@galda/cli 0.10.72 → 0.10.73

package/app/index.html

@@ -213,7 +213,7 @@
 
   .errbar{position:absolute;left:50%;bottom:96px;transform:translateX(-50%);z-index:40;background:var(--errbg);backdrop-filter:blur(14px);
     border:1px solid rgba(var(--danger-rgb),.4);color:var(--danger);font-size:12.5px;border-radius:10px;padding:8px 14px;display:none}
-  .errbar.ok{border-color:rgba(var(--green-rgb),.45);color:var(--green)} /* 07-20c: neutral/success toast (PR merged) */
+  .errbar.ok{background:rgba(var(--green-rgb),.12);border-color:rgba(var(--green-rgb),.45);color:var(--green)} /* 07-20c: neutral/success toast (PR merged) */
 
   /* composer */
   .composer-wrap{flex:0 0 auto;padding:8px 22px 18px}
@@ -296,21 +296,6 @@
   .ctxseg:hover{color:var(--ink)}   /* glyph colour only — no surface (§5.5) */
   .ctxseg svg{width:13px;height:13px;flex:0 0 13px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round}
   .ctxseg b{font-weight:600;font-size:11.5px;color:var(--ink);overflow:hidden;text-overflow:ellipsis;max-width:300px}
-  .ctxdiv{width:1px;align-self:stretch;margin:5px 0;background:var(--hair);flex:0 0 1px}
-  /* workspace mode — isolated worktree is the default; direct workspace is explicit.
-     ON is --ink, never --green: in this product green means "it passed" (PR green,
-     tests green, Token green), and a settings checkbox borrowing it makes that green cheap.
-     The tick is knocked out in --panel (the surface it sits on), NOT --invink. */
-  .ctxwt{font-size:11.5px;color:var(--ink2)}
-  .ctxwt .ctxbox{width:11px;height:11px;flex:0 0 11px;border-radius:3px;border:1px solid var(--ink3);
-    display:inline-block;position:relative;transition:background .12s,border-color .12s}
-  .ctxwt[aria-checked="true"]{color:var(--ink2)}
-  .ctxwt[aria-checked="true"] .ctxbox{background:var(--ink);border-color:var(--ink)}
-  .ctxwt[aria-checked="true"] .ctxbox::after{content:"";position:absolute;left:3px;top:0;width:3px;height:7px;
-    border:solid var(--panel);border-width:0 1.6px 1.6px 0;transform:rotate(42deg)}
-  .ctxworkwarn{display:flex;align-items:center;gap:6px;margin:-3px 2px 6px;color:var(--amber);
-    font:500 11.5px/1.35 var(--ui)}
-  .ctxworkwarn[hidden]{display:none}
   .ctxmenu{min-width:230px;max-width:420px}
   /* The folder list is galda's own screen (Claude has none — it opens ONE folder; galda
      moves between repos). The one thing that actually goes wrong is that names alone look
@@ -1507,15 +1492,6 @@
     background:var(--ink);animation:ccblink 1.05s steps(1) infinite}
   @keyframes ccblink{50%{opacity:0}}
   @media (prefers-reduced-motion:reduce){#fsRoot .cc-caret{animation:none}}
-  /* "→ Added to To Do #NN" — shown quietly in the flow when a turn became a task.
-     Undo appears on hover only (§1.5-10). No filled surface. */
-  #fsRoot .cc-mark{display:flex;align-items:center;gap:8px;font-family:var(--mono);font-size:11px;color:var(--ink3);padding:1px 0}
-  #fsRoot .cc-mark .cm-ar{color:var(--ink2);font-size:12.5px;line-height:1}
-  #fsRoot .cc-mark .cm-t{color:var(--ink2)}
-  #fsRoot .cc-mark .cm-no{color:var(--ink3);font-variant-numeric:tabular-nums}
-  #fsRoot .cc-mark .cm-undo{margin-left:2px;padding:0;border:0;background:none;font:inherit;color:var(--ink3);cursor:pointer;opacity:0;transition:opacity .15s,color .15s}
-  #fsRoot .cc-mark:hover .cm-undo{opacity:1}
-  #fsRoot .cc-mark .cm-undo:hover{color:var(--blue)}
   /* Claude Code CLI language (HANDOFF-v45 §12, flagship .cc-t port): gap:0 — the bullet's
      own margin-right does the spacing, not a flex gap (keeps ⏺ tight against the tool name
      the way the real CLI reads). */
@@ -2134,6 +2110,10 @@
   /* body prose = the app's normal text: 14px / −.012em, matching .bubble (Masa 2026-07-20:
      13px read thinner/lighter for Japanese than the surrounding app). §2. */
   .redesign .rbody{font-size:14px;line-height:1.62;letter-spacing:-.012em;color:var(--ink);max-width:70ch;margin:0 !important}
+  /* Request text is the human's own free-form message (goal #431): it can contain blank
+     lines and numbered lists. esc() already neutralizes HTML, so pre-wrap just keeps the
+     line breaks the person actually typed instead of HTML collapsing them into one line. */
+  .redesign .rbody.rask{white-space:pre-wrap}
   .redesign .rinfra{padding:10px 12px;border:1px solid rgba(var(--amber-rgb),.35);border-radius:8px;background:rgba(var(--amber-rgb),.06)}
   .redesign .rinfra .rbody{color:var(--ink2)}
   .redesign .rinfra .retrybtn{margin-top:8px;margin-left:0}
@@ -2982,13 +2962,8 @@
           <div class="ctxchip ctxbrgrp" id="ctxbrgrp">
             <span class="ctxseg ctxbranch" id="ctxbranch" title="Branch this folder is on">
               <svg viewBox="0 0 24 24"><path d="M6 3v12M6 15a3 3 0 100 6 3 3 0 000-6zM18 9a3 3 0 100-6 3 3 0 000 6zM18 9v3a4 4 0 01-4 4H8"/></svg><span id="ctxbranchname"></span></span>
-            <span class="ctxdiv"></span>
-            <button type="button" class="ctxseg ctxwt" id="ctxwt" role="checkbox" aria-checked="true"
-              title="isolated worktree: default clean copy. direct workspace: inherits and edits this folder.">
-              <i class="ctxbox"></i><span id="ctxwtlabel">isolated worktree</span></button>
           </div>
         </div>
-        <div class="ctxworkwarn" id="ctxworkwarn" hidden></div>
         <!-- Conversation-first composer (SLICE 2, docs/HANDOFF-ONBOARDING-conversational.md):
              a chat/help/settings message gets a quiet reply HERE instead of
              becoming a To-Do. Reuses the .peraanswer surface; hidden until a
@@ -3375,8 +3350,20 @@ const savedTheme = (() => {
 const state = { repos: null, repoHome: '', /* GET /api/repos — the folders a project can point at (Context Bar) */ projects: [], goals: [], tasks: [], act: {}, actAt: {}, todos: {}, chatTurns: {}, active: localStorage.getItem('sel:project') || 'default', editing: null, attach: [], connectCommand: '', models: ['sonnet'], agentModels: null, agentEfforts: null, agents: ['claude-code', 'codex'], auth: null, expanded: new Set(), openThreads: new Set(), queueOrder: {}, externalActivity: [], selectedGoal: null, workflowColumns: {}, wfDraft: null, reviewDefinitions: {}, rdDraft: null, runningCounts: {}, parallelLimits: null, connectedApp: localStorage.getItem('sel:agent') || 'claude-code', reviewOpenGoal: null, reviewApprovals: {}, goalDetailOpen: null, qreplyOpen: new Set(), logCollapsed: localStorage.getItem('logCollapsed') !== '0', logEntries: [], layout: localStorage.getItem('layout') || 'flagship', theme: savedTheme, boardskin: localStorage.getItem('boardskin') || 'auto', summaryPattern: Number(localStorage.getItem('summaryPattern')) || 3, peraSpot: 0, skill: null, skillsCache: null, projectRules: {}, rulesOpen: false,
   // per-message send overrides set via slash-commands (reset after each send,
   // except model which is sticky in localStorage). palette = open command list.
+  // Scoped per project (msgByProject) so a skill/mode picked in one project can't leak
+  // into another one just switched to — state.msg is always the CURRENT project's slot;
+  // switching projects must go through setActiveProject(), never a bare state.active = .
   msg: { mode: null, model: null, effort: null, skill: null, later: false, review: false },
+  msgByProject: {},
   stickyModel: localStorage.getItem('sel:model') || 'sonnet', stickyEffort: localStorage.getItem('sel:effort') || 'medium', palette: null };
+state.msgByProject[state.active] = state.msg;
+function emptyMsg(){ return { mode: null, model: null, effort: null, skill: null, later: false, review: false }; }
+function setActiveProject(id){
+  if (id === state.active) return;
+  state.msgByProject[state.active] = state.msg;
+  state.active = id;
+  state.msg = state.msgByProject[id] || (state.msgByProject[id] = emptyMsg());
+}
 window.state = state; // top-level const isn't a window property; external checks probe window.state
 const $ = (id) => document.getElementById(id);
 
@@ -3901,10 +3888,13 @@ function tokenBaselinePerRequirementLocal(history){
   return samples.reduce((a, b) => a + b, 0) / samples.length;
 }
 // Mirrors engine/lib.mjs estimateTokenOptimization() — see the comment there
-// for why "saved X%" now compares against a real per-project baseline
-// (basis: 'baseline') instead of always reusing this goal's own cache-hit
-// ratio as a stand-in for "cheaper than usual" (basis: 'cache-weight',
-// used only until there's enough finished-goal history).
+// for why a positive `baseline` percent is only labeled "saved" (basis:
+// 'baseline') when a real technique fired this run (cache reuse, a fresh
+// handoff, /compact, /clear). Without one, the same comparison ships as
+// basis: 'baseline-untied' — a true fact (smaller/larger than usual) but
+// not a claim that anything the user did caused it (Masa 2026-07-26; a
+// small goal right after big ones scored a huge "saved" purely from the
+// size mix). With no history at all it's basis: 'no-baseline' (no number).
 function estimateTokenOptimizationLocal({ usage = null, weightedTokens = null, cacheReadWeight = 0.1, sessionMode = null, usedHandoff = false, usedCompact = false, usedClear = false, agentModel = null, requirementCount = 1, history = [] } = {}){
   const u = usage ?? {};
   const raw = (u.input_tokens ?? 0) + (u.output_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0);
@@ -3913,15 +3903,11 @@ function estimateTokenOptimizationLocal({ usage = null, weightedTokens = null, c
   const reqN = Math.max(1, Number(requirementCount) || 1);
   const perReq = weighted / reqN;
   const baseline = tokenBaselinePerRequirementLocal(history);
-  let percent, basis, savedTokens;
+  let percent = null, basis = 'no-baseline', savedTokens = null;
   if (baseline != null) {
     percent = Math.max(-100, Math.min(100, Math.round(((baseline - perReq) / baseline) * 100)));
     basis = 'baseline';
     savedTokens = Math.max(0, Math.round((baseline - perReq) * reqN));
-  } else {
-    savedTokens = Math.max(0, raw - weighted);
-    percent = Math.round((savedTokens / raw) * 100);
-    basis = 'cache-weight';
   }
   const techniques = [];
   const cacheRatio = Math.round(((u.cache_read_input_tokens ?? 0) / raw) * 100);
@@ -3929,8 +3915,10 @@ function estimateTokenOptimizationLocal({ usage = null, weightedTokens = null, c
   if (usedHandoff || sessionMode === 'cold-handoff') techniques.push('fresh handoff instead of a bloated session');
   if (usedCompact || sessionMode === 'compact') techniques.push('/compact before continuing');
   if (usedClear) techniques.push('/clear between unrelated goals');
-  if (agentModel) techniques.push(`${agentModel} for this run`);
+  const techniqueDriven = cacheRatio > 0 || usedHandoff || sessionMode === 'cold-handoff' || usedCompact || sessionMode === 'compact' || usedClear;
+  if (basis === 'baseline' && !techniqueDriven) basis = 'baseline-untied';
   if (basis === 'baseline' && percent > 0) techniques.push(`${Math.round(perReq / 1000)}k tokens/requirement vs your ${Math.round(baseline / 1000)}k average`);
+  if (basis === 'baseline-untied') techniques.push(`${Math.round(perReq / 1000)}k tokens/requirement vs your ${Math.round(baseline / 1000)}k average`);
   if (!techniques.length) techniques.push(`${Math.round(raw / 1000)}k tokens this run (no cache reuse yet)`);
   return { rawTokens: raw, weightedTokens: weighted, savedTokens, percent, basis, techniques: [...new Set(techniques)] };
 }
@@ -3938,6 +3926,10 @@ function tokenOptimizationHtml(opt){
   if (!opt) return '';
   const techniques = opt.techniques?.length ? opt.techniques.slice(0, 4).join(' / ') : 'this run';
   const pct = Number(opt.percent);
+  if (opt.basis === 'baseline-untied') {
+    const dir = pct > 0 ? 'smaller' : 'larger';
+    return `<div class="rvtokenopt">${esc(`Token usage: this run was ${dir} than your recent average (${techniques}) — no cache/compact/handoff technique behind it`)}</div>`;
+  }
   const cmp = opt.basis === 'baseline' ? 'vs your recent average' : 'from prompt caching';
   const text = pct > 0
     ? `Token optimized: saved about ${pct}% ${cmp} (${techniques})`
@@ -3949,7 +3941,7 @@ function renderProjects(){
     const busy = state.tasks.filter((t) => t.projectId === p.id && ['running','queued'].includes(t.status)).length;
     return `<button class="proj ${p.id === state.active ? 'active' : ''}" data-id="${p.id}">${esc(p.name)}${busy ? `<span class="n">${busy}</span>` : ''}</button>`;
   }).join('');
-  for (const b of document.querySelectorAll('.proj')) b.onclick = () => { state.active = b.dataset.id; render(); };
+  for (const b of document.querySelectorAll('.proj')) b.onclick = () => { setActiveProject(b.dataset.id); render(); };
 }
 
 function proofMediaHtml(taskId, proof, altLabel){
@@ -4372,8 +4364,9 @@ function renderStream(){
     inp.addEventListener('keydown', async (e) => {
       if (e.key !== 'Enter' || e.isComposing || !inp.value.trim()) return;
       const text = inp.value.trim(); inp.value = ''; inp.disabled = true;
-      const r = await fetch(withKey(`/api/goals/${inp.dataset.goal}/reply`), { method: 'POST',
-        headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text })) });
+      let r; try { r = await fetch(withKey(`/api/goals/${inp.dataset.goal}/reply`), { method: 'POST',
+        headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text })) }); }
+      catch { showErr('Reply failed — the goal may not have started yet.'); inp.disabled = false; return; }
       if (!r.ok) showErr('Reply failed — the goal may not have started yet.');
       inp.disabled = false;
     });
@@ -4498,18 +4491,22 @@ function renderQueue(){
     const text = document.getElementById(`qedit-${id}`).value.trim();
     const pr = document.getElementById(`qedit-pr-${id}`).dataset.val;
     if (text) {
-      const r = await fetch(withKey(`/api/goals/${id}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text, pr }) });
-      if (r.ok) upsert(state.goals, await r.json());
+      try {
+        const r = await fetch(withKey(`/api/goals/${id}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text, pr }) });
+        if (r.ok) upsert(state.goals, await r.json()); else showErr('Save failed.');
+      } catch { showErr('Save failed.'); }
     }
     state.editing = null; render();
   };
   for (const b of q.querySelectorAll('.qp')) b.onclick = async () => {
-    const r = await fetch(withKey(`/api/goals/${b.dataset.id}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ promote: true }) });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.id}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ promote: true }) }); }
+    catch { showErr('Too late — this goal already started.'); render(); return; }
     if (r.ok) upsert(state.goals, await r.json()); else showErr('Too late — this goal already started.');
     render();
   };
   for (const b of q.querySelectorAll('.qd')) b.onclick = async () => {
-    const r = await fetch(withKey(`/api/goals/${b.dataset.id}`), { method: 'DELETE' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.id}`), { method: 'DELETE' }); }
+    catch { showErr('Too late — this goal already started.'); await refresh(); render(); return; }
     if (r.ok) state.goals = state.goals.filter((g) => g.id !== Number(b.dataset.id));
     else { showErr('Too late — this goal already started.'); await refresh(); }
     render();
@@ -4724,15 +4721,19 @@ function renderTasks(){
       const id = Number(el.dataset.task);
       const rb = e.target.closest('[data-retrybtn]');
       if (rb) {
-        const r = await fetch(withKey(`/api/tasks/${rb.dataset.retrybtn}/retry`), { method: 'POST' });
-        if (!r.ok) showErr('Retry failed.'); else await refresh();
+        try {
+          const r = await fetch(withKey(`/api/tasks/${rb.dataset.retrybtn}/retry`), { method: 'POST' });
+          if (!r.ok) showErr('Retry failed.'); else await refresh();
+        } catch { showErr('Retry failed.'); }
         return;
       }
       const sb = e.target.closest('[data-skipbtn]');
       if (sb) {
-        const r = await fetch(withKey(`/api/tasks/${sb.dataset.skipbtn}/skip`), { method: 'POST',
-          headers: { 'content-type': 'application/json' }, body: JSON.stringify({ reason: 'Dismissed from Attention.' }) });
-        if (!r.ok) showErr('Dismiss failed.'); else await refresh();
+        try {
+          const r = await fetch(withKey(`/api/tasks/${sb.dataset.skipbtn}/skip`), { method: 'POST',
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify({ reason: 'Dismissed from Attention.' }) });
+          if (!r.ok) showErr('Dismiss failed.'); else await refresh();
+        } catch { showErr('Dismiss failed.'); }
         return;
       }
       // Attention rows open the same detail dialog as Review (tap anywhere but
@@ -4776,11 +4777,13 @@ function renderTasks(){
     b.onclick = async (e) => { e.stopPropagation();
       const bx = b.getBoundingClientRect(); // capture before await/re-render — burst FROM the ✓ button
       let ok = true, mergeGoal = null;
-      for (const id of b.dataset.qapprove.split(',')) {
-        const r = await fetch(withKey(`/api/goals/${id}/approve`), { method: 'POST' });
-        if (!r.ok){ ok = false; break; }
-        const j = await r.json(); if (j && j.needsMerge) mergeGoal = j.goal; // 07-20c: PR goal
-      }
+      try {
+        for (const id of b.dataset.qapprove.split(',')) {
+          const r = await fetch(withKey(`/api/goals/${id}/approve`), { method: 'POST' });
+          if (!r.ok){ ok = false; break; }
+          const j = await r.json(); if (j && j.needsMerge) mergeGoal = j.goal; // 07-20c: PR goal
+        }
+      } catch { ok = false; }
       if (!ok){ showErr('Approve failed.'); return; }
       await refresh();
       if (mergeGoal){ confirmMerge(mergeGoal); return; } // merge instead of confetti
@@ -4790,19 +4793,24 @@ function renderTasks(){
     // 07-20c: the inline ✕ is a pure Reject — park the goal in the Rejected column (/reject),
     // no auto-rework. Rework is asked for via chat.
     b.onclick = async (e) => { e.stopPropagation();
-      let r; for (const id of b.dataset.qdismiss.split(',')) r = await fetch(withKey(`/api/goals/${id}/reject`), { method: 'POST' });
+      let r; try { for (const id of b.dataset.qdismiss.split(',')) r = await fetch(withKey(`/api/goals/${id}/reject`), { method: 'POST' }); }
+      catch { showErr('Dismiss failed.'); return; }
       qrefresh(r, 'Dismiss failed.'); };
   }
   // Archive: retire an unfinished goal cleanly (no rework spawned). The escape
   // hatch for half-finished (partial/blocked) items so Attention stays drainable.
   for (const b of $('tasklist').querySelectorAll('[data-archivegoal]')) {
     b.onclick = async (e) => { e.stopPropagation();
-      qrefresh(await fetch(withKey(`/api/goals/${b.dataset.archivegoal}/archive`), { method: 'POST' }), 'Archive failed.'); };
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.archivegoal}/archive`), { method: 'POST' }); }
+      catch { showErr('Archive failed.'); return; }
+      qrefresh(r, 'Archive failed.'); };
   }
   // Manager-verified gate: re-run tests + re-capture proof for a blocked goal.
   for (const b of $('tasklist').querySelectorAll('[data-goalreverify]')) {
     b.onclick = async (e) => { e.stopPropagation(); b.disabled = true; b.textContent = '再検証中…';
-      qrefresh(await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' }), '再検証に失敗'); };
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' }); }
+      catch { showErr('再検証に失敗'); return; }
+      qrefresh(r, '再検証に失敗'); };
   }
   for (const b of $('tasklist').querySelectorAll('[data-qreply]')) {
     b.onclick = (e) => { e.stopPropagation();
@@ -4845,14 +4853,16 @@ function renderTasks(){
   for (const b of $('tasklist').querySelectorAll('[data-pstart]')) {
     b.onclick = async (e) => {
       e.stopPropagation();
-      const r = await fetch(withKey(`/api/goals/${b.dataset.pstart}/activate`), { method: 'POST' });
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.pstart}/activate`), { method: 'POST' }); }
+      catch { showErr('Start failed.'); return; }
       if (!r.ok) showErr('Start failed.'); else await refresh();
     };
   }
   for (const b of $('tasklist').querySelectorAll('[data-pdel]')) {
     b.onclick = async (e) => {
       e.stopPropagation();
-      const r = await fetch(withKey(`/api/goals/${b.dataset.pdel}`), { method: 'DELETE' });
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.pdel}`), { method: 'DELETE' }); }
+      catch { showErr('Delete failed.'); return; }
       if (!r.ok) showErr('Delete failed.'); else await refresh();
     };
   }
@@ -4864,13 +4874,15 @@ function renderTasks(){
     e.stopPropagation();
     const preview = b.closest('.goalhead')?.querySelector('.gt')?.textContent || '';
     if (!(await confirmDelete({ title: 'Delete this goal?', preview }))) return;
-    const r = await fetch(withKey(`/api/goals/${b.dataset.ghdel}`), { method: 'DELETE' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.ghdel}`), { method: 'DELETE' }); }
+    catch { showErr('Cannot delete a running/finished goal — reply to append instead'); return; }
     if (!r.ok) showErr('Cannot delete a running/finished goal — reply to append instead'); else await refresh();
   };
   // Smart intake: answer a planner clarifying question (chip or free text) → re-plan.
   const answerQ = async (id, answer) => {
     if (!answer) return;
-    const r = await fetch(withKey(`/api/goals/${id}/answer`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ answer }) });
+    let r; try { r = await fetch(withKey(`/api/goals/${id}/answer`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ answer }) }); }
+    catch { showErr('Failed to send answer'); return; }
     if (!r.ok) showErr('Failed to send answer'); else await refresh();
   };
   for (const b of $('tasklist').querySelectorAll('[data-qanswer]')) b.onclick = (e) => { e.stopPropagation(); answerQ(Number(b.dataset.qanswer), b.dataset.answer); };
@@ -4967,7 +4979,8 @@ function openGoalheadReply(id, btn){
   const snd = document.createElement('button'); snd.className = 'qbtn ok'; snd.textContent = '↑';
   wrap.appendChild(inp); wrap.appendChild(snd); head.insertAdjacentElement('afterend', wrap); inp.focus();
   const send = async () => { const t = inp.value.trim(); if (!t) return;
-    const r = await fetch(withKey(`/api/goals/${id}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text: t })) });
+    let r; try { r = await fetch(withKey(`/api/goals/${id}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text: t })) }); }
+    catch { showErr('未開始のゴールは編集を使ってください'); return; }
     if (!r.ok) showErr('未開始のゴールは編集を使ってください'); await refresh(); };
   inp.onkeydown = (e) => { if (e.key === 'Enter' && !e.isComposing) { e.preventDefault(); send(); } if (e.key === 'Escape') wrap.remove(); };
   snd.onclick = send;
@@ -4990,9 +5003,11 @@ function wirePriority(){
     b.onclick = async (e) => {
       e.stopPropagation();
       b.closest('.priomenu')?.classList.remove('show');
-      const r = await fetch(withKey(`/api/tasks/${b.dataset.priotask}/priority`), { method: 'PUT',
-        headers: { 'content-type': 'application/json' }, body: JSON.stringify({ priority: b.dataset.val }) });
-      if (!r.ok) showErr('優先度の変更に失敗しました。'); else await refresh();
+      try {
+        const r = await fetch(withKey(`/api/tasks/${b.dataset.priotask}/priority`), { method: 'PUT',
+          headers: { 'content-type': 'application/json' }, body: JSON.stringify({ priority: b.dataset.val }) });
+        if (!r.ok) showErr('優先度の変更に失敗しました。'); else await refresh();
+      } catch { showErr('優先度の変更に失敗しました。'); }
     };
   }
 }
@@ -5188,26 +5203,31 @@ $('wfHeaderEdit').onclick = (e) => { e.stopPropagation(); openWfEditor(); };
 $('wfoverlay').addEventListener('click', (e) => { if (e.target === $('wfoverlay')) $('wfoverlay').classList.remove('show'); });
 $('wfsave').onclick = async () => {
   const columns = state.wfDraft.map((c) => ({ key: c.key, label: c.label.trim(), bucket: c.bucket }));
-  const r = await fetch(withKey(`/api/projects/${state.active}/columns`), { method: 'PUT',
-    headers: { 'content-type': 'application/json' }, body: JSON.stringify({ columns }) });
-  const data = await r.json().catch(() => ({}));
-  if (!r.ok) {
-    $('wferr').textContent = data.error || 'Save failed.';
-    $('wferr').style.display = 'block';
-    return;
-  }
-  const rdr = await fetch(withKey(`/api/projects/${state.active}/review-definition`), { method: 'PUT',
-    headers: { 'content-type': 'application/json' }, body: JSON.stringify({ reviewDefinition: state.rdDraft }) });
-  const rdData = await rdr.json().catch(() => ({}));
-  if (!rdr.ok) {
-    $('wferr').textContent = rdData.error || 'Save failed.';
+  try {
+    const r = await fetch(withKey(`/api/projects/${state.active}/columns`), { method: 'PUT',
+      headers: { 'content-type': 'application/json' }, body: JSON.stringify({ columns }) });
+    const data = await r.json().catch(() => ({}));
+    if (!r.ok) {
+      $('wferr').textContent = data.error || 'Save failed.';
+      $('wferr').style.display = 'block';
+      return;
+    }
+    const rdr = await fetch(withKey(`/api/projects/${state.active}/review-definition`), { method: 'PUT',
+      headers: { 'content-type': 'application/json' }, body: JSON.stringify({ reviewDefinition: state.rdDraft }) });
+    const rdData = await rdr.json().catch(() => ({}));
+    if (!rdr.ok) {
+      $('wferr').textContent = rdData.error || 'Save failed.';
+      $('wferr').style.display = 'block';
+      return;
+    }
+    state.workflowColumns[state.active] = data.columns;
+    state.reviewDefinitions[state.active] = rdData.reviewDefinition;
+    $('wfoverlay').classList.remove('show');
+    render();
+  } catch {
+    $('wferr').textContent = 'Save failed.';
     $('wferr').style.display = 'block';
-    return;
   }
-  state.workflowColumns[state.active] = data.columns;
-  state.reviewDefinitions[state.active] = rdData.reviewDefinition;
-  $('wfoverlay').classList.remove('show');
-  render();
 };
 
 function wireWfEditButtons(){
@@ -5432,7 +5452,8 @@ function renderReviewChecklist(){
       e.stopPropagation();
       b.disabled = true;
       b.textContent = '再検証中…';
-      const r = await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' });
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' }); }
+      catch { showErr('再検証に失敗'); b.disabled = false; return; }
       if (r.ok) await refresh(); else showErr('再検証に失敗');
     };
   }
@@ -5444,9 +5465,10 @@ function renderReviewChecklist(){
       if (!text) return;
       const t = reqs.find((r) => r.id === taskId);
       b.disabled = true; input.disabled = true;
-      const r = await fetch(withKey(`/api/goals/${goalId}/reply`), { method: 'POST',
+      let r; try { r = await fetch(withKey(`/api/goals/${goalId}/reply`), { method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(replyWorkerPayload({ text: `[Fix request for requirement #${t?.num ?? ''} "${t?.title ?? ''}"] ${text}` })) });
+        body: JSON.stringify(replyWorkerPayload({ text: `[Fix request for requirement #${t?.num ?? ''} "${t?.title ?? ''}"] ${text}` })) }); }
+      catch { showErr('Failed to send the fix request.'); b.disabled = false; input.disabled = false; return; }
       if (r.ok) { input.value = ''; input.placeholder = 'Sent — the worker will pick it up'; }
       else showErr('Failed to send the fix request.');
       b.disabled = false; input.disabled = false;
@@ -6367,7 +6389,7 @@ function renderFsRail(){
   el.innerHTML = html;
   for (const b of el.querySelectorAll('[data-fsproj]')) b.onclick = (e) => {
     if (e.target.closest('.pname.editing') || b.querySelector('.pname.editing')) return;
-    state.active = b.dataset.fsproj; document.body.classList.remove('projectsopen'); render();
+    setActiveProject(b.dataset.fsproj); document.body.classList.remove('projectsopen'); render();
   };
   const add = $('fsProjAdd'); if (add) add.onclick = createProject;
 }
@@ -6538,11 +6560,6 @@ function renderFsFeed(){
     let t = '';
     if (turn.role === 'you') {
       t += `<div class="cc-you"><span class="cy-n">You</span><div class="cy-t">${esc(turn.text)}</div></div>`;
-      if (turn.markGoalId != null && !turn.undone) {
-        const mg = state.goals.find((x) => x.id === turn.markGoalId);
-        const n = mg ? goalReviewNumber({ goal: mg, tasks: state.tasks }) : turn.markGoalId;
-        t += `<div class="cc-mark"><span class="cm-ar">→</span><span class="cm-t">Added to To Do</span><span class="cm-no">#${n}</span><button class="cm-undo" type="button" data-ccundo="${turn.markGoalId}">Undo</button></div>`;
-      }
     } else { // Claude Code reply — speaker line first (You → speaker → reply), then the text
       const app = connectedAppMeta(turn.agent);
       t += `<div class="cc-who">${app.icon}<span class="cs-n">${esc(app.label)}</span></div>`;
@@ -6595,24 +6612,12 @@ function renderFsFeed(){
   // Delete a "needs your answer" card outright (restores 「Needs your answer」カードを削除
   // できるように — a question you don't want to answer had no discard path in flagship).
   for (const b of feed.querySelectorAll('[data-fsanswerdel]')) b.onclick = (e) => { e.stopPropagation(); fsTaskDelete(Number(b.dataset.fsanswerdel)); };
-  // Pattern A (H23): Undo a "→ Added to To Do" marker — cancel the created goal
-  // and drop the mark. A just-created (planning) goal is deletable; if it already
-  // started the server returns non-OK (canDeleteGoal) and we say so quietly.
-  for (const b of feed.querySelectorAll('[data-ccundo]')) b.onclick = async (e) => {
-    e.stopPropagation();
-    const gid = Number(b.dataset.ccundo);
-    const r = await fetch(withKey(`/api/goals/${gid}`), { method: 'DELETE' });
-    if (!r.ok) { showErr('Could not undo — the task may already be running'); return; }
-    const turn = (state.chatTurns[state.active] || []).find((t) => t.markGoalId === gid);
-    if (turn) turn.undone = true;
-    state.goals = state.goals.filter((g) => g.id !== gid);
-    render();
-  };
 }
 async function fsAnswerQuestion(goalId, answer){
   if (!answer) return;
-  const r = await fetch(withKey(`/api/goals/${goalId}/answer`), { method: 'POST',
-    headers: { 'content-type': 'application/json' }, body: JSON.stringify({ answer }) });
+  let r; try { r = await fetch(withKey(`/api/goals/${goalId}/answer`), { method: 'POST',
+    headers: { 'content-type': 'application/json' }, body: JSON.stringify({ answer }) }); }
+  catch { showErr('Failed to send answer'); return; }
   if (!r.ok) showErr('Failed to send answer'); else await refresh();
 }
 async function fsRetryTask(id){
@@ -6989,17 +6994,20 @@ function renderFsReview(){
   // "Also carries" section (saItemHtml + the seeall handler).
   for (const b of el.querySelectorAll('[data-fsapprove]')) b.onclick = async (e) => { e.stopPropagation();
     let ok = true, mergeGoal = null;
-    for (const id of b.dataset.fsapprove.split(',')) {
-      const r = await fetch(withKey(`/api/goals/${id}/approve`), { method: 'POST' });
-      if (!r.ok){ ok = false; break; }
-      const j = await r.json(); if (j && j.needsMerge) mergeGoal = j.goal; // 07-20c: PR goal
-    }
+    try {
+      for (const id of b.dataset.fsapprove.split(',')) {
+        const r = await fetch(withKey(`/api/goals/${id}/approve`), { method: 'POST' });
+        if (!r.ok){ ok = false; break; }
+        const j = await r.json(); if (j && j.needsMerge) mergeGoal = j.goal; // 07-20c: PR goal
+      }
+    } catch { ok = false; }
     if (!ok){ showErr('Approve failed.'); return; }
     await refresh();
     if (mergeGoal) confirmMerge(mergeGoal); else celebrateApprove(); };
   for (const b of el.querySelectorAll('[data-fsdismiss]')) b.onclick = async (e) => { e.stopPropagation();
     // 07-20c: the review-card ✕ is a pure Reject → Rejected column (/reject), no auto-rework.
-    let r; for (const id of b.dataset.fsdismiss.split(',')) r = await fetch(withKey(`/api/goals/${id}/reject`), { method: 'POST' });
+    let r; try { for (const id of b.dataset.fsdismiss.split(',')) r = await fetch(withKey(`/api/goals/${id}/reject`), { method: 'POST' }); }
+    catch { showErr('Dismiss failed.'); return; }
     if (r && r.ok) await refresh(); else showErr('Dismiss failed.'); };
 }
 // Shared To Do bucketing (list rows AND the kanban board read the same groups —
@@ -7290,14 +7298,16 @@ function renderFsTodo(){
     if (Number.isFinite(id)) fsOpenGoalDetail(id);
   };
   for (const b of el.querySelectorAll('[data-fsreopen]')) b.onclick = async (e) => { e.stopPropagation();
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fsreopen}/reopen`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsreopen}/reopen`), { method: 'POST' }); }
+    catch { showErr('Reopen failed.'); return; }
     if (!r.ok) showErr('Reopen failed.'); else await refresh(); };
   for (const b of el.querySelectorAll('[data-fsrejdel]')) b.onclick = async (e) => { e.stopPropagation();
     const preview = b.closest('.trow')?.querySelector('.tt')?.textContent || '';
     // Delete on a rejected goal = revert: it closes the PR + drops the worktree, so a rejected
     // goal that had a PR doesn't leave an orphan PR behind (DELETE would 409 — rejected isn't deletable).
     if (!(await confirmDelete({ title: 'Discard this rejected goal?', preview }))) return;
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fsrejdel}/revert`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsrejdel}/revert`), { method: 'POST' }); }
+    catch { showErr('Delete failed.'); return; }
     if (!r.ok) showErr('Delete failed.'); else await refresh(); };
   const more = el.querySelector('#fsTodoMore');
   if (more) more.onclick = () => { fsUI.todoMore = !fsUI.todoMore; renderFsTodo(); };
@@ -7316,45 +7326,53 @@ function renderFsTodo(){
   for (const b of el.querySelectorAll('[data-fsglog]')) b.onclick = () => toggleGoalDetail(Number(b.dataset.fsglog));
   for (const b of el.querySelectorAll('[data-fsreverify]')) b.onclick = async () => {
     b.disabled = true; b.textContent = 'Starting…';
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fsreverify}/reverify`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsreverify}/reverify`), { method: 'POST' }); }
+    catch { showErr(document.documentElement.lang === 'ja' ? 'Retryに失敗しました' : 'Retry failed.'); b.disabled = false; b.textContent = 'Retry'; return; }
     if (!r.ok) { showErr(document.documentElement.lang === 'ja' ? 'Retryに失敗しました' : 'Retry failed.'); b.disabled = false; b.textContent = 'Retry'; }
     else await refresh();
   };
   for (const b of el.querySelectorAll('[data-fsarchive]')) b.onclick = async () => {
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fsarchive}/archive`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsarchive}/archive`), { method: 'POST' }); }
+    catch { showErr('Archive failed.'); return; }
     if (!r.ok) showErr('Archive failed.'); else await refresh();
   };
   // LATER row actions (PRD §8.2): Start queues the shelved goal, Delete discards it.
   for (const b of el.querySelectorAll('[data-fspstart]')) b.onclick = async (e) => { e.stopPropagation();
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fspstart}/activate`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fspstart}/activate`), { method: 'POST' }); }
+    catch { showErr('Start failed.'); return; }
     if (!r.ok) showErr('Start failed.'); else await refresh(); };
   const startNextLater = el.querySelector('[data-fsstartnextlater]');
   if (startNextLater) startNextLater.onclick = async (e) => { e.stopPropagation();
     startNextLater.disabled = true;
-    const r = await fetch(withKey(`/api/goals/${startNextLater.dataset.fsstartnextlater}/activate`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${startNextLater.dataset.fsstartnextlater}/activate`), { method: 'POST' }); }
+    catch { showErr(document.documentElement.lang === 'ja' ? '開始できませんでした' : 'Could not start the next item.'); startNextLater.disabled = false; return; }
     if (!r.ok) { showErr(document.documentElement.lang === 'ja' ? '開始できませんでした' : 'Could not start the next item.'); startNextLater.disabled = false; }
     else await refresh(); };
   for (const b of el.querySelectorAll('[data-fspdel]')) b.onclick = async (e) => { e.stopPropagation();
     const preview = b.closest('.trow')?.querySelector('.tt')?.textContent || '';
     if (!(await confirmDelete({ title: 'Delete this shelved goal?', preview }))) return;
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fspdel}`), { method: 'DELETE' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fspdel}`), { method: 'DELETE' }); }
+    catch { showErr('Delete failed.'); return; }
     if (!r.ok) showErr('Delete failed.'); else await refresh(); };
   // hover-toolbar actions → same endpoints as the SL1 goalhead toolbar
   for (const b of el.querySelectorAll('[data-fsreply]')) b.onclick = (e) => { e.stopPropagation();
     fsInlineInput(b.closest('.trow'), '', 'Reply to this goal…', async (text) => {
-      const r = await fetch(withKey(`/api/goals/${b.dataset.fsreply}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text })) });
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsreply}/reply`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(replyWorkerPayload({ text })) }); }
+      catch { showErr('未開始のゴールは編集を使ってください'); return; }
       if (!r.ok) showErr('未開始のゴールは編集を使ってください'); await refresh();
     }); };
   for (const b of el.querySelectorAll('[data-fsedit]')) b.onclick = (e) => { e.stopPropagation();
     const g = state.goals.find((x) => x.id === Number(b.dataset.fsedit));
     fsInlineInput(b.closest('.trow'), g?.text ?? '', 'Edit the goal…', async (text) => {
-      const r = await fetch(withKey(`/api/goals/${b.dataset.fsedit}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text }) });
+      let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsedit}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text }) }); }
+      catch { showErr('Cannot edit a running/finished goal — reply to append instead'); return; }
       if (!r.ok) showErr('Cannot edit a running/finished goal — reply to append instead'); await refresh();
     }); };
   for (const b of el.querySelectorAll('[data-fsdel]')) b.onclick = async (e) => { e.stopPropagation();
     const preview = b.closest('.trow')?.querySelector('.tt')?.textContent || '';
     if (!(await confirmDelete({ title: 'Delete this goal?', preview }))) return;
-    const r = await fetch(withKey(`/api/goals/${b.dataset.fsdel}`), { method: 'DELETE' });
+    let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.fsdel}`), { method: 'DELETE' }); }
+    catch { showErr('Cannot delete a running/finished goal — reply to append instead'); return; }
     if (!r.ok) showErr('Cannot delete a running/finished goal — reply to append instead'); else await refresh(); };
 }
 async function fsCreateGoal(text, pending){
@@ -7472,7 +7490,7 @@ async function createProject(){
     if (!r.ok) throw new Error();
     const body = await r.json();
     state.projects = body.projects ?? [...state.projects, body.project].filter(Boolean);
-    state.active = body.project.id;
+    setActiveProject(body.project.id);
     document.body.classList.remove('projectsopen');
     render();
   } catch { showErr('New project failed.'); }
@@ -7504,7 +7522,7 @@ async function deleteProject(p){
     const body = await r.json().catch(() => ({}));
     if (!r.ok) throw new Error(body.error || 'Delete project failed.');
     state.projects = body.projects ?? state.projects.filter((x) => x.id !== p.id);
-    if (state.active === p.id) state.active = state.projects[0]?.id ?? state.active;
+    if (state.active === p.id) setActiveProject(state.projects[0]?.id ?? state.active);
     document.body.classList.remove('projectsopen');
     render();
   } catch (err) {
@@ -7539,21 +7557,24 @@ $('fsProjects').addEventListener('dblclick', (e) => {
 async function fsTaskRename(span, goalId){
   if (!goalId) return;
   inlineFsRename(span, async (v) => {
-    const r = await fetch(withKey(`/api/goals/${goalId}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: v }) });
+    let r; try { r = await fetch(withKey(`/api/goals/${goalId}`), { method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: v }) }); }
+    catch { showErr('Cannot rename a running/finished goal — reply to append instead'); return; }
     if (!r.ok) showErr('Cannot rename a running/finished goal — reply to append instead');
     await refresh();
   });
 }
 async function fsTaskArchive(goalId){
   if (!goalId) return;
-  const r = await fetch(withKey(`/api/goals/${goalId}/archive`), { method: 'POST' });
+  let r; try { r = await fetch(withKey(`/api/goals/${goalId}/archive`), { method: 'POST' }); }
+  catch { showErr('Archive failed.'); return; }
   if (!r.ok) showErr('Archive failed.'); else await refresh();
 }
 async function fsTaskDelete(goalId){
   if (!goalId) return;
   const preview = state.goals.find((x) => x.id === goalId)?.text || '';
   if (!(await confirmDelete({ title: 'Delete this goal?', preview }))) return;
-  const r = await fetch(withKey(`/api/goals/${goalId}`), { method: 'DELETE' });
+  let r; try { r = await fetch(withKey(`/api/goals/${goalId}`), { method: 'DELETE' }); }
+  catch { showErr('Cannot delete a running/finished goal — reply to append instead'); return; }
   if (!r.ok) showErr('Cannot delete a running/finished goal — reply to append instead'); else await refresh();
 }
 $('fsTodoSec').addEventListener('contextmenu', (e) => {
@@ -7587,7 +7608,7 @@ function fsSwitcherOpen(){
 function fsSwitcherHi(){ [...fsCtx.querySelectorAll('button')].forEach((b, i) => b.classList.toggle('hi', i === fsCtxSel)); }
 function fsSelectProjByIndex(idx){
   const rows = [...document.querySelectorAll('#fsProjects .fsproj')]; if (idx < 0 || idx >= rows.length) return;
-  state.active = rows[idx].dataset.fsproj; render();
+  setActiveProject(rows[idx].dataset.fsproj); render();
 }
 document.addEventListener('keydown', (e) => {
   if (fsCtx.classList.contains('open') && fsCtxSwitcher) {
@@ -8327,7 +8348,7 @@ async function refresh(){
     state.workflowColumns = s.workflowColumns ?? {};
     state.reviewDefinitions = s.reviewDefinitions ?? {};
     checkUiVersion(s.uiVersion);
-    if (!state.projects.some((p) => p.id === state.active)) state.active = state.projects[0]?.id;
+    if (!state.projects.some((p) => p.id === state.active)) setActiveProject(state.projects[0]?.id);
     render();
   } catch { /* server briefly down; SSE reconnect will retry */ }
 }
@@ -8412,7 +8433,7 @@ function connectSSE(){
     else if (m.ev === 'review-definition') state.reviewDefinitions[m.projectId] = m.reviewDefinition;
     else if (m.ev === 'projects') {
       state.projects = m.projects ?? state.projects;
-      if (!state.projects.some((p) => p.id === state.active)) state.active = state.projects[0]?.id;
+      if (!state.projects.some((p) => p.id === state.active)) setActiveProject(state.projects[0]?.id);
     }
     else if (m.ev === 'ping') { checkUiVersion(m.uiVersion); return; }
     else if (m.ev === 'auth') { renderAuthBanner(m.auth); return; } // selected worker's sign-in preflight result
@@ -8448,7 +8469,7 @@ function bootDisconnected(info){
   applyTheme(); applyCust();
   // seed a minimal board so it renders like the real empty state
   state.projects = [{ id: '__onboard', name: 'Your project' }];
-  state.active = '__onboard';
+  setActiveProject('__onboard');
   state.billing = { licensed: false, email };
   try { render(); } catch (e) { console.warn('disconnected render', e); }
   const heroSpan = document.querySelector('#fsClawdHero .hstat');
@@ -8664,15 +8685,6 @@ async function postOutboxItem(item){
     outbox.land(item.oid, goal.id);
     upsert(state.goals, goal);
     if (recentlySignedOut && !state.billing?.licensed) { recentlySignedOut = false; showSignInNudge(); }
-    // Pattern A (H23): this send became a real To-Do — mark the most recent
-    // unmarked user turn "→ Added to To Do #NN" in the feed. Skip a needsInput
-    // goal (it's still asking; shown as the question card at the feed bottom).
-    if (goal.status !== 'needsInput') {
-      const turns = state.chatTurns[item.projectId] || [];
-      for (let k = turns.length - 1; k >= 0; k--) {
-        if (turns[k].role === 'you' && turns[k].markGoalId == null) { turns[k].markGoalId = goal.id; break; }
-      }
-    }
   } catch {
     outbox.mark(item.oid, 'unsent');
   } finally {
@@ -8887,16 +8899,13 @@ async function send(){
     projectId: state.active, text, pr: 'auto', model, effort, agent: state.connectedApp,
     mode, skill: skill || null,
     workspaceMode: workspaceMode(),
-    // Keep the old wire contract too: only direct sends worktree:false.
-    worktree: worktreeOn() ? undefined : false,
     pending: later, review,
     images: attach.map((a) => a.path), imageUrls: attach.map((a) => a.url),
     status: 'sending', ts: Date.now(),
   };
   outbox.add(item); // saved locally BEFORE any network call
   // Pattern A (H23): the user's own turn enters the center feed immediately, so
-  // the composer reads like a conversation. If this send becomes a To-Do, a
-  // .cc-mark is attached to this turn later; if it's chat, a reply turn follows.
+  // the composer reads like a conversation; if it's chat, a reply turn follows.
   (state.chatTurns[state.active] ||= []).push({ role: 'you', text, ts: Date.now() });
   state.attach = [];
   // mode/skill/later/review are per-message → clear after send (model stays sticky).
@@ -9025,9 +9034,12 @@ function renderSummaryPera(){
   body.querySelector('[data-peradetail]') && (body.querySelector('[data-peradetail]').onclick = () => { state.peraDetailOpen = !state.peraDetailOpen; renderSummaryPera(); });
 }
 async function peraAct(ids, kind){
-  for (const id of String(ids).split(',')) {
-    await fetch(withKey(`/api/goals/${id}/${kind}`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: kind === 'dismiss' ? JSON.stringify({ text: '' }) : undefined });
-  }
+  try {
+    for (const id of String(ids).split(',')) {
+      const r = await fetch(withKey(`/api/goals/${id}/${kind}`), { method: 'POST', headers: { 'content-type': 'application/json' }, body: kind === 'dismiss' ? JSON.stringify({ text: '' }) : undefined });
+      if (!r.ok) throw new Error();
+    }
+  } catch { showErr(kind === 'approve' ? 'Approve failed.' : 'Dismiss failed.'); return; }
   if (kind === 'approve') celebrateApprove(); // confetti from the ペライチ too
   state.peraSpot = 0;
   await refresh();
@@ -9145,6 +9157,7 @@ function saRowFromDigest(r, gs, ts){
       goalText: String(g?.text ?? '').replace(/\s+/g, ' ').trim(),
       did, siblings, risk: g?.risk ?? null,
       verificationInfraError: g?.verificationInfraError ?? r.verificationInfraError ?? null,
+      prNote: g?.prNote ?? null,
       note: g?.retest?.passed ? g.retest.note : null,
       pr: r.pr,
       // P0b (Masa 2026-07-21): the AI's own TodoWrite breakdown for the "Steps" section
@@ -9593,7 +9606,8 @@ function saItemHtml(it, i){
   const fDel = it.metaDel ?? (hasGitDiff ? `−${d.del}` : clientDiff ? `−${cDel}` : null);
   const chips = [];
   if (it.pr) chips.push(`<a class="mx mlink pr" href="${esc(it.pr)}" target="_blank" rel="noopener" title="Open pull request"><span class="mk">PR</span> <b>#${esc(prNum)}</b> <span class="mmut">Open</span>${arw}</a>`);
-  if (it.tokenOpt && tokPct > 0) chips.push(`<button type="button" class="mx mtok" data-saact="tok:${i}"><span class="mk">Token</span> <b>${tokPct}%</b> <span class="mmut">saved</span> <i class="tokchevron">›</i></button>`);
+  const tokUntied = it.tokenOpt?.basis === 'baseline-untied';
+  if (it.tokenOpt && tokPct > 0) chips.push(`<button type="button" class="mx mtok" data-saact="tok:${i}"><span class="mk">Token</span> <b>${tokPct}%</b> <span class="mmut">${tokUntied ? 'smaller' : 'saved'}</span> <i class="tokchevron">›</i></button>`);
   if (testsLabel) chips.push(`<span class="mx"><span class="mk">Tests</span> <b class="ok">${esc(testsLabel)}</b></span>`);
   // Files: hide-empty — only with changed files AND totals (a bare-count chip reads odd).
   if (nf && fAdd) chips.push(`<span class="mx"><span class="mk">Files</span> <b>${nf}</b> <span class="mmut">· <i class="a">${esc(fAdd)}</i> <i class="d">${esc(fDel)}</i></span></span>`);
@@ -9609,7 +9623,7 @@ function saItemHtml(it, i){
   if (it.recording) chips.push(it.recordingUrl
     ? `<a class="mx mlink" href="${esc(it.recordingUrl)}" target="_blank" rel="noopener" title="Watch the recording"><span class="mk">Verify</span> <b>recording</b>${arw}</a>`
     : `<a class="mx mlink" data-saact="rec:${i}" style="cursor:pointer" title="Watch the recording"><span class="mk">Verify</span> <b>recording</b>${arw}</a>`);
-  const tokCmp = it.tokenOpt?.basis === 'baseline' ? 'vs your recent average' : 'from prompt caching';
+  const tokCmp = tokUntied ? 'vs your recent average (no technique behind it)' : it.tokenOpt?.basis === 'baseline' ? 'vs your recent average' : 'from prompt caching';
   const tokTech = (it.tokenOpt?.techniques ?? []).slice(0, 4).join(' / ');
   const metaDetail = (it.tokenOpt && tokPct > 0) ? `<div class="rmeta-detail" id="tokdetail${i}"><span class="k">How this run used tokens</span><span class="v">${esc(tokCmp)}${tokTech ? ` · ${esc(tokTech)}` : ''}</span></div>` : '';
   // §1.5-3: with Open it moved into the body, a card with no PR / tokens / tests has no
@@ -9726,6 +9740,15 @@ function saItemHtml(it, i){
   const riskHtml = risk?.shouldPause
     ? `<div class="lg-risk"><svg viewBox="0 0 24 24"><path d="M12 8v5M12 16.5v.5"/><path d="M10.3 3.9 2.4 18a1.9 1.9 0 0 0 1.7 2.9h15.8a1.9 1.9 0 0 0 1.7-2.9L13.7 3.9a1.9 1.9 0 0 0-3.4 0z"/></svg>Needs your review — touches a sensitive area${risk.categories?.length ? `: ${esc(risk.categories.map((c) => c.label).join(', '))}` : ''}</div>`
     : '';
+  // ── PR-requested-but-no-code note (goal #751, Masa 2026-07-26): a wantsPR goal whose
+  // worker ended with zero changed files and no proof — most often a lane-conflict
+  // report ("空き次第自動再開します") that could not actually resume, since a `claude -p`
+  // run is one-shot. Advisory only (isNothingVerifiableForPR never blocks — Failedを作ら
+  // ない方針を尊重), so the reviewer sees it and decides instead of it silently reading
+  // as a normal completed PR review. ──
+  const prNoteHtml = it.prNote
+    ? `<div class="lg-risk"><svg viewBox="0 0 24 24"><path d="M12 8v5M12 16.5v.5"/><path d="M10.3 3.9 2.4 18a1.9 1.9 0 0 0 1.7 2.9h15.8a1.9 1.9 0 0 0 1.7-2.9L13.7 3.9a1.9 1.9 0 0 0-3.4 0z"/></svg>${esc(it.prNote)}</div>`
+    : '';
   // ── Activity (spec §3): ONE Linear-docs pulldown. The "Activity" heading is plain; the
   // chevron sits on the FIRST line (the opening "You …" row); tapping it opens the rest
   // below, offset-indented. The review Discussion folds in at the bottom of the body. The
@@ -9817,6 +9840,7 @@ function saItemHtml(it, i){
     ${S('Proof', proofInner)}
     ${S('What changed', changedBody)}
     ${riskHtml}
+    ${prNoteHtml}
     ${conversationSec}
     ${activitySec}
     ${S('Workflow', saWorkflowHtml(it))}
@@ -10072,13 +10096,32 @@ function saMoveFeedbackOutOfReview(it, body){
   if (task?.id) upsert(state.tasks, task);
   const at = SA.items.findIndex((row) => row.goalId === it.goalId);
   const next = at >= 0 ? (SA.items[at + 1] || SA.items[at - 1]) : null;
+  // Was the reviewer actually looking at the card that just left Review (vs having already
+  // scrolled past it to read another one)? If it's fully above the visible scroll area, the
+  // reviewer is reading something else — snapping the view to the next card's top would yank
+  // it out from under them (Masa 2026-07-26: replying to the card above and having the one
+  // you're reading jump to the top was reported as stressful).
+  const bodyEl = document.querySelector('#seeall .sa-body');
+  const cardEl = saCardEl(it.goalId);
+  const priorScrollTop = bodyEl?.scrollTop ?? 0;
+  const removedHeight = cardEl ? cardEl.getBoundingClientRect().height : 0;
+  const cardAboveViewport = !!(cardEl && bodyEl && cardEl.getBoundingClientRect().bottom <= bodyEl.getBoundingClientRect().top + 1);
   if (at >= 0) SA.items.splice(at, 1);
   render();
   if (SA.solo === it.goalId || !SA.items.length) { saRender(); saClose(); return; }
   SA.cur = next?.goalId ?? SA.items[0]?.goalId ?? null;
-  SA.focusGid = SA.cur;
-  SA.focusScrolled = false;
-  saRender();
+  if (cardAboveViewport) {
+    // Keep reading where we were: compensate for the removed card's height instead of
+    // forcing a scroll-to-top of whatever is now "current".
+    SA.focusGid = null;
+    saRender();
+    const newBody = document.querySelector('#seeall .sa-body');
+    if (newBody) newBody.scrollTop = Math.max(0, priorScrollTop - removedHeight);
+  } else {
+    SA.focusGid = SA.cur;
+    SA.focusScrolled = false;
+    saRender();
+  }
 }
 function saCardEl(goalId){ return document.querySelector(`#seeall .sa-item[data-gid="${goalId}"]`); }
 // Flip one card to its "Working on it" head without redrawing anything else (決定2).
@@ -10262,7 +10305,8 @@ $('seeall').addEventListener('click', async (e) => {
   // SA.items[i] lookup below.
   if (k === 'foldopen') return openReviewChecklist(Number(v));
   if (k === 'foldundo') {
-    const r = await fetch(withKey(`/api/goals/${v}/unfold`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${v}/unfold`), { method: 'POST' }); }
+    catch { showErr('Undo failed.'); return; }
     if (r && r.ok) await refresh(); else showErr('Undo failed.');
     return;
   }
@@ -10275,7 +10319,8 @@ $('seeall').addEventListener('click', async (e) => {
   if (k === 'reverify') {
     b.disabled = true;
     b.textContent = '再検証中…';
-    const r = await fetch(withKey(`/api/goals/${it.goalId}/reverify`), { method: 'POST' });
+    let r; try { r = await fetch(withKey(`/api/goals/${it.goalId}/reverify`), { method: 'POST' }); }
+    catch { showErr('再検証に失敗'); b.disabled = false; return; }
     if (r.ok) await refresh(); else showErr('再検証に失敗');
     return;
   }
@@ -10460,7 +10505,6 @@ function renderCtxBar(){
   const grp = $('ctxbrgrp');
   if (grp) grp.style.display = branch ? '' : 'none';
   const bn = $('ctxbranchname'); if (bn) bn.textContent = branch;
-  renderWorktreeChip();
   const menu = $('ctxdirmenu'); if (!menu) return;
   const cur = dir;
   const opts = (state.repos ?? [])
@@ -10472,31 +10516,12 @@ function renderCtxBar(){
   const openRow = `<button type="button" class="appopt ctxopen" id="ctxopenfolder" title="Open the OS folder chooser"><svg viewBox="0 0 24 24"><path d="M3 7a2 2 0 012-2h4l2 2h8a2 2 0 012 2v8a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><path d="M12 11v6M9 14h6"/></svg><span class="nm">Open folder…</span></button>`;
   menu.innerHTML = `${opts}${openRow}<div class="ctxpath"><input type="text" id="ctxdirin" placeholder="~/path/to/repo" aria-label="Folder path" spellcheck="false"><button type="button" class="appopt" id="ctxdiruse" style="width:auto">Use</button></div><div class="ctxmsg" id="ctxdirmsg"></div>`;
 }
-// Workspace mode. isolated worktree is the default clean copy; direct workspace inherits
-// and edits the current folder. Sticky per project, like model and effort, because it is
-// a working habit rather than a per-message thought.
-function worktreeKey(){ return `sel:worktree:${state.active}`; }
-function worktreeOn(){ return localStorage.getItem(worktreeKey()) !== '0'; }
-function workspaceMode(){ return worktreeOn() ? 'isolated-worktree' : 'direct-workspace'; }
-function goalWorkspaceMode(g){ return (g?.workspaceMode === 'direct-workspace' || g?.worktree === false) ? 'direct-workspace' : 'isolated-worktree'; }
-function workspaceModeText(g){ return goalWorkspaceMode(g) === 'direct-workspace' ? 'direct workspace' : 'isolated worktree'; }
-function renderWorktreeChip(){
-  const el = $('ctxwt'); if (!el) return;
-  const isolated = worktreeOn();
-  const proj = state.projects.find((p) => p.id === state.active);
-  el.setAttribute('aria-checked', isolated ? 'true' : 'false');
-  const label = $('ctxwtlabel');
-  if (label) label.textContent = isolated ? 'isolated worktree' : 'direct workspace';
-  el.title = isolated
-    ? 'isolated worktree: default clean copy; this folder is not edited.'
-    : 'direct workspace: inherits the current state and edits this folder.';
-  const warn = $('ctxworkwarn');
-  if (warn) {
-    const dirty = !isolated && !!proj?.dirty;
-    warn.hidden = !dirty;
-    warn.textContent = dirty ? `Dirty workspace warning: direct workspace will edit ${folderName(proj?.dir) || 'this folder'} as it is now.` : '';
-  }
-}
+// Workspace mode is fixed to the isolated worktree (clean separate checkout). The
+// direct-workspace escape hatch was removed after two accidents where a stray click
+// edited a shared checkout directly; there was no real upside to keep it around for.
+function workspaceMode(){ return 'isolated-worktree'; }
+function goalWorkspaceMode(){ return 'isolated-worktree'; }
+function workspaceModeText(){ return 'isolated worktree'; }
 // Asked for once, and only when the menu is first opened — the same "only when you look
 // at it" rule the implementation log and the conversation follow.
 async function loadRepos(){
@@ -10557,11 +10582,6 @@ $('ctxdirbtn').onclick = (e) => {
   menu.classList.toggle('show');
   if (opening) { renderCtxBar(); loadRepos(); }   // no-op once boot's fetch has landed
 };
-$('ctxwt').onclick = (e) => {
-  e.stopPropagation();
-  localStorage.setItem(worktreeKey(), worktreeOn() ? '0' : '1');
-  renderWorktreeChip();
-};
 $('ctxdirmenu').addEventListener('click', (e) => {
   e.stopPropagation();
   if (e.target.closest('#ctxopenfolder')) { openFolderNative(); return; }
@@ -11710,6 +11730,7 @@ function buildGearPop(){
       if (!(await confirmDelete({ title: 'Log out of Google?', body: 'You can sign back in anytime.', confirmLabel: 'Log out', confirmDanger: false }))) return;
       signOutBtn.disabled = true;
       try { await fetch(withKey('/api/signout'), { method: 'POST' }); recentlySignedOut = true; }
+      catch {}
       finally { await refresh(); if ($('gearPop')) buildGearPop(); }
     };
     const rulesBtn = pop.querySelector('[data-grules]');

package/engine/lib.mjs

@@ -655,9 +655,25 @@ export function estimateTokenOptimization({ usage = null, weightedTokens = null,
   // layer did to save tokens, and it is the opposite: the model is the user's
   // own pick from the composer, and we deliberately never override it
   // (Masa 2026-07-22). Every remaining line is an action this layer took.
+
+  // Masa 2026-07-26: a positive `baseline` percent is a comparison against past
+  // goals, not proof any technique was applied THIS run — a small goal that
+  // followed a run of large ones scores a big "saved" number purely from the
+  // size mix, with nothing the user actually did behind it. Only call it
+  // "saved" when a real technique signal fired this run (cache reuse, a fresh
+  // handoff, /compact, /clear); otherwise it is a true fact (this run was
+  // smaller/larger than usual) but not a causal claim, so we relabel it
+  // `baseline-untied` and the renderer must phrase it as a comparison, not a
+  // "you saved X% by doing Y".
+  const techniqueDriven = cacheRatio > 0 || usedHandoff || sessionMode === 'cold-handoff' || usedCompact || sessionMode === 'compact' || usedClear;
+  if (basis === 'baseline' && !techniqueDriven) basis = 'baseline-untied';
+
   if (basis === 'baseline' && percent > 0) {
     techniques.push(`${Math.round(perReq / 1000)}k tokens/requirement vs your ${Math.round(baseline / 1000)}k average`);
   }
+  if (basis === 'baseline-untied') {
+    techniques.push(`${Math.round(perReq / 1000)}k tokens/requirement vs your ${Math.round(baseline / 1000)}k average`);
+  }
   if (!techniques.length) techniques.push(`${Math.round(raw / 1000)}k tokens this run (no cache reuse yet)`);
 
   return { rawTokens: raw, weightedTokens: weighted, savedTokens, percent, basis, techniques: [...new Set(techniques)] };
@@ -2254,6 +2270,21 @@ export function isNothingVerifiable({ changedFiles = [], hasPassCondition = fals
   return hasPassCondition && changedFiles.length === 0 && !hasAnyProof;
 }
 
+// goal-751 (2026-07-26): a wantsPR goal is an explicit ask for a PR, so a worker
+// that ends with zero changed files and no proof did not deliver what was asked —
+// most often a lane-conflict report ("空き次第自動再開します") that cannot actually
+// happen, since a `claude -p` worker is a one-shot batch run with no way to resume
+// itself later. taskStatusAfterVerify still reads a clean exit (code===0, no
+// verdict) as 'done', so this reached Review looking exactly like a normal
+// completed PR. Same shape as isNothingVerifiable above but keyed on wantsPR
+// instead of passCondition (a wantsPR goal has no passCondition of its own — the
+// PR ask itself is the promise). Advisory only, like proofNote/verificationInfra
+// Error below: the caller sets a note, it never blocks (Failedを作らない方針, see
+// docs/HANDOFF-2026-07-25-verify-gate-default-off.md).
+export function isNothingVerifiableForPR({ wantsPR = false, changedFiles = [], hasAnyProof = false } = {}) {
+  return Boolean(wantsPR) && changedFiles.length === 0 && !hasAnyProof;
+}
+
 // チェックリストUIで要件が全件Approveされたら goal を review→done へ進める。
 // 以前は「PRありgoalはマージが唯一の完了トリガー」として弾いていたが、それだと
 // 承認しても done が永続化されず次のrefreshで review に戻る不具合になっていた
@@ -2542,10 +2573,10 @@ export function hasGitChanges(porcelainStatus) {
   return Boolean(String(porcelainStatus ?? '').trim());
 }
 
-export function resolveWorkspaceMode(input) {
-  if (input === 'direct-workspace' || input === 'direct') return 'direct-workspace';
-  if (input === 'isolated-worktree' || input === 'worktree' || input === true) return 'isolated-worktree';
-  if (input === false) return 'direct-workspace';
+// Direct workspace is retired (2026-07-26): two accidents where a stray client-side
+// toggle edited a shared checkout directly. This always returns isolated-worktree
+// regardless of what a client sends, so a stale/tampered client can't force direct.
+export function resolveWorkspaceMode(_input) {
   return 'isolated-worktree';
 }
 
@@ -3151,6 +3182,13 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
     // (research, summaries, answers) simply skip this — the worker decides,
     // never us.
     `- 人が実際に動かして結果を見られる依頼なら、最後にプロジェクト直下へ ${RUN_DECL_FILE} を書く: {"cmd": "<起動コマンド>", "url": "<開くURL>", "note": "<何が見えるか1行>", "check": "<人に何を見て判断してほしいか1行>", "title": "<この作業のチケット名。対象が分かる程度に説明的で動作を含む短い名前。例「看板モードの追加」「ヘッダのズレの修正」。依頼文をそのまま写さない>"}。Manager はこれを使って人に「動かして見る」と「何を見ればいいか」を出す。動かして見せるものが無い依頼（調査・要約・質問への回答など）では書かなくてよい。`,
+    // `file` (goal #744):起動不要な静的成果物（比較HTML、レポート等）専用。この
+    // クラスの依頼は cmd/url を使う理由がなく、worker が唯一持っている手（file://
+    // URL）は http(s) しか許さないバリデーションに毎回弾かれ、しかも弾かれた理由が
+    // 「JSONが壊れている」という誤診断メッセージだったため、同じ file:// を書き直
+    // して再度失敗するループが実際に2回連続で起きた（goal #744）。ここで file を
+    // 明示し、file:// URLを書く選択肢自体を塞ぐ。
+    `- 起動不要な静的ファイル（HTML比較ページ・レポート等、npm run devのようなコマンドを必要としないもの）を見せたい場合は、cmd/url でなく "file": "<プロジェクト内の相対パス>" を使う。例: {"file": "docs/design/options.html", "title": "3案の比較"}。file:// URLは絶対に書かない（urlはhttp(s)以外だと宣言ごと弾かれる）。`,
     // Root-cause prevention (goal #733, 2026-07-26): the worker Wrote this file,
     // then Edit'd it, and the edit broke the JSON mid-edit — Manager silently
     // dropped the whole declaration (fixed separately: it now surfaces an honest
@@ -3186,6 +3224,22 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
     // the request is a change-something request, and most requests are not.
     agentName === 'codex' ? '' : `- 同じ画面の「変える前」と「変えた後」を撮ったなら、${RUN_DECL_FILE} に \`"compare": ["<前の画像>.png", "<後の画像>.png"]\` と書いてよい（その2枚が同じ場所の前後だと分かるのは撮った本人だけ）。人には並べて、違う部分に印を付けて見せる。3案を並べた等、前後の関係が無い画像には書かない。`,
     `- 最後に${replyLang}で2〜4行：何を変えたか・どのファイルか・テスト結果・人間が確認すべき点。`,
+    // Root-cause fix (Masa 2026-07-26, goal #727 review): a worker fixed a real bug
+    // (the To-Do lane's Doing ring had zero animation) but its report also claimed
+    // the project-rail dot was "static" before — it actually already had a working
+    // pulse animation (fsrundot), just not a spin. The worker never re-read the
+    // pre-change code to check its own diagnosis; it narrated a plausible-sounding
+    // "before" state instead of a verified one, and nothing downstream caught it.
+    '- 「〜は動いていなかった/静止していた」のように直す前の状態を断定する場合は、その断定をする前に修正前の該当コード（該当CSS/関数）を実際に読んで確認すること。読まずに推測で「動いていない」と書かない。読んで確認した箇所は、報告に該当コードを短く引用すること。',
+    // goal #751 (2026-07-26): you are a one-shot batch process — once this run exits,
+    // nothing resumes you. If something outside your control blocks you (a lane/file
+    // lock held by another agent, a missing permission, etc.), do NOT report that you
+    // will "resume automatically once it frees up" or similar — that is not something
+    // you or anything in this run can do. Say plainly that you made no code changes and
+    // why, so the goal reads as unfinished/blocked rather than as a completed PR. A
+    // human or the CTO will re-dispatch the work (e.g. via manager_reply) once the
+    // blocker clears.
+    '- あなたは1回きりのバッチ実行であり、このプロセスが終了した後に自動で再開することはない。レーン/ファイルの競合など自分では解けない理由で着手できない場合、「空き次第自動で再開します」のような、この実行の外では実現できない約束を書かないこと。何をどう変更できなかったか（コード変更0件であること）を正直に書き、ゴールが完了したPRではなく未完了/ブロックとして扱われるように終えること。再開は人間かCTOが改めて指示する。',
   ].filter(Boolean).join('\n');
 }
 
@@ -3203,6 +3257,37 @@ export function workerPrompt(task, goal, lastFailure, agentName = 'claude-code',
 // button that opens the wrong thing is the fabricated-proof bug all over again.
 export const RUN_DECL_FILE = '.manager-run.json';
 
+// A declaration that parsed as JSON but breaks a rule (bad url scheme, an
+// unsafe `file` path) is NOT the same failure as unparseable JSON — the first
+// is a worker mistake with a specific, sayable reason; the second is a broken
+// file. Conflating them (goal #744) sent the worker back a message that only
+// describes JSON corruption ("was not usable JSON"), so a worker whose actual
+// mistake was a file:// url read that as "my JSON broke" and rewrote the exact
+// same file:// url a second time. This return shape lets the caller tell them
+// apart: `null` stays "nothing usable to report" (unparseable / genuinely
+// empty), an `{ error, message }` object carries a reason a human — or the
+// worker reading its own feedback — can act on.
+function runDeclError(error, message) {
+  return { error, message };
+}
+
+// `file` (goal #744, this PR): a static, already-built artifact — an HTML
+// comparison page, a report — that needs no process and has no http(s) URL of
+// its own. Declared as a path relative to the project so the Manager can copy
+// it out of the worktree (same pattern as SHOT_DIR) and serve it from a URL
+// that survives after the worktree is gone. Only a syntactic check lives here
+// (no absolute path, no ".." segment, no backslash/drive letter, no NUL) —
+// server.mjs still re-resolves against the worktree root before it reads
+// anything, because a syntax check alone doesn't rule out a symlink.
+export function isSafeRunDeclFilePath(p) {
+  if (typeof p !== 'string' || !p) return false;
+  if (p.includes('\0')) return false;
+  if (p.startsWith('/') || p.startsWith('\\')) return false;
+  if (/^[a-zA-Z]:[\\/]/.test(p)) return false; // Windows drive letter
+  const norm = p.replace(/\\/g, '/');
+  return !norm.split('/').some((seg) => seg === '..');
+}
+
 export function parseRunDeclaration(text) {
   let raw;
   try { raw = JSON.parse(String(text ?? '')); } catch { return null; }
@@ -3210,6 +3295,7 @@ export function parseRunDeclaration(text) {
   const str = (v, max) => (typeof v === 'string' && v.trim() ? v.trim().slice(0, max) : null);
   const cmd = str(raw.cmd, 500);
   const url = str(raw.url, 500);
+  const file = str(raw.file, 500);
   // `compare` (Masa 2026-07-22): which TWO of the worker's own screenshots are
   // the same view before and after. Only the agent that did the work knows that
   // two images relate — a request for three design options has no "after" at
@@ -3219,9 +3305,16 @@ export function parseRunDeclaration(text) {
   const compare = parseComparePair(raw.compare);
   const title = str(raw.title, 60);
   // Nothing to start, nothing to open, nothing named, and no pair to show = nothing to look at.
-  if (!cmd && !url && !compare && !title) return null;
-  // Only http(s): the button opens this in the user's browser.
-  if (url && !/^https?:\/\//i.test(url)) return null;
+  if (!cmd && !url && !file && !compare && !title) return null;
+  // Only http(s): the button opens this in the user's browser. A file:// (or
+  // any other scheme) is a worker mistake with a specific fix — declare `file`
+  // instead — not a JSON parse failure, so it gets its own reason.
+  if (url && !/^https?:\/\//i.test(url)) {
+    return runDeclError('bad-url-scheme', "url must start with http:// or https:// — a file:// path can't be opened from a remote browser session; declare an artifact file instead of a file:// url");
+  }
+  if (file && !isSafeRunDeclFilePath(file)) {
+    return runDeclError('bad-file-path', 'file must be a path inside the project — no leading /, no .. segments');
+  }
   // `check` (Masa 2026-07-22): what to look at, in the working AI's own words. It used
   // to come from the intake AI's plan — this layer inventing a pass condition for a
   // request it only read. The AI that did the work states it here instead, in the same
@@ -3232,7 +3325,7 @@ export function parseRunDeclaration(text) {
   // the user's own sentence, repeated back at them in the one place that is
   // supposed to say what the work WAS. The agent that just did it can name it in
   // one line, and it is the only party that knows what actually got done.
-  return { cmd, url, note: str(raw.note, 300), check: str(raw.check, 300), compare, title };
+  return { cmd, url, file, note: str(raw.note, 300), check: str(raw.check, 300), compare, title };
 }
 
 // Exactly two shot file names, in [before, after] order. Anything else is

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, chooseFolderScript, parseChosenFolder, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse, isCommandOnPath } from './lib.mjs';
-import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession } from './lib.mjs';
+import { parseStreamEvents, parseCodexEvents, buildCodexArgs, parsePlan, refinePlanTasks, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, classifyWorkerFailure, isForcedStop, taskStatusAfterVerify, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, latestGoalOutcomeTask, buildDirtyWorkspacePrBlock, buildGoalProofMd, buildGoalPrBody, buildReviewSummaryPrompt, parseReviewSummary, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, rejectGoal, reopenGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, rebasePreviewUrl, shouldCreateGoalPR, normalizePullRequestUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, resolveTestGate, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, workerPrompt, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, autoFoldReviewsEnabled, parseGitUnifiedDiffLocations, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyPrSafety, isInconclusiveTestRun, countInfraFlakes, classifyRunFailures, classifyVerifyGate, buildVerificationInfraError, verificationInfraErrorFrom, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, licenseTokenPayload, shouldRefreshLicense, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, testFailureReason, manualTestRetryPrompt, isNothingVerifiable, isNothingVerifiableForPR, classifyComposerIntentHeuristic, detectPauseIntent, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot, goalTaskTitle, buildGoalTask, shouldUsePlannerForGoal, RUN_DECL_FILE, parseRunDeclaration, SHOT_DIR, collectShotNames, parseGoalAddress, REPLY_OUTCOMES, REPLY_INTENTS, buildReplyIntentPrompt, parseReplyIntent, buildGoalMessage, serializeGoalMessage, parseGoalMessages, computeInternalQualityMetrics, classifyInternalQualityTaskError, resolveWorkspaceMode, goalSessionFor, setGoalAgentSession, switchGoalAgentSession } from './lib.mjs';
 import { createSerialQueue } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
@@ -2406,6 +2406,17 @@ function readRunDeclaration(task, workDir) {
   try { raw = readFileSync(file, 'utf8'); } catch { return; }
   try { unlinkSync(file); } catch { /* best effort — never fail a task over cleanup */ }
   const run = parseRunDeclaration(raw);
+  // A declaration that parsed as JSON but broke a rule (bad url scheme, unsafe
+  // file path) is a worker mistake with a specific, sayable fix — NOT the same
+  // failure as unparseable JSON. Goal #744: conflating the two sent the worker
+  // "was not usable JSON" for a file:// url, so it "fixed" the JSON (which was
+  // never broken) and wrote the exact same file:// url a second time. `run` is
+  // `{ error, message }` here, distinct from the `null` case below.
+  if (run && run.error) {
+    task.runDeclError = { reason: run.error, message: run.message, snippet: String(raw ?? '').slice(0, 200) };
+    sendAct(task, `run declaration ignored — ${run.message}`);
+    return;
+  }
   if (!run) {
     // The worker DID try to declare something (the file exists) but it came out
     // unusable — e.g. a Write followed by an Edit that broke the JSON mid-edit
@@ -2417,17 +2428,62 @@ function readRunDeclaration(task, workDir) {
     // actually written (raw content is deleted above and never otherwise
     // recoverable) so both the activity log and the Review card can say WHY,
     // instead of the human having to guess or dig through file loss.
-    task.runDeclError = { snippet: String(raw ?? '').slice(0, 200) };
+    task.runDeclError = { reason: 'invalid-json', snippet: String(raw ?? '').slice(0, 200) };
     sendAct(task, `run declaration ignored — ${RUN_DECL_FILE} was not usable JSON: ${task.runDeclError.snippet.slice(0, 80)}`);
     return;
   }
   task.run = { ...run, dir: workDir };
-  const how = run.cmd ?? run.url;
+  collectRunDeclFileArtifact(task, workDir);
+  const how = task.run.cmd ?? task.run.url;
   if (how) sendProcessAct(task, `Worker declared how to see the result: ${how}`);
   if (run.title) sendProcessAct(task, `Worker named the work: ${run.title}`);
   if (run.compare) sendProcessAct(task, `Worker declared a before/after pair: ${run.compare.join(' → ')}`);
 }
 
+// `file` (goal #744): a static, already-built artifact that needs no process
+// and has no http(s) URL of its own — an HTML comparison page, a report. Same
+// pattern as collectWorkerShots: copy it out of the worktree (which is about
+// to be diffed/discarded) into logDir/uploads and give it a URL that survives.
+// parseRunDeclaration already checked the path is syntactically inside the
+// project (no leading /, no ..); this re-resolves against the worktree root
+// before reading anything, because a syntax check alone doesn't rule out a
+// symlink pointing outside it.
+function collectRunDeclFileArtifact(task, workDir) {
+  const rel = task.run?.file;
+  if (!rel) return;
+  const root = resolve(workDir) + '/';
+  const abs = resolve(workDir, rel);
+  if (!(abs + '/').startsWith(root) && abs !== root.slice(0, -1)) {
+    task.runDeclError = { reason: 'file-outside-project', message: `file "${rel}" resolves outside the project`, snippet: rel };
+    sendAct(task, `run declaration ignored — ${task.runDeclError.message}.`);
+    task.run = { ...task.run, file: null };
+    return;
+  }
+  let data;
+  try { data = readFileSync(abs); } catch (err) {
+    task.runDeclError = { reason: 'file-unreadable', message: `file "${rel}" could not be read: ${String(err?.code ?? err).slice(0, 80)}`, snippet: rel };
+    sendAct(task, `run declaration's file "${rel}" could not be read: ${String(err?.code ?? err).slice(0, 80)}`);
+    task.run = { ...task.run, file: null };
+    return;
+  }
+  const outDir = join(logDir, 'uploads');
+  mkdirSync(outDir, { recursive: true });
+  const safe = basename(rel).replace(/[^\w.-]/g, '_').slice(-80);
+  const outFile = `${Date.now()}-artifact-${task.id}-${safe}`;
+  try {
+    writeFileSync(join(outDir, outFile), data);
+  } catch (err) {
+    task.runDeclError = { reason: 'file-attach-failed', message: `file "${rel}" could not be attached: ${String(err?.code ?? err).slice(0, 80)}`, snippet: rel };
+    sendAct(task, `run declaration's file "${rel}" could not be attached: ${String(err?.code ?? err).slice(0, 80)}`);
+    task.run = { ...task.run, file: null };
+    return;
+  }
+  // No process to start for a static file — the Review card renders this as a
+  // plain link (like a PR link), not the "Start it" button.
+  task.run = { ...task.run, url: `/upload/${outFile}`, cmd: null };
+  sendProcessAct(task, `Worker attached a file to open: ${rel}`);
+}
+
 // A direct/shared workspace can still contain a declaration left by an older
 // run (for example when that run was interrupted before readRunDeclaration).
 // Remove it before this task starts so only a file created by THIS worker can
@@ -3532,6 +3588,18 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     hasPassCondition: siblings.some((t) => t.passCondition),
     hasAnyProof: siblings.some((t) => t.proof),
   });
+  // goal-751: wantsPR but the worker changed nothing and proved nothing (typically a
+  // lane-conflict report promising an automatic resume that a one-shot `claude -p`
+  // run can never deliver). Advisory only — see isNothingVerifiableForPR in lib.mjs.
+  const prNothingVerifiable = isNothingVerifiableForPR({
+    wantsPR: goal.wantsPR,
+    changedFiles,
+    hasAnyProof: siblings.some((t) => t.proof),
+  });
+  goal.prNote = prNothingVerifiable
+    ? 'workerはコード変更をせずに終了しました（PRを求めていたのに0ファイル変更）。実装は行われていない可能性があります。'
+    : null;
+  if (goal.prNote) goalAct(`PR advisory (not blocking): ${goal.prNote}`);
   if (testsFailing) {
     const failure = recordGoalFailure(goal, {
       kind: 'test',
@@ -3608,7 +3676,7 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     const preNote = goal.testResult?.preExistingOnly
       ? ` (${goal.testResult.preExisting?.length ?? 0} pre-existing test failure(s) ignored as unrelated to this change)`
       : '';
-    goalAct(`Verification gate passed; moving goal to ${goal.status}.${preNote}${goal.proofNote ? ` [proof advisory: ${goal.proofNote}]` : ''}`);
+    goalAct(`Verification gate passed; moving goal to ${goal.status}.${preNote}${goal.proofNote ? ` [proof advisory: ${goal.proofNote}]` : ''}${goal.prNote ? ` [PR advisory: ${goal.prNote}]` : ''}`);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.72",
+  "version": "0.10.73",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {