@telora/daemon 0.24.2 → 0.24.7

package/dist/worktree/capture-head-adoption.d.ts

@@ -0,0 +1,44 @@
+/** The focus branch whose head a review would judge, and the repo its ref lives in (worktrees share it). */
+export interface CaptureHeadTarget {
+    repoPath: string;
+    branchName: string | null;
+}
+/** What the adoption found at the focus head, and did. */
+export type CaptureHeadAdoption = 
+/** The head is not a daemon capture: nothing to adopt, review may judge it. */
+{
+    kind: 'not_capture';
+    headSha: string;
+}
+/** The head was a capture; `adoptedSha` (the new head) commits it as the team's own. */
+ | {
+    kind: 'adopted';
+    captureSha: string;
+    adoptedSha: string;
+    trailerValue: string;
+}
+/** The head is a capture and could not be adopted (or the branch moved meanwhile); retried next read. */
+ | {
+    kind: 'failed';
+    captureSha: string;
+    reason: string;
+}
+/** The head could not be read. */
+ | {
+    kind: 'unreadable';
+    reason: string;
+};
+/** Subject prefix of an adoption commit -- deliberately not a capture subject. */
+export declare const CAPTURE_ADOPTION_SUBJECT_PREFIX = "chore: adopt captured agent work as the team's own commit (";
+/** The adoption commit's message, as commit-tree `-m` paragraphs (the last one is the trailer block). */
+export declare function captureAdoptionMessage(capture: {
+    sha: string;
+    subject: string;
+}, trailerValue: string): string[];
+/**
+ * Adopt the focus head when it is a daemon capture (module doc). Never throws:
+ * an unreadable head, a failed commit or a branch that moved meanwhile is
+ * reported, and the next read retries against whatever the head is then.
+ */
+export declare function adoptCaptureHead(target: CaptureHeadTarget): CaptureHeadAdoption;
+//# sourceMappingURL=capture-head-adoption.d.ts.map

package/dist/worktree/capture-head-adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-head-adoption.d.ts","sourceRoot":"","sources":["../../src/worktree/capture-head-adoption.ts"],"names":[],"mappings":"AAwCA,4GAA4G;AAC5G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB;AAC7B,+EAA+E;AAC7E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC1C,wFAAwF;GACtF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACnF,yGAAyG;GACvG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxD,kCAAkC;GAChC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,kFAAkF;AAClF,eAAO,MAAM,+BAA+B,gEAAiE,CAAC;AAmB9G,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAShH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,CAsB/E"}

package/dist/worktree/capture-head-adoption.js

@@ -0,0 +1,96 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/state-cascade/review-capture-head-gate.test.ts,
+//   packages/daemon/src/focus/pending-review-capture-head.test.ts,
+//   packages/daemon/src/integration/capture-head-review-regression.test.ts,
+//   packages/daemon/src/integration/commits-after-approval-review-regression.test.ts,
+//   packages/daemon/src/integration/fully-merged-focus-sibling-red-scenario.test.ts,
+//   packages/daemon/src/worktree/capture-head-adoption.test.ts
+// PINNED-BY-END
+/**
+ * A focus review never judges a daemon WIP capture: before a review window opens
+ * or a review spawns, a focus head that is a daemon capture of uncommitted agent
+ * work is ADOPTED as the team's own commit, and the review judges that commit.
+ *
+ * Why: the completion merge gate never lets a capture anchor its own approval
+ * (merge/merge-gate-coverage.ts anchorGates), and review runs once per focus head
+ * (focus/pending-review-approved-head.ts), so a review that approved a capture
+ * head left a finished focus held off integration with no step that advances it.
+ * The fix is at the source: the head a review judges is never a capture.
+ * History: docs/daemon/history-platform.md (worktree/capture-head-adoption.ts).
+ *
+ * The adoption is the daemon committing on the team's behalf, append-only: a new
+ * commit on top of the capture with the capture's tree (it changes no file), a
+ * subject that is not a capture subject, and the capture's Telora-Delivery
+ * trailer -- its delivery's id, or `none` when the capture names no delivery (the
+ * adoption itself carries no work, and an `unattributed` stamp would be named as
+ * misattributed work). History is never rewritten: verdicts, attribution and
+ * holds are keyed on commit shas. The branch moves by a compare-and-swap ref
+ * update, so a commit that landed meanwhile is never overwritten. Plumbing
+ * (commit-tree + update-ref) runs no hooks and touches no worktree: a worktree on
+ * the branch follows it to a commit with the same tree, so its index and files
+ * stay exactly as they were.
+ *
+ * @module worktree/capture-head-adoption
+ */
+import { runGitSync } from '../git/types.js';
+import { classifyDeliveryTrailer, DELIVERY_TRAILER_KEY, NON_DELIVERY_SENTINEL } from '../git/delivery-trailer.js';
+import { isDaemonWipCapture } from './safety.js';
+/** Subject prefix of an adoption commit -- deliberately not a capture subject. */
+export const CAPTURE_ADOPTION_SUBJECT_PREFIX = 'chore: adopt captured agent work as the team\'s own commit (';
+const SHA_RE = /^[0-9a-f]{40,64}$/i;
+const FIELD_SEP = '\x1f';
+/** The head commit of `ref`, or why it could not be read. */
+function readHead(repoPath, ref) {
+    const result = runGitSync(['log', '-1', `--format=%H${FIELD_SEP}%s`, ref, '--'], repoPath);
+    if (!result.success)
+        return { reason: `git log ${ref} failed: ${result.error || result.output}` };
+    const [sha = '', ...subject] = result.output.trim().split(FIELD_SEP);
+    return SHA_RE.test(sha) ? { sha, subject: subject.join(FIELD_SEP) } : { reason: `${ref} has no readable head` };
+}
+/** The trailer an adoption carries: the capture's delivery, else the non-delivery sentinel (module doc). */
+function adoptionTrailerValue(repoPath, captureSha) {
+    const attribution = classifyDeliveryTrailer(repoPath, captureSha);
+    return attribution.kind === 'delivery' ? attribution.deliveryId : NON_DELIVERY_SENTINEL;
+}
+/** The adoption commit's message, as commit-tree `-m` paragraphs (the last one is the trailer block). */
+export function captureAdoptionMessage(capture, trailerValue) {
+    return [
+        `${CAPTURE_ADOPTION_SUBJECT_PREFIX}${capture.sha.slice(0, 12)})`,
+        `The daemon captured this focus's uncommitted agent work as ${capture.sha.slice(0, 12)} ` +
+            `("${capture.subject}"). A focus review never judges a daemon capture: the completion merge gate ` +
+            `never lets a capture anchor its own approval. This commit adopts that work as the team's own, so ` +
+            `the review judges a commit the merge gate accepts. It changes no files.`,
+        `${DELIVERY_TRAILER_KEY}: ${trailerValue}`,
+    ];
+}
+/**
+ * Adopt the focus head when it is a daemon capture (module doc). Never throws:
+ * an unreadable head, a failed commit or a branch that moved meanwhile is
+ * reported, and the next read retries against whatever the head is then.
+ */
+export function adoptCaptureHead(target) {
+    if (!target.branchName)
+        return { kind: 'unreadable', reason: 'the focus has no branch' };
+    const ref = `refs/heads/${target.branchName}`;
+    const head = readHead(target.repoPath, ref);
+    if ('reason' in head)
+        return { kind: 'unreadable', reason: head.reason };
+    if (!isDaemonWipCapture(head))
+        return { kind: 'not_capture', headSha: head.sha };
+    const trailerValue = adoptionTrailerValue(target.repoPath, head.sha);
+    const paragraphs = captureAdoptionMessage(head, trailerValue).flatMap((p) => ['-m', p]);
+    const commit = runGitSync(['commit-tree', `${head.sha}^{tree}`, '-p', head.sha, ...paragraphs], target.repoPath);
+    const adoptedSha = commit.output.trim();
+    if (!commit.success || !SHA_RE.test(adoptedSha)) {
+        return { kind: 'failed', captureSha: head.sha, reason: `git commit-tree failed: ${commit.error || commit.output}` };
+    }
+    // Compare-and-swap: moves the branch only if its head is still the capture. The
+    // reflog step reads as a commit, so git/focus-own-delta.ts counts it as the focus's own.
+    const reflog = `commit: adopt daemon capture ${head.sha.slice(0, 12)} as the team's own (telora-daemon)`;
+    const moved = runGitSync(['update-ref', '-m', reflog, ref, adoptedSha, head.sha], target.repoPath);
+    if (!moved.success) {
+        return { kind: 'failed', captureSha: head.sha, reason: `${ref} moved or could not be updated: ${moved.error || moved.output}` };
+    }
+    return { kind: 'adopted', captureSha: head.sha, adoptedSha, trailerValue };
+}
+//# sourceMappingURL=capture-head-adoption.js.map

package/dist/worktree/capture-head-adoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-head-adoption.js","sourceRoot":"","sources":["../../src/worktree/capture-head-adoption.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,4FAA4F;AAC5F,mEAAmE;AACnE,4EAA4E;AAC5E,sFAAsF;AACtF,qFAAqF;AACrF,+DAA+D;AAC/D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,8DAA8D,CAAC;AAE9G,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,QAAgB,EAAE,GAAW;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,SAAS,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAClG,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,uBAAuB,EAAE,CAAC;AAClH,CAAC;AAED,4GAA4G;AAC5G,SAAS,oBAAoB,CAAC,QAAgB,EAAE,UAAkB;IAChE,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClE,OAAO,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC1F,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,OAAyC,EAAE,YAAoB;IACpG,OAAO;QACL,GAAG,+BAA+B,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;QAChE,8DAA8D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YACzF,KAAK,OAAO,CAAC,OAAO,8EAA8E;YAClG,mGAAmG;YACnG,yEAAyE;QACzE,GAAG,oBAAoB,KAAK,YAAY,EAAE;KAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACzF,MAAM,GAAG,GAAG,cAAc,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAEjF,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACtH,CAAC;IACD,gFAAgF;IAChF,yFAAyF;IACzF,MAAM,MAAM,GAAG,gCAAgC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,oCAAoC,CAAC;IACzG,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,mCAAmC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAClI,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC"}

package/dist/worktree/safety.d.ts

@@ -29,12 +29,21 @@ export declare function branchHasUnmergedCommits(branchName: string, targetBranc
 /**
  * Subject prefixes of the two commits the daemon writes to capture an agent's
  * uncommitted work: commitWipChanges (team exit) and safetyCommitWorktree
- * (worktree removal, terminated-team reconcile). The merge gate recognizes a
- * daemon capture by these (merge/merge-gate-coverage.ts), so the writers build
- * their subjects from the same constants.
+ * (worktree removal, terminated-team reconcile). A daemon capture is recognized
+ * by these (isDaemonWipCapture), so the writers build their subjects from the
+ * same constants.
  */
 export declare const WIP_CAPTURE_SUBJECT_PREFIX = "WIP: Uncommitted work captured by daemon on agent exit (";
 export declare const SAFETY_COMMIT_SUBJECT_PREFIX = "wip: uncommitted agent work for \"";
+/**
+ * True for a commit the daemon wrote to capture an agent's uncommitted work (a
+ * commitWipChanges or safetyCommitWorktree subject). The ONE recognizer: the merge
+ * gate's capture rule (merge/merge-gate-coverage.ts) and the review's capture-head
+ * adoption (worktree/capture-head-adoption.ts) both read it. Pure.
+ */
+export declare function isDaemonWipCapture(commit: {
+    readonly subject: string;
+}): boolean;
 /** The subject commitWipChanges writes for `contextName`. */
 export declare function wipCaptureSubject(contextName: string): string;
 /**

package/dist/worktree/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AA0BA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;CAC9E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAa3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,6DAA6D,CAAC;AACrG,eAAO,MAAM,4BAA4B,uCAAsC,CAAC;AAEhF,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,sBAAsB,EACjC,WAAW,CAAC,EAAE,uBAAuB,GACpC,MAAM,GAAG,IAAI,CAaf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOnF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,sBAAsB,GAChC,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,SAAS,EAAE,sBAAsB,CAAC;IAClC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GACA,OAAO,CAoFT;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,sBAAsB,EACjC,WAAW,CAAC,EAAE,uBAAuB,GACpC,MAAM,GAAG,IAAI,CASf"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AA6BA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;CAC9E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAa3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAMT;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,6DAA6D,CAAC;AACrG,eAAO,MAAM,4BAA4B,uCAAsC,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAEhF;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,sBAAsB,EACjC,WAAW,CAAC,EAAE,uBAAuB,GACpC,MAAM,GAAG,IAAI,CAaf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOnF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,sBAAsB,GAChC,MAAM,GAAG,IAAI,CAUf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,SAAS,EAAE,sBAAsB,CAAC;IAClC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GACA,OAAO,CAoFT;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,sBAAsB,EACjC,WAAW,CAAC,EAAE,uBAAuB,GACpC,MAAM,GAAG,IAAI,CASf"}

package/dist/worktree/safety.js

@@ -1,13 +1,16 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
 // Pinned by: packages/daemon/src/completion/team-exit/teardown-merge-gate.test.ts,
 //   packages/daemon/src/completion/team-teardown/mid-flight-merge-gate.test.ts,
+//   packages/daemon/src/focus/pending-review-capture-head.test.ts,
 //   packages/daemon/src/integration/approved-head-hold-release-completion-regression.test.ts,
+//   packages/daemon/src/integration/capture-head-review-regression.test.ts,
 //   packages/daemon/src/merge/attributed-capture-merge-gate.test.ts,
 //   packages/daemon/src/merge/completion-merge-gate.test.ts,
 //   packages/daemon/src/merge/merge-gate-coverage.test.ts,
 //   packages/daemon/src/merge/safe-remove-merge-gate.test.ts,
 //   packages/daemon/src/verify/attribution/exit-capture-attribution-regression.test.ts,
 //   packages/daemon/src/worktree/capture-attribution-commit.test.ts,
+//   packages/daemon/src/worktree/capture-head-adoption.test.ts,
 //   packages/daemon/src/worktree/safety-commit-guard.test.ts,
 //   packages/daemon/src/worktree/safety-commit-under-guard.test.ts,
 //   packages/daemon/src/worktree/unmerged-capture-refusal.test.ts,
@@ -60,12 +63,21 @@ export function branchHasUnmergedCommits(branchName, targetBranch, repoPath) {
 /**
  * Subject prefixes of the two commits the daemon writes to capture an agent's
  * uncommitted work: commitWipChanges (team exit) and safetyCommitWorktree
- * (worktree removal, terminated-team reconcile). The merge gate recognizes a
- * daemon capture by these (merge/merge-gate-coverage.ts), so the writers build
- * their subjects from the same constants.
+ * (worktree removal, terminated-team reconcile). A daemon capture is recognized
+ * by these (isDaemonWipCapture), so the writers build their subjects from the
+ * same constants.
  */
 export const WIP_CAPTURE_SUBJECT_PREFIX = 'WIP: Uncommitted work captured by daemon on agent exit (';
 export const SAFETY_COMMIT_SUBJECT_PREFIX = 'wip: uncommitted agent work for "';
+/**
+ * True for a commit the daemon wrote to capture an agent's uncommitted work (a
+ * commitWipChanges or safetyCommitWorktree subject). The ONE recognizer: the merge
+ * gate's capture rule (merge/merge-gate-coverage.ts) and the review's capture-head
+ * adoption (worktree/capture-head-adoption.ts) both read it. Pure.
+ */
+export function isDaemonWipCapture(commit) {
+    return commit.subject.startsWith(WIP_CAPTURE_SUBJECT_PREFIX) || commit.subject.startsWith(SAFETY_COMMIT_SUBJECT_PREFIX);
+}
 /** The subject commitWipChanges writes for `contextName`. */
 export function wipCaptureSubject(contextName) {
     return `${WIP_CAPTURE_SUBJECT_PREFIX}${contextName})`;

package/dist/worktree/safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mFAAmF;AACnF,gFAAgF;AAChF,8FAA8F;AAC9F,qEAAqE;AACrE,6DAA6D;AAC7D,2DAA2D;AAC3D,8DAA8D;AAC9D,wFAAwF;AACxF,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,yEAAyE;AACzE,gBAAgB;AAEhB;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,wBAAwB,GAGzB,MAAM,+BAA+B,CAAC;AAcvC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAGjD;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CACP,kCAAkC,YAAY,2BAA2B;YACzE,uBAAuB,QAAQ,CAAC,YAAY,IAAI,eAAe,cAAc;YAC7E,iDAAiD,CAClD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0DAA0D,CAAC;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,GAAG,0BAA0B,GAAG,WAAW,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,YAAoB,EACpB,SAAiC,EACjC,WAAqC;IAErC,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,GAAG,4BAA4B,GAAG,YAAY,mBAAmB;QAC1E,OAAO,EAAE,YAAY;QACrB,SAAS;QACT,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,SAAiC;IAEjC,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,kEAAkE;QAC3E,OAAO,EAAE,0BAA0B;QACnC,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,OASC;IAED,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACtD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,YAAY;QACZ,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACzB,YAAY;gBACZ,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,kDAAkD;QAClD,IAAI,4BAA4B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CACN,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,EAAE;gBACzE,GAAG,OAAO,CAAC,SAAS;gBACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;oBACnB,eAAe,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;aACF,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACxB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,eAAe,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,iEAAiE;gBACjE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,gFAAgF;oBAChF,6CAA6C,CAC9C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,kDAAkD;gBAClD,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,mEAAmE;oBACnE,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,WAAmB,EACnB,SAAiC,EACjC,WAAqC;IAErC,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC;QACvC,OAAO,EAAE,WAAW;QACpB,SAAS;QACT,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC;KACnD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/worktree/safety.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mFAAmF;AACnF,gFAAgF;AAChF,mEAAmE;AACnE,8FAA8F;AAC9F,4EAA4E;AAC5E,qEAAqE;AACrE,6DAA6D;AAC7D,2DAA2D;AAC3D,8DAA8D;AAC9D,wFAAwF;AACxF,qEAAqE;AACrE,gEAAgE;AAChE,8DAA8D;AAC9D,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,yEAAyE;AACzE,gBAAgB;AAEhB;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,wBAAwB,GAGzB,MAAM,+BAA+B,CAAC;AAcvC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAGjD;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CACP,kCAAkC,YAAY,2BAA2B;YACzE,uBAAuB,QAAQ,CAAC,YAAY,IAAI,eAAe,cAAc;YAC7E,iDAAiD,CAClD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CACvB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,YAAY,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,EAC5D,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0DAA0D,CAAC;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoC;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAC1H,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,GAAG,0BAA0B,GAAG,WAAW,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,YAAoB,EACpB,SAAiC,EACjC,WAAqC;IAErC,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,GAAG,4BAA4B,GAAG,YAAY,mBAAmB;QAC1E,OAAO,EAAE,YAAY;QACrB,SAAS;QACT,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,SAAiC;IAEjC,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,kEAAkE;QAC3E,OAAO,EAAE,0BAA0B;QACnC,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,YAAoB,EACpB,OASC;IAED,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEhF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YACtD,UAAU,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,YAAY;QACZ,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACzB,YAAY;gBACZ,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,kDAAkD;QAClD,IAAI,4BAA4B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CACN,qCAAqC,YAAY,IAAI;gBACrD,4CAA4C,CAC7C,CAAC;YACF,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,IAAI,SAAS,EAAE;gBACzE,GAAG,OAAO,CAAC,SAAS;gBACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;oBACnB,eAAe,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;aACF,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACxB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,eAAe,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,iEAAiE;gBACjE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,gFAAgF;oBAChF,6CAA6C,CAC9C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,kDAAkD;gBAClD,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,mEAAmE;oBACnE,0BAA0B,CAC3B,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,IAAI,iBAAiB,IAAI,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CACP,+BAA+B,YAAY,IAAI;oBAC/C,UAAU,UAAU,8BAA8B,iBAAiB,IAAI;oBACvE,2CAA2C,CAC5C,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,OAAO,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,WAAmB,EACnB,SAAiC,EACjC,WAAqC;IAErC,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,SAAS,WAAW,GAAG,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC;QACnB,YAAY;QACZ,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC;QACvC,OAAO,EAAE,WAAW;QACpB,SAAS;QACT,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC;KACnD,CAAC,CAAC;AACL,CAAC"}

package/docs/runbook-tower.md

@@ -0,0 +1,237 @@
+# Runbook: the product tower
+
+The tower is traffic control for a product's armed foci. It changes what
+ARMED means -- from "run now" to "run when cleared" -- and it never arms or
+un-arms anything: arming stays the human go-signal. Decision record:
+`docs/DECISIONS.md` ("The tower: traffic control for armed foci lives at the
+product").
+
+With the tower in `enforce`, an operator can arm several foci of a product,
+set the product's limit to 1, and walk away: they run one at a time, in focus
+rank order.
+
+## The pieces
+
+| Piece | Where | What it is |
+|---|---|---|
+| The limit | `products.tower_concurrency_limit` | How many of the product's foci may hold a live coding or review team at once. `NULL` = no product limit: the host session cap alone bounds it. Set with `telora_product` `update` `towerConcurrencyLimit` (`null` clears it). |
+| The verdict | `product_focuses.tower_verdict` | The tower's verdict on one armed, active focus: `cleared`, or `holding` with exactly one reason and since-when. |
+| The pass | `packages/daemon/src/tower/tower-pass.ts` | One pass per configured product; the SOLE writer of verdicts. |
+| Admission | `packages/daemon/src/tower/tower-admission.ts` | What the spawn passes ask before they start a coding or review team. |
+| The graph | `focus_tower_edges` | Declared `depends_on` / `excludes` edges between two foci of the product, with provenance and evidence. Written over MCP (`telora_product_tower`); shown on the product page's Focus tab. |
+| Landed | `packages/daemon/src/tower/focus-landed.ts` | The ONE definition of "this focus's work has landed", shared with the PRD frontier. |
+| The vocabulary | `@telora/daemon-core` `tower.ts` | Modes, verdict states, reasons (in precedence order), edge kinds and provenance, and the fail-open freshness rule -- one definition for the daemon and the dashboard. |
+
+## The verdict
+
+```
+{ state: 'cleared' | 'holding',
+  reason: null | 'product_limit_reached' | 'waits_on' | 'excluded_by',
+  since: ISO,        -- when this state + reason began (kept across re-confirmations)
+  computedAt: ISO,   -- when the pass last confirmed it
+  armedAt: ISO|null, -- the arm (agent_assigned_at) it was computed under
+  mode: 'observe' | 'enforce',
+  detail: { limit?, occupied?, focusId?, focusName?, evidence? } }
+```
+
+The reasons, and what the dashboard says for each:
+
+| Reason | Dashboard | Means |
+|---|---|---|
+| `product_limit_reached` | Held by tower: product limit reached (N of L running) | The product's free slots went to foci ahead of this one. |
+| `waits_on` | Held by tower: waits on <focus> | A `depends_on` predecessor has not landed (tower graph). |
+| `excluded_by` | Held by tower: excluded by <focus> on <evidence> | An `excludes` edge joins it to a focus that is running or cleared ahead of it (tower graph). |
+
+## The graph
+
+Edges join two foci of ONE product (an edge across products, or from a focus to
+itself, is refused):
+
+- **`depends_on`** (directed): `toFocusId` waits until `fromFocusId` has
+  LANDED. A `depends_on` edge that would close a cycle is refused at the write,
+  and the refusal names the cycle (`UI -> Schema -> API -> UI`). The refusal is
+  atomic: a database trigger serializes each product's `depends_on` writes, so
+  two concurrent writes can never close a cycle between them.
+- **`excludes`** (mutual): the two foci are never cleared together -- e.g. both
+  rewrite the same files, fixtures or migration journal. Stored once per pair.
+
+Every edge carries **provenance** (`declared` -- written by a human or an agent
+over MCP; `inferred` and `observed` are reserved for the follow-on focus that
+draws edges itself), **evidence** (why the edge holds -- required), and who
+wrote it and when. Deleting an edge leaves a tombstone (`deleted_at`).
+
+```
+telora_product_tower { action: "edge_create", productId, fromFocusId, toFocusId,
+                       kind: "depends_on" | "excludes", evidence }
+telora_product_tower { action: "edge_list", productId, focusId? }
+telora_product_tower { action: "edge_delete", towerEdgeId }
+```
+
+## The landed rule
+
+A focus has LANDED -- judged by the daemon, no human close -- when:
+
+1. it has at least one delivery, and
+2. every non-cancelled delivery is `done` (at least one: a focus whose every
+   delivery was cancelled landed nothing), and
+3. its branch tip is contained in the integration branch
+   (`git rev-list --count <integration>..<branch>` reads 0; no checkout) -- or
+   the branch is gone AND the focus's merge record (`focus_merges`, written by
+   the daemon when it merges) names a merge commit integration contains. The
+   daemon removes a focus branch only after merging it; the record is the proof.
+   A branch that is gone with no such record (a hand-deleted branch, a legacy
+   focus that never recorded one) is unproven: unknown, never landed.
+
+The PRD frontier's completion signal is this same rule (`prd/controller-shared.ts`
+`computeCompletedFocusIds`): a frontier overcome clears only when its focus has
+landed. A landed check git cannot answer (integration unreadable, a ref or
+containment read that errored, an unreadable or missing merge record) is UNKNOWN: the tower leaves the dependent focus's verdict unavailable (fail
+open) rather than holding it, and the PRD frontier waits a tick.
+
+## Precedence
+
+A verdict records exactly one reason. When several apply, the first in this
+order wins (daemon-core `TOWER_HOLD_REASONS`):
+
+1. `waits_on` -- a fact about this focus's prerequisites;
+2. `excluded_by` -- a fact about this focus's collisions;
+3. `product_limit_reached` -- a fact about the queue.
+
+A focus held for a graph reason takes no slot. `excluded_by` holds the focus
+reached second, in rank order, while the other runs or is cleared, so two
+excluded foci are never cleared together.
+
+## The slot rule
+
+A focus occupies one of the product's slots **only while it has a live coding
+or review team**. An armed focus with no live team -- waiting on CI, a verify
+hold, an escalation -- occupies nothing, so one stalled focus never holds the
+product's queue.
+
+Each pass, per product:
+
+1. Every focus with a live team is cleared (the tower never stops a running team).
+2. Free slots = limit - live foci (unbounded with no limit).
+3. The other armed foci are walked in **focus rank order** (lowest
+   `priority_rank` first) -- foci the spawn passes last found wanting a team
+   ahead of foci they found idle. A focus that waits on an unlanded
+   predecessor, or is excluded by a focus already running or cleared, holds
+   for that reason; the rest each take a free slot (cleared) until none is
+   left, and the remainder hold `product_limit_reached`.
+
+"Wanting" is CURRENT demand: a focus wants a slot when it could run now if the
+tower and the host cap let it. Before the tower allocates, every ready-focus
+pass refreshes stale agent roles (as the spawn pass does) and probes each
+surfaced focus -- ready, or holding a queued directive -- through the gates its
+spawn pass applies, in the pass's order, bar the tower and the host cap
+(`packages/daemon/src/focus/spawn-demand-probe.ts`): its role, a live team, the
+review budget, an open parking escalation (the guard `spawnFocusTeam` applies),
+a demoted just-torn-down respawn, a queued review whose window cannot be read
+(the ready pass withholds it), the operator-hold park, a review at an approved
+head, a verify hold, a cooldown, no team work, and -- for a queued directive --
+an active row the pass could not read (it cannot spawn without one). So a focus held by any of
+those reserves no slot, even the first time it surfaces; a focus whose gate
+clears is ranked with the waiters on that same pass; a focus that spawned has
+had its demand met; and a focus no longer surfaced wants nothing -- when a team
+exits, its focus reserves nothing and the slot goes to the next wanting focus on
+the same pass. The gates that dispose of, park or release a queued directive (a
+stale stage, a closed review window, a superseded coding directive, the
+operator-hold park and its release, a review at an approved head) run for real
+before allocation: they are idempotent and the pending pass would make the same
+disposal on that poll. A probe that cannot answer keeps a fresh record and
+otherwise fails open (the focus wants a slot), so a read error never demotes a
+higher-ranked focus behind the waiters.
+
+The pass runs at the head of every ready-focus pass -- on daemon start, on
+every 30s poll, on the engine's 60s timer and on a completion trigger; there is
+no production path to the ready pass that skips it, and the passes never overlap
+(`runReadyFocusPassThroughTower`, pinned by `tower/tower-entrypoints.test.ts`) -- so a change to the armed set, the limit, focus rank or a
+focus's team presence is reflected within one poll. It writes only a verdict
+that changed, or one older than half the freshness bound (5 minutes), so a
+running tower's verdicts never go stale. It also clears the verdict of a focus
+that is no longer armed. A pass that throws for one product is logged and never
+stops another product's pass; admission fails open on that product's foci at
+once (see the fail-open rule).
+
+## The three modes: `TELORA_TOWER_MODE`
+
+Declared in `@telora/daemon-core` `env-config.ts`; default **`observe`**.
+
+| Mode | Tower pass | Spawn passes |
+|---|---|---|
+| `off` | Does not run. | Exactly as before the tower: API order, host cap only. |
+| `observe` | Writes verdicts; the dashboard shows them, marked "(observe only)". | Ignore verdicts. Every spawn decision `enforce` would have made differently is logged: `[tower] observe: enforce would hold "<focus>" (<reason> since <t>); decision taken: spawned`. |
+| `enforce` | Writes verdicts. | Start no coding or review team for a focus whose verdict is holding AND fresh; offer ready foci, and foci with a queued (e.g. review) directive, to the host in focus rank order. |
+
+## The fail-open rule
+
+In every mode, only a fresh, explicit holding verdict ever stops a spawn, and
+only while this daemon's tower pass for the focus's product is STANDING: its
+most recent pass for the product succeeded, within the freshness bound. When the
+product's pass fails -- or has not yet succeeded since the daemon started --
+every verdict of that product is unobeyed AT ONCE, however fresh, and the daemon
+logs `[tower] "<focus>": its product's tower pass failed -- failing open`.
+Another product's holds are untouched. A verdict that is
+
+- missing,
+- unreadable,
+- older than the bounded age (`TOWER_VERDICT_MAX_AGE_MS`, 5 minutes), or
+- computed under an earlier arm (its `armedAt` is not the focus's current `agent_assigned_at`)
+
+is NO verdict: the focus spawns exactly as it would with the tower off, the
+daemon logs `[tower] "<focus>": tower verdict unavailable (<why>) -- failing
+open`, and the dashboard names it ("Tower verdict unavailable (stale) --
+spawns as with the tower off"). A tower that stops writing therefore releases
+every hold within five minutes rather than freezing the product.
+
+The dashboard judges freshness on a clock while the page is open, so a hold
+turns into "unavailable" on screen when the spawn pass stops obeying it. Whether
+the product's tower is running at all comes from the daemon heartbeat
+(`metadata.tower` = `{ [productId]: { mode, pass } }`): with the tower running,
+an armed focus with no verdict reads "unavailable" even when no focus has one,
+and a failed pass marks every armed focus of the product "unavailable (the
+product's tower pass failed)"; with `TELORA_TOWER_MODE=off` no tower line shows.
+
+Why admission fails OPEN while the merge gates fail CLOSED: the failures are not
+symmetric. A wrongly blocked merge is visible -- a held delivery, a red gate, a
+named reason. A wrongly held spawn is silent -- a focus that simply never runs,
+which is the daemon's recurring bug class. The tower is in front of every
+spawn, so it must never be able to cause that silently.
+
+## Moving a host from observe to enforce
+
+1. Leave the host in `observe` (the default) and set the product's limit:
+   `telora_product update { productId, towerConcurrencyLimit: 1 }`.
+2. Arm the foci. On the dashboard each armed focus now carries the tower's
+   line; on the host, read the divergences:
+   `telora-daemon logs | grep '\[tower\]'`.
+3. Judge them on real foci: every `observe: enforce would hold` line should be
+   a spawn you would have wanted held, and no focus should show "tower verdict
+   unavailable" while the daemon is healthy.
+4. Set `TELORA_TOWER_MODE=enforce` in the daemon's environment and restart it
+   (drain first if teams are running). Holds now take effect on the next poll.
+5. To back out: `TELORA_TOWER_MODE=observe` (verdicts kept, not obeyed) or
+   `off` (no pass at all) and restart. Clearing the product limit
+   (`towerConcurrencyLimit: null`) releases every `product_limit_reached`
+   hold on the next poll without a restart.
+
+## Reading a stuck focus
+
+- **"Held by tower: product limit reached"** -- look at which foci are running
+  (they hold the slots) and their rank; raise the limit or re-rank if the
+  order is wrong.
+- **"Held by tower: waits on <focus>"** -- the predecessor has not landed: it
+  still has open deliveries, or its branch is not yet merged into integration.
+  If the dependency is wrong, delete the edge (`edge_delete`).
+- **"Held by tower: excluded by <focus> on <evidence>"** -- the other focus is
+  running (or was cleared ahead of this one); this one clears when it stops.
+- **"Tower verdict unavailable"** -- the focus will spawn anyway. Check the
+  daemon log for `[tower] pass failed for product ...`.
+- **"Waiting for a session slot"** -- the tower has cleared it; the HOST cap is
+  full. That is the session cap, not the tower.
+
+## Stated limit
+
+A product served by two daemon hosts would get two towers writing the same
+verdicts, each counting only its own live teams. No product is configured that
+way.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telora/daemon",
-  "version": "0.24.2",
+  "version": "0.24.7",
   "description": "Agent orchestration daemon for Telora - spawns and manages Claude Code instances",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "scripts/telora-daemon-wrapper.sh",
     "build-info.json",
     "README.md",
-    ".env.example"
+    ".env.example",
+    "docs/runbook-tower.md"
   ],
   "scripts": {
     "dev": "tsx watch src/index.ts",
@@ -33,12 +34,14 @@
     "test": "node scripts/run-tests.mjs",
     "stamp-build-info": "node scripts/stamp-build-info.mjs",
     "stamp-build-info:local": "node scripts/stamp-build-info.mjs --empty",
-    "prepublishOnly": "npm run build && npm run stamp-build-info"
+    "copy-shipped-docs": "node scripts/copy-shipped-docs.mjs",
+    "prepublishOnly": "npm run build && npm run stamp-build-info",
+    "prepack": "npm run copy-shipped-docs"
   },
   "//testRunner": "Uses Node.js built-in test runner (node:test) via tsx for TypeScript support. The root package uses Vitest; this is a deliberate choice for the daemon package to avoid framework dependencies. Test files live beside the modules they exercise (owner-directory layout); the runner discovers them recursively.",
   "dependencies": {
-    "@telora/daemon-core": "^0.3.0",
-    "@telora/mcp-products": "^0.23.2",
+    "@telora/daemon-core": "^0.3.1",
+    "@telora/mcp-products": "^0.23.4",
     "commander": "^14.0.3",
     "yaml": "^2.4.0",
     "zod": "^4.3.6"