@galda/cli 0.10.34 → 0.10.36

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -657,11 +657,17 @@ if (process.env.MANAGER_SEED_RUNNING_FIXTURE === '1') {
   const goalId = nextId++, taskId = nextId++;
   goals.push({
     id: goalId, projectId: 'default', text: '[verify fixture] 実行中ゴール', status: 'running',
+    // startedAt is what a REAL running goal carries (server.mjs sets it when the
+    // first task starts — see runTask). Without it the board bucketed this as
+    // To Do while the list showed it under Doing (task-level) — the two views
+    // disagreed on a malformed fixture. Set it so the seed matches reality:
+    // both views place a running goal in Doing (Masa 2026-07-19).
+    startedAt: at,
     wantsPR: false, model: 'sonnet', images: [], plan: ['fixture task'], pr: undefined, createdAt: at,
   });
   tasks.push({
     id: taskId, num: 1, goalId, projectId: 'default', title: 'fixture task', detail: '', passCondition: '',
-    model: 'sonnet', status: 'running', createdAt: at, result: null, changedFiles: [], secs: null, proof: null, usage: null,
+    model: 'sonnet', status: 'running', createdAt: at, startedAt: at, result: null, changedFiles: [], secs: null, proof: null, usage: null,
     activity: [
       'Read app/index.html', 'Grep taskBlock', 'Edit app/index.html', 'Read engine/lib.mjs',
       'Bash node --test engine/test/*.test.mjs', '✓ 12 tests passed', 'Edit engine/server.mjs',
@@ -1302,12 +1308,22 @@ function globalRunningCount() {
   return n;
 }
 
+// Per-project play/pause (Masa: Doing列の一時停止/再生). A paused project neither
+// starts new stacked goals nor pumps queued tasks — the two choke points below
+// (startNextStacked / pump) read this, so EVERY caller of them is covered by one
+// guard each. The flag lives on the project object (projects.json), so it
+// survives a restart; nothing auto-resumes a paused project.
+function isProjectPaused(projectId) {
+  return !!projects.find((p) => p.id === projectId)?.paused;
+}
+
 // Goals stack up per project: while one goal is being planned or executed,
 // newer goals wait as 'stacked' (editable / deletable until picked up).
 function goalActive(projectId) {
   return goals.some((g) => g.projectId === projectId && ['planning', 'running'].includes(g.status));
 }
 function startNextStacked(projectId) {
+  if (isProjectPaused(projectId)) return; // paused → don't begin planning queued goals
   if (goalActive(projectId)) return;
   const next = goals.filter((g) => g.projectId === projectId && g.status === 'stacked')
     .sort((a, b) => (b.prio ?? 0) - (a.prio ?? 0) || a.id - b.id)[0];
@@ -1496,6 +1512,9 @@ function pump(projectId) {
   // to sign `claude` in and relaunch). Never spawn a worker that can only fail
   // with "Not logged in". Cleared automatically once a probe succeeds.
   if (!workerAuth.ok) return;
+  // Project paused by the user (Doing列の一時停止 / chat) → hold this project's
+  // queue exactly like the auth hold above. Resume flips the flag and pumps.
+  if (isProjectPaused(projectId)) return;
   const q = queues.get(projectId);
   // sortQueueByPriority is a stable sort: it only ever moves a task ahead of
   // a lower-priority one, never disturbs relative order within the same
@@ -1729,6 +1748,48 @@ function rateLimitResumeSweep() {
 const rateLimitSweepTimer = setInterval(rateLimitResumeSweep, RATE_LIMIT_SWEEP_MS);
 rateLimitSweepTimer.unref?.();
 
+// Project play/pause (Masa: Doing列の一時停止ボタン + チャット). Pause STOPS the
+// project's in-flight Doing work and prevents new ToDo from starting; Resume
+// continues from where it left off. Modelled on the rate-limit pause above (a
+// SIGTERM'd worker becomes an 'interrupted' task with its sessionId preserved,
+// so runTask's retry/resume path re-continues the same conversation) — the only
+// differences are: it's user-driven (no resumeAt / auto-resume), and it flips
+// the persisted project.paused flag that gates pump()/startNextStacked().
+//
+// Race note: setting goal.status='blocked' HERE (synchronously) BEFORE the
+// SIGTERM'd worker's async exit runs means finishGoalIfComplete later sees a
+// non-'running'/'partial' goal and bails at its status guard without clobbering
+// the paused state — see finishGoalIfComplete's early return.
+function pauseProject(projectId) {
+  const project = projects.find((p) => p.id === projectId);
+  if (!project || project.paused) return false;
+  project.paused = true;
+  saveProjects();
+  for (const g of goals.filter((g) => g.projectId === projectId && g.status === 'running')) {
+    killGoalWorkers(g.id); // SIGTERM → task becomes 'interrupted' (resumable), not cancelled
+    g.status = 'blocked';
+    g.blocked = { kind: 'paused', reason: 'paused by user — resume to continue' };
+    saveGoal(g);
+  }
+  send({ ev: 'projects', projects });
+  return true;
+}
+function resumeProject(projectId) {
+  const project = projects.find((p) => p.id === projectId);
+  if (!project || !project.paused) return false;
+  project.paused = false;
+  saveProjects();
+  // Re-queue each paused goal's interrupted tasks and flip it back to running
+  // (reuses the proven rate-limit resume: continues from the preserved session).
+  for (const g of goals.filter((g) => g.projectId === projectId && g.status === 'blocked' && g.blocked?.kind === 'paused')) {
+    resumeRateLimitedGoal(g);
+  }
+  startNextStacked(projectId);
+  pump(projectId);
+  send({ ev: 'projects', projects });
+  return true;
+}
+
 // Slack風スレッド返信タスクの生成(/api/goals/:id/reply と /api/goals/:id/dismiss で共有)。
 // runTask()のtask.reply分岐がgoal.sessionIdをresumeに渡して同じ会話を続ける。
 function queueReplyTask(goal, text) {
@@ -1755,7 +1816,17 @@ function queueReplyTask(goal, text) {
   tasks.push(task);
   saveTask(task);
   queues.get(goal.projectId).waiting.push(task);
-  pump(goal.projectId);
+  // Spawn the worker on the NEXT event-loop turn, not synchronously here. runTask() runs
+  // straight through to its first await — and that stretch includes goalWorkDir()'s
+  // `git worktree add` (measured 1.78s on a checkout with ~135 worktrees). Callers like
+  // POST /api/goals/:id/dismiss and /reply invoke queueReplyTask from inside their HTTP
+  // handler and send the 200 right after, so a synchronous pump() made the response wait on
+  // the worktree — the review UI looked stuck on "review" for seconds while the Ledger had
+  // already claimed "Feedback sent → back to To Do" (Masa 2026-07-19). setImmediate lets the
+  // response flush first; the task is already queued and persisted, so nothing is lost if the
+  // worker starts a turn later. (setImmediate, not nextTick/microtask: those run before the
+  // socket write flushes, so the blocking git call would still delay the response.)
+  setImmediate(() => pump(goal.projectId));
   return task;
 }
 
@@ -2192,8 +2263,12 @@ async function runTask(task) {
       } finally {
         eph?.kill();
       }
-      sendAct(task, `verify: ${verdict.pass ? 'PASS' : 'FAIL'} — ${verdict.detail.slice(0, 120)}`);
-      if (verdict.pass) break;
+      sendAct(task, `verify: ${verdict.pass ? 'PASS' : verdict.inconclusive ? 'INCONCLUSIVE (check could not run)' : 'FAIL'} — ${verdict.detail.slice(0, 120)}`);
+      // An inconclusive verdict = the check itself couldn't run (authored check
+      // referenced hooks the app doesn't expose — #487). Retrying will just
+      // throw again, so stop and let it route to human review rather than
+      // burning attempts and scoring the change as failed.
+      if (verdict.pass || verdict.inconclusive) break;
       lastFailure = verdict.detail;
     } catch (e) {
       sendAct(task, `verify: could not run — ${String(e.message ?? e).slice(0, 120)}`);
@@ -2212,11 +2287,19 @@ async function runTask(task) {
   //     FAIL verdict on a killed (incomplete) worker isn't authoritative either,
   //     so the stop reason takes precedence. (Mirrors the budget-breach path.)
   //  3. a verify that actually ran and FAILED = 'failed'.
-  //  4. no verify = the exit code decides.
+  //  4. an INCONCLUSIVE verify (the check threw / returned garbage — the
+  //     verifier is at fault, not necessarily the change, #487) is NOT
+  //     authoritative: fall through to the exit code so a cleanly-finished
+  //     worker still reaches review for a human, instead of a false 'failed'.
+  //  5. no verify = the exit code decides.
   const forcedStop = isForcedStop(code, timedOut);
+  // A verdict only counts as authoritative when the check actually judged the
+  // change. An inconclusive verdict (check threw / returned garbage) is treated
+  // like "no verdict" everywhere below — status, proof, and snapshot capture.
+  const conclusive = verdict && !verdict.inconclusive;
   task.status = verdict?.pass ? 'done'
     : forcedStop ? 'interrupted'
-    : verdict ? 'failed'
+    : conclusive ? 'failed'
     : (code === 0 ? 'done' : 'failed');
   // Never leave the reason as a bare "(no output)": if the worker produced no
   // report text, result already carries workerExitReason(); make doubly sure a
@@ -2225,19 +2308,26 @@ async function runTask(task) {
   task.result = result.slice(0, 4000);
   task.usage = sumUsage(usages);
   if (verdict) {
-    task.result = `検証${verdict.pass ? 'PASS' : 'FAIL'}: ${verdict.detail}\n\n${task.result}`.slice(0, 4000);
-    task.proof = {
-      pass: verdict.pass,
-      detail: verdict.detail.slice(0, 500),
-      gif: verdict.gifPath?.split('/').pop() ?? null,
-      png: verdict.shotPath?.split('/').pop() ?? null,
-      mp4: verdict.videoPath?.split('/').pop() ?? null,
-      // STRONG proof: this came from an independent passCondition verification,
-      // not a generic auto-snapshot. Only this flag lets a force-stopped (interrupted)
-      // task count toward goal completion (isProofVerified) — a weak "UI capture"
-      // snapshot never auto-promotes an interrupted goal past human review.
-      verified: true,
-    };
+    const label = verdict.pass ? 'PASS' : verdict.inconclusive ? 'INCONCLUSIVE (自動確認できず・要確認)' : 'FAIL';
+    task.result = `検証${label}: ${verdict.detail}\n\n${task.result}`.slice(0, 4000);
+    // Only attach an authoritative proof for a conclusive verdict. An
+    // inconclusive one must NOT leave a pass:false proof — that would trip
+    // verifyGate's proofFailing and re-block the goal through the back door
+    // (#487). Fall through to the snapshot capture below instead.
+    if (conclusive) {
+      task.proof = {
+        pass: verdict.pass,
+        detail: verdict.detail.slice(0, 500),
+        gif: verdict.gifPath?.split('/').pop() ?? null,
+        png: verdict.shotPath?.split('/').pop() ?? null,
+        mp4: verdict.videoPath?.split('/').pop() ?? null,
+        // STRONG proof: this came from an independent passCondition verification,
+        // not a generic auto-snapshot. Only this flag lets a force-stopped (interrupted)
+        // task count toward goal completion (isProofVerified) — a weak "UI capture"
+        // snapshot never auto-promotes an interrupted goal past human review.
+        verified: true,
+      };
+    }
   }
   const after = await gitChanges(workDir);
   task.changedFiles = after.filter((l) => !before.includes(l)).map((l) => l.slice(3));
@@ -2250,7 +2340,7 @@ async function runTask(task) {
   // baselineDir = the user's real project dir (unmodified, pre-goal code) —
   // when it's genuinely different from wproject.dir (a real worktree, not
   // the shared-dir fallback), also attempt a before/after pair.
-  if (!verdict && task.status === 'done' && shouldCaptureProof({ changedFiles: task.changedFiles, hasProof: Boolean(task.proof), canCapture: canSnapshot(wproject) })) {
+  if (!conclusive && task.status === 'done' && shouldCaptureProof({ changedFiles: task.changedFiles, hasProof: Boolean(task.proof), canCapture: canSnapshot(wproject) })) {
     try {
       sendAct(task, 'proof: capturing UI change (screenshot + clip) of the edited app…');
       await captureSnapshotProof(task, wproject, { baselineDir: project.dir, goal });
@@ -2305,7 +2395,9 @@ function runTestsOnce(dir) {
       const timeoutFlakes = (text.match(/did not report ready in time/g) || []).length;
       const realAssertion = /AssertionError|Expected values to be|expected .+ (?:to |but )/i.test(text);
       const failed = realAssertion ? failedTotal : Math.max(0, failedTotal - timeoutFlakes);
-      res({ passed, failed, detail: testOutputExcerpt(text) });
+      // Capture the failing test NAMES too (not just the count) so the gate can
+      // diff them against the base's failures and block only on NEW ones.
+      res({ passed, failed, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
     });
   });
 }
@@ -2320,13 +2412,80 @@ async function runProjectTests(dir) {
   // never blocked on a flaky test.
   if (r.failed > 0) {
     const r2 = await runTestsOnce(dir);
+    const kept = r2.failed <= r.failed ? r2 : r; // the run that saw fewer failures
     r = {
       passed: Math.max(r.passed, r2.passed),
       failed: Math.min(r.failed, r2.failed),
-      detail: (r2.failed <= r.failed ? r2.detail : r.detail) || r.detail || r2.detail || '',
+      detail: kept.detail || r.detail || r2.detail || '',
+      failingNames: kept.failingNames ?? r.failingNames ?? [],
     };
   }
-  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, detail: r.detail ?? '' };
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
+}
+
+// Failing tests on the BASE (pre-change) checkout — the set the review gate
+// subtracts so a goal is blocked only on failures IT introduced, never on a
+// test that was already red (e.g. persist-failure on clean origin/main). Lazy
+// + cached by the base-ref sha in MANAGER_HOME: computed only when a goal's own
+// run is red, then reused across goals sharing the same base (main moves a few
+// times a day, so this is a handful of full runs a day, not one per goal).
+// Any failure to compute → [] = "unknown", and the caller falls back to the
+// old block-on-any-red behaviour (fail closed).
+//
+// 🔴 The base MUST be the ref the goal worktree was branched from —
+// origin/<default> (goalWorkDir: `git worktree add … origin/<br>`), NOT the
+// registry dir's working HEAD. Those diverge in the wild: a dogfood checkout
+// left on an old branch, or uncommitted local work. Measuring the baseline on a
+// stale HEAD runs a suite where today's red tests don't exist yet → an EMPTY
+// failing set → the gate falls closed and blocks EVERY goal on a red that was
+// actually pre-existing. (Masa 2026-07-19: the registry dir sat 612 commits
+// behind origin/main, so every goal Failed on "テスト失敗 1件" the baseline
+// should have excused.) So resolve origin/<default> and run the base suite in a
+// throwaway detached worktree of that exact commit — nested under
+// repoRoot/.manager-wt so node's upward node_modules resolution still finds the
+// repo's deps (the same trick goal worktrees rely on), and so we never mutate
+// the registry checkout (prod procs read it; it may be on any branch).
+const BASELINE_CACHE = join(DATA_DIR, 'test-baseline.json');
+const baselineInFlight = new Map(); // sha -> Promise<string[]> — dedupe concurrent goal closes
+async function getBaselineFailures(baseProject) {
+  const dir = baseProject?.dir;
+  if (!dir) return [];
+  let repoRoot;
+  try { repoRoot = gitSync(dir, ['rev-parse', '--show-toplevel']); } catch { return []; }
+  const br = repoDefaultBranch(dir);
+  try { gitSync(repoRoot, ['fetch', 'origin', br, '--quiet']); } catch { /* offline — use whatever origin/<br> we already have */ }
+  // The base ref the goal worktree is cut from: origin/<br>, else the local
+  // branch tip, else the working HEAD (offline single-checkout fallback).
+  const sha = (gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', `origin/${br}`])
+    || gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', br])
+    || gitOut(repoRoot, ['rev-parse', '--verify', '--quiet', 'HEAD']) || '').trim();
+  if (!sha) return [];
+  try {
+    const cached = JSON.parse(readFileSync(BASELINE_CACHE, 'utf8'));
+    if (cached && cached.sha === sha && Array.isArray(cached.failingNames)) return cached.failingNames;
+  } catch { /* no cache yet */ }
+  if (baselineInFlight.has(sha)) return baselineInFlight.get(sha);
+  const job = (async () => {
+    const wt = join(repoRoot, '.manager-wt', `baseline-${sha.slice(0, 12)}`);
+    let base = null;
+    try {
+      try { gitSync(repoRoot, ['worktree', 'remove', '--force', wt]); } catch { /* nothing to clean */ }
+      gitSync(repoRoot, ['worktree', 'add', '--detach', wt, sha]);
+      base = await runProjectTests(wt);
+    } catch {
+      // Worktree couldn't be made (odd repo / offline no-remote) — fall back to
+      // the registry dir in place = the pre-fix behaviour. Never worse.
+      try { base = await runProjectTests(dir); } catch { base = null; }
+    } finally {
+      try { gitSync(repoRoot, ['worktree', 'remove', '--force', wt]); } catch { /* best effort */ }
+    }
+    if (!base?.ran) return [];
+    const failingNames = base.failingNames ?? [];
+    try { writeFileSync(BASELINE_CACHE, JSON.stringify({ sha, failingNames, at: new Date().toISOString() })); } catch { /* best effort */ }
+    return failingNames;
+  })();
+  baselineInFlight.set(sha, job);
+  try { return await job; } finally { baselineInFlight.delete(sha); }
 }
 
 // ---- See all Ledger engine jobs (HANDOFF-v45 §5 / PRD §5.1) ----------------
@@ -2704,7 +2863,42 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   }
   const proofMissing = canCapture && uiTasks.length > 0 && !uiTasks.some((t) => t.proof);
   const proofFailing = canCapture && uiTasks.some((t) => t.proof && t.proof.pass === false);
-  const testsFailing = goal.testResult.ran && goal.testResult.failed > 0;
+  let testsFailing = goal.testResult.ran && goal.testResult.failed > 0;
+  // Baseline diff (Masa 2026-07-19): block ONLY on failures THIS change
+  // introduced. A test already red on the base — e.g. persist-failure on clean
+  // origin/main — is pre-existing noise and must not knock a proof-verified
+  // goal (#474/#494) or even a no-op goal (#465) back to blocked/Failed. Only
+  // consult the base when the goal's own run is red (keeps the green path free
+  // and pays the base run at most a few times a day, cached by base sha). An
+  // empty baseline = "unknown" → fall through to the old block-on-any-red.
+  // Only trust a baseline diff when the base is a genuinely SEPARATE checkout
+  // from the changed worktree. finishGoalIfComplete runs in the goal's own
+  // worktree (prProject.dir === the worktree), so the base must be the user's
+  // ORIGINAL project dir (on main ≈ origin/main, without this goal's change) —
+  // resolved from the registry, not the worktree-scoped project we were handed.
+  // When they'd be the same dir (shared-dir fallback, no isolated worktree) the
+  // "base" already contains this change, so fall back to the old block-on-any-
+  // red (fail closed).
+  const baseDir = projects.find((p) => p.id === goal.projectId)?.dir;
+  const canBaseline = baseDir && prProject?.dir && baseDir !== prProject.dir && existsSync(baseDir);
+  if (testsFailing && canBaseline) {
+    const baseline = await getBaselineFailures({ dir: baseDir });
+    if (baseline.length) {
+      const gate = classifyTestGate({ current: goal.testResult.failingNames ?? [], baseline });
+      goal.testResult.newFailures = gate.newFailures;
+      goal.testResult.preExisting = gate.preExisting;
+      if (!gate.blocked) {
+        testsFailing = false;
+        goal.testResult.preExistingOnly = true;
+        goalAct(`Project tests: ${gate.preExisting.length} failing test(s) were already red on the base (unrelated to this change), 0 new — not blocking. Pre-existing: ${gate.preExisting.slice(0, 3).join(' / ')}`);
+      } else {
+        goalAct(`Project tests: ${gate.newFailures.length} NEW failure(s) from this change (of ${goal.testResult.failed} total; ${gate.preExisting.length} pre-existing): ${gate.newFailures.slice(0, 3).join(' / ')}`);
+      }
+    }
+  }
+  // Count that drives the block message: the NEW failures when we could diff
+  // against the base, else the raw total (fail-closed when the base is unknown).
+  const blockingFailCount = goal.testResult.newFailures?.length ?? goal.testResult.failed;
   // §4補足: requireVerifyPass (opt-in, off by default) makes the gate strict —
   // EVERY task must carry a passing proof, not just UI tasks. Only ever tightens;
   // never conflicts with §6 (still can't reach Done without a human).
@@ -2722,16 +2916,19 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   if (testsFailing) {
     const failure = recordGoalFailure(goal, {
       kind: 'test',
-      reason: `テスト失敗 ${goal.testResult.failed} 件`,
+      reason: `テスト失敗 ${blockingFailCount} 件`,
       changedFiles,
       testResult: goal.testResult,
     });
+    const newFailList = goal.testResult.newFailures?.length
+      ? `Failures introduced by this change (fix ONLY these — pre-existing reds are not your fault):\n- ${goal.testResult.newFailures.join('\n- ')}`
+      : '';
     const used = Number(goal.autoRework?.testFailures ?? 0);
     if (used < MAX_AUTO_TEST_REWORKS) {
       goal.autoRework = {
         ...(goal.autoRework ?? {}),
         testFailures: used + 1,
-        lastReason: `テスト失敗 ${goal.testResult.failed} 件`,
+        lastReason: `テスト失敗 ${blockingFailCount} 件`,
         lastAt: new Date().toISOString(),
       };
       goal.blocked = null;
@@ -2739,7 +2936,8 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       saveGoal(goal);
       goalAct(`Tests failed; queued automatic worker feedback (${used + 1}/${MAX_AUTO_TEST_REWORKS}) with the failing output.`);
       queueReplyTask(goal, [
-        `Manager auto-feedback: npm test failed (${goal.testResult.failed} failing).`,
+        `Manager auto-feedback: npm test failed (${blockingFailCount} failing).`,
+        newFailList,
         failure?.whatHappened ? `What happened: ${failure.whatHappened}` : '',
         failure?.yourCall ?? 'Please inspect the failure output below, fix the regression, and rerun the project tests until they pass.',
         failure?.nextPolicy ? `Prevention policy: ${failure.nextPolicy}` : '',
@@ -2751,23 +2949,32 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       return;
     }
   }
-  if (testsFailing || proofMissing || proofFailing || verifyFail || nothingVerifiable) {
+  // Proof is advisory now (Masa 2026-07-19): proofMissing / proofFailing no
+  // longer block — the work is done; a screenshot that could not be captured or
+  // a pixel heuristic that could not auto-confirm the target is a NOTE on the
+  // review, not a Failed goal (audit false-failure #3/#2). The proof artifact
+  // (when there is one) is still attached for the human to look at. What still
+  // blocks: newly-failing tests, a promised-but-undone task, opt-in verifyFail.
+  const gate = classifyVerifyGate({ testsFailing, proofMissing, proofFailing, verifyFail, nothingVerifiable });
+  goal.proofNote = gate.proofAdvisory === 'missing'
+    ? 'UI変更ですが proof(スクショ/動画) を撮影できませんでした — 目視で確認してください'
+    : gate.proofAdvisory === 'unconfirmed'
+      ? 'proof は撮れましたが、依頼対象のUIを自動確認できませんでした — 目視で確認してください'
+      : null;
+  if (goal.proofNote) goalAct(`Proof advisory (not blocking): ${goal.proofNote}`);
+  if (gate.blocked) {
     if (!testsFailing) {
       recordGoalFailure(goal, {
-        kind: (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
-        reason: proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
-          : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
-          : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
+        kind: gate.kind,
+        reason: nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
           : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
         changedFiles,
         testResult: goal.testResult,
       });
     }
     goal.blocked = {
-      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
-      reason: testsFailing ? `テスト失敗 ${goal.testResult.failed} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
-        : proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
-        : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+      kind: gate.kind,
+      reason: testsFailing ? `テスト失敗 ${blockingFailCount} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
         : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
         : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
     };
@@ -2777,7 +2984,10 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     goal.blocked = null;
     if (goal.autoRework?.testFailures) goal.autoRework = { ...goal.autoRework, resolvedAt: new Date().toISOString() };
     goal.status = nextGoalStatus({ allDone, wantsPR: goal.wantsPR, allVerified, reviewDefinition });
-    goalAct(`Verification gate passed; moving goal to ${goal.status}.`);
+    const preNote = goal.testResult?.preExistingOnly
+      ? ` (${goal.testResult.preExisting?.length ?? 0} pre-existing test failure(s) ignored as unrelated to this change)`
+      : '';
+    goalAct(`Verification gate passed; moving goal to ${goal.status}.${preNote}${goal.proofNote ? ` [proof advisory: ${goal.proofNote}]` : ''}`);
   }
 }
 
@@ -3158,6 +3368,18 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // Per-project play/pause (Masa: Doing列の一時停止/再生・チャットからも同じ). POST
+  // .../pause stops in-flight Doing work + holds the queue; .../resume continues
+  // from where it left off. Broadcasts the projects change so every client's
+  // toggle updates. Idempotent: pausing an already-paused project is a 200 no-op.
+  const pauseMatch = url.pathname.match(/^\/api\/projects\/([\w-]+)\/(pause|resume)$/);
+  if (pauseMatch && req.method === 'POST') {
+    const project = projects.find((p) => p.id === pauseMatch[1]);
+    if (!project) return json(res, 404, { error: 'project not found' });
+    if (pauseMatch[2] === 'pause') pauseProject(project.id); else resumeProject(project.id);
+    return json(res, 200, { project, projects, paused: !!project.paused });
+  }
+
   // proof artifacts: /proof/<taskId>/<file> (gif/png/mp4 from that task's proof dir)
   const proofMatch = url.pathname.match(/^\/proof\/(\d+)\/([\w.-]+)$/);
   if (proofMatch) {
@@ -3187,6 +3409,21 @@ const server = createServer(async (req, res) => {
         const { projectId, text, pr, images, model, effort, source, pending, review, note, mode, skill, agent } = JSON.parse(body);
         const project = projects.find((p) => p.id === projectId);
         if (!project || !text?.trim()) return json(res, 400, { error: 'projectId and text required' });
+        // Chat-driven play/pause (Masa: "チャットで再生一時停止はおせる"). Deterministic
+        // (no LLM), checked BEFORE the intent router below: a short command-like
+        // "止めて"/"再開" toggles THIS project's pause state and returns a chat reply
+        // — it never becomes a To-Do. /later and /review skip this like the router.
+        if (!pending && !review) {
+          const pauseIntent = detectPauseIntent(text.trim());
+          if (pauseIntent === 'pause') {
+            pauseProject(projectId);
+            return json(res, 200, { kind: 'chat', reply: `${project.name} を一時停止しました。動いていた作業を止め、新しいToDoも始めません。再生（▶）で続きから再開します。` });
+          }
+          if (pauseIntent === 'resume') {
+            resumeProject(projectId);
+            return json(res, 200, { kind: 'chat', reply: `${project.name} を再開しました。止めた作業を続きから進めます。` });
+          }
+        }
         // Onboarding (docs/HANDOFF-ONBOARDING-conversational.md, SLICE 2): the
         // composer is conversation-first. A chat/help/settings message ("what can
         // you do?", "reply in English", a greeting) gets a conversational reply

package/engine/verify.mjs

@@ -129,10 +129,17 @@ export async function runVerification({ entryUrl, verify, outBase, record = true
     try {
       result = await verify(page, makeUiHelpers(page));
       if (!result || typeof result.pass !== 'boolean') {
-        result = { pass: false, detail: `verify script returned an invalid result: ${JSON.stringify(result).slice(0, 200)}` };
+        // The check did not produce a verdict — the VERIFIER is at fault, not
+        // necessarily the change. Mark inconclusive so the caller routes it to
+        // human review instead of scoring the worker's change as failed.
+        result = { pass: false, inconclusive: true, detail: `verify script returned an invalid result: ${JSON.stringify(result).slice(0, 200)}` };
       }
     } catch (e) {
-      result = { pass: false, detail: `verify script threw: ${String(e.message ?? e).slice(0, 300)}` };
+      // The check threw (e.g. an authored check referencing renderTasks/
+      // window.state that the booted app doesn't expose — goal #487). It never
+      // reached a real judgement, so this is inconclusive, NOT "the change is
+      // broken". The caller must not mark the task failed on this alone.
+      result = { pass: false, inconclusive: true, detail: `verify script threw: ${String(e.message ?? e).slice(0, 300)}` };
     }
     await sleep(1200); // keep the outcome on screen in the video
     if (recorder) await recorder.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.34",
+  "version": "0.10.36",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {