@galda/cli 0.10.0

package/engine/server.mjs

@@ -0,0 +1,3315 @@
+#!/usr/bin/env node
+// Manager for AI — chat → Claude Code server (dogfood v0.2)
+//
+//   node engine/server.mjs        → http://localhost:4400
+//
+// v0.2: a chat message is a GOAL. The Manager first decomposes it into
+// numbered tasks (planner = claude -p), then runs each task with a Claude
+// Code worker whose live activity (tool calls) streams to the UI. Queues are
+// per-project (galda1 ∥ galda2, serial within a project). Workers can run
+// node/npm for tests but have no git — they can never commit, push or deploy.
+// If the goal asks for a pull request, the Manager opens one from a temp
+// worktree once all tasks are done (the user's working tree is never touched).
+
+import { createServer } from 'node:http';
+import { spawn, execFile, spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { resolve, dirname, join, basename } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { pathToFileURL } from 'node:url';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken } from './lib.mjs';
+import { openPR } from './pr.mjs';
+import { runVerification, exerciseUi } from './verify.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+// repo checkout keeps state in engine/ as before; an installed package
+// keeps it in ~/.manager-for-ai (never inside the npx cache)
+const DATA_DIR = process.env.MANAGER_HOME
+  ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
+mkdirSync(DATA_DIR, { recursive: true });
+const PORT = Number(process.env.MANAGER_PORT ?? 4400);
+
+// Access key: required for every request when the server is exposed beyond
+// localhost (e.g. through a tunnel). Auto-generated once, kept out of git.
+const keyFile = join(DATA_DIR, 'secret.key');
+if (!existsSync(keyFile)) writeFileSync(keyFile, randomBytes(18).toString('base64url'));
+const ACCESS_KEY = readFileSync(keyFile, 'utf8').trim();
+// Per-worker run cap. Env-configurable so it can be tuned operationally and the
+// timeout→'interrupted' path is testable (a test sets a short value + a slow
+// fake worker instead of waiting 10 real minutes).
+const WORKER_TIMEOUT_MS = Number(process.env.MANAGER_WORKER_TIMEOUT_MS) || 15 * 60 * 1000;
+const MODELS = ['sonnet', 'opus', 'haiku'];
+const CODEX_MODELS = ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex-spark'];
+const WORKER_AGENTS = ['claude-code', 'codex'];
+const CLAUDE_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const CODEX_EFFORTS = ['low', 'medium', 'high', 'xhigh'];
+function workerAgent(agent) { return WORKER_AGENTS.includes(agent) ? agent : 'claude-code'; }
+function workerModel(agent, model) {
+  return workerAgent(agent) === 'codex'
+    ? (CODEX_MODELS.includes(model) ? model : CODEX_MODELS[0])
+    : (MODELS.includes(model) ? model : 'sonnet');
+}
+function workerEffort(agent, effort) {
+  const list = workerAgent(agent) === 'codex' ? CODEX_EFFORTS : CLAUDE_EFFORTS;
+  return list.includes(effort) ? effort : 'medium';
+}
+
+// ---- goal 427: token/quota-frugal guardrails ------------------------------
+// Per-goal run budget (checkRunBudget in lib.mjs does the actual decision).
+// Defaults are deliberately generous — a legitimate multi-task goal with a
+// few verify retries and a rework round or two should never trip this; it
+// exists to stop a genuinely runaway goal (stuck retry loop, a goal that
+// somehow never converges) from quietly burning the weekly quota while the
+// user is AFK ("wake up to evidence, not a burned quota" — PRD §4/§6).
+// All three are overridable via env for anyone who wants a tighter leash.
+function goalRunBudgetLimits() {
+  return {
+    maxRuntimeMs: Number(process.env.MANAGER_GOAL_MAX_RUNTIME_MS) || 2 * 60 * 60 * 1000, // 2h of actual worker wall-time
+    maxTokens: Number(process.env.MANAGER_GOAL_MAX_TOKENS) || 3_000_000, // combined in+out+cache tokens
+    maxAttempts: Number(process.env.MANAGER_GOAL_MAX_ATTEMPTS) || 20, // cumulative `claude` spawns for this goal
+  };
+}
+// Rate-limit pause/resume backoff (nextResumeDelay in lib.mjs). Overridable
+// so tests (and an impatient human) don't have to wait a real 5 minutes.
+function rateLimitDelayOpts() {
+  return {
+    baseMs: Number(process.env.MANAGER_RATE_LIMIT_BASE_MS) || 5 * 60 * 1000,
+    maxMs: Number(process.env.MANAGER_RATE_LIMIT_MAX_MS) || 60 * 60 * 1000,
+  };
+}
+// How often the resume sweep checks for a rate-limited goal whose cooldown
+// has elapsed (see rateLimitResumeSweep below). Restart-durable: the sweep
+// re-derives "is it time yet" from goal.blocked.resumeAt (persisted), so a
+// server restart during the pause just means the sweep picks it up on the
+// next tick instead of losing an in-memory timer.
+const RATE_LIMIT_SWEEP_MS = Number(process.env.MANAGER_RATE_LIMIT_SWEEP_MS) || 15000;
+const MAX_AUTO_TEST_REWORKS = Number(process.env.MANAGER_AUTO_TEST_REWORKS ?? 2);
+const MAX_AUTO_BUDGET_REWORKS = Number(process.env.MANAGER_AUTO_BUDGET_REWORKS ?? 1);
+const CACHE_READ_TOKEN_WEIGHT = Number(process.env.MANAGER_CACHE_READ_TOKEN_WEIGHT ?? 0.1);
+
+// Slow mode (goal 427 §3): an opt-in pacing so an AFK run doesn't burn
+// through quota as fast as the hardware allows. Off by default (unchanged
+// behaviour). On: caps this project's own parallelism to 1 concurrent task
+// and enforces a minimum gap between successive task STARTS (not between
+// goals — a goal's own multi-task sequence already runs serially).
+function slowModeSettings() {
+  const enabled = /^(1|true|on)$/i.test(String(process.env.MANAGER_SLOW_MODE ?? ''));
+  return {
+    enabled,
+    delayMs: Number(process.env.MANAGER_SLOW_MODE_DELAY_MS) || 60 * 1000,
+    maxParallel: Number(process.env.MANAGER_SLOW_MODE_MAX_PARALLEL) || 1,
+  };
+}
+
+// Cloudflare Access (Google login) — stage 1 of "common URL → Google login".
+// When this hostname sits behind CF Access, CF injects a signed RS256 JWT
+// (`Cf-Access-Jwt-Assertion`) on every request after the visitor signs in
+// with Google. We verify that JWT (signature + exp + aud, see
+// verifyCfAccessJwt in lib.mjs) and treat a valid one as authed — on top of,
+// not instead of, the existing ?key= gate, which keeps working for
+// dev/localhost and as a backward-compatible fallback. Unset either env var
+// and CF Access checking is fully disabled (only ?key= works) — it never
+// "fails open".
+const CF_ACCESS_TEAM_DOMAIN = process.env.CF_ACCESS_TEAM_DOMAIN ?? '';
+const CF_ACCESS_AUD = process.env.CF_ACCESS_AUD ?? '';
+const CF_ACCESS_ENABLED = Boolean(CF_ACCESS_TEAM_DOMAIN && CF_ACCESS_AUD);
+const CF_ACCESS_JWKS_TTL_MS = 10 * 60 * 1000;
+
+// Stage 2 ("common URL → branch by user"): Masa's own Google address, so
+// that logging in via CF Access still resolves to the OWNER identity and he
+// keeps seeing every pre-existing goal (see resolveIdentity/goalVisibleTo in
+// lib.mjs). Unset → only key-auth is the owner; every other authed email is
+// just another allow-listed user with their own, separate goal set.
+const MANAGER_OWNER_EMAIL = process.env.MANAGER_OWNER_EMAIL ?? '';
+
+// Public self-serve billing (docs/BILLING-LAUNCH-PLAN.md): the independent
+// Cloudflare Worker that owns Stripe + isPaying lookup (workers/billing-api).
+// Unset → billing-api is never called and every non-owner identity is judged
+// on the free tier alone (fetchIsPaying degrades to null, never throws — see
+// below). This is intentionally a thin, optional gate: engine/server.mjs
+// still works standalone (e.g. for Collaborators / dev) with no billing-api
+// configured at all.
+const BILLING_API_URL = (process.env.MANAGER_BILLING_API_URL ?? '').replace(/\/$/, '');
+const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
+
+// License token (local-first identity, docs/BILLING-LAUNCH-PLAN.md): a signed
+// proof-of-identity the app obtains automatically via "Sign in with Google"
+// (the loopback OAuth flow — /api/signin-url → billing /connect → Google →
+// /oauth/callback below — hands it back with no copy-paste). Verified OFFLINE
+// (verifyLicenseToken, Ed25519) so it works even when billing-api is
+// unreachable — it proves WHO is asking (their verified email), not whether
+// they're paying right now (that's still a live GET /entitlement, cached — see
+// requireEntitlementGate below). Persisted as plain text next to secret.key so
+// it survives restarts.
+const licenseFile = join(DATA_DIR, 'license.token');
+let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
+
+// One-time nonces for the "Sign in with Google" loopback (GET /api/signin-url →
+// billing /connect → Google → billing → GET /oauth/callback). The engine issues
+// the nonce, round-trips it through the flow, and requires it back — so a random
+// page can't drive the local /oauth/callback with a token the user never asked for.
+const SIGNIN_NONCE_TTL_MS = 10 * 60 * 1000;
+const pendingSignins = new Map(); // nonce -> expiresAt
+function newSigninNonce() {
+  const now = Date.now();
+  for (const [k, exp] of pendingSignins) if (exp < now) pendingSignins.delete(k); // opportunistic sweep
+  const nonce = randomBytes(18).toString('base64url');
+  pendingSignins.set(nonce, now + SIGNIN_NONCE_TTL_MS);
+  return nonce;
+}
+function consumeSigninNonce(nonce) {
+  const exp = pendingSignins.get(nonce);
+  if (exp === undefined) return false;
+  pendingSignins.delete(nonce);
+  return exp >= Date.now();
+}
+
+async function loadLicenseFromDisk() {
+  if (!existsSync(licenseFile)) return;
+  const token = readFileSync(licenseFile, 'utf8').trim();
+  if (!token) return;
+  const result = await verifyLicenseToken({ token });
+  if (result.valid) licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
+}
+loadLicenseFromDisk();
+
+// Called by POST /api/license. Verifies before persisting — never write a
+// token to disk that doesn't actually verify, so a bad paste can't silently
+// wedge the app into "licensed but broken".
+async function activateLicense(token) {
+  const result = await verifyLicenseToken({ token: String(token ?? '') });
+  if (!result.valid) return { ok: false, error: `invalid license: ${result.reason}` };
+  writeFileSync(licenseFile, String(token));
+  licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
+  return { ok: true, email: result.payload.email };
+}
+
+// The HTML shown in the popup after Google sign-in. It notifies the app window
+// (postMessage; the app validates origin+shape and refreshes) and closes
+// itself. Everything is inline + self-contained — this page can be opened
+// cross-origin (127.0.0.1 vs the app's localhost) so it never touches the app DOM.
+function signinResultPage(outcome) {
+  const esc = (s) => String(s ?? '').replace(/[<>&]/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;' }[c]));
+  const payload = JSON.stringify(outcome.ok ? { galda: 'signed-in', email: outcome.email } : { galda: 'signin-error', error: outcome.error });
+  const body = outcome.ok
+    ? `<h1>Signed in</h1><p>You're signed in as <b>${esc(outcome.email)}</b>. This tab will close automatically.</p>`
+    : `<h1>Sign-in didn't complete</h1><p>${esc(outcome.error)}</p><p class="muted">Close this tab and click “Sign in with Google” again in the app.</p>`;
+  return `<!doctype html><meta charset="utf-8"><title>Galda</title>` +
+    `<body style="font:15px/1.6 -apple-system,system-ui,sans-serif;max-width:32rem;margin:12vh auto;padding:0 1.5rem;color:#111">` +
+    `<style>h1{font-size:1.35rem;margin:0 0 .5rem}.muted{color:#888;font-size:.9rem}b{font-weight:600}</style>` +
+    body +
+    `<script>try{if(window.opener)window.opener.postMessage(${payload},'*')}catch(e){}` +
+    (outcome.ok ? `setTimeout(function(){try{window.close()}catch(e){}},1200);` : '') +
+    `</script></body>`;
+}
+
+// "Currently occupying capacity" for the free-tier pending-goal cap — every
+// status short of a genuinely finished/dismissed one. Deliberately broad for
+// the same reason RATE_LIMIT_RE above is broad: undercounting here would let
+// someone quietly exceed the cap via an odd status, which costs more than
+// occasionally counting a goal that's nearly done.
+const OPEN_GOAL_STATUSES = ['stacked', 'sending', 'pending', 'planning', 'needsInput', 'running', 'partial', 'failed', 'interrupted', 'blocked', 'review', 'retesting'];
+
+// NOTE(billing, needs a product decision): `projectCount` is left at 0 —
+// projects are shared/global in this codebase today (see the "Projects ...
+// stay shared for everyone" comment above goalVisibleTo in lib.mjs), not
+// per-identity, so a per-user "max 1 project" cap has nothing correct to
+// gate yet (an unpaid user's 2nd project would affect every other user, not
+// just them). checkFreeTierLimit already supports projectCount > 1 the
+// moment that's resolved — see docs/BILLING-LAUNCH-PLAN.md.
+function computeFreeTierUsage(identity) {
+  const owned = goals.filter((g) => (g.owner ?? 'owner') === identity);
+  return {
+    pendingCount: owned.filter((g) => OPEN_GOAL_STATUSES.includes(g.status)).length,
+    cumulativeCount: owned.length,
+    projectCount: 0,
+  };
+}
+
+// Best-effort GET /entitlement?email=... against billing-api. Never throws —
+// an unreachable/unconfigured billing-api must not crash goal creation, it
+// just means requireEntitlementGate falls back to the cache (or fail-closed
+// with no cache — see resolveCachedEntitlement in lib.mjs).
+async function fetchIsPaying(email) {
+  if (!BILLING_API_URL) return null;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3000);
+  try {
+    const res = await fetch(`${BILLING_API_URL}/entitlement?email=${encodeURIComponent(email)}`, { signal: controller.signal });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return Boolean(data?.isPaying);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// POST to billing-api from the engine so the browser never calls the Worker
+// cross-origin (no CORS, and the paying email is the server-verified one, not
+// a client-supplied value). Never throws — returns { ok, status, ...data }.
+async function billingPost(path, payload) {
+  if (!BILLING_API_URL) return { ok: false, status: 501, error: 'billing not configured (MANAGER_BILLING_API_URL unset)' };
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 8000);
+  try {
+    const res = await fetch(`${BILLING_API_URL}${path}`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), signal: controller.signal,
+    });
+    const data = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, ...data };
+  } catch {
+    return { ok: false, status: 502, error: 'billing-api unreachable' };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// The subscription price (from Stripe via billing-api /price), cached 1h so
+// /api/state doesn't hit the Worker on every poll. null until first fetched or
+// when billing-api is unconfigured/unreachable — the UI then omits the amount.
+let billingPriceCache = { at: 0, price: null };
+async function getBillingPrice() {
+  if (!BILLING_API_URL) return null;
+  const now = Date.now();
+  if (billingPriceCache.price && now - billingPriceCache.at < 3600_000) return billingPriceCache.price;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3000);
+  try {
+    const res = await fetch(`${BILLING_API_URL}/price`, { signal: controller.signal });
+    if (!res.ok) return billingPriceCache.price;
+    const data = await res.json();
+    if (data?.price) billingPriceCache = { at: now, price: data.price };
+    return billingPriceCache.price;
+  } catch {
+    return billingPriceCache.price;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// The gate itself (BILLING-LAUNCH-PLAN.md §2/§5): within the free tier
+// passes with zero network calls; only once computeFreeTierUsage says
+// they're over it do we need to know isPaying, and even then we only hit
+// billing-api when the cache says we must (resolveCachedEntitlement's
+// needsRefresh) — a fresh "yes" skips the round trip on every subsequent
+// over-the-limit request from the same identity.
+//
+// `identity` (CF Access / key-auth — usually 'owner' under the local-first
+// public build, see licenseState above) is used ONLY for usage counting
+// (computeFreeTierUsage), since goal ownership is stamped with it and a
+// single local install has exactly one such counting bucket regardless of
+// whether it's licensed yet. The isPaying LOOKUP uses licenseState.email
+// instead — the proven-by-signature paid address — because billing-api has
+// no idea who "owner" is. No verified license on file → blocked as
+// not-paying, same as any other never-checked identity.
+//
+// Deliberately does NOT special-case `identity === 'owner'` as an unlimited
+// bypass. That was correct only under Cloudflare Access (Stage 2 multi-user):
+// there, `identityFor` resolves to 'owner' *specifically* for Masa's verified
+// email or key-auth, and to a real distinct email for everyone else. Under
+// the local-first public build (no Cloudflare Access — every request has no
+// authEmail), `resolveIdentity` returns 'owner' for EVERY user, so an
+// identity-string bypass would have silently disabled the free tier for
+// every installation (~/.claude/plans/toasty-rolling-marshmallow.md).
+// A personal/dev instance that wants to skip billing entirely should opt in
+// explicitly via MANAGER_ENTITLEMENT_BYPASS=1, not ride the 'owner' string.
+async function requireEntitlementGate(identity) {
+  if (process.env.MANAGER_ENTITLEMENT_BYPASS === '1') return { allowed: true, blocked: null };
+  // Count the goal being created (existing + 1): computeFreeTierUsage counts
+  // only goals already on file and this gate runs *before* the new one is
+  // added, so "5 pending / 19 lifetime max" must block the 6th / 20th create,
+  // not the 7th / 21st. (checkFreeTierLimit keeps its `> limit` semantics; we
+  // feed it the post-create count. Display in /api/state stays the raw count.)
+  const existing = computeFreeTierUsage(identity);
+  const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
+  if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
+  const billingEmail = licenseState.email;
+  if (!billingEmail) return resolveEntitlement({ isOwner: false, isPaying: false, usage });
+  const cachedState = resolveCachedEntitlement({ cached: entitlementCache.get(billingEmail) ?? null });
+  let isPaying = cachedState.isPaying;
+  if (cachedState.needsRefresh) {
+    const fresh = await fetchIsPaying(billingEmail);
+    if (fresh != null) {
+      isPaying = fresh;
+      entitlementCache.set(billingEmail, { isPaying: fresh, checkedAt: Date.now() });
+    }
+  }
+  return resolveEntitlement({ isOwner: false, isPaying, usage });
+}
+// The acting identity for a request: 'owner' for key-auth or
+// MANAGER_OWNER_EMAIL, else the verified Google email itself. Stamped onto
+// new goals (owner) and used to filter/gate every goal-scoped read+write.
+function identityFor(req) {
+  return resolveIdentity({ authEmail: req.authEmail, ownerEmail: MANAGER_OWNER_EMAIL });
+}
+// Goal-scoped endpoints (mutations, and the diff read) call this right after
+// their `if (!goal) return json(res, 404, ...)` check: 403s a non-owner
+// acting on a goal that isn't theirs (owner acts on everything; a normal
+// user only on goals stamped with their own identity — see goalVisibleTo).
+function requireGoalOwnership(req, res, goal) {
+  if (goalVisibleTo(goal, identityFor(req), MANAGER_OWNER_EMAIL)) return true;
+  json(res, 403, { error: 'forbidden' });
+  return false;
+}
+// Same check for a task-scoped endpoint (retry/snapshot/skip/priority): a
+// task's ownership follows its goal's. `goals` is declared with `let`
+// further down (module state) so this closes over the live array, not a
+// snapshot frozen at definition time.
+function requireTaskGoalOwnership(req, res, task) {
+  const goal = goals.find((g) => g.id === task.goalId);
+  // A task with no resolvable goal is orphaned data, not a real ownership
+  // gap — never reject solely for that (pre-existing behaviour elsewhere
+  // treats a missing goal permissively too).
+  if (!goal) return true;
+  return requireGoalOwnership(req, res, goal);
+}
+let cfAccessJwksCache = null;
+let cfAccessJwksFetchedAt = 0;
+const cfAccessLoggedEmails = new Set();
+
+async function fetchCfAccessJwks({ forceRefresh = false } = {}) {
+  const now = Date.now();
+  if (!forceRefresh && cfAccessJwksCache && (now - cfAccessJwksFetchedAt) < CF_ACCESS_JWKS_TTL_MS) {
+    return cfAccessJwksCache;
+  }
+  const res = await fetch(`https://${CF_ACCESS_TEAM_DOMAIN}/cdn-cgi/access/certs`);
+  if (!res.ok) throw new Error(`CF Access JWKS fetch failed: HTTP ${res.status}`);
+  cfAccessJwksCache = await res.json();
+  cfAccessJwksFetchedAt = now;
+  return cfAccessJwksCache;
+}
+
+// Returns the authed email, or null (never throws — a JWKS fetch hiccup or
+// a bad token just falls through to the ?key= gate below).
+async function authFromCfAccess(req) {
+  if (!CF_ACCESS_ENABLED) return null;
+  const token = req.headers['cf-access-jwt-assertion'];
+  if (!token) return null;
+  try {
+    let jwks = await fetchCfAccessJwks();
+    let result = verifyCfAccessJwt({ token, jwks, aud: CF_ACCESS_AUD });
+    if (!result.ok && result.reason === 'unknown-kid') {
+      // key rotation: refetch once before giving up
+      jwks = await fetchCfAccessJwks({ forceRefresh: true });
+      result = verifyCfAccessJwt({ token, jwks, aud: CF_ACCESS_AUD });
+    }
+    if (!result.ok) return null;
+    if (!cfAccessLoggedEmails.has(result.email)) {
+      cfAccessLoggedEmails.add(result.email);
+      console.log(`[manager] Cloudflare Access authed: ${result.email}`);
+    }
+    return result.email;
+  } catch (e) {
+    console.error(`[manager] Cloudflare Access verification error: ${e.message ?? e}`);
+    return null;
+  }
+}
+
+const projectsFile = join(DATA_DIR, 'projects.json');
+if (!existsSync(projectsFile)) {
+  const cwd = process.cwd();
+  writeFileSync(projectsFile, JSON.stringify([{ id: 'default', name: basename(cwd), dir: cwd }], null, 2));
+}
+const projects = JSON.parse(readFileSync(projectsFile, 'utf8'));
+function saveProjects() { writeFileSync(projectsFile, JSON.stringify(projects, null, 2)); }
+function uniqueProjectId(name = 'project') {
+  const base = String(name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 28) || 'project';
+  let id = base, n = 2;
+  while (projects.some((p) => p.id === id)) id = `${base}-${n++}`;
+  return id;
+}
+const logDir = join(DATA_DIR, 'chat-runs');
+mkdirSync(logDir, { recursive: true });
+const logFile = join(logDir, 'tasks.jsonl');
+
+// Per-project workflow columns (task 44: the Tasks-panel column editor).
+// Column names/order are cosmetic; every column still maps to one of the
+// four buckets goalGroupStatus/goalChip actually track (see lib.mjs).
+const workflowColumnsFile = join(DATA_DIR, 'workflow-columns.json');
+let workflowColumns = existsSync(workflowColumnsFile) ? JSON.parse(readFileSync(workflowColumnsFile, 'utf8')) : {};
+function saveWorkflowColumns() { writeFileSync(workflowColumnsFile, JSON.stringify(workflowColumns, null, 2)); }
+function getColumns(projectId) { return workflowColumns[projectId] ?? DEFAULT_WORKFLOW_COLUMNS; }
+
+// Per-project review definition (task 45): configurable conditions for when
+// a finished goal lands in 'review' vs 'done'/'partial' — see lib.mjs.
+const reviewDefinitionsFile = join(DATA_DIR, 'review-definitions.json');
+let reviewDefinitions = existsSync(reviewDefinitionsFile) ? JSON.parse(readFileSync(reviewDefinitionsFile, 'utf8')) : {};
+function saveReviewDefinitions() { writeFileSync(reviewDefinitionsFile, JSON.stringify(reviewDefinitions, null, 2)); }
+function getReviewDefinition(projectId) { return reviewDefinitions[projectId] ?? DEFAULT_REVIEW_DEFINITION; }
+
+// ---- state ---------------------------------------------------------------
+// Restarts must not lose pending work: tasks that never started stay
+// queued; only mid-run work becomes 'interrupted' (retryable). Goals that
+// were still planning go back to the stack and re-plan. See replayQueueLog
+// in lib.mjs for the (unit-tested) replay logic.
+const replayed = replayQueueLog(existsSync(logFile) ? readFileSync(logFile, 'utf8') : '', reviewDefinitions);
+let goals = replayed.goals;
+let tasks = replayed.tasks;
+let nextId = replayed.nextId;
+let prioCounter = replayed.prioCounter;
+
+// Reap goals a dead server left with no live worker (Masa dogfood: the To Do
+// pile-up from a goal that never actually resumes) — see reconcileOrphanGoals
+// in lib.mjs for the exact rule (unit-tested there). Computed and applied to
+// the in-memory goal objects right here, right after replay, on purpose —
+// BEFORE the MANAGER_SEED_RUNNING_FIXTURE block below adds its deliberately
+// permanent 'running' example goal (that fixture is verify-instance-only
+// scaffolding and must never be reclassified). The actual persistence
+// (append to the restart-safe log + SSE) happens a little further down, once
+// saveGoal() exists — see "orphanFixes.length" just below its definition.
+const orphanFixes = reconcileOrphanGoals(goals, tasks);
+for (const fix of orphanFixes) {
+  const g = goals.find((x) => x.id === fix.id);
+  if (g) { g.status = fix.status; g.blocked = null; g.prError = fix.reason; }
+}
+
+// Verify fixture only (task 49): a fresh ephemeral verify instance
+// (startEphemeralApp) has no real running worker, but the pass condition
+// under test is about how a genuinely 'running' task's live log renders.
+// replayQueueLog always flips a replayed 'running' task to 'interrupted'
+// (correct for real crash recovery — a real worker process didn't survive
+// the restart), so a running example can't be seeded through the queue
+// log. Instead, when this env var is set (only by startEphemeralApp), add
+// one in-memory-only running task with a long activity log directly —
+// after replay, so the flip above never touches it, and never written to
+// logFile, so it doesn't leak into this throwaway instance's own restarts.
+if (process.env.MANAGER_SEED_RUNNING_FIXTURE === '1') {
+  const at = new Date().toISOString();
+  const goalId = nextId++, taskId = nextId++;
+  goals.push({
+    id: goalId, projectId: 'default', text: '[verify fixture] 実行中ゴール', status: 'running',
+    wantsPR: false, model: 'sonnet', images: [], plan: ['fixture task'], pr: undefined, createdAt: at,
+  });
+  tasks.push({
+    id: taskId, num: 1, goalId, projectId: 'default', title: 'fixture task', detail: '', passCondition: '',
+    model: 'sonnet', status: 'running', createdAt: at, result: null, changedFiles: [], secs: null, proof: null, usage: null,
+    activity: [
+      'Read app/index.html', 'Grep taskBlock', 'Edit app/index.html', 'Read engine/lib.mjs',
+      'Bash node --test engine/test/*.test.mjs', '✓ 12 tests passed', 'Edit engine/server.mjs',
+      'Read engine/test/lib.test.mjs', 'Edit engine/test/lib.test.mjs',
+      'Bash node --test engine/test/*.test.mjs', '✓ 13 tests passed', '✎ 実装をまとめています…',
+    ],
+  });
+}
+
+// res -> identity (see identityFor), captured at connection time so every
+// SSE push can be scoped per-connection without re-deriving auth per event.
+const sseClients = new Map();
+// UI hot-reload: open tabs compare this stamp (index.html mtime + boot
+// time) via /api/state and the 30s SSE ping, and reload themselves when a
+// new UI ships — no manual reload after a hot-copy or a restart.
+const BOOT_STAMP = Date.now();
+function uiVersion() {
+  try { return `${Math.round(statSync(join(ROOT, 'app', 'index.html')).mtimeMs)}-${BOOT_STAMP}`; }
+  catch { return String(BOOT_STAMP); }
+}
+
+// Broadcast to every connected client, unscoped — only for events that carry
+// no per-goal data (project-level columns/review-definition, the keepalive
+// ping). Goal/task events go through sendGoalEvent instead (stage 2).
+function send(obj) {
+  const data = `data: ${JSON.stringify(obj)}\n\n`;
+  for (const res of sseClients.keys()) res.write(data);
+}
+// Push a goal-scoped event only to the connections whose identity can see
+// that goal (owner gets everything; a normal user only their own — same
+// rule as /api/state's filtering, see goalVisibleTo in lib.mjs). This is how
+// a Google user's SSE stream never observes another user's goal/task
+// activity even though the queue/workers are still shared infrastructure.
+function sendGoalEvent(obj, goal) {
+  const data = `data: ${JSON.stringify(obj)}\n\n`;
+  for (const [res, identity] of sseClients) {
+    if (goalVisibleTo(goal, identity, MANAGER_OWNER_EMAIL)) res.write(data);
+  }
+}
+function saveGoal(g) { appendFileSync(logFile, JSON.stringify({ ...g, kind: 'goal' }) + '\n'); sendGoalEvent({ ev: 'goal', goal: g }, g); }
+// Persist the orphan-goal reclassification computed right after replayQueueLog
+// above (deferred to here because saveGoal/send/sseClients don't exist yet at
+// that point in the module) — writes it to the restart-safe log so it settles
+// for good, not just in this process's memory, and broadcasts it over SSE for
+// any UI that's already connected.
+for (const fix of orphanFixes) {
+  const g = goals.find((x) => x.id === fix.id);
+  if (g) { console.log(`[manager] goal ${g.id}: reaped as orphaned (no live worker after restart) → interrupted`); saveGoal(g); }
+}
+function saveTask(t) {
+  const { activity, todos, ...persist } = t; // activity + todos are ephemeral (live only)
+  appendFileSync(logFile, JSON.stringify({ ...persist, kind: 'task' }) + '\n');
+  const goal = goals.find((g) => g.id === t.goalId);
+  if (goal) sendGoalEvent({ ev: 'task', task: persist }, goal); else send({ ev: 'task', task: persist });
+}
+const ACTIVITY_LIMIT = 1000;
+function activityLine(line) {
+  return String(line ?? '')
+    .replace(/\s+/g, ' ')
+    .replace(/key=[^&\s"']+/gi, 'key=***')
+    .slice(0, 500);
+}
+function sendAct(t, line) {
+  const safe = activityLine(line);
+  if (!safe) return;
+  t.activity = [...(t.activity ?? []), safe].slice(-ACTIVITY_LIMIT);
+  const goal = goals.find((g) => g.id === t.goalId);
+  if (goal) sendGoalEvent({ ev: 'act', taskId: t.id, line: safe }, goal); else send({ ev: 'act', taskId: t.id, line: safe });
+}
+function sendProcessAct(t, line) {
+  sendAct(t, `✎ ${line}`);
+}
+// The worker's live to-do list (from Claude Code's TodoWrite): each call
+// replaces the whole list, so we just overwrite. Ephemeral like activity —
+// held on the task only while it runs, streamed to the UI, never persisted.
+function sendTodos(t, todos) {
+  t.todos = todos;
+  const goal = goals.find((g) => g.id === t.goalId);
+  if (goal) sendGoalEvent({ ev: 'todos', taskId: t.id, todos }, goal); else send({ ev: 'todos', taskId: t.id, todos });
+}
+
+// ---- claude helpers --------------------------------------------------------
+function runClaude({ prompt, cwd, tools, onEvent, onTodos, resume, model, effort, permissionMode = 'acceptEdits', onChild }) {
+  return new Promise((done) => {
+    const args = [
+      '-p', prompt,
+      '--model', MODELS.includes(model) ? model : 'sonnet',
+      '--effort', workerEffort('claude-code', effort),
+      '--permission-mode', permissionMode,
+      '--allowedTools', tools,
+      '--output-format', 'stream-json', '--verbose',
+    ];
+    if (resume) args.push('--resume', resume);
+    const child = spawn('claude', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    // Expose the spawned child so a goal can be cancelled (deleted while
+    // running) by SIGTERMing exactly its own worker — see trackGoalWorker.
+    onChild?.(child);
+    let result = '', err = '', buf = '', sessionId = null, usage = null, timedOut = false, lastAct = '';
+    // Mark WHY the child died: the timeout SIGTERMs the worker (exit 143), which
+    // is a forced STOP, not a code failure — the caller uses timedOut to mark the
+    // task 'interrupted' with a real reason instead of a bare 'failed / (no output)'.
+    const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, WORKER_TIMEOUT_MS);
+    child.stdout.on('data', (d) => {
+      buf += d;
+      const lines = buf.split('\n'); buf = lines.pop();
+      for (const line of lines) {
+        for (const ev of parseStreamEvents(line)) {
+          if (ev.kind === 'result') { result = ev.text; usage = ev.usage; }
+          else if (ev.kind === 'session') sessionId = ev.id;
+          else if (ev.kind === 'todos') onTodos?.(ev.todos);
+          else { if (ev.text?.trim()) lastAct = ev.text.trim(); onEvent?.(ev.text); }
+        }
+      }
+    });
+    child.stderr.on('data', (d) => { err += d; });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      done({ code, timedOut, result: workerResultText({ result, err, code, timedOut, lastAct, timeoutMs: WORKER_TIMEOUT_MS }), sessionId, usage });
+    });
+  });
+}
+function parseCodexUsage(usage) {
+  if (!usage) return null;
+  return {
+    input_tokens: usage.input_tokens ?? usage.inputTokens ?? 0,
+    output_tokens: usage.output_tokens ?? usage.outputTokens ?? 0,
+    cache_creation_input_tokens: usage.cache_creation_input_tokens ?? 0,
+    cache_read_input_tokens: usage.cached_input_tokens ?? usage.cache_read_input_tokens ?? 0,
+  };
+}
+function runCodex({ prompt, cwd, onEvent, permissionMode = 'acceptEdits', model, effort, onChild }) {
+  return new Promise((done) => {
+    const sandbox = permissionMode === 'plan' ? 'read-only' : 'workspace-write';
+    const args = ['exec', '--json', '-m', workerModel('codex', model), '-c', `model_reasoning_effort="${workerEffort('codex', effort)}"`, '--sandbox', sandbox, '--skip-git-repo-check', '--cd', cwd, '-'];
+    const child = spawn('codex', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+    onChild?.(child);
+    child.stdin.end(prompt);
+    let result = '', err = '', buf = '', usage = null, timedOut = false, lastAct = '';
+    const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); }, WORKER_TIMEOUT_MS);
+    child.stdout.on('data', (d) => {
+      buf += d;
+      const lines = buf.split('\n'); buf = lines.pop();
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        try {
+          const ev = JSON.parse(line);
+          if (ev.type === 'item.completed') {
+            const item = ev.item ?? {};
+            if (item.type === 'agent_message' && item.text) {
+              result = item.text;
+              onEvent?.(`✎ ${item.text.trim().replace(/\s+/g, ' ').slice(0, 500)}`);
+            } else if (item.type === 'error' && item.message) onEvent?.(`Error ${item.message}`);
+            else if (item.type === 'command_execution' && item.command) { lastAct = `Run ${item.command}`; onEvent?.(lastAct); }
+          } else if (ev.type === 'turn.completed') {
+            usage = parseCodexUsage(ev.usage);
+          } else if (ev.type === 'error' && ev.message) {
+            err += `${ev.message}\n`;
+            onEvent?.(`Error ${ev.message}`);
+          }
+        } catch {
+          if (line.trim()) lastAct = line.trim().slice(0, 240);
+          onEvent?.(line.trim().slice(0, 240));
+        }
+      }
+    });
+    child.stderr.on('data', (d) => { err += d; });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      done({ code, timedOut, result: workerResultText({ result, err, code, timedOut, lastAct, timeoutMs: WORKER_TIMEOUT_MS }), sessionId: null, usage });
+    });
+  });
+}
+function runWorkerAgent({ agent, ...args }) {
+  return workerAgent(agent) === 'codex' ? runCodex(args) : runClaude(args);
+}
+
+// Track worker (and planner) children per goal so a goal can be cancelled by
+// SIGTERMing exactly its own child(ren) — never another goal's, and never a
+// user process. The child auto-unregisters on close.
+const goalWorkerChildren = new Map(); // goalId -> Set<ChildProcess>
+function trackGoalWorker(goalId, child) {
+  if (goalId == null || !child) return;
+  let set = goalWorkerChildren.get(goalId);
+  if (!set) { set = new Set(); goalWorkerChildren.set(goalId, set); }
+  set.add(child);
+  child.on('close', () => { set.delete(child); if (!set.size) goalWorkerChildren.delete(goalId); });
+}
+function killGoalWorkers(goalId) {
+  const set = goalWorkerChildren.get(goalId);
+  if (!set) return 0;
+  let n = 0;
+  for (const c of set) { try { c.kill('SIGTERM'); n++; } catch { /* already gone */ } }
+  goalWorkerChildren.delete(goalId);
+  return n;
+}
+
+// Cancel a goal's in-flight work for deletion: mark it cancelled (runTask/
+// planGoal bail before verify/PR), SIGTERM its worker/planner child(ren), drop
+// its still-queued tasks from the project queue so pump() never starts them,
+// and mark its unfinished tasks 'cancelled'. Only the Manager-spawned child is
+// killed; the user's working tree is never touched (the goal's own .manager-wt
+// worktree is left in place — safe, and reclaimed by the normal paths).
+function cancelGoalWork(goal) {
+  goal.cancelled = true;
+  killGoalWorkers(goal.id);
+  const q = queues.get(goal.projectId);
+  if (q) q.waiting = q.waiting.filter((t) => t.goalId !== goal.id);
+  for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'running', 'interrupted'].includes(t.status))) {
+    t.status = 'cancelled'; t.finishedAt = new Date().toISOString(); saveTask(t);
+  }
+}
+
+function gitChanges(dir) {
+  return new Promise((res) => {
+    execFile('git', ['-C', dir, 'status', '--porcelain', '-uall'], (e, out) =>
+      res(e ? [] : out.split('\n').filter(Boolean).slice(0, 60)));
+  });
+}
+
+function gitSync(cwd, args) {
+  const r = spawnSync('git', ['-C', cwd, ...args], { encoding: 'utf8' });
+  if (r.status !== 0) throw new Error(`git ${args.join(' ')}: ${(r.stderr || r.stdout || '').trim().slice(0, 200)}`);
+  return r.stdout.trim();
+}
+function repoDefaultBranch(dir) {
+  try { return gitSync(dir, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']).replace(/^origin\//, ''); }
+  catch { return 'main'; }
+}
+// Each goal works in its OWN git worktree, branched fresh from origin/<default>,
+// under <repo>/.manager-wt/goal-<id>. So: (1) the user's real working dir is
+// never touched; (2) each goal's diff contains only that goal's changes on top
+// of current main → a clean PR (no stale base, no other goals' edits mixed in).
+// Reused across a goal's tasks and its rework replies; falls back to project.dir
+// if worktrees can't be created (e.g. not a git repo).
+const goalWorkDirs = new Map();
+function goalWorkDir(goal, project) {
+  const cached = goalWorkDirs.get(goal.id);
+  if (cached && existsSync(cached)) return cached;
+  let repoRoot;
+  try { repoRoot = gitSync(project.dir, ['rev-parse', '--show-toplevel']); }
+  catch { return project.dir; } // not a git repo — behave as before
+  const br = repoDefaultBranch(project.dir);
+  const wt = join(repoRoot, '.manager-wt', `goal-${goal.id}`);
+  const branch = `manager-ai/goal-${goal.id}`;
+  try { gitSync(repoRoot, ['fetch', 'origin', br, '--quiet']); } catch { /* offline — use whatever origin/<br> we have */ }
+  if (!existsSync(wt)) {
+    try { gitSync(repoRoot, ['worktree', 'add', wt, '-b', branch, `origin/${br}`]); }
+    catch {
+      try { gitSync(repoRoot, ['worktree', 'add', wt, branch]); } // branch already exists (rework) — reuse it
+      catch { return project.dir; } // give up cleanly rather than block the worker
+    }
+  }
+  goalWorkDirs.set(goal.id, wt);
+  return wt;
+}
+function removeGoalWorkDir(goal, project) {
+  const wt = goalWorkDirs.get(goal.id);
+  if (!wt) return;
+  goalWorkDirs.delete(goal.id);
+  try { const repoRoot = gitSync(project.dir, ['rev-parse', '--show-toplevel']); gitSync(repoRoot, ['worktree', 'remove', '--force', wt]); } catch { /* best effort */ }
+}
+
+// External commit sync: pick up commits made outside this Manager (Claude
+// Code sessions run directly in the terminal, manual commits, other tools)
+// so they show up alongside Manager-run tasks for the same project. The
+// last-seen hash per project is persisted so a server restart doesn't
+// re-announce commits we've already synced.
+const externalSyncFile = join(ROOT, 'engine', 'external-sync.json');
+let externalSync = {};
+if (existsSync(externalSyncFile)) {
+  try { externalSync = JSON.parse(readFileSync(externalSyncFile, 'utf8')); } catch {}
+}
+function saveExternalSync() {
+  writeFileSync(externalSyncFile, JSON.stringify(externalSync, null, 2));
+}
+
+function gitLogRaw(dir) {
+  return new Promise((res) => {
+    execFile('git', ['-C', dir, 'log', '--pretty=format:%H%x1f%ad%x1f%an%x1f%s', '--date=iso-strict', '-n', '30'],
+      (e, out) => res(e ? '' : out));
+  });
+}
+
+async function syncExternalCommits(project) {
+  const commits = parseGitLog(await gitLogRaw(project.dir));
+  if (!commits.length) return;
+  const prev = externalSync[project.id];
+  const fresh = diffNewCommits(commits, prev?.lastHash ?? null);
+  if (fresh.length) console.log(`[manager] ${project.id}: ${fresh.length} new commit(s) synced`);
+  externalSync[project.id] = { lastHash: commits[0].hash, commits: commits.slice(0, 20) };
+  saveExternalSync();
+}
+
+async function syncAllExternal() {
+  await Promise.all(projects.map((p) => syncExternalCommits(p).catch(() => {})));
+}
+
+// Goals awaiting review carry their PR url in goal.pr; poll `gh pr view` for
+// each and flip 'review' -> 'done' once GitHub reports it merged or approved.
+function ghPrView(url) {
+  return new Promise((res) => {
+    execFile('gh', ['pr', 'view', url, '--json', 'state,mergedAt,reviewDecision'], (e, out, stderr) => {
+      // Silent forever otherwise: if `gh` is missing/unauthenticated in prod,
+      // review goals would never auto-flip to done and nothing would say why.
+      if (e) console.warn(`[manager] gh pr view ${url} failed: ${(stderr || e.message || '').trim().slice(0, 300)}`);
+      res(e ? null : out);
+    });
+  });
+}
+async function syncGoalMerges() {
+  const reviewGoals = goals.filter((g) => g.status === 'review' && g.pr);
+  await Promise.all(reviewGoals.map(async (g) => {
+    const raw = await ghPrView(g.pr);
+    if (!raw) return;
+    let data;
+    try { data = JSON.parse(raw); } catch { return; }
+    const newStatus = reviewToDoneStatus({ goalStatus: g.status, merged: isPrMerged(data), approved: isPrApproved(data) });
+    if (newStatus !== g.status) {
+      g.status = newStatus; saveGoal(g);
+      // §3/§7: a merged PR is truly terminal (no rework possible) — reclaim the
+      // per-goal worktree so .manager-wt/goal-<id> doesn't leak forever. (Manual
+      // Approve stays reworkable via revert, so we don't clean those up here.)
+      if (newStatus === 'done' && isPrMerged(data)) {
+        const project = projects.find((p) => p.id === g.projectId);
+        if (project) removeGoalWorkDir(g, project);
+      }
+    }
+  }));
+}
+
+// ---- goal pipeline ---------------------------------------------------------
+// Bounded per-project parallelism (Masa: "same project でも conflict しない
+// ものは並列で実装してほしい。conflict 判断はしてほしい。"): each goal already
+// runs in its own isolated git worktree (goalWorkDir above), so DIFFERENT
+// goals' tasks can safely run at the same time — only a single goal's OWN
+// tasks must stay sequential. `running` replaces the old single `busy`
+// boolean with the SET of tasks currently in flight for that project;
+// nextRunnableTasks() (engine/lib.mjs) decides which queued tasks are safe to
+// start without disturbing same-goal ordering. MANAGER_MAX_PARALLEL caps how
+// many of THIS project's tasks run at once (default 2, hard cap 4);
+// MANAGER_GLOBAL_MAX caps the total across every project, so a burst of
+// goals across many projects still can't spawn unbounded `claude` processes.
+const PROJECT_MAX_PARALLEL = clampParallelLimit(process.env.MANAGER_MAX_PARALLEL, { def: 2, max: 4 });
+const GLOBAL_MAX_PARALLEL = clampParallelLimit(process.env.MANAGER_GLOBAL_MAX, { def: 4, max: 32 });
+const queues = new Map(projects.map((p) => [p.id, { running: new Set(), waiting: [] }]));
+function globalRunningCount() {
+  let n = 0;
+  for (const q of queues.values()) n += q.running.size;
+  return n;
+}
+
+// Goals stack up per project: while one goal is being planned or executed,
+// newer goals wait as 'stacked' (editable / deletable until picked up).
+function goalActive(projectId) {
+  return goals.some((g) => g.projectId === projectId && ['planning', 'running'].includes(g.status));
+}
+function startNextStacked(projectId) {
+  if (goalActive(projectId)) return;
+  const next = goals.filter((g) => g.projectId === projectId && g.status === 'stacked')
+    .sort((a, b) => (b.prio ?? 0) - (a.prio ?? 0) || a.id - b.id)[0];
+  if (!next) return;
+  next.status = 'planning';
+  saveGoal(next);
+  planGoal(next).catch((e) => {
+    next.status = 'failed'; next.prError = String(e).slice(0, 300); saveGoal(next);
+    startNextStacked(projectId);
+  });
+}
+
+async function planGoal(goal) {
+  const project = projects.find((p) => p.id === goal.projectId);
+  const prompt = [
+    'あなたはユーザーの依頼を受けるプロダクトマネージャ。以下のユーザー依頼を、ユーザーから見た「成果物（トピック）」の単位で整理する。エンジニアリングの工程には分解しない。',
+    '- 既定は 1トピック=1タスク。1つのまとまった依頼を実装工程に割らない（「PRDを作る」「パーサを追加」「テストを書く」「リファクタ」等を別タスクにしない）。それらは1人のworkerが内部で全部やる（実装→テスト→proof/検証まで一気通貫）。',
+    '- 複数タスクに分けるのは、依頼に「明確に別々の成果物・トピック」が含まれる時「だけ」（例:「音声入力を追加して、あとビジュアル作成も」→ 音声入力 / ビジュアル作成 の2つ）。工程での分割は絶対にしない。',
+    '- 被っている・言い換えているだけの依頼は、自分で理解して1つにまとめる。',
+    '- タスク数は最小に。既定1個、多くても distinct な依頼の数だけ（現実的に1〜3、最大4）。依存順に並べる。',
+    '- 各タスクの title は「ユーザーから見た成果（ユーザーの言葉のまま・短く）」にする。エンジニアリングの手順名（設計/実装/テスト等）にしない。detail には worker への完全な指示を書く：そのworkerが1人で実装・テスト・proofまで完結させる。工程ごとの兄弟タスクは来ない前提で書くこと。',
+    '- passCondition はユーザーが依頼文で明示的に検証条件（「成功条件:」「〜したら〜になる」等）を書いた場合のみ設定する。見た目の調整・文言変更・スタイル変更のタスクには付けない（null）。検証は高価なので、明示された時だけ。',
+    '- 検証対象のページがあれば entry に書く（プロジェクト相対のhtmlパス、または http URL。無ければ null）。依頼中に書かれていればそれを使い、無ければリポジトリを見て推測してよい。',
+    '- 依頼が曖昧で重要な前提が1つ欠けている（例: 対象・範囲・形式が不明）か、既存の作業と矛盾する場合「のみ」、タスクではなく確認質問を返す: {"question":"確認したい1点（短く）","options":["選択肢A","選択肢B"]}。ただし基本は合理的な仮定で進めること。質問は本当に必要な時だけ、1問に絞る。',
+    // Once the user has answered a clarification, NEVER ask again — re-asking looped
+    // the answered question back onto the board. Override the rule above for re-plans.
+    goal.clarified ? '【最重要】ユーザーは既にこの依頼への確認質問に回答済み（依頼文末尾に [確認: … → …] として反映済み）。これ以上、確認質問(question)を返してはならない。回答を前提に、必ずタスクへ分解して返すこと。' : '',
+    '- 出力はJSONのみ（前後に文章を書かない）。通常: {"entry":"path|null","tasks":[{"title":"ユーザーから見た成果（短い日本語）","detail":"workerへの完全な指示","passCondition":"検証条件|null"}]} ／ 確認が要る時だけ: {"question":"...","options":["...","..."]}',
+    '',
+    goal.priorFailureMemory?.length ? [
+      '過去の失敗メモリ（同じ失敗を避けること）:',
+      latestFailurePolicy(goal.priorFailureMemory)?.text,
+      'この依頼を分解するときは、上記の防止策を detail に自然に含める。',
+    ].filter(Boolean).join('\n') : '',
+    '',
+    goal.images?.length ? `添付画像（Readで読める絶対パス）: ${goal.images.join(' ')}` : '',
+    `依頼: ${goal.text}`,
+  ].filter(Boolean).join('\n');
+  // Plan (and later work) inside this goal's own worktree, so the warm session
+  // the workers resume shares the same cwd and the goal stays isolated.
+  const workDir = goalWorkDir(goal, project);
+  // Planner decomposes the goal into 1-6 tasks. (Tried haiku for speed but it was
+  // SLOWER — the cost is claude cold-start + repo reading, not inference, and
+  // haiku took more tool round-trips. The instant Planning… row is the real
+  // "it's queued" feedback; detailed tasks follow in ~13s.)
+  const { result, sessionId } = await runWorkerAgent({ agent: goal.agent, prompt, cwd: workDir, tools: 'Read,Glob,Grep', model: goal.model, effort: goal.effort, onChild: (c) => trackGoalWorker(goal.id, c) });
+  if (goal.cancelled || !goals.some((g) => g.id === goal.id)) return; // deleted/cancelled while planning
+  // Warm handoff: the planner already read the repo in this session, so the
+  // goal's workers resume it instead of cold-starting a fresh claude each
+  // task (faster first token, no re-briefing tokens).
+  if (sessionId) goal.sessionId = sessionId;
+  // Smart intake: the planner may return a clarifying question instead of tasks
+  // when the goal is genuinely ambiguous. Surface it as a "needsInput" goal (a
+  // ❓ card in To Do) and wait for the answer — no tasks created yet, no worker.
+  let clarify = null;
+  try { const m = result.match(/\{[\s\S]*\}/); if (m) { const o = JSON.parse(m[0]); if (o && o.question && !Array.isArray(o.tasks)) clarify = { text: String(o.question).slice(0, 300), options: Array.isArray(o.options) ? o.options.slice(0, 4).map((x) => String(x).slice(0, 60)) : [] }; } } catch { /* not a question */ }
+  // Ask a clarifying question ONLY on the first plan. Once the user has answered
+  // (goal.clarified), NEVER re-enter needsInput — that was the loop where an
+  // already-answered question kept reappearing on the board. A stray question on a
+  // re-plan is ignored and parsePlan falls back to a single task from goal.text
+  // (which now carries the answer). Structural guarantee: the code refuses to
+  // re-ask even if the planner disobeys the prompt.
+  if (shouldAskClarification(clarify, goal)) {
+    goal.question = clarify;
+    goal.status = 'needsInput';
+    saveGoal(goal);
+    return; // wait for /answer
+  }
+  goal.question = null;
+  const plan = parsePlan(result, goal.text);
+  // USER-TOPIC granularity backstop: collapse any engineering-phase over-
+  // decomposition the LLM may still emit into user-facing deliverables (Masa:
+  // プログラムエンジニアのタスク単位で分解しないで — 1メッセージ=1トピック既定).
+  plan.tasks = refinePlanTasks(plan.tasks, { goalText: goal.text });
+  goal.status = 'running';
+  goal.entry = plan.entry;
+  goal.plan = plan.tasks.map((t) => t.title);
+  saveGoal(goal);
+  const base = tasks.filter((t) => t.projectId === goal.projectId).map((t) => t.num);
+  let num = (base.length ? Math.max(...base) : 0);
+  for (const p of plan.tasks) {
+    const task = {
+      id: nextId++, num: ++num, goalId: goal.id, projectId: goal.projectId,
+      title: p.title, detail: p.detail, passCondition: p.passCondition, model: goal.model, effort: goal.effort, agent: goal.agent,
+      mode: goal.mode ?? 'auto', skill: goal.skill ?? null,
+      status: 'queued', createdAt: new Date().toISOString(), priority: '中',
+      result: null, changedFiles: [], secs: null, activity: [], proof: null, usage: null,
+    };
+    tasks.push(task);
+    saveTask(task);
+    queues.get(goal.projectId).waiting.push(task);
+  }
+  pump(goal.projectId);
+}
+
+// Author the executable check once per task (the only LLM cost of
+// verification); the check itself then runs deterministically in Chrome.
+async function authorVerify(task, goal, project) {
+  const file = join(logDir, `verify-task-${task.id}.mjs`);
+  const prompt = [
+    `You are writing an automated UI check. Read ${goal.entry} (and related files) to find real selectors.`,
+    ``,
+    `PASS CONDITION to check: ${task.passCondition}`,
+    ``,
+    'IMPORTANT if the entry is this Manager app itself (app/index.html): this check runs against a FRESH EPHEMERAL instance, so a brand-new goal created there (compose box, or POST /api/tasks) does NOT queue harmlessly — it goes straight to \'planning\' and starts a REAL background `claude` process immediately, which takes far longer than any UI wait should sit through (never create a goal and then wait for its status to reach \'review\'/\'done\' — that will time out). Instead verify against state/UI that already exists: read window.state.tasks/goals for already-finished entries, or the current page\'s own render output. window.state.goals already contains four settled example goals seeded for exactly this purpose: one finished with a PR (wantsPR: true, pr set), one finished without one (wantsPR: false, no pr), one already sitting in \'review\' status (id 5, use it to check review-column display content e.g. a project\'s review description text, since app/index.html only renders that section when at least one goal is actually in \'review\'), and one goal+task that is genuinely status: \'running\' right now with a long (12-line) window.state-visible activity log already attached (the task\'s chat card in the stream area — NOT the small floating corner panel — is the one to inspect for full-log/no-truncation/auto-scroll behavior; it never finishes, so it is always safe to assert against without waiting). If you do need to check that a *newly created* goal\'s wantsPR/PR-related field comes out right, only read the field from the immediate creation response/state (it is set synchronously before any worker runs) — never wait on it progressing further.',
+    ``,
+    'Output ONLY the JavaScript source of an ES module (no markdown fences, no prose) of this exact shape:',
+    'export default async function verify(page, ui) {',
+    '  // page: full puppeteer Page. ui.click(selector): moves a visible cursor and clicks; returns false if the element is missing.',
+    '  // Interact like a user (ui.click for clicks; page.type/page.evaluate where needed), then assert the outcome.',
+    '  // Return { pass: boolean, detail: string } — detail says what was observed, in Japanese.',
+    '}',
+  ].join('\n');
+  const { result } = await runWorkerAgent({ agent: goal?.agent, prompt, cwd: project.dir, tools: 'Read,Glob,Grep', permissionMode: 'plan' });
+  const code = result.replace(/^```[a-z]*\n?/m, '').replace(/```\s*$/m, '').trim();
+  writeFileSync(file, code);
+  const mod = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+  if (typeof mod.default !== 'function') throw new Error('authored verify script has no default export');
+  return mod.default;
+}
+
+// goal 427 §3 — slow mode: when MANAGER_SLOW_MODE is on, pace task starts so
+// an AFK run doesn't burn quota at hardware speed. Pure-ish (isolated to this
+// one Map so it stays trivially inspectable); the actual gate is the
+// `lastStartAt` check in pump() below.
+const slowModeLastStart = new Map(); // projectId -> ms epoch of the last task start
+function pump(projectId) {
+  const q = queues.get(projectId);
+  // sortQueueByPriority is a stable sort: it only ever moves a task ahead of
+  // a lower-priority one, never disturbs relative order within the same
+  // priority — so a task's push-time (creation) position, or a user's own
+  // drag reorder (/api/queue/reorder below), survives every pump() call.
+  q.waiting = sortQueueByPriority(q.waiting);
+  if (!q.waiting.length) return;
+  const slow = slowModeSettings();
+  // Slots = the tighter of "this project's own parallel cap" (further capped
+  // by slow mode's maxParallel when on) and "global cap across every
+  // project" — never spawn past either. nextRunnableTasks then picks which
+  // queued tasks are actually safe to start within that many slots: at most
+  // one per goalId not already running, so a goal's own next task never
+  // jumps ahead of its still-running sibling.
+  const projectCap = slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
+  const slots = Math.min(projectCap - q.running.size, GLOBAL_MAX_PARALLEL - globalRunningCount());
+  if (!canStartMore(0, slots)) return;
+  if (slow.enabled) {
+    const last = slowModeLastStart.get(projectId) ?? 0;
+    const wait = slow.delayMs - (Date.now() - last);
+    if (wait > 0) { setTimeout(() => pump(projectId), wait); return; }
+  }
+  const runningGoalIds = [...q.running].map((t) => t.goalId);
+  const toStart = nextRunnableTasks(q.waiting, runningGoalIds, slow.enabled ? 1 : slots);
+  for (const task of toStart) {
+    const i = q.waiting.indexOf(task);
+    if (i !== -1) q.waiting.splice(i, 1);
+    q.running.add(task);
+    if (slow.enabled) slowModeLastStart.set(projectId, Date.now());
+    runTask(task).finally(() => { q.running.delete(task); pump(projectId); });
+  }
+}
+
+// goal 427 §1/§2 wiring: cumulative per-goal usage tracking + the two stop
+// conditions (run-budget exceeded / rate-limited) that a worker call can hit.
+// Called right after every runClaude() call that belongs to a goal's own
+// worker (not the cheap auxiliary calls — authorVerify/summarizeForReview —
+// which are single, haiku-tier, and not the actual quota-burn risk).
+function trackGoalRunUsage(goal, elapsedMs, usage) {
+  if (!goal) return null;
+  goal.runElapsedMs = (goal.runElapsedMs ?? 0) + Math.max(0, elapsedMs || 0);
+  goal.runUsage = sumUsage([goal.runUsage, usage]);
+  goal.runTokenWeight = CACHE_READ_TOKEN_WEIGHT;
+  goal.runTokens = (goal.runTokens ?? 0) + usageBudgetTokens(usage, { cacheReadWeight: CACHE_READ_TOKEN_WEIGHT });
+  goal.runAttempts = (goal.runAttempts ?? 0) + 1;
+  const budget = checkRunBudget({ elapsedMs: goal.runElapsedMs, tokens: goal.runTokens, attempts: goal.runAttempts }, goalRunBudgetLimits());
+  if (budget?.exceeded) {
+    budget.usage = goal.runUsage;
+    budget.weightedTokens = goal.runTokens;
+    budget.cacheReadWeight = CACHE_READ_TOKEN_WEIGHT;
+  }
+  return budget;
+}
+
+function budgetUsageDetail(budget) {
+  if (!budget?.usage || budget.which !== 'tokens') return '';
+  const u = budget.usage;
+  const fmt = (n) => Number(n ?? 0).toLocaleString('en-US');
+  const weight = Number(budget.cacheReadWeight ?? 0.1);
+  return `budget-counted ${fmt(budget.weightedTokens)} tokens (cache read weighted ${weight}); raw input ${fmt(u.input_tokens)}, output ${fmt(u.output_tokens)}, cache write ${fmt(u.cache_creation_input_tokens)}, cache read ${fmt(u.cache_read_input_tokens)}`;
+}
+
+function budgetReasonWithUsage(budget) {
+  const detail = budgetUsageDetail(budget);
+  return detail ? `${budget.reason}\n${detail}` : budget.reason;
+}
+
+function refreshGoalHandoff(goal) {
+  if (!goal) return null;
+  const siblings = tasks.filter((t) => t.goalId === goal.id);
+  goal.contextHandoff = buildContextHandoffSummary({ goal, tasks: siblings });
+  goal.contextHandoffAt = new Date().toISOString();
+  return goal.contextHandoff;
+}
+
+function shouldFreshSessionForPlan(plan) {
+  return ['compact', 'cold-handoff'].includes(plan?.sessionMode);
+}
+
+function managerHandoffPrompt(goal, plan) {
+  if (!shouldFreshSessionForPlan(plan)) return '';
+  const mode = plan.sessionMode === 'compact' ? 'compact handoff' : 'fresh handoff';
+  return [
+    `(Manager session-hygiene: using ${mode} because ${plan.sessionReason}. Continue from this compact handoff and the files on disk; do not assume hidden chat history.)`,
+    goal?.contextHandoff || refreshGoalHandoff(goal) || '',
+    plan.workerPolicy?.reason ? `Worker policy: ${plan.workerPolicy.reason}` : '',
+    latestFailurePolicy(goal)?.text || '',
+  ].filter(Boolean).join('\n\n');
+}
+
+function recentProjectFailureMemory(projectId, text) {
+  const haystack = String(text ?? '').toLowerCase();
+  return goals
+    .filter((g) => g.projectId === projectId && Array.isArray(g.failureMemory) && g.failureMemory.length)
+    .flatMap((g) => g.failureMemory.map((entry) => ({ goal: g, entry })))
+    .filter(({ entry }) => {
+      if (!haystack) return true;
+      const blob = `${entry?.recurrenceKey ?? ''} ${entry?.rootCause ?? ''} ${entry?.whatHappened ?? ''}`.toLowerCase();
+      return blob.includes('test') && /test|テスト|検証/.test(haystack)
+        || blob.includes('budget') && /token|budget|予算|コンテキスト/.test(haystack)
+        || blob.includes('proof') && /ui|proof|スクショ|画面/.test(haystack)
+        || blob.includes('non-code') && /docs?|prd|調査|レポート|document/.test(haystack);
+    })
+    .sort((a, b) => String(b.entry.createdAt ?? '').localeCompare(String(a.entry.createdAt ?? '')))
+    .slice(0, 3)
+    .map(({ entry }) => entry);
+}
+
+function recordGoalFailure(goal, { kind, reason = '', usage = null, changedFiles = [], testResult = null, attentionHadDetail = true } = {}) {
+  if (!goal) return null;
+  const siblings = tasks.filter((t) => t.goalId === goal.id);
+  const entry = buildFailurePostmortem({
+    goal,
+    tasks: siblings,
+    kind,
+    reason,
+    usage: usage ?? goal.runUsage,
+    changedFiles,
+    testResult: testResult ?? goal.testResult,
+    attentionHadDetail,
+    previousEntries: goal.failureMemory ?? [],
+  });
+  goal.failureMemory = appendFailureMemory(goal, entry);
+  return entry;
+}
+
+// Stop the goal cleanly on a run-budget breach: the offending task becomes
+// 'interrupted' (same status crash-recovery uses — retryable, never a silent
+// fail) and the goal becomes 'blocked' with a human-readable reason, exactly
+// like the existing verifyGate block states (goal.blocked = {kind, reason}) —
+// reusing the SAME Attention UI (reason + Retry + Archive) rather than adding
+// a new one.
+function queueBudgetContinuation(goal, task, budget) {
+  const used = Number(goal.autoRework?.budgetStops ?? 0);
+  if (used >= MAX_AUTO_BUDGET_REWORKS) return false;
+  const now = new Date().toISOString();
+  goal.autoRework = {
+    ...(goal.autoRework ?? {}),
+    budgetStops: used + 1,
+    lastBudgetReason: budget.reason,
+    lastBudgetAt: now,
+  };
+  goal.status = 'running';
+  goal.blocked = null;
+  goal.contextHandoff = buildContextHandoffSummary({ goal, tasks: tasks.filter((t) => t.goalId === goal.id) });
+  goal.contextHandoffAt = now;
+  goal.sessionId = null;
+  goal.runElapsedMs = 0;
+  goal.runTokens = 0;
+  goal.runAttempts = 0;
+  goal.runUsage = null;
+  saveGoal(goal);
+  const reply = queueReplyTask(goal, [
+    `Manager budget-feedback: the previous worker run exceeded the token budget (${budgetReasonWithUsage(budget).replace(/\n/g, '; ')}).`,
+    `Continue the same goal from the files already on disk${task?.title ? `, focused only on "${task.title}"` : ''}.`,
+    'Do not resume broad exploration or re-read the whole repository. Inspect only the directly relevant files and make the smallest change needed.',
+    'Run the narrowest relevant tests first; only run the full test suite after the small fix is in place.',
+    'If the remaining work is larger than one small patch, stop and report the next smallest step instead of expanding scope.',
+  ].join('\n'));
+  reply.budgetContinuation = true;
+  saveTask(reply);
+  return true;
+}
+
+function blockForBudget(goal, task, budget) {
+  task.status = 'interrupted';
+  task.result = budgetReasonWithUsage(budget);
+  task.finishedAt = new Date().toISOString();
+  saveTask(task);
+  recordGoalFailure(goal, { kind: 'budget', reason: budgetReasonWithUsage(budget), usage: goal?.runUsage });
+  if (queueBudgetContinuation(goal, task, budget)) {
+    task.status = 'skipped';
+    task.result = `${budgetReasonWithUsage(budget)}\n\n自動縮小リトライに引き継ぎ済み`;
+    saveTask(task);
+    sendAct(task, `budget exceeded — queued a cold, narrow continuation`);
+    return;
+  }
+  const retries = Number(goal.autoRework?.budgetStops ?? 0);
+  const baseReason = budgetReasonWithUsage(budget);
+  const reason = retries ? `${baseReason}\n自動縮小リトライ ${retries} 回後も停止` : baseReason;
+  goal.status = 'blocked';
+  goal.blocked = { kind: 'budget', reason };
+  saveGoal(goal);
+  sendAct(task, `stopped — ${reason}`);
+}
+// Pause (not fail) on a detected Claude usage/rate limit: mark the task
+// 'interrupted' (retryable) and the goal 'blocked' with kind 'rate-limit' +
+// resumeAt, then let rateLimitResumeSweep() (below) auto-resume it once the
+// cooldown elapses — no immediate retry, which would just re-hit the same
+// limit and burn the retry budget for nothing.
+function pauseForRateLimit(goal, task) {
+  const attempt = (goal.rateLimitAttempts = (goal.rateLimitAttempts ?? 0) + 1);
+  const delay = nextResumeDelay(attempt, rateLimitDelayOpts());
+  const resumeAt = Date.now() + delay;
+  goal.status = 'blocked';
+  goal.blocked = { kind: 'rate-limit', reason: `paused: Claude usage limit — will resume automatically in ~${Math.max(1, Math.round(delay / 60000))}min`, resumeAt };
+  recordGoalFailure(goal, { kind: 'rate-limit', reason: goal.blocked.reason, usage: goal?.runUsage });
+  saveGoal(goal);
+  task.status = 'interrupted';
+  task.result = 'paused: Claude usage limit reached — will resume automatically';
+  task.finishedAt = new Date().toISOString();
+  saveTask(task);
+  sendAct(task, `rate limit detected — pausing goal, auto-resume in ~${Math.max(1, Math.round(delay / 60000))}min`);
+}
+// Auto-resume: re-queue every 'interrupted' task the pause left behind and
+// flip the goal back to 'running'. Driven by rateLimitResumeSweep (a plain
+// setInterval) rather than a per-goal setTimeout so it survives a server
+// restart during the cooldown — resumeAt is persisted on goal.blocked, so the
+// very next sweep tick after boot picks up anything whose time has come.
+function resumeRateLimitedGoal(goal) {
+  const stuck = tasks.filter((t) => t.goalId === goal.id && t.status === 'interrupted');
+  for (const t of stuck) {
+    t.status = 'queued'; t.result = null; t.finishedAt = null;
+    saveTask(t);
+    const q = queues.get(t.projectId);
+    if (q && !q.waiting.includes(t)) q.waiting.push(t);
+  }
+  goal.status = 'running';
+  goal.blocked = null;
+  saveGoal(goal);
+  if (stuck.length) pump(goal.projectId);
+}
+function rateLimitResumeSweep() {
+  const now = Date.now();
+  for (const g of goals) {
+    if (g.status === 'blocked' && g.blocked?.kind === 'rate-limit' && g.blocked.resumeAt && g.blocked.resumeAt <= now) {
+      resumeRateLimitedGoal(g);
+    }
+  }
+}
+const rateLimitSweepTimer = setInterval(rateLimitResumeSweep, RATE_LIMIT_SWEEP_MS);
+rateLimitSweepTimer.unref?.();
+
+// Slack風スレッド返信タスクの生成(/api/goals/:id/reply と /api/goals/:id/dismiss で共有)。
+// runTask()のtask.reply分岐がgoal.sessionIdをresumeに渡して同じ会話を続ける。
+function queueReplyTask(goal, text) {
+  const failurePolicy = latestFailurePolicy(goal);
+  const promptText = failurePolicy ? `${failurePolicy.text}\n\n${text}` : text;
+  goal.executionPlan = buildExecutionPlan({
+    projectId: goal.projectId,
+    text: promptText,
+    usage: goal.runUsage,
+    runTokens: goal.runTokens,
+    runAttempts: goal.runAttempts,
+    previousSession: Boolean(goal.sessionId || goal.contextHandoff),
+  });
+  if (shouldFreshSessionForPlan(goal.executionPlan)) refreshGoalHandoff(goal);
+  saveGoal(goal);
+  const nums = tasks.filter((t) => t.projectId === goal.projectId).map((t) => t.num);
+  const task = {
+    id: nextId++, num: (nums.length ? Math.max(...nums) : 0) + 1,
+    goalId: goal.id, projectId: goal.projectId, reply: true, model: goal.model, effort: goal.effort, agent: goal.agent,
+    title: text.replace(/\s+/g, ' ').slice(0, 60), detail: promptText.slice(0, 4000),
+    passCondition: null, status: 'queued', createdAt: new Date().toISOString(), priority: '中',
+    result: null, changedFiles: [], secs: null, activity: [], proof: null, usage: null,
+  };
+  tasks.push(task);
+  saveTask(task);
+  queues.get(goal.projectId).waiting.push(task);
+  pump(goal.projectId);
+  return task;
+}
+
+function testOutputExcerpt(text) {
+  const lines = String(text ?? '').split('\n').map((l) => l.trimEnd()).filter(Boolean);
+  const interesting = lines.filter((l) =>
+    /fail|error|assert|expected|actual|not ok|✖|テスト失敗|ERR!/i.test(l));
+  const chosen = (interesting.length ? interesting : lines).slice(-80);
+  return chosen.join('\n').slice(-3000);
+}
+
+function workerPrompt(task, goal, lastFailure) {
+  // Optional skill the user attached to this goal. Empirically (scratch worker,
+  // haiku, custom fixture skill) the reliably-firing form is an explicit Skill-tool
+  // instruction as the FIRST line; a bare "/name" first line did not consistently
+  // trigger the skill in `claude -p`. See commit body for the run evidence.
+  const skill = task?.skill ?? goal?.skill;
+  const agentName = workerAgent(task?.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code';
+  return [
+    skill ? `FIRST, use the /${skill} skill via the Skill tool (invoke Skill with the "${skill}" skill) before doing anything else. Then carry out the task below.` : '',
+    `You are a ${agentName} worker managed by "Manager for AI". Do ONLY the task below inside this project directory.`,
+    goal?.priorFailureMemory?.length ? `\nMANAGER FAILURE MEMORY:\n${latestFailurePolicy(goal.priorFailureMemory)?.text}\nApply this prevention before starting.` : '',
+    '',
+    `TASK ${task.num}: ${task.title}`,
+    task.detail ? `DETAIL: ${task.detail}` : '',
+    goal?.images?.length ? `ATTACHED IMAGES (absolute paths, use the Read tool to view them): ${goal.images.join(' ')}` : '',
+    task.passCondition ? `\nEXPLICIT PASS CONDITION (verified externally by a headless browser after you finish — NOT by you): ${task.passCondition}` : '',
+    lastFailure ? `\nPREVIOUS ATTEMPT FAILED EXTERNAL VERIFICATION: ${lastFailure}\nYour previous changes are on disk. Diagnose and fix.` : '',
+    goal ? `\n(全体ゴールの一部です: ${goal.text.slice(0, 500)})` : '',
+    '',
+    'RULES:',
+    '- Edit only files inside this directory. Keep changes minimal.',
+    '- Keep the work bounded: inspect only files needed for this task; avoid broad repository scans unless they are necessary.',
+    '- If the task is larger than one focused patch, make the smallest safe change and report the next step instead of expanding scope.',
+    "- You may use the user's installed skills (Skill tool, e.g. /galda-doc) when one clearly fits the task.",
+    // Token-frugality + the 10-min run cap: the worker used to run the WHOLE suite
+    // (npm test) repeatedly, which the Manager ALSO runs at close-out — double work
+    // that regularly overran the cap (→ a SIGTERM 'interrupted'). Write the test,
+    // run only the RELEVANT file once, and leave the full-suite + verification to
+    // the Manager. (Masa: worker が自前でテスト全回し→止まる、が最大の無駄。)',
+    '- 変更に対応するテストを書く。確認は該当テストファイル1つだけを1回実行する（例: node --test path/to/only-this.test.mjs）。プロジェクト全体の npm test を繰り返し回さない — 全体テストと最終検証は Manager 側が実行する。テストが適用できない変更は理由と手動確認手順を書く。',
+    '- 検証しすぎない: 自分の変更が動くと確認できたら、それ以上ログを漁ったり再検証を重ねたりせず、すぐに報告して終える（時間と token の無駄を避ける）。',
+    '- Do not commit (git is handled by the Manager).',
+    '- 最後に日本語で2〜4行：何を変えたか・どのファイルか・テスト結果・人間が確認すべき点。',
+  ].filter(Boolean).join('\n');
+}
+
+// A fresh ephemeral instance starts with zero history, but some pass
+// conditions are about completion-time behavior (e.g. task 46: a goal
+// created with the PR toggle off must finish without a PR). Actually
+// running a real worker task to produce that history would spawn a live
+// Claude Code worker back onto this very project directory (recursive,
+// slow, and liable to collide with the run already in progress) — so
+// instead seed two already-finished example goals directly into the
+// ephemeral instance's queue log before it boots: one that completed with
+// a PR, one that completed without. A verify check can then inspect
+// window.state.goals for real finished examples of both cases, per the
+// authorVerify instructions below.
+// 1x1 transparent GIF — just enough bytes for a real /proof/:id/proof.gif
+// response, so the PR-less review checklist's video slot (task 62) renders
+// an actual <img>, not the "no video" placeholder.
+const TINY_GIF = Buffer.from('R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==', 'base64');
+
+function seedEphemeralHistory(home, projectDir) {
+  const dir = join(home, 'chat-runs');
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, 'tasks.jsonl'), buildEphemeralSeedLog());
+  // Without this, the ephemeral instance has no projects.json of its own and
+  // auto-generates exactly one project — not enough to verify the sidebar
+  // can switch between projects (task 57).
+  writeFileSync(join(home, 'projects.json'), JSON.stringify(buildEphemeralSeedProjects(projectDir), null, 2));
+  // Task 62's 8 seeded review requirement tasks (ids 8-15, see
+  // buildEphemeralSeedLines) each reference proof.gif — write the file each
+  // one's proof dir actually serves so the checklist's <img> isn't a 404.
+  for (let id = 8; id <= 15; id++) {
+    const proofDir = join(dir, `proof-${id}`);
+    mkdirSync(proofDir, { recursive: true });
+    writeFileSync(join(proofDir, 'proof.gif'), TINY_GIF);
+  }
+}
+
+// When the verify target is a Manager app itself (our main dogfood case),
+// file:// or this server's own URL are both wrong: file:// cannot fetch
+// /api, and this server serves ITS code, not the project's edited code.
+// So boot a throwaway instance of the project's code and verify against it.
+// Ephemeral proof servers are spawned children of this process. If the parent
+// (prod) is restarted (every deploy does `kill <pid>`) while one is mid-capture,
+// it ORPHANS and keeps holding its port — this was the true source of the
+// session-long "server did not report ready in time" flakiness (leaked servers
+// squatting test/ephemeral ports). Track them and hard-kill on parent exit.
+const ephemeralChildren = new Set();
+let ephemeralReaperInstalled = false;
+function installEphemeralReaper() {
+  if (ephemeralReaperInstalled) return;
+  ephemeralReaperInstalled = true;
+  const reap = () => { for (const c of ephemeralChildren) { try { c.kill('SIGKILL'); } catch { /* already gone */ } } };
+  process.on('exit', reap);
+  for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { reap(); process.exit(0); });
+}
+async function startEphemeralApp(projectDir) {
+  installEphemeralReaper();
+  const port = 4460 + Math.floor(Math.random() * 30);
+  const home = join(logDir, `ephemeral-${Date.now()}`);
+  mkdirSync(home, { recursive: true });
+  seedEphemeralHistory(home, projectDir);
+  const child = spawn('node', [join(projectDir, 'engine', 'server.mjs')], {
+    env: { ...process.env, MANAGER_PORT: String(port), MANAGER_HOME: home, MANAGER_OPEN_BROWSER: '0', MANAGER_SEED_RUNNING_FIXTURE: '1' },
+    cwd: projectDir, stdio: 'ignore',
+  });
+  ephemeralChildren.add(child);
+  child.on('close', () => ephemeralChildren.delete(child));
+  for (let i = 0; i < 40; i++) {
+    await new Promise((r) => setTimeout(r, 250));
+    try {
+      const key = readFileSync(join(home, 'secret.key'), 'utf8').trim();
+      const r = await fetch(`http://localhost:${port}/api/state?key=${key}`);
+      if (r.ok) return { url: `http://localhost:${port}/?key=${key}`, kill: () => { try { child.kill(); } catch {} } };
+    } catch { /* not up yet */ }
+  }
+  try { child.kill(); } catch {}
+  return null;
+}
+
+function isManagerApp(goal, project) {
+  if (!goal?.entry || /^https?:\/\//.test(goal.entry)) return false;
+  const abs = resolve(join(project.dir, goal.entry));
+  return abs === resolve(project.dir, 'app', 'index.html') && existsSync(join(project.dir, 'engine', 'server.mjs'));
+}
+
+function entryUrlFor(goal, project) {
+  return resolveEntryUrl({ entry: goal?.entry, projectDir: project.dir, managerRoot: ROOT, port: PORT, accessKey: ACCESS_KEY });
+}
+
+function canSnapshot(project) {
+  return existsSync(join(project.dir, 'engine', 'server.mjs')) && existsSync(join(project.dir, 'app', 'index.html'));
+}
+
+function proofIntentFor(goal, task) {
+  const text = `${goal?.text ?? ''}\n${goal?.plan?.join?.('\n') ?? ''}\n${task?.title ?? ''}\n${task?.detail ?? ''}`.toLowerCase();
+  if (/retry|resume|view log|archive|失敗|エラー|blocked|interrupted|attention|to do|todo/.test(text)) {
+    return 'attention-actions';
+  }
+  if (/review|approve|dismiss|proof|スクショ|画像|動画/.test(text)) return 'review';
+  return 'general';
+}
+
+async function verifyManagerProofTarget(page, ui, { goal = null, task = null } = {}) {
+  const intent = proofIntentFor(goal, task);
+  const root = await page.waitForSelector('#fsRoot', { timeout: 1500 }).catch(() => null);
+  if (!root) {
+    await exerciseUi(page, ui);
+    return { pass: true, detail: 'UI change capture (auto, unverified)' };
+  }
+  await page.evaluate(() => {
+    localStorage.setItem('layout', 'flagship');
+    if (window.state?.projects?.some((p) => p.id === 'default')) window.state.active = 'default';
+    window.render?.();
+  });
+  await ui.sleep(300);
+
+  if (intent === 'attention-actions') {
+    await page.waitForSelector('#fsTodoSec .drow.err .acts2', { timeout: 5000 });
+    await page.evaluate(() => document.querySelector('#fsTodoSec .drow.err')?.scrollIntoView({ block: 'center', inline: 'nearest' }));
+    await ui.sleep(250);
+    const metrics = await page.evaluate(() => {
+      const rect = (el) => {
+        const r = el?.getBoundingClientRect?.();
+        return r ? { x: r.x, y: r.y, width: r.width, height: r.height, top: r.top, bottom: r.bottom, right: r.right, left: r.left } : null;
+      };
+      const root = document.querySelector('#fsRoot');
+      const feed = document.querySelector('#fsFeedWrap') || document.querySelector('#fsFeed')?.parentElement;
+      const lane = document.querySelector('#fsLane');
+      const row = document.querySelector('#fsTodoSec .drow.err');
+      const msg = row?.querySelector('.errline .msg');
+      const acts = row?.querySelector('.acts2');
+      const buttonText = [...(acts?.querySelectorAll('button') ?? [])].map((b) => b.textContent.trim()).join(' ');
+      const rootR = rect(root), feedR = rect(feed), laneR = rect(lane), msgR = rect(msg), actsR = rect(acts);
+      return {
+        buttonText,
+        hasRetry: /Retry|Resume/.test(buttonText),
+        hasLog: /View log/.test(buttonText),
+        hasArchive: /Archive/.test(buttonText),
+        actionGap: msgR && actsR ? Math.round(actsR.top - msgR.bottom) : null,
+        laneWidth: Math.round(laneR?.width ?? 0),
+        feedWidth: Math.round(feedR?.width ?? 0),
+        rootWidth: Math.round(rootR?.width ?? 0),
+        laneVisible: Boolean(laneR && laneR.width >= 260 && laneR.right <= window.innerWidth + 2),
+      };
+    });
+    const actionClose = metrics.actionGap == null || metrics.actionGap <= 18;
+    const laneSane = metrics.laneVisible && metrics.feedWidth > 420 && metrics.laneWidth > 260;
+    return {
+      pass: Boolean(metrics.hasRetry && metrics.hasLog && actionClose && laneSane),
+      detail: `Manager UI proof target: failed-row actions visible (${metrics.buttonText || 'none'}), action gap ${metrics.actionGap ?? 'n/a'}px, lane ${metrics.laneWidth}px/feed ${metrics.feedWidth}px`,
+    };
+  }
+
+  await exerciseUi(page, ui);
+  const metrics = await page.evaluate(() => {
+    const lane = document.querySelector('#fsLane')?.getBoundingClientRect();
+    const feed = (document.querySelector('#fsFeedWrap') || document.querySelector('#fsFeed')?.parentElement)?.getBoundingClientRect();
+    return { laneWidth: Math.round(lane?.width ?? 0), feedWidth: Math.round(feed?.width ?? 0) };
+  });
+  return { pass: true, detail: `Manager UI capture (${intent}); lane ${metrics.laneWidth}px/feed ${metrics.feedWidth}px` };
+}
+
+// Zero-LLM screenshot + short clip of an ephemeral instance of the project's
+// current code, stored as the task's proof. Used automatically for UI tasks
+// without an explicit pass condition, and on demand via
+// POST /api/tasks/:id/snapshot to backfill old "No capture yet" reviews.
+//
+// The clip is no longer an idle page (a 0-second clip of nothing moving said
+// nothing a screenshot didn't) — exerciseUi() moves the cursor and scrolls
+// the live app during the capture, so the GIF/mp4 actually SHOW the change
+// instead of a static landing shot. The `detail` text is deliberately NOT
+// "snapshot"-worded: app/index.html's proofMediaHtml() keys its PNG-only /
+// no-video display off /snapshot|スナップショット/i in proof.detail (that
+// heuristic exists for the old idle capture) — this capture has real motion
+// worth showing, so it earns the same GIF+tap-to-play-mp4 treatment as a
+// verified run.
+//
+// opts.baselineDir: when given and it's a genuinely different checkout than
+// `project.dir` (see shouldCaptureBaseline — never fabricate a before/after
+// from the same directory), best-effort capture a BASELINE screenshot too
+// (single attempt, screenshot-only, never throws) so the review card can
+// show before/after. Reviewer UI already supports this via
+// proof.beforePng/beforeGif (beforeAfterMediaHtml in app/index.html).
+async function captureSnapshotProof(task, project, opts = {}) {
+  const eph = await startEphemeralApp(project.dir);
+  if (!eph) throw new Error('ephemeral instance failed to boot');
+  try {
+    const proofDir = join(logDir, `proof-${task.id}`);
+    mkdirSync(proofDir, { recursive: true });
+    const managerApp = canSnapshot(project);
+    const snap = await runVerification({
+      entryUrl: eph.url,
+      verify: async (page, ui) => managerApp
+        ? verifyManagerProofTarget(page, ui, { goal: opts.goal, task })
+        : (await exerciseUi(page, ui), { pass: true, detail: 'UI change capture (auto, unverified)' }),
+      outBase: join(proofDir, 'snapshot'),
+      viewport: managerApp ? { width: 1440, height: 900, deviceScaleFactor: 2 } : undefined,
+    });
+    task.proof = {
+      pass: snap.pass, detail: snap.detail || 'UI change capture (auto, unverified)',
+      gif: snap.gifPath?.split('/').pop() ?? null,
+      png: snap.shotPath?.split('/').pop() ?? null,
+      mp4: snap.videoPath?.split('/').pop() ?? null,
+    };
+    const baselineDir = opts.baselineDir;
+    if (shouldCaptureBaseline({ baselineDir, afterDir: project.dir, canCaptureBaseline: baselineDir ? canSnapshot({ dir: baselineDir }) : false })) {
+      let beph = null;
+      try {
+        beph = await startEphemeralApp(baselineDir);
+        if (beph) {
+          const bsnap = await runVerification({
+            entryUrl: beph.url,
+            verify: async (page, ui) => managerApp
+              ? verifyManagerProofTarget(page, ui, { goal: opts.goal, task })
+              : (await exerciseUi(page, ui), { pass: true, detail: 'baseline (before)' }),
+            outBase: join(proofDir, 'before'),
+            viewport: managerApp ? { width: 1440, height: 900, deviceScaleFactor: 2 } : undefined,
+            record: false, // comparison shot only — not worth a second video encode
+          });
+          task.proof.beforePng = bsnap.shotPath?.split('/').pop() ?? null;
+        }
+      } catch (e) {
+        // Before/after is a nice-to-have on top of the mandatory "after"
+        // capture above (already saved) — never let a flaky baseline boot
+        // fail the whole capture. Report it and move on.
+        sendAct(task, `proof: baseline (before) capture skipped — ${String(e.message ?? e).slice(0, 100)}`);
+      } finally { beph?.kill(); }
+    }
+    saveTask(task);
+    return task;
+  } finally { eph.kill(); }
+}
+
+async function runTask(task) {
+  const project = projects.find((p) => p.id === task.projectId);
+  const goal = goals.find((g) => g.id === task.goalId);
+  task.status = 'running'; task.startedAt = new Date().toISOString();
+  if (goal && !goal.startedAt && !task.reply) { goal.startedAt = task.startedAt; saveGoal(goal); }
+  saveTask(task);
+  sendProcessAct(task, `Working on "${task.title}"${task.reply ? ' as a follow-up' : ''}.`);
+
+  // Everything the worker touches happens in the goal's own worktree (clean
+  // base from origin/main, isolated from other goals and the user's real dir).
+  const workDir = goal ? goalWorkDir(goal, project) : project.dir;
+  const wproject = { ...project, dir: workDir };
+  sendProcessAct(task, `Prepared isolated worktree: ${workDir}`);
+  const before = await gitChanges(workDir);
+  sendProcessAct(task, `Checked starting git state (${before.length} changed file${before.length === 1 ? '' : 's'} before this task).`);
+  // Plan mode makes no edits, so there is nothing to verify — never author a
+  // check or boot an ephemeral instance for it.
+  const planMode = goal?.mode === 'plan' && goal?.planPhase !== 'executing';
+  const permissionMode = permissionModeFor(planMode ? 'plan' : (task.mode ?? goal?.mode));
+  const entryUrl = (task.passCondition && !planMode) ? entryUrlFor(goal, wproject) : null;
+  const maxAttempts = entryUrl ? 3 : 1;
+  const t0 = Date.now();
+
+  // Thread replies resume the goal's Claude Code session — same context,
+  // same conversation, no re-briefing (and no wasted tokens).
+  if (task.reply) {
+    const plan = goal?.executionPlan;
+    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goal?.sessionId ?? undefined);
+    const prompt = [
+      managerHandoffPrompt(goal, plan),
+      task.detail,
+      '',
+      '(User follow-up on the goal you worked on. Act on it inside this project directory; reply briefly in Japanese.)',
+    ].filter(Boolean).join('\n');
+    const callT0 = Date.now();
+    sendProcessAct(task, `Starting ${workerAgent(task.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code'} worker with the existing goal context.`);
+    const r = await runWorkerAgent({
+      agent: task.agent ?? goal?.agent,
+      prompt, cwd: workDir, tools: WORKER_TOOLS, resume: resumeSession,
+      // A reply that revises a plan-review must stay plan mode (no edits); a
+      // reply/rework on a normal goal stays acceptEdits as before.
+      permissionMode: permissionModeFor(goal?.mode === 'plan' && goal?.planPhase !== 'executing' ? 'plan' : undefined),
+      model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+      onTodos: (todos) => sendTodos(task, todos),
+      onChild: (c) => trackGoalWorker(goal?.id, c),
+    });
+    if (goal?.cancelled) return; // goal deleted mid-run → don't resurrect the task / run the gate
+    // goal 427 §1/§2: a reply/rework is still a real worker spawn — count it
+    // against the goal's run budget, and treat a rate-limit hit here the same
+    // as in the main loop (pause + auto-resume, not a normal failure).
+    if (goal && isRateLimited(r.result)) { pauseForRateLimit(goal, task); return; }
+    const replyBudget = trackGoalRunUsage(goal, Date.now() - callT0, r.usage);
+    if (replyBudget?.exceeded) { blockForBudget(goal, task, replyBudget); return; }
+    sendProcessAct(task, `Worker finished with exit code ${r.code}.`);
+    task.secs = Math.round((Date.now() - t0) / 1000);
+    task.status = r.code === 0 ? 'done' : 'failed';
+    task.result = r.result.slice(0, 4000);
+    task.usage = sumUsage([r.usage]);
+    if (r.sessionId && goal) { goal.sessionId = r.sessionId; saveGoal(goal); }
+    const afterR = await gitChanges(workDir);
+    task.changedFiles = afterR.filter((l) => !before.includes(l)).map((l) => l.slice(3));
+    sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this follow-up.`);
+    task.finishedAt = new Date().toISOString();
+    saveTask(task);
+    // A rework (comment/dismiss) must re-enter the verify gate — re-test,
+    // re-capture proof, update the SAME PR (openPR existingBranch) — and land
+    // back in Review. Without this the reworked goal is stuck 'running' forever
+    // (dismissGoal set it running) and never returns to the reviewer.
+    //
+    // NOT awaited (Masa dogfood #111: "doingの内容が終わって、to doが始まるまで
+    // にラグがある"): this task's own work is already done and saved above —
+    // finishGoalIfComplete's tests/PR/summarize/proof pipeline can take a long
+    // time and must not hold this task's running-slot hostage. It runs in the
+    // goal's own isolated worktree, so it's safe to let it proceed while
+    // pump() (below, via runTask's caller) immediately frees the slot and
+    // starts the next queued task, possibly from a different goal.
+    if (goal) {
+      sendProcessAct(task, 'Starting goal close-out: tests, proof gate, review summary, and PR update if needed.');
+      finishGoalIfComplete(goal, wproject, task).catch((e) => sendAct(task, `goal close: ${String(e.message ?? e).slice(0, 120)}`));
+    }
+    else startNextStacked(task.projectId);
+    return;
+  }
+
+  let verify = null, verdict = null, lastFailure = null, code = 0, result = '', usages = [], timedOut = false;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    let callT0 = Date.now();
+    const plan = goal?.executionPlan;
+    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goal?.sessionId ?? undefined);
+    const prompt = [managerHandoffPrompt(goal, plan), workerPrompt(task, goal, lastFailure)].filter(Boolean).join('\n\n');
+    sendProcessAct(task, `Starting ${workerAgent(task.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code'} worker (attempt ${attempt}/${maxAttempts}).`);
+    let r = await runWorkerAgent({
+      agent: task.agent ?? goal?.agent,
+      prompt, cwd: workDir, tools: WORKER_TOOLS,
+      resume: resumeSession, permissionMode,
+      model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+      onTodos: (todos) => sendTodos(task, todos),
+      onChild: (c) => trackGoalWorker(goal?.id, c),
+    });
+    if (goal?.cancelled) return; // deleted mid-run → stop, don't run verify/PR
+    // goal 427 §2: a detected usage/rate limit is NOT a normal failure — pause
+    // and auto-resume instead of falling into the cold-retry/failure paths
+    // below, which would just re-hit the same limit.
+    if (goal && isRateLimited(r.result)) { pauseForRateLimit(goal, task); return; }
+    // goal 427 §1: count this spawn against the goal's run budget regardless
+    // of exit code — a budget breach stops the goal even if THIS call itself
+    // "succeeded".
+    let budget = trackGoalRunUsage(goal, Date.now() - callT0, r.usage);
+    if (budget?.exceeded) { blockForBudget(goal, task, budget); return; }
+    if (r.code !== 0 && goal?.sessionId) {
+      // The warm session can expire or be cleaned up between tasks; one cold
+      // retry distinguishes "resume broke" from "the task itself failed".
+      sendAct(task, 'warm session unavailable — retrying with a fresh session…');
+      goal.sessionId = null; saveGoal(goal);
+      callT0 = Date.now();
+      sendProcessAct(task, 'Starting a fresh worker session because the warm session could not resume.');
+      r = await runWorkerAgent({
+        agent: task.agent ?? goal?.agent,
+        prompt: workerPrompt(task, goal, lastFailure), cwd: workDir, tools: WORKER_TOOLS,
+        permissionMode,
+        model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+        onTodos: (todos) => sendTodos(task, todos),
+        onChild: (c) => trackGoalWorker(goal?.id, c),
+      });
+      if (goal?.cancelled) return;
+      if (goal && isRateLimited(r.result)) { pauseForRateLimit(goal, task); return; }
+      budget = trackGoalRunUsage(goal, Date.now() - callT0, r.usage);
+      if (budget?.exceeded) { blockForBudget(goal, task, budget); return; }
+    }
+    ({ code, result } = r);
+    timedOut = Boolean(r.timedOut);
+    usages.push(r.usage);
+    sendProcessAct(task, timedOut
+      ? `Worker attempt ${attempt} was stopped at the ${Math.round(WORKER_TIMEOUT_MS / 60000)}-minute run limit (exit ${code}).`
+      : `Worker attempt ${attempt} finished with exit code ${code}.`);
+    if (r.sessionId && goal) { goal.sessionId = r.sessionId; saveGoal(goal); }
+    if (!entryUrl) break;
+    try {
+      if (!verify) {
+        sendAct(task, 'verify: authoring the check…');
+        verify = await authorVerify(task, goal, wproject);
+      }
+      sendAct(task, `verify: running independent check (attempt ${attempt}/${maxAttempts})…`);
+      const proofDir = join(logDir, `proof-${task.id}`);
+      mkdirSync(proofDir, { recursive: true });
+      let eph = null, target = entryUrl;
+      if (isManagerApp(goal, wproject)) {
+        sendAct(task, 'verify: booting a fresh instance of the edited app…');
+        eph = await startEphemeralApp(workDir);
+        if (eph) target = eph.url;
+      }
+      try {
+        verdict = await runVerification({ entryUrl: target, verify, outBase: join(proofDir, `attempt-${attempt}`) });
+      } finally {
+        eph?.kill();
+      }
+      sendAct(task, `verify: ${verdict.pass ? 'PASS' : 'FAIL'} — ${verdict.detail.slice(0, 120)}`);
+      if (verdict.pass) break;
+      lastFailure = verdict.detail;
+    } catch (e) {
+      sendAct(task, `verify: could not run — ${String(e.message ?? e).slice(0, 120)}`);
+      verdict = null;
+      break;
+    }
+  }
+
+  if (goal?.cancelled) return; // deleted during the verify loop → don't resurrect the task
+  task.secs = Math.round((Date.now() - t0) / 1000);
+  // Status decision, most-authoritative first:
+  //  1. an independent verify PASS = verified success — wins even if the worker
+  //     was force-stopped afterwards (the change is proven good).
+  //  2. a forced STOP (10-min timeout / SIGTERM, exit 143) = 'interrupted', NOT
+  //     'failed' — it's a retryable halt, not "the worker's code was wrong". A
+  //     FAIL verdict on a killed (incomplete) worker isn't authoritative either,
+  //     so the stop reason takes precedence. (Mirrors the budget-breach path.)
+  //  3. a verify that actually ran and FAILED = 'failed'.
+  //  4. no verify = the exit code decides.
+  const forcedStop = isForcedStop(code, timedOut);
+  task.status = verdict?.pass ? 'done'
+    : forcedStop ? 'interrupted'
+    : verdict ? 'failed'
+    : (code === 0 ? 'done' : 'failed');
+  // Never leave the reason as a bare "(no output)": if the worker produced no
+  // report text, result already carries workerExitReason(); make doubly sure a
+  // force-stopped task states WHY so the Attention card explains itself.
+  if (forcedStop && (!result || result === '(no output)')) result = workerExitReason(code, timedOut, WORKER_TIMEOUT_MS);
+  task.result = result.slice(0, 4000);
+  task.usage = sumUsage(usages);
+  if (verdict) {
+    task.result = `検証${verdict.pass ? 'PASS' : 'FAIL'}: ${verdict.detail}\n\n${task.result}`.slice(0, 4000);
+    task.proof = {
+      pass: verdict.pass,
+      detail: verdict.detail.slice(0, 500),
+      gif: verdict.gifPath?.split('/').pop() ?? null,
+      png: verdict.shotPath?.split('/').pop() ?? null,
+      mp4: verdict.videoPath?.split('/').pop() ?? null,
+      // STRONG proof: this came from an independent passCondition verification,
+      // not a generic auto-snapshot. Only this flag lets a force-stopped (interrupted)
+      // task count toward goal completion (isProofVerified) — a weak "UI capture"
+      // snapshot never auto-promotes an interrupted goal past human review.
+      verified: true,
+    };
+  }
+  const after = await gitChanges(workDir);
+  task.changedFiles = after.filter((l) => !before.includes(l)).map((l) => l.slice(3));
+  sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this task.`);
+
+  // A UI change with no explicit pass condition used to finish with no
+  // evidence at all ("UI変更のはずなのに写真が撮られてない"). Capture a cheap
+  // zero-LLM snapshot (screenshot + short clip) from an ephemeral instance
+  // of the edited app so the review card always has something to look at.
+  // baselineDir = the user's real project dir (unmodified, pre-goal code) —
+  // when it's genuinely different from wproject.dir (a real worktree, not
+  // the shared-dir fallback), also attempt a before/after pair.
+  if (!verdict && task.status === 'done' && shouldCaptureProof({ changedFiles: task.changedFiles, hasProof: Boolean(task.proof), canCapture: canSnapshot(wproject) })) {
+    try {
+      sendAct(task, 'proof: capturing UI change (screenshot + clip) of the edited app…');
+      await captureSnapshotProof(task, wproject, { baselineDir: project.dir, goal });
+      sendProcessAct(task, `Proof capture finished: ${task.proof?.pass === false ? 'target check failed' : 'screenshot/clip attached'}.`);
+      if (task.proof && task.proof.pass === false) {
+        task.status = 'failed';
+        task.result = `proof FAIL: ${task.proof.detail}\n\n${task.result ?? ''}`.slice(0, 4000);
+      }
+    } catch (e) { sendAct(task, `proof: capture failed — ${String(e.message ?? e).slice(0, 100)}`); }
+  }
+  task.finishedAt = new Date().toISOString();
+  saveTask(task);
+  sendProcessAct(task, `Task saved as ${task.status}.`);
+
+  // goal bookkeeping + optional PR when the whole goal is finished.
+  //
+  // NOT awaited — same reasoning as the reply branch above: this is the line
+  // that was holding this task's running-slot hostage for the duration of
+  // finishGoalIfComplete's tests/PR/summarize/proof pipeline (runProjectTests
+  // alone allows up to 240s), so a task already sitting queued in To Do — for
+  // this goal's next sibling or a different goal entirely — waited behind it
+  // instead of starting the moment THIS task's own work finished (saved just
+  // above). runTask's caller (pump(), defined earlier in this file) frees
+  // this task's slot and starts the next queued task(s) as soon as this
+  // function's promise settles, so letting that happen now (rather than
+  // after goal-closing) is the fix for the "doing → next todo" lag.
+  // finishGoalIfComplete still runs to completion in the goal's own
+  // isolated worktree, and still calls startNextStacked() for any legitimately
+  // stacked goal when it's done.
+  if (goal) {
+    sendProcessAct(task, 'Starting goal close-out: tests, proof gate, review summary, and PR update if needed.');
+    finishGoalIfComplete(goal, wproject, task).catch((e) => sendAct(task, `goal close: ${String(e.message ?? e).slice(0, 120)}`));
+  }
+}
+
+// Manager-run tests (never trust the worker's "all green" claim): run the
+// project's own `npm test` in the goal's worktree and parse node --test's
+// "ℹ pass N / ℹ fail N" (or TAP "# pass/# fail"). Returns {ran,passed,failed,ok}.
+function runTestsOnce(dir) {
+  return new Promise((res) => {
+    execFile('npm', ['test'], { cwd: dir, timeout: 240000, env: { ...process.env }, maxBuffer: 8 * 1024 * 1024 }, (e, out = '', err = '') => {
+      const text = `${out}\n${err}`;
+      const n = (re) => { const m = text.match(re); return m ? Number(m[1]) : null; };
+      const passed = n(/ℹ pass (\d+)/) ?? n(/# pass (\d+)/) ?? n(/(\d+) passing/) ?? 0;
+      const failedTotal = n(/ℹ fail (\d+)/) ?? n(/# fail (\d+)/) ?? n(/(\d+) failing/) ?? (e ? 1 : 0);
+      // Don't block on INFRA flakes: the integration suite spawns real servers,
+      // and under load (prod + several worker goals running) a server can miss
+      // its startup window ("did not report ready in time"). That's not a code
+      // regression. BUT fail CLOSED: only discount those timeouts when NO real
+      // assertion failed. A genuine AssertionError sharing a run with a timeout
+      // must still block — never let arithmetic subtraction mask a real failure.
+      const timeoutFlakes = (text.match(/did not report ready in time/g) || []).length;
+      const realAssertion = /AssertionError|Expected values to be|expected .+ (?:to |but )/i.test(text);
+      const failed = realAssertion ? failedTotal : Math.max(0, failedTotal - timeoutFlakes);
+      res({ passed, failed, detail: testOutputExcerpt(text) });
+    });
+  });
+}
+async function runProjectTests(dir) {
+  let hasTest = false;
+  try { hasTest = !!JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).scripts?.test; } catch { /* no package.json */ }
+  if (!hasTest) return { ran: false };
+  let r = await runTestsOnce(dir);
+  // Flake resistance: the integration suite spawns real servers; under load a
+  // startup can time out. Re-run once and take the fewer failures — a real
+  // failure fails both runs, a flake clears on the retry — so a good goal is
+  // never blocked on a flaky test.
+  if (r.failed > 0) {
+    const r2 = await runTestsOnce(dir);
+    r = {
+      passed: Math.max(r.passed, r2.passed),
+      failed: Math.min(r.failed, r2.failed),
+      detail: (r2.failed <= r.failed ? r2.detail : r.detail) || r.detail || r2.detail || '',
+    };
+  }
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, detail: r.detail ?? '' };
+}
+
+// ---- See all Ledger engine jobs (HANDOFF-v45 §5 / PRD §5.1) ----------------
+// Plain Dismiss → automatic retest ×3: re-run the goal's deterministic
+// verification (the project's own `npm test` in the goal's worktree — reuses
+// the same pipeline as verifyGate's runTestsOnce, NO LLM) three times.
+// 3/3 green → back to 'review' with the note; a reproduced failure → back to
+// To Do as reworking with the evidence attached to the worker respawn.
+// Async by design: progress and the settled outcome stream over SSE via
+// saveGoal, and the intent survives a restart because status 'retesting' is
+// persisted in tasks.jsonl like every other status (re-kicked on boot below).
+const RETEST_RUNS = 3;
+// One live token per goal: a cancelled (or superseded) job compares its own
+// token before EVERY write, so an UNDO mid-run can never be overwritten by a
+// stale job finishing later.
+const retestTokens = new Map();
+async function runRetestJob(goal, token) {
+  const live = () => retestTokens.get(goal.id) === token
+    && goals.some((g) => g.id === goal.id) && goal.status === 'retesting';
+  const project = projects.find((p) => p.id === goal.projectId);
+  if (!project) return;
+  const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
+  let hasTest = false;
+  try { hasTest = !!JSON.parse(readFileSync(join(wdir, 'package.json'), 'utf8')).scripts?.test; } catch { /* no package.json */ }
+  const results = [];
+  if (!hasTest) {
+    results.push({ ran: false });
+  } else {
+    for (let i = 0; i < RETEST_RUNS; i++) {
+      if (!live()) return; // cancelled (UNDO) / superseded / deleted → discard
+      const r = await runTestsOnce(wdir);
+      if (!live()) return; // cancelled while this run was in flight
+      results.push({ ran: true, passed: r.passed, failed: r.failed });
+      goal.retest = { state: 'running', runs: results.length, total: RETEST_RUNS, startedAt: goal.retest?.startedAt };
+      saveGoal(goal); // SSE progress tick
+      if (r.failed > 0) break; // a reproduced failure decides the outcome
+    }
+  }
+  if (!live()) return;
+  const outcome = computeRetestOutcome(results, RETEST_RUNS);
+  goal.retest = {
+    state: 'done', verdict: outcome.verdict, passed: outcome.verdict === 'pass',
+    note: outcome.note, runs: results.length, total: RETEST_RUNS, at: new Date().toISOString(),
+  };
+  goal.status = outcome.status;
+  saveGoal(goal);
+  if (outcome.status === 'running') {
+    queueReplyTask(goal, `差し戻し（自動再テストで問題が再現）: ${outcome.evidence}。修正してください。`);
+  }
+}
+
+// Revert (ゴミ箱): the small wrapper around the destructive gh/git calls, so
+// the decision logic (revertGoal/planRevertActions in lib.mjs) stays pure and
+// testable without network. Worktree discipline as engine/pr.mjs: only the
+// goal's own .manager-wt worktree is removed — the user's working tree is
+// never touched (closing a PR / deleting a REMOTE branch is API-side only).
+function execRevertAction(action, goal, project) {
+  return new Promise((resolvePromise, reject) => {
+    if (action.kind === 'close-pr') {
+      const args = ['pr', 'close', action.url, ...(action.deleteBranch ? ['--delete-branch'] : [])];
+      execFile('gh', args, { cwd: project.dir }, (e, out, err) => {
+        if (e) return reject(new Error(`gh pr close: ${(err || e.message || '').trim().slice(0, 300)}`));
+        resolvePromise();
+      });
+      return;
+    }
+    if (action.kind === 'delete-remote-branch') {
+      execFile('git', ['-C', project.dir, 'push', 'origin', '--delete', action.branch], (e, out, err) => {
+        // a branch that was never pushed is already "never happened" — not an error
+        if (e && !/remote ref does not exist/i.test(String(err))) {
+          return reject(new Error(`git push --delete: ${(err || e.message || '').trim().slice(0, 300)}`));
+        }
+        resolvePromise();
+      });
+      return;
+    }
+    if (action.kind === 'remove-worktree') { removeGoalWorkDir(goal, project); return resolvePromise(); }
+    resolvePromise();
+  });
+}
+
+// Ledger Details data: diff stats (+a −d), changed files and the diff text
+// for a goal's branch vs the repo default branch — plain git, no LLM,
+// cached per branch tip so repeated opens are free until the goal updates.
+const goalDiffCache = new Map();
+function gitOut(dir, args) {
+  const r = spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  return r.status === 0 ? r.stdout : null;
+}
+function computeGoalDiff(goal, project) {
+  let repoRoot;
+  try { repoRoot = gitSync(project.dir, ['rev-parse', '--show-toplevel']); }
+  catch { return null; } // not a git repo — no diff to show
+  const branch = goal.prBranch ?? `manager-ai/goal-${goal.id}`;
+  const head = gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', branch])?.trim()
+    || gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', `origin/${branch}`])?.trim();
+  if (!head) return null; // goal never grew a branch (e.g. no-code goal)
+  const cached = goalDiffCache.get(goal.id);
+  if (cached && cached.head === head) return cached.payload;
+  const base = repoDefaultBranch(project.dir);
+  const baseRef = gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', `origin/${base}`]) ? `origin/${base}` : base;
+  const stats = parseNumstat(gitOut(repoRoot, ['diff', '--numstat', `${baseRef}...${head}`]) ?? '');
+  const { text, truncated } = truncateDiffText(gitOut(repoRoot, ['diff', `${baseRef}...${head}`]) ?? '', 400);
+  const payload = { branch, base: baseRef, head, add: stats.add, del: stats.del, files: stats.files, diff: text, truncated };
+  goalDiffCache.set(goal.id, { head, payload });
+  return payload;
+}
+// One cheap LLM pass turns the verbose worker output + diff into a two-line,
+// plain-language review headline in the user's language: what to CHECK and what
+// CHANGED. Never trusts the worker to self-format.
+async function summarizeForReview(goal, siblings, dir, reviewDefinition) {
+  const lang = reviewDefinition.language || 'ja';
+  const changed = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].slice(0, 20);
+  const reports = siblings.filter((t) => !t.reply).map((t) => `- ${t.title}: ${(t.result ?? '').replace(/\s+/g, ' ').slice(0, 300)}`).join('\n');
+  const fallback = { check: '', changed: (goal.plan?.[0] ?? goal.text ?? '').replace(/\s+/g, ' ').slice(0, 80) };
+  if (!changed.length && !reports) return fallback;
+  const prompt = [
+    `あるゴールの実装が完了しました。レビューする人が一目で判断できるよう、やさしい${lang === 'ja' ? '日本語' : lang}で2行だけ書いてください。`,
+    '専門用語・長い説明は禁止。小学生でも分かる短い言い方。JSONのみ出力（前後に文章を書かない）:',
+    '{"check":"何を確認すれば良いか(1行)","changed":"何を変えたか(1行)"}',
+    '',
+    `ゴール: ${(goal.text ?? '').slice(0, 300)}`,
+    `変更ファイル: ${changed.join(', ') || '(なし)'}`,
+    `ワーカー報告:\n${reports.slice(0, 1500)}`,
+  ].join('\n');
+  try {
+    const r = await runClaude({ prompt, cwd: dir, tools: 'Read', model: 'haiku' });
+    const m = r.result.match(/\{[\s\S]*\}/);
+    if (m) { const o = JSON.parse(m[0]); return { check: String(o.check ?? '').replace(/\s+/g, ' ').slice(0, 120), changed: String(o.changed ?? '').replace(/\s+/g, ' ').slice(0, 120) || fallback.changed }; }
+  } catch { /* fall through */ }
+  return fallback;
+}
+
+// ---- merge-time conflict detection -----------------------------------------
+// Deterministic, no LLM (mission: "conflict 判断はしてほしい"). Each goal runs
+// in its own worktree, so parallel goals never corrupt each other's WORKING
+// files — but if two goals edited the same repo path, their branches will
+// still conflict when they land. Rather than guess ahead of time (a goal's
+// real changed files aren't known until its worker has actually run),
+// detection is best-effort and runs at goal-finish time: compare the
+// just-finished goal's files against every sibling in the same project that
+// is still running or sitting in Review with an unmerged PR — whatever THAT
+// sibling has changed so far (its own conflicts get finalized in turn when
+// it finishes). Flags both sides so a human reviewing either one sees
+// "touches the same files as #N — review/merge in order". We deliberately do
+// NOT auto-serialize the conflicting pair here (see mission notes): the
+// worker for the second goal has typically already run by the time this is
+// known, and holding a finished PR back adds a new class of "why is my done
+// work stuck" bug for a UI that doesn't exist yet to explain it — so this is
+// flag-only, left for the (future) UI/human to act on.
+const SCRATCH_FILE_RE = /(^|\/)\.tmp|\.log$|(^|\/)\.manager-wt(\/|$)|(^|\/)node_modules(\/|$)|(^|\/)secret\.key$/;
+function goalChangedFileUnion(goalId) {
+  return [...new Set(tasks.filter((t) => t.goalId === goalId).flatMap((t) => t.changedFiles ?? []))]
+    .filter((f) => f && !SCRATCH_FILE_RE.test(f));
+}
+const CONFLICT_CANDIDATE_STATUSES = ['running', 'review', 'blocked', 'partial', 'retesting'];
+function updateGoalConflicts(goal) {
+  const files = goalChangedFileUnion(goal.id);
+  const candidates = goals
+    .filter((g) => g.id !== goal.id && g.projectId === goal.projectId && CONFLICT_CANDIDATE_STATUSES.includes(g.status))
+    .map((g) => ({ id: g.id, changedFiles: goalChangedFileUnion(g.id) }));
+  const conflicts = detectConflicts({ id: goal.id, changedFiles: files }, candidates);
+  goal.conflictsWith = conflicts;
+  // Reciprocal: a sibling flagged from this side may not know about it yet
+  // (e.g. it finished earlier, before this goal's files existed) — stamp it
+  // too so its own Review card also surfaces the overlap.
+  for (const otherId of conflicts) {
+    const other = goals.find((g) => g.id === otherId);
+    if (other && !(other.conflictsWith ?? []).includes(goal.id)) {
+      other.conflictsWith = [...(other.conflictsWith ?? []), goal.id];
+      saveGoal(other);
+    }
+  }
+  return conflicts;
+}
+
+// Shared by task completion, thread replies and the skip endpoint, so every
+// path that closes a task also closes its goal and wakes the queue.
+async function finishGoalIfComplete(goal, project, activityTask = null) {
+  const goalAct = (line) => { if (activityTask) sendProcessAct(activityTask, line); };
+  if (!goal || !project) return;
+  const siblings = tasks.filter((t) => t.goalId === goal.id);
+  if (!siblings.length || !siblings.every((t) => ['done', 'failed', 'interrupted', 'skipped'].includes(t.status))) return;
+  if (!['running', 'partial'].includes(goal.status)) { startNextStacked(goal.projectId); return; }
+  goalAct(`Close-out started for goal-${goal.id}: ${siblings.length} task${siblings.length === 1 ? '' : 's'} ready for final checks.`);
+  // Plan mode: the worker produced a PLAN and made no edits. Land it in Review
+  // as a plan-review (no PR, no proof gate — nothing changed) with the plan
+  // body captured, so the reviewer sees "PLAN — approve to execute". Approving
+  // it (server approve handler) re-queues the goal to actually execute.
+  if (goal.mode === 'plan' && goal.planPhase !== 'executing') {
+    goal.planText = siblings
+      .filter((t) => t.status === 'done' && t.result)
+      .map((t) => t.result).join('\n\n').slice(0, 8000) || '(no plan text produced)';
+    goal.planPhase = 'awaiting-approval';
+    goal.summary = buildGoalSummary({ goalText: goal.text, tasks: siblings });
+    goal.blocked = null;
+    goal.status = 'review';
+    saveGoal(goal);
+    startNextStacked(goal.projectId);
+    return;
+  }
+  const judged = siblings.filter((t) => t.status !== 'skipped');
+  const allDone = siblings.every(taskCountsAsComplete);
+  const allVerified = judged.length > 0 && judged.every((t) => t.proof?.pass === true);
+  const reviewDefinition = getReviewDefinition(goal.projectId);
+  // Always PR from the goal's own worktree (has only this goal's changes on top
+  // of current main). Resolve it here too, so callers that pass the real project
+  // (e.g. the skip endpoint) still PR from the isolated worktree, not the shared dir.
+  const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
+  const prProject = { ...project, dir: wdir };
+  // Masa's model: any goal that TOUCHED CODE opens a PR (reviewed via the PR);
+  // a no-code goal is a report/confirmation. So always attempt a PR — createGoalPR
+  // no-ops when there are no changed files — instead of gating on goal.wantsPR
+  // (which defaulted to false, so almost nothing ever became a PR). Always call
+  // it (not just `if (!goal.pr)`): when a goal already has a PR — e.g. a review
+  // comment sent it back for rework and the reply task just finished — this is
+  // the only place that pushes the rework diff, and createGoalPR itself decides
+  // "new PR" vs "push onto the existing PR's branch" from goal.pr/goal.prBranch.
+  // Conflict check runs BEFORE the PR call and doesn't depend on it (no gh/
+  // network needed) — this goal's changed files are already final at this
+  // point (all its tasks are done), so its conflictsWith is accurate even if
+  // PR creation itself fails (e.g. no `gh` auth) or is still no-op'd (no code).
+  updateGoalConflicts(goal);
+  goalAct('Checking changed files and preparing the PR branch if code changed.');
+  await createGoalPR(goal, prProject, siblings, reviewDefinition, activityTask);
+  // goal 427 §4: classify the change's risk from the SAME changed-files/diff
+  // that just went into (or would have gone into) the PR, and attach it to
+  // the goal so the review card can surface it. Never an LLM call — pure
+  // string/regex matching (classifyChangeRisk in lib.mjs).
+  goal.risk = computeGoalRisk(goal, prProject, siblings);
+  goal.summary = buildGoalSummary({ goalText: goal.text, tasks: siblings });
+  await verifyGate(goal, prProject, siblings, project, activityTask);
+  // A high-risk change (secrets/auth/payment/db-migration/destructive) must
+  // never slip past a human — verifyGate's nextGoalStatus never returns
+  // 'done' directly today (only an explicit Approve or an actual PR merge
+  // does), so this is a safety net against that ever changing, not a fix for
+  // an observed bypass: force 'review' (never silently stay 'partial' or
+  // otherwise skip the human gate) unless the goal is already the even more
+  // conservative 'blocked' (tests failing / proof missing — still human-gated).
+  if (goal.risk?.shouldPause && !['blocked', 'running'].includes(goal.status)) goal.status = 'review';
+  if (['review', 'done', 'blocked', 'archived'].includes(goal.status)) {
+    refreshGoalHandoff(goal);
+    if (goal.sessionId) {
+      goal.sessionId = null;
+      goal.sessionClosedAt = new Date().toISOString();
+      goal.executionPlan = {
+        ...(goal.executionPlan ?? {}),
+        optimizationTechniques: [...new Set([...(goal.executionPlan?.optimizationTechniques ?? []), 'session close', 'AI handoff'])],
+      };
+    }
+  }
+  saveGoal(goal);
+  goalAct(`Close-out finished: goal is now ${goal.status}.`);
+  startNextStacked(goal.projectId);
+}
+
+// goal 427 §4: pure classification (classifyChangeRisk) fed with THIS goal's
+// real changed files + real diff. Best-effort on the diff (computeGoalDiff
+// returns null for a no-code goal, or if the branch/git lookup fails for any
+// reason) — a missing diff still classifies correctly off filenames alone,
+// it just can't catch a diffPattern-only rule (e.g. an added `rm -rf` on an
+// otherwise unremarkable file).
+function computeGoalRisk(goal, project, siblings) {
+  const files = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].filter((f) => f && !SCRATCH_FILE_RE.test(f));
+  let diffText = '';
+  try { diffText = computeGoalDiff(goal, project)?.diff ?? ''; } catch { /* best effort — filename-only classification still runs */ }
+  const r = classifyChangeRisk(files, diffText);
+  return { level: r.level, shouldPause: r.shouldPause, categories: r.categories, sensitiveFiles: r.sensitiveFiles };
+}
+
+// The Manager-verified review gate (shared by goal completion and /reverify):
+// run OUR OWN tests, generate a plain-language headline, and require proof for a
+// UI change — capturing it (3 tries) if missing. Any failure → 'blocked' (shown
+// in Attention with the reason); otherwise → review/done via nextGoalStatus.
+// Nothing reaches Review that a human can't judge.
+async function verifyGate(goal, prProject, siblings, baseProject, activityTask = null) {
+  const goalAct = (line) => { if (activityTask) sendProcessAct(activityTask, line); };
+  const wdir = prProject.dir;
+  const reviewDefinition = getReviewDefinition(goal.projectId);
+  const judged = siblings.filter((t) => t.status !== 'skipped');
+  const allDone = siblings.every(taskCountsAsComplete);
+  const allVerified = judged.length > 0 && judged.every((t) => t.proof?.pass === true);
+  const changedFiles = [...new Set(siblings.flatMap((t) => t.changedFiles ?? []))].filter((f) => f && !SCRATCH_FILE_RE.test(f));
+  if (hasTestRelevantChanges(changedFiles)) {
+    goalAct(`Running project tests in the goal worktree (${changedFiles.length} changed file${changedFiles.length === 1 ? '' : 's'}).`);
+    goal.testResult = await runProjectTests(wdir);
+    goalAct(`Project tests finished: ${goal.testResult.failed ?? 0} failed, ${goal.testResult.passed ?? 0} passed.`);
+  } else {
+    goal.testResult = { ran: false, skipped: true, skippedReason: changedFiles.length ? 'documentation-only change' : 'no changed files' };
+    goalAct(`Skipped project tests: ${goal.testResult.skippedReason}.`);
+  }
+  goalAct('Writing the review summary from the worker report and diff.');
+  goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
+  const uiTasks = siblings.filter((t) => isUiChange(t.changedFiles));
+  // Only require/capture proof for projects we can actually boot & screenshot
+  // (Manager-shaped). A generic web repo that edits a stylesheet can't be
+  // captured — it must still reach Review as a report, not be trapped in
+  // 'blocked' forever (PRD §4A/§6#1: block only what a human can't judge, not
+  // what the tool can't photograph).
+  const canCapture = canSnapshot(prProject);
+  if (shouldCaptureProof({ changedFiles: uiTasks.flatMap((t) => t.changedFiles ?? []), hasProof: uiTasks.some((t) => t.proof), canCapture })) {
+    const t = uiTasks[uiTasks.length - 1];
+    goalAct('UI changed and no proof is attached yet, so Manager is capturing proof now.');
+    for (let i = 0; i < 3 && !t.proof; i++) {
+      try {
+        goalAct(`Proof capture attempt ${i + 1}/3.`);
+        await captureSnapshotProof(t, prProject, { baselineDir: baseProject?.dir, goal });
+      } catch (e) {
+        goalAct(`Proof capture attempt ${i + 1}/3 failed: ${String(e.message ?? e).slice(0, 140)}`);
+      }
+    }
+    saveTask(t);
+  }
+  const proofMissing = canCapture && uiTasks.length > 0 && !uiTasks.some((t) => t.proof);
+  const proofFailing = canCapture && uiTasks.some((t) => t.proof && t.proof.pass === false);
+  const testsFailing = goal.testResult.ran && goal.testResult.failed > 0;
+  // §4補足: requireVerifyPass (opt-in, off by default) makes the gate strict —
+  // EVERY task must carry a passing proof, not just UI tasks. Only ever tightens;
+  // never conflicts with §6 (still can't reach Done without a human).
+  const verifyFail = reviewDefinition.requireVerifyPass && !allVerified;
+  if (testsFailing) {
+    const failure = recordGoalFailure(goal, {
+      kind: 'test',
+      reason: `テスト失敗 ${goal.testResult.failed} 件`,
+      changedFiles,
+      testResult: goal.testResult,
+    });
+    const used = Number(goal.autoRework?.testFailures ?? 0);
+    if (used < MAX_AUTO_TEST_REWORKS) {
+      goal.autoRework = {
+        ...(goal.autoRework ?? {}),
+        testFailures: used + 1,
+        lastReason: `テスト失敗 ${goal.testResult.failed} 件`,
+        lastAt: new Date().toISOString(),
+      };
+      goal.blocked = null;
+      goal.status = 'running';
+      saveGoal(goal);
+      goalAct(`Tests failed; queued automatic worker feedback (${used + 1}/${MAX_AUTO_TEST_REWORKS}) with the failing output.`);
+      queueReplyTask(goal, [
+        `Manager auto-feedback: npm test failed (${goal.testResult.failed} failing).`,
+        failure?.whatHappened ? `What happened: ${failure.whatHappened}` : '',
+        failure?.yourCall ?? 'Please inspect the failure output below, fix the regression, and rerun the project tests until they pass.',
+        failure?.nextPolicy ? `Prevention policy: ${failure.nextPolicy}` : '',
+        'Keep the existing goal/PR branch; do not start a new project or unrelated refactor.',
+        '',
+        'Failing test output:',
+        goal.testResult.detail || '(no detailed output captured)',
+      ].filter(Boolean).join('\n').slice(0, 4000));
+      return;
+    }
+  }
+  if (testsFailing || proofMissing || proofFailing || verifyFail) {
+    if (!testsFailing) {
+      recordGoalFailure(goal, {
+        kind: (proofMissing || proofFailing) ? 'proof' : 'verify',
+        reason: proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
+          : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+          : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
+        changedFiles,
+        testResult: goal.testResult,
+      });
+    }
+    goal.blocked = {
+      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : 'verify',
+      reason: testsFailing ? `テスト失敗 ${goal.testResult.failed} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
+        : proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
+        : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+        : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
+    };
+    goal.status = 'blocked';
+    goalAct(`Goal blocked: ${goal.blocked.reason}`);
+  } else {
+    goal.blocked = null;
+    if (goal.autoRework?.testFailures) goal.autoRework = { ...goal.autoRework, resolvedAt: new Date().toISOString() };
+    goal.status = nextGoalStatus({ allDone, wantsPR: goal.wantsPR, allVerified, reviewDefinition });
+    goalAct(`Verification gate passed; moving goal to ${goal.status}.`);
+  }
+}
+
+async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT_REVIEW_DEFINITION, activityTask = null) {
+  const goalAct = (line) => { if (activityTask) sendProcessAct(activityTask, line); };
+  // Keep the PR to real source: drop worker scratch/debug leftovers (.tmp_* files
+  // and dirs, *.log, ephemeral diag homes, worktree/deps) that otherwise pollute
+  // the diff. Proof artifacts (.manager-proof) are intentional and kept.
+  const SCRATCH = /(^|\/)\.tmp|\.log$|(^|\/)\.manager-wt(\/|$)|(^|\/)node_modules(\/|$)|(^|\/)secret\.key$/;
+  const files = [...new Set(goalTasks.flatMap((t) => t.changedFiles))].filter((f) => f && !SCRATCH.test(f));
+  // No code changed → nothing to open a PR for. This is a confirmation /
+  // investigation goal, not a failure: it still lands in Review (nextGoalStatus),
+  // where the worker's report IS the "please confirm" summary. So clear any PR
+  // error and return — don't scare the reviewer with a red prError. (A rework
+  // round can't actually hit this — its files are a superset of the ones that
+  // already got it a PR — but the guard is harmless either way.)
+  if (!files.length) { goal.pr = null; goal.prError = null; saveGoal(goal); goalAct('No code changes detected, so PR creation is skipped.'); return; }
+  // Rework: the goal already has an open PR from an earlier finish. Push onto
+  // that same branch instead of opening a second PR for the goal (see openPR's
+  // existingBranch/existingPrUrl mode in pr.mjs).
+  const isRework = Boolean(goal.pr && goal.prBranch);
+  try {
+    goalAct(`${isRework ? 'Updating the existing PR' : 'Opening a PR'} with ${files.length} changed file${files.length === 1 ? '' : 's'}.`);
+    // proof artifacts for verified tasks: committed to the branch, GIF auto-plays
+    const proofRel = `.manager-proof/goal-${goal.id}`;
+    const proofItems = [];
+    const extraCopies = [];
+    for (const t of goalTasks) {
+      if (!t.proof?.pass) continue;
+      const dir = join(logDir, `proof-${t.id}`);
+      const item = { num: t.num, title: t.title, passCondition: t.passCondition, detail: t.proof.detail, gifName: null, shotName: null, videoName: null, beforeShotName: null };
+      if (t.proof.gif) { item.gifName = `t${t.num}.gif`; extraCopies.push({ src: join(dir, t.proof.gif), destRel: `${proofRel}/t${t.num}.gif` }); }
+      if (t.proof.png) { item.shotName = `t${t.num}.png`; extraCopies.push({ src: join(dir, t.proof.png), destRel: `${proofRel}/t${t.num}.png` }); }
+      if (t.proof.mp4) { item.videoName = `t${t.num}.mp4`; extraCopies.push({ src: join(dir, t.proof.mp4), destRel: `${proofRel}/t${t.num}.mp4` }); }
+      if (t.proof.beforePng) { item.beforeShotName = `t${t.num}-before.png`; extraCopies.push({ src: join(dir, t.proof.beforePng), destRel: `${proofRel}/t${t.num}-before.png` }); }
+      proofItems.push(item);
+    }
+    const ownerRes = spawnSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'], { cwd: project.dir, encoding: 'utf8' });
+    const owner = ownerRes.status === 0 ? ownerRes.stdout.trim() : null;
+    // PR body in the USER's language (reviewDefinition.language, default ja) —
+    // not forced English/bilingual (Masa: 「ユーザーの言語で」).
+    const lang = reviewDefinition.language || 'ja';
+    const L = (en, ja) => (lang === 'en' ? en : ja);
+    const bodyFor = (branch) => [
+      ...(proofItems.length && owner ? [
+        L('## Proof — one tap, plays in place', '## 動作確認 — 1タップでその場で再生'),
+        '',
+        `https://github.com/${owner}/blob/${branch}/${proofRel}/PROOF.md`,
+        '',
+      ] : []),
+      L('## Goal', '## ゴール'),
+      '',
+      goal.text.slice(0, 1500),
+      '',
+      ...buildReviewRuleSection(reviewDefinition.description),
+      L(`Implemented by Manager for AI: the goal was decomposed into ${goalTasks.length} task(s), each executed by a Claude Code worker (flat-rate, no extra API), tests written and run per task.${proofItems.length ? ' Tasks with a pass condition were verified independently in a headless browser.' : ''}`,
+        `Manager for AI が実装: ゴールを${goalTasks.length}個のタスクに分解し、Claude Code worker が順に実行（既存サブスク・追加API無し・タスク毎にテストを作成し実行）。${proofItems.length ? '成功条件つきタスクは headless ブラウザで独立検証済み。' : ''}`),
+      '',
+      L('## Tasks and worker reports', '## タスクとworker報告'),
+      ...goalTasks.map((t) => `\n### ${t.num} ${t.title} — ${t.status} (${t.secs}s)\n${(t.result ?? '').slice(0, 800)}`),
+      '',
+      L(`Changed files: ${files.map((f) => `\`${f}\``).join(' ')}`, `変更ファイル: ${files.map((f) => `\`${f}\``).join(' ')}`),
+    ].join('\n');
+    const title = `Manager for AI: ${isRework ? L('rework — ', '再作業 — ') : ''}${goal.plan?.[0] ?? goal.text.slice(0, 60)}${goal.plan?.length > 1 ? L(` +${goal.plan.length - 1} more`, ` 他${goal.plan.length - 1}件`) : ''}`;
+    const { url, branch } = openPR({
+      repoDir: project.dir, slug: `goal-${goal.id}`,
+      title,
+      body: 'placeholder',
+      buildBody: bodyFor,
+      files,
+      extraCopies,
+      extraWrites: proofItems.length ? [{
+        destRel: `${proofRel}/PROOF.md`,
+        content: buildGoalProofMd({ goalText: goal.text, items: proofItems }),
+      }] : [],
+      ...(isRework ? { existingBranch: goal.prBranch, existingPrUrl: goal.pr } : {}),
+    });
+    goal.pr = url;
+    goal.prBranch = branch;
+    goal.prError = null;
+    goalAct(`PR ready: ${url}`);
+  } catch (e) {
+    // A rework push failing shouldn't blow away an already-working PR url —
+    // only clear it on a from-scratch creation failure.
+    if (!isRework) goal.pr = null;
+    goal.prError = String(e.message ?? e).slice(0, 300);
+    goalAct(`PR step failed: ${goal.prError}`);
+  }
+  saveGoal(goal);
+}
+
+// ---- http ----------------------------------------------------------------
+function json(res, code, body) {
+  res.writeHead(code, { 'content-type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+const server = createServer(async (req, res) => {
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+
+  // auth, in order: (1) a verified Cloudflare Access (Google) identity —
+  // authed as that email, no ?key= needed; (2) the existing ?key=/cookie gate
+  // (dev, localhost, backward compat); (3) else 403. req.authEmail is exposed
+  // to handlers below for future per-user work (no per-user isolation yet).
+  // /oauth/callback is the loopback landing for "Sign in with Google" — the
+  // billing Worker 302s the browser here with a signed license token and no
+  // ?key= (it can't know the local key), so it must bypass the key gate. It's
+  // safe: it only accepts a Worker-signed token (verified before use) plus a
+  // one-time nonce the engine itself issued, and it grants no app access — it
+  // only records entitlement identity.
+  const authExempt = url.pathname === '/oauth/callback';
+  req.authEmail = authExempt ? null : await authFromCfAccess(req);
+  if (!req.authEmail && !authExempt) {
+    const cookieKey = /(?:^|;\s*)mkey=([^;]+)/.exec(req.headers.cookie ?? '')?.[1];
+    // `|| cookieKey` (not `??`): an EMPTY ?key= (e.g. a proof <img> URL built
+    // with an empty AKEY) is a non-nullish '' that would otherwise shadow a
+    // valid mkey cookie and 403 the request. Treat empty-string as "no key".
+    const givenKey = url.searchParams.get('key') || cookieKey;
+    if (givenKey !== ACCESS_KEY) {
+      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
+      return res.end('403 — open this app with ?key=<access key> (see engine/secret.key on the host)');
+    }
+    if (url.searchParams.get('key')) {
+      res.setHeader('set-cookie', `mkey=${ACCESS_KEY}; HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000`);
+    }
+  }
+
+  if (url.pathname === '/' || url.pathname === '/index.html') {
+    // no-cache: browsers were keeping a STALE index.html (no cache header before),
+    // so deployed fixes/UI didn't appear until a hard-refresh — the root cause of
+    // recurring "still old / still slow / まだ日本語" reports. Always revalidate.
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store, no-cache, must-revalidate', pragma: 'no-cache', expires: '0' });
+    // Inject the access key into the page so the client can always self-authenticate
+    // /api/* calls, even on a Cloudflare-Access-gated URL with no ?key= (CF Access
+    // gates the whole hostname; when the browser's fetch()/EventSource lacks a valid
+    // CF session, CF 302s cross-origin to its login page, which fetch() can't follow
+    // — the API call just fails). This response only reaches clients that already
+    // passed the auth check above (CF Access identity, or key/cookie), so this isn't
+    // a new exposure — it's the same key that was already usable via ?key= in the URL.
+    const html = readFileSync(join(ROOT, 'app', 'index.html'), 'utf8')
+      .replace('<head>', `<head>\n<script>window.__MGR_KEY=${JSON.stringify(ACCESS_KEY)};</script>`);
+    return res.end(html);
+  }
+  // Design tokens + theme (owned by the design/CDO role). Served as a real file
+  // so the two roles never edit the same file: theme.css (look) vs index.html (impl).
+  if (url.pathname === '/theme.css') {
+    res.writeHead(200, { 'content-type': 'text/css; charset=utf-8', 'cache-control': 'no-cache' });
+    return res.end(readFileSync(join(ROOT, 'app', 'theme.css')));
+  }
+  // brand-font exploration faces (@font-face data URIs, latin subsets) — big & static, cache hard.
+  if (url.pathname === '/fonts.css') {
+    res.writeHead(200, { 'content-type': 'text/css; charset=utf-8', 'cache-control': 'public, max-age=86400' });
+    return res.end(readFileSync(join(ROOT, 'app', 'fonts.css')));
+  }
+  // design wallpapers for the image-backed themes (theme 6 composer band; later 3/4).
+  // Whitelisted filename → served from app/wp/. Static design assets, cacheable.
+  const wpMatch = url.pathname.match(/^\/wp\/([\w-]+\.jpg)$/);
+  if (wpMatch) {
+    const file = join(ROOT, 'app', 'wp', wpMatch[1]);
+    if (!existsSync(file)) { res.writeHead(404); return res.end('not found'); }
+    res.writeHead(200, { 'content-type': 'image/jpeg', 'cache-control': 'public, max-age=86400' });
+    return res.end(readFileSync(file));
+  }
+
+  if (url.pathname === '/api/state') {
+    await syncAllExternal();
+    await syncGoalMerges();
+    const mcpPath = join(ROOT, 'engine', 'mcp.mjs');
+    const connectCommand = `claude mcp remove -s user manager-for-ai 2>/dev/null; claude mcp add -s user manager-for-ai -e MANAGER_BASE=http://localhost:${PORT} -e MANAGER_KEY=${ACCESS_KEY} -- node ${mcpPath}`;
+    // Stage 2 (multi-user): the owner sees every goal (including legacy
+    // goals with no `owner` field); a normal Google user sees only goals
+    // stamped with their own identity. Tasks/queueOrder follow their goal's
+    // visibility so a filtered-out goal never leaks through its tasks.
+    // Projects/columns/review-definitions stay shared for everyone.
+    const identity = identityFor(req);
+    const visibleGoals = goals.filter((g) => goalVisibleTo(g, identity, MANAGER_OWNER_EMAIL));
+    const visibleGoalIds = new Set(visibleGoals.map((g) => g.id));
+    const visibleTasks = tasks.filter((t) => t.goalId == null || visibleGoalIds.has(t.goalId));
+    const visibleTaskIds = new Set(visibleTasks.map((t) => t.id));
+    const queueOrder = Object.fromEntries(projects.map((p) => [p.id, queues.get(p.id).waiting.map((t) => t.id).filter((id) => visibleTaskIds.has(id))]));
+    const externalActivity = projects.flatMap((p) =>
+      (externalSync[p.id]?.commits ?? []).map((c) => ({ projectId: p.id, ...c })));
+    const projectColumns = Object.fromEntries(projects.map((p) => [p.id, getColumns(p.id)]));
+    const projectReviewDefs = Object.fromEntries(projects.map((p) => [p.id, getReviewDefinition(p.id)]));
+    // Per-project running count (out of PROJECT_MAX_PARALLEL) + the caps
+    // themselves, so a later UI can show "N running in parallel" without
+    // recomputing it client-side.
+    const runningCounts = Object.fromEntries(projects.map((p) => [p.id, queues.get(p.id).running.size]));
+    const parallelLimits = { project: PROJECT_MAX_PARALLEL, global: GLOBAL_MAX_PARALLEL };
+    // Billing snapshot for the UI: identity (signed-in email), plan (from the
+    // token's isPaying), current free-tier usage vs limits, and the Stripe
+    // price. usage counts this identity's goals — the same numbers the gate
+    // enforces — so the settings PLAN card can't drift from the actual wall.
+    const freeUsage = computeFreeTierUsage(identity);
+    const billing = {
+      licensed: Boolean(licenseState.email),
+      email: licenseState.email,
+      isPaying: Boolean(licenseState.isPaying),
+      plan: licenseState.isPaying ? 'paid' : 'free',
+      usage: { pending: freeUsage.pendingCount, cumulative: freeUsage.cumulativeCount },
+      limits: { pending: FREE_TIER_LIMITS.maxPendingGoals, cumulative: FREE_TIER_LIMITS.maxCumulativeGoals },
+      price: await getBillingPrice(),
+      siteUrl: BILLING_API_URL || null,
+    };
+    return json(res, 200, { projects, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: WORKER_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing });
+  }
+
+  // Billing (docs/BILLING-LAUNCH-PLAN.md): activate the license key a user
+  // copies from galda.app after paying. GET reports whether one is on file
+  // (for the settings panel); POST verifies+persists a newly pasted token.
+  if (url.pathname === '/api/license' && req.method === 'GET') {
+    return json(res, 200, { licensed: Boolean(licenseState.email), email: licenseState.email });
+  }
+  if (url.pathname === '/api/license' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', async () => {
+      let input;
+      try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      const result = await activateLicense(input?.token);
+      if (!result.ok) return json(res, 400, { error: result.error });
+      return json(res, 200, { licensed: true, email: result.email });
+    });
+    return;
+  }
+
+  // GET /api/signin-url — mints a one-time nonce and returns the billing
+  // Worker's /connect URL for "Sign in with Google". The app opens this in the
+  // browser; Google bounces back to /oauth/callback (below) with a token.
+  if (url.pathname === '/api/signin-url' && req.method === 'GET') {
+    if (!BILLING_API_URL) return json(res, 501, { error: 'sign-in not configured (MANAGER_BILLING_API_URL unset)' });
+    const nonce = newSigninNonce();
+    const signinUrl = `${BILLING_API_URL}/connect?port=${PORT}&state=${encodeURIComponent(nonce)}`;
+    return json(res, 200, { url: signinUrl });
+  }
+
+  // GET /oauth/callback?token&email&state | ?error&state — loopback landing for
+  // the Google sign-in (auth-exempt above). Validates the nonce, activates the
+  // signed token, then renders a page that hands the result back to the app
+  // window (postMessage) and closes itself.
+  if (url.pathname === '/oauth/callback' && req.method === 'GET') {
+    const state = url.searchParams.get('state') ?? '';
+    const oauthError = url.searchParams.get('error');
+    const token = url.searchParams.get('token');
+    const nonceOk = consumeSigninNonce(state);
+    let outcome;
+    if (!nonceOk) outcome = { ok: false, error: 'sign-in expired or was not started from this app' };
+    else if (oauthError) outcome = { ok: false, error: oauthError };
+    else {
+      const result = await activateLicense(token);
+      outcome = result.ok ? { ok: true, email: result.email } : { ok: false, error: result.error };
+    }
+    res.writeHead(outcome.ok ? 200 : 400, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+    return res.end(signinResultPage(outcome));
+  }
+
+  // POST /api/checkout — start a Stripe Checkout (Upgrade). Proxied to
+  // billing-api so the browser stays same-origin; the paying email is the
+  // signed-in one when known (else Stripe collects it). Returns { url }.
+  if (url.pathname === '/api/checkout' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', async () => {
+      let input; try { input = JSON.parse(body || '{}'); } catch { return json(res, 400, { error: 'bad json' }); }
+      const r = await billingPost('/checkout', { email: licenseState.email || undefined, successUrl: input?.successUrl, cancelUrl: input?.cancelUrl });
+      if (r.ok && r.url) return json(res, 200, { url: r.url });
+      return json(res, r.status || 502, { error: r.error || 'could not start checkout' });
+    });
+    return;
+  }
+
+  // POST /api/portal — open the Stripe Billing Portal for the signed-in paying
+  // user (manage/cancel). Requires a verified license email. Returns { url }.
+  if (url.pathname === '/api/portal' && req.method === 'POST') {
+    if (!licenseState.email) return json(res, 400, { error: 'sign in first' });
+    const r = await billingPost('/portal', { email: licenseState.email });
+    if (r.ok && r.url) return json(res, 200, { url: r.url });
+    return json(res, r.status || 502, { error: r.error || 'could not open billing portal' });
+  }
+
+  // POST /api/refresh-billing — re-check isPaying live (used right after a
+  // checkout return: the webhook that flips the KV record can lag a beat).
+  // Updates the display cache so /api/state shows Paid without a re-sign-in;
+  // the license token on disk is unchanged (isPaying there is just the boot seed).
+  if (url.pathname === '/api/refresh-billing' && req.method === 'POST') {
+    if (!licenseState.email) return json(res, 200, { licensed: false, isPaying: false });
+    const fresh = await fetchIsPaying(licenseState.email);
+    if (fresh != null) {
+      licenseState.isPaying = fresh;
+      entitlementCache.set(licenseState.email, { isPaying: fresh, checkedAt: Date.now() });
+    }
+    return json(res, 200, { licensed: true, isPaying: licenseState.isPaying });
+  }
+
+  if (url.pathname === '/api/projects' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const input = JSON.parse(body || '{}');
+        const base = projects.find((p) => p.id === input.baseProjectId) ?? projects[0];
+        const nameBase = String(input.name ?? 'New project').trim().slice(0, 80) || 'New project';
+        let name = nameBase, n = 2;
+        while (projects.some((p) => p.name === name)) name = `${nameBase} ${n++}`;
+        const dir = typeof input.dir === 'string' && input.dir.trim() ? input.dir.trim() : (base?.dir ?? ROOT);
+        const project = { id: uniqueProjectId(name), name, dir };
+        projects.push(project);
+        queues.set(project.id, { running: new Set(), waiting: [] });
+        saveProjects();
+        send({ ev: 'projects', projects });
+        return json(res, 200, { project, projects });
+      } catch { return json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  const projectMatch = url.pathname.match(/^\/api\/projects\/([\w-]+)$/);
+  if (projectMatch && (req.method === 'PUT' || req.method === 'DELETE')) {
+    const project = projects.find((p) => p.id === projectMatch[1]);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    if (req.method === 'DELETE') {
+      if (projects.length <= 1) return json(res, 409, { error: 'cannot delete the last project' });
+      const active = goals.some((g) => g.projectId === project.id && ['planning', 'running', 'retesting'].includes(g.status))
+        || tasks.some((t) => t.projectId === project.id && ['running', 'queued'].includes(t.status));
+      if (active) return json(res, 409, { error: 'cannot delete a project with active work' });
+      const idx = projects.findIndex((p) => p.id === project.id);
+      projects.splice(idx, 1);
+      queues.delete(project.id);
+      saveProjects();
+      send({ ev: 'projects', projects, deletedProjectId: project.id });
+      return json(res, 200, { ok: true, projects, deletedProjectId: project.id });
+    }
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const input = JSON.parse(body || '{}');
+        if (typeof input.name === 'string' && input.name.trim()) project.name = input.name.trim().slice(0, 80);
+        saveProjects();
+        send({ ev: 'projects', projects });
+        return json(res, 200, { project, projects });
+      } catch { return json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // proof artifacts: /proof/<taskId>/<file> (gif/png/mp4 from that task's proof dir)
+  const proofMatch = url.pathname.match(/^\/proof\/(\d+)\/([\w.-]+)$/);
+  if (proofMatch) {
+    const file = join(logDir, `proof-${proofMatch[1]}`, proofMatch[2]);
+    if (!existsSync(file)) { res.writeHead(404); return res.end('not found'); }
+    const type = file.endsWith('.gif') ? 'image/gif' : file.endsWith('.png') ? 'image/png'
+      : file.endsWith('.mp4') ? 'video/mp4' : 'application/octet-stream';
+    // proof artifacts are immutable per attempt — let the browser cache them
+    // instead of re-streaming megabytes through the tunnel on every render
+    res.writeHead(200, { 'content-type': type, 'cache-control': 'public, max-age=86400' });
+    return res.end(readFileSync(file));
+  }
+
+  if (url.pathname === '/api/events') {
+    res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
+    res.write('\n');
+    sseClients.set(res, identityFor(req));
+    req.on('close', () => sseClients.delete(res));
+    return;
+  }
+
+  if (url.pathname === '/api/tasks' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', async () => {
+      try {
+        const { projectId, text, pr, images, model, effort, source, pending, review, note, mode, skill, agent } = JSON.parse(body);
+        const project = projects.find((p) => p.id === projectId);
+        if (!project || !text?.trim()) return json(res, 400, { error: 'projectId and text required' });
+        // Dedupe (Masa: 被ったやつもまとめて): if this near-duplicates a goal
+        // already in flight (running/review with a live worker session), fold it
+        // in as a thread follow-up (context kept via session resume) instead of
+        // piling up a redundant parallel goal. Conservative — HIGH-confidence
+        // text overlap only, against session-bearing active goals — so a
+        // genuinely distinct ask always becomes its own goal, and the user's
+        // text is never dropped (it becomes a reply task either way). Skipped for
+        // pending (shelved) and review-only (human-only) items.
+        const identity = identityFor(req);
+        if (!pending && !review) {
+          // Stage 2: only fold into a goal this identity can actually see —
+          // otherwise a near-duplicate message from user B could silently
+          // attach as a reply task onto someone else's private goal (and
+          // leak that goal's text back to B in the response).
+          const candidates = goals.filter((g) => g.projectId === projectId && g.sessionId && ['running', 'review'].includes(g.status) && goalVisibleTo(g, identity, MANAGER_OWNER_EMAIL));
+          const overlap = findOverlappingGoal(text.trim(), candidates);
+          if (overlap) {
+            // A follow-up on a goal already awaiting review re-opens work on it.
+            if (overlap.goal.status === 'review') { overlap.goal.status = 'running'; saveGoal(overlap.goal); }
+            const replyTask = queueReplyTask(overlap.goal, text.trim().slice(0, 8000));
+            return json(res, 200, { ...overlap.goal, mergedInto: overlap.goal.id, replyTaskId: replyTask.id, overlapScore: overlap.score });
+          }
+        }
+        // Billing (docs/BILLING-LAUNCH-PLAN.md §2/§5): gate actual new-goal
+        // creation on the free tier / paid entitlement. Placed after the
+        // dedupe fold-in above on purpose — folding into an existing goal as
+        // a reply doesn't create a new goal, so it doesn't count against the
+        // cap or need a gate check.
+        const gate = await requireEntitlementGate(identity);
+        if (!gate.allowed) return json(res, 402, { error: 'free-tier limit reached', blocked: gate.blocked });
+        // review-only = a "please look at / approve this" item for a human. It
+        // lands straight in the Review lane and NEVER spawns a worker (no plan,
+        // no PR) — the reviewer just Approves (files it) or Dismisses (drops
+        // it). This is how "needs my judgment" reaches the phone without kicking
+        // off an implementation run.
+        const goalAgent = workerAgent(agent);
+        const priorFailureMemory = recentProjectFailureMemory(projectId, text.trim());
+        const goal = {
+          id: nextId++, projectId, text: text.trim().slice(0, 8000),
+          status: review ? 'review' : pending ? 'pending' : 'planning',
+          reviewOnly: review ? true : undefined,
+          note: review && typeof note === 'string' && note.trim() ? note.trim().slice(0, 8000) : undefined,
+          wantsPR: review ? false : resolveWantsPR(pr, text, getReviewDefinition(projectId).defaultWantsPR),
+          model: workerModel(goalAgent, model),
+          effort: workerEffort(goalAgent, effort),
+          agent: goalAgent,
+          // MODE (Auto/Plan): plan = propose a plan first, approve to execute.
+          // review-only goals never run a worker, so mode is moot → 'auto'.
+          mode: (!review && GOAL_MODES.includes(mode)) ? mode : 'auto',
+          // SKILL: an optional user/project skill (or command) to invoke first.
+          skill: (typeof skill === 'string' && skill.trim()) ? skill.trim().slice(0, 80) : null,
+          images: Array.isArray(images) ? images.slice(0, 6) : [],
+          source: resolveGoalSource(source), sourceRef: null,
+          executionPlan: buildExecutionPlan({
+            projectId,
+            text: priorFailureMemory.length ? `${latestFailurePolicy(priorFailureMemory)?.text ?? ''}\n\n${text.trim()}` : text.trim(),
+            previousSession: false,
+          }),
+          priorFailureMemory: priorFailureMemory.length ? priorFailureMemory : undefined,
+          plan: null, pr: undefined, createdAt: new Date().toISOString(),
+          // Stage 2 (multi-user): who this goal belongs to — 'owner' for
+          // key-auth/MANAGER_OWNER_EMAIL, else the creator's Google email.
+          owner: identity,
+        };
+        goals.push(goal);
+        saveGoal(goal);
+        // pending = deliberately shelved (Phase 2 material): never planned,
+        // never queued, until POST /api/goals/:id/activate. review-only items
+        // are terminal-until-human too, so they also skip planGoal.
+        if (!pending && !review) {
+          planGoal(goal).catch((e) => {
+            goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
+          });
+        }
+        json(res, 200, goal);
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // Ask: a free-text question about the current Review/Attention/Done state,
+  // answered in place (not the chat) — cheap LLM pass, no tools, no file access.
+  if (url.pathname === '/api/ask' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', async () => {
+      let question;
+      try { ({ question } = JSON.parse(body)); } catch { return json(res, 400, { error: 'bad json' }); }
+      if (!question?.trim()) return json(res, 400, { error: 'question required' });
+      try {
+        // Stage 2: Ask must never answer from another user's goals/tasks.
+        const identity = identityFor(req);
+        const askGoals = goals.filter((g) => goalVisibleTo(g, identity, MANAGER_OWNER_EMAIL));
+        const askGoalIds = new Set(askGoals.map((g) => g.id));
+        const askTasks = tasks.filter((t) => t.goalId == null || askGoalIds.has(t.goalId));
+        const context = buildAskContext(askGoals, askTasks);
+        const prompt = [
+          '以下はコーディングタスク管理ツールの現在の状態一覧（Review=レビュー待ち／Attention=要対応／Done=完了）です。',
+          'この情報だけを根拠に、ユーザーの質問に日本語で簡潔に答えてください。前置きや説明は書かず、答えだけを書いてください。',
+          '',
+          context,
+          '',
+          `質問: ${question.trim().slice(0, 500)}`,
+        ].join('\n');
+        const r = await runClaude({ prompt, cwd: ROOT, tools: 'Read', model: 'haiku' });
+        json(res, 200, { answer: r.result.trim().slice(0, 2000) });
+      } catch (e) {
+        json(res, 500, { error: String(e.message ?? e).slice(0, 200) });
+      }
+    });
+    return;
+  }
+
+  // Goals can be edited (until work meaningfully starts) or deleted/cancelled
+  // (up to and including a running goal) — see canEditGoal / canDeleteGoal.
+  const goalMatch = url.pathname.match(/^\/api\/goals\/(\d+)$/);
+  if (goalMatch && (req.method === 'PUT' || req.method === 'DELETE')) {
+    const goal = goals.find((g) => g.id === Number(goalMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (req.method === 'DELETE') {
+      if (!canDeleteGoal(goal.status)) return json(res, 409, { error: `a ${goal.status} goal cannot be deleted` });
+      // Running goal → clean cancel: SIGTERM its worker child, drop its queued
+      // tasks, mark unfinished tasks cancelled. (No-op stop for not-yet-started
+      // states.) The killed child's runTask frees its running-slot; we also
+      // nudge the pipeline so a stacked/queued sibling starts.
+      cancelGoalWork(goal);
+      for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'interrupted', 'failed'].includes(t.status))) {
+        t.status = 'skipped';
+        t.result = t.result ?? 'deleted';
+        saveTask(t);
+      }
+      const q = queues.get(goal.projectId);
+      if (q) q.waiting = q.waiting.filter((t) => t.goalId !== goal.id);
+      goals = goals.filter((g) => g.id !== goal.id);
+      appendFileSync(logFile, JSON.stringify({ kind: 'goal', id: goal.id, deleted: true }) + '\n');
+      sendGoalEvent({ ev: 'goal-deleted', id: goal.id }, goal);
+      startNextStacked(goal.projectId);
+      pump(goal.projectId);
+      return json(res, 200, { ok: true });
+    }
+    if (!canEditGoal(goal.status, goal.startedAt)) return json(res, 409, { error: `a ${goal.status} goal cannot be edited` });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { text, pr, promote } = JSON.parse(body);
+        if (promote) goal.prio = ++prioCounter;
+        if (text?.trim()) {
+          goal.text = text.trim().slice(0, 8000);
+          goal.wantsPR = resolveWantsPR(pr, goal.text, getReviewDefinition(goal.projectId).defaultWantsPR);
+        }
+        saveGoal(goal);
+        json(res, 200, goal);
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // retry an interrupted/failed task (same task object, fresh run)
+  const retryMatch = url.pathname.match(/^\/api\/tasks\/(\d+)\/retry$/);
+  if (retryMatch && req.method === 'POST') {
+    const task = tasks.find((t) => t.id === Number(retryMatch[1]));
+    if (!task) return json(res, 404, { error: 'task not found' });
+    if (!requireTaskGoalOwnership(req, res, task)) return;
+    if (!['interrupted', 'failed'].includes(task.status)) return json(res, 409, { error: 'only interrupted/failed tasks can be retried' });
+    task.status = 'queued'; task.result = null; task.secs = null; task.proof = null;
+    saveTask(task);
+    const goal = goals.find((g) => g.id === task.goalId);
+    // goal 427: 'blocked' now also covers a run-budget stop or a rate-limit
+    // pause (goal.blocked.kind === 'budget'/'rate-limit') — a human hitting
+    // Retry on the interrupted task is an explicit "yes, keep going" decision,
+    // so clear the block and, for a budget stop specifically, give the
+    // resumed run a fresh budget window (otherwise it would immediately
+    // re-trip the same limit it just got manually overridden past).
+    if (goal && ['partial', 'failed', 'interrupted', 'done', 'blocked'].includes(goal.status)) {
+      const wasBudget = goal.blocked?.kind === 'budget';
+      goal.status = 'running';
+      goal.blocked = null;
+      if (wasBudget) { goal.runElapsedMs = 0; goal.runTokens = 0; goal.runAttempts = 0; goal.runUsage = null; }
+      saveGoal(goal);
+    }
+    queues.get(task.projectId).waiting.push(task);
+    pump(task.projectId);
+    return json(res, 200, task);
+  }
+
+  // backfill a snapshot proof for a finished task (old reviews predate
+  // automatic UI snapshots and show "No capture yet" otherwise)
+  const snapMatch = url.pathname.match(/^\/api\/tasks\/(\d+)\/snapshot$/);
+  if (snapMatch && req.method === 'POST') {
+    const task = tasks.find((t) => t.id === Number(snapMatch[1]));
+    if (!task) return json(res, 404, { error: 'task not found' });
+    if (!requireTaskGoalOwnership(req, res, task)) return;
+    const project = projects.find((p) => p.id === task.projectId);
+    if (!project || !canSnapshot(project)) return json(res, 409, { error: 'project cannot be snapshotted' });
+    captureSnapshotProof(task, project)
+      .then(() => json(res, 200, task))
+      .catch((e) => json(res, 500, { error: String(e.message ?? e).slice(0, 200) }));
+    return;
+  }
+
+  // close a stalled task without running it (failure-taxonomy: skipped)
+  const skipMatch = url.pathname.match(/^\/api\/tasks\/(\d+)\/skip$/);
+  if (skipMatch && req.method === 'POST') {
+    const task = tasks.find((t) => t.id === Number(skipMatch[1]));
+    if (!task) return json(res, 404, { error: 'task not found' });
+    if (!requireTaskGoalOwnership(req, res, task)) return;
+    if (!['interrupted', 'failed', 'queued'].includes(task.status)) return json(res, 409, { error: 'only stalled tasks can be skipped' });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let reason = 'Skipped.';
+      try { reason = JSON.parse(body).reason ?? reason; } catch {}
+      task.status = 'skipped'; task.result = reason;
+      const q = queues.get(task.projectId);
+      q.waiting = q.waiting.filter((t) => t.id !== task.id);
+      saveTask(task);
+      const goal = goals.find((g) => g.id === task.goalId);
+      const project = projects.find((p) => p.id === task.projectId);
+      if (goal && project) finishGoalIfComplete(goal, project).catch(() => {});
+      pump(task.projectId);
+      json(res, 200, task);
+    });
+    return;
+  }
+
+  // drag & drop ordering: stacked goals / queued tasks
+  if (url.pathname === '/api/goals/reorder' && req.method === 'PUT') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { ids } = JSON.parse(body);
+        if (!Array.isArray(ids)) return json(res, 400, { error: 'ids required' });
+        const identity = identityFor(req);
+        // Drag reorder only ever contains ids the client rendered for this
+        // identity in the first place — silently skip anything foreign
+        // instead of 403ing the whole batch (a non-owner id here would only
+        // ever be a bug, not a real client action).
+        ids.forEach((id, i) => {
+          const g = goals.find((x) => x.id === Number(id) && x.status === 'stacked');
+          if (g && goalVisibleTo(g, identity, MANAGER_OWNER_EMAIL)) { g.prio = ids.length - i; saveGoal(g); }
+        });
+        prioCounter = Math.max(prioCounter, ids.length);
+        json(res, 200, { ok: true });
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+  if (url.pathname === '/api/queue/reorder' && req.method === 'PUT') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { projectId, ids } = JSON.parse(body);
+        const q = queues.get(projectId);
+        if (!q || !Array.isArray(ids)) return json(res, 400, { error: 'projectId and ids required' });
+        // The queue itself is shared per-project (unchanged), but a drag
+        // reorder must not let a non-owner move someone else's task — drop
+        // any id whose task belongs to a goal this identity can't see; it
+        // then simply keeps its current position (orderByIds leaves ids it
+        // wasn't given untouched).
+        const identity = identityFor(req);
+        const ownIds = ids.filter((id) => {
+          const t = q.waiting.find((x) => x.id === Number(id));
+          const g = t && goals.find((gg) => gg.id === t.goalId);
+          return !g || goalVisibleTo(g, identity, MANAGER_OWNER_EMAIL);
+        });
+        // Only reshuffles queued tasks; a task already running was shifted
+        // out of q.waiting by pump() and is never touched here. Re-applying
+        // the priority sort keeps a drag from ever placing a task ahead of a
+        // higher-priority one — it can only reorder within its own band.
+        q.waiting = sortQueueByPriority(reorderQueue(q.waiting, ownIds));
+        for (const t of q.waiting) saveTask(t); // broadcast new order
+        json(res, 200, { ok: true, order: q.waiting.map((t) => t.id) });
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // change a queued task's priority (高/中/低) — re-sorts its project's queue
+  // so a bumped-up task actually runs sooner, not just displays that way.
+  const priorityMatch = url.pathname.match(/^\/api\/tasks\/(\d+)\/priority$/);
+  if (priorityMatch && req.method === 'PUT') {
+    const task = tasks.find((t) => t.id === Number(priorityMatch[1]));
+    if (!task) return json(res, 404, { error: 'task not found' });
+    if (!requireTaskGoalOwnership(req, res, task)) return;
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { priority } = JSON.parse(body);
+        if (!TASK_PRIORITIES.includes(priority)) return json(res, 400, { error: `priority must be one of: ${TASK_PRIORITIES.join(', ')}` });
+        task.priority = priority;
+        saveTask(task);
+        const q = queues.get(task.projectId);
+        if (q) { q.waiting = sortQueueByPriority(q.waiting); for (const t of q.waiting) saveTask(t); }
+        json(res, 200, task);
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // PRなしレビューのチェックリストが全件Approveされたら次の状態へ進める (task 62)
+  const advanceMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/advance-review$/);
+  if (advanceMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(advanceMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = advanceReviewGoal(goal);
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status;
+    saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // task 97: doneに進めたPRなしレビューゴールを review へ戻す(『元に戻す』)。
+  // advance-review の逆操作。押し間違いのApproveを取り消せるようにする。
+  const revertMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/revert-review$/);
+  if (revertMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(revertMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = revertReviewGoal(goal);
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status;
+    saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Pending (deliberately shelved) goals: activate moves one into the normal
+  // breakdown-first flow; pend shelves a stacked goal.
+  const activateMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/activate$/);
+  if (activateMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(activateMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.status !== 'pending') return json(res, 409, { error: 'only pending goals can be activated' });
+    goal.status = 'planning'; saveGoal(goal);
+    planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+    return json(res, 200, goal);
+  }
+  const pendMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/pend$/);
+  if (pendMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(pendMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.status !== 'stacked') return json(res, 409, { error: 'only stacked goals can be pended' });
+    goal.status = 'pending'; saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Slack-style thread reply on a goal: resumes the goal's worker session
+  // Smart intake: answer a planner clarifying question → fold it into the goal
+  // and re-plan (no new worker; same goal continues to decomposition).
+  const answerMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/answer$/);
+  if (answerMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(answerMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (goal.status !== 'needsInput') return json(res, 409, { error: 'goal is not awaiting input' });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let answer = '';
+      try { answer = String(JSON.parse(body || '{}').answer ?? '').trim(); } catch {}
+      if (!answer) return json(res, 400, { error: 'answer required' });
+      goal.text = `${goal.text}\n[確認: ${goal.question?.text ?? ''} → ${answer}]`;
+      goal.clarified = true; // answered once → planGoal must never re-ask (persisted via saveGoal)
+      goal.question = null;
+      goal.status = 'planning';
+      saveGoal(goal);
+      planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+      json(res, 200, goal);
+    });
+    return;
+  }
+
+  const replyMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/reply$/);
+  if (replyMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(replyMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    if (['stacked', 'planning'].includes(goal.status)) return json(res, 409, { error: 'goal not started yet — edit it instead' });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { text } = JSON.parse(body);
+        if (!text?.trim()) return json(res, 400, { error: 'text required' });
+        if (['partial', 'failed', 'interrupted', 'blocked'].includes(goal.status)) {
+          goal.status = 'running';
+          goal.blocked = null;
+          saveGoal(goal);
+        }
+        json(res, 200, queueReplyTask(goal, text.trim()));
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+
+  // レビュー詳細パネル(task 70)のApproveボタン: レビュー中のgoalをdoneへ確定する。
+  // advance-review(task 62)のチェックリスト全件Approveとは別の、単発の人間の判断。
+  const approveMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/approve$/);
+  if (approveMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(approveMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    // Plan-review approve: do NOT file to Done — re-queue the SAME goal to
+    // EXECUTE the approved plan. Flip to auto (acceptEdits), mark executing, and
+    // reset this goal's tasks back to 'queued' so the worker now actually edits
+    // (with the approved plan already in its resumed session as context).
+    if (isPlanReview(goal)) {
+      const next = nextAfterPlanApprove(goal);
+      if (!next.ok) return json(res, 409, { error: next.error });
+      goal.mode = next.mode;
+      goal.planPhase = next.planPhase;
+      goal.status = next.status;
+      goal.blocked = null;
+      saveGoal(goal);
+      const q = queues.get(goal.projectId);
+      for (const t of tasks.filter((t) => t.goalId === goal.id)) {
+        t.status = 'queued'; t.mode = 'auto';
+        t.result = null; t.secs = null; t.proof = null; t.changedFiles = [];
+        saveTask(t);
+        if (q) q.waiting.push(t);
+      }
+      pump(goal.projectId);
+      return json(res, 200, goal);
+    }
+    const result = approveGoal({ goalStatus: goal.status });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status;
+    saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Re-run the Manager-verified gate for a blocked goal (tests + proof), from
+  // Attention's 再検証 button. Passes → review; still failing → stays blocked.
+  const reverifyMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/reverify$/);
+  if (reverifyMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(reverifyMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const project = projects.find((p) => p.id === goal.projectId);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    const siblings = tasks.filter((t) => t.goalId === goal.id);
+    const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
+    await verifyGate(goal, { ...project, dir: wdir }, siblings, project);
+    saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Archive: retire an UNFINISHED goal (partial/failed/interrupted/blocked)
+  // cleanly — spawning no rework. DELETE only accepts stacked/pending, and
+  // dismiss on a partial goal queues a "差し戻し" rework task, so a goal that
+  // half-finished (a subtask failed/interrupted) had no clean exit and piled up
+  // forever between done and cleared. Archive puts the goal AND any of its
+  // non-terminal child tasks to rest as 'skipped', clearing Attention for good.
+  // Ledger (v45 §5.1/PRD §5.1) adds 'review' to the archivable statuses:
+  // Archive = 判断保留の棚上げ, neither Done nor a dismissal. archivedFrom is
+  // kept so the Ledger one-liner's UNDO (/unarchive) can restore it.
+  const archiveMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/archive$/);
+  if (archiveMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(archiveMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = archiveGoal({ goalStatus: goal.status });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    // Retire leftover work — but never touch a task mid-run (no worker kill).
+    for (const t of tasks.filter((t) => t.goalId === goal.id && ['queued', 'interrupted', 'failed'].includes(t.status))) {
+      t.status = 'skipped'; t.result = t.result ?? 'archived'; saveTask(t);
+    }
+    goal.archivedFrom = result.archivedFrom;
+    goal.status = result.status; goal.blocked = null; saveGoal(goal);
+    sendGoalEvent({ ev: 'goal-archived', id: goal.id }, goal);
+    return json(res, 200, { ok: true, goal });
+  }
+
+  // UNDO of a Ledger Archive — honest scope: only goals archived FROM review
+  // (see unarchiveGoal in lib.mjs for why unfinished-goal archives stay put).
+  const unarchiveMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/unarchive$/);
+  if (unarchiveMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(unarchiveMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = unarchiveGoal({ goalStatus: goal.status, archivedFrom: goal.archivedFrom });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status; goal.archivedFrom = null; saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Ledger plain Dismiss (v45 §5.3): start the automatic retest ×3 job. The
+  // dismiss-with-text (chat) path stays on /dismiss below.
+  const retestMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/retest$/);
+  if (retestMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(retestMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = retestGoal({ goalStatus: goal.status });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status;
+    goal.retest = { state: 'running', runs: 0, total: RETEST_RUNS, startedAt: new Date().toISOString() };
+    saveGoal(goal);
+    const token = `${goal.id}-${Date.now()}-${Math.random()}`;
+    retestTokens.set(goal.id, token);
+    runRetestJob(goal, token).catch((e) => console.warn(`[manager] retest goal ${goal.id} failed: ${String(e).slice(0, 200)}`));
+    return json(res, 200, goal);
+  }
+
+  // UNDO of a Ledger plain Dismiss: cancel the in-flight retest. The running
+  // job re-checks goal.status before applying results, so a cancelled retest
+  // can never overwrite this.
+  const retestCancelMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/retest-cancel$/);
+  if (retestCancelMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(retestCancelMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const result = cancelRetestGoal({ goalStatus: goal.status });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    goal.status = result.status; goal.retest = null; saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // Ledger Revert (ゴミ箱, v45 §5.3): make the change never have happened —
+  // close the PR (+ delete its remote branch), drop the goal's worktree, mark
+  // the goal 'reverted' (terminal, distinct from archived). If a destructive
+  // step fails the goal is NOT marked reverted (never claim a revert that
+  // didn't happen).
+  const revertGoalMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/revert$/);
+  if (revertGoalMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(revertGoalMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const project = projects.find((p) => p.id === goal.projectId);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    const decision = revertGoal({ goalStatus: goal.status });
+    if (!decision.ok) return json(res, 409, { error: decision.error });
+    const actions = planRevertActions({ pr: goal.pr, prBranch: goal.prBranch, hasWorktree: goalWorkDirs.has(goal.id) });
+    for (const a of actions) {
+      try { await execRevertAction(a, goal, project); }
+      catch (e) { return json(res, 502, { error: `revert incomplete (${a.kind}): ${String(e.message ?? e).slice(0, 300)}` }); }
+    }
+    goal.status = decision.status;
+    goal.reverted = { at: new Date().toISOString(), actions: actions.map((a) => a.kind) };
+    saveGoal(goal);
+    return json(res, 200, goal);
+  }
+
+  // UNDO of a Ledger chat send-back: pull the rework reply task back out of
+  // the queue while it is still queued (honest — see undismissGoal).
+  const undismissMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/undismiss$/);
+  if (undismissMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(undismissMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const replyTask = [...tasks].reverse().find((t) => t.goalId === goal.id && t.reply);
+    const result = undismissGoal({ goalStatus: goal.status, replyTask });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    const q = queues.get(goal.projectId);
+    if (q) q.waiting = q.waiting.filter((t) => t.id !== replyTask.id);
+    replyTask.status = 'skipped'; replyTask.result = 'undone from the Ledger before it started'; saveTask(replyTask);
+    goal.status = result.status; saveGoal(goal);
+    return json(res, 200, { goal, task: replyTask });
+  }
+
+  // Ledger Details data: diff stats + files + diff text for the goal's branch
+  // (plain git, cached per branch tip in computeGoalDiff). 404 = the goal has
+  // no branch/diff — the UI renders what exists and omits the rest honestly.
+  const goalDiffMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/diff$/);
+  if (goalDiffMatch && req.method === 'GET') {
+    const goal = goals.find((g) => g.id === Number(goalDiffMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    const project = projects.find((p) => p.id === goal.projectId);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    const payload = computeGoalDiff(goal, project);
+    if (!payload) return json(res, 404, { error: 'no diff available for this goal' });
+    return json(res, 200, payload);
+  }
+
+  // レビュー詳細パネルのDismissボタン: 修正指示(空でも「差し戻し」扱い)をgoalのスレッド
+  // 返信としてworkerに渡し、goalをrunning(doing相当)へ戻す。
+  const dismissMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/dismiss$/);
+  if (dismissMatch && req.method === 'POST') {
+    const goal = goals.find((g) => g.id === Number(dismissMatch[1]));
+    if (!goal) return json(res, 404, { error: 'goal not found' });
+    if (!requireGoalOwnership(req, res, goal)) return;
+    // review-only items + blocked goals have no worker thread to revise — Dismiss
+    // just clears them (filed 'skipped'), spawning nothing.
+    if (goal.reviewOnly || goal.status === 'blocked') {
+      if (!['review', 'blocked'].includes(goal.status)) return json(res, 409, { error: 'goal is not dismissable' });
+      goal.status = 'skipped'; goal.blocked = null;
+      saveGoal(goal);
+      return json(res, 200, { goal });
+    }
+    const result = dismissGoal({ goalStatus: goal.status });
+    if (!result.ok) return json(res, 409, { error: result.error });
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      let text = '';
+      try { text = String(JSON.parse(body || '{}').text ?? '').trim(); } catch {}
+      goal.status = result.status;
+      saveGoal(goal);
+      const task = queueReplyTask(goal, text || '差し戻し。修正してください。');
+      json(res, 200, { goal, task });
+    });
+    return;
+  }
+
+  // image attachments: upload (base64 JSON) + serve back for thumbnails
+  if (url.pathname === '/api/upload' && req.method === 'POST') {
+    let body = '';
+    req.on('data', (d) => { body += d; });
+    req.on('end', () => {
+      try {
+        const { name, dataBase64 } = JSON.parse(body);
+        const safe = String(name ?? 'image.png').replace(/[^\w.-]/g, '_').slice(-80);
+        const file = `${Date.now()}-${safe}`;
+        const dir = join(logDir, 'uploads');
+        mkdirSync(dir, { recursive: true });
+        const buf = Buffer.from(String(dataBase64 ?? ''), 'base64');
+        if (!buf.length || buf.length > 10 * 1024 * 1024) return json(res, 400, { error: 'empty or >10MB' });
+        writeFileSync(join(dir, file), buf);
+        json(res, 200, { path: join(dir, file), url: `/upload/${file}` });
+      } catch { json(res, 400, { error: 'bad json' }); }
+    });
+    return;
+  }
+  const upMatch = url.pathname.match(/^\/upload\/([\w.-]+)$/);
+  if (upMatch) {
+    const file = join(logDir, 'uploads', upMatch[1]);
+    if (!existsSync(file)) { res.writeHead(404); return res.end('not found'); }
+    res.writeHead(200, { 'content-type': file.endsWith('.gif') ? 'image/gif' : file.endsWith('.jpg') || file.endsWith('.jpeg') ? 'image/jpeg' : 'image/png' });
+    return res.end(readFileSync(file));
+  }
+
+  // SKILL picker: list the skills/commands a worker can invoke for this project
+  // — user-level (~/.claude) + project-level (<dir>/.claude). Read-only, no LLM.
+  const skillsMatch = url.pathname.match(/^\/api\/projects\/([\w-]+)\/skills$/);
+  if (skillsMatch && req.method === 'GET') {
+    const project = projects.find((p) => p.id === skillsMatch[1]);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    const home = homedir();
+    const sources = [
+      { dir: join(home, '.claude', 'skills'), source: 'user', kind: 'skill' },
+      { dir: join(home, '.claude', 'commands'), source: 'user', kind: 'command' },
+      { dir: join(project.dir, '.claude', 'skills'), source: 'project', kind: 'skill' },
+      { dir: join(project.dir, '.claude', 'commands'), source: 'project', kind: 'command' },
+    ];
+    return json(res, 200, { skills: collectSkills(sources) });
+  }
+
+  // workflow columns: the Tasks-panel column editor's persistence (task 44)
+  const colsMatch = url.pathname.match(/^\/api\/projects\/([\w-]+)\/columns$/);
+  if (colsMatch) {
+    const project = projects.find((p) => p.id === colsMatch[1]);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    if (req.method === 'GET') return json(res, 200, { columns: getColumns(project.id) });
+    if (req.method === 'PUT') {
+      let body = '';
+      req.on('data', (d) => { body += d; });
+      req.on('end', () => {
+        try {
+          const { columns } = JSON.parse(body);
+          const result = validateWorkflowColumns(columns);
+          if (!result.ok) return json(res, 400, { error: result.error });
+          workflowColumns[project.id] = result.columns;
+          saveWorkflowColumns();
+          send({ ev: 'columns', projectId: project.id, columns: result.columns });
+          json(res, 200, { columns: result.columns });
+        } catch { json(res, 400, { error: 'bad json' }); }
+      });
+      return;
+    }
+  }
+
+  // review definition: what counts as "needs review" for a finished goal
+  // (task 45), edited from the same settings panel as workflow columns
+  const reviewDefMatch = url.pathname.match(/^\/api\/projects\/([\w-]+)\/review-definition$/);
+  if (reviewDefMatch) {
+    const project = projects.find((p) => p.id === reviewDefMatch[1]);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    if (req.method === 'GET') return json(res, 200, { reviewDefinition: getReviewDefinition(project.id) });
+    if (req.method === 'PUT') {
+      let body = '';
+      req.on('data', (d) => { body += d; });
+      req.on('end', () => {
+        try {
+          const { reviewDefinition } = JSON.parse(body);
+          const result = validateReviewDefinition(reviewDefinition);
+          if (!result.ok) return json(res, 400, { error: result.error });
+          reviewDefinitions[project.id] = result.definition;
+          saveReviewDefinitions();
+          send({ ev: 'review-definition', projectId: project.id, reviewDefinition: result.definition });
+          json(res, 200, { reviewDefinition: result.definition });
+        } catch { json(res, 400, { error: 'bad json' }); }
+      });
+      return;
+    }
+  }
+
+  res.writeHead(404); res.end('not found');
+});
+
+// IPv6 loopback (::1) twin. A Cloudflare/ngrok tunnel with origin "localhost"
+// resolves to ::1 first; binding IPv4-only (127.0.0.1) made that path 502.
+// Same request handler, loopback-only, best-effort (skip if ::1 unavailable).
+const server6 = createServer(server.listeners('request')[0]);
+server6.on('error', (e) => console.log(`[manager] ::1 listen skipped: ${e.code}`));
+try { server6.listen(PORT, '::1'); } catch { /* IPv6 loopback unavailable */ }
+
+server.listen(PORT, '127.0.0.1', () => {
+  console.log(`[manager] Manager for AI → http://localhost:${PORT}/?key=${ACCESS_KEY}`);
+  if (process.env.MANAGER_OPEN_BROWSER === '1' && process.platform === 'darwin') {
+    spawn('open', ['-g', `http://localhost:${PORT}/?key=${ACCESS_KEY}`], { stdio: 'ignore' }).unref();
+  }
+  console.log(`[manager] projects: ${projects.map((p) => `${p.id}=${p.dir}`).join('  ')}`);
+  syncAllExternal().catch(() => {});
+  syncGoalMerges().catch(() => {});
+  setInterval(() => {
+    send({ ev: 'ping', uiVersion: uiVersion() });
+    syncGoalMerges().catch(() => {});
+    for (const p of projects) {
+      pump(p.id);
+      for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
+        g.status = 'planning'; saveGoal(g);
+        planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
+      }
+    }
+  }, 30_000).unref();
+  for (const p of projects) {
+    const pending = tasks.filter((t) => t.projectId === p.id && t.status === 'queued').sort((a, b) => a.num - b.num);
+    const q = queues.get(p.id);
+    q.waiting.push(...pending);
+    if (pending.length) console.log(`[manager] ${p.id}: re-queued ${pending.length} pending task(s) after restart`);
+    pump(p.id);
+    // breakdown-first: any goal still sitting 'stacked' (legacy or crash
+    // leftovers) gets planned immediately so it can never rot in the queue
+    for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
+      g.status = 'planning'; saveGoal(g);
+      planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
+    }
+    // A restart must not orphan an in-flight Ledger retest (v45 §5.3): the
+    // intent is persisted as status 'retesting' in tasks.jsonl (replayQueueLog
+    // passes it through untouched) — resume the job from run 1.
+    for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'retesting')) {
+      const token = `${g.id}-${Date.now()}-${Math.random()}`;
+      retestTokens.set(g.id, token);
+      runRetestJob(g, token).catch(() => {});
+    }
+    // A crash between a goal's last task finishing and createGoalPR running
+    // leaves it 'review' with no goal.pr and no prError yet (see
+    // replayQueueLog) — finish that PR now instead of leaving it stuck.
+    const orphanedReview = goals.filter((g) => g.projectId === p.id && g.status === 'review' && g.wantsPR && !g.pr && !g.prError);
+    for (const g of orphanedReview) {
+      createGoalPR(g, p, tasks.filter((t) => t.goalId === g.id)).catch(() => {});
+    }
+  }
+});