@galda/cli 0.10.69 → 0.10.70

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
@@ -611,6 +611,71 @@ function uniqueProjectId(name = 'project') {
 const logDir = join(DATA_DIR, 'chat-runs');
 mkdirSync(logDir, { recursive: true });
 const logFile = join(logDir, 'tasks.jsonl');
+const internalQualityEventsFile = join(logDir, 'internal-quality-events.jsonl');
+const internalQualityEventKeys = new Set();
+function internalQualityKey(e) {
+  const subject = e.goalId != null ? `g${e.goalId}` : e.taskId != null ? `t${e.taskId}` : 'global';
+  const status = e.status ? `:${e.status}` : '';
+  return `${e.type}:${subject}${status}`;
+}
+function appendInternalQualityEvent(e, { once = true } = {}) {
+  const safe = {
+    type: String(e.type || ''),
+    at: e.at || new Date().toISOString(),
+    goalId: e.goalId ?? undefined,
+    taskId: e.taskId ?? undefined,
+    projectId: e.projectId ?? undefined,
+    status: e.status ?? undefined,
+    category: e.category ?? undefined,
+    agent: e.agent ?? undefined,
+  };
+  if (!safe.type) return;
+  const key = internalQualityKey(safe);
+  if (once && internalQualityEventKeys.has(key)) return;
+  internalQualityEventKeys.add(key);
+  try { appendFileSync(internalQualityEventsFile, JSON.stringify(safe) + '\n'); }
+  catch (err) { console.error(`[manager] internal quality event write failed (${err?.code || err})`); }
+}
+function readInternalQualityEvents() {
+  try {
+    return readFileSync(internalQualityEventsFile, 'utf8')
+      .split('\n')
+      .filter(Boolean)
+      .map((line) => JSON.parse(line));
+  } catch {
+    return [];
+  }
+}
+for (const e of readInternalQualityEvents()) internalQualityEventKeys.add(internalQualityKey(e));
+function emitGoalQualityEvents(g) {
+  if (!g || g.id == null) return;
+  appendInternalQualityEvent({ type: 'goal_created', goalId: g.id, projectId: g.projectId, at: g.createdAt });
+  if (g.status === 'running' && g.startedAt) appendInternalQualityEvent({ type: 'goal_doing_started', goalId: g.id, projectId: g.projectId, at: g.startedAt });
+  if (g.status === 'review') appendInternalQualityEvent({ type: 'goal_review_reached', goalId: g.id, projectId: g.projectId });
+  if (['failed', 'blocked', 'interrupted', 'partial'].includes(g.status)) {
+    appendInternalQualityEvent({ type: 'goal_failed', goalId: g.id, projectId: g.projectId, status: g.status });
+  }
+  if (g.status === 'folded') appendInternalQualityEvent({ type: 'goal_folded', goalId: g.id, projectId: g.projectId });
+  if (g.status === 'reverted') appendInternalQualityEvent({ type: 'goal_reverted', goalId: g.id, projectId: g.projectId });
+}
+function emitTaskQualityEvents(t) {
+  if (!t || t.id == null) return;
+  appendInternalQualityEvent({ type: 'task_created', taskId: t.id, goalId: t.goalId, projectId: t.projectId, at: t.createdAt });
+  if (t.status === 'running') appendInternalQualityEvent({ type: 'task_doing_started', taskId: t.id, goalId: t.goalId, projectId: t.projectId, at: t.startedAt, agent: t.agent });
+  if (t.status === 'skipped') appendInternalQualityEvent({ type: 'task_skipped', taskId: t.id, goalId: t.goalId, projectId: t.projectId, at: t.finishedAt });
+  if (['done', 'failed', 'interrupted', 'skipped'].includes(t.status)) {
+    appendInternalQualityEvent({
+      type: 'task_finished',
+      taskId: t.id,
+      goalId: t.goalId,
+      projectId: t.projectId,
+      status: t.status,
+      category: classifyInternalQualityTaskError(t),
+      agent: t.agent,
+      at: t.finishedAt,
+    });
+  }
+}
 
 // Per-project workflow columns (task 44: the Tasks-panel column editor).
 // Column names/order are cosmetic; every column still maps to one of the
@@ -791,7 +856,11 @@ function logAppend(line) {
   try { appendFileSync(logFile, line + '\n'); markSyncDirty(); return true; }
   catch (e) { console.error(`[manager] log write failed (${e?.code || e}) — state not persisted this write, UI still updated`); return false; }
 }
-function saveGoal(g) { logAppend(JSON.stringify({ ...g, kind: 'goal' })); sendGoalEvent({ ev: 'goal', goal: g }, g); }
+function saveGoal(g) {
+  emitGoalQualityEvents(g);
+  logAppend(JSON.stringify({ ...g, kind: 'goal' }));
+  sendGoalEvent({ ev: 'goal', goal: g }, g);
+}
 // Persist the orphan-goal reclassification computed right after replayQueueLog
 // above (deferred to here because saveGoal/send/sseClients don't exist yet at
 // that point in the module) — writes it to the restart-safe log so it settles
@@ -849,6 +918,7 @@ function readGoalMessages(goalId) {
 }
 
 function saveTask(t) {
+  emitTaskQualityEvents(t);
   // freeze BEFORE the destructure strips `activity`, and mark the task so the UI knows a
   // log exists without having to ask for one that was never written.
   if (freezeActivityLog(t)) t.activityLog = true;
@@ -1106,10 +1176,7 @@ function rebuildQueuesAfterAdopt() {
     reconcileQueuedGoalStarts(p.id);
     queues.get(p.id).waiting.push(...pending);
     pump(p.id);
-    for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
-      g.status = 'planning'; saveGoal(g);
-      planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
-    }
+    startNextStacked(p.id);
   }
 }
 
@@ -1249,6 +1316,56 @@ function runWorkerAgent({ agent, ...args }) {
   return workerAgent(agent) === 'codex' ? runCodex(args) : runClaude(args);
 }
 
+function collectWorkerSkills(dir) {
+  const home = homedir();
+  return collectSkills([
+    { dir: join(home, '.claude', 'skills'), source: 'user', kind: 'skill' },
+    { dir: join(home, '.claude', 'commands'), source: 'user', kind: 'command' },
+    { dir: join(dir, '.claude', 'skills'), source: 'project', kind: 'skill' },
+    { dir: join(dir, '.claude', 'commands'), source: 'project', kind: 'command' },
+  ]);
+}
+
+function collectWorkerMcpSettings(dir) {
+  const candidates = [
+    '.mcp.json',
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    '.codex/config.toml',
+  ];
+  return candidates
+    .filter((name) => existsSync(join(dir, name)))
+    .map((name) => `${name}: present`);
+}
+
+function workerRunContext({ goal, task, agent, model, effort, permissionMode, cwd, resumeSession, plan }) {
+  const projectRules = collectProjectRules(cwd, (dir, name) => {
+    try { return readFileSync(join(dir, name), 'utf8'); } catch { return null; }
+  }).map((f) => ({ name: f.name }));
+  return {
+    agentName: workerAgent(agent),
+    model,
+    effort,
+    permissionMode,
+    cwd,
+    resumeSession,
+    sessionMode: plan?.sessionMode,
+    projectRules,
+    skills: collectWorkerSkills(cwd),
+    mcpSettings: collectWorkerMcpSettings(cwd),
+    images: goal?.images ?? [],
+    selectedSkill: task?.skill ?? goal?.skill ?? null,
+  };
+}
+
+function sendWorkerContextAct(task, context) {
+  const rules = context.projectRules?.map((r) => r.name).join(', ') || 'CLAUDE.md/AGENTS.md not detected';
+  const skills = context.skills?.length ? `${context.skills.length} available` : 'not detected';
+  const mcp = context.mcpSettings?.join(', ') || 'not detected or not introspected';
+  const session = context.resumeSession ? `resume ${context.resumeSession}` : (context.sessionMode || 'fresh');
+  sendProcessAct(task, `Context inherited: agent=${context.agentName}, model=${context.model}, effort=${context.effort}, session=${session}, cwd=${context.cwd}, rules=${rules}, skills=${skills}, MCP/settings=${mcp}, images=${context.images?.length || 0}.`);
+}
+
 // Track worker (and planner) children per goal so a goal can be cancelled by
 // SIGTERMing exactly its own child(ren) — never another goal's, and never a
 // user process. The child auto-unregisters on close.
@@ -1297,6 +1414,37 @@ function gitSync(cwd, args) {
   if (r.status !== 0) throw new Error(`git ${args.join(' ')}: ${(r.stderr || r.stdout || '').trim().slice(0, 200)}`);
   return r.stdout.trim();
 }
+function gitSyncOrNull(cwd, args) {
+  try { return gitSync(cwd, args); } catch { return null; }
+}
+function gitStatusPaths(lines = []) {
+  return [...new Set((lines ?? []).map((line) => String(line).slice(3).trim()).filter(Boolean))];
+}
+function newAttemptId(goal, task) {
+  return `goal-${goal?.id ?? 'none'}-task-${task.id}-${Date.now()}-${randomBytes(3).toString('hex')}`;
+}
+function noteGoalTaskBaseline(goal, project, workDir, before) {
+  if (!goal || goal.prBaseline) return;
+  const repoRoot = gitSyncOrNull(workDir, ['rev-parse', '--show-toplevel']);
+  const branch = repoRoot ? gitSyncOrNull(workDir, ['branch', '--show-current']) : null;
+  const head = repoRoot ? gitSyncOrNull(workDir, ['rev-parse', 'HEAD']) : null;
+  let aheadOfDefault = 0;
+  if (repoRoot) {
+    const defaultBranch = repoDefaultBranch(workDir);
+    aheadOfDefault = Number(gitSyncOrNull(workDir, ['rev-list', '--count', `origin/${defaultBranch}..HEAD`])) || 0;
+  }
+  goal.prBaseline = {
+    workDir,
+    projectDir: project?.dir ?? null,
+    sharedCheckout: goal.worktree === false || workDir === project?.dir,
+    dirtyFiles: gitStatusPaths(before),
+    branch,
+    head,
+    aheadOfDefault,
+    capturedAt: new Date().toISOString(),
+  };
+  saveGoal(goal);
+}
 function repoDefaultBranch(dir) {
   try { return gitSync(dir, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']).replace(/^origin\//, ''); }
   catch { return 'main'; }
@@ -1338,7 +1486,7 @@ function goalWorkDir(goal, project) {
   // at, which is what they want when they mean to watch it happen. On (the default)
   // keeps today's behaviour: a private copy per goal, so a run can never leave their
   // checkout half-edited.
-  if (goal?.worktree === false) return project.dir;
+  if (resolveWorkspaceMode(goal?.workspaceMode ?? goal?.worktree) === 'direct-workspace') return project.dir;
   const cached = goalWorkDirs.get(goal.id);
   if (cached && existsSync(cached)) return cached;
   let repoRoot;
@@ -1358,6 +1506,15 @@ function goalWorkDir(goal, project) {
   goalWorkDirs.set(goal.id, wt);
   return wt;
 }
+function projectDirtyInfo(dir) {
+  try {
+    const raw = gitSync(dir, ['status', '--porcelain']);
+    const paths = raw.split('\n').filter((line) => line.trim()).slice(0, 8);
+    return paths.length ? { dirty: true, dirtyPaths: paths } : { dirty: false };
+  } catch {
+    return {};
+  }
+}
 function removeGoalWorkDir(goal, project) {
   const wt = goalWorkDirs.get(goal.id);
   if (!wt) return;
@@ -1467,21 +1624,62 @@ function isProjectPaused(projectId) {
 
 // Goals stack up per project: while one goal is being planned or executed,
 // newer goals wait as 'stacked' (editable / deletable until picked up).
-function goalActive(projectId) {
-  return goals.some((g) => g.projectId === projectId && ['planning', 'running'].includes(g.status));
+function projectParallelCap() {
+  const slow = slowModeSettings();
+  return slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
+}
+function planningCount(projectId = null) {
+  return goals.filter((g) => g.status === 'planning' && (projectId == null || g.projectId === projectId)).length;
+}
+function activeSlotCount(projectId = null) {
+  if (projectId != null) return (queues.get(projectId)?.running.size ?? 0) + planningCount(projectId);
+  return globalRunningCount() + planningCount();
+}
+function stackedStartSlots(projectId) {
+  return Math.min(projectParallelCap() - activeSlotCount(projectId), GLOBAL_MAX_PARALLEL - activeSlotCount());
+}
+function startPlanningGoal(goal) {
+  goal.status = 'planning';
+  saveGoal(goal);
+  planGoal(goal).catch((e) => {
+    goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
+    startNextStacked(goal.projectId);
+  });
 }
 function startNextStacked(projectId) {
   if (isProjectPaused(projectId)) return; // paused → don't begin planning queued goals
-  if (goalActive(projectId)) return;
-  const next = goals.filter((g) => g.projectId === projectId && g.status === 'stacked')
-    .sort((a, b) => (b.prio ?? 0) - (a.prio ?? 0) || a.id - b.id)[0];
-  if (!next) return;
-  next.status = 'planning';
-  saveGoal(next);
-  planGoal(next).catch((e) => {
-    next.status = 'failed'; next.prError = String(e).slice(0, 300); saveGoal(next);
-    startNextStacked(projectId);
-  });
+  let slots = stackedStartSlots(projectId);
+  if (!canStartMore(0, slots)) return;
+  const nextGoals = goals.filter((g) => g.projectId === projectId && g.status === 'stacked')
+    .sort((a, b) => (b.prio ?? 0) - (a.prio ?? 0) || a.id - b.id);
+  if (!nextGoals.length) return;
+  for (const next of nextGoals) {
+    if (slots <= 0) break;
+    startPlanningGoal(next);
+    slots--;
+  }
+}
+
+// Runtime queue invariant: persisted queued tasks are the source of truth. A live
+// board takeover, an interrupted request handler, or a process race must not leave
+// one saved as `queued` but absent from the in-memory waiting list. Repair that
+// drift before pumping, then fill every available planning slot from `stacked`.
+// Deliberately ignores `pending`: those are Later items, explicitly shelved until
+// the person taps Start.
+function reconcileAndPumpProject(projectId) {
+  if (isProjectPaused(projectId)) return;
+  const q = queues.get(projectId);
+  if (!q) return;
+  const known = new Set([...q.running, ...q.waiting].map((task) => task.id));
+  const missing = tasks
+    .filter((task) => task.projectId === projectId && task.status === 'queued' && !known.has(task.id))
+    .sort((a, b) => a.num - b.num);
+  if (missing.length) {
+    q.waiting.push(...missing);
+    console.log(`[manager] ${projectId}: repaired ${missing.length} queued task(s) missing from memory`);
+  }
+  startNextStacked(projectId);
+  pump(projectId);
 }
 
 // Worker auth preflight state. The manager runs every worker by spawning a
@@ -1563,6 +1761,36 @@ async function relocalizeGeneralQuestion(goal, lang, res) {
 
 async function planGoal(goal) {
   const project = projects.find((p) => p.id === goal.projectId);
+  const enqueueSingleTask = (entry = null) => {
+    goal.question = null;
+    goal.status = 'running';
+    goal.entry = entry;
+    const title = goalTaskTitle(goal.text);
+    goal.plan = [title];
+    saveGoal(goal);
+    const base = tasks.filter((t) => t.projectId === goal.projectId).map((t) => t.num);
+    const num = (base.length ? Math.max(...base) : 0) + 1;
+    const task = buildGoalTask(goal, {
+      id: nextId++, num,
+      createdAt: new Date().toISOString(),
+    });
+    tasks.push(task);
+    saveTask(task);
+    queues.get(goal.projectId).waiting.push(task);
+    pump(goal.projectId);
+  };
+
+  // Stability roadmap 03/08: normal implementation requests bypass the intake
+  // planner entirely. The user's original text, attachments, selected
+  // Agent/Model/effort, and project settings already live on the goal and flow
+  // straight into buildGoalTask()/runTask(). Only explicit Plan mode keeps the
+  // planner hop for clarification/entry resolution before the worker receives
+  // the same verbatim request.
+  if (!shouldUsePlannerForGoal(goal)) {
+    enqueueSingleTask(null);
+    return;
+  }
+
   const prompt = [
     'あなたはユーザーの依頼を受けるプロダクトマネージャ。以下のユーザー依頼を、ユーザーから見た「成果物（トピック）」の単位で整理する。エンジニアリングの工程には分解しない。',
     '【言語】ユーザーが読む文字列（各タスクの title、確認の question / options）は、末尾の「依頼:」と同じ言語で書く。英語の依頼には英語で、日本語の依頼には日本語で返す（例: "test" → 英語、"テスト" → 日本語）。detail（worker への指示）は言語自由。',
@@ -1605,12 +1833,12 @@ async function planGoal(goal) {
   // SLOWER — the cost is claude cold-start + repo reading, not inference, and
   // haiku took more tool round-trips. The instant Planning… row is the real
   // "it's queued" feedback; detailed tasks follow in ~13s.)
-  const { result, sessionId } = await runWorkerAgent({ agent: goal.agent, prompt, cwd: workDir, tools: 'Read,Glob,Grep', model: goal.model, effort: goal.effort, onChild: (c) => trackGoalWorker(goal.id, c) });
+  const { result, sessionId } = await runWorkerAgent({ agent: goal.agent, prompt, cwd: workDir, tools: 'Read,Glob,Grep', permissionMode: 'plan', model: goal.model, effort: goal.effort, onChild: (c) => trackGoalWorker(goal.id, c) });
   if (goal.cancelled || !goals.some((g) => g.id === goal.id)) return; // deleted/cancelled while planning
   // Warm handoff: the planner already read the repo in this session, so the
   // goal's workers resume it instead of cold-starting a fresh claude each
   // task (faster first token, no re-briefing tokens).
-  if (sessionId) goal.sessionId = sessionId;
+  if (sessionId) setGoalAgentSession(goal, goal.agent, sessionId);
   // Smart intake: the planner may return a clarifying question instead of tasks
   // when the goal is genuinely ambiguous. Surface it as a "needsInput" goal (a
   // ❓ card in To Do) and wait for the answer — no tasks created yet, no worker.
@@ -1634,7 +1862,6 @@ async function planGoal(goal) {
   // decomposition the LLM may still emit into user-facing deliverables (Masa:
   // プログラムエンジニアのタスク単位で分解しないで — 1メッセージ=1トピック既定).
   plan.tasks = refinePlanTasks(plan.tasks, { goalText: goal.text });
-  goal.status = 'running';
   goal.entry = plan.entry;
   // Demoted planner (Masa 2026-07-21, P0b): the planner LLM still resolves the
   // entry URL, asks for clarification, and warms the session — but it no longer
@@ -1646,19 +1873,7 @@ async function planGoal(goal) {
   // what "correct" means for it, and it did so at random (see the prompt note
   // above). Nothing here sets one, so `entry` now only survives as the page a
   // future explicit, user-written condition would open.
-  const title = goalTaskTitle(goal.text);
-  goal.plan = [title];
-  saveGoal(goal);
-  const base = tasks.filter((t) => t.projectId === goal.projectId).map((t) => t.num);
-  const num = (base.length ? Math.max(...base) : 0) + 1;
-  const task = buildGoalTask(goal, {
-    id: nextId++, num,
-    createdAt: new Date().toISOString(),
-  });
-  tasks.push(task);
-  saveTask(task);
-  queues.get(goal.projectId).waiting.push(task);
-  pump(goal.projectId);
+  enqueueSingleTask(plan.entry);
 }
 
 // Author the executable check once per task (the only LLM cost of
@@ -1712,8 +1927,8 @@ function pump(projectId) {
   // queued tasks are actually safe to start within that many slots: at most
   // one per goalId not already running, so a goal's own next task never
   // jumps ahead of its still-running sibling.
-  const projectCap = slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
-  const slots = Math.min(projectCap - q.running.size, GLOBAL_MAX_PARALLEL - globalRunningCount());
+  const projectCap = projectParallelCap();
+  const slots = Math.min(projectCap - activeSlotCount(projectId), GLOBAL_MAX_PARALLEL - activeSlotCount());
   if (!canStartMore(0, slots)) return;
   if (slow.enabled) {
     const last = slowModeLastStart.get(projectId) ?? 0;
@@ -1846,6 +2061,7 @@ function queueBudgetContinuation(goal, task, budget) {
   goal.contextHandoff = buildContextHandoffSummary({ goal, tasks: tasks.filter((t) => t.goalId === goal.id) });
   goal.contextHandoffAt = now;
   goal.sessionId = null;
+  goal.sessions = {};
   goal.runElapsedMs = 0;
   goal.runTokens = 0;
   goal.runAttempts = 0;
@@ -1975,17 +2191,17 @@ function resumeProject(projectId) {
 }
 
 // Slack風スレッド返信タスクの生成(/api/goals/:id/reply と /api/goals/:id/dismiss で共有)。
-// runTask()のtask.reply分岐がgoal.sessionIdをresumeに渡して同じ会話を続ける。
+// runTask()のtask.reply分岐が各agentのsessionをresumeに渡して同じ会話を続ける。
 function applyReplyWorker(goal, requested = {}) {
   if (requested.agent == null) return { ok: true };
   if (!WORKER_AGENTS.includes(requested.agent)) return { ok: false, error: 'unsupported agent' };
   const agent = workerAgent(requested.agent);
   if (!AVAILABLE_AGENTS.includes(agent)) return { ok: false, error: `${agent} is not connected on this device` };
   const switchedAgent = agent !== goal.agent;
-  goal.agent = agent;
+  if (switchedAgent) switchGoalAgentSession(goal, agent);
+  else goal.agent = agent;
   goal.model = workerModel(agent, requested.model);
   goal.effort = workerEffort(agent, requested.effort);
-  if (switchedAgent) goal.sessionId = null;
   return { ok: true };
 }
 
@@ -2002,7 +2218,7 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
     usage: goal.runUsage,
     runTokens: goal.runTokens,
     runAttempts: goal.runAttempts,
-    previousSession: Boolean(goal.sessionId || goal.contextHandoff),
+    previousSession: Boolean(goalSessionFor(goal, goal.agent) || goal.contextHandoff),
   });
   if (shouldFreshSessionForPlan(goal.executionPlan)) refreshGoalHandoff(goal);
   saveGoal(goal);
@@ -2011,6 +2227,8 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
     id: nextId++, num: (nums.length ? Math.max(...nums) : 0) + 1,
     goalId: goal.id, projectId: goal.projectId, reply: true, model: goal.model, effort: goal.effort, agent: goal.agent,
     title: text.replace(/\s+/g, ' ').slice(0, 60), detail: promptText.slice(0, 4000),
+    workspaceMode: resolveWorkspaceMode(goal.workspaceMode ?? goal.worktree),
+    worktree: goal.worktree === false ? false : undefined,
     passCondition: null, status: 'queued', createdAt: new Date().toISOString(), priority: '中',
     result: null, changedFiles: [], secs: null, activity: [], proof: null, usage: null,
   };
@@ -2029,8 +2247,8 @@ function queueReplyTask(goal, text, { from = 'manager', via = 'composer' } = {})
   // follow-up reply to an already-running goal must stay DOING (its clock stands).
   if (goal.status === 'running' && ![...q.running].some((t) => t.goalId === goal.id)) {
     const slow = slowModeSettings();
-    const projectCap = slow.enabled ? Math.min(PROJECT_MAX_PARALLEL, slow.maxParallel) : PROJECT_MAX_PARALLEL;
-    const slots = Math.min(projectCap - q.running.size, GLOBAL_MAX_PARALLEL - globalRunningCount());
+    const projectCap = projectParallelCap();
+    const slots = Math.min(projectCap - activeSlotCount(goal.projectId), GLOBAL_MAX_PARALLEL - activeSlotCount());
     const runningGoalIds = [...q.running].map((t) => t.goalId);
     const eligible = q.waiting.filter((candidate) => workerCanStart({ agent: candidate.agent, auth: workerAuth }));
     const startsNow = workerCanStart({ agent: task.agent, auth: workerAuth })
@@ -2217,6 +2435,39 @@ function readRunDeclaration(task, workDir) {
   if (run.compare) sendProcessAct(task, `Worker declared a before/after pair: ${run.compare.join(' → ')}`);
 }
 
+// A direct/shared workspace can still contain a declaration left by an older
+// run (for example when that run was interrupted before readRunDeclaration).
+// Remove it before this task starts so only a file created by THIS worker can
+// name the review card or supply its Open it target.
+function clearStaleRunDeclaration(task, workDir) {
+  const file = join(workDir, RUN_DECL_FILE);
+  if (!existsSync(file)) return;
+  try {
+    unlinkSync(file);
+    sendProcessAct(task, `Removed a stale ${RUN_DECL_FILE} before starting this task.`);
+  } catch (err) {
+    sendProcessAct(task, `Could not remove stale ${RUN_DECL_FILE}: ${String(err?.code ?? err).slice(0, 80)}`);
+  }
+}
+
+function inheritPreviousRunDeclaration(task, goalId) {
+  if (task.run || !goalId) return;
+  const prev = [...tasks].reverse().find((t) => t.goalId === goalId && t.id !== task.id && t.run && (t.run.cmd || t.run.url));
+  if (!prev) return;
+  const note = [
+    'Reusing the previous preview because this follow-up did not declare a new preview.',
+    prev.run.note || prev.run.cmd || prev.run.url || '',
+  ].filter(Boolean).join(' ');
+  task.run = {
+    ...prev.run,
+    note: note.slice(0, 300),
+    inherited: true,
+    inheritedFromTaskId: prev.id,
+    inheritedFromAttemptId: prev.attemptId ?? null,
+  };
+  sendProcessAct(task, `No new run declaration; explicitly reusing preview from task ${prev.id}.`);
+}
+
 // A declared pair only survives if both pictures actually arrived. The card
 // draws a red box over whatever differs between the two, so a name matching no
 // collected shot would leave the reviewer half a comparison — show the plain
@@ -2343,12 +2594,22 @@ async function runTask(task) {
   saveTask(task);
   sendProcessAct(task, `Working on "${task.title}"${task.reply ? ' as a follow-up' : ''}.`);
 
-  // Everything the worker touches happens in the goal's own worktree (clean
-  // base from origin/main, isolated from other goals and the user's real dir).
+  // The workspace mode is chosen at goal creation and then held through every
+  // worker/review/PR step.
   const workDir = goal ? goalWorkDir(goal, project) : project.dir;
   const wproject = { ...project, dir: workDir };
-  sendProcessAct(task, `Prepared isolated worktree: ${workDir}`);
+  const workspaceMode = resolveWorkspaceMode(task.workspaceMode ?? goal?.workspaceMode ?? goal?.worktree);
+  sendProcessAct(task, workspaceMode === 'direct-workspace'
+    ? `Using direct workspace: ${workDir}`
+    : `Prepared isolated worktree: ${workDir}`);
+  if (goal?.workspaceWarning) sendProcessAct(task, goal.workspaceWarning);
+  clearStaleRunDeclaration(task, workDir);
   const before = await gitChanges(workDir);
+  task.attemptId = task.attemptId || newAttemptId(goal, task);
+  if (goal) {
+    goal.latestAttemptId = task.attemptId;
+    noteGoalTaskBaseline(goal, project, workDir, before);
+  }
   sendProcessAct(task, `Checked starting git state (${before.length} changed file${before.length === 1 ? '' : 's'} before this task).`);
   // Plan mode makes no edits, so there is nothing to verify — never author a
   // check or boot an ephemeral instance for it.
@@ -2362,25 +2623,31 @@ async function runTask(task) {
   // same conversation, no re-briefing (and no wasted tokens).
   if (task.reply) {
     const plan = goal?.executionPlan;
-    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goal?.sessionId ?? undefined);
+    const runAgent = workerAgent(task.agent ?? goal?.agent);
+    const runModel = task.model ?? goal?.model;
+    const runEffort = task.effort ?? goal?.effort;
+    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goalSessionFor(goal, runAgent) ?? undefined);
+    const replyPermissionMode = permissionModeFor(goal?.mode === 'plan' && goal?.planPhase !== 'executing' ? 'plan' : undefined);
+    const runContext = workerRunContext({ goal, task, agent: runAgent, model: runModel, effort: runEffort, permissionMode: replyPermissionMode, cwd: workDir, resumeSession, plan });
     // A follow-up is a full worker run, so it needs the same deliverable contract as
     // the first attempt (artifacts, run declaration, tests, language). The old short
     // prompt omitted those rules, which let a reply finish with prose only and left
     // Review showing the original task's stale "Skipped." result.
     const prompt = [
       managerHandoffPrompt(goal, plan),
-      workerPrompt(task, goal, null, workerAgent(task.agent ?? goal?.agent)),
+      workerPrompt(task, goal, null, runAgent, runContext),
       '(User follow-up on the goal you worked on. Apply it to the same goal and deliver the requested result.)',
     ].filter(Boolean).join('\n\n');
     const callT0 = Date.now();
-    sendProcessAct(task, `Starting ${workerAgent(task.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code'} worker with the existing goal context.`);
+    sendWorkerContextAct(task, runContext);
+    sendProcessAct(task, `Starting ${runAgent === 'codex' ? 'Codex' : 'Claude Code'} worker with the existing goal context.`);
     const r = await runWorkerAgent({
-      agent: task.agent ?? goal?.agent,
+      agent: runAgent,
       prompt, cwd: workDir, tools: WORKER_TOOLS, resume: resumeSession,
       // A reply that revises a plan-review must stay plan mode (no edits); a
       // reply/rework on a normal goal stays acceptEdits as before.
-      permissionMode: permissionModeFor(goal?.mode === 'plan' && goal?.planPhase !== 'executing' ? 'plan' : undefined),
-      model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+      permissionMode: replyPermissionMode,
+      model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
       onChild: (c) => trackGoalWorker(goal?.id, c),
@@ -2397,11 +2664,19 @@ async function runTask(task) {
     task.status = r.code === 0 ? 'done' : 'failed';
     task.result = r.result.slice(0, RESULT_MAX);
     task.usage = sumUsage([r.usage]);
-    if (r.sessionId && goal) { goal.sessionId = r.sessionId; saveGoal(goal); }
+    if (r.sessionId && goal) { setGoalAgentSession(goal, runAgent, r.sessionId); saveGoal(goal); }
+    // A follow-up owns its own evidence too. Previously only the initial task
+    // consumed .manager-run.json, so replies either left the new declaration
+    // behind or Review kept showing an older task's title/URL.
+    readRunDeclaration(task, workDir);
+    collectWorkerShots(task, workDir);
+    reconcileComparePair(task);
+    inheritPreviousRunDeclaration(task, goal?.id);
     const afterR = await gitChanges(workDir);
     task.changedFiles = afterR.filter((l) => !before.includes(l)).map((l) => l.slice(3));
     sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this follow-up.`);
     task.finishedAt = new Date().toISOString();
+    task.resultAttemptId = task.attemptId;
     saveTask(task);
     // A rework (comment/dismiss) must re-enter the verify gate — re-test,
     // re-capture proof, update the SAME PR (openPR existingBranch) — and land
@@ -2429,14 +2704,19 @@ async function runTask(task) {
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     let callT0 = Date.now();
     const plan = goal?.executionPlan;
-    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goal?.sessionId ?? undefined);
-    const prompt = [managerHandoffPrompt(goal, plan), workerPrompt(task, goal, null, workerAgent(task.agent ?? goal?.agent))].filter(Boolean).join('\n\n');
-    sendProcessAct(task, `Starting ${workerAgent(task.agent ?? goal?.agent) === 'codex' ? 'Codex' : 'Claude Code'} worker (attempt ${attempt}/${maxAttempts}).`);
+    const runAgent = workerAgent(task.agent ?? goal?.agent);
+    const runModel = task.model ?? goal?.model;
+    const runEffort = task.effort ?? goal?.effort;
+    const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goalSessionFor(goal, runAgent) ?? undefined);
+    const runContext = workerRunContext({ goal, task, agent: runAgent, model: runModel, effort: runEffort, permissionMode, cwd: workDir, resumeSession, plan });
+    const prompt = [managerHandoffPrompt(goal, plan), workerPrompt(task, goal, null, runAgent, runContext)].filter(Boolean).join('\n\n');
+    sendWorkerContextAct(task, runContext);
+    sendProcessAct(task, `Starting ${runAgent === 'codex' ? 'Codex' : 'Claude Code'} worker (attempt ${attempt}/${maxAttempts}).`);
     let r = await runWorkerAgent({
-      agent: task.agent ?? goal?.agent,
+      agent: runAgent,
       prompt, cwd: workDir, tools: WORKER_TOOLS,
       resume: resumeSession, permissionMode,
-      model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+      model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
       images: goal?.images,
       onTodos: (todos) => sendTodos(task, todos),
       onChild: (c) => trackGoalWorker(goal?.id, c),
@@ -2451,18 +2731,21 @@ async function runTask(task) {
     // "succeeded".
     let budget = trackGoalRunUsage(goal, Date.now() - callT0, r.usage);
     if (budget?.exceeded) { blockForBudget(goal, task, budget); return; }
-    if (r.code !== 0 && goal?.sessionId) {
+    if (r.code !== 0 && goalSessionFor(goal, runAgent)) {
       // The warm session can expire or be cleaned up between tasks; one cold
       // retry distinguishes "resume broke" from "the task itself failed".
       sendAct(task, 'warm session unavailable — retrying with a fresh session…');
-      goal.sessionId = null; saveGoal(goal);
+      if (goal?.sessions && typeof goal.sessions === 'object') delete goal.sessions[runAgent];
+      if (goal) { goal.sessionId = null; goal.sessionAgent = runAgent; saveGoal(goal); }
       callT0 = Date.now();
       sendProcessAct(task, 'Starting a fresh worker session because the warm session could not resume.');
+      const freshContext = workerRunContext({ goal, task, agent: runAgent, model: runModel, effort: runEffort, permissionMode, cwd: workDir, resumeSession: undefined, plan: { ...plan, sessionMode: 'cold' } });
+      sendWorkerContextAct(task, freshContext);
       r = await runWorkerAgent({
-        agent: task.agent ?? goal?.agent,
-        prompt: workerPrompt(task, goal, null, workerAgent(task.agent ?? goal?.agent)), cwd: workDir, tools: WORKER_TOOLS,
+        agent: runAgent,
+        prompt: workerPrompt(task, goal, null, runAgent, freshContext), cwd: workDir, tools: WORKER_TOOLS,
         permissionMode,
-        model: task.model ?? goal?.model, effort: task.effort ?? goal?.effort, onEvent: (line) => sendAct(task, line),
+        model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
         images: goal?.images,
         onTodos: (todos) => sendTodos(task, todos),
         onChild: (c) => trackGoalWorker(goal?.id, c),
@@ -2478,7 +2761,7 @@ async function runTask(task) {
     sendProcessAct(task, timedOut
       ? `Worker attempt ${attempt} was stopped at the ${Math.round(WORKER_TIMEOUT_MS / 60000)}-minute run limit (exit ${code}).`
       : `Worker attempt ${attempt} finished with exit code ${code}.`);
-    if (r.sessionId && goal) { goal.sessionId = r.sessionId; saveGoal(goal); }
+    if (r.sessionId && goal) { setGoalAgentSession(goal, runAgent, r.sessionId); saveGoal(goal); }
     if (!entryUrl) break;
     try {
       if (!verify) {
@@ -2589,6 +2872,7 @@ async function runTask(task) {
   task.changedFiles = after.filter((l) => !before.includes(l)).map((l) => l.slice(3));
   sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this task.`);
   task.finishedAt = new Date().toISOString();
+  task.resultAttemptId = task.attemptId;
   saveTask(task);
   sendProcessAct(task, `Task saved as ${task.status}.`);
 
@@ -2919,6 +3203,23 @@ function goalChangedFileUnion(goalId) {
   return [...new Set(tasks.filter((t) => t.goalId === goalId).flatMap((t) => t.changedFiles ?? []))]
     .filter((f) => f && !SCRATCH_FILE_RE.test(f));
 }
+function computeWorktreeChangeLocations(dir) {
+  try {
+    return parseGitUnifiedDiffLocations(gitOut(dir, ['diff', '--unified=0']) ?? '');
+  } catch {
+    return [];
+  }
+}
+function foldCandidateShape(g) {
+  return {
+    id: g.id,
+    changedFiles: goalChangedFileUnion(g.id),
+    changeLocations: g.changeLocations ?? [],
+    text: g.text,
+    title: g.reviewSummary?.title ?? g.plan?.[0],
+    summary: g.reviewSummary?.changed ?? '',
+  };
+}
 const CONFLICT_CANDIDATE_STATUSES = ['running', 'review', 'blocked', 'partial', 'retesting'];
 function updateGoalConflicts(goal) {
   const files = goalChangedFileUnion(goal.id);
@@ -2949,6 +3250,10 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   if (!siblings.length || !siblings.every((t) => ['done', 'failed', 'interrupted', 'skipped'].includes(t.status))) return;
   if (!['running', 'partial'].includes(goal.status)) { startNextStacked(goal.projectId); return; }
   goalAct(`Close-out started for goal-${goal.id}: ${siblings.length} task${siblings.length === 1 ? '' : 's'} ready for final checks.`);
+  if (activityTask?.attemptId) {
+    goal.closeoutAttemptId = activityTask.attemptId;
+    goal.latestAttemptId = activityTask.attemptId;
+  }
   // Plan mode: the worker produced a PLAN and made no edits. Land it in Review
   // as a plan-review (no PR, no proof gate — nothing changed) with the plan
   // body captured, so the reviewer sees "PLAN — approve to execute". Approving
@@ -3015,15 +3320,16 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // (that would be an instant loop, since the target still sits in review with
   // the overlapping files). The card then opens its own PR and both stay in
   // Review, flagged via conflictsWith — the visible collision Masa asked for.
-  const foldTarget = (conflicts.length && !goal.noFold)
+  goal.changeLocations = computeWorktreeChangeLocations(wdir);
+  const foldTarget = (autoFoldReviewsEnabled(project) && conflicts.length && !goal.noFold)
     ? goals.find((g) => g.id === pickFoldTarget(
-      { id: goal.id, changedFiles: goalChangedFileUnion(goal.id) },
+      foldCandidateShape(goal),
       goals
         .filter((c) => c.id !== goal.id
           && c.projectId === goal.projectId
           && c.status === 'review'
           && (c.owner ?? 'owner') === (goal.owner ?? 'owner'))
-        .map((c) => ({ id: c.id, changedFiles: goalChangedFileUnion(c.id) })),
+        .map(foldCandidateShape),
     ))
     : null;
   if (foldTarget) {
@@ -3051,6 +3357,7 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // time the PR is opened, not only on the review card (Masa 2026-07-16).
   goalAct('Writing the review summary from the worker report and diff.');
   goal.reviewSummary = await summarizeForReview(goal, siblings, wdir, reviewDefinition);
+  if (activityTask?.attemptId) goal.reviewSummaryAttemptId = activityTask.attemptId;
   goalAct('Checking changed files and preparing the PR branch if code changed.');
   await createGoalPR(goal, prProject, siblings, reviewDefinition, activityTask);
   // goal 427 §4: classify the change's risk from the SAME changed-files/diff
@@ -3059,6 +3366,7 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   // string/regex matching (classifyChangeRisk in lib.mjs).
   goal.risk = computeGoalRisk(goal, prProject, siblings);
   goal.summary = buildGoalSummary({ goalText: goal.text, tasks: siblings });
+  if (activityTask?.attemptId) goal.summaryAttemptId = activityTask.attemptId;
   await verifyGate(goal, prProject, siblings, project, activityTask);
   // A high-risk change (secrets/auth/payment/db-migration/destructive) must
   // never slip past a human — verifyGate's nextGoalStatus never returns
@@ -3070,8 +3378,10 @@ async function finishGoalIfComplete(goal, project, activityTask = null) {
   if (goal.risk?.shouldPause && !['blocked', 'running'].includes(goal.status)) goal.status = 'review';
   if (['review', 'done', 'blocked', 'archived'].includes(goal.status)) {
     refreshGoalHandoff(goal);
-    if (goal.sessionId) {
+    if (goalSessionFor(goal, goal.agent) && shouldFreshSessionForPlan(goal.executionPlan)) {
+      if (goal.sessions && typeof goal.sessions === 'object') delete goal.sessions[goal.agent];
       goal.sessionId = null;
+      goal.sessionAgent = goal.agent;
       goal.sessionClosedAt = new Date().toISOString();
       goal.executionPlan = {
         ...(goal.executionPlan ?? {}),
@@ -3098,6 +3408,13 @@ function computeGoalRisk(goal, project, siblings) {
   return { level: r.level, shouldPause: r.shouldPause, categories: r.categories, sensitiveFiles: r.sensitiveFiles };
 }
 
+function prSafetyIssue(goal, project, files) {
+  const baseline = goal?.prBaseline;
+  const currentBranch = gitSyncOrNull(project.dir, ['branch', '--show-current']);
+  const lines = spawnSync('git', ['-C', project.dir, 'status', '--porcelain', '-uall'], { encoding: 'utf8' }).stdout?.split('\n').filter(Boolean) ?? [];
+  return classifyPrSafety({ baseline, files, currentFiles: gitStatusPaths(lines), currentBranch });
+}
+
 // The Manager-verified review gate (shared by goal completion and /reverify):
 // run OUR OWN tests, generate a plain-language headline, and require proof for a
 // UI change — capturing it (3 tries) if missing. Any failure → 'blocked' (shown
@@ -3270,7 +3587,9 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     : gate.proofAdvisory === 'unconfirmed'
       ? 'proof は撮れましたが、依頼対象のUIを自動確認できませんでした — 目視で確認してください'
       : null;
+  goal.verificationInfraError = verificationInfraErrorFrom({ testResult: goal.testResult, proofNote: goal.proofNote });
   if (goal.proofNote) goalAct(`Proof advisory (not blocking): ${goal.proofNote}`);
+  if (goal.verificationInfraError) goalAct(`Verification infrastructure issue (not blocking): ${goal.verificationInfraError.detail}`);
   if (gate.blocked) {
     if (!testsFailing) {
       recordGoalFailure(goal, {
@@ -3314,6 +3633,14 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
   // round can't actually hit this — its files are a superset of the ones that
   // already got it a PR — but the guard is harmless either way.)
   if (!files.length) { goal.pr = null; goal.prError = null; saveGoal(goal); goalAct('No code changes detected, so PR creation is skipped.'); return; }
+  const unsafe = prSafetyIssue(goal, project, files);
+  if (unsafe) {
+    goal.prError = unsafe.message.slice(0, 300);
+    goal.prSafety = { code: unsafe.code, message: unsafe.message, at: new Date().toISOString() };
+    goalAct(unsafe.message);
+    saveGoal(goal);
+    return;
+  }
   // Rework: the goal already has an open PR from an earlier finish. Push onto
   // that same branch instead of opening a second PR for the goal (see openPR's
   // existingBranch/existingPrUrl mode in pr.mjs).
@@ -3365,6 +3692,12 @@ async function createGoalPR(goal, project, goalTasks, reviewDefinition = DEFAULT
     goal.pr = url;
     goal.prBranch = branch;
     goal.prError = null;
+    goal.prErrorClass = null;
+    goal.prRepair = null;
+    goal.stalePr = null;
+    goal.prSafety = null;
+    if (activityTask?.attemptId) goal.prAttemptId = activityTask.attemptId;
+    if (!goal.prAttemptId) goal.prAttemptId = goal.latestAttemptId ?? goalTasks.map((t) => t.attemptId || `task-${t.id}`).filter(Boolean).at(-1) ?? null;
     goalAct(`PR ready: ${url}`);
   } catch (e) {
     // A rework push failing shouldn't blow away an already-working PR url —
@@ -3451,6 +3784,16 @@ const server = createServer(async (req, res) => {
     return res.end(readFileSync(file));
   }
 
+  if (url.pathname === '/api/internal/quality-metrics' && req.method === 'GET') {
+    if (identityFor(req) !== 'owner') return json(res, 403, { error: 'owner/debug only' });
+    return json(res, 200, computeInternalQualityMetrics({
+      goals,
+      tasks,
+      events: readInternalQualityEvents(),
+      nowMs: Date.now(),
+    }));
+  }
+
   if (url.pathname === '/api/state') {
     await syncAllExternal();
     await syncGoalMerges();
@@ -3496,7 +3839,8 @@ const server = createServer(async (req, res) => {
     const projectsWithBranch = projects.map((p) => {
       let branch = null;
       try { branch = gitSync(p.dir, ['rev-parse', '--abbrev-ref', 'HEAD']); } catch { /* not a repo → no branch, and the bar shows none */ }
-      return branch ? { ...p, branch } : p;
+      const dirty = projectDirtyInfo(p.dir);
+      return { ...p, ...(branch ? { branch } : {}), ...dirty };
     });
     return json(res, 200, { projects: projectsWithBranch, goals: visibleGoals, tasks: trimTaskActivityForState(visibleTasks), models: MODELS, agentModels: { 'claude-code': MODELS, codex: CODEX_MODELS }, agentEfforts: { 'claude-code': CLAUDE_EFFORTS, codex: CODEX_EFFORTS }, agents: AVAILABLE_AGENTS, connectCommand, queueOrder, externalActivity, workflowColumns: projectColumns, reviewDefinitions: projectReviewDefs, runningCounts, parallelLimits, uiVersion: uiVersion(), billing, auth: publicAuth() });
   }
@@ -3647,7 +3991,7 @@ const server = createServer(async (req, res) => {
     const model = CODEX_MODELS[0];
     for (const task of queued) { task.agent = 'codex'; task.model = model; task.sessionId = null; saveTask(task); }
     for (const goal of goals.filter((item) => goalIds.has(item.id))) {
-      goal.agent = 'codex'; goal.model = model; goal.sessionId = null; goal.startedAt = null; saveGoal(goal);
+      switchGoalAgentSession(goal, 'codex'); goal.model = model; goal.startedAt = null; saveGoal(goal);
     }
     for (const projectId of new Set(queued.map((task) => task.projectId))) pump(projectId);
     return json(res, 200, { changed: queued.length, goals: [...goalIds] });
@@ -3811,7 +4155,7 @@ const server = createServer(async (req, res) => {
     req.on('data', (d) => { body += d; });
     req.on('end', async () => {
       try {
-        const { projectId, text, pr, images, model, effort, source, pending, review, note, mode, skill, agent, worktree } = JSON.parse(body);
+        const { projectId, text, pr, images, model, effort, source, pending, review, note, mode, skill, agent, worktree, workspaceMode } = JSON.parse(body);
         const project = projects.find((p) => p.id === projectId);
         if (!project || !text?.trim()) return json(res, 400, { error: 'projectId and text required' });
         // Chat-driven play/pause (Masa: "チャットで再生一時停止はおせる"). Deterministic
@@ -3926,9 +4270,11 @@ const server = createServer(async (req, res) => {
         // present would otherwise spawn a worker doomed to fail at launch.
         const goalAgent = pickAvailableAgent(workerAgent(agent), AVAILABLE_AGENTS);
         const priorFailureMemory = recentProjectFailureMemory(projectId, text.trim());
+        const resolvedWorkspaceMode = resolveWorkspaceMode(workspaceMode ?? worktree);
+        const workspaceDirty = resolvedWorkspaceMode === 'direct-workspace' ? projectDirtyInfo(project.dir) : {};
         const goal = {
           id: nextId++, projectId, text: text.trim().slice(0, 8000),
-          status: (needsFolder || needsReviewPref) ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'planning',
+          status: (needsFolder || needsReviewPref) ? 'needsInput' : review ? 'review' : pending ? 'pending' : 'stacked',
           question: folderQuestion || reviewPrefQuestion,
           reviewOnly: review ? true : undefined,
           note: review && typeof note === 'string' && note.trim() ? note.trim().slice(0, 8000) : undefined,
@@ -3941,11 +4287,16 @@ const server = createServer(async (req, res) => {
           mode: (!review && GOAL_MODES.includes(mode)) ? mode : 'auto',
           // SKILL: an optional user/project skill (or command) to invoke first.
           skill: (typeof skill === 'string' && skill.trim()) ? skill.trim().slice(0, 80) : null,
-          // WORKTREE (Masa 2026-07-22, the Claude app's own checkbox): true/undefined =
-          // a private copy per goal, which is what has always happened. Explicit false =
-          // work in the folder the person is looking at. Only an explicit false is
-          // stored, so every goal ever written keeps meaning what it meant.
-          worktree: worktree === false ? false : undefined,
+          // WORKSPACE MODE: isolated-worktree is the default and uses a clean per-goal
+          // checkout; direct-workspace is explicit and runs in the folder the person is
+          // looking at, inheriting its current dirty/clean state. Keep the old
+          // worktree:false wire contract too, so existing clients and old goals retain
+          // their behavior while Review/PR can show the explicit mode name.
+          workspaceMode: resolvedWorkspaceMode,
+          worktree: resolvedWorkspaceMode === 'direct-workspace' ? false : undefined,
+          workspaceWarning: workspaceDirty.dirty
+            ? `Dirty workspace warning: direct workspace will inherit current uncommitted changes (${(workspaceDirty.dirtyPaths ?? []).join(', ')}).`
+            : undefined,
           images: Array.isArray(images) ? images.slice(0, 6) : [],
           source: resolveGoalSource(source), sourceRef: null,
           executionPlan: buildExecutionPlan({
@@ -3968,11 +4319,7 @@ const server = createServer(async (req, res) => {
         // pending = deliberately shelved (Phase 2 material): never planned,
         // never queued, until POST /api/goals/:id/activate. review-only items
         // are terminal-until-human too, so they also skip planGoal.
-        if (runnable && !needsFolder && !needsReviewPref) {
-          planGoal(goal).catch((e) => {
-            goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
-          });
-        }
+        if (runnable && !needsFolder && !needsReviewPref) startNextStacked(goal.projectId);
         json(res, 200, goal);
       } catch { json(res, 400, { error: 'bad json' }); }
     });
@@ -4065,6 +4412,7 @@ const server = createServer(async (req, res) => {
     if (!task) return json(res, 404, { error: 'task not found' });
     if (!requireTaskGoalOwnership(req, res, task)) return;
     if (!['interrupted', 'failed'].includes(task.status)) return json(res, 409, { error: 'only interrupted/failed tasks can be retried' });
+    appendInternalQualityEvent({ type: 'task_retry_requested', taskId: task.id, goalId: task.goalId, projectId: task.projectId }, { once: false });
     task.status = 'queued'; task.result = null; task.secs = null; task.proof = null;
     saveTask(task);
     const goal = goals.find((g) => g.id === task.goalId);
@@ -4111,7 +4459,7 @@ const server = createServer(async (req, res) => {
         saveTask(task);
       }
       for (const goal of goals.filter((item) => goalIds.has(item.id))) {
-        goal.agent = agent; goal.model = model; goal.effort = effort; goal.sessionId = null; goal.startedAt = null;
+        switchGoalAgentSession(goal, agent); goal.model = model; goal.effort = effort; goal.startedAt = null;
         saveGoal(goal);
       }
       pump(projectId);
@@ -4132,7 +4480,7 @@ const server = createServer(async (req, res) => {
     const queuedTasks = tasks.filter((task) => task.goalId === goal.id && task.status === 'queued');
     if (!queuedTasks.length) return json(res, 409, { error: 'this goal has no queued work' });
     const model = CODEX_MODELS[0];
-    goal.agent = 'codex'; goal.model = model; goal.sessionId = null; goal.startedAt = null;
+    switchGoalAgentSession(goal, 'codex'); goal.model = model; goal.startedAt = null;
     saveGoal(goal);
     for (const task of queuedTasks) {
       task.agent = 'codex'; task.model = model; task.sessionId = null;
@@ -4156,9 +4504,26 @@ const server = createServer(async (req, res) => {
     if (!task) return json(res, 404, { error: 'task not found' });
     if (!requireTaskGoalOwnership(req, res, task)) return;
     if (!task.run) return json(res, 409, { error: 'no run declaration for this task' });
+    const goal = goals.find((g) => g.id === task.goalId);
     startPreview(task)
-      .then((p) => json(res, 200, p))
-      .catch((e) => json(res, 500, { error: String(e.message ?? e).slice(0, 200) }));
+      .then((p) => {
+        if (goal?.verificationInfraError?.source === 'preview') {
+          goal.verificationInfraError = null;
+          saveGoal(goal);
+        }
+        json(res, 200, p);
+      })
+      .catch((e) => {
+        const detail = String(e.message ?? e).slice(0, 200);
+        if (goal && goal.status === 'review') {
+          goal.verificationInfraError = buildVerificationInfraError({
+            source: 'preview',
+            detail: `Local preview could not start: ${detail}. The implementation result stays in Review; press 再検証 to rerun verification only, or try Open it again when the local environment is idle.`,
+          });
+          saveGoal(goal);
+        }
+        json(res, 500, { error: detail });
+      });
     return;
   }
 
@@ -4334,6 +4699,7 @@ const server = createServer(async (req, res) => {
     goal.foldedInto = null;
     goal.noFold = true;
     goal.status = 'running'; // let finishGoalIfComplete re-run close-out (its tasks are all done → opens its own PR)
+    appendInternalQualityEvent({ type: 'goal_fold_unfolded', goalId: goal.id, projectId: goal.projectId }, { once: false });
     saveGoal(goal);
     finishGoalIfComplete(goal, project).catch((e) => {
       goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal);
@@ -4349,8 +4715,8 @@ const server = createServer(async (req, res) => {
     if (!goal) return json(res, 404, { error: 'goal not found' });
     if (!requireGoalOwnership(req, res, goal)) return;
     if (goal.status !== 'pending') return json(res, 409, { error: 'only pending goals can be activated' });
-    goal.status = 'planning'; saveGoal(goal);
-    planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+    goal.status = 'stacked'; saveGoal(goal);
+    startNextStacked(goal.projectId);
     return json(res, 200, goal);
   }
   const pendMatch = url.pathname.match(/^\/api\/goals\/(\d+)\/pend$/);
@@ -4386,13 +4752,14 @@ const server = createServer(async (req, res) => {
         if (!proj) {
           proj = { id: uniqueProjectId(basename(dir)), name: basename(dir), dir };
           projects.push(proj); saveProjects();
+          queues.set(proj.id, { running: new Set(), waiting: [] });
         }
         goal.projectId = proj.id;
         goal.question = null;
         goal.clarified = true;
-        goal.status = 'planning';
+        goal.status = 'stacked';
         saveGoal(goal);
-        planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+        startNextStacked(goal.projectId);
         return json(res, 200, goal);
       };
       // Intent router (no free-text box is a dead-end). Before any per-kind
@@ -4515,17 +4882,17 @@ const server = createServer(async (req, res) => {
         goal.wantsPR = resolveWantsPR(undefined, goal.text, patch.defaultWantsPR);
         goal.question = null;
         goal.clarified = true;
-        goal.status = 'planning';
+        goal.status = 'stacked';
         saveGoal(goal);
-        planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+        startNextStacked(goal.projectId);
         return json(res, 200, goal);
       }
       goal.text = `${goal.text}\n[確認: ${goal.question?.text ?? ''} → ${answer}]`;
       goal.clarified = true; // answered once → planGoal must never re-ask (persisted via saveGoal)
       goal.question = null;
-      goal.status = 'planning';
+      goal.status = 'stacked';
       saveGoal(goal);
-      planGoal(goal).catch((e) => { goal.status = 'failed'; goal.prError = String(e).slice(0, 300); saveGoal(goal); });
+      startNextStacked(goal.projectId);
       json(res, 200, goal);
     });
     return;
@@ -4627,6 +4994,7 @@ const server = createServer(async (req, res) => {
       goal.autoRework = { ...(goal.autoRework ?? {}), testFailures: 0, manualRetryAt: new Date().toISOString() };
       saveGoal(goal);
       const task = queueReplyTask(goal, prompt, { from: 'manager', via: 'retry' });
+      appendInternalQualityEvent({ type: 'task_retry_requested', taskId: task.id, goalId: goal.id, projectId: goal.projectId }, { once: false });
       return json(res, 200, { goal, task, repairing: true });
     }
     const wdir = (goalWorkDirs.get(goal.id) && existsSync(goalWorkDirs.get(goal.id))) ? goalWorkDirs.get(goal.id) : project.dir;
@@ -4785,7 +5153,7 @@ async function judgeReplyIntent(goal, reply) {
 
 // 「聞いてるだけ」への返事 (ONE-CONVERSATION.md §1.3 answer)。
 //
-// 答えるのは**作業した AI 本人**＝ goal.sessionId を resume する。状況一覧しか
+// 答えるのは**作業した AI 本人**＝その agent の session を resume する。状況一覧しか
 // 知らない別AIでは「なぜそうしたか」に答えられない（Masa確定 2026-07-22）。
 // コードは1文字も変わらない: ツールは Read だけ、permissionMode は 'plan'
 // （Codex 側は read-only サンドボックスに落ちる）。タスクも作らないので看板も
@@ -4806,7 +5174,7 @@ async function answerGoalQuestion(goal, question) {
     const r = await runWorkerAgent({
       agent: goal.agent, model: goal.model, prompt, cwd,
       tools: 'Read', permissionMode: 'plan',
-      resume: goal.sessionId ?? undefined,
+      resume: goalSessionFor(goal, goal.agent) ?? undefined,
       onChild: (c) => trackGoalWorker(goal.id, c),
     });
     const answer = String(r?.result ?? '').trim();
@@ -4873,7 +5241,7 @@ async function answerGoalQuestion(goal, question) {
       }
 
       // answer: 聞かれただけ。ゴールは review のまま、ワーカーも起こさない（§1.3）。
-      // 答えるのは**その作業をやった AI 本人**（goal.sessionId を resume）なので
+      // 答えるのは**その作業をやった AI 本人**（agent別sessionを resume）なので
       // 「なぜそうしたか」に答えられる。HTTP は待たせない——答えは会話に1発言
       // 積まれ、SSE の goal イベント（messageCount）で画面に出る。
       if (result.answers) {
@@ -5095,27 +5463,22 @@ server.listen(PORT, '127.0.0.1', () => {
   setInterval(() => {
     send({ ev: 'ping', uiVersion: uiVersion() });
     syncGoalMerges().catch(() => {});
-    for (const p of projects) {
-      pump(p.id);
-      for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
-        g.status = 'planning'; saveGoal(g);
-        planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
-      }
-    }
   }, 30_000).unref();
+  // Queue liveness is a product invariant, not something an SSE refresh or a
+  // person pressing Retry should have to restore. Five seconds keeps recovery
+  // quick without doing meaningful work while idle.
+  setInterval(() => {
+    for (const p of projects) reconcileAndPumpProject(p.id);
+  }, 5_000).unref();
   for (const p of projects) {
     const pending = tasks.filter((t) => t.projectId === p.id && t.status === 'queued').sort((a, b) => a.num - b.num);
     const q = queues.get(p.id);
     reconcileQueuedGoalStarts(p.id);
     q.waiting.push(...pending);
     if (pending.length) console.log(`[manager] ${p.id}: re-queued ${pending.length} pending task(s) after restart`);
-    pump(p.id);
     // breakdown-first: any goal still sitting 'stacked' (legacy or crash
-    // leftovers) gets planned immediately so it can never rot in the queue
-    for (const g of goals.filter((g) => g.projectId === p.id && g.status === 'stacked')) {
-      g.status = 'planning'; saveGoal(g);
-      planGoal(g).catch((e) => { g.status = 'failed'; g.prError = String(e).slice(0, 300); saveGoal(g); });
-    }
+    // leftovers) gets planned immediately so it can never rot in the queue.
+    reconcileAndPumpProject(p.id);
     // A restart must not orphan an in-flight Ledger retest (v45 §5.3): the
     // intent is persisted as status 'retesting' in tasks.jsonl (replayQueueLog
     // passes it through untouched) — resume the job from run 1.