@bongos/core 1.19.252 → 1.19.254

package/docs/copy-registry.json

@@ -996,7 +996,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/gate.js:205",
-        "modules/hall-ui/public/government.js:812"
+        "modules/hall-ui/public/government.js:842"
       ]
     },
     {
@@ -1549,7 +1549,7 @@
       "surface": "builders-hall",
       "text": ", membership",
       "file": "modules/hall-ui/public/government.js",
-      "line": 756,
+      "line": 786,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1855,7 +1855,7 @@
       "surface": "builders-hall",
       "text": "An objection returns the idea to its author with your reason and the section it faults \\u2014 the feedback they revise against.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 711,
+      "line": 741,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2026,7 +2026,7 @@
       "surface": "builders-hall",
       "text": "As configuration:",
       "file": "modules/hall-ui/public/government.js",
-      "line": 603,
+      "line": 633,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2269,7 +2269,7 @@
       "surface": "builders-hall",
       "text": "Cast objection",
       "file": "modules/hall-ui/public/government.js",
-      "line": 711,
+      "line": 741,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2332,7 +2332,7 @@
       "surface": "builders-hall",
       "text": "Charter library",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2566,7 +2566,7 @@
       "surface": "builders-hall",
       "text": "Closed sittings",
       "file": "modules/hall-ui/public/government.js",
-      "line": 782,
+      "line": 812,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2998,7 +2998,7 @@
       "surface": "builders-hall",
       "text": "Could not load government data just now.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 853,
+      "line": 883,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3052,7 +3052,7 @@
       "surface": "builders-hall",
       "text": "Could not load the Board Room just now.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 774,
+      "line": 804,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3061,7 +3061,7 @@
       "surface": "builders-hall",
       "text": "Could not load the constitution just now.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 598,
+      "line": 628,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3457,7 +3457,7 @@
       "surface": "builders-hall",
       "text": "Could not vote: {…}",
       "file": "modules/hall-ui/public/government.js",
-      "line": 738,
+      "line": 768,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4087,7 +4087,7 @@
       "surface": "builders-hall",
       "text": "Full Idea",
       "file": "modules/hall-ui/public/government.js",
-      "line": 639,
+      "line": 669,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4348,7 +4348,7 @@
       "surface": "builders-hall",
       "text": "How a project moves between structures over time — summarized from the synthesis:",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4366,7 +4366,7 @@
       "surface": "builders-hall",
       "text": "How it has changed",
       "file": "modules/hall-ui/public/government.js",
-      "line": 603,
+      "line": 633,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4429,7 +4429,7 @@
       "surface": "builders-hall",
       "text": "How this project is governed — the constitution it runs, the Board Room, and the ranks & permissions that administer it.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 840,
+      "line": 870,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5509,7 +5509,7 @@
       "surface": "builders-hall",
       "text": "No sitting has closed yet.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 783,
+      "line": 813,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5563,7 +5563,7 @@
       "surface": "builders-hall",
       "text": "No votes yet{…}.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 657,
+      "line": 687,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6292,7 +6292,7 @@
       "surface": "builders-hall",
       "text": "Ranks & Permissions is the Archon administration surface. The Constitution and the Board Room are yours to read.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 824,
+      "line": 854,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6733,7 +6733,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 812,
+      "line": 842,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7030,7 +7030,7 @@
       "surface": "builders-hall",
       "text": "Selectable today",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7624,7 +7624,7 @@
       "surface": "builders-hall",
       "text": "The developmental ladder: {…}. Formality is adopted only where informal coordination breaks.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 586,
+      "line": 616,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7795,7 +7795,7 @@
       "surface": "builders-hall",
       "text": "The seven government structures, for getting a team up to speed before deciding when to flip a switch.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8020,7 +8020,7 @@
       "surface": "builders-hall",
       "text": "This is your idea \\u2014 its author does not vote on it. The board decides; a return comes back to you with its reason.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 707,
+      "line": 737,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8236,7 +8236,7 @@
       "surface": "builders-hall",
       "text": "Vote yes",
       "file": "modules/hall-ui/public/government.js",
-      "line": 711,
+      "line": 741,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8371,7 +8371,7 @@
       "surface": "builders-hall",
       "text": "What this project runs today",
       "file": "modules/hall-ui/public/government.js",
-      "line": 603,
+      "line": 633,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8479,7 +8479,7 @@
       "surface": "builders-hall",
       "text": "Why \\u2014 the reason the author will act on",
       "file": "modules/hall-ui/public/government.js",
-      "line": 711,
+      "line": 741,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8623,7 +8623,7 @@
       "surface": "builders-hall",
       "text": "You have not voted on this item. Casting arrives with the vote form.",
       "file": "modules/hall-ui/public/government.js",
-      "line": 755,
+      "line": 785,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8650,7 +8650,7 @@
       "surface": "builders-hall",
       "text": "You voted",
       "file": "modules/hall-ui/public/government.js",
-      "line": 754,
+      "line": 784,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8956,7 +8956,7 @@
       "surface": "builders-hall",
       "text": "active builder{…}: {…}",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9037,7 +9037,7 @@
       "surface": "builders-hall",
       "text": "as configuration: {…}",
       "file": "modules/hall-ui/public/government.js",
-      "line": 574,
+      "line": 604,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9181,7 +9181,7 @@
       "surface": "builders-hall",
       "text": "documented for later",
       "file": "modules/hall-ui/public/government.js",
-      "line": 572,
+      "line": 602,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9496,7 +9496,7 @@
       "surface": "builders-hall",
       "text": "means expressible through the real configuration — a rank-based membership plus a pass rule — with no new code. This project has",
       "file": "modules/hall-ui/public/government.js",
-      "line": 580,
+      "line": 610,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9622,7 +9622,7 @@
       "surface": "builders-hall",
       "text": "objected to",
       "file": "modules/hall-ui/public/government.js",
-      "line": 664,
+      "line": 694,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9766,7 +9766,7 @@
       "surface": "builders-hall",
       "text": "recommended at your headcount",
       "file": "modules/hall-ui/public/government.js",
-      "line": 573,
+      "line": 603,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9820,7 +9820,7 @@
       "surface": "builders-hall",
       "text": "selectable today",
       "file": "modules/hall-ui/public/government.js",
-      "line": 571,
+      "line": 601,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9856,7 +9856,7 @@
       "surface": "builders-hall",
       "text": "tally: {…} yes · {…} no — sitting under",
       "file": "modules/hall-ui/public/government.js",
-      "line": 756,
+      "line": 786,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10072,7 +10072,7 @@
       "surface": "builders-hall",
       "text": "your vote",
       "file": "modules/hall-ui/public/government.js",
-      "line": 661,
+      "line": 691,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10567,7 +10567,7 @@
       "surface": "builders-hall",
       "text": "— {…}{…}",
       "file": "modules/hall-ui/public/government.js",
-      "line": 575,
+      "line": 605,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/migrations/core_221_claims_requested_worktree_name.sql

@@ -0,0 +1,144 @@
+-- core_221_claims_requested_worktree_name.sql
+-- Task 1002709 (goal 1000024, build-pipeline integrity). A CORE migration, not a
+-- lifecycle_ one, by the same rule core_204 states: it alters the shared
+-- pre-module `claims` table and swaps an index on it, and a module migration
+-- must stay additive within its own <key>_ tables (ADR 0083 §Decision #5).
+-- Idempotent on re-run.
+--
+-- ── THE HOLE ────────────────────────────────────────────────────────────────
+--
+-- V3.R51 disambiguation (modules/lifecycle/db.js disambiguateWorktreeName)
+-- silently RENAMES a requested worktree_name that collides with any other
+-- currently-active claim: "overnight" is stored as "overnight-2". That rename is
+-- correct and load-bearing — `.claude/worktrees/<name>` is a filesystem path and
+-- two live builders pointing at one would stomp each other.
+--
+-- But both halves of the one-claim-per-tree rule then key on the STORED name,
+-- while the CLI keeps sending the REQUESTED one (scripts/gds/claim.js reads the
+-- real directory, which is never renamed). So:
+--
+--   1. Builder X holds an active claim with worktree_name "overnight".
+--   2. Builder Y, session S, in a tree genuinely named "overnight", claims task
+--      A. Y's name collides with X's, so it is stored as "overnight-2".
+--   3. Same session S, same tree, claims task B. The guard compares the incoming
+--      "overnight" against the stored "overnight-2" — different tree, ALLOW. The
+--      index sees (S,"overnight") vs (S,"overnight-2") — no collision, INSERT.
+--
+-- Result: ONE real working tree, ONE branch, TWO active claims — the exact
+-- commingled-ship hazard task 1642 and ADR 0097 exist to prevent. Rare, because
+-- worktree names are usually task-slug + random hex, but reachable for any fixed
+-- reusable name: the overnight builder, box workflows, `--worktree` passed by
+-- hand.
+--
+-- ── WHY A COLUMN AND NOT A CLEVERER GUARD ───────────────────────────────────
+--
+-- Matching "^<requested>-\d+$" in the guard would refuse a builder who genuinely
+-- runs worktrees "foo" and "foo-2" side by side — reintroducing the false
+-- refusal this whole family of bugs (1002570, 1002589, 1002522) is about. The
+-- guard needs the name the claim was FILED under, which is simply not stored
+-- today. So store it.
+--
+-- TWO NAMES, TWO JOBS, and keeping them separate is the point:
+--   worktree_name            the name on DISK after disambiguation. Still what
+--                            branch naming and the operator surfaces read, and
+--                            still globally unique across active claims.
+--   requested_worktree_name  the name the CALLER asked for. The identity of the
+--                            working TREE, which is what "do these two claims
+--                            share a tree" actually asks.
+--
+-- ── THE BACKFILL IS HONEST ABOUT WHAT IT CANNOT KNOW ────────────────────────
+--
+-- For historical rows the requested name was never recorded. Copying
+-- worktree_name across is exactly right for every row that was NOT renamed (the
+-- overwhelming majority — disambiguation only fires on a live collision) and is
+-- the best available answer for the few that were. It cannot resurrect a lost
+-- fact, and it does not pretend to: the column is nullable, and a row that was
+-- renamed simply carries its post-rename name as its pre-rename one. No active
+-- claim changes meaning, because the pair is only compared against other rows
+-- backfilled the same way.
+
+BEGIN;
+
+ALTER TABLE claims
+  ADD COLUMN IF NOT EXISTS requested_worktree_name text;
+
+COMMENT ON COLUMN claims.requested_worktree_name IS
+  'The worktree name the CALLER asked for, before V3.R51 disambiguation renamed it. The one-claim-per-working-tree guard keys on THIS (task 1002709); worktree_name remains the disambiguated on-disk name.';
+
+-- Backfill (see the header): the requested name equals the stored name for every
+-- row disambiguation never touched, and is the closest available answer for the
+-- rest. Guarded so a re-run never overwrites a real value with a stale one.
+UPDATE claims
+   SET requested_worktree_name = worktree_name
+ WHERE requested_worktree_name IS NULL;
+
+-- ── heal before CREATE (the migration 174/180/204 shape) ────────────────────
+--
+-- A unique index refuses to create if live rows already violate it, which would
+-- block the deploy. This heal keeps that safe for rows the NEW code writes.
+--
+-- WHAT IT CANNOT DO, STATED PLAINLY: it cannot find a commingled pair that
+-- already exists. Consider the two shapes, after the backfill above:
+--
+--   commingled   session S, stored "overnight" + "overnight-2", ONE real tree
+--   legitimate   session S, stored "foo"       + "foo-2",       TWO real trees
+--
+-- Both backfill to requested = their stored name, so both read as two distinct
+-- trees, and the heal closes neither. They are INDISTINGUISHABLE in the data —
+-- the requested name was never recorded, which is the entire bug. Any heuristic
+-- that could close the first (stripping a "-\d+" suffix) would also close the
+-- second, silently killing an active claim of a builder who did nothing wrong.
+-- That is the same false-refusal trap that makes suffix-matching wrong in the
+-- guard, and it is worse here because a migration acts without asking.
+--
+-- So this deliberately under-heals. The window it leaves is bounded and small:
+-- any commingled pair already in flight stays in flight, and the FIRST of the
+-- two to ship takes the tree's branch — the pre-existing hazard, unchanged. From
+-- the moment the new guard code lands, no NEW pair can be created. Closing the
+-- ledger honestly beats closing someone's claim on a guess.
+--
+-- The heal still earns its place: once rows carry a real requested name, two of
+-- them CAN collide on it, and then this closes the later and keeps the earliest
+-- — the same rule core_204 applied, and the one the guard would have applied had
+-- it been able to see the collision at claim time.
+WITH ranked AS (
+  SELECT c.id,
+         ROW_NUMBER() OVER (
+           PARTITION BY c.creator_session_id, COALESCE(c.requested_worktree_name, '')
+           ORDER BY c.claimed_at, c.id
+         ) AS rn
+    FROM claims c
+   WHERE c.released_at IS NULL
+     AND c.creator_session_id IS NOT NULL
+)
+UPDATE claims c
+   SET released_at = now(),
+       outcome     = COALESCE(c.outcome, 'abandoned')
+  FROM ranked r
+ WHERE c.id = r.id
+   AND r.rn > 1;
+
+-- ── swap the index ──────────────────────────────────────────────────────────
+-- COALESCE, not PG15's NULLS NOT DISTINCT, and it is load-bearing for the same
+-- reason core_204 gives: in a plain multi-column unique index NULLs are
+-- DISTINCT, so two worktree-less claims (one shared clone, whose single branch
+-- genuinely commingles) would both insert and re-open the hole task 1642 closed.
+--
+-- The old index is DROPPED rather than left alongside. Keeping it would re-refuse
+-- a legitimate second claim from a builder genuinely running "foo" and "foo-2"
+-- in parallel — the false refusal this change exists to avoid reintroducing.
+DROP INDEX IF EXISTS uniq_active_claim_per_session_worktree;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_active_claim_per_session_requested_worktree
+  ON claims (creator_session_id, (COALESCE(requested_worktree_name, '')))
+  WHERE released_at IS NULL AND creator_session_id IS NOT NULL;
+
+-- (This index name and claimUniqueViolationError's SESSION_CLAIM_INDEXES set
+-- must stay in lockstep — tests/one_active_claim_per_session.mjs pins both
+-- sides, and all three generations stay in that set because a deploy applies
+-- code and migration at different instants.)
+
+INSERT INTO schema_migrations (version) VALUES ('core_221_claims_requested_worktree_name')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/government/board.js

@@ -664,7 +664,12 @@ async function boardRoomView({ closedLimit = 20 } = {}) {
 function recommendedCharter(headcount) {
   const n = Number(headcount) || 0;
   if (n <= 2) return { key: 'monarchy', rung: 'solo/pair', why: 'informal coordination has nothing to break yet — the founding monarchy is the honest shape' };
-  if (n <= 8) return { key: 'direct-democracy', rung: 'circle (3–8)', why: 'a consent circle of all trusted members — the rung this ladder was written on' };
+  // "all trusted members" was not expressible under the pre-1003094 exact-match
+  // grammar, so at this headcount the library recommended a charter it could not
+  // state (task 1003095). It is expressible now — `rank:xenos+` seats every
+  // builder — and the wording says the thing the predicate actually does rather
+  // than a phrase with no predicate behind it.
+  if (n <= 8) return { key: 'direct-democracy', rung: 'circle (3–8)', why: 'a consent circle of every builder (rank:xenos+) — the rung this ladder was written on' };
   if (n <= 49) return { key: 'presidential', rung: '~9: name an executive', why: 'past ~9, naming an executive beats everyone coordinating with everyone' };
   if (n <= 149) return { key: 'foundation', rung: '~50: written charter + council', why: 'past ~50, the charter must be written down and a council carries it' };
   return { key: 'federation', rung: '~150: adjudication separates — federate beyond', why: 'past ~150, one body cannot both govern and adjudicate; federate' };

package/modules/hall-ui/public/government.js

@@ -539,15 +539,40 @@
   // config — a rank-predicate membership plus first_ratifier|consent — so nobody
   // is misled about what a settings change can and cannot reach. Source: the
   // Six-Variables synthesis (Verro Labs, Aug 2026), Parts III–IV, via the spec.
+  // EVERY SELECTABLE CHARTER CARRIES A MACHINE-CHECKABLE PREDICATE (task 1003095).
+  //
+  // This library is the ONLY place in the product that tells an owner what to
+  // type. That makes a wrong `how` line worse than no library at all — and two
+  // of them were wrong. Under the pre-1003094 exact-match grammar,
+  // `membership rank:xenos (everyone)` seated NEWCOMERS ONLY: an owner who
+  // followed this page handed the board to the least-trusted tier and locked
+  // themselves out. Timocratic Republic was true as far as it went and silent
+  // about the same surprise.
+  //
+  // So the claim is no longer prose. `predicate` is the exact string an owner
+  // types, and `seatsRanks` is what it must resolve to — checked in
+  // tests/government_charter_library.mjs against the REAL parser
+  // (modules/government/membership-predicate.js), not against a copy of the
+  // intent. If the grammar ever changes underneath this file again, that test
+  // reds instead of the page quietly lying.
+  //
+  // `predicate: null` means the predicate is the owner's to choose (Foundation
+  // names their own custom rank), which is honest rather than unchecked — the
+  // test asserts such a charter says so in its `how`.
   const CHARTERS = [
     { key: 'monarchy', name: 'Monarchy / BDFL', selectable: true,
-      how: "membership rank:archon · first ratifier · no clock — the shipped default",
+      predicate: 'rank:archon', seatsRanks: ['archon'],
+      how: 'membership rank:archon · first ratifier · no clock — the shipped default',
       blurb: 'One trusted executive decides. Fast, legible, and honest at founding scale; the shape every project actually starts in.' },
     { key: 'timocratic-republic', name: 'Timocratic Republic', selectable: true,
-      how: 'membership by a trusted rank (e.g. rank:metic) · consent · a timed sitting',
+      predicate: 'rank:metic+', seatsRanks: ['metic', 'archon'],
+      how: 'membership rank:metic+ (metic and above — Archons included) · consent · a timed sitting',
       blurb: 'Standing accrues to those actively building: the franchise follows earned rank, not headcount.' },
     { key: 'direct-democracy', name: 'Direct Democracy', selectable: true,
-      how: 'membership rank:xenos (everyone) · consent · a timed sitting',
+      predicate: 'rank:xenos+', seatsRanks: ['xenos', 'thetes', 'metic', 'archon'],
+      // The `+` is load-bearing and is why it is spelled out: a bare rank:xenos
+      // seats newcomers ONLY, which is what this line used to say.
+      how: 'membership rank:xenos+ (every builder — the + is what makes it everyone) · consent · a timed sitting',
       blurb: 'Every builder sits on the board. Consent keeps it unblockable: silence passes, one reasoned objection returns.' },
     { key: 'presidential', name: 'Presidential', selectable: false,
       blurb: 'An ELECTED executive with a fixed term. Needs election machinery this system does not have yet — documented for later.' },
@@ -556,7 +581,12 @@
     { key: 'federation', name: 'Federation', selectable: false,
       blurb: 'Multiple chambers or sub-projects, each self-governing, coordinating through a compact. The >150 shape — documented for later.' },
     { key: 'foundation', name: 'Foundation', selectable: true,
-      how: 'a CUSTOM rank as the trustee body (the Ranks tab creates it) · consent · a timed sitting',
+      // The one selectable charter whose predicate the OWNER names — a custom
+      // rank is a DB row this page cannot know. Deliberately null rather than a
+      // made-up example, and the `how` says so: `+` does not apply to a custom
+      // rank (it has no ladder position), so a bare key is the correct form here.
+      predicate: null, seatsRanks: null,
+      how: 'membership rank:<your-trustee-rank> — a CUSTOM rank you create on the Ranks tab, named exactly (no +, a custom rank has no ladder position) · consent · a timed sitting',
       blurb: 'A written charter carried by a small appointed council. Expressible today by governing through a custom rank.' },
   ];
   const TRAJECTORIES = [

package/modules/lifecycle/db.js

@@ -2600,7 +2600,13 @@ async function unsatisfiedDeps(taskId, client = pool) {
 // carry the old index.
 const SESSION_CLAIM_INDEXES = new Set([
   'uniq_active_claim_per_session',           // migration 180 — session-only (pre-re-key)
-  'uniq_active_claim_per_session_worktree',  // core_204 (task 1002570) — per (session, worktree)
+  'uniq_active_claim_per_session_worktree',  // core_204 (task 1002570) — per (session, stored worktree)
+  // core_221 (task 1002709) — per (session, REQUESTED worktree). All three
+  // generations stay listed: a deploy applies code and migration at different
+  // instants, so an instance may still carry an older index, and an unrecognised
+  // constraint falls closed onto the generic ALREADY_CLAIMED — which for this
+  // case is the wrong, phantom-rival answer.
+  'uniq_active_claim_per_session_requested_worktree',
 ]);
 // Branch on err.constraint; an UNKNOWN constraint fails CLOSED on the generic
 // ALREADY_CLAIMED (never widen a claim refusal). Pure + exported for DB-free
@@ -2830,7 +2836,18 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // task 1002522: fold ''/whitespace → NULL before anything keys on the name.
     // core_204's index folds them together anyway (COALESCE(worktree_name, ''));
     // normalizing here means the stored row matches what the guard compared.
-    let finalWorktreeName = foldWorktreeName(worktreeName);
+    // task 1002709: BOTH names are stored, and they answer different questions.
+    // `requestedWorktreeName` is what the caller asked for — the identity of the
+    // working TREE, which is what "do these two claims share a tree" actually
+    // asks. `finalWorktreeName` is what lands on disk after disambiguation, which
+    // is what must stay globally unique across active claims.
+    //
+    // Keying the one-claim-per-tree guard on the STORED name was the hole: a
+    // second claim from the same session in the same tree compared "overnight"
+    // against a previously-renamed "overnight-2", saw a different tree, and let
+    // a commingling claim through. See core_221 for the full repro.
+    const requestedWorktreeName = foldWorktreeName(worktreeName);
+    let finalWorktreeName = requestedWorktreeName;
     if (finalWorktreeName) {
       const { rows: activeNameRows } = await client.query(
         `SELECT worktree_name FROM claims
@@ -2841,10 +2858,10 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
 
     const insertClaim = await client.query(
-      `INSERT INTO claims (task_id, builder_id, worktree_name, head_sha, reserved_migration_number, creator_session_id)
-       VALUES ($1, $2, $3, $4, $5, $6)
-       RETURNING id, task_id, builder_id, worktree_name, claimed_at, head_sha, reserved_migration_number`,
-      [taskId, builderId, finalWorktreeName, headSha ?? null, reservedMigrationNumber, creatorSessionId ?? null]
+      `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING id, task_id, builder_id, worktree_name, requested_worktree_name, claimed_at, head_sha, reserved_migration_number`,
+      [taskId, builderId, finalWorktreeName, requestedWorktreeName, headSha ?? null, reservedMigrationNumber, creatorSessionId ?? null]
     );
 
     await client.query(`UPDATE tasks SET status = 'active' WHERE id = $1`, [taskId]);
@@ -3198,10 +3215,16 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
         : null;
       const rowCreatorSessionId = i === 0 ? (creatorSessionId ?? null) : null;
       try {
+        // task 1002709: requested == final on this path by construction — each
+        // row gets its own `<prefix>-<taskId>` tree and nothing disambiguates
+        // them. It is still written explicitly rather than left NULL: core_221's
+        // index keys on COALESCE(requested_worktree_name, ''), so a NULL here
+        // would make a row that HAS a worktree read as worktree-less and collide
+        // with the shared-clone group.
         const insertClaim = await client.query(
-          `INSERT INTO claims (task_id, builder_id, worktree_name, head_sha, reserved_migration_number, creator_session_id)
-           VALUES ($1, $2, $3, NULL, $4, $5)
-           RETURNING id, task_id, builder_id, worktree_name, claimed_at, head_sha, reserved_migration_number`,
+          `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id)
+           VALUES ($1, $2, $3, $3, NULL, $4, $5)
+           RETURNING id, task_id, builder_id, worktree_name, requested_worktree_name, claimed_at, head_sha, reserved_migration_number`,
           [t.id, builderId, worktreeName, reservedMigrationNumber, rowCreatorSessionId]
         );
         inserted.push(insertClaim.rows[0]);
@@ -4843,7 +4866,12 @@ async function activeClaimCountForBuilder(builderId, deps = {}) {
 async function getActiveClaimsForSession(creatorSessionId) {
   if (!creatorSessionId) return [];
   const { rows } = await pool.query(
-    `SELECT c.id AS claim_id, c.task_id, c.creator_session_id, c.worktree_name, c.claimed_at,
+    // task 1002709: requested_worktree_name rides along because the guard keys on
+    // it — comparing the incoming REQUESTED name against a stored DISAMBIGUATED
+    // one is what let a second same-tree claim through. worktree_name stays
+    // selected: callers still render the on-disk name.
+    `SELECT c.id AS claim_id, c.task_id, c.creator_session_id, c.worktree_name,
+            c.requested_worktree_name, c.claimed_at,
             t.title
        FROM claims c JOIN tasks t ON t.id = c.task_id
       WHERE c.creator_session_id = $1 AND c.released_at IS NULL