@joshuafolkken/kit 1.972.0 → 1.983.0

package/scripts/run/run-halfrun-resume.ts

@@ -0,0 +1,104 @@
+import { run_hold, type HoldRead, type RunHold } from './run-hold'
+
+// joshuafolkken/kit#2796: a `halfrun` stops before its commit and **keeps** its hold, because the
+// uncommitted, hand-verified work is exactly what a second run would trample. The person then types
+// `fullrun #N` to ship it — and `run:entry`'s claim answered `busy` against that very hold, or, once the
+// hold had been cleared, the preflight advised stashing the verified diff away. The hand-off the
+// `halfrun` stop promised could not land, and each run improvised its own way past the guard.
+//
+// **The stop is recorded, never inferred.** A hold naming #N over a dirty tree is also what a `halfrun`
+// still implementing and a `backlogrun` child leave, and adopting either hands a half-written diff to
+// the gate and the merge. So the `halfrun` stop re-writes its own record with a stop mark
+// (`run:hold <N> --halfrun-stop`) — re-keying a `halfrun new`'s unnumbered record to the issue it filed —
+// and only a marked record is adopted. An expired one qualifies too, since a person may verify the next
+// day. The adopted record carries the `fullrun` mark instead, so the implementation-cut guard and
+// `run:cut --resume` read the tree as this `fullrun`'s from here on.
+
+const MARKED = 'marked'
+const FOREIGN = 'foreign'
+const UNREADABLE = 'unreadable'
+
+type StopMark = typeof FOREIGN | typeof MARKED | typeof UNREADABLE
+
+function hold_of(read: HoldRead): RunHold | undefined {
+	return read.kind === 'held' || read.kind === 'stale' ? read.hold : undefined
+}
+
+function is_halfrun_stop(read: HoldRead, issue: string, is_dirty: boolean): boolean {
+	const hold = hold_of(read)
+
+	return is_dirty && hold?.issue === issue && hold.is_halfrun_stop === true
+}
+
+// The stopping run's own record names its issue, or `new` when it entered as `halfrun new`; a free tree
+// is marked as well, since the work to protect is sitting in it either way.
+function is_own_record(read: HoldRead, issue: string): boolean {
+	const hold = hold_of(read)
+
+	return hold === undefined || hold.issue === issue || hold.issue === run_hold.UNNUMBERED_ISSUE
+}
+
+function mark_stop_at(target: string, issue: string): StopMark {
+	const read = run_hold.read_hold(target)
+
+	if (read.kind === 'unreadable') return UNREADABLE
+
+	if (!is_own_record(read, issue)) return FOREIGN
+
+	run_hold.release_hold(target)
+
+	return run_hold.create_halfrun_stop_hold(target, issue) ? MARKED : FOREIGN
+}
+
+// `false` leaves the record untouched, so the ordinary claim that follows decides the tree exactly as
+// it did before this resume existed.
+function adopt_at(target: string, issue: string, is_dirty: boolean): boolean {
+	if (!is_halfrun_stop(run_hold.read_hold(target), issue, is_dirty)) return false
+
+	run_hold.release_hold(target)
+
+	return run_hold.create_hold(target, issue, new Date(), true)
+}
+
+// **An unreadable git directory is no resume**, never a crash: `run:entry` must still print its one
+// summary line, and the ordinary claim that follows answers `unknown` for the same tree.
+async function hold_target(): Promise<string | undefined> {
+	try {
+		const directory = await run_hold.worktree_directory()
+
+		return directory === undefined ? undefined : run_hold.hold_path(directory)
+	} catch {
+		return undefined
+	}
+}
+
+// Read-only, so `run:entry` can ask the session budget before it takes anything over.
+async function is_pending(issue: string): Promise<boolean> {
+	const target = await hold_target()
+
+	if (target === undefined) return false
+
+	return is_halfrun_stop(run_hold.read_hold(target), issue, await run_hold.is_tree_dirty())
+}
+
+async function adopt(issue: string): Promise<boolean> {
+	const target = await hold_target()
+
+	if (target === undefined) return false
+
+	return adopt_at(target, issue, await run_hold.is_tree_dirty())
+}
+
+const run_halfrun_resume = {
+	FOREIGN,
+	MARKED,
+	UNREADABLE,
+	adopt,
+	adopt_at,
+	is_halfrun_stop,
+	is_pending,
+	mark_stop_at,
+}
+
+export type { StopMark }
+export { run_halfrun_resume }

package/scripts/run/run-hold-cli.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env tsx
 import { fileURLToPath } from 'node:url'
+import { run_halfrun_resume } from './run-halfrun-resume'
 import { run_hold, type HoldRead, type RunHold } from './run-hold'
 import { run_preflight, type PreflightDecision } from './run-preflight'
 import { run_tidy_cli } from './run-tidy-cli'
@@ -46,11 +47,12 @@ const FORCE_FLAG = '--force'
 // What `fullrun #N`'s entry claims with, so the record says the run is a `fullrun` — the one run whose
 // implementation cut outside a lane resumes as `fullrun #N` (joshuafolkken/kit#2760).
 const FULLRUN_FLAG = '--fullrun'
-// The most a claim reads: the issue number and the `--fullrun` flag after it.
+const HALFRUN_STOP_FLAG = '--halfrun-stop'
+// The most a claim reads: the issue number and the one flag after it.
 const MAX_CLAIM_ARGUMENTS = 2
 const ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/u
 const USAGE =
-	'Usage: josh run:hold [<issue-number> [--fullrun]] | josh run:release [<issue-number> | --force]'
+	'Usage: josh run:hold [<issue-number> [--fullrun | --halfrun-stop]] | josh run:release [<issue-number> | --force]'
 
 const HOLD_VERDICT = 'hold'
 const BUSY_VERDICT = 'busy'
@@ -62,6 +64,7 @@ const NONE_VERDICT = 'none'
 const HELD_VERDICT = 'held'
 
 const FORCE_RELEASE_KIND = 'force-release'
+const HALFRUN_STOP_KIND = 'halfrun-stop'
 
 interface ClaimRequest {
 	kind: 'claim'
@@ -70,7 +73,10 @@ interface ClaimRequest {
 }
 
 type HoldRequest =
-	ClaimRequest | { kind: 'release'; claimant: string } | { kind: typeof FORCE_RELEASE_KIND }
+	| ClaimRequest
+	| { kind: 'release'; claimant: string }
+	| { kind: typeof FORCE_RELEASE_KIND }
+	| { kind: typeof HALFRUN_STOP_KIND; issue: string }
 
 const FORCE_RELEASE_REQUEST: HoldRequest = { kind: FORCE_RELEASE_KIND }
 
@@ -78,10 +84,13 @@ function release_request(claimant: string): HoldRequest {
 	return { kind: 'release', claimant }
 }
 
-// The flag after a numbered claim: absent, or `--fullrun`. Anything else is a usage error.
+// The flag after a numbered claim: absent, `--fullrun` or `--halfrun-stop`. Anything else is a usage
+// error.
 function numbered_claim(issue: string, flag: string | undefined): HoldRequest | undefined {
 	if (flag === undefined) return { kind: 'claim', issue }
 
+	if (flag === HALFRUN_STOP_FLAG) return { kind: HALFRUN_STOP_KIND, issue }
+
 	return flag === FULLRUN_FLAG ? { kind: 'claim', issue, is_fullrun: true } : undefined
 }
 
@@ -282,9 +291,23 @@ async function read_worktree(): Promise<string | undefined> {
 	}
 }
 
+// **A `halfrun` stop marks its own record** (joshuafolkken/kit#2796) — the positive "this run has ended
+// over its verified diff" that `run:entry` adopts on `fullrun #N`. Another run's record is left alone.
+function mark_halfrun_stop(target: string, issue: string): number {
+	const mark = run_halfrun_resume.mark_stop_at(target, issue)
+
+	if (mark === run_halfrun_resume.MARKED) return report_hold()
+
+	if (mark === run_halfrun_resume.UNREADABLE) return report_unknown()
+
+	return report_busy(run_hold.race_message(run_hold.read_hold(target), target))
+}
+
 async function dispatch(request: HoldRequest, target: string, is_linked: boolean): Promise<number> {
 	if (request.kind === 'claim') return await claim(target, request, is_linked)
 
+	if (request.kind === HALFRUN_STOP_KIND) return mark_halfrun_stop(target, request.issue)
+
 	if (request.kind === FORCE_RELEASE_KIND) return force_release(target)
 
 	return release(target, request.claimant)

package/scripts/run/run-hold.ts

@@ -48,6 +48,10 @@ interface RunHold {
 	// `backlogrun` child — which hold the tree just the same — must not be read as one. Optional and
 	// `| undefined` because a record written before this field existed is simply not a `fullrun`'s.
 	is_fullrun?: boolean | undefined
+	// Set only at a `halfrun`'s stop before commit (`run:hold <N> --halfrun-stop`, joshuafolkken/kit#2796):
+	// the positive record that the run has *ended* over its verified diff, which is what lets
+	// `fullrun #N` adopt the hold. A running `halfrun` or a `backlogrun` child never carries it.
+	is_halfrun_stop?: boolean | undefined
 }
 
 type HoldRead =
@@ -87,6 +91,7 @@ const run_hold_schema = z.object({
 	taken_at: z.string(),
 	pid: z.number(),
 	is_fullrun: z.boolean().optional(),
+	is_halfrun_stop: z.boolean().optional(),
 })
 
 // `undefined` for anything that is not a well-formed record, so the caller decides what a broken one
@@ -156,6 +161,11 @@ function create_hold(
 	return stamp_file.create_stamp(target, build_hold(issue, now, is_fullrun))
 }
 
+// The claim a `halfrun` stop leaves behind: the same exclusive create, carrying the stop mark.
+function create_halfrun_stop_hold(target: string, issue: string, now: Date = new Date()): boolean {
+	return stamp_file.create_stamp(target, { ...build_hold(issue, now), is_halfrun_stop: true })
+}
+
 // **A tree with uncommitted work in it is never handed over, however old its record is.** No age can
 // be chosen that covers a `halfrun` stop or a `needs-human-review` stop: those are held across a
 // person's latency rather than a run's, and the thing that must not be trampled is sitting in the
@@ -249,6 +259,7 @@ const run_hold = {
 	RELEASE_COMMAND,
 	UNNUMBERED_ISSUE,
 	classify,
+	create_halfrun_stop_hold,
 	create_hold,
 	describe_holder,
 	foreign_release_message,

package/scripts/security/security-audit.ts

@@ -86,10 +86,21 @@ function resolve_scanner(project_root: string, platform: string): ScannerChoice
 	return has_path_binary ? { path: BINARY_NAME, is_below_floor: true } : undefined
 }
 
+// **Output is forwarded, never handed the terminal itself.** osv-scanner is a Go binary that probes a
+// terminal on its stdout for its background color (an OSC 11 query followed by a cursor-position
+// request) and never reads the answers, so they sat in the terminal's input queue and surfaced at the
+// next shell prompt as `11;rgb:0101/0404/0909;1R` after a push ran this audit from the pre-push hook.
+// A pipe means the scanner sees no terminal and asks nothing; the `inherit` half still prints its report.
+// The fix belongs here, at the one command that asks, rather than on `git push`: piping the push would
+// make its timeout wait on any process a hook left running (joshuafolkken/kit#2801).
+const FORWARDED_OUTPUT = ['inherit', 'pipe'] as const
+
 function run_scanner(scanner_path: string): number {
 	const { LOCKFILE_PATH, build_scanner_arguments } = security_audit_logic
 	const result = execaSync(scanner_path, [...build_scanner_arguments(LOCKFILE_PATH)], {
-		stdio: 'inherit',
+		stdin: 'inherit',
+		stdout: FORWARDED_OUTPUT,
+		stderr: FORWARDED_OUTPUT,
 		reject: false,
 	})
 

package/scripts/sync/sync.ts

@@ -8,6 +8,7 @@ import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import { plugin_install_hint_module } from '#scripts/init/plugin-install-hint'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { repository_labels } from '#scripts/repo/repository-labels'
 import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { sonar_file } from '#scripts/security/sonar-file'
@@ -364,9 +365,14 @@ function sync_package_json_migrations(destination_path: string): void {
 // unless the repository allows auto-merge (joshuafolkken/kit#834). Neither ever fails the sync: both
 // are GitHub-side state, not synced artifacts. Unconditional, unlike `init`, because `sync`
 // overwrites both files on every run.
+//
+// The labels are the same kind of GitHub-side prerequisite, and one kit *can* write: the synced
+// `pr-classification.yml` requires one of the release classification labels, so the missing ones are
+// created here rather than reported (joshuafolkken/kit#2797).
 function report_repository_settings(name_with_owner: string | undefined): void {
 	security_updates.report_security_updates_section(name_with_owner)
 	auto_merge_setting.report_auto_merge_section(name_with_owner)
+	repository_labels.ensure_labels(name_with_owner)
 }
 
 function sync_project_artifacts(is_force: boolean): void {

package/scripts/test/pilot-files.ts

@@ -320,7 +320,6 @@ const PILOT_FILES: ReadonlyArray<string> = [
 	'scripts/rules/issue-comments-rule.test.ts',
 	'scripts/rules/issue-depth-label.test.ts',
 	'scripts/rules/issue-fold.test.ts',
-	'scripts/rules/issue-scout.test.ts',
 	'scripts/rules/josh-git-bare.test.ts',
 	'scripts/rules/lane-interactive-ask-rule.test.ts',
 	'scripts/rules/lane-park-rule.test.ts',

package/scripts/version/fresh-metadata-cache.ts

@@ -0,0 +1,36 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+
+const CACHE_DIRECTORY_PREFIX = 'josh-latest-cache-'
+const CACHE_DIRECTORY_FLAG = '--config.cache-dir='
+
+// Points every stage at one metadata cache directory. pnpm keeps registry metadata there and the
+// package store elsewhere, so an empty one costs a metadata refetch, never a tarball download.
+function with_cache_directory(
+	stages: ReadonlyArray<ReadonlyArray<string>>,
+	cache_directory: string,
+): Array<Array<string>> {
+	return stages.map((stage) => [...stage, `${CACHE_DIRECTORY_FLAG}${cache_directory}`])
+}
+
+// A cached metadata file written through safe-chain lacks every version that was under 24 hours old
+// at the time, and with `minimumReleaseAge` set pnpm reuses a cache file younger than that age
+// instead of refetching it — so a version that has since aged in stays invisible for up to a day
+// (joshuafolkken/kit#2805). A fresh directory per run means nothing filtered earlier is ever read.
+function run_in_fresh_cache<T>(
+	stages: ReadonlyArray<ReadonlyArray<string>>,
+	run_stages: (stages: Array<Array<string>>) => T,
+): T {
+	const cache_directory = mkdtempSync(path.join(tmpdir(), CACHE_DIRECTORY_PREFIX))
+
+	try {
+		return run_stages(with_cache_directory(stages, cache_directory))
+	} finally {
+		rmSync(cache_directory, { recursive: true, force: true })
+	}
+}
+
+const fresh_metadata_cache = { with_cache_directory, run_in_fresh_cache }
+
+export { fresh_metadata_cache }

package/scripts/version/latest-update.ts

@@ -11,6 +11,7 @@ import { lockfile_overrides } from '#scripts/overrides/lockfile-overrides'
 import { overrides_files } from '#scripts/overrides/overrides-files'
 import { overrides_check } from '#scripts/overrides/overrides-logic'
 import { execaSync } from 'execa'
+import { fresh_metadata_cache } from './fresh-metadata-cache'
 import { latest_regression, type VersionRegression } from './latest-regression'
 import { preinstall_version_update } from './preinstall-version-update'
 
@@ -99,7 +100,7 @@ function find_regressions_after_update(snapshot: TreeSnapshot): Array<VersionReg
 // Exits zero: the tree is left exactly as it was found, nothing is broken, and every workflow that
 // runs `josh latest` in its preamble would otherwise stop for a situation that resolves itself.
 function update_without_downgrading(snapshot: TreeSnapshot): UpdateOutcome {
-	const status = run_update_stages(build_update_commands())
+	const status = fresh_metadata_cache.run_in_fresh_cache(build_update_commands(), run_update_stages)
 	if (status !== 0) return { status, is_rolled_back: false }
 
 	const regressions = find_regressions_after_update(snapshot)

package/scripts/rules/issue-bug-label.ts

@@ -1,85 +0,0 @@
-import { readFileSync } from 'node:fs'
-import path from 'node:path'
-import { issue_classification } from '#scripts/issue/issue-classification'
-import type { GuardRun } from '#scripts/josh/hook-decision'
-import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
-import { time_shell } from '#scripts/time-runtime/time-shell'
-import { bash_triggers } from './bash-triggers'
-import { issue_filing_args } from './issue-filing-args'
-import { shell_segments } from './shell-segments'
-import { tail_commands } from './tail-commands'
-
-const LINT_NAMES = new Set(['issue:lint'])
-const LINT_PATH = /\b(?:issue:lint|iln)\s+(?:'([^']+)'|"([^"]+)"|(\S+))/u
-
-function lint_argument(segment: string): string | undefined {
-	const [, single_quoted, double_quoted, bare] = LINT_PATH.exec(segment) ?? []
-
-	return single_quoted ?? double_quoted ?? bare
-}
-
-function latest_lint_path(tail: string): string | undefined {
-	const segments = tail_commands
-		.prior_bash_commands(tail)
-		.flatMap((command) => shell_segments.segments_of(command))
-	const lint = segments.findLast((segment) => shell_segments.is_josh_command(segment, LINT_NAMES))
-
-	return lint === undefined ? undefined : lint_argument(lint)
-}
-
-function linted_body(body_path: string): string | undefined {
-	try {
-		return readFileSync(body_path, 'utf8')
-	} catch {
-		return undefined
-	}
-}
-
-function matches_linted_file(command: string, lint_path: string): boolean {
-	const filing_path = issue_filing_args.body_file(command)
-
-	return filing_path !== undefined && path.resolve(filing_path) === path.resolve(lint_path)
-}
-
-function needs_classification_labels(command: string, tail: string): boolean {
-	const lint_path = latest_lint_path(tail)
-
-	if (lint_path === undefined) return false
-	const body = linted_body(lint_path)
-
-	if (body === undefined) return false
-
-	if (!matches_linted_file(command, lint_path) || issue_classification.problems(body).length > 0) {
-		return true
-	}
-
-	const expected = issue_classification.required_labels(body)
-
-	return issue_classification.CLASSIFICATION_LABELS.some(
-		(label) => expected.includes(label) !== issue_filing_args.has_label(command, label),
-	)
-}
-
-function decide(call: { input: unknown }, run: GuardRun): boolean {
-	const command = time_shell.bash_command(call.input)
-	const tail = time_density_hook.read_tail(run.transcript)
-
-	return needs_classification_labels(command, tail)
-}
-
-const ISSUE_CLASSIFICATION_REASON =
-	'⛔ issue classification mismatch: use the exact body file checked by `pnpm josh issue:lint` ' +
-	'in this creation call (`-F body=@<path>` or `gh issue create --body-file <path>`) and ' +
-	'apply exactly the `labels:` it reports (`bug`, `enhancement`, `breaking-change`). See ' +
-	'`prompts/collaboration-workflow/issue-template.md`.'
-
-const ROW = {
-	id: 'issue-bug-label',
-	is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
-	reason: ISSUE_CLASSIFICATION_REASON,
-	decide,
-}
-
-const issue_bug_label_rule = { ROW, latest_lint_path, needs_classification_labels }
-
-export { issue_bug_label_rule }

package/scripts/rules/issue-filing-args.ts

@@ -1,50 +0,0 @@
-const SHELL_WORD = /(?:[^\s'"]|'[^']*'|"[^"]*")+/gu
-const QUOTE = /['"]/gu
-const RAW_FIELDS = new Set(['-f', '--raw-field'])
-const FILE_FIELDS = new Set(['-F', '--field'])
-const LABEL_OPTIONS = new Set(['-l', '--label'])
-const BODY_FILE_OPTIONS = new Set(['--body-file'])
-const INLINE_BODY_OPTIONS = new Set(['-b', '--body'])
-const BODY_FILE_PREFIX = 'body=@'
-
-function words_of(command: string): Array<string> {
-	return [...command.matchAll(SHELL_WORD)].map((match) => match[0].replaceAll(QUOTE, ''))
-}
-
-function values_after(words: ReadonlyArray<string>, flags: ReadonlySet<string>): Array<string> {
-	return words.flatMap((word, index) => {
-		const value = words[index + 1]
-
-		return value !== undefined && flags.has(word) ? [value] : []
-	})
-}
-
-function has_inline_body(words: ReadonlyArray<string>): boolean {
-	const has_raw = values_after(words, RAW_FIELDS).some((value) => value.startsWith('body='))
-
-	return has_raw || values_after(words, INLINE_BODY_OPTIONS).length > 0
-}
-
-function body_file(command: string): string | undefined {
-	const words = words_of(command)
-	const fields = values_after(words, FILE_FIELDS).filter((value) => value.startsWith('body='))
-	const options = values_after(words, BODY_FILE_OPTIONS)
-
-	if (has_inline_body(words) || fields.length + options.length !== 1) return undefined
-
-	return fields[0]?.startsWith(BODY_FILE_PREFIX)
-		? fields[0].slice(BODY_FILE_PREFIX.length)
-		: options[0]
-}
-
-function has_label(command: string, label: string): boolean {
-	const words = words_of(command)
-	const fields = [...values_after(words, RAW_FIELDS), ...values_after(words, FILE_FIELDS)]
-	const options = values_after(words, LABEL_OPTIONS).flatMap((value) => value.split(','))
-
-	return fields.includes(`labels[]=${label}`) || options.includes(label)
-}
-
-const issue_filing_args = { body_file, has_label, words_of }
-
-export { issue_filing_args }

package/scripts/rules/issue-scout.ts

@@ -1,64 +0,0 @@
-import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
-import { bash_triggers } from './bash-triggers'
-import { shell_segments } from './shell-segments'
-import { tail_commands } from './tail-commands'
-
-// The trigger and the delivered text behind the `issue-scout` row of `delivered-rules.ts`
-// (joshuafolkken/kit#2119).
-//
-// **A filing without `pnpm josh issue:scout` in front of it, refused at the filing itself.** §2e
-// requires the scout before every `gh api … issues` call, and a duplicate is likeliest for the work
-// that just finished — the one case self-restraint is least able to catch. The input is mechanical —
-// did the run already run the scout — so it is a delivered rule rather than resident prose.
-//
-// **It is `issue-comments`'s shape, not the WIP cap's.** Like that row it is once per run with an
-// `already_satisfied` stand-down read off the tail, and the refusal hands over the command rather than
-// asking the run to "scout first" — a body-only read is refused so the reissue makes the comments
-// present, and here a scout-less filing is refused so the reissue makes the scout present. **No new
-// delivery path**: the trigger is `bash_triggers.is_issue_filing`, reused verbatim.
-
-// `pnpm josh issue:scout`, the one act the rule asks for. The alias `isc` is expanded where the
-// command is read, so the canonical name matches both spellings (joshuafolkken/kit#1789).
-const SCOUT_NAMES: ReadonlySet<string> = new Set(['issue:scout'])
-
-// Keeping the rule: a call that runs the scout. Segment-wise, so a spelling quoted inside a filing's
-// own body is not read as the scout that filing skipped.
-function runs_the_scout(command: string): boolean {
-	return shell_segments
-		.segments_of(command)
-		.some((segment) => shell_segments.is_josh_command(segment, SCOUT_NAMES))
-}
-
-// The `already_satisfied` stand-down: the run has already scouted, so this filing asks for nothing new.
-// The tool-name gate the row's trigger applies has already passed, so `call` only marks the shape; the
-// answer is entirely in the tail.
-function already_scouted(tail: string, _call: GuardedCall): boolean {
-	return tail_commands.prior_bash_commands(tail).some((command) => runs_the_scout(command))
-}
-
-// The instruction in the shape a refusal can carry: what the call skipped, why it matters most here,
-// and the command that fixes it. The duplicate risk is named because it is the half that makes the
-// rule believable — the filing most likely to duplicate is the one about work that just finished.
-const ISSUE_SCOUT_REASON =
-	'⛔ issue scout: this files an Issue with no `pnpm josh issue:scout` earlier in the run. A ' +
-	'duplicate is likeliest for the work that just finished, which is exactly where self-restraint is ' +
-	'weakest. Reissue after scouting: `pnpm josh issue:scout "<title>"` (add `--body "<one-line ' +
-	'summary, citing #N where the work follows one>"` so the epic half can answer), then read its ' +
-	'`Duplicates:` — an **open** candidate covering the same work stops the run rather than filing a ' +
-	'second Issue, and a `(closed)` one means the work is already done — before reissuing this filing. ' +
-	'The procedure is `.claude/skills/workflow-commands/SKILL.md` → §2e. It fires once per run and ' +
-	'cannot repeat on the call in hand.'
-
-// The enumeration row itself, so `delivered-rules.ts` spreads one entry rather than restating the
-// trigger and reason it already single-sources here. Once per run with the stand-down above.
-const ROW = {
-	id: 'issue-scout',
-	is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
-	reason: ISSUE_SCOUT_REASON,
-	already_satisfied: already_scouted,
-	keeps: bash_triggers.on_bash_command(runs_the_scout),
-}
-
-const issue_scout = { ISSUE_SCOUT_REASON, ROW, already_scouted, runs_the_scout }
-
-export { issue_scout }