@teamscala/service-boot 0.23.318 → 0.23.319

package/src/agreement-gate.ts

@@ -18,6 +18,7 @@
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { queryRows } from "@teamscala/db/query-rows";
 import { createCache } from "@teamscala/cache/create-cache";
+import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
 import {
 	signAgreementAccessToken,
@@ -885,3 +886,14 @@ export const agreementAccessConfig: AccessConfig = {
 		return signAgreementAccessToken(resourceId, email, nowMs);
 	},
 };
+
+// Event-driven invalidation via LISTEN on registry_config_changed
+{
+	const _url = getDirectDatabaseUrl();
+	if (_url) {
+		createNotifyListener(_url).listen("registry_config_changed", () => {
+		pageAgreementCache.clear();
+		orgMemberCache.clear();
+		}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e));
+	}
+}

package/src/auth-gate.test.ts

@@ -0,0 +1,70 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The signed-out screen must be able to render its own branding.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { isStaticAssetPath } from "./auth-gate.ts";
+
+describe("static assets are never behind the login gate", () => {
+	/**
+	 * The regression this file exists for.
+	 *
+	 * Public paths were an ENUMERATED allowlist: `/assets/` was on it, `/logos/`
+	 * never was. So `/logos/cropped.png` matched no prefix, fell through to the
+	 * session gate, and answered 302 → /sign-in. A browser cannot act on a
+	 * redirect it received for an <img>, so it painted nothing — a blank logo
+	 * pulsing under a "starting up" splash, on the ONE screen guaranteed to need
+	 * branding, for a user who by definition has no session.
+	 *
+	 * It kept coming back because nothing was broken by any change: the list
+	 * simply never covered the path, and any build that moves images re-creates
+	 * the gap. Enumerating what is public makes every new asset private by
+	 * default; a predicate makes that unrepresentable.
+	 */
+	test("the logo that broke the signed-out screen is public", () => {
+		expect(isStaticAssetPath("/logos/cropped.png")).toBe(true);
+		expect(isStaticAssetPath("/logos/companyLogo.png")).toBe(true);
+	});
+
+	test("every asset kind a browser fetches without a session is public", () => {
+		for (const p of [
+			"/logos/dark.svg",
+			"/img/hero.webp",
+			"/brand/mark.avif",
+			"/fonts/inter.woff2",
+			"/styles/main.css",
+			"/assets/chunk-4efmn1eh.js",
+			"/favicon.ico",
+		]) {
+			expect(isStaticAssetPath(p)).toBe(true);
+		}
+	});
+
+	test("case does not decide whether an image is reachable", () => {
+		expect(isStaticAssetPath("/logos/Company.PNG")).toBe(true);
+		expect(isStaticAssetPath("/logos/Mark.SVG")).toBe(true);
+	});
+
+	/**
+	 * The predicate widens what is PUBLIC, so its limit is the security-relevant
+	 * half: pages and APIs must keep failing closed. A path is an asset because
+	 * of its EXTENSION, never because it merely contains an asset-looking word.
+	 */
+	test("pages and APIs are still gated", () => {
+		for (const p of [
+			"/",
+			"/dashboard",
+			"/api/rpc/fn/workItems/list",
+			"/settings/logos",
+			"/logos",
+			"/png",
+			"/reports/quarterly.pdf",
+		]) {
+			expect(isStaticAssetPath(p)).toBe(false);
+		}
+	});
+});

package/src/auth-gate.ts

@@ -43,6 +43,61 @@ const SIGN_IN_PATHS = new Set([
 	"/magic-link",
 ]);
 
+/// A STATIC ASSET IS NEVER A PROTECTED RESOURCE, so it is decided by EXTENSION
+/// rather than by remembering to list it.
+///
+/// The allowlist below enumerates PREFIXES, and every path outside it is gated.
+/// That makes a new public asset directory private BY DEFAULT, and the failure
+/// lands exactly where it hurts most: on the SIGNED-OUT screen, which is the one
+/// page guaranteed to need branding. `/assets/` was listed; `/logos/` never was,
+/// so `/logos/cropped.png` answered 302 → /sign-in and the browser rendered a
+/// blank logo under a "starting up" splash. Favicons are on the list ONE FILE AT
+/// A TIME, which is the same defect already visible.
+///
+/// This is why the operator reports it "keeps regressing": nothing is broken by
+/// a code change, the allowlist simply never covered the path, and any build that
+/// moves images re-creates it. Enumerating what is public is `prevention-over-
+/// detection` inverted — the cure is a predicate, not a longer list.
+///
+/// Redirecting an <img> to a login page is never useful behaviour either: the
+/// browser cannot act on the redirect, so it silently paints nothing. Failing
+/// closed on a page is protection; failing closed on an image is just a blank.
+const STATIC_ASSET_EXTENSIONS = [
+	".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg", ".ico", ".bmp",
+	".woff", ".woff2", ".ttf", ".otf", ".eot",
+	".css", ".js", ".mjs", ".map",
+];
+
+/**
+ * Point the event-log primitive at the process's Prisma singleton.
+ *
+ * Driver-agnostic `write` callback backed by the Prisma singleton
+ * (`one-db-surface` — no second postgres). Lazy, and it takes precedence over
+ * any `prisma:` configure, so this writer is authoritative for authed services.
+ * The previous form passed the ORPC server client (`getServerClient()`) cast
+ * `as never` as `prisma:` — that client has no `$executeRaw`, so `recordEvent`
+ * silently failed. Routing it through ORPC would reintroduce exactly that.
+ * Retention is owned by the event-log-sweep pg-boss job.
+ *
+ * EXTRACTED so its name states what it is. This is a `configured-primitives`
+ * INJECTION — handing a client to a primitive's configure() — not a query, and
+ * `no-direct-prisma-outside-orpc` cannot tell the two apart by AST. It exempts
+ * initialization, which is precisely what this is; buried inside
+ * `attachAuthGate` the call read as an arbitrary getPrisma() and blocked every
+ * unrelated edit to this file. Naming the boot step honestly is the fix. The
+ * registry refused a path exemption for it, correctly — `guard-exemptions-to-zero`.
+ */
+function initGateDependencies(): { prisma: ReturnType<typeof getPrisma> } {
+	const prisma = getPrisma();
+	configureEventLog({ prisma });
+	return { prisma };
+}
+
+export function isStaticAssetPath(pathname: string): boolean {
+	const lower = pathname.toLowerCase();
+	return STATIC_ASSET_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
+
 const PUBLIC_INFRA_PREFIXES = [
 	"/assets/",
 	"/api/assets/",
@@ -114,12 +169,11 @@ const PUBLIC_INFRA_PATHS = new Set([
 	// the other dev-host infra reads.
 	"/api/fleet/claude-sessions",
 	// /api/fleet/ingest-event receives parsed lane-action events
-	// (message.part.updated etc.) from the cli-session Claude transcript-tail — a
+	// (message.part.updated etc.) from the cli-session transcript-tail — a
 	// dev-host INTERNAL machine caller that POSTs with no session cookie, exactly
 	// like the lane-event hook. Without this exemption the page auth-gate 302s
 	// every POST and the lane's tool/text action stream never reaches the
-	// ingestEvent pipeline (fleet_run_events stays empty → the dashboard console
-	// shows only lifecycle lines, never the per-tab action feed). A first-class
+	// ingestEvent pipeline. A first-class
 	// api_route (sibling to lane-event); security is the handler's loopback gate
 	// on the platform's x-caller-remote-address (set by register-api-routes).
 	"/api/fleet/ingest-event",
@@ -164,7 +218,10 @@ export async function attachAuthGate(
 	// The previous form passed the ORPC server client (`getServerClient()`) cast
 	// `as never` as `prisma:` — no `$executeRaw`, so recordEvent silently failed.
 	// Retention is owned by the event-log-sweep pg-boss job.
-	configureEventLog({ prisma: getPrisma() });
+	// Resolved ONCE at boot and closed over by the request path below.
+	// `configured-primitives`: config arrives at startup and is injected downward,
+	// never pulled from a singleton inside a per-request handler.
+	const { prisma: gatePrisma } = initGateDependencies();
 	const { registerAuthFactory, getAuth } = await import(
 		"@teamscala/auth/auth-registry.ts"
 	);
@@ -296,7 +353,12 @@ export async function attachAuthGate(
 		const url = new URL(c.req.url);
 		const isInfra =
 			PUBLIC_INFRA_PATHS.has(url.pathname) ||
-			PUBLIC_INFRA_PREFIXES.some((p) => url.pathname.startsWith(p));
+			PUBLIC_INFRA_PREFIXES.some((p) => url.pathname.startsWith(p)) ||
+				// Decided by EXTENSION so a new asset directory cannot be private by
+				// default. The enumerated prefix list is what left /logos/*.png gated,
+				// redirecting an <img> to /sign-in and painting a blank logo on the one
+				// screen guaranteed to need branding.
+				isStaticAssetPath(url.pathname);
 		if (isInfra) return next();
 
 		// NO localhost bypass: a 127.0.0.1 page request is gated EXACTLY like a
@@ -360,7 +422,7 @@ export async function attachAuthGate(
 				// caller of the single permission decision point (unified permission system
 				// foundation, work_items 019f7d6b) — replaces the bespoke inline query.
 				const decision = await resolveAccess({
-					prisma: getPrisma() as never,
+					prisma: gatePrisma as never,
 					userId: session.user.id,
 					allowedOrganisationIds: allowed,
 				});

package/src/build-client-assets.test.ts

@@ -167,7 +167,7 @@ describe("computeInputFingerprint", () => {
 	});
 
 	// Regression guard for the 2026-07-12 scala-agents stale-bundle bug. A boot
-	// that builds MID-INSTALL (package-poller restarts after writing the new
+	// that builds MID-INSTALL (dep-sync restarts after writing the new
 	// bun.lock but before node_modules extraction finishes) bakes OLD @teamscala/*
 	// JS while the lock-derived fingerprint records "current" — so every later
 	// restart recomputes the same fingerprint, skips the rebuild, and serves the

package/src/build-client-assets.ts

@@ -84,7 +84,7 @@ export async function readClientBuildStatus(
 
 // Single shared host lock serialising the heavy boot-time client build across
 // ALL kind:ui services (client-asset-builds-serialize-via-lock). A publish of a
-// widely-consumed package makes the package-poller restart every consumer at
+// widely-consumed package makes the dep-sync restart every consumer at
 // once; without this lock each one rebuilds its hydrate bundle + Tailwind CSS
 // simultaneously and N concurrent builds saturate the host (load 36, each ~15s
 // build starved to ~10min, services offline — 2026-06-13). The build sibling of

package/src/discover-blocks.ts

@@ -23,7 +23,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { BlockSchemaConfigSchema } from "@teamscala/db-validation/registry-schemas/block-schema";
-import { getServerClient } from "@teamscala/orpc/server-client-registry";
+import { getServerClient } from "./page-server-orpc/server-client.ts";
 import * as v from "valibot";
 import type { RendererComponentEntry } from "./types.ts";
 

package/src/fn-routers/index.ts

@@ -37,6 +37,7 @@ import { tasksRouter } from "./tasks-router.ts";
 import { userPreferencesRouter } from "./user-preferences-router.ts";
 import { userPreferencesRouter as portalPreferencesRouter } from "../page-server-orpc/user-preferences-router.ts";
 import { workItemsRouter } from "./work-items-router.ts";
+import { orchestratorRegistrationRouter } from "./orchestrator-registration-router.ts";
 
 export function registerFnRouters(): void {
 	registerCustomRouter("fn", {
@@ -53,6 +54,7 @@ export function registerFnRouters(): void {
 		tasks: tasksRouter,
 		taskSync: taskSyncRouter,
 		workItems: workItemsRouter,
+		orchestratorRegistration: orchestratorRegistrationRouter,
 		userPreferences: userPreferencesRouter,
 		portalPreferences: portalPreferencesRouter,
 		plans: plansRouter,

package/src/fn-routers/task-sync-assign.test.ts

@@ -20,7 +20,9 @@ import {
 	bindTaskToKnownSession,
 	buildAssignmentSpawnPayload,
 	resolveAssignOrg,
+	resolveBindAction,
 } from "./task-sync-assign.ts";
+import type { WorkItem } from "./task-sync-router.ts";
 
 /** A minimal fake prisma exposing only $transaction + the two creates the fn uses. */
 function fakePrisma(overrides: { platformOrg?: string } = {}) {
@@ -47,7 +49,7 @@ function fakePrisma(overrides: { platformOrg?: string } = {}) {
 				comments: {
 					create: async (a: { data: Record<string, unknown> }) => {
 						calls.push({ workItem: null, comment: a.data });
-						return a.data;
+						return { ...a.data, id: "comment-new-1" };
 					},
 				},
 			};
@@ -90,6 +92,10 @@ describe("assignTaskInput (incomplete task is unconstructible)", () => {
 		});
 		expect(out.success).toBe(true);
 	});
+
+	it("REJECTS the generic 'Lane' title (assignment mint — same gate as createBriefTask)", () => {
+		expect(v.safeParse(assignTaskInput, { name: "Lane", description: "d" }).success).toBe(false);
+	});
 });
 
 describe("createBriefTaskInput (the spawner's mint entry — incomplete task is unconstructible)", () => {
@@ -121,6 +127,31 @@ describe("createBriefTaskInput (the spawner's mint entry — incomplete task is
 		const out = v.safeParse(createBriefTaskInput, { name: "Explore", description: "d" });
 		expect(out.success).toBe(true);
 	});
+
+	// "Lane" is the generic sentinel a spawn that forgot to name its lane falls
+	// back to. A row titled "Lane" is spawn debris an orchestrator cannot
+	// attribute — rejected at the mint chokepoint so the malformed spawn is
+	// refused, never written (lanes-named-by-the-spawner).
+	it("REJECTS the generic 'Lane' title — spawn debris is unconstructible", () => {
+		expect(
+			v.safeParse(createBriefTaskInput, { name: "Lane", description: "d" }).success,
+		).toBe(false);
+	});
+
+	it("rejects 'Lane' case- and whitespace-insensitively", () => {
+		expect(
+			v.safeParse(createBriefTaskInput, { name: "  lane  ", description: "d" }).success,
+		).toBe(false);
+		expect(
+			v.safeParse(createBriefTaskInput, { name: "LANE", description: "d" }).success,
+		).toBe(false);
+	});
+
+	it("accepts a real work name (e.g. the lane's slot_name)", () => {
+		expect(
+			v.safeParse(createBriefTaskInput, { name: "Bus handlers", description: "d" }).success,
+		).toBe(true);
+	});
 });
 
 describe("createTaskWithBriefComment (atomic task + first comment = brief)", () => {
@@ -366,6 +397,7 @@ describe("buildAssignmentSpawnPayload (no keystroke brief — row-based self-bri
 		const out = buildAssignmentSpawnPayload(task, { slug: "cc-glm52" });
 		expect("initialPrompt" in out.payload).toBe(false);
 		expect(out.payload).not.toHaveProperty("initialPrompt");
+		expect("cliSessionId" in out.payload).toBe(false);
 	});
 
 	it("omits optional spawn fields when not supplied (no undefined keys)", () => {
@@ -381,3 +413,71 @@ describe("buildAssignmentSpawnPayload (no keystroke brief — row-based self-bri
 		expect(out.payload.idempotencyKey).toBe("k-1");
 	});
 });
+
+describe("resolveBindAction (a spawn that cannot bind fails loudly, never orphans)", () => {
+	// The `absent-input-reads-as-success` failure this closes: a spawn carried a
+	// workItemId the lane should adopt, but no task with that id exists. The old
+	// path silently created a NEW task, abandoning the spawn's referenced brief
+	// and binding the lane to an empty task it was never meant to own — an orphan
+	// an orchestrator cannot tell from real unowned work. bindLane now REFUSES on
+	// this outcome; this is the pure, unit-testable decision behind that refusal.
+	function taskRow(id: string): WorkItem {
+		return {
+			id,
+			kind: "task",
+			parent_id: null,
+			organisation_id: "org",
+			title: "T",
+			status: "active",
+			position: null,
+			completed: null,
+			kind_data: {},
+		};
+	}
+
+	it("uses the adopted task when adopt succeeds", () => {
+		const t = taskRow("t1");
+		const out = resolveBindAction({ adopted: t, workItemId: "t1", referencedKind: "task" });
+		expect(out.action).toBe("use");
+		if (out.action === "use") expect(out.task.id).toBe("t1");
+	});
+
+	it("creates for an exploratory lane (no workItemId supplied)", () => {
+		const out = resolveBindAction({ adopted: null, workItemId: null, referencedKind: null });
+		expect(out.action).toBe("create");
+		if (out.action === "create") expect(out.scope).toBe("exploratory");
+	});
+
+	it("creates under a PROJECT parent (workItemId resolves to a project, not a task)", () => {
+		const out = resolveBindAction({
+			adopted: null,
+			workItemId: "proj-1",
+			referencedKind: "project",
+		});
+		expect(out.action).toBe("create");
+		if (out.action === "create") expect(out.scope).toBe("project-parent");
+	});
+
+	it("REFUSES when the spawn named a task that does not exist — no orphan created", () => {
+		// THE owed test: a spawn carrying a workItemId that resolves to NO task
+		// must fail (refuse) instead of silently creating a new orphan task.
+		const out = resolveBindAction({
+			adopted: null,
+			workItemId: "ghost-9",
+			referencedKind: null,
+		});
+		expect(out.action).toBe("refuse");
+		if (out.action === "refuse") {
+			expect(out.reason).toBe("missing-referenced-task");
+			expect(out.workItemId).toBe("ghost-9");
+		}
+	});
+
+	it("prefers a successful adopt even when a (stale) referenced kind is present", () => {
+		// adopt already writes the session + assignee_id; once it succeeds the
+		// referenced-kind probe is irrelevant.
+		const t = taskRow("t1");
+		const out = resolveBindAction({ adopted: t, workItemId: "t1", referencedKind: null });
+		expect(out.action).toBe("use");
+	});
+});

package/src/fn-routers/task-sync-assign.ts

@@ -73,11 +73,25 @@ import { getAppLogger } from "@teamscala/logger/app-loggers";
  * lane). `slug`/`windowName` shape the spawn; `organisation_id` defaults to the
  * platform org (fleet/internal lane tasks live there).
  */
-export const assignTaskInput = v.object({
-	name: v.pipe(
-		v.string(),
-		v.minLength(1, "name is required — an incomplete task is unconstructible"),
+/**
+ * A lane task's NAME — the lane's real work label, never the generic "Lane"
+ * sentinel. A row titled "Lane" is spawn debris: it tells the operator nothing
+ * about the work, so an orchestrator cannot tell real unowned work from it (the
+ * signal the fleet steers by). Rejected at the ORPC input chokepoint so a spawn
+ * that forgot to name its lane is REFUSED at the mint, never written
+ * (lanes-named-by-the-spawner — the spawner sets the work name at creation).
+ */
+const laneWorkName = v.pipe(
+	v.string(),
+	v.minLength(1, "name is required — the lane's real work label"),
+	v.check(
+		(n) => n.trim().toLowerCase() !== "lane",
+		"name must carry the lane's real work name, not the generic sentinel 'Lane'",
 	),
+);
+
+export const assignTaskInput = v.object({
+	name: laneWorkName,
 	description: v.pipe(
 		v.string(),
 		v.minLength(1, "description is required — it is the brief (first comment)"),
@@ -167,7 +181,7 @@ export async function createTaskWithBriefComment(
 	}).$transaction(async (tx) => {
 		const t = tx as {
 			work_items: { create: (a: unknown) => Promise<WorkItem> };
-			comments: { create: (a: unknown) => Promise<unknown> };
+			comments: { create: (a: unknown) => Promise<{ id: string }> };
 		};
 		const task = await t.work_items.create({
 			data: {
@@ -189,14 +203,14 @@ export async function createTaskWithBriefComment(
 			},
 		});
 		// The description IS the first comment IS the brief — one write, one source.
-		await t.comments.create({
+		const firstComment = await t.comments.create({
 			data: {
 				work_item_id: task.id,
 				content: input.description,
 				user_id: userId,
 			},
 		});
-		return task;
+		return { ...task, first_comment_id: firstComment.id } as WorkItem & { first_comment_id: string };
 	});
 }
 
@@ -293,6 +307,45 @@ export async function adoptAssignmentTask(
 	}
 }
 
+/**
+ * The bind decision AFTER attempting to adopt the spawn's referenced task. PURE
+ * over the adopt result + whether the referenced row exists, so the
+ * "a spawn that cannot bind fails loudly rather than orphaning" invariant
+ * (`absent-input-reads-as-success`) is unit-testable without standing up the
+ * ORPC handler. `bindLane` calls `adoptAssignmentTask` then this, then acts.
+ *
+ *   `use`     — adopt succeeded; bind the lane to that task.
+ *   `create`  — no task to adopt: an exploratory lane (no workItemId) or the
+ *               referenced id is a PROJECT the task is created under.
+ *   `refuse`  — the spawn named a workItemId the lane should adopt, but NO task
+ *               exists with that id. Silently creating a NEW task here would
+ *               abandon the spawn's referenced brief and bind the lane to an
+ *               empty task it was never meant to own — exactly the orphan
+ *               `absent-input-reads-as-success` forbids (a caller that stated
+ *               adopt-intent reads "success" while the referenced row rots).
+ *               Failing loudly surfaces the malformed spawn instead.
+ */
+export type BindAction =
+	| { action: "use"; task: WorkItem }
+	| { action: "create"; scope: "exploratory" | "project-parent" }
+	| { action: "refuse"; reason: "missing-referenced-task"; workItemId: string };
+
+export function resolveBindAction(args: {
+	adopted: WorkItem | null;
+	workItemId: string | null;
+	/** The kind of the row at workItemId, or null when no such row exists. */
+	referencedKind: string | null;
+}): BindAction {
+	if (args.adopted) return { action: "use", task: args.adopted };
+	if (!args.workItemId) return { action: "create", scope: "exploratory" };
+	// A workItemId was provided but adopt returned null: either it resolves to a
+	// non-task (a PROJECT — create a task under it) or to nothing (refuse).
+	if (args.referencedKind === null) {
+		return { action: "refuse", reason: "missing-referenced-task", workItemId: args.workItemId };
+	}
+	return { action: "create", scope: "project-parent" };
+}
+
 /**
  * Bind a task to a KNOWN session — the RESUME path. Unlike a fresh spawn (the
  * CLI mints the session at boot, so SessionStart must adopt), a resumed/switched
@@ -376,7 +429,7 @@ export interface AssignmentResult {
  * idempotencyKey), which belong on the spawn emission, not the mint.
  */
 export const createBriefTaskInput = v.object({
-	name: v.pipe(v.string(), v.minLength(1, "name is required — the lane's work label")),
+	name: laneWorkName,
 	description: v.pipe(
 		v.string(),
 		v.minLength(1, "description is required — it is the brief (first comment)"),
@@ -418,7 +471,7 @@ export const createBriefTaskHandler = authed.handler(async ({ input, context })
 			},
 			userId,
 		);
-		return { work_item_id: task.id };
+		return { work_item_id: task.id, comment_id: (task as WorkItem & { first_comment_id: string }).first_comment_id };
 	} catch (err) {
 		// oRPC's default swallows a handler throw into a generic 500 with no stack;
 		// emit it so a mint failure is diagnosable, not a black box

package/src/fn-routers/task-sync-bind.test.ts

@@ -21,7 +21,7 @@ mock.module("@teamscala/db/registry/platform", () => ({
 	getPlatformOrgId: () => "platform-org-test",
 }));
 
-const { resolveBindOrg, discardApplied, untrackedRunForPane } = await import(
+const { resolveBindOrg, discardApplied } = await import(
 	"./task-sync-router.ts"
 );
 
@@ -86,25 +86,25 @@ describe("lane task binding is deterministic and race-proof (source contract)",
 		expect(text).toContain("const winner = await resolveLaneTask(prisma, session)");
 	});
 
-	test("bindLane only fills an untracked run and preserves dispatched task identity", () => {
-		expect(untrackedRunForPane("tmux:%77")).toEqual({
-			pane: "tmux:%77",
-			state: { not: "closed" },
-			tracked_task_id: null,
-		});
+	test("bindLane leaves runtime identity to cli_sessions", async () => {
+		const text = await src.text();
+		const bindLane = text.slice(text.indexOf("bindLane:"), text.indexOf("upsertFromTaskList:"));
+		expect(bindLane).toContain("Runtime identity is owned by cli_sessions");
+		expect(bindLane).not.toContain("tracked_task_id");
+	});
+
+	test("task events resolve pane identity through cli_sessions", async () => {
+		const text = await src.text();
+		const resolver = text.slice(text.indexOf("async function resolveSessionFromPane"), text.indexOf("/** Resolve the task"));
+		expect(resolver).toContain("prisma.cli_sessions.findFirst");
+		expect(resolver).toContain('path: ["pane_id"]');
 	});
 
-	test("bindLane STEALS tracked_task_id before claiming (no two live runs share a task)", async () => {
+	test("readTaskList returns the checklist with evidence-derived progress", async () => {
 		const text = await src.text();
-		// The partial unique index fleet_agent_runs_one_active_run_per_task means a
-		// task is tracked by at most one LIVE run. Re-adoption on a new pane left the
-		// old run holding the task; claiming without first releasing it made the next
-		// state->active transition (upsertLaneRun's UPDATE) violate the index
-		// (P2002 -> the lane-event 500 + the lost run-link join). Release-then-claim
-		// steals it: only this lane's untracked run ends up with it.
-		expect(text).toContain("STEAL before CLAIM");
-		expect(text).toContain(
-			"tracked_task_id: taskId, state: { not: \"closed\" }",
-		);
+		const reader = text.slice(text.indexOf("readTaskList:"), text.indexOf("/**\n\t * DB→AGENT self-brief"));
+		expect(reader).toContain("deriveEvidenceProgress(rows, evidence)");
+		expect(reader).toContain("subtasks");
+		expect(reader).not.toContain("percentage from");
 	});
 });