@intentic/sandbox-contract 1.307.0 → 1.308.2

package/src/schemas/agent.ts

@@ -125,166 +125,167 @@ export const ForkedFromSchema = z.object({
     files: z.enum(["then", "now"]),
 });
 export type ForkedFrom = z.infer<typeof ForkedFromSchema>;
-export const AgentTurnSchema = z
-    .object({
-        prompt: z.string().describe("What to say to the agent. May be empty if you are only attaching files."),
-        // Seeds a fresh registry entry's title; an existing entry's title always wins over this.
-        title: z
-            .string()
-            .max(80)
-            .optional()
-            .describe("A title for a conversation this turn is opening. Ignored for a conversation that already has one."),
-        // Already uploaded via /workspace/upload; Claude reads them via Read, Codex gets images as native input.
-        attachments: z
-            .array(z.string().min(1))
-            .max(20)
-            .optional()
-            .describe("Files to hand the agent along with the prompt, as workspace paths. Upload them first."),
-        // Read out of the prompt's own `@path` tokens rather than chosen: a tokenizer over pasted text guesses, so a
-        // miss here is dropped and only a chosen attachment can refuse the turn.
-        mentions: z
-            .array(z.string().min(1))
-            .max(MENTION_LIMIT)
-            .optional()
-            .describe(
-                "Workspace paths the prompt mentions with `@`. Unlike attachments, one that escapes the workspace or names no file is ignored rather than refused.",
-            ),
-        // Which provider serves the turn, absent = claude; a sessionId resumes only on the provider that minted it.
-        agent: AgentProviderSchema.optional().describe("Which model provider serves this turn. Leave it out for Claude."),
-        // Which agentic loop runs the turn, absent = provider's own; "claude-code" forces the SDK loop for any
-        // provider.
-        harness: AgentHarnessSchema.optional().describe("Which agentic loop runs the turn. Leave it out to use each provider's own."),
-        // Which connected account of that provider serves the turn; absent = the provider's first account.
-        account: z.string().optional().describe("Which of that provider's connected accounts pays for the turn. Leave it out for the first one."),
-        // Distinct from `account` (who pays): whose name the turn posts as; absent means something different for each
-        // mode.
-        actsAs: entryId.optional().describe("Which persona the turn speaks as out in the world. Not the same as which account pays for it."),
-        sessionId: z.string().optional().describe("Resume this provider session instead of starting a fresh one."),
-        // Stable id surviving provider/account/harness switches; keys the registry entry, the turn run, and the
-        // worktree when isolated.
-        conversationId: ConversationIdSchema.optional().describe(
-            "The conversation this turn belongs to. You choose it, it survives model switches, and it is how you address the conversation later. Naming one that does not exist opens it.",
+// The turn's fields before the cross-field refinements below, so a subset (TurnProfileSchema) can be picked from them.
+const AgentTurnFieldsSchema = z.object({
+    prompt: z.string().describe("What to say to the agent. May be empty if you are only attaching files."),
+    // Seeds a fresh registry entry's title; an existing entry's title always wins over this.
+    title: z
+        .string()
+        .max(80)
+        .optional()
+        .describe("A title for a conversation this turn is opening. Ignored for a conversation that already has one."),
+    // Already uploaded via /workspace/upload; Claude reads them via Read, Codex gets images as native input.
+    attachments: z
+        .array(z.string().min(1))
+        .max(20)
+        .optional()
+        .describe("Files to hand the agent along with the prompt, as workspace paths. Upload them first."),
+    // Read out of the prompt's own `@path` tokens rather than chosen: a tokenizer over pasted text guesses, so a
+    // miss here is dropped and only a chosen attachment can refuse the turn.
+    mentions: z
+        .array(z.string().min(1))
+        .max(MENTION_LIMIT)
+        .optional()
+        .describe(
+            "Workspace paths the prompt mentions with `@`. Unlike attachments, one that escapes the workspace or names no file is ignored rather than refused.",
         ),
-        // Runs in the conversation's own git worktree (created lazily) instead of shared /work; requires
-        // conversationId.
-        isolated: z
-            .boolean()
-            .optional()
-            .describe(
-                "Work in this conversation's own private copy of the repos rather than the shared tree, so several agents can work at once. Needs a conversation id.",
-            ),
-        // Decided like `isolated`: the first turn's choice, latched. A persona's own start folder wins over it.
-        startIn: z
-            .string()
-            .max(200)
-            .optional()
-            .describe(
-                "Which folder the conversation opens in, relative to the workspace root; the project it belongs to. Decided on the first turn. A persona that names its own start folder wins.",
-            ),
-        // Decided like `isolated`: the request's choice on the first turn, the registry's after. `runner` implies
-        // isolation; absent means local.
-        placement: AgentPlacementSchema.optional().describe(
-            "Where this conversation runs: this sandbox (leave it out), or a paired runner by id. Decided on the first turn; later turns follow the conversation.",
+    // Which provider serves the turn, absent = claude; a sessionId resumes only on the provider that minted it.
+    agent: AgentProviderSchema.optional().describe("Which model provider serves this turn. Leave it out for Claude."),
+    // Which agentic loop runs the turn, absent = provider's own; "claude-code" forces the SDK loop for any
+    // provider.
+    harness: AgentHarnessSchema.optional().describe("Which agentic loop runs the turn. Leave it out to use each provider's own."),
+    // Which connected account of that provider serves the turn; absent = the provider's first account.
+    account: z.string().optional().describe("Which of that provider's connected accounts pays for the turn. Leave it out for the first one."),
+    // Distinct from `account` (who pays): whose name the turn posts as; absent means something different for each
+    // mode.
+    actsAs: entryId.optional().describe("Which persona the turn speaks as out in the world. Not the same as which account pays for it."),
+    sessionId: z.string().optional().describe("Resume this provider session instead of starting a fresh one."),
+    // Stable id surviving provider/account/harness switches; keys the registry entry, the turn run, and the
+    // worktree when isolated.
+    conversationId: ConversationIdSchema.optional().describe(
+        "The conversation this turn belongs to. You choose it, it survives model switches, and it is how you address the conversation later. Naming one that does not exist opens it.",
+    ),
+    // Runs in the conversation's own git worktree (created lazily) instead of shared /work; requires
+    // conversationId.
+    isolated: z
+        .boolean()
+        .optional()
+        .describe(
+            "Work in this conversation's own private copy of the repos rather than the shared tree, so several agents can work at once. Needs a conversation id.",
         ),
-        // Pins a new isolated conversation's worktree to these commits; a workflow step's candidates share one snapshot
-        // and skip the ordinary rebase.
-        worktreeBase: z
-            .array(RepoBaseSchema)
-            .min(1)
-            .max(50)
-            .optional()
-            .describe(
-                "Pin a new private copy to these exact commits instead of today's workspace. Used when several agents must start from identical files.",
-            ),
-        // Overrides landing for this turn only; a workflow step sets false so candidates can't leak in before synthesis
-        // compares them.
-        autoLand: z
-            .boolean()
-            .optional()
-            .describe(
-                "Whether this turn's work merges into the workspace when it finishes. Overrides the conversation's own setting for this turn only.",
-            ),
-        // Which per-job model list answers when nobody named a model or provider (turn-resume.ts); names the job, not a
-        // tier, and never overrides an explicit pick.
-        runRole: ModelRoleSchema.optional().describe(
-            "What started this turn, when it was not a person typing: which of the sandbox's per-job model lists answers for it. Only used when the turn names no model of its own.",
+    // Decided like `isolated`: the first turn's choice, latched. A persona's own start folder wins over it.
+    startIn: z
+        .string()
+        .max(200)
+        .optional()
+        .describe(
+            "Which folder the conversation opens in, relative to the workspace root; the project it belongs to. Decided on the first turn. A persona that names its own start folder wins.",
         ),
-        // Set only by the daemon's own dispatchers, never a client; requires conversationId to record it on.
-        origin: AgentOriginSchema.optional().describe(
-            "Set by the sandbox alone: this turn opened a conversation on behalf of a message from outside rather than a person.",
+    // Decided like `isolated`: the request's choice on the first turn, the registry's after. `runner` implies
+    // isolation; absent means local.
+    placement: AgentPlacementSchema.optional().describe(
+        "Where this conversation runs: this sandbox (leave it out), or a paired runner by id. Decided on the first turn; later turns follow the conversation.",
+    ),
+    // Pins a new isolated conversation's worktree to these commits; a workflow step's candidates share one snapshot
+    // and skip the ordinary rebase.
+    worktreeBase: z
+        .array(RepoBaseSchema)
+        .min(1)
+        .max(50)
+        .optional()
+        .describe(
+            "Pin a new private copy to these exact commits instead of today's workspace. Used when several agents must start from identical files.",
         ),
-        // No `history` field: a provider/account/harness switch carries no transcript over the wire; the daemon seeds
-        // the new session from its own conversationId-keyed record.
-        // Where a fork was cut from, on its first turn only; requires conversationId, and files:"then" implies
-        // isolated.
-        forkOf: z
-            .object({
-                conversationId: ConversationIdSchema.describe("The conversation this one was cut from."),
-                keep: z.number().int().nonnegative().describe("How many of that conversation's messages to copy in before this turn runs."),
-                files: z
-                    .enum(["then", "now"])
-                    .describe(
-                        'Which files the fork opens on: "now" is the workspace as it stands, "then" is the files as they were at the cut, which needs a private copy.',
-                    ),
-            })
-            .optional()
-            .describe("Where this conversation was cut from, on its first turn only. Only the client knows this, so only the client can say it."),
-        // The browser sends the chosen model per turn; the provider token is the sandbox's own stored credential.
-        model: z.string().optional().describe("Which model to use. Leave it out for the provider's default."),
-        // Audience only, never model routing: `runRole` is what fills a model in. A run somebody pressed and is
-        // watching leaves this off, however little of it a person typed.
-        unattended: z
-            .boolean()
-            .optional()
-            .describe(
-                "Nobody is watching this turn: a schedule, a queue or another agent started it and no chat is open on it. A card that needs a person is refused rather than raised, plan mode and the terminal hand-off are withheld, and the sandbox's signed-in accounts stay out of it unless a persona carries them.",
-            ),
-        // Outside content caused this turn, naming the source; distinct from `unattended` (whether anyone is watching).
-        outsideWake: z
-            .string()
-            .min(1)
-            .optional()
-            .describe(
-                "Content from outside caused this turn, and what to call the source. It is what makes the sandbox treat the turn as carrying somebody else's words.",
-            ),
-        // How tool calls are gated for this turn (the SDK's permissionMode, verbatim):
-        // plan: propose → approve → execute; the proposing half asks nothing, it only withholds writes
-        // default: prompts per tool on the permission side channel, the one mode that interrupts anybody
-        // bypassPermissions: runs everything
-        // The agent can move itself between modes mid-turn, riding back as a `mode` frame.
-        permissionMode: PermissionModeSchema.optional().describe(
-            "How tool calls are gated: ask before each tool, propose a plan first, or run everything. The agent can move itself between these mid-turn.",
+    // Overrides landing for this turn only; a workflow step sets false so candidates can't leak in before synthesis
+    // compares them.
+    autoLand: z
+        .boolean()
+        .optional()
+        .describe(
+            "Whether this turn's work merges into the workspace when it finishes. Overrides the conversation's own setting for this turn only.",
         ),
-        // Narrows the turn to these tool names (the SDK option, not the daemon's MCP `tools`/servers); absent means
-        // everything the runtime has.
-        allowedTools: z
-            .array(z.string().min(1))
-            .optional()
-            .describe(
-                "Narrow the turn to these tools. Leave it out for everything the runtime has. For a turn driven by an outside message this list is the real boundary, because prompt wording is only advice.",
-            ),
-        effort: z.string().optional().describe("How hard the model should think, where the provider offers a choice."),
-        thinking: z.boolean().optional().describe("Whether to show the model's reasoning as it works."),
-        // Requests the harness serve this turn faster at a higher price; a request, not a promise, the `fast_mode`
-        // frame reports what happened.
-        fast: z
-            .boolean()
-            .optional()
-            .describe(
-                "Ask for the same work at a higher rate for a higher price. A request rather than a promise: the answer says what actually happened.",
-            ),
-        // Set by the composer on the one turn whose model the Auto judge chose; the daemon only records it.
-        autoPicked: z
-            .boolean()
-            .optional()
-            .describe(
-                "Whether this turn's model was chosen for you by reading the conversation's opening message, rather than picked by hand. Recorded so the choice can be judged later against what you did next.",
-            ),
-        // The opt-in editor context chip: what the user is looking at, folded into the prompt daemon-side.
-        editorContext: EditorContextSchema.optional().describe(
-            'What the user has open in their editor, folded into the prompt so that pointing words like "this" resolve.',
+    // Which per-job model list answers when nobody named a model or provider (turn-resume.ts); names the job, not a
+    // tier, and never overrides an explicit pick.
+    runRole: ModelRoleSchema.optional().describe(
+        "What started this turn, when it was not a person typing: which of the sandbox's per-job model lists answers for it. Only used when the turn names no model of its own.",
+    ),
+    // Set only by the daemon's own dispatchers, never a client; requires conversationId to record it on.
+    origin: AgentOriginSchema.optional().describe(
+        "Set by the sandbox alone: this turn opened a conversation on behalf of a message from outside rather than a person.",
+    ),
+    // No `history` field: a provider/account/harness switch carries no transcript over the wire; the daemon seeds
+    // the new session from its own conversationId-keyed record.
+    // Where a fork was cut from, on its first turn only; requires conversationId, and files:"then" implies
+    // isolated.
+    forkOf: z
+        .object({
+            conversationId: ConversationIdSchema.describe("The conversation this one was cut from."),
+            keep: z.number().int().nonnegative().describe("How many of that conversation's messages to copy in before this turn runs."),
+            files: z
+                .enum(["then", "now"])
+                .describe(
+                    'Which files the fork opens on: "now" is the workspace as it stands, "then" is the files as they were at the cut, which needs a private copy.',
+                ),
+        })
+        .optional()
+        .describe("Where this conversation was cut from, on its first turn only. Only the client knows this, so only the client can say it."),
+    // The browser sends the chosen model per turn; the provider token is the sandbox's own stored credential.
+    model: z.string().optional().describe("Which model to use. Leave it out for the provider's default."),
+    // Audience only, never model routing: `runRole` is what fills a model in. A run somebody pressed and is
+    // watching leaves this off, however little of it a person typed.
+    unattended: z
+        .boolean()
+        .optional()
+        .describe(
+            "Nobody is watching this turn: a schedule, a queue or another agent started it and no chat is open on it. A card that needs a person is refused rather than raised, plan mode and the terminal hand-off are withheld, and the sandbox's signed-in accounts stay out of it unless a persona carries them.",
         ),
-    })
+    // Outside content caused this turn, naming the source; distinct from `unattended` (whether anyone is watching).
+    outsideWake: z
+        .string()
+        .min(1)
+        .optional()
+        .describe(
+            "Content from outside caused this turn, and what to call the source. It is what makes the sandbox treat the turn as carrying somebody else's words.",
+        ),
+    // How tool calls are gated for this turn (the SDK's permissionMode, verbatim):
+    // plan: propose → approve → execute; the proposing half asks nothing, it only withholds writes
+    // default: prompts per tool on the permission side channel, the one mode that interrupts anybody
+    // bypassPermissions: runs everything
+    // The agent can move itself between modes mid-turn, riding back as a `mode` frame.
+    permissionMode: PermissionModeSchema.optional().describe(
+        "How tool calls are gated: ask before each tool, propose a plan first, or run everything. The agent can move itself between these mid-turn.",
+    ),
+    // Narrows the turn to these tool names (the SDK option, not the daemon's MCP `tools`/servers); absent means
+    // everything the runtime has.
+    allowedTools: z
+        .array(z.string().min(1))
+        .optional()
+        .describe(
+            "Narrow the turn to these tools. Leave it out for everything the runtime has. For a turn driven by an outside message this list is the real boundary, because prompt wording is only advice.",
+        ),
+    effort: z.string().optional().describe("How hard the model should think, where the provider offers a choice."),
+    thinking: z.boolean().optional().describe("Whether to show the model's reasoning as it works."),
+    // Requests the harness serve this turn faster at a higher price; a request, not a promise, the `fast_mode`
+    // frame reports what happened.
+    fast: z
+        .boolean()
+        .optional()
+        .describe(
+            "Ask for the same work at a higher rate for a higher price. A request rather than a promise: the answer says what actually happened.",
+        ),
+    // Set by the composer on the one turn whose model the Auto judge chose; the daemon only records it.
+    autoPicked: z
+        .boolean()
+        .optional()
+        .describe(
+            "Whether this turn's model was chosen for you by reading the conversation's opening message, rather than picked by hand. Recorded so the choice can be judged later against what you did next.",
+        ),
+    // The opt-in editor context chip: what the user is looking at, folded into the prompt daemon-side.
+    editorContext: EditorContextSchema.optional().describe(
+        'What the user has open in their editor, folded into the prompt so that pointing words like "this" resolve.',
+    ),
+});
+export const AgentTurnSchema = AgentTurnFieldsSchema
     // An attachment-only send (no text) is legal; an entirely empty turn is not.
     .refine((turn) => turn.prompt.trim().length > 0 || (turn.attachments?.length ?? 0) > 0, {
         message: "prompt or attachments required",
@@ -306,6 +307,35 @@ export const AgentTurnSchema = z
         message: 'forkOf.files "then" requires isolated',
     });
 export type AgentTurn = z.infer<typeof AgentTurnSchema>;
+// Which turn this is, as opposed to what it says: who serves it and how (agent, harness, account, model and its knobs),
+// as whom (actsAs), where (isolated), whether anyone watches (unattended) and for which job (runRole). A turn that
+// continues another (a resume, a wake, a nudge, a child's follow-up) carries this whole, never a hand-picked part.
+export const TurnProfileSchema = AgentTurnFieldsSchema.pick({
+    agent: true,
+    harness: true,
+    account: true,
+    model: true,
+    effort: true,
+    thinking: true,
+    fast: true,
+    actsAs: true,
+    isolated: true,
+    unattended: true,
+    runRole: true,
+});
+export type TurnProfile = z.infer<typeof TurnProfileSchema>;
+const PROFILE_KEYS = Object.keys(TurnProfileSchema.shape) as readonly (keyof TurnProfile)[];
+// Read as `=== true` everywhere, so false and absent are one value; carrying a false would state a placement or an
+// audience the turn never named.
+const TRUE_ONLY: ReadonlySet<keyof TurnProfile> = new Set(["isolated", "unattended"]);
+/* THE PROFILE A TURN STATES: absent stays absent (no `undefined` keys), and a `=== true` flag travels only when set. */
+export const profileOf = (turn: TurnProfile): TurnProfile =>
+    Object.fromEntries(
+        PROFILE_KEYS.flatMap((key) => {
+            const value = turn[key];
+            return value === undefined || (TRUE_ONLY.has(key) && value !== true) ? [] : [[key, value]];
+        }),
+    ) as TurnProfile;
 /* A MODEL CHOSEN FOR ONE SURFACE-STARTED RUN, what the caret on the shared run button (<AgentRunButton>) sends along with the click that starts it. */
 export const AgentRunPickSchema = z
     .object({

package/src/schemas/agents.ts

@@ -109,6 +109,12 @@ export const LandedMessageSchema = z.object({
         .string()
         .optional()
         .describe("What this change takes away, for anything already relying on it. Nearly always absent: it is for removals, not for additions."),
+    // Present only when the conversation said why a test it weakened should stay weaker; the push gate reads it as the
+    // weakening's declaration.
+    testNote: z
+        .string()
+        .optional()
+        .describe("Why a test this change weakened is meant to be weaker, in the conversation's own words. Nearly always absent."),
 });
 export type LandedMessage = z.infer<typeof LandedMessageSchema>;
 // One model's turn in the drafting walk (agent/role-model.ts tries connected models in order), in spend order:

package/src/schemas/devices.ts

@@ -1,6 +1,6 @@
 // What one of the user's own machines is running.
 import { z } from "zod";
-import { hostEntryOf, hostEnvironmentOf, type DeviceFacts, DeviceFactsSchema, WSL_SYSTEM_DISTROS, WslEnvironmentSchema } from "./hosts.js";
+import { hostEntryOf, hostEnvironmentOf, type DeviceFacts, DeviceFactsSchema, userDistrosOf, WslEnvironmentSchema } from "./hosts.js";
 import { DEV_VERSION } from "../state/versions.js";
 // Desktop-sync report shape shared by the agent, daemon and browser, produced only by the agent's own `deviceReport`.
 // The agent never reports `sandboxes`; the docker half is filled in by whoever reads the report, scoped to the reader's
@@ -596,7 +596,7 @@ export const pathReach = (platform: string | undefined, facts: DeviceFacts | und
     if (platform === undefined || (platform === "windows") === windowsPath(path)) {
         return { kind: "direct" };
     }
-    const distros = platform === "windows" ? (facts?.wslDistros ?? []).filter((distro) => !WSL_SYSTEM_DISTROS.has(distro)) : [];
+    const distros = platform === "windows" ? userDistrosOf(facts) : [];
     const only = distros.length === 1 ? distros[0] : undefined;
     return only === undefined ? { kind: "none", distros } : { kind: "wsl", distro: only };
 };

package/src/schemas/hosts.ts

@@ -41,6 +41,10 @@ export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 // Docker Desktop's own distros: `wsl -l -q` lists them like any other, and none ever runs an agent or holds a checkout.
 export const WSL_SYSTEM_DISTROS: ReadonlySet<string> = new Set(["docker-desktop", "docker-desktop-data"]);
 
+// The distros a Windows side lists that are the user's own: the only ones any screen offers, crosses into or boots.
+export const userDistrosOf = (facts: Pick<DeviceFacts, "wslDistros"> | undefined): string[] =>
+    (facts?.wslDistros ?? []).filter((distro) => !WSL_SYSTEM_DISTROS.has(distro));
+
 // One folder, two names. Windows sees a distro's files under a UNC share and a distro sees the Windows drives under
 // /mnt, so a path handed across the boundary is translated here rather than by hand at every call site.
 export const wslPathOf = (windowsPath: string): string | undefined => {

package/src/schemas/settings.ts

@@ -389,6 +389,15 @@ export const SandboxSettingsSchema = z.object({
         ),
     // Worth it since the container is recreated on every update or environment approval — otherwise approving a
     // Dockerfile change costs the run that asked for it.
+    // What happens to breakage found after the work that caused it has left the turn: a land that turns the main tree's own
+    // check red is sent back to the conversation that landed it, and main's CI staying red on one failure gets a fix agent
+    // once pushes go quiet, with a fleet failure re-run instead. Off, both are only reported.
+    autoRepair: z
+        .boolean()
+        .default(true)
+        .describe(
+            "Whether breakage found after the work left its turn is repaired without asking: a land that turns the main tree's check red goes back to the conversation that landed it, and main's CI staying red on the same failure gets a fix agent once pushes go quiet. A failure on the CI fleet itself is re-run once instead. Off, both are only reported.",
+        ),
     autoResumeOnRestart: z
         .boolean()
         .default(false)

package/src/state/history-state.ts

@@ -1,8 +1,8 @@
 import type { StateFile } from "./state-portability.js";
 
-// /history holds daemon state outside /work's `.intentic/`: real git dirs (in-tree .git is a pointer file), the fleet
-// registry, turn journal, ledgers, checkpoint scopes, isolated checkouts. Nothing here is watched, unlike `.intentic`.
-// history-state-coverage.test.ts enforces this list stays complete.
+// /history holds daemon state outside /work's `.intentic/`: real git dirs (in-tree .git is a pointer file), the fleet's
+// database and each conversation's directory, ledgers, checkpoint scopes, isolated checkouts. Nothing here is watched,
+// unlike `.intentic`. history-state-coverage.test.ts enforces this list stays complete.
 
 // historyRoot-relative paths, forward-slash, matched by prefix; a directory keeps its trailing slash so it can't
 // prefix-match a sibling file.
@@ -13,22 +13,15 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "gits/", portability: "carry" },
     // Checkpoint timeline (one bare repo per scope); lets "restore to before that turn" still reach back.
     { path: "scopes/", portability: "carry" },
-    // The fleet: every conversation card, its branch, session ids and standing.
-    { path: "agents.json", portability: "carry" },
-    { path: "turns/", portability: "carry" },
-    // Armed condition watches; carries safely: the journal holds no credential, only names re-derived on target.
-    { path: "watches/", portability: "carry" },
-    { path: "transcripts/", portability: "carry" },
-    // What each conversation's last turn was told before its own words (prompt-record.ts), one file per conversation.
-    // Carried with the transcripts it explains: a restored conversation whose prompt record stayed behind can no
-    // longer say whether its AGENTS.md arrived or a small window trimmed it, which is the whole point of keeping it.
-    { path: "system-prompts/", portability: "carry" },
-    // One runtime session store per fenced conversation, holding for it what `.intentic/records/sessions/claude/` holds
-    // for every other: its own transcripts, plans, backups and checklists, kept off /work so no other conversation's
-    // namespace can reach them. Carried for the same reason that one is.
-    { path: "sessions/", portability: "carry" },
-    // What each message can restore to (a checkpoint or isolated commit); the join between transcripts and scopes.
-    { path: "turn-checkpoints.json", portability: "carry" },
+    // The fleet and everything keyed by a conversation that must agree with it: each card's record, its checkout's
+    // per-repo provenance, what each message restores to, its turn in flight and its armed watches, plus automation
+    // fires in flight. Packed as a snapshot taken for the bundle, never as the live file and its WAL, and landed row
+    // by row into the target's own database. Watches carry safely: they hold no credential, only names.
+    { path: "conversations.db", portability: "carry" },
+    // One directory per conversation: its transcript, what its last turn was told before its own words, and a fenced
+    // conversation's own runtime session store (what `.intentic/records/sessions/claude/` holds for every other).
+    // Carried whole, like the conversation it is.
+    { path: "conversations/", portability: "carry" },
     // Index of published-page conversations; the pages travel with /work anyway, this makes one withdrawable.
     { path: "shares.json", portability: "carry" },
     { path: "activity.jsonl", portability: "carry" },
@@ -56,22 +49,14 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
 
     /* ---- regenerated by the target ---- */
 
-    // Deliberately omitted: the branch lives in gits/, the registry in agents.json; regenerated on the next turn.
+    // Deliberately omitted: the branch lives in gits/, the registry in conversations.db; regenerated on the next turn.
     {
         path: "worktrees/",
         portability: "derived",
         note: "Each conversation re-attaches its checkout from its branch on its next turn.",
     },
-    // Search phrase index, derived from transcripts/; rebuilt by the first boot's backfill instead of carried.
+    // Search phrase index, derived from the conversations' transcripts; rebuilt by the first boot's backfill instead.
     { path: "said-index/", portability: "derived", note: "Rebuilt from the carried transcripts by the first boot's backfill." },
-    // What each conversation was last told (prompt-record.ts). Tens of kilobytes per conversation, rewritten by every
-    // turn — and a prompt composed on THIS sandbox names its paths, devices and accounts, so carrying it would describe
-    // the machine the bundle left rather than the one it landed on.
-    {
-        path: "system-prompts/",
-        portability: "derived",
-        note: "Each conversation records what it was told again on its next turn.",
-    },
     // What each connected machine and browser publishes as its tools, so one that is asleep still appears in a turn
     // (peers/peer-tool-memory.ts). Re-asked of every peer the moment it reconnects, and about software that stayed
     // behind on somebody else's computer, so it is not worth carrying.

package/src/state/landed-commit.test.ts

@@ -0,0 +1,18 @@
+import { expect, test } from "bun:test";
+import { declaredTestNote, landedCommitMessage } from "./landed-commit.js";
+
+// The push gate reads a weakening's declaration off the commit (assertion-ratchet.mjs), so the trailer must survive
+// the trip from the conversation's last word into the message a land commits under.
+
+test("a landed message commits as its subject and one trailer paragraph, the test note included", () => {
+    expect(landedCommitMessage({ subject: "fix: tabs" })).toBe("fix: tabs");
+    expect(landedCommitMessage({ subject: "feat: tabs", note: "Tabs remember.", breaking: "Old API gone.", testNote: "Rows became a table." })).toBe(
+        "feat: tabs\n\nRelease-Note: Tabs remember.\nBreaking-Note: Old API gone.\nTest-Note: Rows became a table.",
+    );
+});
+
+test("a Test-Note is read only from a line that starts with one and says something", () => {
+    expect(declaredTestNote("Done.\n\nTest-Note: the prose assertion became a structural one\n")).toBe("the prose assertion became a structural one");
+    expect(declaredTestNote("I kept a Test-Note: nowhere near the start")).toBeUndefined();
+    expect(declaredTestNote("Test-Note:   \n")).toBeUndefined();
+});

package/src/state/landed-commit.ts

@@ -0,0 +1,17 @@
+import type { LandedMessage } from "../schemas/agents.js";
+
+// The commit a landed message makes: its subject, then every trailer in one paragraph, since git reads only the last
+// block of a message as trailers.
+export const landedCommitMessage = (landed: LandedMessage): string => {
+    const trailers = [
+        landed.note === undefined ? "" : `Release-Note: ${landed.note}`,
+        landed.breaking === undefined ? "" : `Breaking-Note: ${landed.breaking}`,
+        landed.testNote === undefined ? "" : `Test-Note: ${landed.testNote}`,
+    ]
+        .filter((line) => line !== "")
+        .join("\n");
+    return [landed.subject, trailers].filter((part) => part !== "").join("\n\n");
+};
+
+// The `Test-Note:` line a conversation ended its last message with, when it declared a weakened test on purpose.
+export const declaredTestNote = (said: string): string | undefined => /^Test-Note:[ \t]*(\S.*)$/m.exec(said)?.[1]?.trim();