@plot-pm/board 0.16.2 → 0.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plot-pm/board",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Local Kanban board for Plot — a glanceable view of plan phases from docs/plans, with sprint and story filters",
   "type": "module",
   "license": "MIT",
@@ -39,11 +39,9 @@
     "plot-pr-merged.sh",
     "plot-reap.sh",
     "plot-release-refs.sh",
-    "plot-resolve-artifact.sh",
     "plot-state-receipt.sh",
     "plot-tmp.sh",
     "plot-transcript-quiet.sh",
-    "plot-worker-monitor.sh",
     "plot-worker-state.sh"
   ],
   "scripts": {

package/plot-agent-manifest.sh

@@ -17,7 +17,66 @@
 # `plot_session_id`, which `plot-dispatch.sh` calls to launch an agent and
 # `plot-worker-loop.sh` calls when a hop moves the agent to a new branch; and
 # `manifest_resume_id` with `session_handle`, the conversation handle that the
-# loop passes to the prompt and `plot-worker-monitor.sh` probes for a transcript.
+# loop passes to the prompt and the loop's own watcher probes for a transcript.
+
+# ONE READER FOR EVERY STRING FIELD a manifest carries, and one for every
+# counter. Six callers read one field each — `branch`, `session`, `worktree`,
+# `resumeId`, `attempts`, `correctionAttempts` — and each carried its own
+# fourteen-line copy of the same read-parse-default dance. The copies answered
+# identically and drifted only in the field name, so the name is the argument.
+#
+# ABSENT, UNREADABLE AND WRONG-TYPED ARE ONE ANSWER, which is the contract
+# every caller already documents: nothing for a string (status 1), `0` for a
+# counter. A manifest that cannot be read is not permission to do anything, and
+# a counter that cannot be read also cannot be raised.
+manifest_string() { # $1=manifest $2=field → prints the value, or nothing
+  local manifest="$1" value
+  [ -n "$manifest" ] && [ -f "$manifest" ] || return 1
+  value=$(node -e '
+    const fs = require("fs");
+    try {
+      const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+      const v = manifest[process.argv[2]];
+      process.stdout.write(typeof v === "string" ? v : "");
+    } catch { process.stdout.write(""); }
+  ' "$manifest" "$2" 2>/dev/null) && [ -n "$value" ] || return 1
+  printf '%s' "$value"
+}
+
+# A non-negative integer field, or `0`. The node call itself only ever prints
+# a clean digit string or "0", so a failed call is the one case needing a
+# shell-side fallback.
+manifest_count() { # $1=manifest $2=field → prints a count
+  local manifest="$1"
+  [ -n "$manifest" ] && [ -f "$manifest" ] || { printf '0'; return 0; }
+  node -e '
+    const fs = require("fs");
+    try {
+      const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+      const n = manifest[process.argv[2]];
+      process.stdout.write(Number.isInteger(n) && n >= 0 ? String(n) : "0");
+    } catch { process.stdout.write("0"); }
+  ' "$manifest" "$2" 2>/dev/null || printf '0'
+}
+
+# Raise a non-negative integer field by one, leaving every other field verbatim.
+#
+# THROUGH A TEMP FILE AND A RENAME, the shape every writer here takes: a reader
+# never sees a partial manifest. A write that fails leaves the file alone and
+# reports it; an absent manifest is not a failure.
+raise_manifest_count() { # $1=manifest $2=field
+  local manifest="$1" tmp="$1.plot-count-tmp"
+  [ -n "$manifest" ] && [ -f "$manifest" ] || return 0
+  node -e '
+    const fs = require("fs");
+    const [file, field, tmp] = process.argv.slice(1);
+    const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+    const n = manifest[field];
+    manifest[field] = (Number.isInteger(n) && n >= 0 ? n : 0) + 1;
+    fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n");
+  ' "$manifest" "$2" "$tmp" 2>/dev/null || { rm -f "$tmp"; return 1; }
+  mv -f "$tmp" "$manifest" 2>/dev/null || { rm -f "$tmp"; return 1; }
+}
 
 # Clear `branch` when a slice finishes, so the window before the next one is
 # observable.
@@ -98,18 +157,7 @@ plot_session_id() {
 # `assigned_branch` in `plot-worker-loop.sh` already takes: no handle. A hand-started loop has no
 # manifest, and a manifest nobody can read is not a handle.
 manifest_resume_id() { # $1=manifest → prints the handle, or nothing
-  local manifest="$1"
-  [ -n "$manifest" ] && [ -f "$manifest" ] || return 1
-  local id
-  id=$(node -e '
-    const fs = require("fs");
-    try {
-      const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
-      process.stdout.write(typeof manifest.resumeId === "string" ? manifest.resumeId : "");
-    } catch { process.stdout.write(""); }
-  ' "$manifest" 2>/dev/null) || return 1
-  [ -n "$id" ] || return 1
-  printf '%s' "$id"
+  manifest_string "$1" resumeId
 }
 
 # THE HANDLE THE PROMPT CARRIES — the manifest's `resumeId`, or the launch id.
@@ -119,8 +167,8 @@ manifest_resume_id() { # $1=manifest → prints the handle, or nothing
 # the two answers are the same string and this reads as a no-op. It stops being
 # one the moment the handle diverges from the join key — which is what the two
 # fields exist to allow, and what a later `--fork-session` would do. The loop
-# and `plot-worker-monitor.sh` both call this, so the prompt and the idle
-# verdict ask about one conversation.
+# calls this for the prompt and its own watcher calls it for the idle verdict,
+# so both ask about one conversation.
 #
 # `$PLOT_SESSION_ID` IS THE FALLBACK, NOT THE SOURCE. A hand-started loop has no
 # manifest and a pre-`resumeId` manifest carries no handle; both are the launch
@@ -135,3 +183,51 @@ session_handle() { # → the handle, or nothing
   [ -n "${PLOT_SESSION_ID:-}" ] || return 1
   printf '%s' "$PLOT_SESSION_ID"
 }
+
+# The live agents whose manifests name a branch, for `claimAnswer`'s
+# `holders` — one session id per line, in the directory's own order.
+#
+# ASKS EACH MANIFEST'S OWN DESK, never the branch's checkout: an agent just
+# handed the branch has not checked it out, so a check against the branch's
+# worktree would answer nothing even while that agent's own desk is alive and
+# genuinely holds the slice. `queue-reading.ts:302` takes the same `running` or
+# `waiting` bar; a dead agent's manifest is not a holder (#1039's negative
+# control).
+#
+# `$2` AND `$3` EXCLUDE DIFFERENT THINGS, and a caller supplies at most one.
+# `plot-dispatch.sh --release` has no asker and excludes `release_wt` instead —
+# the desk its OWN live-worker refusal already checks, so this must not
+# duplicate that refusal's case with a different message for the same desk.
+# `plot-worker-loop.sh`'s rejection excludes its OWN manifest file instead —
+# the supervisor wrote the rejected branch into it before the push, so
+# counting it would answer `held-by-agent` on every rejection.
+live_holders_of_branch() { # $1=registry_dir $2=branch $3=exclude_manifest $4=exclude_worktree → "session\tworktree" lines
+  local dir="$1" branch="$2" exclude_manifest="${3:-}" exclude_worktree="${4:-}" m m_wt
+  [ -d "$dir" ] || return 0
+  for m in "$dir"/*.json; do
+    [ -f "$m" ] && [ "$m" != "$exclude_manifest" ] || continue
+    [ "$(manifest_string "$m" branch)" = "$branch" ] || continue
+    m_wt=$(manifest_string "$m" worktree) || continue
+    [ -d "$m_wt" ] && [ "$m_wt" != "$exclude_worktree" ] || continue
+    case "$(plot_worker_state "$m_wt" "" | cut -f1)" in
+      running|waiting) printf '%s\t%s\n' "$(manifest_string "$m" session)" "$m_wt" ;;
+    esac
+  done
+}
+
+# WHAT A CLAIM MEANS, ASKED OF THE DOMAIN. One of `claimAnswer`'s five words,
+# or nothing when the bundle is absent — a checkout that vendored the skills
+# without building the board answers no question rather than a wrong one.
+#
+# ONE ASKER FOR BOTH CALLERS. `plot-dispatch.sh --release` asks with `ref:
+# unknown` and no log, because `held-by-agent` follows from `holders` alone;
+# `plot-worker-loop.sh`'s rejection path supplies all three. The JSON shape is
+# the bundle's contract, and two hand-built copies of it would drift.
+claim_answer() { # $1=bundle $2=ref $3=log $4=holders, newline-separated → the word, or nothing
+  [ -f "$1" ] || return 1
+  printf '%s\n' "$4" | node -e '
+    const holders = require("fs").readFileSync(0, "utf8").split("\n").filter(Boolean);
+    const [ref, log] = process.argv.slice(1);
+    process.stdout.write(JSON.stringify({ ref, log: ref === "present" ? log : null, holders }));
+  ' "$2" "$3" | node "$1" 2>/dev/null | cut -f1
+}

package/plot-agent-monitor.sh

@@ -93,9 +93,13 @@ Started by plot-dispatch.sh inside the worker's wrapper. Reads its subject from
 the environment, exactly as the wrapper's other children do:
 
   PLOT_BRANCH        the branch whose debts this monitor will report
-  PLOT_WORKTREE      the desk it reads
+  PLOT_WORKTREE      the desk it STARTS on; it follows the manifest's
+                     `worktree` from then on (PLOT_MANIFEST_FILE below)
+  PLOT_MANIFEST_FILE the manifest this agent is named in, re-read each pass;
+                     absent or unreadable keeps watching PLOT_WORKTREE
   PLOT_MONITOR_FILE  where findings are published (default:
-                     $PLOT_WORKTREE/.plot-worker.monitor.agent.jsonl)
+                     $PLOT_WORKTREE/.plot-worker.monitor.agent.jsonl). Set
+                     explicitly, it WINS and does not follow a hop.
   PLOT_MONITOR_INTERVAL  seconds between passes (default 300)
 
   --once   take one sample and exit, rather than looping. A test
@@ -116,7 +120,14 @@ done
 monitor='AgentMonitor'
 
 branch="${PLOT_BRANCH:-}"
-worktree="${PLOT_WORKTREE:-}"
+# THE DESK THIS MONITOR WAS LAUNCHED ON, FIXED FOR ITS WHOLE LIFE. `worktree`
+# itself is no longer fixed: `monitor_pass` reassigns it every pass by asking
+# `plot_watched_desk`, which follows a hop to the manifest's new `worktree`
+# field. This is the launch desk `plot_watched_desk` falls back to when the
+# manifest carries no override — never read directly after startup.
+launched_worktree="${PLOT_WORKTREE:-}"
+worktree="$launched_worktree"
+manifest_file="${PLOT_MANIFEST_FILE:-}"
 # FIVE MINUTES IS A HOST BUDGET, NOT CAUTION. Its findings need a PR lookup, and
 # this repository has already measured what happens when host questions ride a
 # fast loop. Against a stall that lasted 50 minutes, five makes it visible 45
@@ -126,7 +137,11 @@ worktree="${PLOT_WORKTREE:-}"
 # prevent.
 interval="${PLOT_MONITOR_INTERVAL:-300}"
 
-findings="${PLOT_MONITOR_FILE:-${worktree:+$worktree/.plot-worker.monitor.agent.jsonl}}"
+# IF `PLOT_MONITOR_FILE` IS SET IT WINS AND DOES NOT FOLLOW THE DESK — the
+# existing contract this usage text already states. Otherwise `findings`
+# follows `worktree`, reassigned alongside it at the top of `monitor_pass`.
+monitor_file_override="${PLOT_MONITOR_FILE:-}"
+findings="${monitor_file_override:-${worktree:+$worktree/.plot-worker.monitor.agent.jsonl}}"
 
 # THE SUBJECT, read the same way the WorkerMonitor reads it: `.plot-worker.pid`
 # names the AGENT, and the wrapper passes its path in `PLOT_PID_FILE`.
@@ -478,7 +493,30 @@ sample_finding() { # → prints "finding\tevidence", or nothing
 
 # One full pass: sample, publish only on a change.
 monitor_pass() {
-  local row finding evidence
+  local row finding evidence new_worktree
+  # REASSIGNED ONCE, HERE, RATHER THAN THREADED THROUGH EACH READER.
+  # `worktree` feeds `plot_worker_dirty`, `plot_worker_blocked` and this
+  # monitor's transcript probe, so a hop is picked up in one place rather than
+  # three. `PLOT_MONITOR_FILE`, when set, WINS and does not follow the desk —
+  # the existing contract the usage text states.
+  new_worktree=$(plot_watched_desk "$manifest_file" "$launched_worktree")
+
+  # A DESK CHANGE RESETS `published`/`since` DELIBERATELY. The debt they
+  # remember is the OLD desk's: a finding like `holds unlanded work` is about
+  # commits and files on that specific tree, and after a hop the new desk has
+  # never been measured. Carrying the old `published` forward would compare
+  # the new desk's first reading against the old one's last and could publish
+  # `clear` for a debt that was never the new desk's to begin with — the exact
+  # trap the brief names. Resetting to blank treats the new desk as a fresh
+  # subject: a real finding there publishes as new, and a clean desk publishes
+  # nothing at all, which is silence rather than a false `clear`.
+  if [ "$new_worktree" != "$worktree" ]; then
+    published=''
+    since=''
+  fi
+  worktree="$new_worktree"
+  findings="${monitor_file_override:-${worktree:+$worktree/.plot-worker.monitor.agent.jsonl}}"
+
   row=$(sample_finding)
   finding="${row%%	*}"
   evidence=''

package/plot-approve.sh

@@ -107,12 +107,13 @@ script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 . "$script_dir/plot-state-receipt.sh"
 
 dry_run=0
-who_override=""
+who_flag_given=0
+who_flag=""
 slug=""
 while [ $# -gt 0 ]; do
   case "$1" in
     --dry-run) dry_run=1 ;;
-    --who) who_override="${2:?--who needs a value}"; shift ;;
+    --who) who_flag_given=1; who_flag="${2:-}"; shift ;;
     -h|--help) sed -n '2,12p' "$0"; exit 0 ;;
     -*) echo "plot-approve: unknown flag '$1'" >&2; exit 1 ;;
     *) slug="$1" ;;
@@ -195,11 +196,40 @@ esac
 # NONE means a pre-Plot-2 plan on an idea branch, which the skill documents as
 # `pr` by default. An unrecognised value is refused rather than defaulted:
 # "carry on" is the shape of stale assumption this whole story keeps finding.
+#
+# `in-session` IS NO LONGER A REFUSAL HERE, which is this slice's whole change.
+# `plot-approve.sh --who <handle> <slug>` performs the seven mechanical steps
+# for it exactly as it does for `pr`, because #1185 made the domain able to
+# decide the write (`approveTransition` takes `who` and `people`). What stays a
+# refusal is the absence of a usable reviewer: no `--who` at all, an empty one,
+# or one `People` does not declare — the domain's `review-human` and
+# `reviewer-undeclared` gates, asked through `decide_transition` below rather
+# than re-implemented here. There is no `--reviewer`: a round-1 panel measured
+# that spelling exiting 2 at the controller gate, and `--who` is the one flag
+# this script already declares.
+#
+# UNDER `PLOT_UNATTENDED=1` THIS STILL REFUSES, `--who` or not. The reviewer is
+# a human in a session that, by definition, has nobody in it under an
+# unattended run — the same argument `plot-approve/SKILL.md` already makes for
+# the skill's own in-session walkthrough. A default here would let the machine
+# name the reviewer, which is exactly what `--who`'s absence of a fallback (no
+# `PLOT_APPROVE_WHO`, no `git config user.name`) refuses for the same channel.
+in_session=0
 case "$review" in
   pr|NONE) ;;
   in-session)
-    die "plan '$slug' declares 'Review: in-session' — the reviewer is a human in the room.
-  A script cannot stand in for one. Approve it with /plot-approve $slug." ;;
+    if [ "${PLOT_UNATTENDED:-}" = "1" ]; then
+      die "plan '$slug' declares 'Review: in-session' — the reviewer is a human in the room.
+  Refusing under PLOT_UNATTENDED=1: there is nobody here to name. Approve it from a session: /plot-approve $slug"
+    fi
+    # No reviewer named: refuse before any git work. The domain's `review-human`
+    # gate says the same thing later, after a booking worktree exists; asking
+    # here keeps a refusal local and cheap. `--who` has no default.
+    if [ -z "$(printf '%s' "$who_flag" | tr -d '[:space:]')" ]; then
+      die "plan '$slug' declares 'Review: in-session' — name the reviewer with --who."
+    fi
+    in_session=1
+    ;;
   ballot)
     die "plan '$slug' declares 'Review: ballot' — the tally is the approval.
   A script cannot read a ballot. Approve it with /plot-approve $slug." ;;
@@ -208,71 +238,134 @@ case "$review" in
   Refusing rather than treating it as 'pr' — that would approve a plan nobody discussed." ;;
 esac
 
+# The declared handles, for the domain's `reviewer-undeclared` gate. Read
+# unconditionally — cheap, and a `pr` or `ballot` plan never reaches the branch
+# that uses it — from `People`'s `handle = Spelling; handle = Spelling` form:
+# only the text before each `=` is a handle, and `People` may be absent.
+people_raw=$(cfg "People" "")
+people_csv=$(printf '%s' "$people_raw" | tr ';' '\n' | while IFS= read -r entry; do
+  h="${entry%%=*}"
+  h="$(printf '%s' "$h" | sed -e 's/^[ \t]*//' -e 's/[ \t]*$//' | tr '[:upper:]' '[:lower:]')"
+  [ -n "$h" ] && printf '%s\n' "$h"
+done | paste -sd, -)
+[ -n "$people_csv" ] || people_csv=""
+
+# Read even for in-session: the booking worktree below (every non-same-branch
+# flow, in-session included) fetches and books against it.
 MAIN=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')
 [ -n "$MAIN" ] || MAIN=$(bash "$script_dir/plot-host.sh" default-branch 2>/dev/null) || MAIN=""
 [ -n "$MAIN" ] || MAIN="main"
 
-# The PR that carries the plan. `Impl: same branch` puts plan and code on the
-# work branch, so its PR is the WORK branch's — and it must not be merged here
-# (it merges once, at the end, carrying the implementation with it).
-same_branch=0
-[ "$impl" = "same-branch" ] && same_branch=1
-
-if [ "$same_branch" = 1 ]; then
-  pr_branch="$slug"
-  for p in $(cfg "Branch prefixes" "idea/, feature/, bug/, docs/, infra/" | tr ',' ' '); do
-    p="${p%/}"; p="${p# }"
-    [ -z "$p" ] && continue
-    [ "$p" = "idea" ] && continue
-    if git show-ref --verify --quiet "refs/heads/$p/$slug" \
-      || git show-ref --verify --quiet "refs/remotes/origin/$p/$slug"; then
-      pr_branch="$p/$slug"
-      break
-    fi
-  done
+if [ "$in_session" = 1 ]; then
+  # No plan PR to read or merge: the approval IS the reviewer's go, not a host
+  # state. `same_branch` stays 0 — in-session records through the same booking
+  # worktree the `pr` flow uses, since an in-session plan has no work branch of
+  # its own to record on.
+  same_branch=0
+  pr_number=0
+  pr_state="NONE"
+  pr_draft="false"
+  echo "step: plan $plan_file — phase=$phase review=${review} impl=${impl} (in-session, no plan PR)"
 else
-  pr_branch="idea/$slug"
-fi
+  # The PR that carries the plan. `Impl: same branch` puts plan and code on the
+  # work branch, so its PR is the WORK branch's — and it must not be merged here
+  # (it merges once, at the end, carrying the implementation with it).
+  same_branch=0
+  [ "$impl" = "same-branch" ] && same_branch=1
+
+  if [ "$same_branch" = 1 ]; then
+    pr_branch="$slug"
+    for p in $(cfg "Branch prefixes" "idea/, feature/, bug/, docs/, infra/" | tr ',' ' '); do
+      p="${p%/}"; p="${p# }"
+      [ -z "$p" ] && continue
+      [ "$p" = "idea" ] && continue
+      if git show-ref --verify --quiet "refs/heads/$p/$slug" \
+        || git show-ref --verify --quiet "refs/remotes/origin/$p/$slug"; then
+        pr_branch="$p/$slug"
+        break
+      fi
+    done
+  else
+    pr_branch="idea/$slug"
+  fi
 
-# THE EXIT CODE IS THE READING, not the emptiness of stdout. `pr-state` exits 0
-# with `state: NONE` when the host answered that the branch has no PR, and
-# non-zero when the host could not be asked: 3 for a refused or failed call
-# (a rate limit included), 4 for a backend with no answer at all. Only the
-# first is an absence. The other two stop here with the host's own words and
-# name no repair to the branch, because nothing about the branch was read.
-pr_err_file=""
-plot_tmpfile pr_err_file approve-pr
-pr_rc=0
-pr_json=$(bash "$script_dir/plot-host.sh" pr-state "$pr_branch" 2>"$pr_err_file") || pr_rc=$?
-pr_err=$(cat "$pr_err_file" 2>/dev/null); rm -f "$pr_err_file"
-if [ "$pr_rc" = 4 ]; then
-  die "the host backend has no answer for the PR state of '$pr_branch' (plot-host.sh pr-state exited 4).
+  # THE EXIT CODE IS THE READING, not the emptiness of stdout. `pr-state` exits 0
+  # with `state: NONE` when the host answered that the branch has no PR, and
+  # non-zero when the host could not be asked: 3 for a refused or failed call
+  # (a rate limit included), 4 for a backend with no answer at all. Only the
+  # first is an absence. The other two stop here with the host's own words and
+  # name no repair to the branch, because nothing about the branch was read.
+  pr_err_file=""
+  plot_tmpfile pr_err_file approve-pr
+  pr_rc=0
+  pr_json=$(bash "$script_dir/plot-host.sh" pr-state "$pr_branch" 2>"$pr_err_file") || pr_rc=$?
+  pr_err=$(cat "$pr_err_file" 2>/dev/null); rm -f "$pr_err_file"
+  if [ "$pr_rc" = 4 ]; then
+    die "the host backend has no answer for the PR state of '$pr_branch' (plot-host.sh pr-state exited 4).
   ${pr_err:-The host adapter gave no reason.}
   This backend cannot report a PR's state, so the approval cannot read its gate. The plan was not approved and its phase is unchanged."
-elif [ "$pr_rc" != 0 ]; then
-  die "the host could not be asked for the PR of '$pr_branch' (plot-host.sh pr-state exited $pr_rc).
+  elif [ "$pr_rc" != 0 ]; then
+    die "the host could not be asked for the PR of '$pr_branch' (plot-host.sh pr-state exited $pr_rc).
   ${pr_err:-The host adapter gave no reason.}
   The plan was not approved and its phase is unchanged. Wait for the host to answer again, then re-run the approval."
-fi
-[ -n "$pr_json" ] || pr_json='{"number":0,"state":"NONE","draft":false,"url":""}'
-pr_number=$(printf '%s' "$pr_json" | jq -r '.number // 0' 2>/dev/null)
-pr_state=$(printf '%s' "$pr_json" | jq -r '.state // "NONE"' 2>/dev/null)
-pr_draft=$(printf '%s' "$pr_json" | jq -r '.draft // false' 2>/dev/null)
-
-# --- refusal 3: the PR ------------------------------------------------------
-case "$pr_state" in
-  MERGED) ;;
-  OPEN) ;;
-  CLOSED)
-    die "the plan PR for '$slug' (#$pr_number) is closed.
+  fi
+  [ -n "$pr_json" ] || pr_json='{"number":0,"state":"NONE","draft":false,"url":""}'
+  pr_number=$(printf '%s' "$pr_json" | jq -r '.number // 0' 2>/dev/null)
+  pr_state=$(printf '%s' "$pr_json" | jq -r '.state // "NONE"' 2>/dev/null)
+  pr_draft=$(printf '%s' "$pr_json" | jq -r '.draft // false' 2>/dev/null)
+
+  # --- refusal 3: the PR ------------------------------------------------------
+  case "$pr_state" in
+    MERGED) ;;
+    OPEN) ;;
+    CLOSED)
+      die "the plan PR for '$slug' (#$pr_number) is closed.
   Reopen it on the host, or push '$pr_branch' again and open a new one." ;;
-  NONE|*)
-    die "no PR found for branch '$pr_branch'.
+    NONE|*)
+      die "no PR found for branch '$pr_branch'.
   Push the branch: git push -u origin $pr_branch
   Then open its PR — or run /plot-idea, which does both." ;;
-esac
+  esac
+fi
 
-echo "step: plan $plan_file — phase=$phase review=${review} impl=${impl} pr=#$pr_number($pr_state)"
+# --- refusal 4: a branch under no slice heading -----------------------------
+#
+# BEFORE THE MERGE, which is the whole point of its position. Step 2 merges the
+# plan PR, and a refusal fired after that leaves the PR merged, the plan still
+# Draft, and a refusal the operator can clear only by editing a merged plan. So
+# it sits with refusals 1 to 3, reading the same `$meta` step 1 took, and it
+# writes nothing.
+#
+# The heading is the slice's name on the board and the title of its PR
+# (`openSlicePr` refuses `slice-unnamed`), so it is owed on the default branch
+# before any agent starts. Without this an agent meets that refusal, writes the
+# heading on its own branch, and the board reads `(unnamed)` until the PR
+# merges (#1057).
+#
+# The rule is the domain's and it is asked, never re-implemented here:
+# `decide_transition` asks the same one through the same bundle, so the two can
+# never disagree about one plan.
+transition_check_mjs="$script_dir/board/plot-transition.mjs"
+if [ -f "$transition_check_mjs" ]; then
+  slice_err_file=""
+  plot_tmpfile slice_err_file approve-slices
+  slice_rc=0
+  printf '%s' "$meta" | node "$transition_check_mjs" --check-slices "$slug" \
+    2>"$slice_err_file" >/dev/null || slice_rc=$?
+  slice_err=$(cat "$slice_err_file" 2>/dev/null); rm -f "$slice_err_file"
+  if [ "$slice_rc" = 1 ]; then
+    die "$(printf '%s' "$slice_err" | cut -f2-)
+  The plan was not approved, nothing was merged and its phase is unchanged."
+  elif [ "$slice_rc" != 0 ]; then
+    die "cannot read the slices of '$plan_file' (plot-transition.mjs --check-slices exited $slice_rc).
+  ${slice_err:-The bundle gave no reason.}
+  Refusing rather than approving a plan whose slice headings were never read."
+  fi
+else
+  echo "plot-approve: cannot find $transition_check_mjs — slice headings went unchecked. Run 'pnpm build:board'." >&2
+fi
+
+[ "$in_session" = 1 ] || echo "step: plan $plan_file — phase=$phase review=${review} impl=${impl} pr=#$pr_number($pr_state)"
 
 # --- a DRAFT is taken out of draft, not refused ------------------------------
 #
@@ -290,16 +383,35 @@ echo "step: plan $plan_file — phase=$phase review=${review} impl=${impl} pr=#$
 # mergeable on either host — and stated as its own `step:` line so a caller
 # reading the output can see which half happened if the second one fails.
 
-who="${who_override:-${PLOT_APPROVE_WHO:-$(git config user.name 2>/dev/null || echo plot)}}"
+# `in-session` TAKES NO DEFAULT. A default here would let the machine name the
+# reviewer, which is the one thing a script must never do for a channel that
+# exists because a human is in the room — so `--who` alone answers, and an
+# empty or absent one reaches the domain's `review-human` refusal below rather
+# than silently becoming `git config user.name`. `pr` and the direct/same-branch
+# flow keep the existing chain: `PLOT_APPROVE_WHO`, then the git identity.
+if [ "$in_session" = 1 ]; then
+  who="$who_flag"
+  channel="in-session"
+else
+  who="${who_flag:-${PLOT_APPROVE_WHO:-$(git config user.name 2>/dev/null || echo plot)}}"
+fi
 today=$(date +%Y-%m-%d)
 
 if [ "$dry_run" = 1 ]; then
-  [ "$pr_draft" = "true" ] && echo "step: would mark PR #$pr_number ready for review"
-  echo "step: would merge PR #$pr_number"
-  echo "step: would flip Phase → Approved and fill Approved: $today, $who, plan-PR #$pr_number merged"
-  echo "step: would clear .plot/hold entries for: $(printf '%s' "$plan_branches" | tr '\n' ' ')"
-  echo "step: would update the sprint annotation${sprint:+ in $SPRINT_DIR (sprint $sprint)}"
-  echo "summary: merged=would phase=would record=would holds=would sprint=would push=would"
+  if [ "$in_session" = 1 ]; then
+    echo "step: would flip Phase → Approved and fill Approved: $today, $who, in-session"
+    echo "step: would clear .plot/hold entries for: $(printf '%s' "$plan_branches" | tr '\n' ' ')"
+    echo "step: would update the sprint annotation${sprint:+ in $SPRINT_DIR (sprint $sprint)}"
+    echo "step: would append a row to .plot/state/in-session-approvals.tsv"
+    echo "summary: merged=skipped-in-session phase=would record=would holds=would sprint=would push=would"
+  else
+    [ "$pr_draft" = "true" ] && echo "step: would mark PR #$pr_number ready for review"
+    echo "step: would merge PR #$pr_number"
+    echo "step: would flip Phase → Approved and fill Approved: $today, $who, plan-PR #$pr_number merged"
+    echo "step: would clear .plot/hold entries for: $(printf '%s' "$plan_branches" | tr '\n' ' ')"
+    echo "step: would update the sprint annotation${sprint:+ in $SPRINT_DIR (sprint $sprint)}"
+    echo "summary: merged=would phase=would record=would holds=would sprint=would push=would"
+  fi
   exit 0
 fi
 
@@ -313,7 +425,11 @@ fi
 # Merge commits, not squash: plan refinement history is the context a later
 # reader wants. `--delete-branch` retires idea/<slug>, which has no further job.
 merged_report="already"
-if [ "$same_branch" = 1 ]; then
+if [ "$in_session" = 1 ]; then
+  # No plan PR exists for this channel: the approval is the reviewer's go,
+  # read nowhere on a host.
+  merged_report="skipped-in-session"
+elif [ "$same_branch" = 1 ]; then
   # Plan and code ride one branch; the PR merges once, at the end, and merging
   # it here would land an unfinished implementation on the default branch.
   merged_report="skipped-same-branch"
@@ -513,16 +629,30 @@ decide_transition() { # $1=file $2=channel  → prints "<Phase>\t<record>\t<writ
     || { echo "plot-approve: cannot find $transition_mjs — run 'pnpm build:board'." >&2; return 1; }
   m=$(bash "$script_dir/plot-plan-meta.sh" "$f" 2>/dev/null) || m=""
   [ -n "$m" ] || { echo "plot-approve: cannot parse $f — refusing rather than guessing." >&2; return 1; }
-  answer=$(printf 'approve\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n' \
+  # THE SLICES TRAVEL WITH THE TRANSITION, not only with the early check above.
+  # Measured 2026-10-02 by disabling that check: this call approved an unnamed
+  # plan outright — merged, flipped and recorded — because the field line
+  # carries no slices and the domain reads an absent reading as unmeasured. So
+  # the rule is asked twice, the second time from the file this re-parses, which
+  # on the `pr` flow is the plan on the default branch.
+  #
+  # Out of band rather than a field of its own, which is why `People` widening
+  # the line to twelve did not touch this: the slices are a nested list, and
+  # `requestFrom` pads nothing.
+  local slices_file=""
+  plot_tmpfile slices_file approve-transition-slices
+  printf '%s' "$m" > "$slices_file"
+  answer=$(printf 'approve\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\t%s\n' \
     "$slug" \
     "$(printf '%s' "$m" | jq -r '.phase // ""')" \
     "$(printf '%s' "$m" | jq -r '.review // ""')" \
     "$(printf '%s' "$m" | jq -r '.approved_raw // ""')" \
     "$(printf '%s' "$m" | jq -r '.delivered_raw // ""')" \
     "$(printf '%s' "$m" | jq -r '.released_raw // ""')" \
-    "$today" "$who" "$channel" \
-    | node "$transition_mjs" 2>&1)
+    "$today" "$who" "$channel" "$people_csv" \
+    | node "$transition_mjs" --slices "$slices_file" 2>&1)
   rc=$?
+  rm -f "$slices_file"
   # Exit 1 is the domain's refusal and its sentence, tab-separated after the
   # rule that fired. Exit 2 is this script handing it something unreadable,
   # which no operator can act on — so it reports as the bug it is.
@@ -690,10 +820,11 @@ apply_local_writes() { # $1=root  → sets phase_report record_report holds_repo
   # here rather than trusted from the caller's copy, because on the `pr` flow
   # those are different files and the plan on the default branch is the one that
   # counts.
-  local channel="plan-PR #$pr_number merged"
-  [ "$same_branch" = 1 ] && channel="plan-PR #$pr_number reviewed"
+  local write_channel="plan-PR #$pr_number merged"
+  [ "$same_branch" = 1 ] && write_channel="plan-PR #$pr_number reviewed"
+  [ "$in_session" = 1 ] && write_channel="$channel"
   local decided record action recorded
-  decided=$(decide_transition "$f" "$channel") || return 1
+  decided=$(decide_transition "$f" "$write_channel") || return 1
   record=$(printf '%s' "$decided" | cut -f2)
   action=$(printf '%s' "$decided" | cut -f3)
   recorded=$(printf '%s' "$decided" | cut -f4)
@@ -791,13 +922,16 @@ else
       cleanup
     else
       # BRANCH PROTECTION FALLBACK — the only path where a micro-PR is right.
-      # Never leave the merged plan stranded at `Phase: Draft`: the merge is
-      # done and irreversible, so the recorded phase must follow it.
+      # Never leave the approved plan stranded at `Phase: Draft`: the approval
+      # is decided and irreversible once committed, so the recorded phase must
+      # follow it.
+      micro_body="Records the approval of \`$slug\` (plan-PR #$pr_number merged)."
+      [ "$in_session" = 1 ] && micro_body="Records the in-session approval of \`$slug\` by $who."
       echo "step: push rejected — opening a micro-PR instead"
       if git push -q origin "$bookbr" 2>/dev/null \
         && micro_url=$(bash "$script_dir/plot-host.sh" pr-create \
              --title "plot: approve $slug" \
-             --body "Records the approval of \`$slug\` (plan-PR #$pr_number merged)." \
+             --body "$micro_body" \
              --base "$MAIN" --head "$bookbr" 2>/dev/null) \
         && micro_num=$(printf '%s' "$micro_url" | sed 's#.*/##') \
         && bash "$script_dir/plot-host.sh" pr-merge "$micro_num" --delete-branch >/dev/null 2>&1
@@ -807,8 +941,10 @@ else
         cleanup
       else
         push_report="rejected"
+        stranded_reason="PR #$pr_number IS MERGED"
+        [ "$in_session" = 1 ] && stranded_reason="the in-session approval IS DECIDED"
         echo "plot-approve: the approval is committed on '$bookbr' but could not reach $MAIN." >&2
-        echo "  PR #$pr_number IS MERGED — the plan must not stay at Phase: Draft." >&2
+        echo "  $stranded_reason — the plan must not stay at Phase: Draft." >&2
         echo "  Land '$bookbr' by hand, or re-run this command once the push works." >&2
         git worktree remove --force "$tmpwt" >/dev/null 2>&1 || true
         echo "summary: merged=$merged_report phase=$phase_report record=$record_report holds=$holds_report sprint=$sprint_report push=$push_report"
@@ -818,6 +954,21 @@ else
   fi
 fi
 
+# THE LOG REPLACES A COUNT, NEVER A RECEIPT. Appended ONLY after the push
+# landed this run — `nothing-to-commit` means an earlier run already recorded
+# this approval (and, with it, this row), so appending again would double a
+# count that exists to say how many in-session approvals happened, not how
+# many times this script ran. A refused or interrupted run reaches neither
+# this line nor a row, which is `plot-agent-settings.sh`'s rule applied here:
+# read the exit code, not the emptiness.
+if [ "$in_session" = 1 ] && [ "$push_report" != "nothing-to-commit" ] && [ "$push_report" != "n/a" ]; then
+  entry="script"
+  [ "${PLOT_APPROVE_ENTRY:-}" = "board" ] && entry="board"
+  log_dir="$main_root/.plot/state"
+  mkdir -p "$log_dir" 2>/dev/null \
+    && printf '%s\t%s\t%s\t%s\n' "$today" "$slug" "$who" "$entry" >> "$log_dir/in-session-approvals.tsv" 2>/dev/null
+fi
+
 echo "summary: merged=$merged_report phase=$phase_report record=$record_report holds=$holds_report sprint=$sprint_report push=$push_report"
 # THE RECEIPT IS SPENT HERE, on the action COMPLETING — never at the gate.
 # `plot-controller-gate.sh` clears on a receipt and LEAVES it, so an