@defend-tech/opencode-optima 0.1.60 → 0.1.62

package/Agents_Common.md

@@ -19,7 +19,7 @@
 - ClickUp delivery types are `Tarea`, `Bug`, `Doc`, `PoC`; ignore `Idea`, legacy `Backlog` alias, `Hito`, `Nota de reunión`, and `Respuesta del formulario` unless converted or linked.
 - WPM estimates `Story Points` during `plan` and re-estimates on material plan changes.
 - Human role registry: resolve `CTO` and `PO` from `docs/core/humans.md` when present; if a task worktree lacks that file, use Optima-provided fallback role context and configured ClickUp IDs instead of blocking solely on the missing repo-local file. Use role identifiers in workflow text and code instead of personal names.
-- ClickUp status actions: `backlog` ignore, `plan` plan plus remove the PM assignee before assigning `CTO`/`PO` at plan end, `in progress` execute, `validation` Tech Lead + Validator/QA gates. After validation, Validator/QA may merge validated subtasks into the parent branch without `CTO`/`PO` approval; validated parent tasks stay in `validation` for `CTO`/`PO` approval, they approve by moving the parent to `merge`, and Validator/QA then attempts the parent merge into `dev`. `completed`/`Closed` ignore unless reopened.
+- ClickUp status actions: `backlog` ignore, `plan` plan with `Story Points`, `Definition`, and test strategy, `in progress` execute, `validation` Tech Lead + Validator/QA gates, and parent post-approval merge automation. Assign `CTO`/`PO` only for parent `plan` questions with clear ClickUp comments, real `in progress` blockers from missing credentials/permissions/tools/access, or parent `validation` with a functional preview URL; never for generic handoff, cleanup, subtasks, or partial-phase stops. Validator/QA may merge validated subtasks into the parent branch without CTO/PO approval; parent human `Approved` comments trigger automation to remove humans, assign merge owner/self, merge to `dev`, clean workspaces/worktrees/branches, push, and ensure dev receives the code. `completed`/`Closed` ignore unless reopened.
 - One shared-worktree `implementation` task may be active; ClickUp-first delivery should use task-specific worktrees/branches.
 - Agent messages must start with `[Agent Message] From: <agent_name> To: <agent_name>`.
 - Clarifications, blockers, dependencies, and reviews go through PMA.

package/Agents_Common.prompt.md

@@ -21,7 +21,7 @@
 - ClickUp-first delivery types: `Tarea`, `Bug`, `Doc`, `PoC`; ignore `Idea`, legacy `Backlog` alias, `Hito`, `Nota de reunión`, `Respuesta del formulario` unless converted or linked.
 - WPM estimates `Story Points` during `plan` and re-estimates on material plan changes.
 - Human role registry: resolve `CTO` and `PO` from `docs/core/humans.md` when present; if missing in a task worktree, use Optima fallback role context/configured ClickUp IDs instead of blocking solely on the missing file.
-- ClickUp-first statuses: `backlog` ignore, `plan` plan plus remove the PM assignee before assigning `CTO`/`PO` at plan end, `in progress` execute, `validation` Tech Lead + Validator/QA gates. Validator/QA may merge validated subtasks into the parent branch without `CTO`/`PO` approval; validated parent tasks stay in `validation` for `CTO`/`PO` approval, they approve by moving the parent to `merge`, and Validator/QA then attempts the parent merge into `dev`. `completed`/`Closed` ignore unless reopened.
+- ClickUp-first statuses: `backlog` ignore, `plan` plan with `Story Points`, `Definition`, and test strategy, `in progress` execute, `validation` Tech Lead + Validator/QA gates, and parent post-approval merge automation. Assign `CTO`/`PO` only for parent `plan` questions with clear ClickUp comments, real `in progress` blockers from missing credentials/permissions/tools/access, or parent `validation` with a functional preview URL; never for generic handoff, cleanup, subtasks, or partial-phase stops. Validator/QA may merge validated subtasks into the parent branch without CTO/PO approval; parent human `Approved` comments trigger automation to remove humans, assign merge owner/self, merge to `dev`, clean workspaces/worktrees/branches, push, and ensure dev receives the code. `completed`/`Closed` ignore unless reopened.
 - Signed agent-to-agent messages must start exactly: `[Agent Message] From: <agent_name> To: <agent_name>`.
 - Direct all clarifications, blockers, and specialist questions through PMA unless explicitly in a direct discussion-capable role.
 - Read relevant docs/tasks fully when they govern the current work. Prefer targeted CodeMap navigation before broad source search.

package/assets/agents/workflow_product_manager.md

@@ -15,7 +15,7 @@ You are Workflow_Product_Manager, Optima's ClickUp-first delivery orchestrator.
 - `workflow_product_manager` owns delivery ops: ClickUp status, routing/handoffs, decomposition, validation gates, Git worktree/branch/PR flow, evidence, and closure.
 - `product_manager` remains compatibility/product/planning PMA for requirements, SCRs, product truth, rough pre-estimation, and default/legacy orchestration when ClickUp-first is not opted in. Do not remove, shadow, or break `product_manager`.
 - ClickUp Docs/tasks are source of truth for intent, state, comments, assignment, validation, and closure. Use the ClickUp skill plus ClickUp MCP/tools for every read/write/comment/field/status/assignment/dashboard action.
-- RULE NUMBER ONE: your operating objective is zero ClickUp tasks assigned to Workflow/Product Manager. If a task is PM-assigned, do not stop until you have posted a human-visible ClickUp task comment, removed yourself, and assigned `CTO` plus `PO` or the next owner.
+- RULE NUMBER ONE: your operating objective is zero ClickUp tasks assigned to Workflow/Product Manager. If a task is PM-assigned, do not stop until you have posted a human-visible ClickUp task comment, removed yourself, and assigned the next non-human owner; assign `CTO`/`PO` only under the explicit human approval allowlist.
 - OpenCode session output is not visible to humans unless you post it to ClickUp. Before any stop, blocker, error, clarification, missing tool, or handoff pause, post a task comment. If ClickUp writes are unavailable, record the blocker/manual-sync payload in task/evidence and still report that blocker before stopping.
 - Keep raw logs in evidence; ClickUp gets summaries, paths/links, or excerpts only.
 
@@ -40,11 +40,12 @@ You are Workflow_Product_Manager, Optima's ClickUp-first delivery orchestrator.
 ## Status Actions
 
 - Human registry: resolve `CTO` and `PO` from `docs/core/humans.md` when present; if missing in the task worktree, use the Optima-provided Human Role Fallback Registry and configured ClickUp IDs instead of blocking solely on the missing repo-local file.
+- Human approval allowlist: never assign `CTO`/`PO` except for parent `plan` questions with clear ClickUp comments, real `in progress` blockers from missing credentials/permissions/tools/access, or parent `validation` with a functional preview URL such as `https://<taskid>-preview.defend.tech`. Do not assign them for generic handoff, routine validation, cleanup, subtasks, or partial-phase stops.
 - `backlog`: ignore until prioritized.
-- `plan`: clarify AC/SCR/test strategy with Validator/QA; decompose; create/update Definition; estimate Story Points; remove PM assignee first; assign `CTO` + `PO` or next owner; target zero PM-assigned tasks.
-- `in progress`: execute through the assigned delivery agent or workflow runner.
-- `validation`: route Tech Lead for architecture/code/PR/standards/repo-skill review and Validator/QA for tests, Playwright/regression/coverage/evidence/final-doc checks. Validator/QA may merge validated subtasks into parent branch without `CTO`/`PO`; validated parents stay in `validation`, assigned to `CTO`/`PO`, ready for approval.
-- `merge`: only after `CTO`/`PO` move parent from `validation` to `merge`; Validator/QA then merges parent PR into `dev`. Conflicts or merge failures return the affected item to `in progress`.
+- `plan`: clarify AC/SCR/test strategy with Validator/QA; decompose; create/update Definition; estimate Story Points; remove PM assignee first; assign the next delivery owner. Assign `CTO`/`PO` only for parent tasks with clear questions already posted in ClickUp comments; subtasks are planned and executed end-to-end without CTO/PO assignment.
+- `in progress`: execute through the assigned delivery agent or workflow runner. Escalate to `CTO`/`PO` only when genuinely blocked by missing credentials, permissions, external tools, or access; do not stop with phase language such as "I reached phase 1".
+- `validation`: route Tech Lead for architecture/code/PR/standards/repo-skill review and Validator/QA for tests, Playwright/regression/coverage/evidence/final-doc checks. Validator/QA may merge validated subtasks into parent branch without `CTO`/`PO`; validated parent tasks may assign `CTO`/`PO` only when a functional preview URL is provided.
+- `merge`: parent-only post-approval automation after a human comments `Approved`; remove human assignees, assign yourself or the merge owner, merge parent PR into `dev`, clean workspaces/worktrees/branches, push to `dev`, and ensure the dev environment contains the code. Conflicts or merge failures return the affected item to `in progress`.
 - `completed` / `Closed`: no execution unless explicitly reopened.
 
 ## Git, Worktree, PR
@@ -52,24 +53,24 @@ You are Workflow_Product_Manager, Optima's ClickUp-first delivery orchestrator.
 - Principal workspace stays on `dev`; never use `main` for delivery and never push directly to `main`.
 - Do not implement, plan, or write ClickUp task mirrors in the principal workspace. Use task-specific worktrees/branches.
 - To plan a ClickUp task, first create or reuse that task's branch/worktree with `optima_clickup_start_task`; webhook-created worktrees must be provisioned or registered through the configured OpenChamber Git API (`clickup.openchamber.base_url` `/api/git/worktrees`) before local `.optima` mirror writes.
-- Use `clickup.opencode.base_url` for legacy OpenCode session/prompt delivery, not as the preferred worktree creation API when `clickup.openchamber.base_url` is configured.
+- Use `clickup.openchamber.base_url` only for OpenChamber Git worktree API calls; use `clickup.opencode.base_url` for OpenCode workspace/project sync, visibility checks, and session/prompt delivery.
 - If OpenChamber cannot create or verify the required branch/worktree (especially subtask start-from-parent semantics), fail closed with a ClickUp blocker comment instead of silently using raw `git worktree add`.
 - Do not update the principal `dev` workspace `.optima/tasks/current.md` for ClickUp task planning.
 - Unrelated active tasks in `.optima/tasks/current.md` must not block planning; move to/create the correct task worktree instead.
 - Parent setup pulls remote once; after parent branch creation, subtasks can trust the parent local branch without continuous remote polling.
 - Branches: parent `<clickup-task-type>/<parent-task-id>`; subtask `<clickup-task-type>/<parent-task-id>-subtask-<subtask-id>`; pending planned subtasks `<clickup-task-type>/<parent-task-id>-pending-<title-slug>`; PoC always `poc/<clickup-task-id>` and remains there unless productized later.
-- PR targets/start points: subtask -> parent branch and starts from the parent branch; if parent branch/worktree is missing, bootstrap the parent from `dev`/`origin/dev` first; parent -> `dev` only after Tech Lead + Validator/QA pass and `CTO`/`PO` move to `merge`; release -> `dev` to `main` only after explicit approval.
+- PR targets/start points: subtask -> parent branch and starts from the parent branch; if parent branch/worktree is missing, bootstrap the parent from `dev`/`origin/dev` first; parent -> `dev` only after Tech Lead + Validator/QA pass and a parent-validation human `Approved` comment triggers merge automation; release -> `dev` to `main` only after explicit approval.
 - Preserve user work and unrelated dirty files. Stop and ask if unexpected changes appear.
 
 ## Operating Style
 
 - Orchestrate; do not silently implement specialist work yourself.
 - Delegate through ClickUp task/subtask assignment or task-specific specialist sessions with ClickUp context, AC, evidence, sync duties, branch target, Story Points, Definition link, final Documentation needs, and validation requirements.
-- Never abandon a PM-assigned task: keep working until unblocked and handed off, or post the stop/blocker/clarification/error as a ClickUp comment, remove Workflow/Product Manager, and assign `CTO` plus `PO` or next owner.
+- Never abandon a PM-assigned task: keep working until unblocked and handed off, or post the stop/blocker/clarification/error as a ClickUp comment, remove Workflow/Product Manager, and assign the next delivery owner; assign `CTO`/`PO` only under the human approval allowlist.
 - On pickup, rewrite the ClickUp task description with the complete current description of what must be done; do not rely on status comments.
 - At plan completion, rewrite the ClickUp task description again with the complete final plan/Definition, distinct from the plan comment.
 - Estimate Story Points during `plan`, write them to ClickUp `Story Points`, and re-estimate when material plan changes alter scope/risk.
-- Before assigning `CTO`/`PO` or any next owner, remove the PM assignee and verify no task remains assigned to Workflow/Product Manager unless explicitly re-queued.
+- Before assigning any next owner, remove the PM assignee and verify no task remains assigned to Workflow/Product Manager unless explicitly re-queued; when the next owner is `CTO`/`PO`, verify the allowlist condition and comment evidence first.
 - Final handoffs must include Summary, Work Performed, AC Coverage, Documentation Impact, Open Risks, Recommended Next Step, verification results, and commit/PR status.
 
 <include:plugin:Agents_Common.md>

package/dist/index.js

@@ -8527,6 +8527,7 @@ var CLICKUP_WEBHOOK_REQUEST_TIMEOUT_MS = 1e4;
 var CLICKUP_WEBHOOK_STARTUP_TASK_LIMIT = 50;
 var CLICKUP_WEBHOOK_STARTUP_COMMENT_LIMIT = 100;
 var CLICKUP_WEBHOOK_STARTUP_RECONCILIATION_DELAY_MS = 3e4;
+var CLICKUP_WORKTREE_FAILURE_COMMENT_DEDUPE_MS = 10 * 60 * 1e3;
 var CLICKUP_WEBHOOK_LOG_LEVELS = /* @__PURE__ */ new Set(["error", "info", "verbose"]);
 var CLICKUP_WEBHOOK_REDACTED = "[REDACTED]";
 var DISCUSSION_BACKFILL_FETCH_LIMIT = 100;
@@ -8844,9 +8845,9 @@ var CLICKUP_REQUIRED_SUMMARY_SECTIONS = [
 ];
 var CLICKUP_RAW_LOG_SECTION_NAMES = /* @__PURE__ */ new Set(["Raw Logs", "Logs", "Full Logs", "Command Output", "Transcript"]);
 var CLICKUP_TRANSITIONS = /* @__PURE__ */ new Map([
-  ["plan->in progress", { status: "in progress", assignFinalApprovers: true, comment: "Plan complete; assigning CTO+PO for visibility and moving to implementation." }],
+  ["plan->in progress", { status: "in progress", comment: "Plan complete; moving to implementation without generic CTO/PO assignment." }],
   ["in progress->validation", { status: "validation", comment: "Implementation complete; ready for validation." }],
-  ["validation->merge", { status: "merge", assignFinalApprovers: true, comment: "Validation passed; parent task is ready for CTO+PO merge approval." }],
+  ["validation->merge", { status: "merge", assignFinalApprovers: true, parentOnlyFinalApproval: true, comment: "Parent validation passed with a functional preview URL; ready for CTO/PO approval flow." }],
   ["validation->in progress", { status: "in progress", comment: "Validation failed; returning to implementation." }],
   ["merge->completed", { status: "completed", comment: "Merge complete; closing delivery task." }],
   ["completed->in progress", { status: "in progress", comment: "Task reopened; returning to implementation." }],
@@ -9234,30 +9235,36 @@ function openChamberUrl(baseUrl, pathname, query = {}) {
   }
   return url.toString();
 }
-async function readOpenChamberJson(response, endpoint) {
+async function readOpenChamberJson(response, endpoint, serviceName = "OpenChamber") {
   const text = await response.text();
   let data = null;
   if (text.trim()) {
     try {
       data = JSON.parse(text);
     } catch {
-      throw new Error(`OpenChamber ${endpoint} returned non-JSON response.`);
+      throw new Error(`${serviceName} ${endpoint} returned non-JSON response.`);
     }
   }
   if (!response.ok) {
     const message = data?.error?.message || data?.message || data?.data?.message || text.slice(0, 200) || `HTTP ${response.status}`;
-    throw new Error(`OpenChamber ${endpoint} failed: ${response.status} ${message}`);
+    throw new Error(`${serviceName} ${endpoint} failed: ${response.status} ${message}`);
   }
   return data;
 }
-async function requestOpenChamberJson({ baseUrl, endpoint, method = "GET", directory, body, fetchImpl = globalThis.fetch } = {}) {
-  if (typeof fetchImpl !== "function") throw new Error("OpenChamber worktree provisioning requires fetch.");
+async function requestServiceJson({ baseUrl, serviceName = "OpenChamber", endpoint, method = "GET", directory, body, fetchImpl = globalThis.fetch } = {}) {
+  if (typeof fetchImpl !== "function") throw new Error(`${serviceName} API calls require fetch.`);
   const response = await fetchImpl(openChamberUrl(baseUrl, endpoint, { directory }), {
     method,
     headers: body ? { "content-type": "application/json" } : void 0,
     body: body ? JSON.stringify(body) : void 0
   });
-  return readOpenChamberJson(response, endpoint);
+  return readOpenChamberJson(response, endpoint, serviceName);
+}
+async function requestOpenChamberJson(options = {}) {
+  return requestServiceJson({ ...options, serviceName: "OpenChamber" });
+}
+async function requestOpenCodeJson(options = {}) {
+  return requestServiceJson({ ...options, serviceName: "OpenCode" });
 }
 function normalizeOpenChamberCollection(value) {
   if (Array.isArray(value)) return value;
@@ -9296,39 +9303,40 @@ function openChamberListIncludesBranch(list, directory, branch) {
     return !entryBranch || entryBranch === branch;
   });
 }
-async function findOpenChamberProject({ baseUrl, baseWorktree, fetchImpl = globalThis.fetch } = {}) {
-  const projects = await requestOpenChamberJson({ baseUrl, endpoint: "/project", directory: baseWorktree, fetchImpl });
+async function findOpenChamberProject({ opencodeBaseUrl, baseWorktree, fetchImpl = globalThis.fetch } = {}) {
+  const projects = await requestOpenCodeJson({ baseUrl: opencodeBaseUrl, endpoint: "/project", directory: baseWorktree, fetchImpl });
   if (!Array.isArray(projects)) return null;
   const resolvedBase = path5.resolve(baseWorktree);
   return projects.find((project) => path5.resolve(String(project?.worktree || project?.path || "")) === resolvedBase) || null;
 }
-async function refreshOpenChamberProjectCopy({ baseUrl, baseWorktree, projectId, fetchImpl = globalThis.fetch } = {}) {
+async function refreshOpenChamberProjectCopy({ opencodeBaseUrl, projectId, fetchImpl = globalThis.fetch } = {}) {
   if (!projectId) return { refreshed: false, reason: "project_id_unavailable" };
-  const response = await fetchImpl(openChamberUrl(baseUrl, `/experimental/project/${encodeURIComponent(projectId)}/copy/refresh`, {}), { method: "POST" });
-  await readOpenChamberJson(response, "/experimental/project/{projectID}/copy/refresh");
+  await requestOpenCodeJson({ baseUrl: opencodeBaseUrl, endpoint: `/experimental/project/${encodeURIComponent(projectId)}/copy/refresh`, method: "POST", fetchImpl });
   return { refreshed: true, projectId };
 }
-async function listOpenChamberGitWorktrees({ baseUrl, baseWorktree, fetchImpl = globalThis.fetch } = {}) {
-  return requestOpenChamberJson({ baseUrl, endpoint: "/api/git/worktrees", directory: baseWorktree, fetchImpl });
+async function listOpenChamberGitWorktrees({ openchamberBaseUrl, baseUrl, baseWorktree, fetchImpl = globalThis.fetch } = {}) {
+  return requestOpenChamberJson({ baseUrl: openchamberBaseUrl || baseUrl, endpoint: "/api/git/worktrees", directory: baseWorktree, fetchImpl });
 }
-async function verifyOpenChamberGitWorktree({ baseUrl, baseWorktree, worktreePath, branch, fetchImpl = globalThis.fetch } = {}) {
-  const worktrees = await listOpenChamberGitWorktrees({ baseUrl, baseWorktree, fetchImpl });
+async function verifyOpenChamberGitWorktree({ openchamberBaseUrl, baseUrl, baseWorktree, worktreePath, branch, fetchImpl = globalThis.fetch } = {}) {
+  const worktrees = await listOpenChamberGitWorktrees({ openchamberBaseUrl: openchamberBaseUrl || baseUrl, baseWorktree, fetchImpl });
   const verified = openChamberListIncludesBranch(worktrees, worktreePath, branch);
   if (!verified) {
     throw new Error(`OpenChamber Git worktree verification failed for ${worktreePath} on ${branch}.`);
   }
   return { worktree: true, branch: true };
 }
-async function syncOpenChamberWorktreeVisibility({ baseUrl, baseWorktree, worktreePath, branch, fetchImpl = globalThis.fetch } = {}) {
-  const gitWorktree = await verifyOpenChamberGitWorktree({ baseUrl, baseWorktree, worktreePath, branch, fetchImpl });
-  await requestOpenChamberJson({ baseUrl, endpoint: "/experimental/workspace/sync-list", method: "POST", directory: baseWorktree, fetchImpl });
-  const project = await findOpenChamberProject({ baseUrl, baseWorktree, fetchImpl });
-  if (!project?.id) throw new Error("OpenChamber project was not found after workspace sync; refusing to treat worktree as visible.");
-  await refreshOpenChamberProjectCopy({ baseUrl, baseWorktree, projectId: project.id, fetchImpl });
+async function syncOpenChamberWorktreeVisibility({ openchamberBaseUrl, opencodeBaseUrl, baseUrl, baseWorktree, worktreePath, branch, fetchImpl = globalThis.fetch } = {}) {
+  const effectiveOpenChamberBaseUrl = openchamberBaseUrl || baseUrl;
+  const effectiveOpenCodeBaseUrl = opencodeBaseUrl || baseUrl;
+  const gitWorktree = await verifyOpenChamberGitWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, worktreePath, branch, fetchImpl });
+  await requestOpenCodeJson({ baseUrl: effectiveOpenCodeBaseUrl, endpoint: "/experimental/workspace/sync-list", method: "POST", directory: baseWorktree, fetchImpl });
+  const project = await findOpenChamberProject({ opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, fetchImpl });
+  if (!project?.id) throw new Error("OpenCode project was not found after workspace sync; refusing to treat worktree as visible.");
+  await refreshOpenChamberProjectCopy({ opencodeBaseUrl: effectiveOpenCodeBaseUrl, projectId: project.id, fetchImpl });
   const [worktrees, workspaces, directories] = await Promise.all([
-    listOpenChamberGitWorktrees({ baseUrl, baseWorktree, fetchImpl }),
-    requestOpenChamberJson({ baseUrl, endpoint: "/experimental/workspace", directory: baseWorktree, fetchImpl }),
-    requestOpenChamberJson({ baseUrl, endpoint: `/project/${encodeURIComponent(project.id)}/directories`, directory: baseWorktree, fetchImpl })
+    listOpenChamberGitWorktrees({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, fetchImpl }),
+    requestOpenCodeJson({ baseUrl: effectiveOpenCodeBaseUrl, endpoint: "/experimental/workspace", directory: baseWorktree, fetchImpl }),
+    requestOpenCodeJson({ baseUrl: effectiveOpenCodeBaseUrl, endpoint: `/project/${encodeURIComponent(project.id)}/directories`, directory: baseWorktree, fetchImpl })
   ]);
   const visibility = {
     worktree: openChamberListIncludesBranch(worktrees, worktreePath, branch),
@@ -9338,7 +9346,7 @@ async function syncOpenChamberWorktreeVisibility({ baseUrl, baseWorktree, worktr
     projectId: project.id
   };
   if (!visibility.worktree || !visibility.workspace || !visibility.projectDirectory) {
-    throw new Error(`OpenChamber visibility verification failed for ${worktreePath}: ${JSON.stringify(visibility)}`);
+    throw new Error(`OpenCode visibility verification failed for ${worktreePath}: ${JSON.stringify(visibility)}`);
   }
   return visibility;
 }
@@ -9347,12 +9355,13 @@ function assertOpenChamberClickUpWorktreePath({ baseWorktree, worktreePath } = {
     throw new Error(`OpenChamber worktree path is outside the configured ClickUp sibling scope: ${worktreePath}`);
   }
 }
-async function createOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch, worktreePath, startPoint, branchExists = false, fetchImpl = globalThis.fetch } = {}) {
+async function createOpenChamberClickUpWorktree({ openchamberBaseUrl, baseUrl, baseWorktree, branch, worktreePath, startPoint, branchExists = false, fetchImpl = globalThis.fetch } = {}) {
+  const effectiveOpenChamberBaseUrl = openchamberBaseUrl || baseUrl;
   const worktreeName = clickUpOpenChamberWorktreeName(branch);
   const body = { name: worktreeName, mode: branchExists ? "existing" : "new", worktreeName, branchName: branch, startRef: branchExists ? branch : startPoint };
   let created;
   try {
-    created = await requestOpenChamberJson({ baseUrl, endpoint: "/api/git/worktrees", method: "POST", directory: baseWorktree, body, fetchImpl });
+    created = await requestOpenChamberJson({ baseUrl: effectiveOpenChamberBaseUrl, endpoint: "/api/git/worktrees", method: "POST", directory: baseWorktree, body, fetchImpl });
   } catch (error) {
     throw new Error(`OpenChamber could not create ${branch} from ${branchExists ? branch : startPoint}; API may not support required branch/startRef semantics. Fail-closed: ${error.message}`);
   }
@@ -9364,15 +9373,17 @@ async function createOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch,
   if (createdBranch !== branch) {
     throw new Error(`OpenChamber created unexpected branch ${createdBranch || "<unknown>"}; expected ${branch}.`);
   }
-  const verified = await verifyOpenChamberGitWorktree({ baseUrl, baseWorktree, worktreePath: createdDirectory, branch, fetchImpl });
+  const verified = await verifyOpenChamberGitWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, worktreePath: createdDirectory, branch, fetchImpl });
   return { created, worktree: path5.resolve(createdDirectory), branch: createdBranch, verified };
 }
-async function registerOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch, worktreePath, fetchImpl = globalThis.fetch, source = "reuse" } = {}) {
+async function registerOpenChamberClickUpWorktree({ openchamberBaseUrl, opencodeBaseUrl, baseUrl, baseWorktree, branch, worktreePath, fetchImpl = globalThis.fetch, source = "reuse" } = {}) {
   assertOpenChamberClickUpWorktreePath({ baseWorktree, worktreePath });
-  const visibility = await syncOpenChamberWorktreeVisibility({ baseUrl, baseWorktree, worktreePath, branch, fetchImpl });
+  const visibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: openchamberBaseUrl || baseUrl, opencodeBaseUrl: opencodeBaseUrl || baseUrl, baseWorktree, worktreePath, branch, fetchImpl });
   return { branch, worktree: path5.resolve(worktreePath), reused: true, provider: "openchamber", openChamber: { source, visibility } };
 }
-async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, baseUrl = "", fetchImpl = globalThis.fetch, log = null } = {}) {
+async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId, taskType = "Tarea", parentTaskId = "", subtaskId = "", existingMetadata = {}, runGitFn = runGit, openchamberBaseUrl = "", opencodeBaseUrl = "", baseUrl = "", fetchImpl = globalThis.fetch, log = null } = {}) {
+  const effectiveOpenChamberBaseUrl = openchamberBaseUrl || baseUrl;
+  const effectiveOpenCodeBaseUrl = opencodeBaseUrl || baseUrl;
   const effectiveParent = parentTaskId || taskId;
   const isSubtask = isClickUpSubtaskRoute({ taskType, parentTaskId: effectiveParent, subtaskId, taskId });
   const parentBranch = isSubtask ? deriveClickUpBranchName({ taskType, parentTaskId: effectiveParent }) : "";
@@ -9380,13 +9391,13 @@ async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId,
   const prTarget = parentBranch || "dev";
   const existing = safeExistingClickUpWorktree({ metadata: existingMetadata, branch });
   if (existing) {
-    const registered = await registerOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch, worktreePath: existing.worktree, fetchImpl, source: "metadata_reuse" });
+    const registered = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch, worktreePath: existing.worktree, fetchImpl, source: "metadata_reuse" });
     log?.({ type: "openchamber_worktree_registered", taskId, branch, worktree: registered.worktree, source: "metadata_reuse", visibility: registered.openChamber.visibility });
     return { ...registered, parentBranch: parentBranch || void 0, prTarget };
   }
   const worktreePath = deriveClickUpWorktree({ baseWorktree, taskId, taskType, parentTaskId: effectiveParent, subtaskId });
   if (fs5.existsSync(worktreePath)) {
-    const registered = await registerOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch, worktreePath, fetchImpl, source: "existing_directory" });
+    const registered = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch, worktreePath, fetchImpl, source: "existing_directory" });
     log?.({ type: "openchamber_worktree_registered", taskId, branch, worktree: registered.worktree, source: "existing_directory", visibility: registered.openChamber.visibility });
     return { ...registered, parentBranch: parentBranch || void 0, prTarget };
   }
@@ -9394,40 +9405,54 @@ async function ensureClickUpTaskWorktreeOpenChamber({ baseWorktree = "", taskId,
   if (isSubtask) {
     const parentWorktree = deriveClickUpWorktree({ baseWorktree, taskId: effectiveParent, taskType, parentTaskId: effectiveParent });
     if (fs5.existsSync(parentWorktree)) {
-      const registeredParent = await registerOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, fetchImpl, source: "parent_existing_directory" });
+      const registeredParent = await registerOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, fetchImpl, source: "parent_existing_directory" });
       parentBootstrap = { branch: parentBranch, worktree: registeredParent.worktree, reused: true, provider: "openchamber", visibility: registeredParent.openChamber.visibility };
     } else {
       const parentStartPoint = resolveClickUpDevStartPoint(baseWorktree, runGitFn);
       const parentBranchExists = clickUpGitRefExists(baseWorktree, parentBranch, runGitFn);
-      const createdParent = await createOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, startPoint: parentStartPoint, branchExists: parentBranchExists, fetchImpl });
-      const parentVisibility = await syncOpenChamberWorktreeVisibility({ baseUrl, baseWorktree, worktreePath: createdParent.worktree, branch: parentBranch, fetchImpl });
+      const createdParent = await createOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, branch: parentBranch, worktreePath: parentWorktree, startPoint: parentStartPoint, branchExists: parentBranchExists, fetchImpl });
+      const parentVisibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, worktreePath: createdParent.worktree, branch: parentBranch, fetchImpl });
       parentBootstrap = { branch: parentBranch, worktree: createdParent.worktree, startPoint: parentBranchExists ? parentBranch : parentStartPoint, reused: parentBranchExists, provider: "openchamber", visibility: parentVisibility };
       log?.({ type: "openchamber_worktree_created", taskId: effectiveParent, branch: parentBranch, worktree: parentBootstrap.worktree, startPoint: parentBootstrap.startPoint, visibility: parentVisibility });
     }
   }
   const startPoint = isSubtask ? parentBranch : resolveClickUpDevStartPoint(baseWorktree, runGitFn);
   const branchExists = clickUpGitRefExists(baseWorktree, branch, runGitFn);
-  const created = await createOpenChamberClickUpWorktree({ baseUrl, baseWorktree, branch, worktreePath, startPoint, branchExists, fetchImpl });
-  const visibility = await syncOpenChamberWorktreeVisibility({ baseUrl, baseWorktree, worktreePath: created.worktree, branch, fetchImpl });
+  const created = await createOpenChamberClickUpWorktree({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, baseWorktree, branch, worktreePath, startPoint, branchExists, fetchImpl });
+  const visibility = await syncOpenChamberWorktreeVisibility({ openchamberBaseUrl: effectiveOpenChamberBaseUrl, opencodeBaseUrl: effectiveOpenCodeBaseUrl, baseWorktree, worktreePath: created.worktree, branch, fetchImpl });
   log?.({ type: "openchamber_worktree_created", taskId, branch, worktree: created.worktree, startPoint: branchExists ? branch : startPoint, visibility });
   return { branch, worktree: created.worktree, reused: false, startPoint, parentBranch: parentBranch || void 0, prTarget, parentBootstrap: parentBootstrap || void 0, provider: "openchamber", openChamber: { source: "created", visibility } };
 }
 async function ensureClickUpTaskWorktreeForWebhook({ opencodeBaseUrl = "", opencodeBaseUrlConfigured = false, openchamberBaseUrl = "", openchamberBaseUrlConfigured = false, clickupClient = null, webhookWorktree = process.cwd(), fetchImpl = globalThis.fetch, ...options } = {}) {
-  void opencodeBaseUrl;
   void opencodeBaseUrlConfigured;
   if (!openchamberBaseUrlConfigured || !openchamberBaseUrl) return ensureClickUpTaskWorktree(options);
   try {
-    return await ensureClickUpTaskWorktreeOpenChamber({ ...options, baseUrl: openchamberBaseUrl, fetchImpl, log: (entry) => appendClickUpWebhookLocalLog(webhookWorktree, entry) });
+    return await ensureClickUpTaskWorktreeOpenChamber({ ...options, openchamberBaseUrl, opencodeBaseUrl, fetchImpl, log: (entry) => appendClickUpWebhookLocalLog(webhookWorktree, entry) });
   } catch (error) {
     const message = `OpenChamber worktree provisioning failed for ${options.taskId || "unknown task"}; raw git fallback is disabled to avoid invisible worktrees. ${error.message}`;
     appendClickUpWebhookLocalLog(webhookWorktree, { type: "openchamber_worktree_failed", taskId: options.taskId || null, message });
     if (typeof clickupClient?.postTaskComment === "function") {
-      try {
-        await clickupClient.postTaskComment({ taskId: options.taskId, comment: `${message}
+      const taskId = options.taskId || "unknown task";
+      const ledgerPath = clickUpCommentLedgerPath(webhookWorktree);
+      const comment = `${message}
 
-Optima did not run raw git worktree fallback. Please verify clickup.openchamber.base_url and OpenChamber Git API compatibility.` });
-      } catch (commentError) {
-        appendClickUpWebhookLocalLog(webhookWorktree, { type: "openchamber_worktree_blocker_comment_failed", taskId: options.taskId || null, message: commentError.message });
+Optima did not run raw git worktree fallback. Please verify clickup.openchamber.base_url and OpenCode/OpenChamber endpoint configuration.`;
+      let dedupe = { post: true, key: clickUpWorktreeFailureCommentKey({ taskId, message }) };
+      try {
+        dedupe = shouldPostClickUpWorktreeFailureComment({ ledgerPath, taskId, message });
+      } catch (ledgerError) {
+        appendClickUpWebhookLocalLog(webhookWorktree, { type: "openchamber_worktree_comment_dedupe_failed", taskId, message: ledgerError.message });
+      }
+      if (dedupe.post) {
+        try {
+          await clickupClient.postTaskComment({ taskId: options.taskId, comment });
+          recordClickUpWorktreeFailureComment({ ledgerPath, taskId, message, posted: true });
+        } catch (commentError) {
+          appendClickUpWebhookLocalLog(webhookWorktree, { type: "openchamber_worktree_blocker_comment_failed", taskId: options.taskId || null, message: commentError.message });
+        }
+      } else {
+        appendClickUpWebhookLocalLog(webhookWorktree, { type: "openchamber_worktree_blocker_comment_deduped", taskId, key: dedupe.key, reason: dedupe.reason });
+        recordClickUpWorktreeFailureComment({ ledgerPath, taskId, message, posted: false, skippedReason: dedupe.reason });
       }
     }
     throw new Error(message);
@@ -9561,11 +9586,14 @@ function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed
   const key = `${from}->${to}`;
   const rule = CLICKUP_TRANSITIONS.get(key);
   if (!rule) return { ok: false, dryRun: true, message: `Transition not allowed: ${key}` };
-  const assignsFinalApprovers = rule.assignFinalApprovers === true;
-  const requiresPlanCompletionContract = from === "plan" && assignsFinalApprovers;
+  const assignsFinalApprovers = rule.assignFinalApprovers === true && !(rule.parentOnlyFinalApproval && isSubtask);
+  const requiresPlanCompletionContract = from === "plan" && to === "in progress";
   const definitionContent = compactMarkdownValue(definition);
   const description = compactMarkdownValue(planDescription);
   const validationErrors = [];
+  if (rule.parentOnlyFinalApproval && isSubtask) {
+    validationErrors.push("Subtasks must not use the parent final-approval transition; merge validated subtasks directly into the parent branch/workspace.");
+  }
   if (assignsFinalApprovers && !isRealClickUpAssigneeId(productManagerAssignee) && requireProductManagerAssignee !== false) {
     validationErrors.push("productManagerAssignee must be the configured ClickUp PM assignee ID before assigning final approvers.");
   }
@@ -9574,10 +9602,10 @@ function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed
     if (!definitionContent) validationErrors.push("definition is required and must contain the complete plan/Definition content at plan completion.");
   }
   if (validationErrors.length > 0) return clickUpPayloadValidationError(validationErrors);
-  const finalApprovers = rule.assignFinalApprovers ? finalApprovalAssignees(CLICKUP_FINAL_APPROVER_ROLES, humansRegistry) : [];
+  const finalApprovers = assignsFinalApprovers ? finalApprovalAssignees(CLICKUP_FINAL_APPROVER_ROLES, humansRegistry) : [];
   const explicitRemovals = (removeAssignees || []).filter(Boolean);
   const normalizedProductManagerAssignee = isRealClickUpAssigneeId(productManagerAssignee) ? String(productManagerAssignee).trim() : "";
-  const removalTargets = rule.assignFinalApprovers ? [...new Set([normalizedProductManagerAssignee, ...explicitRemovals].filter(Boolean))] : explicitRemovals;
+  const removalTargets = assignsFinalApprovers ? [...new Set([normalizedProductManagerAssignee, ...explicitRemovals].filter(Boolean))] : explicitRemovals;
   const assigned = [...new Set([...assignees || [], ...finalApprovers].filter(Boolean))].filter((assignee) => !removalTargets.includes(assignee));
   const authority = from === "validation" || to === "merge" ? determineClickUpMergeAuthority({ isSubtask, clickupStatus: to, validationPassed: validationPassed || to === "merge", humansRegistry }) : null;
   const fields = authority ? { merge_authority: JSON.stringify(authority) } : {};
@@ -9592,7 +9620,7 @@ function buildClickUpTransitionPayload({ fromStatus, toStatus, validationPassed
       assignment_delta: {
         add: assigned,
         remove: removalTargets,
-        objective: rule.assignFinalApprovers ? "zero_product_manager_assigned_tasks" : "preserve_existing_owner_policy"
+        objective: assignsFinalApprovers ? "zero_product_manager_assigned_tasks" : "preserve_existing_owner_policy"
       },
       comment: rule.comment,
       description,
@@ -10050,11 +10078,17 @@ function createTestClickUpApiClient(config) {
     __metadata: metadata
   };
 }
-function normalizeClickUpWebhookApiResponse(response = {}, fallbackConfig = null) {
-  const webhook = response?.webhook || response?.data || response || {};
+function clickUpWebhookRemoteInactiveReason(webhook = {}) {
   const healthStatus = String(webhook.health?.status || webhook.health_status || "").trim().toLowerCase();
   const status = String(webhook.status || webhook.state || "").trim().toLowerCase();
-  const active = webhook.active !== false && !["inactive", "disabled", "suspended", "failed", "failing", "error", "errored", "paused"].includes(status) && !["failed", "failing", "unhealthy", "error", "errored", "suspended", "paused"].includes(healthStatus);
+  if (["suspended", "paused", "failed", "failing", "unhealthy", "error", "errored"].includes(healthStatus)) return `remote_health_${healthStatus}`;
+  if (["inactive", "disabled", "suspended", "failed", "failing", "error", "errored", "paused"].includes(status)) return `remote_status_${status}`;
+  if (webhook.active === false) return "remote_inactive";
+  return "";
+}
+function normalizeClickUpWebhookApiResponse(response = {}, fallbackConfig = null) {
+  const webhook = response?.webhook || response?.data || response || {};
+  const active = !clickUpWebhookRemoteInactiveReason(webhook);
   return sanitizeClickUpWebhookState({
     active,
     webhookId: webhook.id || webhook.webhook_id || webhook.webhookId,
@@ -10080,20 +10114,44 @@ function clickUpWebhookLocationCompatible(webhook = {}, config = {}) {
   }
   return true;
 }
+function clickUpWebhookEventsCompatible(webhook = {}, config = {}) {
+  if (!Array.isArray(webhook.events) || webhook.events.length === 0) return false;
+  const actualEvents = new Set(webhook.events);
+  return [...new Set(config?.webhook?.events || [])].every((event) => actualEvents.has(event));
+}
+function clickUpWebhookRemoteCompatibilityReason(webhook = {}, config = {}) {
+  if (!clickUpWebhookLocationCompatible(webhook, config)) return "remote_location_mismatch";
+  if (!clickUpWebhookEventsCompatible(webhook, config)) return "remote_events_mismatch";
+  return "";
+}
+function isClickUpWebhookRemoteSelfHealableReason(reason = "") {
+  const normalized = String(reason || "");
+  return normalized === "remote_inactive" || normalized.startsWith("remote_health_") || normalized.startsWith("remote_status_");
+}
 async function findReusableClickUpWebhook(config, clickupClient = null, existingState = null) {
   if (!clickupClient?.listWebhooks) return null;
   const listed = await clickupClient.listWebhooks({ teamId: config.teamId });
-  let secretlessMatch = null;
+  let incompatibleMatch = null;
   for (const webhook of clickUpWebhookListItems(listed)) {
     const remote = normalizeClickUpWebhookApiResponse(webhook, config);
     if (remote.publicUrl !== config.webhook.publicUrl) continue;
-    if (!clickUpWebhookLocationCompatible(webhook, config)) continue;
+    const compatibilityReason = clickUpWebhookRemoteCompatibilityReason(webhook, config);
+    if (compatibilityReason) {
+      if (compatibilityReason === "remote_events_mismatch" && remote.webhookId && !incompatibleMatch) incompatibleMatch = { ...remote, active: false, reason: compatibilityReason };
+      continue;
+    }
     const existingSecret = existingState?.webhookId === remote.webhookId ? existingState.secret : "";
     const reusable = remote.secret ? remote : { ...remote, secret: existingSecret };
     if (isClickUpWebhookStateActive(reusable, config)) return reusable;
-    if (remote.webhookId && !secretlessMatch) secretlessMatch = { ...remote, active: false, reason: "remote_secret_unavailable" };
+    if (remote.webhookId && !incompatibleMatch) {
+      incompatibleMatch = {
+        ...remote,
+        active: false,
+        reason: remote.active === false ? clickUpWebhookRemoteInactiveReason(webhook) || "remote_inactive" : "remote_secret_unavailable"
+      };
+    }
   }
-  return secretlessMatch;
+  return incompatibleMatch;
 }
 async function validateClickUpWebhookState(state, config, clickupClient = null, { allowRemoteUnhealthyLocalRecovery = false } = {}) {
   if (!isClickUpWebhookStateActive(state, config)) return { valid: false, reason: "state_incomplete" };
@@ -10108,7 +10166,7 @@ async function validateClickUpWebhookState(state, config, clickupClient = null,
     }
     const localStateValidation = await validateClickUpWebhookState(state, config, null);
     if (allowRemoteUnhealthyLocalRecovery && localStateValidation.valid && remote.webhookId === state.webhookId) {
-      const remoteConfigMatches = remote.publicUrl === config.webhook.publicUrl && [...new Set(config.webhook.events || [])].every((event) => new Set(remote.events || []).has(event));
+      const remoteConfigMatches = remote.publicUrl === config.webhook.publicUrl && !clickUpWebhookRemoteCompatibilityReason(match, config);
       if (remoteConfigMatches) {
         return {
           ...localStateValidation,
@@ -10133,12 +10191,18 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
   const { config } = validation;
   const existing = existingState ? sanitizeClickUpWebhookState(existingState, config) : readClickUpWebhookState(worktree, config);
   const existingValidation = await validateClickUpWebhookState(existing, config, clickupClient, { allowRemoteUnhealthyLocalRecovery: true });
-  if (existingValidation.valid) {
+  const canReplaceUnhealthyExisting = existingValidation.mode === "local_state_remote_unhealthy" && existingValidation.remote?.webhookId && clickupClient?.deleteWebhook && clickupClient?.createWebhook;
+  if (existingValidation.valid && !canReplaceUnhealthyExisting) {
     const state = writeClickUpWebhookState(worktree, { ...existingValidation.state, recentEventKeys: existing.recentEventKeys || [] }, config);
     clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_reused", webhookId: state.webhookId, mode: existingValidation.mode });
     return { active: true, valid: true, mode: existingValidation.mode, limitation: existingValidation.limitation, state };
   }
-  const reusableRemote = await findReusableClickUpWebhook(config, clickupClient, existing);
+  const reusableRemote = canReplaceUnhealthyExisting ? {
+    ...existingValidation.remote,
+    active: false,
+    secret: existingValidation.remote.secret || existing.secret,
+    reason: clickUpWebhookRemoteInactiveReason(existingValidation.remote) || existingValidation.reason || "remote_unhealthy_self_heal"
+  } : await findReusableClickUpWebhook(config, clickupClient, existing);
   if (reusableRemote) {
     if (isClickUpWebhookStateActive(reusableRemote, config)) {
       const state = writeClickUpWebhookState(worktree, { ...reusableRemote, recentEventKeys: existing.recentEventKeys || [] }, config);
@@ -10146,10 +10210,31 @@ async function ensureClickUpWebhookSubscription({ validation, worktree, clickupC
       clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_reused", webhookId: state.webhookId, mode: mode2 });
       return { active: true, valid: true, mode: mode2, state };
     }
-    clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_preserved", webhookId: reusableRemote.webhookId, reason: reusableRemote.reason || "remote_webhook_exists_without_secret" });
-    return { active: false, valid: false, reason: reusableRemote.reason || "remote_webhook_exists_without_secret", state: existing, remote: reusableRemote };
+    if (reusableRemote.active === false && reusableRemote.reason !== "remote_secret_unavailable") {
+      if (!isClickUpWebhookRemoteSelfHealableReason(reusableRemote.reason)) {
+        clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_preserved", webhookId: reusableRemote.webhookId, reason: reusableRemote.reason || "remote_incompatible" });
+        return { active: false, valid: false, reason: reusableRemote.reason || "remote_incompatible", state: existing, remote: reusableRemote };
+      }
+      if (clickupClient?.deleteWebhook && clickupClient?.createWebhook) {
+        const deleteResult = await deleteClickUpWebhookBestEffort({ webhookId: reusableRemote.webhookId, clickupClient, worktree, reason: reusableRemote.reason || "remote_unhealthy_self_heal" });
+        if (deleteResult.ok) {
+          if (existing.webhookId === reusableRemote.webhookId) markClickUpWebhookInactive(worktree, existing, config);
+        } else {
+          const reason = deleteResult.reason || "remote_unhealthy_delete_failed";
+          clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_preserved", webhookId: reusableRemote.webhookId, reason });
+          return { active: false, valid: false, reason, state: existing, remote: reusableRemote, deleteResult };
+        }
+      } else {
+        const reason = clickupClient?.deleteWebhook ? "remote_unhealthy_create_unavailable" : "remote_unhealthy_delete_unavailable";
+        clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_preserved", webhookId: reusableRemote.webhookId, reason });
+        return { active: false, valid: false, reason, state: existing, remote: reusableRemote };
+      }
+    } else {
+      clickUpWebhookLifecycleLog(worktree, { type: "remote_webhook_preserved", webhookId: reusableRemote.webhookId, reason: reusableRemote.reason || "remote_webhook_exists_without_secret" });
+      return { active: false, valid: false, reason: reusableRemote.reason || "remote_webhook_exists_without_secret", state: existing, remote: reusableRemote };
+    }
   }
-  if (existing.webhookId && clickupClient?.deleteWebhook) {
+  if (existing.webhookId && existing.webhookId !== reusableRemote?.webhookId && clickupClient?.deleteWebhook) {
     await deleteClickUpWebhookBestEffort({ webhookId: existing.webhookId, clickupClient, worktree, reason: existingValidation.reason || "startup_self_heal" });
     markClickUpWebhookInactive(worktree, existing, config);
   }
@@ -10227,23 +10312,29 @@ function rememberClickUpWebhookEvent(state = {}, eventKey, limit = 200) {
   if (recent.includes(eventKey)) return { duplicate: true, state };
   return { duplicate: false, state: { ...state, recentEventKeys: [...recent, eventKey].slice(-limit) } };
 }
-function readClickUpCommentLedger(ledgerPath) {
-  const processed = /* @__PURE__ */ new Set();
-  if (!ledgerPath || !fs5.existsSync(ledgerPath)) return processed;
+function readClickUpCommentLedgerEntries(ledgerPath) {
+  if (!ledgerPath || !fs5.existsSync(ledgerPath)) return [];
   try {
     const raw = fs5.readFileSync(ledgerPath, "utf8");
+    const entries = [];
     for (const [index, line] of raw.split(/\r?\n/).entries()) {
       if (!line.trim()) continue;
       try {
-        const entry = JSON.parse(line);
-        if (entry?.key) processed.add(String(entry.key));
+        entries.push(JSON.parse(line));
       } catch (error) {
         throw new Error(`malformed ledger row ${index + 1}: ${error.message}`);
       }
     }
+    return entries;
   } catch (error) {
     throw new Error(`ClickUp comment ledger unavailable: ${error.message}`);
   }
+}
+function readClickUpCommentLedger(ledgerPath) {
+  const processed = /* @__PURE__ */ new Set();
+  for (const entry of readClickUpCommentLedgerEntries(ledgerPath)) {
+    if (entry?.key) processed.add(String(entry.key));
+  }
   return processed;
 }
 function appendClickUpCommentLedgerEntry(ledgerPath, entry = {}) {
@@ -10309,6 +10400,35 @@ function recordClickUpCommentVersionProcessed({ ledgerPath, key, taskId, eventTy
     recordedAt: at.toISOString()
   });
 }
+function clickUpWorktreeFailureCommentKey({ taskId, message } = {}) {
+  const hash = crypto.createHash("sha256").update(String(message || "")).digest("hex").slice(0, 16);
+  return [String(taskId || "unknown").trim() || "unknown", "worktree_failure", hash].join(":");
+}
+function shouldPostClickUpWorktreeFailureComment({ ledgerPath, taskId, message, now = /* @__PURE__ */ new Date(), windowMs = CLICKUP_WORKTREE_FAILURE_COMMENT_DEDUPE_MS } = {}) {
+  const key = clickUpWorktreeFailureCommentKey({ taskId, message });
+  const nowMs = now instanceof Date ? now.getTime() : new Date(now).getTime();
+  for (const entry of readClickUpCommentLedgerEntries(ledgerPath).reverse()) {
+    if (entry?.key !== key) continue;
+    const postedAtMs = new Date(entry.postedAt || entry.recordedAt || entry.at || 0).getTime();
+    if (Number.isFinite(postedAtMs) && Number.isFinite(nowMs) && nowMs - postedAtMs <= windowMs) {
+      return { post: false, key, reason: "recent_duplicate" };
+    }
+    if (entry?.message === message) return { post: false, key, reason: "latest_equivalent" };
+  }
+  return { post: true, key };
+}
+function recordClickUpWorktreeFailureComment({ ledgerPath, taskId, message, posted = true, skippedReason = null, at = /* @__PURE__ */ new Date() } = {}) {
+  appendClickUpCommentLedgerEntry(ledgerPath, {
+    key: clickUpWorktreeFailureCommentKey({ taskId, message }),
+    taskId,
+    eventType: "worktree_failure",
+    action: posted ? "worktree_failure_comment_posted" : "worktree_failure_comment_skipped",
+    message,
+    posted,
+    skippedReason,
+    postedAt: at.toISOString()
+  });
+}
 function clickUpTaskIdFromPayload(payload = {}) {
   return String(payload.task_id || payload.taskId || payload.task?.id || payload.task?.task_id || "").trim();
 }