@joshuafolkken/kit 1.978.0 → 1.983.0

package/scripts/rules/bash-triggers.ts

@@ -1,12 +1,12 @@
 import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
 import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { time_shell } from '#scripts/time-runtime/time-shell'
+import { shell_segments } from './shell-segments'
 
-// The two trigger helpers the enumeration in `delivered-rules.ts` is built from, held here so a rule
+// The trigger helpers the enumeration in `delivered-rules.ts` is built from, held here so a rule
 // that lives in its own module can build its own row without importing the enumeration back
-// (joshuafolkken/kit#2119). `is_issue_filing` is the one three rows now share — the WIP cap, the scout
-// gate and the per-run filing cap — so it could not stay a private function of the file that spreads
-// their rows.
+// (joshuafolkken/kit#2119). `is_issue_filing` is the one three rows share — the WIP cap, the per-run
+// filing cap and the fold — so it could not stay a private function of the file that spreads their rows.
 
 // **Only `Bash`, and the omission is deliberate** (joshuafolkken/kit#1390): Claude Code denies one
 // call of a turn and runs the rest, so a refused `Edit` would leave its siblings applied and itself
@@ -33,12 +33,25 @@ const ISSUES_ENDPOINT = /repos\/[^\s'"]*\/issues(?=$|["'\s])/u
 // that limit is recorded beside the non-`gh` one in `prompts/collaboration-workflow/rule-delivery.md`.
 const TITLE_FIELD = /(?:-f|-F|--field|--raw-field)\s*'?title=/u
 
-function is_issue_filing(command: string): boolean {
+// A filing made by hand rather than through `josh issue:file` — the call the `direct-filing` row
+// refuses on every occurrence (joshuafolkken/kit#2808).
+function is_direct_filing(command: string): boolean {
 	if (ISSUE_CREATE_COMMAND.test(command)) return true
 
 	return ISSUES_ENDPOINT.test(command) && TITLE_FIELD.test(command)
 }
 
-const bash_triggers = { is_issue_filing, on_bash_command }
+// `pnpm josh issue:file`, in either spelling — **the** filing act once a direct one is refused, so the
+// run-level filing rows (the WIP cap, the per-run cap, the fold) trigger on it. Segment-wise, so a
+// spelling quoted inside another command's body is not read as a filing.
+const FILING_NAMES: ReadonlySet<string> = new Set(['issue:file'])
+
+function is_issue_filing(command: string): boolean {
+	return shell_segments
+		.segments_of(command)
+		.some((segment) => shell_segments.is_josh_command(segment, FILING_NAMES))
+}
+
+const bash_triggers = { is_direct_filing, is_issue_filing, on_bash_command }
 
 export { bash_triggers }

package/scripts/rules/delivered-rules.ts

@@ -3,15 +3,14 @@ import { hook_decision, type GuardRun, type TranscriptGuardSpec } from '#scripts
 import { lane_guard_policy } from '#scripts/lane/lane-guard-policy'
 import { time_batch_guard, type GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { bash_triggers } from './bash-triggers'
+import { direct_filing } from './direct-filing'
 import { early_heartbeat } from './early-heartbeat'
 import { file_body } from './file-body'
 import { filing_cap } from './filing-cap'
 import { gh_api } from './gh-api'
 import { git_force } from './git-force'
 import { implementation_cut } from './implementation-cut'
-import { issue_bug_label_rule } from './issue-bug-label'
 import { issue_fold } from './issue-fold'
-import { issue_scout } from './issue-scout'
 import { josh_git_bare } from './josh-git-bare'
 import { lane_background } from './lane-background'
 import { lane_carry_conflict } from './lane-carry-conflict'
@@ -135,9 +134,9 @@ type MeasuredRule = Omit<DeliveredRule, 'is_trigger'> & {
 const STAMP_PREFIX = 'josh-rule-guard-'
 
 // **`is_issue_filing` and `on_bash_command` moved to `bash-triggers.ts`** (joshuafolkken/kit#2119):
-// three rows now share the filing trigger — the WIP cap, the scout gate and the per-run filing cap —
-// and the last two live in their own modules, which could not import the enumeration back to reach a
-// private function of it. `on_bash_command` went with it because those modules build their own rows.
+// three rows share the filing trigger — the WIP cap, the per-run filing cap and the fold — and the
+// last two live in their own modules, which could not import the enumeration back to reach a private
+// function of it. `on_bash_command` went with it because those modules build their own rows.
 const { is_issue_filing, on_bash_command } = bash_triggers
 
 // The whole of the WIP cap, in the shape a refusal can carry: the count, the refusal, the two
@@ -239,8 +238,8 @@ const ISSUE_COMMENTS_REASON =
 	"except for two answers that are not the run's to make: work a comment reassigns to another " +
 	'Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a ' +
 	'reason to exist stops the run with a `confirmation` Telegram. The procedure is ' +
-	'`.claude/skills/workflow-commands/SKILL.md` → "An Issue\'s comments are part of the Issue". It ' +
-	'fires once per run and cannot repeat on the call in hand.'
+	'`.claude/skills/workflow-commands/SKILL.md` → "An Issue\'s comments are part of the Issue". ' +
+	'Every body-only read is refused until the comments are read.'
 
 // The reading of the call itself — which spellings carry a body inline, and what the shell does to
 // the value — is `shell-body-trigger.ts`, beside its own cases, as is the refusal text. A row states
@@ -295,26 +294,24 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	// before any of those speak; on a first-party filing it is silent (the owners match), so `wip-cap`
 	// still speaks first, exactly as before. It fires on every occurrence (`git-force.ts`).
 	third_party_write.ROW,
+	// **A hand-built filing is refused on every occurrence** (joshuafolkken/kit#2808) and pointed at
+	// `josh issue:file`, which runs the scout, the lint, the labels, the `## Origin` check and
+	// `epic:bundle` itself. It claims the direct call only, so the rows below — which trigger on the
+	// `issue:file` call — never overlap it.
+	direct_filing.ROW,
 	{
 		id: 'wip-cap',
 		is_trigger: on_bash_command(is_issue_filing),
 		reason: WIP_CAP_REASON,
 		keeps: on_bash_command(counts_open_issues),
 	},
-	// **Three rows share the filing trigger** (joshuafolkken/kit#2119), listed after `wip-cap` so the
-	// backlog count still speaks first: `issue-scout` refuses a filing the run has not scouted (once per
-	// run, stood down once the scout is on the tail), and `filing-cap` refuses every filing past the
-	// per-run ceiling. Each is a real instance of the admissible overlap the comment on `delivery`
-	// describes — the losing rule's delivery is still correct one reissue later — so a scout-less,
-	// over-cap filing is delivered `wip-cap`, then `issue-scout`, then `filing-cap` across its reissues.
-	issue_scout.ROW,
+	// **Two more rows share the filing trigger** (joshuafolkken/kit#2119, joshuafolkken/kit#2213), listed
+	// after `wip-cap` so the backlog count still speaks first: `filing-cap` refuses every filing past
+	// the per-run ceiling, and `issue-fold` refuses a *second* filing the run has not folded. Each is a
+	// real instance of the admissible overlap the comment on `delivery` describes — the losing rule's
+	// delivery is still correct one reissue later — so an unfolded, over-cap second filing is delivered
+	// `wip-cap`, then `filing-cap`, then `issue-fold` across its reissues.
 	filing_cap.ROW,
-	// **`issue-fold` shares the same filing trigger** (joshuafolkken/kit#2213), listed after
-	// `filing-cap`: it refuses a *second* filing the run has not folded, once per run, stood down off
-	// the tail when the run has already folded or has filed nothing earlier. It is another instance of
-	// the admissible overlap — the losing rule's delivery is still correct one reissue later — so a
-	// scout-less, unfolded, over-cap second filing is delivered `wip-cap`, then `issue-scout`, then
-	// `filing-cap`, then `issue-fold` across its reissues.
 	issue_fold.ROW,
 	{
 		id: 'issue-comments',
@@ -541,13 +538,9 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	rule_body_guard.ROW,
 	// **The generic oracle-consulted rows, one per oracle that declared a firing point**
 	// (joshuafolkken/kit#2324). Each refuses the action the oracle governs when the run has not run that
-	// oracle's command first, stood down once it has — `issue-scout`'s shape read from the registry
-	// rather than hand-written. Listed last so an oracle whose firing point overlaps a filing
-	// (`issue:lint`) delivers on the reissue, after `wip-cap` / `issue-scout` / `filing-cap` /
-	// `issue-fold` have each had their turn. The non-overlapping firing point (`pkg:scout` on a package
-	// add) claims a command no row above matches.
+	// oracle's command first, stood down once it has. Listed last; the one firing point left
+	// (`pkg:scout` on a package add) claims a command no row above matches.
 	...oracle_consulted.ROWS,
-	issue_bug_label_rule.ROW,
 ]
 
 // A turn that issued more than this many calls is a turn that batched. The guard counts turns that
@@ -703,10 +696,13 @@ function is_first_delivery(
 // **It is a trade, and the other side is named rather than hidden**: an arm allowed inside that window
 // that really does run is not recorded either, so a second one before it fires goes uncaught. A missing
 // record loses one detection; a wrong one blocks every arm until it expires.
-// **Both extras hang off `is_first_delivery`, and a row declares at most one.** `decide` is for a
-// recurring rule (joshuafolkken/kit#1570); `already_satisfied` is for a once-per-run rule the run can
-// satisfy earlier (joshuafolkken/kit#1905), where the earlier act stands the delivery down before the
-// once-per-run record is spent. A row with neither takes `is_first_delivery` unchanged.
+// **Both extras replace `is_first_delivery`, and a row declares at most one.** `decide` is for a
+// recurring rule (joshuafolkken/kit#1570); `already_satisfied` is for a precondition the run satisfies
+// with an earlier act (joshuafolkken/kit#1905), and that act is the only way past it: the row refuses
+// every candidate call until the act is on the tail (joshuafolkken/kit#2807). Once per run, the
+// reissue went through with the precondition still unmet — a guard that passed precisely the run that
+// skipped the procedure. Repeating cannot wedge a run that obeys, because the stand-down answers first.
+// A row with neither takes `is_first_delivery` unchanged.
 function delivery_decision(rule: DeliveredRule): TranscriptGuardSpec['should_block'] {
 	const { decide, already_satisfied } = rule
 
@@ -719,7 +715,7 @@ function delivery_decision(rule: DeliveredRule): TranscriptGuardSpec['should_blo
 		run: GuardRun,
 	): boolean {
 		if (already_satisfied?.(tail, call) === true) return false
-		if (decide === undefined) return is_first_delivery(tail, call, delivered_at_ms, run)
+		if (decide === undefined) return true
 
 		return decide(call, run, !will_batch_guard_refuse(tail, call, run), delivered_at_ms)
 	}
@@ -776,11 +772,11 @@ const delivered_rules = {
 	DELIVERED_RULES,
 	EARLY_HEARTBEAT_REASON: early_heartbeat.EARLY_HEARTBEAT_REASON,
 	FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+	DIRECT_FILING_REASON: direct_filing.DIRECT_FILING_REASON,
 	FILING_CAP_REASON: filing_cap.FILING_CAP_REASON,
 	GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
 	ISSUE_COMMENTS_REASON,
 	ISSUE_FOLD_REASON: issue_fold.ISSUE_FOLD_REASON,
-	ISSUE_SCOUT_REASON: issue_scout.ISSUE_SCOUT_REASON,
 	LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,
 	LANE_PARK_REASON: lane_park.LANE_PARK_REASON,
 	MEASURED_RULES,

package/scripts/rules/direct-filing.ts

@@ -0,0 +1,38 @@
+import { bash_triggers } from './bash-triggers'
+
+// The `direct-filing` row of `delivered-rules.ts` (joshuafolkken/kit#2808). Filing an Issue owes a
+// duplicate scout, a body lint, the classification / depth / `route:` labels, a `## Origin` on a
+// cross-repository filing and an `epic:bundle` afterwards — steps spread over as many documents, each
+// with its own guard, and joshuafolkken/kit#2805 ran two of them and skipped the rest. `josh issue:file`
+// runs them all in one command, so a hand-built `gh api …/issues` / `gh issue create` filing is refused
+// outright and pointed there; the step-by-step guards that used to sit on the direct call went with it.
+
+const DIRECT_FILING_REASON =
+	'⛔ direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> ' +
+	'--depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api …/issues` ' +
+	'or `gh issue create`. The command runs every filing step in order — the duplicate scout, the body ' +
+	'lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing ' +
+	'into another repository, and `epic:bundle` after the create — so none of them is a step to remember. ' +
+	'When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,…>` ' +
+	'for the ones that are separate deliverables. Reference: `docs/josh-commands.md` → "`josh issue:file`". ' +
+	'**This rule fires on every occurrence, not once per run.**'
+
+function is_any_filing(command: string): boolean {
+	return bash_triggers.is_direct_filing(command) || bash_triggers.is_issue_filing(command)
+}
+
+// `decide` returns true so it refuses every occurrence. Keeping the rule is filing through the command;
+// the trigger is the violation itself, so the occasion it governs is a filing in either spelling
+// (`reaches`, the `run-tail` shape).
+const ROW = {
+	id: 'direct-filing',
+	is_trigger: bash_triggers.on_bash_command(bash_triggers.is_direct_filing),
+	reason: DIRECT_FILING_REASON,
+	decide: (): boolean => true,
+	keeps: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
+	reaches: bash_triggers.on_bash_command(is_any_filing),
+}
+
+const direct_filing = { DIRECT_FILING_REASON, ROW }
+
+export { direct_filing }

package/scripts/rules/filing-cap.ts

@@ -21,7 +21,9 @@ import { tail_commands } from './tail-commands'
 // **A guard-refused filing does not count.** Claude Code writes a denied call to the transcript as a
 // `tool_use` block with an errored `tool_result`, so the WIP cap's own reissue would otherwise
 // double-count one Issue — the same exclusion `investigation-reads.ts` makes for a refused read
-// (joshuafolkken/kit#1764). The filing is counted only where its result carried no guard refusal.
+// (joshuafolkken/kit#1764). **Nor does one `issue:file` held itself** (joshuafolkken/kit#2808): a lint
+// problem or an unacknowledged duplicate exits non-zero having filed nothing, and the reissue is the
+// same Issue. The filing is counted only where its result did not fail.
 
 const FILING_CAP = 10
 // The current call is not yet on the tail, so the count read there is of filings *already* made. At
@@ -31,8 +33,9 @@ const CAP_REACHED = FILING_CAP
 interface TailFilings {
 	// The `tool_use` id of every filing on the tail.
 	filing_ids: Array<string>
-	// Each result's id mapped to the guard that refused it, and `''` for a result no guard refused.
-	refusals: Map<string, string>
+	// The id of every result that came back as a failure — a guard refusal, or `issue:file` holding the
+	// filing itself (a lint problem, an unacknowledged duplicate), which files nothing either.
+	failures: Set<string>
 }
 
 function is_filing_use(block: Block): boolean {
@@ -42,7 +45,7 @@ function is_filing_use(block: Block): boolean {
 }
 
 function collect_block(block: Block, found: TailFilings): void {
-	if (block.result_id !== '') found.refusals.set(block.result_id, block.refusal_guard)
+	if (block.result_id !== '' && block.is_error === true) found.failures.add(block.result_id)
 	if (is_filing_use(block)) found.filing_ids.push(block.id)
 }
 
@@ -55,18 +58,18 @@ function collect_line(line: string, found: TailFilings): void {
 }
 
 function scan_tail(tail: string): TailFilings {
-	const found: TailFilings = { filing_ids: [], refusals: new Map<string, string>() }
+	const found: TailFilings = { filing_ids: [], failures: new Set<string>() }
 
 	for (const line of tail.split('\n')) collect_line(line, found)
 
 	return found
 }
 
-// How many Issues the run has already filed, counting only filings no guard refused.
+// How many Issues the run has already filed, counting only filings whose result did not fail.
 function prior_filing_count(tail: string): number {
-	const { filing_ids, refusals } = scan_tail(tail)
+	const { filing_ids, failures } = scan_tail(tail)
 
-	return filing_ids.filter((id) => (refusals.get(id) ?? '') === '').length
+	return filing_ids.filter((id) => !failures.has(id)).length
 }
 
 // A person's prompt: a `user` line carrying no tool result. Tool results ride `user` lines too, so the

package/scripts/rules/issue-fold.ts

@@ -15,8 +15,8 @@ import { tail_commands } from './tail-commands'
 // binds. The input is mechanical — has the run filed before, did it fold — so it is a delivered rule
 // rather than resident prose.
 //
-// **It is `issue-scout`'s shape, not `filing-cap`'s.** Once per run with an `already_satisfied`
-// stand-down read off the tail: a filing with no prior filing is stood down (nothing to fold), and so
+// **It is `issue-scout`'s shape, not `filing-cap`'s.** Refused until an `already_satisfied`
+// stand-down read off the tail answers: a filing with no prior filing is stood down (nothing to fold), and so
 // is one the run has already folded. The refusal hands over the command rather than asking the run to
 // "fold first". **No new predicate**: the filing trigger is `bash_triggers.is_issue_filing`, and the
 // prior-filing count is `filing_cap.prior_filing_count`, both reused verbatim.
@@ -55,8 +55,8 @@ const ISSUE_FOLD_REASON =
 	'"<title>" …` — `fold` means file one Issue covering them, `separate` means file them apart ' +
 	'(separable findings whose combined size clears the split guide), and the default is `fold`. Add ' +
 	'`--not-separable` when they are really one deliverable. The procedure is ' +
-	'`.claude/skills/workflow-commands/split-assessment.md` → "The question". It fires once per run ' +
-	'and cannot repeat on the call in hand.'
+	'`.claude/skills/workflow-commands/split-assessment.md` → "The question". Every later filing is ' +
+	'refused until the fold is on the transcript.'
 
 // The enumeration row itself, so `delivered-rules.ts` spreads one entry rather than restating the
 // trigger and reason it already single-sources here. Once per run with the stand-down above.

package/scripts/rules/oracle-consulted.ts

@@ -11,8 +11,8 @@ import { tail_commands } from './tail-commands'
 // `DeliveredRule` for each such oracle — refused when the run performs the governed action without
 // having run the oracle's command earlier, stood down once it has.
 //
-// **It is `issue-scout`'s shape, generalized.** Each generated row is once per run with an
-// `already_satisfied` stand-down read off the tail — refuse the governed call, hand back the command,
+// **It is `issue-scout`'s shape, generalized.** Each generated row refuses until its
+// `already_satisfied` stand-down reads the command off the tail — refuse the governed call, hand back the command,
 // stand down once that command is on the tail. What `issue-scout` and `issue-fold` hand-wrote per
 // oracle, this reads from the registry: the refusal is assembled from the oracle's decision, command,
 // answer vocabulary and single source, so no oracle carries a hand-written refusal of its own. **No new
@@ -51,8 +51,8 @@ function reason_for(oracle: Oracle, firing_point: FiringPoint): string {
 		`⛔ decision oracle not consulted: this is ${firing_point.describes}, but the run has not run ` +
 		`\`${command_line(oracle)}\` first — the oracle that decides ${oracle.decision.toLowerCase()}. ` +
 		`It answers ${oracle.vocabulary.join(' | ')}; single source ${oracle.single_source}. Reissue ` +
-		`after running it and reading its verdict. It fires once per run and cannot repeat on the call ` +
-		`in hand.`
+		`after running it and reading its verdict. Every such call is refused until that command is on ` +
+		`the transcript.`
 	)
 }
 

package/scripts/rules/oracle-firing.ts

@@ -1,4 +1,3 @@
-import { bash_triggers } from './bash-triggers'
 import { decision_oracle } from './decision-oracle'
 import { shell_segments } from './shell-segments'
 
@@ -32,9 +31,10 @@ function is_package_add(command: string): boolean {
 	return shell_segments.segments_of(command).some((segment) => PACKAGE_ADD.test(segment))
 }
 
-// The two firing points wired — the oracles whose governed call can be named without guessing: the
-// package add and the Issue filing. The rest declare why none can be named, so the unenforced oracles
-// are visible rather than silently missing.
+// The firing point wired — the oracle whose governed call can be named without guessing: the package
+// add. The Issue filing's `issue:lint` point left with joshuafolkken/kit#2808, when `josh issue:file`
+// began running the lint itself. The rest declare why none can be named, so the unenforced oracles are
+// visible rather than silently missing.
 const FIRING: ReadonlyMap<string, FiringPoint> = new Map([
 	[
 		'pkg:scout',
@@ -43,13 +43,6 @@ const FIRING: ReadonlyMap<string, FiringPoint> = new Map([
 			governs: is_package_add,
 		},
 	],
-	[
-		'issue:lint',
-		{
-			describes: 'an Issue-filing call (`gh api …/issues`, `gh issue create`)',
-			governs: bash_triggers.is_issue_filing,
-		},
-	],
 ])
 
 // The reason an oracle names no firing point, in three recurring shapes plus the one-off reasons for
@@ -66,9 +59,12 @@ const SELF = 'the command is itself the governed act; there is no earlier call t
 const LATEST_SCOPE_REASON =
 	'the run it governs (`pnpm josh latest`) is already gated at its point of use by the latest-gate; ' +
 	'a firing here would double-gate it'
-const EPIC_BUNDLE_REASON =
-	'it runs after a filing to place it, and that filing is already gated by `issue-scout`; it has no ' +
-	'earlier call of its own'
+// `josh issue:file` runs the scout, the lint and `epic:bundle` itself, and a filing made any other way
+// is refused by the `direct-filing` row (joshuafolkken/kit#2808) — so none of the three has a call left
+// to gate before.
+const FILING_STEP_REASON =
+	'`pnpm josh issue:file` runs it as one of its filing steps, and a direct filing is refused by the ' +
+	'`direct-filing` delivered rule; there is no separate call left to gate'
 const RELEASE_SCOPE_REASON =
 	'it reads the release owed *after* `pnpm josh followup` has merged (`git_followup_pending`), so it ' +
 	'trails the merge rather than gating it; a firing on `followup` would gate a check that must run ' +
@@ -84,8 +80,9 @@ const NOT_NAMED: ReadonlyMap<string, string> = new Map([
 	['latest:scope', LATEST_SCOPE_REASON],
 	['run:hold', SELF],
 	['cost:cut', READ],
-	['epic:bundle', EPIC_BUNDLE_REASON],
-	['issue:scout', 'the filing it governs is already gated by the `issue-scout` delivered rule'],
+	['epic:bundle', FILING_STEP_REASON],
+	['issue:scout', FILING_STEP_REASON],
+	['issue:lint', FILING_STEP_REASON],
 	[
 		'issue:fold',
 		'the second filing it governs is already gated by the `issue-fold` delivered rule',

package/scripts/rules/rule-body-guard.ts

@@ -22,16 +22,13 @@ import { tail_commands } from './tail-commands'
 // URL is stripped) all fail. What stays is the case the Issue names — writing rule prose into a rule
 // document.
 //
-// **No `decide`, so once per run.** The refusal changes what the run *knows* — that a new rule owes
-// question 0 and the ordering question — which is the shape `rule-delivery.md` says once-per-run is
-// right for: told once, the run applies it to every later rule it writes.
-//
 // **The stand-down is what turned the reminder into a check** (joshuafolkken/kit#2324). Until now the
 // row only *reminded* — it fired once and let the reissue through unconditionally, so "reissue and it
 // goes" meant a computable rule could still be written into prose with nothing having answered the two
 // questions. Now the pass condition is a *record*: the run has run `pnpm josh oracle:list` (question 0)
 // and `pnpm josh run:step` (the ordering question) earlier in the transcript. Both present, the edit is
-// stood down; either missing, it is refused. It passes on answering the questions, not on reading the
+// stood down; either missing, it is refused — on the reissue too, since a row with a stand-down
+// refuses until it is met (joshuafolkken/kit#2807). It passes on answering the questions, not on reading the
 // reminder. Keeping the rule is therefore running those two commands, which `keeps` names.
 
 // The two edit tools the `PreToolUse` matcher routes here. A `Write` carries the whole new file; an
@@ -133,7 +130,7 @@ function writes_rule_prose(
 }
 
 // The instruction in the shape a refusal can carry: what the edit is doing, the two questions it
-// skips, the commands that answer them, and the reissue every once-per-run delivery needs.
+// skips, the commands that answer them, and the reissue once they have run.
 const RULE_BODY_REASON =
 	'⛔ rule written into prose: this edit adds rule text to CLAUDE.md, a `prompts/**` doc or a skill ' +
 	'body. Before it lands, run the residency questions the addition skips. A rule whose answer is ' +
@@ -144,9 +141,9 @@ const RULE_BODY_REASON =
 	'sequencing rule moves into. Only a rule that is neither — not computable, not ordering — stays ' +
 	'prose, and then as a trigger-plus-pointer line rather than a second copy of its procedure. The ' +
 	'criterion is `prompts/collaboration-workflow/residency.md` (question 0 and the ordering question); ' +
-	'the delivery enumeration is `prompts/collaboration-workflow/rule-delivery.md`. This fires once per ' +
-	'run — once you have confirmed the rule can be neither an oracle nor an ordering step, reissue this ' +
-	'edit and it will go through.'
+	'the delivery enumeration is `prompts/collaboration-workflow/rule-delivery.md`. Every such edit is ' +
+	'refused until both commands are on the transcript — run them, confirm the rule can be neither an ' +
+	'oracle nor an ordering step, then reissue this edit.'
 
 // The two placement oracles the residency questions name: question 0 is `pnpm josh oracle:list`, the
 // ordering question is `pnpm josh run:step` (its degenerate pre-implementation form `run:next` counts

package/scripts/rules/stop-rules.ts

@@ -136,8 +136,9 @@ const FILING_OFFER_REASON =
 	'⛔ filing offer: your reply offers to file an Issue instead of filing it. Filing into a ' +
 	'first-party repository is Tier A — the trigger is the judgement that it is worth filing, not the ' +
 	"run's progress (`.claude/skills/workflow-commands/SKILL.md` → §2i, `observation-filing.md`). Run " +
-	'`pnpm josh issue:scout "<title>"`, file it, run `pnpm josh epic:bundle <new>`, then end with the ' +
-	'one-line citation of what was filed — do not repeat your previous reply. If it is not worth filing ' +
+	'`pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2>` — it scouts, lints, labels and ' +
+	'runs `epic:bundle` itself — then end with the one-line citation of what was filed; do not repeat ' +
+	'your previous reply. If it is not worth filing ' +
 	'after all, say so in one line instead.'
 
 // **A headless parent's turn-end is its process's end** (joshuafolkken/kit#2437). Under `claude -p` the

package/scripts/test/pilot-files.ts

@@ -320,7 +320,6 @@ const PILOT_FILES: ReadonlyArray<string> = [
 	'scripts/rules/issue-comments-rule.test.ts',
 	'scripts/rules/issue-depth-label.test.ts',
 	'scripts/rules/issue-fold.test.ts',
-	'scripts/rules/issue-scout.test.ts',
 	'scripts/rules/josh-git-bare.test.ts',
 	'scripts/rules/lane-interactive-ask-rule.test.ts',
 	'scripts/rules/lane-park-rule.test.ts',

package/scripts/version/fresh-metadata-cache.ts

@@ -0,0 +1,36 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+
+const CACHE_DIRECTORY_PREFIX = 'josh-latest-cache-'
+const CACHE_DIRECTORY_FLAG = '--config.cache-dir='
+
+// Points every stage at one metadata cache directory. pnpm keeps registry metadata there and the
+// package store elsewhere, so an empty one costs a metadata refetch, never a tarball download.
+function with_cache_directory(
+	stages: ReadonlyArray<ReadonlyArray<string>>,
+	cache_directory: string,
+): Array<Array<string>> {
+	return stages.map((stage) => [...stage, `${CACHE_DIRECTORY_FLAG}${cache_directory}`])
+}
+
+// A cached metadata file written through safe-chain lacks every version that was under 24 hours old
+// at the time, and with `minimumReleaseAge` set pnpm reuses a cache file younger than that age
+// instead of refetching it — so a version that has since aged in stays invisible for up to a day
+// (joshuafolkken/kit#2805). A fresh directory per run means nothing filtered earlier is ever read.
+function run_in_fresh_cache<T>(
+	stages: ReadonlyArray<ReadonlyArray<string>>,
+	run_stages: (stages: Array<Array<string>>) => T,
+): T {
+	const cache_directory = mkdtempSync(path.join(tmpdir(), CACHE_DIRECTORY_PREFIX))
+
+	try {
+		return run_stages(with_cache_directory(stages, cache_directory))
+	} finally {
+		rmSync(cache_directory, { recursive: true, force: true })
+	}
+}
+
+const fresh_metadata_cache = { with_cache_directory, run_in_fresh_cache }
+
+export { fresh_metadata_cache }

package/scripts/version/latest-update.ts

@@ -11,6 +11,7 @@ import { lockfile_overrides } from '#scripts/overrides/lockfile-overrides'
 import { overrides_files } from '#scripts/overrides/overrides-files'
 import { overrides_check } from '#scripts/overrides/overrides-logic'
 import { execaSync } from 'execa'
+import { fresh_metadata_cache } from './fresh-metadata-cache'
 import { latest_regression, type VersionRegression } from './latest-regression'
 import { preinstall_version_update } from './preinstall-version-update'
 
@@ -99,7 +100,7 @@ function find_regressions_after_update(snapshot: TreeSnapshot): Array<VersionReg
 // Exits zero: the tree is left exactly as it was found, nothing is broken, and every workflow that
 // runs `josh latest` in its preamble would otherwise stop for a situation that resolves itself.
 function update_without_downgrading(snapshot: TreeSnapshot): UpdateOutcome {
-	const status = run_update_stages(build_update_commands())
+	const status = fresh_metadata_cache.run_in_fresh_cache(build_update_commands(), run_update_stages)
 	if (status !== 0) return { status, is_rolled_back: false }
 
 	const regressions = find_regressions_after_update(snapshot)

package/scripts/rules/issue-bug-label.ts

@@ -1,85 +0,0 @@
-import { readFileSync } from 'node:fs'
-import path from 'node:path'
-import { issue_classification } from '#scripts/issue/issue-classification'
-import type { GuardRun } from '#scripts/josh/hook-decision'
-import { time_density_hook } from '#scripts/time-runtime/time-density-hook'
-import { time_shell } from '#scripts/time-runtime/time-shell'
-import { bash_triggers } from './bash-triggers'
-import { issue_filing_args } from './issue-filing-args'
-import { shell_segments } from './shell-segments'
-import { tail_commands } from './tail-commands'
-
-const LINT_NAMES = new Set(['issue:lint'])
-const LINT_PATH = /\b(?:issue:lint|iln)\s+(?:'([^']+)'|"([^"]+)"|(\S+))/u
-
-function lint_argument(segment: string): string | undefined {
-	const [, single_quoted, double_quoted, bare] = LINT_PATH.exec(segment) ?? []
-
-	return single_quoted ?? double_quoted ?? bare
-}
-
-function latest_lint_path(tail: string): string | undefined {
-	const segments = tail_commands
-		.prior_bash_commands(tail)
-		.flatMap((command) => shell_segments.segments_of(command))
-	const lint = segments.findLast((segment) => shell_segments.is_josh_command(segment, LINT_NAMES))
-
-	return lint === undefined ? undefined : lint_argument(lint)
-}
-
-function linted_body(body_path: string): string | undefined {
-	try {
-		return readFileSync(body_path, 'utf8')
-	} catch {
-		return undefined
-	}
-}
-
-function matches_linted_file(command: string, lint_path: string): boolean {
-	const filing_path = issue_filing_args.body_file(command)
-
-	return filing_path !== undefined && path.resolve(filing_path) === path.resolve(lint_path)
-}
-
-function needs_classification_labels(command: string, tail: string): boolean {
-	const lint_path = latest_lint_path(tail)
-
-	if (lint_path === undefined) return false
-	const body = linted_body(lint_path)
-
-	if (body === undefined) return false
-
-	if (!matches_linted_file(command, lint_path) || issue_classification.problems(body).length > 0) {
-		return true
-	}
-
-	const expected = issue_classification.required_labels(body)
-
-	return issue_classification.CLASSIFICATION_LABELS.some(
-		(label) => expected.includes(label) !== issue_filing_args.has_label(command, label),
-	)
-}
-
-function decide(call: { input: unknown }, run: GuardRun): boolean {
-	const command = time_shell.bash_command(call.input)
-	const tail = time_density_hook.read_tail(run.transcript)
-
-	return needs_classification_labels(command, tail)
-}
-
-const ISSUE_CLASSIFICATION_REASON =
-	'⛔ issue classification mismatch: use the exact body file checked by `pnpm josh issue:lint` ' +
-	'in this creation call (`-F body=@<path>` or `gh issue create --body-file <path>`) and ' +
-	'apply exactly the `labels:` it reports (`bug`, `enhancement`, `breaking-change`). See ' +
-	'`prompts/collaboration-workflow/issue-template.md`.'
-
-const ROW = {
-	id: 'issue-bug-label',
-	is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
-	reason: ISSUE_CLASSIFICATION_REASON,
-	decide,
-}
-
-const issue_bug_label_rule = { ROW, latest_lint_path, needs_classification_labels }
-
-export { issue_bug_label_rule }