@galda/cli 0.10.43 → 0.10.45

package/app/index.html

@@ -2046,6 +2046,14 @@
   .redesign .rtag{letter-spacing:.02em;font-variant-numeric:tabular-nums}
   .redesign .rst{display:inline-flex;align-items:center;gap:6px;color:var(--ink2)}
   .redesign .rdot{width:6px;height:6px;border-radius:50%;background:var(--amber,#e0a021);display:inline-block}
+  /* reply → in-place "Working on it" (REVIEW-FEEDBACK-FLOW 決定1-4): a reply does NOT
+     dismiss the card. The header turns green "Working on it"; your line + the AI's one-line
+     voice live in the reply thread below the box (.replynote .wkline) so sending only appends
+     — no re-layout, no flash. */
+  .redesign .rst.working{color:var(--green)}
+  .redesign .rst.working .rdot{background:var(--green)}
+  .sa-item.working{box-shadow:0 1px 2px rgba(20,23,31,.05),0 0 0 1px color-mix(in oklab,var(--green) 22%,var(--hair))}
+  .replynote .wkline .wkdot{display:inline-block;width:7px;height:7px;border-radius:50%;background:var(--green);box-shadow:0 0 0 3px color-mix(in oklab,var(--green) 22%,transparent);margin-right:9px;vertical-align:middle;position:relative;top:-1px}
   .redesign .rtitle{font-family:var(--ui);font-size:18px;font-weight:680;letter-spacing:-.018em;line-height:1.3;margin:8px 0 0 !important;color:var(--ink)}
   /* meta — Linear sans, green/neutral chips, hairline under (spec §4) */
   .redesign .rmeta{display:flex;flex-wrap:wrap;align-items:center;gap:8px 12px;margin:12px 0 0 !important;padding-bottom:12px !important;
@@ -4748,7 +4756,7 @@ function renderTasks(){
   }
   for (const inp of $('tasklist').querySelectorAll('[data-qreplyinput]')) {
     inp.onclick = (e) => e.stopPropagation();
-    inp.onkeydown = (e) => { if (e.key === 'Enter') { e.preventDefault(); sendQReply(inp.dataset.qreplyinput, inp); } };
+    inp.onkeydown = (e) => { if (e.key === 'Enter' && !e.isComposing) { e.preventDefault(); sendQReply(inp.dataset.qreplyinput, inp); } };
   }
   // Pending rows open the same detail dialog as Review (tap anywhere but the
   // Start/Delete buttons, which stop propagation in their own handlers).
@@ -4872,7 +4880,7 @@ function startGoalheadEdit(id, btn){
   const save = async () => { const t = inp.value.trim(); if (!t) { wrap.remove(); return; }
     const r = await fetch(withKey(`/api/goals/${id}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: t }) });
     if (!r.ok) showErr('Cannot edit a running/finished goal — reply to append instead'); await refresh(); };
-  inp.onkeydown = (e) => { if (e.key === 'Enter') { e.preventDefault(); save(); } if (e.key === 'Escape') wrap.remove(); };
+  inp.onkeydown = (e) => { if (e.key === 'Enter' && !e.isComposing) { e.preventDefault(); save(); } if (e.key === 'Escape') wrap.remove(); };
 }
 // SL1 inline Reply: append an instruction to a started goal → POST /api/goals/:id/reply.
 function openGoalheadReply(id, btn){
@@ -4885,7 +4893,7 @@ function openGoalheadReply(id, btn){
   const send = async () => { const t = inp.value.trim(); if (!t) return;
     const r = await fetch(withKey(`/api/goals/${id}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: t }) });
     if (!r.ok) showErr('未開始のゴールは編集を使ってください'); await refresh(); };
-  inp.onkeydown = (e) => { if (e.key === 'Enter') { e.preventDefault(); send(); } if (e.key === 'Escape') wrap.remove(); };
+  inp.onkeydown = (e) => { if (e.key === 'Enter' && !e.isComposing) { e.preventDefault(); send(); } if (e.key === 'Escape') wrap.remove(); };
   snd.onclick = send;
 }
 
@@ -5620,9 +5628,19 @@ function paintReplyNote(){
 function paintSettledThreads(){
   for (const inp of document.querySelectorAll('#seeall .sa-chat[data-goal]')) {
     const goalId = Number(inp.dataset.goal);
-    loadReplyThread(goalId);
     if (replyNoteState?.goalId === goalId) continue;     // the live note draws its own history
-    const html = replyPastHtmlFor(goalId);
+    const item = typeof SA !== 'undefined' ? SA.items.find((x) => x.goalId === goalId) : null;
+    let html;
+    // A card with a live See-all conversation (it.rthread / a transient status) renders from
+    // its OWN client state — send-ordered, per-card, never re-fetched. This is what keeps
+    // replies from vanishing, reordering, or wiping another card (Masa 2026-07-24). A card
+    // with no client thread (reopened later) falls back to the server-persisted thread.
+    if (item && (item.rthread?.length || item.rstatus)) {
+      html = saCardThreadHtml(item);
+    } else {
+      loadReplyThread(goalId);
+      html = replyPastHtmlFor(goalId);
+    }
     if (!html) continue;
     const row = inp.closest('.sa-act') ?? inp.parentElement;
     if (!row?.parentElement) continue;
@@ -5630,6 +5648,8 @@ function paintSettledThreads(){
     el.className = 'qsub replynote';
     el.innerHTML = html;
     row.after(el);
+    // wire the unsure route chips (they carry the goal id so a repaint keeps them working)
+    for (const b of el.querySelectorAll('[data-rcgoal]')) b.onclick = () => saPickRoute(Number(b.dataset.rcgoal), b.dataset.rc);
   }
 }
 function setReplyNote(anchorSel, html, resolve){
@@ -5661,6 +5681,9 @@ function replyPastHtml(){
   return replyPastHtmlFor(goalId);
 }
 function replyPastHtmlFor(goalId){
+  // The SERVER-persisted thread (via:'review'). Used for a card reopened later (its client
+  // it.rthread is gone) and for the #reviewFixInput dialog. The live See-all card renders from
+  // its own client it.rthread (saCardThreadHtml) instead — see paintSettledThreads.
   const msgs = goalId == null ? [] : (replyThread[goalId] ?? []);
   return msgs.map((m) => (m.from === 'you' ? replySaidHtml(m.text)
     : m.from === 'ai' ? replyAnsweredHtml(m.text)
@@ -5679,12 +5702,68 @@ function replySaidHtml(you){
 function replyWaitHtml(label){
   return `<div class="txr note"><span class="w"></span><span class="m"><span class="shimmer">${esc(label)}</span></span></div>`;
 }
+// The settled AI voice for a `continue` reply (REVIEW-FEEDBACK-FLOW 決定2): replaces the
+// "Thinking…" line once the reply is picked up. A steady green dot (not a shimmer — it is
+// no longer waiting) beside the one-line voice; the card header turns "Working on it" too.
+function replyWorkingHtml(){
+  return `<div class="txr note wkline"><span class="w"></span><span class="m"><span class="wkdot"></span>Picking this back up — I'll be back when it's ready.</span></div>`;
+}
 function replyNoteRowHtml(body){
   return `<div class="txr note"><span class="w"></span><span class="m">${body}</span></div>`;
 }
 function replyAnsweredHtml(text){
   return `<div class="txr cl"><span class="w">Claude</span><span class="m">${esc(text)}</span></div>`;
 }
+// ── See-all card reply thread (unified, Masa 2026-07-24) ────────────────────────────────
+// One per-card model instead of the tangle of a single live note + server reloads that kept
+// losing/reordering lines. Each card owns its conversation in CLIENT state:
+//   it.rthread  = [{ who:'you'|'ai'|'note', text, seq }]  (rendered SORTED by seq, so send
+//                 order is preserved even when a reply's routing round-trip resolves late)
+//   it.rstatus  = 'thinking'|'answering'|'working'|'unsure'|null   (the transient trailer)
+//   it.rchoices = the four routes, when rstatus==='unsure'
+// It is never re-fetched (no reload flash) and never shared between cards (no cross-wipe).
+let saReplySeq = 0;
+function saNextSeq(){ return ++saReplySeq; }
+function saCardThreadHtml(it){
+  const rows = [...(it.rthread || [])].sort((a, b) => a.seq - b.seq).map((m) =>
+    m.who === 'you' ? replySaidHtml(m.text)
+    : m.who === 'ai' ? replyAnsweredHtml(m.text)
+    : replyNoteRowHtml(esc(m.text))).join('');
+  const trailer = it.rstatus === 'thinking' ? replyWaitHtml(REPLY_WAIT_ROUTING)
+    : it.rstatus === 'answering' ? replyWaitHtml(REPLY_WAIT_ANSWERING)
+    : it.rstatus === 'working' ? replyWorkingHtml()
+    : it.rstatus === 'unsure' ? (replyNoteRowHtml('Which one is this?')
+        + `<div class="qchips">${(it.rchoices || []).map((c) =>
+          `<button type="button" class="qchip" data-rc="${esc(c)}" data-rcgoal="${it.goalId}">${esc(REPLY_CHOICE_LABEL[c] ?? c)}</button>`).join('')}</div>`)
+    : '';
+  return rows + trailer;
+}
+// Seed a card's client thread from the server-persisted conversation the FIRST time we reply
+// to it. Without this, a card that already has history (its client it.rthread is empty — the
+// normal state right after a page reload, or a card reopened later) would render only the new
+// line the moment you reply, and the earlier replies would vanish (Masa 2026-07-24). Seeded
+// rows get their seq in server order (before this reply's), so the thread reads oldest→newest.
+async function saEnsureThread(it){
+  if (!it || it.rthread) return;
+  let msgs = replyThread[it.goalId];
+  if (msgs === undefined) {
+    try { const j = await (await fetch(withKey(`/api/goals/${it.goalId}/messages`))).json(); msgs = (j.messages ?? []).filter((m) => m.via === 'review'); replyThread[it.goalId] = msgs; }
+    catch { msgs = []; }
+  }
+  it.rthread = (msgs || []).map((m) => ({ who: (m.from === 'ai' || m.from === 'manager') ? 'ai' : 'you', text: m.text, seq: saNextSeq() }));
+}
+// Poll a goal's conversation for the next AI/manager line after `seen` (an answer, §1.3 —
+// there is no task to watch, it arrives as a message). Returns the text, or '' on timeout.
+async function saPollAnswer(goalId, seen){
+  for (let i = 0; i < 120; i++) {
+    await new Promise((r) => setTimeout(r, 1000));
+    let msgs = [];
+    try { msgs = (await (await fetch(withKey(`/api/goals/${goalId}/messages`))).json()).messages ?? []; } catch { continue; }
+    const said = msgs.slice(seen).find((m) => m.from === 'ai' || m.from === 'manager');
+    if (said) return said.text;
+  }
+  return '';
+}
 // Sent, and nothing decided yet. Shown immediately — the wait is real (a routing
 // call, then the answer), so the honest thing is to say it is thinking, not to
 // pretend the reply landed somewhere it has not.
@@ -5778,7 +5857,7 @@ async function sendReviewReject(){
 $('reviewDismiss').onclick = () => sendReviewReject();
 $('reviewFixSend').onclick = () => { const t = $('reviewFixInput').value.trim(); if (t || reviewAttach.length) sendReviewDismiss(t); };
 $('reviewFixInput').addEventListener('keydown', (e) => {
-  if (e.key === 'Enter') { const t = $('reviewFixInput').value.trim(); if (t || reviewAttach.length) sendReviewDismiss(t); }
+  if (e.key === 'Enter' && !e.isComposing) { const t = $('reviewFixInput').value.trim(); if (t || reviewAttach.length) sendReviewDismiss(t); }
 });
 $('reviewFixImg').onclick = () => $('reviewFixFile').click();
 $('reviewFixFile').addEventListener('change', async () => {
@@ -6934,7 +7013,7 @@ function inlineFsRename(span, onCommit){
     if (changed) onCommit?.(v);
     span.removeEventListener('keydown', onKey); span.removeEventListener('keyup', onKeyUp); span.removeEventListener('blur', onBlur); };
   const onKey = (ev) => { ev.stopPropagation();
-    if (ev.key === 'Enter') { ev.preventDefault(); finish(true); span.blur(); }
+    if (ev.key === 'Enter' && !ev.isComposing) { ev.preventDefault(); finish(true); span.blur(); }
     else if (ev.key === 'Escape') { ev.preventDefault(); finish(false); span.blur(); } };
   const onKeyUp = (ev) => { ev.stopPropagation(); };
   const onBlur = () => finish(true);
@@ -8779,7 +8858,10 @@ function saWorkflowHtml(it){
   return '<div class="rwf">' + steps.map(([s, st]) => `<div class="wf-s ${st}"><span class="mk">${st === 'ok' ? '✓' : st === 'now' ? '→' : '□'}</span>${s}</div>`).join('') + '</div>';
 }
 function saItemHtml(it, i){
-  const done = { 1: ['ok', '✓', 'Approved'], 2: ['no', '↩', 'Dismissed'], 3: ['no', '↩', 'Feedback sent — returned to To Do'], 4: ['ar', '—', 'Archived'], 5: ['no', '↩', 'Reverted — change undone'] }[it.st];
+  // st===3 is NOT a terminal row (REVIEW-FEEDBACK-FLOW 決定3): a reply is not a dismissal.
+  // The old sa-done "feedback returned to To Do" line is gone; st===3 now renders the full
+  // card in its "Working on it" state (see `working` below). Terminal rows: 1/2/4/5 only.
+  const done = { 1: ['ok', '✓', 'Approved'], 2: ['no', '↩', 'Dismissed'], 4: ['ar', '—', 'Archived'], 5: ['no', '↩', 'Reverted — change undone'] }[it.st];
   if (done) {
     // Revert deliberately has NO undo: the PR is closed and its branch deleted —
     // an "UNDO" here would be a lie (HANDOFF-v45 §5.3 honesty over symmetry).
@@ -9004,8 +9086,17 @@ function saItemHtml(it, i){
     ? `<section class="rsec rconv"><div class="rsec-h">Conversation</div><details class="lacc" data-detkey="${gk}:msg" data-msgs="${it.goalId}"${msgOpen}><summary><i class="ltog">›</i><div class="rtx lfirst">${msgSummary}</div></summary><div class="lbody"><div class="rtx" data-msgbody="${it.goalId}">${msgBody}</div></div></details></section>`
     : '';
   const S = (label, body) => body ? `<section class="rsec"><div class="rsec-h">${label}</div>${body}</section>` : '';
-  return `<div class="sa-item lg redesign${it.goalId === SA.cur ? ' cur' : ''}" data-gid="${it.goalId}">
-    <div class="rhead"><span class="rtag">${it.no != null ? `#${it.no}` : ''}</span><span class="rst"><span class="rdot"></span>In review</span></div>
+  // st===3 = a reply was sent and the goal is being picked back up (REVIEW-FEEDBACK-FLOW
+  // 決定1-4). The card is NOT collapsed: it stays open and the header reads "Working on it".
+  // Your reply + the AI's one-line voice ("Picking this back up…") live in the reply thread
+  // BELOW the box (the same .replynote surface the answer flow uses) — so sending only APPENDS
+  // a line and never re-lays-out the card. It leaves Review only when the card is closed.
+  const working = it.st === 3;
+  const rst = working
+    ? '<span class="rst working"><span class="rdot"></span>Working on it</span>'
+    : '<span class="rst"><span class="rdot"></span>In review</span>';
+  return `<div class="sa-item lg redesign${it.goalId === SA.cur ? ' cur' : ''}${working ? ' working' : ''}" data-gid="${it.goalId}">
+    <div class="rhead"><span class="rtag">${it.no != null ? `#${it.no}` : ''}</span>${rst}</div>
     <h2 class="rtitle">${esc(it.title)}</h2>
     ${meta}
     ${reqSec}
@@ -9149,7 +9240,10 @@ function saSync(){
   const rows = saRows();
   for (const row of rows) {
     const ex = SA.items.find((x) => x.goalId === row.goalId);
-    if (ex) { const st = ex.st, inflight = ex.inflight; Object.assign(ex, row); ex.st = (st > 0 && !inflight) ? 0 : st; }
+    // Preserve st===3 ("Working on it", 決定1-4): a reply held the card open in place; if a
+    // tick still saw it as 'review' before the /dismiss→running upsert landed, resetting st
+    // would snap the card back to "In review". Terminal verdicts (1/2/4/5) reset as before.
+    if (ex) { const st = ex.st, inflight = ex.inflight; Object.assign(ex, row); ex.st = (st > 0 && st !== 3 && !inflight) ? 0 : st; }
     else SA.items.push({ ...row, st: 0 });
   }
   saRender();
@@ -9230,49 +9324,111 @@ async function saCall(ids, path, body){
   }
   return r;
 }
-// The review card's reply box (§1.3/§1.4). It says "Reply, ask, or send back" —
-// until now all three did the same thing: sent the goal back to be redone.
-//
-// Unlike saAct this does NOT show its outcome first. "Feedback sent — returned to
-// To Do" is a lie when the reply was a question, and an optimistic lie is worse
-// than a moment of waiting: the card would say the work was sent back while the
-// goal sat untouched in review.
+// The review card's reply box (§1.3/§1.4). The reply is routed by the AI itself
+// (outcome:'auto', ONE-CONVERSATION §1.4) — this layer never guesses continue vs
+// question. Unlike saAct it does NOT show its outcome first: "Feedback sent" would
+// be a lie when the reply was a question.
 async function saReplyCall(it, text, outcome){
   const r = await saCall(it.ids, 'dismiss', { text, outcome });
   if (!r?.ok) throw new Error('reply failed');
   return r.json().catch(() => null);
 }
+function saCardEl(goalId){ return document.querySelector(`#seeall .sa-item[data-gid="${goalId}"]`); }
+// Flip one card to its "Working on it" head without redrawing anything else (決定2).
+function saFlipWorking(goalId){
+  const card = saCardEl(goalId);
+  if (!card) return;
+  card.classList.add('working');
+  const rst = card.querySelector('.rhead .rst');
+  if (rst) { rst.className = 'rst working'; rst.innerHTML = '<span class="rdot"></span>Working on it'; }
+}
+// Repaint one card's reply thread IN PLACE from its client state — no saRender, so nothing
+// above the box moves. Header is flipped to "Working on it" iff the card is in that state,
+// and the cursor is kept in this box (a blurred box would let an SSE tick fire a full
+// saRender = a flash). Everything the reply UI does routes through here.
+function saPaintCard(goalId){
+  const it = SA.items.find((x) => x.goalId === goalId);
+  if (it?.rstatus === 'working') saFlipWorking(goalId);
+  paintReplyNote();   // clears + repaints every card's thread via paintSettledThreads
+  saCardEl(goalId)?.querySelector('.sa-chat')?.focus({ preventScroll: true });
+}
+// A reply is "one more line in the conversation" (REVIEW-FEEDBACK-FLOW 決定1-4), NOT a verdict.
+// Every reply is appended to the card's OWN client thread (it.rthread) in send order and shown
+// in place — no saRender (no flash/shift), no shared live note (no cross-card wipe), no lost
+// line (a follow-up while the AI is working goes via /reply, which accepts a running goal, so
+// it never 409s). The FIRST reply on a fresh review card is routed by the AI (answer / unsure /
+// continue, §1.3/§1.4); a follow-up on a card already in conversation is always another
+// instruction (continue).
 async function saSendReply(it, i, text){
   const goalId = it.goalId;
-  // By goal, not by row index: the list re-sorts while the AI is thinking, and an
-  // index-based anchor then points at someone else's card (or nothing).
-  const sel = `.sa-chat[data-goal="${goalId}"]`;
+  await saEnsureThread(it);              // fold in any existing history BEFORE this reply (so it isn't hidden)
+  const seq = saNextSeq();               // reserve send order NOW, so a late-resolving route keeps its place
+  // Clear the box in place — keep it FOCUSED, not blurred (saSync skips a rebuild while an
+  // input in #seeall has focus, which is what keeps an SSE tick from flashing the panel).
+  document.querySelectorAll(`#seeall .sa-item[data-gid="${goalId}"] .sa-chat`).forEach((inp) => { inp.value = ''; });
+  // Append the line to the card's own thread immediately — this is what the person sees, and
+  // its `seq` fixes its order regardless of when any round trip returns.
+  it.rthread = [...(it.rthread || []), { who: 'you', text, seq }];
+  const followUp = it.st === 3 || it.inflight;   // card already in conversation → another instruction
+
+  if (followUp) {
+    it.st = 3; it.rstatus = 'working'; SA.cur = goalId;
+    saPaintCard(goalId);
+    try {
+      const r = await fetch(withKey(`/api/goals/${goalId}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text }) });
+      if (!r.ok) throw new Error('reply failed');
+    } catch {
+      it.rthread = it.rthread.filter((m) => m.seq !== seq);   // roll back just this line
+      if (!it.rthread.some((m) => m.who === 'you')) { it.st = 0; it.rstatus = null; }
+      saPaintCard(goalId); showErr('Reply failed.');
+    }
+    return;
+  }
+
+  // First reply: route it. Show "Thinking…" under the line while the AI decides.
   const seen = state.goals.find((g) => g.id === goalId)?.messageCount ?? 0;
-  it.inflight = true; saRender();
-  showReplySent(sel, text, goalId);   // BEFORE the round trip — this is the ~7s that felt broken
+  it.inflight = true; it.rstatus = 'thinking'; SA.cur = goalId;
+  saPaintCard(goalId);
   try {
     let body = await saReplyCall(it, text, 'auto');
     if (body?.outcome === 'unsure') {
-      it.inflight = false; saRender();
-      const picked = await askReplyDestination(sel, body.choices);
-      if (!picked) return;                       // nothing was touched; the words stay in the box
-      it.inflight = true; saRender();
+      it.inflight = false; it.rstatus = 'unsure'; it.rchoices = body.choices || REPLY_OUTCOMES_CLIENT;
+      saPaintCard(goalId);
+      const picked = await new Promise((resolve) => { it._routeResolve = resolve; });
+      it._routeResolve = null;
+      if (!picked) {                                // cancelled: drop this line, revert the card
+        it.rthread = it.rthread.filter((m) => m.seq !== seq); it.rstatus = null;
+        if (!it.rthread.length) it.st = 0;
+        saPaintCard(goalId); return;
+      }
+      it.inflight = true; it.rstatus = 'thinking'; saPaintCard(goalId);
       body = await saReplyCall(it, text, picked);
     }
     it.inflight = false;
-    if (body?.outcome === 'answer') {
-      // The goal never moved, so the card stays exactly where it is — and the
-      // answer appears under the box that asked for it.
-      saRender();
-      showAnswerWhenItArrives(sel, goalId, seen + 1);
+    if (body?.outcome === 'answer') {              // a question: the AI answers, the goal never moves
+      it.rstatus = 'answering'; saPaintCard(goalId);
+      const ans = await saPollAnswer(goalId, seen + 1);
+      it.rthread = [...it.rthread, { who: 'ai', text: ans || 'No answer came back.', seq: saNextSeq() }];
+      it.rstatus = null; saPaintCard(goalId);
       return;
     }
-    it.st = 3; saSync(); saAdvanceFocus(goalId);
+    // continue: the card is now "Working on it".
+    it.st = 3; it.rstatus = 'working'; SA.cur = goalId;
+    saPaintCard(goalId);
   } catch {
-    it.inflight = false; saRender();
-    showErr('Action failed.');
+    it.inflight = false;
+    it.rthread = it.rthread.filter((m) => m.seq !== seq);
+    if (!it.rthread.length) it.rstatus = null;
+    saPaintCard(goalId); showErr('Action failed.');
   }
 }
+// The unsure chips resolve the pending route (see saSendReply's Promise). Kept keyed by goal
+// so a repaint (which re-creates the buttons) still lands on the right pending reply.
+const REPLY_OUTCOMES_CLIENT = ['continue', 'rescope', 'split', 'answer'];
+function saPickRoute(goalId, route){
+  const it = SA.items.find((x) => x.goalId === goalId);
+  if (it?._routeResolve) it._routeResolve(route);
+}
 // one action round-trip: optimistic one-liner → endpoint → settle or roll back
 async function saAct(it, st, path, body){
   it.st = st; it.inflight = true; saRender();
@@ -9586,7 +9742,7 @@ $('ctxdirmenu').addEventListener('click', (e) => {
 });
 $('ctxdirmenu').addEventListener('keydown', (e) => {
   e.stopPropagation();
-  if (e.key === 'Enter' && e.target.id === 'ctxdirin') { e.preventDefault(); setProjectFolder(e.target.value); }
+  if (e.key === 'Enter' && !e.isComposing && e.target.id === 'ctxdirin') { e.preventDefault(); setProjectFolder(e.target.value); }
 });
 $('appbtn').onclick = (e) => { e.stopPropagation(); $('appmenu').classList.toggle('show'); };
 $('appmenu').addEventListener('click', (e) => {

package/engine/lib.mjs

@@ -1158,6 +1158,49 @@ export function isInconclusiveTestRun({ ran = false, timedOut = false, passed =
   return Boolean(ran) && Boolean(timedOut) && !realAssertion && passed === 0;
 }
 
+// Infra failures the review gate must NOT block real work on. A test that stands
+// up a real server/headless Chrome fails these ways under WHOLE-MACHINE
+// saturation (prod :4400 + several agent sessions + the baseline run all live at
+// once — which --test-concurrency=1 inside one suite cannot prevent, the load is
+// from OTHER processes): the server dies during boot ("server exited (code N)
+// before it was ready"), misses its window ("did not report ready in time"), or a
+// puppeteer wait/navigation times out. None is the goal's code regressing, and
+// they SHUFFLE to a different set of tests each run, so classifyTestGate's
+// name-diff can never subtract them. Count them so a run can discount them.
+export function countInfraFlakes(text = '') {
+  const pats = [
+    /server exited \(code \d+\) before it was ready/g, // test helper: server crashed on boot under load
+    /did not report ready in time/g,                   // test helper: server missed its startup window
+    /Waiting failed: \d+\s*ms exceeded/g,              // puppeteer waitForFunction/Selector
+    /Navigation timeout of \d+\s*ms exceeded/g,        // puppeteer page.goto
+    /test timed out after \d+\s*ms/g,                  // node --test per-test timeout
+    /\bTarget closed\b/g,                              // puppeteer: browser died mid-test
+  ];
+  return pats.reduce((n, re) => n + (String(text ?? '').match(re) || []).length, 0);
+}
+
+// Decide how many of a test run's failures are REAL (should block Review) vs
+// infra flakes (countInfraFlakes above). The old runTestsOnce let a SINGLE
+// "expected … to" match anywhere in megabytes of output (realAssertion=true)
+// disable the infra discount for ALL failures — which is exactly why 93 boot
+// failures ("server exited (code 1) before it was ready", 650 passed) blocked
+// goals #616/#620 (2026-07-24): every failure was infra, yet realAssertion
+// tripped on stray text and none was discounted.
+//   - infraOnly: every counted failure is an infra flake (infraFlakes covers the
+//     whole count) → block on none, regardless of a stray assertion string. If a
+//     REAL assertion failure existed it would be an ADDITIONAL failure not covered
+//     by the infra count, so infraFlakes < failedTotal and we fall through.
+//   - a real assertion sharing a mixed run → fail CLOSED on the full count.
+//   - otherwise → discount the infra flakes from the total.
+export function classifyRunFailures({ failedTotal = 0, infraFlakes = 0, realAssertion = false } = {}) {
+  const ft = Math.max(0, Number(failedTotal) || 0);
+  const inf = Math.max(0, Number(infraFlakes) || 0);
+  if (ft <= 0) return { effectiveFailed: 0, infraOnly: false };
+  if (inf >= ft) return { effectiveFailed: 0, infraOnly: true };
+  if (realAssertion) return { effectiveFailed: ft, infraOnly: false };
+  return { effectiveFailed: Math.max(0, ft - inf), infraOnly: false };
+}
+
 // The verification-gate decision (Masa 2026-07-19: "検証/proof は Failed を作らない").
 // PROOF IS ADVISORY: a UI goal whose screenshot could not be captured
 // (proofMissing) or whose pixel heuristic could not auto-confirm the target

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
 import { openPR } from './pr.mjs';
@@ -2475,15 +2475,21 @@ function runTestsOnce(dir) {
       const n = (re) => { const m = text.match(re); return m ? Number(m[1]) : null; };
       const passed = n(/ℹ pass (\d+)/) ?? n(/# pass (\d+)/) ?? n(/(\d+) passing/) ?? 0;
       const failedTotal = n(/ℹ fail (\d+)/) ?? n(/# fail (\d+)/) ?? n(/(\d+) failing/) ?? (e ? 1 : 0);
-      // Don't block on INFRA flakes: the integration suite spawns real servers,
-      // and under load (prod + several worker goals running) a server can miss
-      // its startup window ("did not report ready in time"). That's not a code
-      // regression. BUT fail CLOSED: only discount those timeouts when NO real
-      // assertion failed. A genuine AssertionError sharing a run with a timeout
-      // must still block — never let arithmetic subtraction mask a real failure.
-      const timeoutFlakes = (text.match(/did not report ready in time/g) || []).length;
+      // Don't block on INFRA flakes: the integration suite spawns real servers +
+      // headless Chrome, and under WHOLE-MACHINE saturation (prod :4400 + several
+      // agent sessions + the baseline run) a server dies on boot ("server exited
+      // (code N) before it was ready"), misses its window ("did not report ready
+      // in time"), or a puppeteer wait times out — none a code regression, and
+      // they shuffle to different tests each run. countInfraFlakes tallies them;
+      // classifyRunFailures decides how many failures are REAL. Fail CLOSED: a
+      // real AssertionError sharing a MIXED run still blocks (infraFlakes <
+      // failedTotal). Only when EVERY failure is infra (infraOnly) do we discount
+      // despite a stray "expected … to" match — the coarse global realAssertion
+      // flag is exactly what stranded #616/#620 (93 boot failures, all discountable,
+      // yet realAssertion tripped on unrelated text and blocked them).
+      const infraFlakes = countInfraFlakes(text);
       const realAssertion = /AssertionError|Expected values to be|expected .+ (?:to |but )/i.test(text);
-      const failed = realAssertion ? failedTotal : Math.max(0, failedTotal - timeoutFlakes);
+      const { effectiveFailed: failed, infraOnly } = classifyRunFailures({ failedTotal, infraFlakes, realAssertion });
       // Was the run KILLED at the execFile timeout (machine too saturated to
       // finish), rather than exiting on its own? execFile sets killed=true and
       // signal='SIGTERM' on timeout. That is the inconclusive signal — a normal
@@ -2492,7 +2498,7 @@ function runTestsOnce(dir) {
       const timedOut = Boolean(e && (e.killed || e.signal === 'SIGTERM' || e.code === 'ETIMEDOUT'));
       // Capture the failing test NAMES too (not just the count) so the gate can
       // diff them against the base's failures and block only on NEW ones.
-      res({ passed, failed, timedOut, realAssertion, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
+      res({ passed, failed, timedOut, realAssertion, infraOnly, infraFlakes, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
     });
   }));
 }
@@ -2516,11 +2522,16 @@ async function runProjectTests(dir) {
       // a real red in either run still fails closed.
       timedOut: Boolean(r.timedOut && r2.timedOut),
       realAssertion: r.realAssertion || r2.realAssertion,
+      // infra state from the run we keep (the one with fewer real failures): if
+      // its failures were all infra flakes (infraOnly → failed 0), that is what
+      // the gate should see, so no good goal is blocked on a saturated boot.
+      infraOnly: !!kept.infraOnly,
+      infraFlakes: kept.infraFlakes ?? 0,
       detail: kept.detail || r.detail || r2.detail || '',
       failingNames: kept.failingNames ?? r.failingNames ?? [],
     };
   }
-  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, timedOut: !!r.timedOut, realAssertion: !!r.realAssertion, infraOnly: !!r.infraOnly, infraFlakes: r.infraFlakes ?? 0, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
 }
 
 // Failing tests on the BASE (pre-change) checkout — the set the review gate
@@ -2982,6 +2993,15 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     goal.testResult.inconclusive = true;
     goalAct('Project tests could not complete — the suite was killed before finishing (0 passed, no real assertion), which means the machine was too saturated to run them, not a code failure. Treating as inconclusive, not blocking. Re-run the tests when the machine is idle to confirm.');
   }
+  // Infra-only run (root fix for #616/#620, 2026-07-24): the suite finished but
+  // EVERY failure was an infra flake (a real server could not boot — "server
+  // exited (code N) before it was ready" — or a wait timed out under whole-machine
+  // saturation), so runProjectTests already discounted them to 0. testsFailing is
+  // therefore already false; surface it as an advisory so the human knows the
+  // suite couldn't be trusted here (not that it ran green), and can re-run idle.
+  if (goal.testResult.ran && goal.testResult.infraOnly && !goal.testResult.inconclusive) {
+    goalAct(`Project tests: all ${goal.testResult.infraFlakes || goal.testResult.failed || ''} failure(s) were infra flakes (a real server could not boot / a wait timed out under machine load), not code regressions — not blocking. Re-run when the machine is idle to confirm.`.replace(/\s{2,}/g, ' '));
+  }
   // Baseline diff (Masa 2026-07-19): block ONLY on failures THIS change
   // introduced. A test already red on the base — e.g. persist-failure on clean
   // origin/main — is pre-existing noise and must not knock a proof-verified

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.43",
+  "version": "0.10.45",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {