@galda/cli 0.10.87 → 0.10.89

package/CLAUDE.md

@@ -105,6 +105,8 @@
 - Worker/API へは**必ず所有ドメイン `https://galda.app`（custom domain）経由**で参照する。`*.workers.dev` サブドメインを製品コードに焼き込まない（`MANAGER_BILLING_API_URL` 等の既定値は `https://galda.app`）。
 - **Cloudflare/wrangler にデプロイする前に `wrangler whoami` でデプロイ先アカウントを確認**し、Galda/Kodo 所有であること・workers.dev サブドメイン名に客先名や別プロジェクト名が出ていないことを確かめる。怪しければ止めて Masa に確認（本番デプロイは Masa 明示許可制）。
 - **リリースは4面**（① npm ② Fly ③ Worker ④ Masaの常駐インスタンス `~/manager-for-ai`:4400）。①だけ出して④を忘れると「直したのに直ってない」＋relay相互kickループ再発の実例あり（2026-07-16/17）。全文＝`docs/RELEASE-WORKFLOW.md`の「本番は1つじゃない」表。
+- **常駐Managerを直接 `kill`／`launchctl kickstart -k` しない**（2026-07-28、実行中3 workerを同時中断した実例）。再起動は対象checkoutで
+  `node tools/safe-restart-manager.mjs` を使う。このコマンドはDoing／Finalizingが1件でもあれば拒否する。拒否時は完了を待って再実行し、Agent切替で回避しない。
 
 ## relay接続（`app.galda.app`）を伴う作業の掟（Masa明言 2026-07-17・全レーン必読）
 

package/app/index.html

@@ -1558,6 +1558,14 @@
     line-height:1.15;padding:2.5px 10px;border-radius:7px;box-shadow:inset 0 0 0 1px var(--hair2)}
   #fsRoot .acts2 .errbtn:first-child{color:var(--ink2)}
   #fsRoot .errbtn:hover{background:var(--hover);color:var(--ink)}
+  /* The review/attention dialog is rendered in #seeall, outside #fsRoot.
+     Keep its recovery actions on the same designed component instead of
+     falling back to the browser's unstyled native button. */
+  #seeall .acts2{display:flex;gap:6px;margin-top:3px;align-items:center}
+  #seeall .errbtn{border:0;background:transparent;color:var(--ink3);font-family:var(--mono);font-size:10px;letter-spacing:.02em;cursor:pointer;
+    line-height:1.15;padding:2.5px 10px;border-radius:7px;box-shadow:inset 0 0 0 1px var(--hair2)}
+  #seeall .acts2 .errbtn:first-child{color:var(--ink2)}
+  #seeall .errbtn:hover{background:var(--hover);color:var(--ink)}
   /* AI question in the feed (q2 — §6.5: while current it lives in the chat feed).
      H18 / CDO HANDOFF-question-ui-2026-07-13: QUESTION card = hairline frame +
      2px --blue left rule + mono label + option chips + an always-on free-text
@@ -3633,10 +3641,7 @@ function reviewCardConfigFor(projectId){ return { ...DEFAULT_REVIEW_DEFINITION.r
 // project to one language regardless of what a given goal was typed in.
 function reviewLangFor(projectId){ const l = reviewDefinitionFor(projectId).language; return (l === 'en' || l === 'ja') ? l : 'auto'; }
 function retryCopy(projectId){
-  const ja = reviewLangFor(projectId) === 'ja';
-  return ja
-    ? { infra: '検証基盤エラー', retry: '再検証', retrying: '再検証中…', failed: '再検証に失敗' }
-    : { infra: 'Verification infrastructure error', retry: 'Retry verification', retrying: 'Retrying…', failed: 'Verification retry failed' };
+  return { infra: 'Verification infrastructure error', retry: 'Retry verification', retrying: 'Retrying…', failed: 'Verification retry failed' };
 }
 
 function esc(s){ const d = document.createElement('div'); d.textContent = s ?? ''; return d.innerHTML; }
@@ -4891,7 +4896,8 @@ function renderTasks(){
   for (const b of $('tasklist').querySelectorAll('[data-goalreverify]')) {
     b.onclick = async (e) => { e.stopPropagation(); const copy = retryCopy(state.active); b.disabled = true; b.textContent = copy.retrying;
       let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' }); }
-      catch { showErr(copy.failed); return; }
+      catch { showErr(copy.failed); b.disabled = false; b.textContent = copy.retry; return; }
+      if (!r.ok) { showErr(copy.failed); b.disabled = false; b.textContent = copy.retry; return; }
       qrefresh(r, copy.failed); };
   }
   for (const b of $('tasklist').querySelectorAll('[data-qreply]')) {
@@ -5557,8 +5563,8 @@ function renderReviewChecklist(){
       b.disabled = true;
       b.textContent = retryCopy(goal.projectId).retrying;
       let r; try { r = await fetch(withKey(`/api/goals/${b.dataset.goalreverify}/reverify`), { method: 'POST' }); }
-      catch { showErr(retryCopy(goal.projectId).failed); b.disabled = false; return; }
-      if (r.ok) await refresh(); else showErr(retryCopy(goal.projectId).failed);
+      catch { showErr(retryCopy(goal.projectId).failed); b.disabled = false; b.textContent = retryCopy(goal.projectId).retry; return; }
+      if (r.ok) await refresh(); else { showErr(retryCopy(goal.projectId).failed); b.disabled = false; b.textContent = retryCopy(goal.projectId).retry; }
     };
   }
   for (const b of $('reviewList').querySelectorAll('.reqsend')) {
@@ -7191,6 +7197,7 @@ const FAILURE_COPY = {
     infra: {
       title: 'Galda基盤エラー',
       timeout: 'Galda側の実行上限や待ち時間で止まりました。変更内容の失敗とは限りません。',
+      interrupted: 'ローカルの実行が中断されました。変更内容やAgentの失敗とは限らないため、同じ作業を再開できます。',
       auth: '接続や認証確認で止まりました。接続を直してから再開できます。',
       relay: 'relay接続で止まりました。接続状態を確認してから再試行できます。',
       chrome: 'Chrome/ブラウザ確認で止まりました。画面確認環境の問題で、実装失敗とは限りません。',
@@ -7200,8 +7207,8 @@ const FAILURE_COPY = {
       unknown: 'Galdaの実行基盤で止まりました。ログを確認し、原因に応じて再試行できます。',
     },
     actions: {
-      retry: '再試行', resume: '再開', connect: 'Connect', check: '接続確認',
-      other: '別Agentで実行', log: 'ログ確認', tests: 'テスト再実行', pr: 'PR再試行',
+      retry: 'Retry', resume: 'Resume', connect: 'Connect', check: 'Check connection',
+      other: 'Try another Agent', log: 'View log', tests: 'Re-run tests', pr: 'Retry PR',
     },
   },
   en: {
@@ -7209,6 +7216,7 @@ const FAILURE_COPY = {
     infra: {
       title: 'Galda system issue',
       timeout: 'Galda stopped this at the run limit or a wait timed out. This is not necessarily a problem with the change.',
+      interrupted: 'The local run was interrupted. This does not necessarily reflect a problem with the change or agent; resume the same work.',
       auth: 'Connection or authentication failed. Reconnect, then continue.',
       relay: 'The relay connection failed. Check the connection, then retry.',
       chrome: 'Chrome/browser verification failed. The UI check environment stopped, not necessarily the implementation.',
@@ -7229,17 +7237,23 @@ function failureLang(){
 function inferErrorClass(text, agent){
   const low = String(text || '').toLowerCase();
   const infra = (reason, actionIds) => ({ owner: 'galda-infra', reason, actionIds });
-  if (/run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) return infra('timeout', ['retry', 'run-with-codex', 'view-log']);
-  if (/spawn|enoent|eacces|command not found|worker tool exited early|作業ツールが途中で終了/.test(low)) return infra('worker-start', ['retry', 'run-with-codex', 'view-log']);
-  if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) return infra('auth', ['connect', 'check-connection', 'run-with-codex', 'view-log']);
+  if (/run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) return infra('timeout', ['retry', 'view-log']);
+  if (/worker was interrupted|作業が途中で中断|exit 143|sigterm|sigint/.test(low)) return infra('interrupted', ['retry', 'view-log']);
+  if (/spawn|enoent|eacces|command not found|worker tool exited early|作業ツールが途中で終了/.test(low)) return infra('worker-start', ['retry', 'view-log']);
+  if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) return infra('auth', ['connect', 'check-connection', 'view-log']);
   if (/relay|websocket|socket|econnreset|econnrefused|billing-api unreachable|cf access|cloudflare access/.test(low)) return infra('relay', ['retry', 'connect', 'view-log']);
   if (/chrome|chromium|puppeteer|target closed|browser|navigation timeout|waiting failed|screenshot|headless/.test(low)) return infra('chrome', ['retry', 'view-log']);
   if (/test runner|node --test|npm test|project tests|server exited \(code \d+\) before it was ready|did not report ready in time|test timed out after|tap|not ok \d+/.test(low)) return infra('test-runner', ['retry-tests', 'view-log']);
   if (/pr step failed|openpr|pull request|github|gh:|gh auth|git push|git fetch|git .*failed|pr作成|pr failed/.test(low)) return infra('pr', ['retry-pr', 'view-log']);
-  return { owner: 'agent', reason: agent === 'codex' ? 'codex' : 'claude-code', actionIds: ['retry', 'run-with-codex', 'view-log'] };
+  return { owner: 'agent', reason: agent === 'codex' ? 'codex' : 'claude-code', actionIds: ['retry', 'view-log'] };
 }
 function taskErrorMeta(t, goal){
-  const meta = t.errorClass || inferErrorClass(t.result, t.agent || goal?.agent);
+  // Reclassify interrupted tasks from their concrete exit text instead of
+  // trusting stale persisted metadata. Older records labelled an external
+  // SIGTERM/restart as an Agent failure and permanently carried a Codex switch.
+  const inferred = inferErrorClass(t.result, t.agent || goal?.agent);
+  const raw = t.status === 'interrupted' ? inferred : (t.errorClass || inferred);
+  const meta = { ...raw, actionIds: (raw.actionIds || []).filter((id) => !['run-with-codex', 'run-with-claude'].includes(id)) };
   const lang = failureLang(), C = FAILURE_COPY[lang];
   const isInfra = meta.owner === 'galda-infra';
   return {
@@ -7253,20 +7267,16 @@ function goalBlockedErrorMeta(g){
   const raw = g.blocked?.errorClass || (g.blocked?.kind === 'test'
     ? { owner: 'galda-infra', reason: 'test-runner', actionIds: ['retry-tests', 'view-log'] }
     : inferErrorClass(g.blocked?.reason, g.agent));
+  const meta = { ...raw, actionIds: (raw.actionIds || []).filter((id) => !['run-with-codex', 'run-with-claude'].includes(id)) };
   const lang = failureLang(), C = FAILURE_COPY[lang];
-  const isInfra = raw.owner === 'galda-infra';
-  return { ...raw, title: isInfra ? C.infra.title : C.agent.title, body: isInfra ? (C.infra[raw.reason] || C.infra.unknown) : C.agent.body, copy: C };
+  const isInfra = meta.owner === 'galda-infra';
+  return { ...meta, title: isInfra ? C.infra.title : C.agent.title, body: isInfra ? (C.infra[meta.reason] || C.infra.unknown) : C.agent.body, copy: C };
 }
 function errorButtonsHtml(meta, { taskId = null, goalId = null, interrupted = false, agent = null, pr = false } = {}){
   const C = meta.copy.actions;
-  const canCodex = goalId != null && agent !== 'codex' && (state.agents || []).includes('codex');
   const out = [];
   for (const id of meta.actionIds || []) {
     if (id === 'retry' && taskId != null) out.push(`<button class="errbtn" data-fsretry="${taskId}">${interrupted ? C.resume : C.retry}</button>`);
-    // This keeps the existing agent-switch endpoint, but says what it really does
-    // for an interrupted run: continue the saved goal with another agent rather
-    // than imply a brand-new, contextless task will be created.
-    else if (id === 'run-with-codex' && canCodex) out.push(`<button class="errbtn" data-fscodex="${goalId}">${interrupted ? (failureLang() === 'ja' ? 'Codexで再開' : 'Resume with Codex') : C.other}</button>`);
     else if (id === 'connect') out.push(`<button class="errbtn" data-fsconnectworker="1">${C.connect}</button>`);
     else if (id === 'check-connection') out.push(`<button class="errbtn" data-fscheckworker="1">${C.check}</button>`);
     else if (id === 'retry-tests' && goalId != null) out.push(`<button class="errbtn" data-fsreverify="${goalId}">${C.tests}</button>`);
@@ -8530,7 +8540,7 @@ let sseUp = false; // live engine link — the honest signal behind the MCP tab'
 // Connection status line (queue tray): grace-debounce the offline state ~800ms so
 // sub-second SSE blips don't flash a red line. connOffline is the debounced flag
 // renderQueue() reads; connSetOnline/Offline flip it around real sseUp changes.
-let connOffline = false, _connGraceT = null, _sseReconnectT = null, _es = null, _healthT = null;
+let connOffline = false, _connGraceT = null, _sseReconnectT = null, _es = null, _healthT = null, _healthFailStreak = 0;
 function connSetOnline(){ if (_connGraceT) { clearTimeout(_connGraceT); _connGraceT = null; } if (connOffline) { connOffline = false; renderQueue(); } }
 function connSetOffline(){ if (_connGraceT || connOffline) return; _connGraceT = setTimeout(() => { _connGraceT = null; connOffline = true; renderQueue(); }, 800); }
 // Reconnect button: drop any pending backoff timer and reopen the EventSource now.
@@ -8545,15 +8555,23 @@ async function checkHealth(){
   if (document.hidden) return;
   let ok = false;
   try {
-    const c = new AbortController(); const to = setTimeout(() => c.abort(), 3000);
+    // Mobile browsers and DevTools device emulation can briefly starve this low-priority
+    // probe even while the already-open SSE and POST path are healthy.  Do not turn one
+    // transient probe into a user-visible outage.
+    const c = new AbortController(); const to = setTimeout(() => c.abort(), 5000);
     const r = await fetch(withKey('/'), { method: 'HEAD', cache: 'no-store', signal: c.signal });
     clearTimeout(to); ok = r.ok;
   } catch { ok = false; }
   if (!ok) {
+    _healthFailStreak++;
+    if (_healthFailStreak < 2) return;
     connSetOffline(); // grace-debounced ~800ms
     if (!_sseReconnectT) { try { _es && _es.close(); } catch {} sseUp = false; esRetryMs = Math.min(esRetryMs, 4000); _sseReconnectT = setTimeout(connectSSE, esRetryMs); }
-  } else if (connOffline && !_sseReconnectT) {
+  } else {
+    _healthFailStreak = 0;
+    if (connOffline && !_sseReconnectT) {
     forceReconnect(); // server reachable again but the line is still up → reconnect to clear + flush
+    }
   }
 }
 function startHealthPoll(){ clearInterval(_healthT); _healthT = setInterval(checkHealth, 4000); }
@@ -8773,6 +8791,10 @@ async function boot(){
   flushOutbox();
   connectSSE();
   startHealthPoll();
+  // A Wi-Fi ⇄ cellular switch can leave EventSource waiting for its normal retry
+  // budget.  The browser has already confirmed connectivity here, so reconnect now
+  // instead of making a mobile send wait for the next health poll/backoff cycle.
+  window.addEventListener('online', () => { _healthFailStreak = 0; forceReconnect(); });
   document.addEventListener('visibilitychange', () => { if (!document.hidden) { refresh(); flushOutbox(); checkHealth(); } });
   // belt and suspenders for the never-lose guarantee: even if every event
   // path misfires, unsent memos are retried on a slow heartbeat
@@ -10130,13 +10152,12 @@ function saItemHtml(it, i){
     ${coverageSec}
     ${evidenceSec}
     ${reqVerifySec}
-    ${S('Open it', openBody)}
+    ${S('Open it', openBody + infraBody)}
     ${S('Run state', interruptedBody)}
     ${S('PR', prRepairBody)}
     ${S('Also carries', carriesBody)}
     ${S('What to check', checkBody)}
     ${S('Result', reportBody)}
-    ${S(infra?.title || '検証基盤エラー', infraBody)}
     ${S('Screenshots', shotsBody)}
     ${S('Steps', stepsBody)}
     ${S('Proof', proofInner)}
@@ -10629,11 +10650,12 @@ $('seeall').addEventListener('click', async (e) => {
   // meta-row toggle (H23): tap the token chip to reveal the technique breakdown.
   if (k === 'tok') { b.classList.toggle('open'); $('seeall').querySelector(`#tokdetail${i}`)?.classList.toggle('open'); return; }
   if (k === 'reverify') {
+    const copy = retryCopy(it.goal?.projectId || state.active);
     b.disabled = true;
-    b.textContent = '再検証中…';
+    b.textContent = copy.retrying;
     let r; try { r = await fetch(withKey(`/api/goals/${it.goalId}/reverify`), { method: 'POST' }); }
-    catch { showErr('再検証に失敗'); b.disabled = false; return; }
-    if (r.ok) await refresh(); else showErr('再検証に失敗');
+    catch { showErr(copy.failed); b.disabled = false; b.textContent = copy.retry; return; }
+    if (r.ok) await refresh(); else { showErr(copy.failed); b.disabled = false; b.textContent = copy.retry; }
     return;
   }
   // Open it (P1, Masa 2026-07-21): start the thing the worker said to run, then open it.

package/engine/completion-contract.mjs

@@ -0,0 +1,19 @@
+const CHANGE_REQUEST_RE = /(?:修正|直して|解決して|改善して|一致させ|統一して|実装して|追加して|削除して|変更して|作って|fix\b|solve\b|resolve\b|implement\b|change\b|make\b)/i;
+const REFUSAL_RESULT_RE = /(?:直せません|修正できません|解決できません|実現できません|不可能です|cannot\s+(?:be\s+)?(?:fix(?:ed)?|solv(?:e|ed)|implement(?:ed)?|done)|can't\s+(?:fix|solve|implement|do)|unable\s+to\s+(?:fix|solve|implement))/i;
+
+export const COMPLETION_CONTRACT_PROMPT = [
+  'MANAGER COMPLETION CONTRACT:',
+  '- The latest explicit user instruction can revise an older product decision or code comment. Treat old comments as context, not proof that the requested change is impossible. If the change has consequences, explain them and implement the latest request; only a real safety, permission, legal, or external-system constraint is a blocker.',
+  '- A test must assert the observable outcome the user requested. Never replace the request with a tooltip, explanation, or a test that permanently preserves the opposite behavior.',
+  '- Do not report a change request as complete with “cannot fix”, “直せません”, or equivalent. If a real external blocker remains, state the concrete blocker and leave the work explicitly unfinished instead of presenting it for Review as completed.',
+].join('\n');
+
+export function completionContractIssue({ request = '', followUp = '', result = '', status = '' } = {}) {
+  if (status !== 'done') return null;
+  const requested = `${request}\n${followUp}`;
+  if (!CHANGE_REQUEST_RE.test(requested) || !REFUSAL_RESULT_RE.test(String(result))) return null;
+  return {
+    kind: 'unresolved-refusal',
+    reason: '変更・解決依頼に対して「対応不能」で終了しており、要求した結果が実現されていません。',
+  };
+}

package/engine/lib.mjs

@@ -1258,13 +1258,20 @@ export function classifyWorkerFailure({ agent = 'claude-code', result = '', err
     actionIds,
   });
   if (timedOut || /run limit|実行上限|timed out|timeout|タイムアウト/.test(low)) {
-    return infra('timeout', ['retry', 'run-with-codex', 'view-log']);
+    return infra('timeout', ['retry', 'view-log']);
+  }
+  // SIGTERM/SIGINT means the local worker was stopped from outside the task
+  // (for example while the local Manager was restarting).  It says nothing
+  // about either the requested change or the chosen agent, so never turn this
+  // recovery path into a suggestion to switch agents.
+  if (code === 143 || code === 130 || /worker was interrupted|作業が途中で中断|exit 143|sigterm|sigint/.test(low)) {
+    return infra('interrupted', ['retry', 'view-log']);
   }
   if (/spawn|enoent|eacces|command not found|executable|worker tool exited early|作業ツールが途中で終了/.test(low)) {
-    return infra('worker-start', ['retry', 'run-with-codex', 'view-log']);
+    return infra('worker-start', ['retry', 'view-log']);
   }
   if (/auth probe|preflight|not logged in|logged out|not authenticated|authentication|unauthorized|invalid api key|bad credentials|401\b|403\b|接続が必要|認証/.test(low)) {
-    return infra('auth', ['connect', 'check-connection', 'run-with-codex', 'view-log']);
+    return infra('auth', ['connect', 'check-connection', 'view-log']);
   }
   if (/relay|websocket|socket|econnreset|econnrefused|billing-api unreachable|cf access|cloudflare access/.test(low)) {
     return infra('relay', ['retry', 'connect', 'view-log']);
@@ -1281,7 +1288,7 @@ export function classifyWorkerFailure({ agent = 'claude-code', result = '', err
   return {
     owner: 'agent',
     reason: agent === 'codex' ? 'codex' : 'claude-code',
-    actionIds: ['retry', agent === 'claude-code' ? 'run-with-codex' : 'run-with-claude', 'view-log'],
+    actionIds: ['retry', 'view-log'],
   };
 }
 

package/engine/server.mjs

@@ -26,6 +26,7 @@ import { createSerialQueue } from './lib.mjs';
 import { parseRequirementEvidence, unmappedChangedFiles } from './lib.mjs';
 import { isPrClosed } from './lib.mjs';
 import { collectProjectRules } from './lib.mjs';
+import { COMPLETION_CONTRACT_PROMPT, completionContractIssue } from './completion-contract.mjs';
 import { FALLBACK_CODEX_MODELS, loadCodexModels } from './codex-models.mjs';
 import { CLAUDE_MODELS } from './claude-models.mjs';
 import { classifyWorkerPreflight, shouldProbeClaudeAuth, workerCanStart } from './worker-availability.mjs';
@@ -2378,8 +2379,13 @@ async function startEphemeralApp(projectDir) {
   const home = join(logDir, `ephemeral-${Date.now()}`);
   mkdirSync(home, { recursive: true });
   seedEphemeralHistory(home, projectDir);
+  // Managed worktrees intentionally do not copy node_modules. An ephemeral
+  // preview is still this Manager package, so let it resolve the already
+  // installed runtime dependencies from the parent rather than crashing before
+  // its readiness endpoint can answer (for example `puppeteer-core`).
+  const nodePath = testNodePath(projectDir);
   const child = spawn('node', [join(projectDir, 'engine', 'server.mjs')], {
-    env: { ...process.env, MANAGER_PORT: String(port), MANAGER_HOME: home, MANAGER_OPEN_BROWSER: '0', MANAGER_SEED_RUNNING_FIXTURE: '1' },
+    env: { ...process.env, NODE_PATH: nodePath, MANAGER_PORT: String(port), MANAGER_HOME: home, MANAGER_OPEN_BROWSER: '0', MANAGER_SEED_RUNNING_FIXTURE: '1' },
     cwd: projectDir, stdio: 'ignore',
   });
   ephemeralChildren.add(child);
@@ -2721,6 +2727,7 @@ async function runTask(task) {
     const prompt = [
       managerHandoffPrompt(goal, plan),
       workerPrompt(task, goal, null, runAgent, runContext),
+      COMPLETION_CONTRACT_PROMPT,
       '(User follow-up on the goal you worked on. Apply it to the same goal and deliver the requested result.)',
     ].filter(Boolean).join('\n\n');
     const callT0 = Date.now();
@@ -2765,6 +2772,17 @@ async function runTask(task) {
     task.unmappedChangedFiles = unmappedChangedFiles(task.changedFiles, task.requirementEvidence);
     task.requirementVerification = { proof: task.proof ?? null, run: task.run ?? null, changedFiles: task.changedFiles };
     sendProcessAct(task, `Detected ${task.changedFiles.length} changed file${task.changedFiles.length === 1 ? '' : 's'} from this follow-up.`);
+    const completionIssue = completionContractIssue({
+      request: goal?.text,
+      followUp: task.detail,
+      result: task.result,
+      status: task.status,
+    });
+    if (completionIssue) {
+      task.status = 'interrupted';
+      task.result = `[未解決: ${completionIssue.reason}]\n\n${task.result}`.slice(0, RESULT_MAX);
+      sendProcessAct(task, 'Completion contract rejected an unresolved refusal — kept out of Review for retry.');
+    }
     task.finishedAt = new Date().toISOString();
     task.resultAttemptId = task.attemptId;
     saveTask(task);
@@ -2799,7 +2817,7 @@ async function runTask(task) {
     const runEffort = task.effort ?? goal?.effort;
     const resumeSession = shouldFreshSessionForPlan(plan) ? undefined : (goalSessionFor(goal, runAgent) ?? undefined);
     const runContext = workerRunContext({ goal, task, agent: runAgent, model: runModel, effort: runEffort, permissionMode, cwd: workDir, resumeSession, plan });
-    const prompt = [managerHandoffPrompt(goal, plan), workerPrompt(task, goal, null, runAgent, runContext)].filter(Boolean).join('\n\n');
+    const prompt = [managerHandoffPrompt(goal, plan), workerPrompt(task, goal, null, runAgent, runContext), COMPLETION_CONTRACT_PROMPT].filter(Boolean).join('\n\n');
     sendWorkerContextAct(task, runContext);
     sendProcessAct(task, `Starting ${runAgent === 'codex' ? 'Codex' : 'Claude Code'} worker (attempt ${attempt}/${maxAttempts}).`);
     let r = await runWorkerAgent({
@@ -2833,7 +2851,7 @@ async function runTask(task) {
       sendWorkerContextAct(task, freshContext);
       r = await runWorkerAgent({
         agent: runAgent,
-        prompt: workerPrompt(task, goal, null, runAgent, freshContext), cwd: workDir, tools: WORKER_TOOLS,
+        prompt: [workerPrompt(task, goal, null, runAgent, freshContext), COMPLETION_CONTRACT_PROMPT].join('\n\n'), cwd: workDir, tools: WORKER_TOOLS,
         permissionMode,
         model: runModel, effort: runEffort, onEvent: (line) => sendAct(task, line),
         images: goal?.images,
@@ -2984,6 +3002,17 @@ async function runTask(task) {
     task.result = `[未完了の疑い: 変更ファイル0件かつ応答が途中で切れています] ${task.result}`.slice(0, RESULT_MAX);
     sendProcessAct(task, 'Result looked incomplete (0 changed files, cut-off text) — marked interrupted instead of done for human review.');
   }
+  const completionIssue = completionContractIssue({
+    request: goal?.text,
+    followUp: task.reply ? task.detail : '',
+    result: task.result,
+    status: task.status,
+  });
+  if (completionIssue) {
+    task.status = 'interrupted';
+    task.result = `[未解決: ${completionIssue.reason}]\n\n${task.result}`.slice(0, RESULT_MAX);
+    sendProcessAct(task, 'Completion contract rejected an unresolved refusal — kept out of Review for retry.');
+  }
   task.finishedAt = new Date().toISOString();
   task.resultAttemptId = task.attemptId;
   saveTask(task);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.87",
+  "version": "0.10.89",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {