its choice
+// and a second run changes nothing. GitHub compares label names case-insensitively.
+//
+// **Never throws.** A token without the scope or no network must not stop a sync halfway; the names
+// still missing are printed instead, so the person can create them by hand.
+
+function labels_endpoint(repo: string): string {
+	return `repos/${repo}/labels`
+}
+
+// A failed request is an answer to report, never an exception to propagate (see above).
+function request(api: Parameters<typeof git_gh_exec.exec_gh_api_sync>[0]): string | undefined {
+	try {
+		return git_gh_exec.exec_gh_api_sync(api)
+	} catch {
+		return undefined
+	}
+}
+
+function read_existing(repo: string): ReadonlyArray<string> | undefined {
+	const path = labels_endpoint(repo)
+	const listing = request({ path, should_paginate: true, jq_filter: '.[].name' })
+
+	return listing?.split('\n').filter((name) => name.length > 0)
+}
+
+function missing_labels(existing: ReadonlyArray<string>): ReadonlyArray<LabelDefinition> {
+	const names = new Set(existing.map((name) => name.toLowerCase()))
+
+	return REPOSITORY_LABELS.filter((label) => !names.has(label.name.toLowerCase()))
+}
+
+function create_label(label: LabelDefinition, repo: string): boolean {
+	const body = JSON.stringify(label)
+	const is_created = request({ path: labels_endpoint(repo), method: 'POST', body }) !== undefined
+
+	if (is_created) console.info(`  ✔ label ${label.name}`)
+
+	return is_created
+}
+
+function label_names(labels: ReadonlyArray<LabelDefinition>): ReadonlyArray<string> {
+	return labels.map((label) => label.name)
+}
+
+// An unreadable listing is not an empty one: nothing is created, and every label is reported as
+// unconfirmed rather than as missing. An unresolved repository (no GitHub remote) is the same case.
+function unreadable(repo: string | undefined): ReadonlyArray<string> {
+	const names = label_names(REPOSITORY_LABELS)
+	const target = repo ?? 'this repository'
+
+	console.warn(
+		`  ⚠ could not read the labels of ${target}; make sure these exist: ${names.join(', ')}`,
+	)
+
+	return names
+}
+
+function create_missing(
+	missing: ReadonlyArray<LabelDefinition>,
+	repo: string,
+): ReadonlyArray<string> {
+	const names = label_names(missing.filter((label) => !create_label(label, repo)))
+
+	if (names.length > 0) {
+		console.warn(`  ⚠ could not create these labels; create them by hand: ${names.join(', ')}`)
+	}
+
+	return names
+}
+
+// The label names not confirmed present afterwards — empty when the repository has every one.
+function ensure_labels(repo: string | undefined): ReadonlyArray<string> {
+	if (repo === undefined) return unreadable(repo)
+
+	const existing = read_existing(repo)
+	if (existing === undefined) return unreadable(repo)
+
+	return create_missing(missing_labels(existing), repo)
+}
+
+const repository_labels = { missing_labels, ensure_labels }
+
+export { repository_labels }

package/scripts/run/run-entry-cli.ts

@@ -4,6 +4,7 @@ import { josh_command } from '#scripts/josh/josh-run'
 import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import { run_cut_report } from './run-cut-report'
 import { run_entry, type EntryParts } from './run-entry'
+import { run_halfrun_resume } from './run-halfrun-resume'
 import { run_hold_cli } from './run-hold-cli'
 import { run_next } from './run-next'
 import { run_prep } from './run-prep'
@@ -33,6 +34,7 @@ const NEWLINE = '\n'
 const HOLD_STOP_NOTE =
 	'(tree not held — see the reason above; clean up and retry, or release with `pnpm josh run:release`)'
 const COST_STOP_NOTE = '(session budget spent — see the figure above; resume in a fresh session)'
+const HALFRUN_RESUME_TOKEN = 'halfrun'
 
 // Exactly one issue number, or the call is refused — `run:entry` opens one run, and a second number
 // would claim and read a second issue a caller reads as this one's.
@@ -126,11 +128,33 @@ function resume_report(issue_number: string, resume: Resume): number {
 	return resume.code
 }
 
+// **A `halfrun` stopped before its commit is resumed, not claimed** (joshuafolkken/kit#2796): its hold
+// is kept over the verified diff, so the claim below would answer `busy` against it. The budget is asked
+// first, as for any run; then the hold is adopted and the run goes to the gate, skipping everything up
+// to and including implementation.
+async function resume_halfrun(issue_number: string): Promise<number> {
+	const cost = await check_cost()
+
+	if (cost === run_entry.COST_OVER) {
+		return stop_report(issue_number, HALFRUN_RESUME_TOKEN, cost, COST_STOP_NOTE)
+	}
+
+	if (!(await run_halfrun_resume.adopt(issue_number))) {
+		return stop_report(issue_number, run_hold_cli.BUSY_VERDICT, cost, HOLD_STOP_NOTE)
+	}
+
+	console.info(`entry #${issue_number} — resume: ${HALFRUN_RESUME_TOKEN}`)
+
+	return SUCCESS_EXIT_CODE
+}
+
 async function open_run(issue_number: string): Promise<number> {
 	const resume = await ask_resume(issue_number)
 
 	if (resume.token !== run_cut_report.FRESH_VERDICT) return resume_report(issue_number, resume)
 
+	if (await run_halfrun_resume.is_pending(issue_number)) return await resume_halfrun(issue_number)
+
 	const hold = await claim_hold(issue_number)
 
 	if (hold !== run_hold_cli.HOLD_VERDICT) {
@@ -162,7 +186,16 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const run_entry_cli = { SUCCESS_EXIT_CODE, USAGE, check_cost, claim_hold, main, parse_number, run }
+const run_entry_cli = {
+	HALFRUN_RESUME_TOKEN,
+	SUCCESS_EXIT_CODE,
+	USAGE,
+	check_cost,
+	claim_hold,
+	main,
+	parse_number,
+	run,
+}
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/run/run-halfrun-resume.ts

@@ -0,0 +1,104 @@
+import { run_hold, type HoldRead, type RunHold } from './run-hold'
+
+// joshuafolkken/kit#2796: a `halfrun` stops before its commit and **keeps** its hold, because the
+// uncommitted, hand-verified work is exactly what a second run would trample. The person then types
+// `fullrun #N` to ship it — and `run:entry`'s claim answered `busy` against that very hold, or, once the
+// hold had been cleared, the preflight advised stashing the verified diff away. The hand-off the
+// `halfrun` stop promised could not land, and each run improvised its own way past the guard.
+//
+// **The stop is recorded, never inferred.** A hold naming #N over a dirty tree is also what a `halfrun`
+// still implementing and a `backlogrun` child leave, and adopting either hands a half-written diff to
+// the gate and the merge. So the `halfrun` stop re-writes its own record with a stop mark
+// (`run:hold <N> --halfrun-stop`) — re-keying a `halfrun new`'s unnumbered record to the issue it filed —
+// and only a marked record is adopted. An expired one qualifies too, since a person may verify the next
+// day. The adopted record carries the `fullrun` mark instead, so the implementation-cut guard and
+// `run:cut --resume` read the tree as this `fullrun`'s from here on.
+
+const MARKED = 'marked'
+const FOREIGN = 'foreign'
+const UNREADABLE = 'unreadable'
+
+type StopMark = typeof FOREIGN | typeof MARKED | typeof UNREADABLE
+
+function hold_of(read: HoldRead): RunHold | undefined {
+	return read.kind === 'held' || read.kind === 'stale' ? read.hold : undefined
+}
+
+function is_halfrun_stop(read: HoldRead, issue: string, is_dirty: boolean): boolean {
+	const hold = hold_of(read)
+
+	return is_dirty && hold?.issue === issue && hold.is_halfrun_stop === true
+}
+
+// The stopping run's own record names its issue, or `new` when it entered as `halfrun new`; a free tree
+// is marked as well, since the work to protect is sitting in it either way.
+function is_own_record(read: HoldRead, issue: string): boolean {
+	const hold = hold_of(read)
+
+	return hold === undefined || hold.issue === issue || hold.issue === run_hold.UNNUMBERED_ISSUE
+}
+
+function mark_stop_at(target: string, issue: string): StopMark {
+	const read = run_hold.read_hold(target)
+
+	if (read.kind === 'unreadable') return UNREADABLE
+
+	if (!is_own_record(read, issue)) return FOREIGN
+
+	run_hold.release_hold(target)
+
+	return run_hold.create_halfrun_stop_hold(target, issue) ? MARKED : FOREIGN
+}
+
+// `false` leaves the record untouched, so the ordinary claim that follows decides the tree exactly as
+// it did before this resume existed.
+function adopt_at(target: string, issue: string, is_dirty: boolean): boolean {
+	if (!is_halfrun_stop(run_hold.read_hold(target), issue, is_dirty)) return false
+
+	run_hold.release_hold(target)
+
+	return run_hold.create_hold(target, issue, new Date(), true)
+}
+
+// **An unreadable git directory is no resume**, never a crash: `run:entry` must still print its one
+// summary line, and the ordinary claim that follows answers `unknown` for the same tree.
+async function hold_target(): Promise<string | undefined> {
+	try {
+		const directory = await run_hold.worktree_directory()
+
+		return directory === undefined ? undefined : run_hold.hold_path(directory)
+	} catch {
+		return undefined
+	}
+}
+
+// Read-only, so `run:entry` can ask the session budget before it takes anything over.
+async function is_pending(issue: string): Promise<boolean> {
+	const target = await hold_target()
+
+	if (target === undefined) return false
+
+	return is_halfrun_stop(run_hold.read_hold(target), issue, await run_hold.is_tree_dirty())
+}
+
+async function adopt(issue: string): Promise<boolean> {
+	const target = await hold_target()
+
+	if (target === undefined) return false
+
+	return adopt_at(target, issue, await run_hold.is_tree_dirty())
+}
+
+const run_halfrun_resume = {
+	FOREIGN,
+	MARKED,
+	UNREADABLE,
+	adopt,
+	adopt_at,
+	is_halfrun_stop,
+	is_pending,
+	mark_stop_at,
+}
+
+export type { StopMark }
+export { run_halfrun_resume }

package/scripts/run/run-hold-cli.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { run_halfrun_resume } from './run-halfrun-resume'
 import { run_hold, type HoldRead, type RunHold } from './run-hold'
 import { run_preflight, type PreflightDecision } from './run-preflight'
 import { run_tidy_cli } from './run-tidy-cli'
@@ -46,11 +47,12 @@ const FORCE_FLAG = '--force'
 // What `fullrun #N`'s entry claims with, so the record says the run is a `fullrun` — the one run whose
 // implementation cut outside a lane resumes as `fullrun #N` (joshuafolkken/kit#2760).
 const FULLRUN_FLAG = '--fullrun'
-// The most a claim reads: the issue number and the `--fullrun` flag after it.
+const HALFRUN_STOP_FLAG = '--halfrun-stop'
+// The most a claim reads: the issue number and the one flag after it.
 const MAX_CLAIM_ARGUMENTS = 2
 const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
 const USAGE =
-	'Usage: josh run:hold [<issue-number> [--fullrun]] | josh run:release [<issue-number> | --force]'
+	'Usage: josh run:hold [<issue-number> [--fullrun | --halfrun-stop]] | josh run:release [<issue-number> | --force]'
 
 const HOLD_VERDICT = 'hold'
 const BUSY_VERDICT = 'busy'
@@ -62,6 +64,7 @@ const NONE_VERDICT = 'none'
 const HELD_VERDICT = 'held'
 
 const FORCE_RELEASE_KIND = 'force-release'
+const HALFRUN_STOP_KIND = 'halfrun-stop'
 
 interface ClaimRequest {
 	kind: 'claim'
@@ -70,7 +73,10 @@ interface ClaimRequest {
 }
 
 type HoldRequest =
-	ClaimRequest | { kind: 'release'; claimant: string } | { kind: typeof FORCE_RELEASE_KIND }
+	| ClaimRequest
+	| { kind: 'release'; claimant: string }
+	| { kind: typeof FORCE_RELEASE_KIND }
+	| { kind: typeof HALFRUN_STOP_KIND; issue: string }
 
 const FORCE_RELEASE_REQUEST: HoldRequest = { kind: FORCE_RELEASE_KIND }
 
@@ -78,10 +84,13 @@ function release_request(claimant: string): HoldRequest {
 	return { kind: 'release', claimant }
 }
 
-// The flag after a numbered claim: absent, or `--fullrun`. Anything else is a usage error.
+// The flag after a numbered claim: absent, `--fullrun` or `--halfrun-stop`. Anything else is a usage
+// error.
 function numbered_claim(issue: string, flag: string | undefined): HoldRequest | undefined {
 	if (flag === undefined) return { kind: 'claim', issue }
 
+	if (flag === HALFRUN_STOP_FLAG) return { kind: HALFRUN_STOP_KIND, issue }
+
 	return flag === FULLRUN_FLAG ? { kind: 'claim', issue, is_fullrun: true } : undefined
 }
 
@@ -282,9 +291,23 @@ async function read_worktree(): Promise<string | undefined> {
 	}
 }
 
+// **A `halfrun` stop marks its own record** (joshuafolkken/kit#2796) — the positive "this run has ended
+// over its verified diff" that `run:entry` adopts on `fullrun #N`. Another run's record is left alone.
+function mark_halfrun_stop(target: string, issue: string): number {
+	const mark = run_halfrun_resume.mark_stop_at(target, issue)
+
+	if (mark === run_halfrun_resume.MARKED) return report_hold()
+
+	if (mark === run_halfrun_resume.UNREADABLE) return report_unknown()
+
+	return report_busy(run_hold.race_message(run_hold.read_hold(target), target))
+}
+
 async function dispatch(request: HoldRequest, target: string, is_linked: boolean): Promise<number> {
 	if (request.kind === 'claim') return await claim(target, request, is_linked)
 
+	if (request.kind === HALFRUN_STOP_KIND) return mark_halfrun_stop(target, request.issue)
+
 	if (request.kind === FORCE_RELEASE_KIND) return force_release(target)
 
 	return release(target, request.claimant)

package/scripts/run/run-hold.ts

@@ -48,6 +48,10 @@ interface RunHold {
 	// `backlogrun` child — which hold the tree just the same — must not be read as one. Optional and
 	// `| undefined` because a record written before this field existed is simply not a `fullrun`'s.
 	is_fullrun?: boolean | undefined
+	// Set only at a `halfrun`'s stop before commit (`run:hold <N> --halfrun-stop`, joshuafolkken/kit#2796):
+	// the positive record that the run has *ended* over its verified diff, which is what lets
+	// `fullrun #N` adopt the hold. A running `halfrun` or a `backlogrun` child never carries it.
+	is_halfrun_stop?: boolean | undefined
 }
 
 type HoldRead =
@@ -87,6 +91,7 @@ const run_hold_schema = z.object({
 	taken_at: z.string(),
 	pid: z.number(),
 	is_fullrun: z.boolean().optional(),
+	is_halfrun_stop: z.boolean().optional(),
 })
 
 // `undefined` for anything that is not a well-formed record, so the caller decides what a broken one
@@ -156,6 +161,11 @@ function create_hold(
 	return stamp_file.create_stamp(target, build_hold(issue, now, is_fullrun))
 }
 
+// The claim a `halfrun` stop leaves behind: the same exclusive create, carrying the stop mark.
+function create_halfrun_stop_hold(target: string, issue: string, now: Date = new Date()): boolean {
+	return stamp_file.create_stamp(target, { ...build_hold(issue, now), is_halfrun_stop: true })
+}
+
 // **A tree with uncommitted work in it is never handed over, however old its record is.** No age can
 // be chosen that covers a `halfrun` stop or a `needs-human-review` stop: those are held across a
 // person's latency rather than a run's, and the thing that must not be trampled is sitting in the
@@ -249,6 +259,7 @@ const run_hold = {
 	RELEASE_COMMAND,
 	UNNUMBERED_ISSUE,
 	classify,
+	create_halfrun_stop_hold,
 	create_hold,
 	describe_holder,
 	foreign_release_message,

package/scripts/security/security-audit.ts

@@ -86,10 +86,21 @@ function resolve_scanner(project_root: string, platform: string): ScannerChoice
 	return has_path_binary ? { path: BINARY_NAME, is_below_floor: true } : undefined
 }
 
+// **Output is forwarded, never handed the terminal itself.** osv-scanner is a Go binary that probes a
+// terminal on its stdout for its background color (an OSC 11 query followed by a cursor-position
+// request) and never reads the answers, so they sat in the terminal's input queue and surfaced at the
+// next shell prompt as `11;rgb:0101/0404/0909;1R` after a push ran this audit from the pre-push hook.
+// A pipe means the scanner sees no terminal and asks nothing; the `inherit` half still prints its report.
+// The fix belongs here, at the one command that asks, rather than on `git push`: piping the push would
+// make its timeout wait on any process a hook left running (joshuafolkken/kit#2801).
+const FORWARDED_OUTPUT = ['inherit', 'pipe'] as const
+
 function run_scanner(scanner_path: string): number {
 	const { LOCKFILE_PATH, build_scanner_arguments } = security_audit_logic
 	const result = execaSync(scanner_path, [...build_scanner_arguments(LOCKFILE_PATH)], {
-		stdio: 'inherit',
+		stdin: 'inherit',
+		stdout: FORWARDED_OUTPUT,
+		stderr: FORWARDED_OUTPUT,
 		reject: false,
 	})
 

package/scripts/sync/sync.ts

@@ -8,6 +8,7 @@ import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import { plugin_install_hint_module } from '#scripts/init/plugin-install-hint'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { repository_labels } from '#scripts/repo/repository-labels'
 import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { sonar_file } from '#scripts/security/sonar-file'
@@ -364,9 +365,14 @@ function sync_package_json_migrations(destination_path: string): void {
 // unless the repository allows auto-merge (joshuafolkken/kit#834). Neither ever fails the sync: both
 // are GitHub-side state, not synced artifacts. Unconditional, unlike `init`, because `sync`
 // overwrites both files on every run.
+//
+// The labels are the same kind of GitHub-side prerequisite, and one kit *can* write: the synced
+// `pr-classification.yml` requires one of the release classification labels, so the missing ones are
+// created here rather than reported (joshuafolkken/kit#2797).
 function report_repository_settings(name_with_owner: string | undefined): void {
 	security_updates.report_security_updates_section(name_with_owner)
 	auto_merge_setting.report_auto_merge_section(name_with_owner)
+	repository_labels.ensure_labels(name_with_owner)
 }
 
 function sync_project_artifacts(is_force: boolean): void {