@worca/app 1.0.0 → 1.2.0-rc.1

package/ui/server.mjs

@@ -13,26 +13,72 @@ import os from 'node:os';
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import process from 'node:process';
+import { createRequire } from 'node:module';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
 
 import { preflightNode } from '../src/core/preflight-node.mjs';
-import { createOrchestrator } from '../src/core/orchestrator.mjs';
+import { createOrchestratorFor } from '../src/core/engine-select.mjs';
 import {
   listPipelines, readPipeline, listAllPipelines, readPipelineByKey,
   enrichPipelinesPr, reconcileStaleRunning, readPipelineForResume, persistPrState,
   readRunLogText, readRunArtifactText, countPipelines, runRootSweepLookups, legacySweepLookups, slugify,
-  listArtifacts,
+  listArtifacts, lookupPipelineRow, findPipelineRowById, resolveIndexedArtifact, resolveIndexedArtifactForRow,
+  readPromptFile,
 } from '../src/core/artifacts.mjs';
 import { DIFF_PATCH_FILE } from '../src/core/results.mjs';
+import { protectedSectionKeys } from '../src/core/diff-anchor.mjs';
+import {
+  addDiffComment, listDiffComments, getDiffComment, setDiffCommentResolved,
+  deleteDiffComment, unresolvedCounts, onDiffCommentsChanged, stampSentRunId,
+  peekPendingCardComments, clearPendingCardComments, DiffCommentError, DC_ID_RE,
+} from '../src/core/diff-comments.mjs';
 import { listProjects, addProject, removeProject, normalizeProjectPath, countProjects, worcaHome } from '../src/core/projects.mjs';
 import {
   getWorcaRoot, setWorcaRoot, setProjectsRoot, defaultRoot,
   rawProjectsRoot, defaultProjectsRoot, runRootMode,
   pipelineCostLimitUsd, totalCostLimitUsd, costLimitResetPeriod,
   setPipelineCostLimitUsd, setTotalCostLimitUsd, setCostLimitResetPeriod, assertCostLimitInputs,
+  askMaxTurns, askMaxBudgetUsd, setAskMaxTurns, setAskMaxBudgetUsd, assertAskLimitInputs,
   chatPrefs, setChatPrefs,
+  debugSpawnEnabled as storedDebugSpawnEnabled, effectiveDebugSpawn, setDebugSpawnEnabled, assertDebugSpawnInput, SETTINGS_POST_KEYS,
 } from '../src/core/settings.mjs';
+import {
+  ASK_ID_RE, createThread as askCreateThread, getThread as askGetThread,
+  listThreads as askListThreads, updateThread as askUpdateThread,
+  deleteThread as askDeleteThread, sweepEmptyThreads, sweepStreamingMessages,
+  countThreads as askCountThreads, listThreadIds as askListThreadIds,
+  countWorktrees as askCountWorktrees, countAttachments as askCountAttachments,
+  appendMessage as askAppendMessage, getMessage as askGetMessage,
+  listMessages as askListMessages, setMessageBlocks as askSetMessageBlocks,
+  findCard as askFindCard, updateCardBlock as askUpdateCardBlock,
+  addAttachment as askAddAttachment, listAttachments as askListAttachments,
+  getAttachment as askGetAttachment, attachmentPath as askAttachmentPath, threadAttachmentBytes as askThreadAttachmentBytes,
+  linkRun as askLinkRun, updateRunLink as askUpdateRunLink, listRunLinks as askListRunLinks,
+  findRunLinksByPipeline as askFindRunLinksByPipeline,
+  finishMessage as askFinishMessage,
+} from '../src/core/ask/store.mjs';
+import { sanitizeTitle as askSanitizeTitle } from '../src/core/title.mjs';
+import { ASK_LIMITS } from '../src/core/ask/limits.mjs';
+import { askCatalog, validateModelEffort } from '../src/core/ask/models.mjs';
+import { buildCatalog as askBuildCatalog } from '../src/core/ask/catalog.mjs';
+import {
+  buildSystemPrompt as askBuildSystemPrompt, buildContextHeader as askBuildContextHeader,
+  buildTurnPrompt as askBuildTurnPrompt, buildRestoredPrompt as askBuildRestoredPrompt,
+  selectInlineAttachments as askSelectInlineAttachments, validateClientContext,
+} from '../src/core/ask/prompt.mjs';
+import {
+  classifyExtension as askClassifyExtension, sniffMime as askSniffMime,
+} from '../src/core/ask/attachment-kind.mjs';
+import {
+  listAskWorktrees as askListWorktrees,
+  removeAskWorktree as askRemoveWorktree,
+  removeThreadWorktrees as askRemoveThreadWorktrees,
+  sweepAskWorktrees,
+} from '../src/core/ask/worktrees.mjs';
+import { createAskTurn } from '../src/core/ask/turn.mjs';
+import { attachRunFollower } from '../src/core/ask/follow.mjs';
+import { mockEnabled, MOCK_WRITER_ROLES } from '../src/core/claude-runner.mjs';
 import { budgetStatus, readCostCapOverride, setCostCapOverride } from '../src/core/cost-budget.mjs';
 import { getStats } from '../src/core/stats.mjs';
 import { pickFolderNative } from '../src/core/folder-dialog.mjs';
@@ -40,22 +86,25 @@ import { listFolders } from '../src/core/fs-browse.mjs';
 import {
   readConfig, setStep, addCustomModel, removeCustomModel, listModels,
   PREDEFINED_MODELS, agentSteps, EFFORTS,
-  readRunConfig, setNodeModel, setFeedbackCycles, setActiveWorkflow, resetWorkflowConfig,
+  readRunConfig, setNodeModel, setFeedbackCycles, setWireCycles, setActiveWorkflow, resetWorkflowConfig,
   globalModelRefs, removeGlobalModelAndRefs, promoteCustomModel, costUnreliableModelIds,
 } from '../src/core/config.mjs';
 import { listGlobalModels, addGlobalModel, updateGlobalModel } from '../src/core/settings.mjs';
-import { modelEnvRef } from '../src/core/model-env.mjs';
+import { modelEnvRef, maskModelEnvValue, SUBAGENT_MODEL_VALUES, subagentModelIssue } from '../src/core/model-env.mjs';
 import { listPluginModels, modelSecretsSchema, pluginModelSecretStatus } from '../src/core/plugin-models.mjs';
+import { testModel } from '../src/core/model-test.mjs';
 import { validateGuardrails } from '../src/core/guardrails.mjs';
 import {
   listBuiltinGuardrailSets, listGuardrailSets, readGuardrailSet,
   writeGuardrailSet, deleteGuardrailSet, isBuiltinGuardrailSetId,
 } from '../src/core/guardrail-store.mjs';
 import {
-  DEFAULT_WORKFLOW, listWorkflows, readWorkflow, writeWorkflow, deleteWorkflow,
-  setWorkflowNodeDefaults, workflowNodeDefaults,
+  GRAPH_DEFAULT_WORKFLOW, listWorkflows, deleteWorkflow, isSafeWorkflowId,
+  setWorkflowNodeDefaults, workflowNodeDefaults, assertRunnableWorkflow, writeGraphWorkflow,
 } from '../src/core/workflows.mjs';
-import { validateWorkflow } from '../src/core/workflow-validator.mjs';
+import { registryPortsFn } from '../src/core/graph/registry-ports.mjs';
+import { sweepV1Runs, V1_RUN_RETIRED } from '../src/core/db.mjs';
+import { validateGraph, AGENT_TUNABLES } from '../src/shared/graph/validate.mjs';
 import { loadAgentRegistry } from '../src/core/agent-registry.mjs';
 import {
   listLocalBranches, currentBranch, isValidSourceRef, sweepRunRoots, sweepLegacyWorktreesAll,
@@ -72,7 +121,6 @@ import { projectKey } from '../src/core/store.mjs';
 import { createWorkspaceScan } from '../src/core/workspace-scan.mjs';
 import { createAgentGen } from '../src/core/agent-gen.mjs';
 import { listAgents, readAgent, createAgent, updateAgent, deleteAgent, AGENT_KEY_RE } from '../src/core/agent-store.mjs';
-import { CHANNEL_IDS } from '../src/core/channels.mjs';
 import {
   listInstalledPlugins, installPlugin, updatePlugin, uninstallPlugin,
   setPluginEnabled, doctorPlugin,
@@ -83,7 +131,14 @@ import {
   addMarketplace, listMarketplaces, syncMarketplace, refreshAllMarketplaces,
   removeMarketplace, readMarketplaces, seedBuiltinMarketplace,
 } from '../src/core/marketplaces.mjs';
-import { redactedConfig, writePluginConfig, readPluginConfig } from '../src/core/plugin-config.mjs';
+import {
+  redactedConfig, writePluginConfig, readPluginConfig, listProfiles, listProfileIds,
+  createProfile, deleteProfile, isValidProfileId, DEFAULT_PROFILE,
+} from '../src/core/plugin-config.mjs';
+import {
+  setBinding, clearBinding, listBindingsForScope,
+  clearBindingsForProfile, resolveProfile,
+} from '../src/core/source-bindings.mjs';
 import { createChannelHost } from '../src/core/chat/channel-host.mjs';
 import { createCommandRouter } from '../src/core/chat/command-router.mjs';
 import { createChatContext } from '../src/core/chat/chat-context.mjs';
@@ -94,6 +149,7 @@ import { readPluginsLock, pluginCurrentDir } from '../src/core/plugins-lock.mjs'
 import { normalizeManifest, PLUGIN_NAME_RE as MANIFEST_PLUGIN_NAME_RE } from '../src/core/plugin-manifest.mjs';
 import { listTaskSources, retryWriteback } from '../src/core/sources.mjs';
 import { callSource, PluginOpError } from '../src/core/plugin-shim.mjs';
+import { HLJS_GRAMMAR_IDS } from './public/hljs-loader.mjs';
 
 // ── node:sqlite runtime guard + warning filter ──────────────────────────────────
 // Drop ONLY the one-time ExperimentalWarning emitted by node:sqlite (the module is
@@ -117,6 +173,45 @@ const PROJECT_ROOT = path.resolve(__dirname, '..');
 const PUBLIC_DIR = path.join(__dirname, 'public');
 const AGENTS_DIR = path.join(PROJECT_ROOT, 'agents');
 const SKILLS_DIR = path.join(PROJECT_ROOT, 'skills');
+const require = createRequire(import.meta.url);
+const HLJS_LANGUAGE_FILE_RE = /^[a-z0-9][a-z0-9-]{0,63}\.min\.js$/;
+// Primaries plus the sub-language grammars their instances register
+// (hljs-loader.mjs); a shipped but unmapped grammar stays a plain 404.
+const HLJS_LANGUAGE_FILES = new Set(
+  HLJS_GRAMMAR_IDS.map((id) => `${id}.min.js`),
+);
+
+function resolveHljsAssets(resolve = require.resolve, warn = (msg) => console.warn(msg)) {
+  try {
+    const core = resolve('@highlightjs/cdn-assets/es/core.min.js');
+    return { core, languages: path.join(path.dirname(core), 'languages') };
+  } catch (err) {
+    warn(`[worca-ui] syntax-highlighter assets unavailable: ${err?.message || err}`);
+    return null;
+  }
+}
+
+const HLJS_ASSETS = resolveHljsAssets();
+
+// Ask Worca §10.7: the chat's markdown pipeline is served from node_modules the
+// same way the hljs assets are, but resolved with import.meta.resolve — the CJS
+// require.resolve lands on marked's CJS build, and dompurify/package.json is not
+// exported. Each package degrades independently: a missing one just leaves its
+// route unregistered and the existing /vendor no-store 404 answers.
+function resolveEsmAsset(spec, resolve = (s) => import.meta.resolve(s), warn = (msg) => console.warn(msg)) {
+  try {
+    return fileURLToPath(resolve(spec));
+  } catch (err) {
+    warn(`[worca-ui] ask markdown asset unavailable (${spec}): ${err?.message || err}`);
+    return null;
+  }
+}
+
+const ASK_VENDOR_ASSETS = {
+  marked: resolveEsmAsset('marked'),
+  dompurify: resolveEsmAsset('dompurify'),
+};
+
 const PORT = Number(process.env.PORT) || 4317;
 // Bind to loopback by default (S1). Power users who knowingly want LAN exposure
 // can set WORCA_HOST=0.0.0.0, but the localhost-only Host/Origin guard still
@@ -161,7 +256,9 @@ function liveRunIds() {
 // `stepgraphify` (§7.3) was emitted by the orchestrator and handled by the client
 // but missing here, so the graphify badge only appeared after a reload (via the
 // persisted column) and never live. It rides the same pass-through as `stepskills`.
-const EVENT_NAMES = ['phase', 'log', 'question', 'artifact', 'state', 'done', 'error', 'subagent', 'stepskills', 'stepgraphify', 'title'];
+// `exec` and `token` are the graph engine's (§5.7). `phase` stays for the v1
+// engine AND for the v2 shim until the graph cut-over retires it.
+const EVENT_NAMES = ['exec', 'token', 'log', 'question', 'artifact', 'state', 'done', 'error', 'subagent', 'stepskills', 'stepgraphify', 'title'];
 // The scan-* WS family (Workspaces M5, §5.4). A NEW family in the SAME runs Map;
 // the 7-event run plumbing above is untouched. createWorkspaceScan emits many
 // scan-progress then exactly one terminal scan-done OR scan-error.
@@ -182,6 +279,20 @@ const wss = new WebSocketServer({ server, path: '/ws' });
 /** All currently connected sockets. */
 const sockets = new Set();
 
+// server.close() only calls back once every connection is gone, and Node's
+// closeAllConnections() skips UPGRADED sockets — a WebSocket whose close
+// handshake has not completed (a client that vanished, or a test tearing down
+// right after ws.close()) keeps the callback from ever firing; under load that
+// is a hang. Terminate the lingering clients first so close() is deterministic
+// on every OS; the per-socket 'close' handlers below drop them from `sockets`.
+{
+  const httpClose = server.close.bind(server);
+  server.close = (cb) => {
+    for (const ws of sockets) { try { ws.terminate(); } catch { /* already gone */ } }
+    return httpClose(cb);
+  };
+}
+
 wss.on('connection', (ws, req) => {
   // S1: WS upgrades bypass the express middleware chain, so re-apply the
   // loopback guard here (same DNS-rebinding protection as the HTTP routes).
@@ -197,24 +308,31 @@ wss.on('connection', (ws, req) => {
   let requestedRunId = null;
   let requestedScanId = null;
   let requestedGenId = null;
+  let requestedThreadId = null;
   try {
     const u = new URL(req.url, 'http://localhost');
     requestedRunId = u.searchParams.get('runId');
     requestedScanId = u.searchParams.get('scanId');
     requestedGenId = u.searchParams.get('genId');
+    requestedThreadId = u.searchParams.get('threadId');
   } catch {
     requestedRunId = null;
     requestedScanId = null;
     requestedGenId = null;
+    requestedThreadId = null;
   }
   const id = requestedRunId || requestedScanId || requestedGenId;
 
-  send(ws, { type: 'hello', runs: summarizeRuns() });
+  send(ws, { type: 'hello', runs: summarizeRuns(), ask: askHello() });
 
   if (id && runs.has(id)) {
     replayEntry(ws, runs.get(id));
   }
 
+  if (requestedThreadId && askJobs.has(requestedThreadId)) {
+    replayAskJob(ws, askJobs.get(requestedThreadId));
+  }
+
   ws.on('close', () => sockets.delete(ws));
   ws.on('error', () => sockets.delete(ws));
   ws.on('message', (data) => {
@@ -231,6 +349,10 @@ wss.on('connection', (ws, req) => {
     if (subId && runs.has(subId)) {
       replayEntry(ws, runs.get(subId));
     }
+    const askThreadId = msg && msg.type === 'subscribe' && typeof msg.threadId === 'string' ? msg.threadId : null;
+    if (askThreadId && askJobs.has(askThreadId)) {
+      replayAskJob(ws, askJobs.get(askThreadId));
+    }
   });
 });
 
@@ -302,6 +424,32 @@ function emitChanged(type, action) {
   broadcast({ type, action: action || null });
 }
 
+// Every comment mutation in THIS process (the REST routes below) pokes the open
+// Diff tabs. A poke carries ids only — no payload, so it is idempotent and has no
+// ordering concerns; the client refetches and repaints its CARDS, never the diff.
+// MCP-side mutations happen in the stdio CHILD process and cannot reach this
+// listener; they arrive through the turn's comment hook instead.
+onDiffCommentsChanged(({ storeKey, pipelineId }) => {
+  broadcast({ type: 'diff-comments-changed', storeKey, pipelineId });
+});
+
+/** Resolve an 8-hex pipeline id to its History store key and poke the open Diff
+ *  tabs. Used for MCP-side writes, which happen in the stdio CHILD process and
+ *  cannot reach the listener above. The frame is byte-identical to the REST one,
+ *  so the client has ONE code path. findPipelineRowById is key-agnostic and
+ *  includes archived rows. Exported through `_testing` — the wiring at the ask
+ *  turn is a one-liner precisely so this function is the whole testable surface. */
+function emitDiffCommentsChanged(runId) {
+  try {
+    const row = findPipelineRowById(runId);
+    if (!row) return false;
+    const storeKey = (row.target === 'workspace' || row.workspace_key)
+      ? `workspaces/${row.workspace_key}` : row.project_key;
+    broadcast({ type: 'diff-comments-changed', storeKey, pipelineId: row.id });
+    return true;
+  } catch { return false; }   // a poke is best effort
+}
+
 // Append a tagged event to an entry's ring buffer (runId LAST so the runs-Map key
 // always wins over any id the orchestrator stamped). Shared by the live wire
 // (record) and out-of-band resolutions (resolvePending) so both honor MAX_BUFFER.
@@ -342,6 +490,9 @@ function summarizeRuns() {
     // 'cost_pipeline'/'cost_total') instead of showing a plain "Paused" card
     // until the next event.
     pauseReason: r.pauseReason || null,
+    // The clipped failure message behind reason 'error', or null — so a
+    // reload/reconnect restores the "Paused · error" detail, not a bare card.
+    pauseDetail: r.pauseDetail || null,
     startedAt: r.startedAt,
     pendingQuestion: r.pendingQuestion || null,
     // kind discriminator so the client routes runs vs scans vs agent generations
@@ -422,16 +573,23 @@ function wireRun(entry) {
         // Remember the pause reason for summarizeRuns (hello). Reset on every
         // done so a later reasonless finish cannot leave a stale cost banner.
         entry.pauseReason = (payload && payload.reason) || null;
+        // ...and WHAT went wrong for an error-pause, reset alongside it.
+        entry.pauseDetail = (payload && payload.detail) || null;
         resolvePending(entry, { reason: entry.status });
         if (payload?.reason === 'cost_pipeline' || payload?.reason === 'cost_total') {
           emitChanged('budget-changed');
         }
       }
       if (name === 'error') {
-        entry.status = 'error';
-        resolvePending(entry, { reason: 'error' });
+        // The launch-error channel (a failure BEFORE the pipeline row exists). A
+        // converted in-run failure pauses and emits no 'error'; never let a stray
+        // one demote a parked run.
+        if (entry.status !== 'paused' && entry.status !== 'pausing') {
+          entry.status = 'error';
+          resolvePending(entry, { reason: 'error' });
+        }
       }
-      if (name === 'phase') {
+      if (name === 'exec') {
         entry.status = 'running';
       }
       if (name === 'state' && payload && typeof payload === 'object') {
@@ -576,7 +734,6 @@ app.post('/api/ingress/teams/:plugin/:channelId/:token',
 // ---------------------------------------------------------------------------
 // Express middleware + static
 // ---------------------------------------------------------------------------
-app.use(express.json({ limit: '8mb' }));
 
 // S1: worca-cc's UI/API has no auth and runs agents with permissionMode
 // 'acceptEdits' — it is a single-user *localhost* tool. The server binds to
@@ -584,13 +741,98 @@ app.use(express.json({ limit: '8mb' }));
 // suspenders: reject any request whose Host (or browser Origin) is not a
 // loopback name, so a malicious page resolving a name to 127.0.0.1 still can't
 // drive the API. Override WORCA_HOST only if you understand the exposure.
+//
+// FIRST, ahead of the body parser (MIN-108): a refused request must be refused
+// before a single byte of its body is parsed or buffered, and a malformed body
+// from a non-loopback Host used to answer 400 (with a stack) where a valid one
+// answered 403. The ingress webhook above is deliberately mounted EARLIER and
+// stays exempt — it carries its own token check and 256 KB cap.
 app.use((req, res, next) => {
   if (!isLocalRequest(req)) {
-    return res.status(403).json({ error: 'forbidden: worca-cc is a localhost-only tool' });
+    return res.status(403).json({ error: 'forbidden: worca is a localhost-only tool' });
   }
   next();
 });
 
+// Ask attachments ride base64 inside the message JSON (§7.3), and a binary
+// attachment (#398) may legitimately be 5 MB — several of them blow the app-wide
+// 8mb cap below. Registered BEFORE the global parser on the ONE route that
+// carries uploads (a body parsed here is skipped there): every other ask route
+// reads a string field or nothing and keeps the 8mb window. 64mb covers
+// maxFiles × maxBytesPerBinaryFile at base64's 4/3 inflation, so every
+// over-budget upload still reaches the route's OWN clear 400/413, not a raw
+// parser error.
+app.post('/api/ask/threads/:id/messages', express.json({ limit: '64mb' }));
+app.use(express.json({ limit: '8mb' }));
+
+if (HLJS_ASSETS) {
+  const sendHljsModule = (file) => (_req, res, next) => {
+    res.type('text/javascript');
+    res.set('X-Content-Type-Options', 'nosniff');
+    res.sendFile(file, (err) => {
+      if (!err) return;
+      if (res.headersSent) return next(err);
+      next();
+    });
+  };
+  app.get('/vendor/hljs/core.min.js', sendHljsModule(HLJS_ASSETS.core));
+  app.get('/vendor/hljs/languages/:file', (req, res, next) => {
+    const file = String(req.params.file || '');
+    if (!HLJS_LANGUAGE_FILE_RE.test(file) || !HLJS_LANGUAGE_FILES.has(file)) return next();
+    const candidate = path.join(HLJS_ASSETS.languages, file);
+    try {
+      if (!fs.statSync(candidate).isFile()) return next();
+    } catch {
+      return next();
+    }
+    return sendHljsModule(candidate)(req, res, next);
+  });
+}
+
+// Ask Worca §10.7 vendor routes. sendHljsModule's shape, reused verbatim: the
+// sendFile error path falls through to the /vendor no-store handlers below.
+const sendEsmModule = (file) => (_req, res, next) => {
+  res.type('text/javascript');
+  res.set('X-Content-Type-Options', 'nosniff');
+  res.sendFile(file, (err) => {
+    if (!err) return;
+    if (res.headersSent) return next(err);
+    next();
+  });
+};
+if (ASK_VENDOR_ASSETS.marked) {
+  app.get('/vendor/marked/marked.esm.js', sendEsmModule(ASK_VENDOR_ASSETS.marked));
+}
+if (ASK_VENDOR_ASSETS.dompurify) {
+  app.get('/vendor/dompurify/purify.es.mjs', sendEsmModule(ASK_VENDOR_ASSETS.dompurify));
+}
+
+app.use('/vendor', (err, _req, res, next) => {
+  if (res.headersSent) return next(err);
+  res.set('Cache-Control', 'no-store');
+  const status = err?.status === 400 ? 400 : 404;
+  res.status(status).type('text/plain').send(status === 400 ? 'Bad request' : 'Not found');
+});
+app.use('/vendor', (_req, res) => {
+  res.set('Cache-Control', 'no-store');
+  res.status(404).type('text/plain').send('Not found');
+});
+
+// src/shared/** is the ONE source of the graph model for server + browser
+// (no build step). ui modules import it by relative path that walks above
+// ui/public; the browser clamps that URL at '/', so it must be served here at
+// exactly the repo-relative path. The 404 tail keeps a typo'd path from
+// falling through to the SPA index.html (which Chrome reports as a MIME error).
+const SHARED_DIR = path.join(PROJECT_ROOT, 'src', 'shared');
+app.use('/src/shared', express.static(SHARED_DIR, {
+  index: false,
+  setHeaders: (res) => res.set('X-Content-Type-Options', 'nosniff'),
+}));
+app.use('/src/shared', (_req, res) => {
+  res.set('Cache-Control', 'no-store');
+  res.status(404).type('text/plain').send('Not found');
+});
+
 app.use(express.static(PUBLIC_DIR, { extensions: ['html'] }));
 
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
@@ -694,6 +936,9 @@ function normalizeRunSource(raw) {
         return { ok: false, error: `source.${k} is required for type "plugin"` };
       }
     }
+    if (raw.profile !== undefined && !isValidProfileId(raw.profile)) {
+      return { ok: false, error: 'source.profile is not a valid profile id' };
+    }
     return {
       ok: true,
       source: {
@@ -702,12 +947,34 @@ function normalizeRunSource(raw) {
         sourceId: raw.sourceId.trim(),
         taskId: raw.taskId.trim(),
         inputs: raw.inputs && typeof raw.inputs === 'object' && !Array.isArray(raw.inputs) ? raw.inputs : undefined,
+        // Which configuration of the source the task came from. Absent is legal
+        // (single-profile sources); an id that is not path-safe is not.
+        profile: typeof raw.profile === 'string' && raw.profile ? raw.profile : undefined,
       },
     };
   }
   return { ok: false, error: `unknown source.type "${type}"` };
 }
 
+/**
+ * A markdown source that NAMES a promptFile must name one we can read. Resolution
+ * happens inside the orchestrator, which this route launches fire-and-forget AFTER
+ * it has already answered — so without this submit-time check a bad path surfaces
+ * as an anonymous mid-run error event on a pipeline the client was told started.
+ * Resolved against the same base the orchestrator uses (the project, or a
+ * workspace's primary member).
+ * @returns {Promise<string|null>} the error message, or null when there is nothing wrong
+ */
+async function promptFileProblem(source, projectDir) {
+  if (!source || source.type !== 'markdown' || !source.promptFile) return null;
+  try {
+    await readPromptFile(projectDir, source.promptFile);
+    return null;
+  } catch (err) {
+    return err && err.message ? err.message : String(err);
+  }
+}
+
 // Fallback run title when the client sends none. The legacy path is unchanged
 // (first 80 chars of the prompt — effectivePrompt is guaranteed set there); a
 // plugin source starts as "<plugin>: <taskId>" until the orchestrator resolves
@@ -719,6 +986,67 @@ function fallbackRunTitle(effectivePrompt, source) {
   return String(text).slice(0, 80);
 }
 
+// Wire an Ask Worca follower for a card-linked run: the orchestrator's
+// state/question/error/done events become thread notices, ask_run_links patches
+// and ask-run-status frames. Used by POST /api/run at launch AND by resumeRun
+// (a resumed pipeline is a NEW orchestrator; the paused lineage's follower
+// detached on done{paused}, so the link must be re-followed — review of PR #376).
+function attachAskFollower(orch, { threadId, runId, cardId }) {
+  const follower = attachRunFollower(orch, {
+    threadId,
+    runId,
+    cardId,
+    post: ({ text, href }) => {
+      try {
+        const m = askAppendMessage(threadId, {
+          role: 'system', text, blocks: [{ kind: 'notice', text, href }],
+        });
+        broadcast({ type: 'ask-message', threadId, message: m });
+      } catch { /* thread deleted mid-run */ }
+    },
+    updateStatus: (patch) => {
+      try {
+        const linkPatch = {};
+        if (patch.pipelineId) linkPatch.pipelineId = patch.pipelineId;
+        if (patch.status) linkPatch.status = patch.status;
+        if (patch.phase !== undefined) linkPatch.phase = patch.phase;
+        const row = Object.keys(linkPatch).length
+          ? askUpdateRunLink(threadId, runId, linkPatch) : null;
+        // The 8-hex History id lands on the FIRST state event (follow.mjs guards
+        // "first truthy sight only"), which is the first moment a
+        // "sent to #<runId>" marker could point anywhere real. Never the
+        // runs-Map UUID, never at launch, and never a resolve.
+        if (linkPatch.pipelineId && row && row.commentIds.length) {
+          try { stampSentRunId(row.commentIds, linkPatch.pipelineId); } catch { /* best effort */ }
+        }
+        if (patch.cardFailed) {
+          flipCard(threadId, cardId, { state: 'failed', error: patch.cardFailed });
+        }
+        broadcast({
+          type: 'ask-run-status', threadId, runId,
+          pipelineId: (row && row.pipelineId) || patch.pipelineId || null,
+          cardId,
+          status: patch.status || (row && row.status) || null,
+          phase: patch.phase !== undefined ? patch.phase : ((row && row.phase) || null),
+        });
+      } catch { /* thread deleted mid-run */ }
+    },
+    onDetached: () => {
+      const set = askFollowers.get(threadId);
+      if (set) {
+        set.delete(follower);
+        if (!set.size) askFollowers.delete(threadId);
+      }
+    },
+  });
+  let set = askFollowers.get(threadId);
+  if (!set) {
+    set = new Set();
+    askFollowers.set(threadId, set);
+  }
+  set.add(follower);
+}
+
 // ---------------------------------------------------------------------------
 // POST /api/run  -> start a new orchestration run
 // body (single-project): { projectDir, prompt?, promptMarkdown?, title?, mock? }
@@ -739,6 +1067,28 @@ app.post('/api/run', async (req, res) => {
       return badRequest(res, 'workspaceId or projectDir is required');
     }
 
+    // Ask Worca card link (§8.1): both or neither; the thread must exist and
+    // the card must still be `proposed` BEFORE any run state is created.
+    const hasAskThread = body.askThreadId !== undefined && body.askThreadId !== null;
+    const hasAskCard = body.askCardId !== undefined && body.askCardId !== null;
+    let askLink = null;
+    if (hasAskThread || hasAskCard) {
+      if (!hasAskThread || !hasAskCard) {
+        return badRequest(res, 'askThreadId and askCardId must be provided together');
+      }
+      if (typeof body.askThreadId !== 'string' || !ASK_ID_RE.test(body.askThreadId)
+        || typeof body.askCardId !== 'string' || !ASK_ID_RE.test(body.askCardId)) {
+        return badRequest(res, 'invalid askThreadId or askCardId');
+      }
+      if (!askGetThread(body.askThreadId)) return badRequest(res, 'unknown askThreadId');
+      const found = askFindCard(body.askThreadId, body.askCardId);
+      if (!found) return badRequest(res, 'unknown askCardId');
+      if (found.block.state !== 'proposed') {
+        return res.status(409).json({ error: `card is ${found.block.state}` });
+      }
+      askLink = { threadId: body.askThreadId, cardId: body.askCardId };
+    }
+
     // ── Shared resolution (factored BEFORE the target branch, §2.6) ──────────
     // NEW (plugins §7.3): body.source is the task-source descriptor; shape-check
     // only and pass through — the orchestrator resolves it exactly once. Absent
@@ -747,6 +1097,29 @@ app.post('/api/run', async (req, res) => {
     if (sourceCheck && !sourceCheck.ok) return badRequest(res, sourceCheck.error);
     const source = sourceCheck ? sourceCheck.source : null;
 
+    // A multiProfile source without a profile would run against the (empty)
+    // default bucket and die mid-pipeline with a confusing connector error —
+    // reject it here, at submit, where the client can still fix it. The same
+    // goes for a profile that is no longer IN the roster (deleted in another
+    // tab after the client resolved it) and for a profile supplied to a source
+    // that does not use them (it would read a phantom bucket instead of the
+    // real config). A broken or uninstalled plugin is left for
+    // resolveTaskInput to report.
+    if (source && source.type === 'plugin') {
+      const m = readInstalledManifest(source.plugin);
+      const ts = m && (m.taskSources || []).find((s) => s.id === source.sourceId);
+      if (ts && ts.multiProfile) {
+        if (!source.profile) {
+          return badRequest(res, `source.profile is required — task source "${source.sourceId}" has per-profile configuration`);
+        }
+        if (!listProfileIds(source.plugin).includes(source.profile)) {
+          return badRequest(res, `plugin "${source.plugin}" has no profile "${source.profile}" — it may have been deleted; re-select one`);
+        }
+      } else if (ts && source.profile) {
+        return badRequest(res, `task source "${source.sourceId}" does not use profiles — omit source.profile`);
+      }
+    }
+
     // prompt OR promptMarkdown. promptMarkdown is treated as the prompt text.
     const prompt = typeof body.prompt === 'string' && body.prompt.trim() ? body.prompt : undefined;
     const promptMarkdown =
@@ -770,7 +1143,16 @@ app.post('/api/run', async (req, res) => {
     // so the client gets a clean 400 instead of a mid-run error event.
     const workflowId =
       typeof body.workflowId === 'string' && body.workflowId.trim() ? body.workflowId.trim() : 'wf_default';
-    if (!(await readWorkflow(workflowId))) return badRequest(res, `unknown workflowId "${workflowId}"`);
+    // ONE gate for every run entry point, ONE status: unknown (today's text) and
+    // archived (the upgrade explanation the UI shows verbatim) answer 400 through
+    // badRequest. A graph row runs on the graph engine — createOrchestratorFor
+    // routes it off the row's version.
+    let workflowRow;
+    try {
+      workflowRow = await assertRunnableWorkflow(workflowId);
+    } catch (err) {
+      return badRequest(res, err && err.message ? err.message : String(err));
+    }
 
     // Optional guardrailsId selects the named guardrail set that IS this run's
     // policy (applied uniformly to every member — guardrails are per-run only).
@@ -858,7 +1240,10 @@ app.post('/api/run', async (req, res) => {
         return badRequest(res, `unknown or invalid sourceBranch: ${badOverride}`);
       }
 
-      orch = createOrchestrator({
+      const wsFileProblem = await promptFileProblem(effectiveSource, projects[0].projectDir);
+      if (wsFileProblem) return badRequest(res, wsFileProblem);
+
+      orch = await createOrchestratorFor({
         workspace: {
           id: ws.id,
           key: ws.id, // ws.id === workspaceKey(ws); routes artifacts to its store
@@ -872,6 +1257,7 @@ app.post('/api/run', async (req, res) => {
         extras,
         agentsDir: AGENTS_DIR,
         workflowId,
+        template: workflowRow,
         guardrailsId,
         branch,
         claude: { permissionMode: 'acceptEdits', mock },
@@ -911,7 +1297,10 @@ app.post('/api/run', async (req, res) => {
         return badRequest(res, `unknown or invalid sourceBranch: ${branch.source}`);
       }
 
-      orch = createOrchestrator({
+      const fileProblem = await promptFileProblem(effectiveSource, projectDir);
+      if (fileProblem) return badRequest(res, fileProblem);
+
+      orch = await createOrchestratorFor({
         projectDir,
         prompt: effectivePrompt,
         ...(effectiveSource ? { source: effectiveSource } : {}),
@@ -919,6 +1308,7 @@ app.post('/api/run', async (req, res) => {
         extras,
         agentsDir: AGENTS_DIR,
         workflowId,
+        template: workflowRow,
         guardrailsId,
         branch,
         claude: { permissionMode: 'acceptEdits', mock },
@@ -939,6 +1329,48 @@ app.post('/api/run', async (req, res) => {
 
     runs.set(runId, entry);
     wireRun(entry);
+    if (askLink) {
+      // Card-state TOCTOU: awaits (source-ref check, budget) sit between Hunk
+      // B's `proposed` check and here — a concurrent Start may have flipped
+      // the card already. That is a LOST RACE, not a detail to log: the loser
+      // must not launch a second pipeline for the same card (review of PR #376).
+      // Withdraw the run entry (nothing has run or been announced yet) and 409.
+      const still = askFindCard(askLink.threadId, askLink.cardId);
+      if (!still || still.block.state !== 'proposed') {
+        runs.delete(runId);
+        return res.status(409).json({ error: `card is no longer proposed (${still ? still.block.state : 'gone'})` });
+      }
+      try {
+        askLinkRun(askLink.threadId, { runId, cardId: askLink.cardId, status: entry.status });
+        flipCard(askLink.threadId, askLink.cardId, { state: 'started', runId });
+        // The card's pending comment ids move onto the link row, keyed by the minted
+        // UUID exactly as pipeline_id is before it exists. Consumed one-shot: a card
+        // launches at most once. Own try/catch — comment bookkeeping must never
+        // abort the card flip or the run.
+        try {
+          // Read, WRITE, then consume — not consume-then-write. A combined take()
+          // deletes the rows it returns, so if askUpdateRunLink throws in between (its
+          // catch here only logs) the ids are gone and the sent_run_id stamp is lost
+          // with no way to recover them. peek/commit keeps the delete on the success
+          // path only; a second launch of the same card cannot happen anyway (the
+          // card must be in state 'proposed' above).
+          const pendingComments = peekPendingCardComments(askLink.cardId);
+          if (pendingComments.length) {
+            askUpdateRunLink(askLink.threadId, runId, { commentIds: pendingComments });
+            clearPendingCardComments(askLink.cardId);
+          }
+        } catch (e) { console.error('[diff-comments] pending-card handoff failed:', e && e.message ? e.message : e); }
+        const startedMsg = askAppendMessage(askLink.threadId, {
+          role: 'system',
+          text: `Run started — "${title}"`,
+          blocks: [{ kind: 'notice', text: `Run started — "${title}"`, href: `#running/${runId}` }],
+        });
+        broadcast({ type: 'ask-message', threadId: askLink.threadId, message: startedMsg });
+        attachAskFollower(orch, { threadId: askLink.threadId, runId, cardId: askLink.cardId });
+      } catch (err) {
+        console.error(`[worca-ui] ask run link failed: ${err && err.message ? err.message : err}`);
+      }
+    }
     announceRun(entry);
 
     // Fire-and-forget; all progress is surfaced through events.
@@ -1169,10 +1601,18 @@ async function resumeRun(pipelineId, { ignoreCostCap = false, mock = false } = {
   if (!saved) throw new ResumeError(404, { error: 'pipeline not found' });
   if (saved.row.status !== 'paused' && saved.row.status !== 'interrupted') throw new ResumeError(400, { error: `pipeline is "${saved.row.status}", not resumable` });
   if (!saved.resumePoint) throw new ResumeError(400, { error: 'pipeline has no resume point' });
+  if (saved.resumePoint.version !== 2) {
+    throw new ResumeError(409, { code: 'ENGINE_RETIRED', error: V1_RUN_RETIRED });
+  }
 
   if (saved.row.archived_at) {
     throw new ResumeError(409, { error: 'pipeline is archived' });
   }
+  // No graph re-validation on RESUME, on purpose: _restoreFromResumePoint never
+  // reads the workflow row — the frozen manifest supplies topology and port
+  // identity (resolvedFromManifest: snapshot wins), so a template that drifted
+  // while the run sat paused cannot strand it. A vanished agent KEY is the one
+  // resume-time hazard, and _preflightAgentKeys already refuses it (§9.4).
   const budget = budgetStatus();
   if (budget.blocked) {
     throw new ResumeError(403, { error: 'total cost limit reached', budget });
@@ -1226,7 +1666,7 @@ async function resumeRun(pipelineId, { ignoreCostCap = false, mock = false } = {
 
   const effMock = mock || isTruthy(process.env.WORCA_MOCK ?? process.env.ORCH_MOCK);
   const runId = randomUUID();
-  const orch = createOrchestrator({
+  const orch = await createOrchestratorFor({
     projectDir,
     ...(workspace ? { workspace } : {}),
     agentsDir: AGENTS_DIR,
@@ -1255,6 +1695,22 @@ async function resumeRun(pipelineId, { ignoreCostCap = false, mock = false } = {
   wireRun(entry);
   announceRun(entry);
 
+  // A card-linked run keeps reporting to its chat across the resume: the link
+  // row moves to the new runId and a fresh follower takes over (the old one
+  // detached on done{paused}). Best-effort per row — chat bookkeeping must never
+  // block a resume.
+  for (const link of askFindRunLinksByPipeline(pipelineId)) {
+    try {
+      if (!askUpdateRunLink(link.threadId, link.runId, { runId, status: 'running' })) continue;
+      const text = `Run resumed — "${saved.row.title || 'run'}"`;
+      const m = askAppendMessage(link.threadId, { role: 'system', text, blocks: [{ kind: 'notice', text, href: `#running/${runId}` }] });
+      broadcast({ type: 'ask-message', threadId: link.threadId, message: m });
+      attachAskFollower(orch, { threadId: link.threadId, runId, cardId: link.cardId });
+    } catch (err) {
+      console.error(`[worca-ui] ask follower re-attach failed: ${err && err.message ? err.message : err}`);
+    }
+  }
+
   // Evict the superseded paused/interrupted lineage for this pipeline. The old
   // entry is inert (paused), but summarizeRuns() broadcasts EVERY Map entry on
   // each hello — leaving it resurfaces the now-resumed (and possibly already
@@ -1362,6 +1818,22 @@ app.get('/api/runs/:id', async (req, res) => {
   }
 });
 
+// GET /api/runs/:id/artifact?rel= -> the same payload, resolved by the pipeline
+// id ALONE (findPipelineRowById): the Running page knows the run's pipelineId
+// but no store key until History has been visited. Placed beside /api/runs/:id
+// (`:id` matches one path segment, so the two never shadow each other).
+app.get('/api/runs/:id/artifact', async (req, res) => {
+  try {
+    const row = findPipelineRowById(req.params.id);
+    if (!row) return res.status(404).json({ error: 'pipeline not found' });
+    const hit = await resolveIndexedArtifactForRow(row, req.query.rel);
+    if (!hit) return res.status(404).json({ error: 'artifact not found' });
+    res.json(hit);
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // Shared query-scope resolver for the retained-work routes (recovery-patch GET +
 // discard POST). Returns null after writing the error response itself. The older
 // DELETE /api/runs/:id route keeps its inline copy DELIBERATELY (it shadows the
@@ -1538,10 +2010,176 @@ app.get('/api/history/:key/:id/log', async (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Internal, line-anchored diff comments. Bound to BOTH route families below: the
+// /api/history/:key/:id key regex forbids a slash, so a workspace run (store key
+// "workspaces/<id>") can only be reached through /api/workspaces/:id/runs/:runId —
+// the same split the /diff and /log routes already carry. One handler set, two
+// registrations: the two can never diverge.
+//
+// Traversal posture matches the /diff route below: the run dir comes from a DB row
+// via readRunArtifactText, and the relPath is the CONSTANT DIFF_PATCH_FILE. No
+// route here ever passes user input as a path.
+// ---------------------------------------------------------------------------
+
+// The history key regex is an inline literal on every route in this family; this
+// block keeps that convention rather than introducing a shared constant the rest
+// of the file does not use.
+const commentsHistoryKey = (res, key) => {
+  if (!/^[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$/.test(key)) {
+    res.status(404).json({ error: 'pipeline not found' });
+    return null;
+  }
+  return key;
+};
+const commentsWorkspaceKey = (res, id) => {
+  if (!WORKSPACE_KEY_RE.test(id)) { res.status(404).json({ error: 'pipeline not found' }); return null; }
+  return `workspaces/${id}`;
+};
+const commentIdParam = (res, value) => {
+  if (typeof value !== 'string' || !DC_ID_RE.test(value)) {
+    res.status(400).json({ error: 'invalid comment id' });
+    return null;
+  }
+  return value;
+};
+const commentsFail = (res, err) => res.status(500).json({ error: err && err.message ? err.message : String(err) });
+
+/** The run row for a store key + id, or null after answering 404. */
+function commentRun(res, storeKey, id) {
+  const row = lookupPipelineRow(storeKey, id);
+  if (!row) { res.status(404).json({ error: 'pipeline not found' }); return null; }
+  return row;
+}
+
+async function commentsList(res, storeKey, id) {
+  try {
+    const row = commentRun(res, storeKey, id);
+    if (!row) return;
+    // The UI needs to know whether the '+' affordance may appear at all; a run
+    // whose patch is gone (archived, or never captured) can only read and delete.
+    const patchText = await readRunArtifactText(storeKey, row.id, DIFF_PATCH_FILE);
+    res.json({
+      comments: listDiffComments(storeKey, row.id),
+      patchAvailable: !!patchText,
+      // Section keys the protected-path floor will refuse whatever the line, so the
+      // browser can drop the '+' up front instead of surfacing a 400 on submit. The
+      // preset itself never leaves the server.
+      protectedPaths: protectedSectionKeys(patchText),
+    });
+  } catch (err) { commentsFail(res, err); }
+}
+
+async function commentsCreate(req, res, storeKey, id) {
+  try {
+    const row = commentRun(res, storeKey, id);
+    if (!row) return;
+    const body = req.body || {};
+    const patchText = await readRunArtifactText(storeKey, row.id, DIFF_PATCH_FILE);
+    // `!patchText` covers BOTH null (absent/unreadable) and '' (present but empty):
+    // addDiffComment refuses the empty string too, and it must surface as 409, not
+    // as the 400 an anchor failure would get.
+    if (!patchText) {
+      // 409, not 400: the request is well-formed, the RUN is no longer commentable.
+      return res.status(409).json({ error: 'this run has no stored diff — comments cannot be created on it' });
+    }
+    const comment = addDiffComment({
+      storeKey, pipelineId: row.id, patchText,
+      project: body.project ?? null, path: body.path, side: body.side, line: body.line,
+      body: body.body, author: 'user',
+    });
+    res.status(201).json({ comment });
+  } catch (err) {
+    if (err instanceof DiffCommentError) return badRequest(res, err.message);
+    commentsFail(res, err);
+  }
+}
+
+/** A comment reached through a run URL must BELONG to that run — never id alone. */
+function commentOfRun(res, storeKey, id, cid) {
+  const row = commentRun(res, storeKey, id);
+  if (!row) return null;
+  const comment = getDiffComment(cid);
+  if (!comment || comment.storeKey !== storeKey || comment.pipelineId !== row.id) {
+    res.status(404).json({ error: 'comment not found' });
+    return null;
+  }
+  return comment;
+}
+
+function commentsPatch(req, res, storeKey, id, cid) {
+  try {
+    // Existence BEFORE shape: an unknown run must 404 on every verb, including a
+    // PATCH whose body happens to be malformed.
+    if (!commentOfRun(res, storeKey, id, cid)) return;
+    const raw = (req.body || {}).resolved;
+    if (typeof raw !== 'boolean') return badRequest(res, 'resolved must be a boolean');
+    res.json({ comment: setDiffCommentResolved(cid, raw) });
+  } catch (err) { commentsFail(res, err); }
+}
+
+function commentsDelete(res, storeKey, id, cid) {
+  try {
+    if (!commentOfRun(res, storeKey, id, cid)) return;
+    deleteDiffComment(cid);
+    res.json({ ok: true });
+  } catch (err) { commentsFail(res, err); }
+}
+
+app.get('/api/history/:key/:id/comments', async (req, res) => {
+  const key = commentsHistoryKey(res, req.params.key); if (!key) return;
+  await commentsList(res, key, req.params.id);
+});
+app.post('/api/history/:key/:id/comments', async (req, res) => {
+  const key = commentsHistoryKey(res, req.params.key); if (!key) return;
+  await commentsCreate(req, res, key, req.params.id);
+});
+app.patch('/api/history/:key/:id/comments/:cid', (req, res) => {
+  const key = commentsHistoryKey(res, req.params.key); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsPatch(req, res, key, req.params.id, cid);
+});
+app.delete('/api/history/:key/:id/comments/:cid', (req, res) => {
+  const key = commentsHistoryKey(res, req.params.key); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsDelete(res, key, req.params.id, cid);
+});
+
+app.get('/api/workspaces/:id/runs/:runId/comments', async (req, res) => {
+  const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
+  await commentsList(res, key, req.params.runId);
+});
+app.post('/api/workspaces/:id/runs/:runId/comments', async (req, res) => {
+  const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
+  await commentsCreate(req, res, key, req.params.runId);
+});
+app.patch('/api/workspaces/:id/runs/:runId/comments/:cid', (req, res) => {
+  const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsPatch(req, res, key, req.params.runId, cid);
+});
+app.delete('/api/workspaces/:id/runs/:runId/comments/:cid', (req, res) => {
+  const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsDelete(res, key, req.params.runId, cid);
+});
+
+// Unresolved counts for every run, for the History list pill. Its own endpoint
+// rather than a field on /api/history: that response has a localStorage skeleton
+// cache, so a cached paint would show a stale pill; and diff-comments-changed can
+// repaint pills from here without forcing a whole History reload.
+app.get('/api/diff-comments/counts', (_req, res) => {
+  try { res.json({ counts: unresolvedCounts() }); } catch (err) { commentsFail(res, err); }
+});
+
 // ---------------------------------------------------------------------------
 // GET /api/history/:key/:id/diff -> the run's persisted diff-patch.patch, inline
-// (text/x-diff). Exists only for runs that reached done (results are built on
-// the done path only); everything else 404s and the UI shows its empty state.
+// (text/x-diff). The route is status-agnostic and always has been: the artifact
+// exists for every run that reached a checkpoint AND changed something under it —
+// the done path AND the stopped/error paths, which build results too (orchestrator
+// run() and resume()). A run stopped before its checkpoint has none, nor does one
+// that changed nothing (_buildResults writes neither artifact for an empty patch),
+// and neither does an archived one; all of those 404 and the UI shows its empty state.
 // Key validation mirrors the /log route (:1529); the artifact read follows the
 // recovery-patch route's readRunArtifactText pattern (:1408) — the log routes
 // themselves use the specialized readRunLogText. The relPath is the CONSTANT
@@ -1561,6 +2199,23 @@ app.get('/api/history/:key/:id/diff', async (req, res) => {
   }
 });
 
+// GET /api/history/:key/:id/artifact?rel= -> { rel, text } for ONE artifact the
+// run indexed (the End card's result chip). `rel` never reaches the FS: it only
+// selects among the pipeline's own artifacts rows (exact rel_path, else a path
+// suffix). Same key regex as /diff.
+app.get('/api/history/:key/:id/artifact', async (req, res) => {
+  if (!/^[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$/.test(req.params.key)) {
+    return res.status(404).json({ error: 'pipeline not found' });
+  }
+  try {
+    const hit = await resolveIndexedArtifact(req.params.key, req.params.id, req.query.rel);
+    if (!hit) return res.status(404).json({ error: 'artifact not found' });
+    res.json(hit);
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // DELETE /api/runs/:id?projectKey=...  (or ?projectDir=...)
 // ARCHIVE a FINISHED pipeline: reclaims everything on disk — its store folder,
@@ -2062,6 +2717,8 @@ app.get('/api/workspaces/:id/runs/:runId/log', async (req, res) => {
   }
 });
 
+// NOTE: the /comments twins for workspace runs are registered with their project
+// siblings up at the diff-comments block — the pair must be read together.
 app.get('/api/workspaces/:id/runs/:runId/diff', async (req, res) => {
   if (!WORKSPACE_KEY_RE.test(req.params.id)) {
     return res.status(404).json({ error: 'pipeline not found' });
@@ -2075,6 +2732,18 @@ app.get('/api/workspaces/:id/runs/:runId/diff', async (req, res) => {
   }
 });
 
+// The End-card result chip's workspace twin (see the project route above).
+app.get('/api/workspaces/:id/runs/:runId/artifact', async (req, res) => {
+  if (!WORKSPACE_KEY_RE.test(req.params.id)) return res.status(404).json({ error: 'pipeline not found' });
+  try {
+    const hit = await resolveIndexedArtifact(`workspaces/${req.params.id}`, req.params.runId, req.query.rel);
+    if (!hit) return res.status(404).json({ error: 'artifact not found' });
+    res.json(hit);
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // GET /api/settings  -> { root, projectsRoot, projectsRootDefault, default }
 //   root                : the configured Worca CC data-root base, '' when unset
@@ -2106,6 +2775,10 @@ const settingsState = () => ({
   pipelineCostLimitUsd: pipelineCostLimitUsd(),
   totalCostLimitUsd: totalCostLimitUsd(),
   costLimitResetPeriod: costLimitResetPeriod(),
+  askMaxTurns: askMaxTurns(),
+  askMaxBudgetUsd: askMaxBudgetUsd(),
+  debugSpawnEnabled: storedDebugSpawnEnabled(),          // what is STORED (the checkbox)
+  debugSpawnEffective: effectiveDebugSpawn(),             // what the next spawn will DO, and why
 });
 
 app.get('/api/settings', (_req, res) => {
@@ -2120,6 +2793,8 @@ app.post('/api/settings', async (req, res) => {
   const body = req.body || {};
   const has = (k) => Object.prototype.hasOwnProperty.call(body, k);
   const hasBudgetKey = has('pipelineCostLimitUsd') || has('totalCostLimitUsd') || has('costLimitResetPeriod');
+  const hasAskKey = has('askMaxTurns') || has('askMaxBudgetUsd');
+  const hasDebugSpawnKey = has('debugSpawnEnabled');
   // Normalize the budget keys first, then validate them as a SET before ANY write.
   // Each setter persists on its own, so a two-key POST whose second key is invalid
   // used to answer 400 with the first key already on disk, no budget-changed
@@ -2131,8 +2806,24 @@ app.post('/api/settings', async (req, res) => {
   if (has('costLimitResetPeriod')) {
     budget.costLimitResetPeriod = typeof body.costLimitResetPeriod === 'string' ? body.costLimitResetPeriod : '';
   }
+  // Ask Worca per-turn guards (ask-worca-design.md §6.9): same set-validation
+  // discipline. `null` is a VALUE for askMaxBudgetUsd (no cap) and must survive
+  // normalisation; only undefined becomes a clear.
+  const ask = {};
+  if (has('askMaxTurns')) ask.askMaxTurns = body.askMaxTurns ?? '';
+  if (has('askMaxBudgetUsd')) ask.askMaxBudgetUsd = body.askMaxBudgetUsd === undefined ? '' : body.askMaxBudgetUsd;
   try {
     assertCostLimitInputs(budget);
+    assertAskLimitInputs(ask);
+    if (hasDebugSpawnKey) assertDebugSpawnInput(body.debugSpawnEnabled);
+    // Root first: it is the one key whose setter can still fail AFTER the asserts
+    // above (an unusable path), so every other key's write must come after it or
+    // a mixed POST would answer 400 with those keys already applied on disk.
+    // Legacy contract: a POST that names NO known key clears root; the known
+    // keys live beside their setters (SETTINGS_POST_KEYS), not in a list here.
+    if (has('root') || !SETTINGS_POST_KEYS.some(has)) {
+      await setWorcaRoot(typeof body.root === 'string' ? body.root : '');
+    }
     if (has('chat')) await setChatPrefs(body.chat);
     if (has('projectsRoot')) {
       await setProjectsRoot(typeof body.projectsRoot === 'string' ? body.projectsRoot : '');
@@ -2140,12 +2831,13 @@ app.post('/api/settings', async (req, res) => {
     if (has('pipelineCostLimitUsd')) await setPipelineCostLimitUsd(budget.pipelineCostLimitUsd);
     if (has('totalCostLimitUsd')) await setTotalCostLimitUsd(budget.totalCostLimitUsd);
     if (has('costLimitResetPeriod')) await setCostLimitResetPeriod(budget.costLimitResetPeriod);
-    // Legacy contract: a POST that names no known key clears root. Budget keys
-    // must not trip it — a budget-only save would otherwise wipe the root.
-    if (has('root') || !(has('projectsRoot') || hasBudgetKey || has('chat'))) {
-      await setWorcaRoot(typeof body.root === 'string' ? body.root : '');
-    }
+    if (has('askMaxTurns')) await setAskMaxTurns(ask.askMaxTurns);
+    if (has('askMaxBudgetUsd')) await setAskMaxBudgetUsd(ask.askMaxBudgetUsd);
+    if (hasDebugSpawnKey) await setDebugSpawnEnabled(body.debugSpawnEnabled);
     if (hasBudgetKey) emitChanged('budget-changed');
+    // Other open tabs repaint their Settings cards (a stale tab could otherwise
+    // "save" its old checkbox state over this one with no feedback to either).
+    if (hasAskKey || hasDebugSpawnKey) emitChanged('settings-changed');
     res.json({ ...settingsState(), chat: chatPrefs() });
   } catch (err) {
     // The setters throw only on an unusable path -> client error (400).
@@ -2167,6 +2859,7 @@ app.get('/api/config', async (req, res) => {
     return res.json({
       config: { steps: {}, customModels: [] },
       models: await listModels(''), steps: agentSteps(), efforts: EFFORTS,
+      subagentModels: SUBAGENT_MODEL_VALUES,
     });
   }
   const projectDir = resolveProjectDir(raw);
@@ -2185,6 +2878,10 @@ app.get('/api/config', async (req, res) => {
     ]);
     res.json({
       config, models, steps: agentSteps(), efforts: EFFORTS,
+      // The sub-agent model policy vocabulary is a FIXED alias enum (the CLI's Task
+      // tool refuses catalog ids), so it ships beside `efforts` rather than being
+      // derived from `models`.
+      subagentModels: SUBAGENT_MODEL_VALUES,
     });
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
@@ -2198,6 +2895,7 @@ app.post('/api/config', async (req, res) => {
   try {
     await setStep(projectDir, body.step, {
       model: body.model, effort: body.effort, fanOut: body.fanOut, askQuestions: body.askQuestions,
+      subagentModel: body.subagentModel,
     });
     // Respond with the FULL run-config (mirrors PATCH): setStep's return value is
     // the legacy {steps, customModels} view only, and clients assign the response
@@ -2219,31 +2917,55 @@ app.post('/api/config', async (req, res) => {
 // validates model/effort against the effective catalog exactly like setStep
 // (configurable-models-design.md §4.5) -> 400; setFeedbackCycles still COERCES
 // maxCycles to >= 1 (it never throws).
-// body: { projectDir, workflowId, nodes?:{[id]:{model,effort}}, feedbacks?:{[id]:{maxCycles}}, activeWorkflowId? }
+// body: { projectDir, workflowId, nodes?:{[id]:{model,effort}}, feedbacks?:{[id]:{maxCycles}}, wires?:{[wireId]:{maxCycles}}, activeWorkflowId? }
 // ---------------------------------------------------------------------------
 app.patch('/api/config', async (req, res) => {
   const body = req.body || {};
   const projectDir = resolveProjectDir(body.projectDir);
   if (!projectDir) return badRequest(res, 'projectDir is required');
   const workflowId = typeof body.workflowId === 'string' ? body.workflowId.trim() : '';
+  // MAJ-1: every arm below keys a normalized table by workflowId, and
+  // readWorkflowsMap rebuilds a map from those keys — an id like '__proto__'
+  // used to be persisted unchecked and then broke readRunConfig for the whole
+  // project. isSafeWorkflowId is the store's own id rule, so the API can never
+  // write an id the store would refuse. (The recovery route DELETE
+  // /api/config/workflow stays deliberately ungated: an already-poisoned row
+  // must still be clearable.)
+  const workflowIdError = (what) => {
+    if (!workflowId) return `workflowId is required to set ${what} config`;
+    if (!isSafeWorkflowId(workflowId)) return 'invalid workflowId';
+    return null;
+  };
   try {
     if (body.nodes && typeof body.nodes === 'object') {
-      if (!workflowId) return badRequest(res, 'workflowId is required to set node config');
+      const bad = workflowIdError('node');
+      if (bad) return badRequest(res, bad);
       for (const [nodeId, sel] of Object.entries(body.nodes)) {
         await setNodeModel(projectDir, workflowId, nodeId, {
           model: sel && sel.model, effort: sel && sel.effort,
           fanOut: sel && sel.fanOut, askQuestions: sel && sel.askQuestions,
+          subagentModel: sel && sel.subagentModel,
         });
       }
     }
     if (body.feedbacks && typeof body.feedbacks === 'object') {
-      if (!workflowId) return badRequest(res, 'workflowId is required to set feedback config');
+      const bad = workflowIdError('feedback');
+      if (bad) return badRequest(res, bad);
       for (const [fbId, sel] of Object.entries(body.feedbacks)) {
         await setFeedbackCycles(projectDir, workflowId, fbId, sel && sel.maxCycles);
       }
     }
+    if (body.wires && typeof body.wires === 'object') {
+      const bad = workflowIdError('wire');
+      if (bad) return badRequest(res, bad);
+      for (const [wireId, sel] of Object.entries(body.wires)) {
+        await setWireCycles(projectDir, workflowId, wireId, sel && sel.maxCycles);
+      }
+    }
     if (typeof body.activeWorkflowId === 'string' && body.activeWorkflowId.trim()) {
-      await setActiveWorkflow(projectDir, body.activeWorkflowId.trim());
+      const active = body.activeWorkflowId.trim();
+      if (!isSafeWorkflowId(active)) return badRequest(res, 'invalid workflowId');
+      await setActiveWorkflow(projectDir, active);
     }
     const config = await readRunConfig(projectDir);
     res.json({ config });
@@ -2301,8 +3023,7 @@ app.delete('/api/config/models', async (req, res) => {
 // back means "keep" and is dropped from the write.
 // ---------------------------------------------------------------------------
 
-const maskEnvValue = (v) =>
-  (modelEnvRef(v) ? v : (v.length > 8 ? `••••••${v.slice(-4)}` : '••••••'));
+const maskEnvValue = (v) => (modelEnvRef(v) ? v : maskModelEnvValue(v));
 const maskedGlobalModel = (m) => (m.env
   ? { ...m, env: Object.fromEntries(Object.entries(m.env).map(([k, v]) => [k, maskEnvValue(v)])) }
   : m);
@@ -2330,6 +3051,7 @@ const pluginModelsPayload = () => {
         k, typeof v === 'string' ? maskEnvValue(v) : `(secret: ${v.secret})`,
       ])),
       secrets: status.filter((s) => m.secrets.includes(s.key)),
+      ...(m.cost ? { cost: m.cost } : {}),   // manifest-pinned pricing — config, never a credential
       ...(flagged.has(m.id.toLowerCase()) ? { costUnreliable: true } : {}),
     };
   });
@@ -2342,7 +3064,7 @@ app.get('/api/models', (req, res) => {
 app.post('/api/models', async (req, res) => {
   const b = req.body || {};
   try {
-    const model = await addGlobalModel({ id: b.id, label: b.label, efforts: b.efforts, env: b.env });
+    const model = await addGlobalModel({ id: b.id, label: b.label, efforts: b.efforts, env: b.env, cost: b.cost });
     res.json({ model: maskedGlobalModel(model), models: maskedGlobalModels() });
   } catch (err) {
     // addGlobalModel throws only on validation (empty/dup id, unknown effort,
@@ -2425,6 +3147,10 @@ app.post('/api/models/export-plugin', async (req, res) => {
       ...(entry.label !== entry.id ? { label: entry.label } : {}),
       ...(entry.efforts.length && entry.efforts.length !== EFFORTS.length ? { efforts: entry.efforts } : {}),
       ...(Object.keys(env).length ? { env } : {}),
+      // Pricing travels with the model. It is configuration, not a credential —
+      // and a shared on-prem model is precisely one the CLI would otherwise
+      // price by NAME on every machine that installs the plugin.
+      ...(entry.cost ? { cost: entry.cost } : {}),
     });
   }
 
@@ -2495,7 +3221,7 @@ app.patch('/api/models/:id', async (req, res) => {
     env = Object.fromEntries(Object.entries(env).filter(([, v]) => !isMaskedEcho(v)));
   }
   try {
-    const model = await updateGlobalModel(req.params.id, { label: b.label, efforts: b.efforts, env });
+    const model = await updateGlobalModel(req.params.id, { label: b.label, efforts: b.efforts, env, cost: b.cost });
     res.json({ model: maskedGlobalModel(model), models: maskedGlobalModels() });
   } catch (err) {
     // updateGlobalModel throws only on validation (unknown id, unknown effort,
@@ -2534,6 +3260,35 @@ app.delete('/api/models/:id', async (req, res) => {
   }
 });
 
+// Live connectivity check for a catalog model — the Models-view Test button.
+// Explicit user action only (one real, tiny API call against wherever the
+// model routes). Caller mistakes get an HTTP status; the test OUTCOME rides a
+// 200 envelope, same convention as POST /api/chat/test. Ids resolve global
+// first, then plugin — resolveModelEnv's precedence.
+const modelTestsInFlight = new Set();
+app.post('/api/models/:id/test', async (req, res) => {
+  const id = String(req.params.id);
+  const lc = id.toLowerCase();
+  const global = listGlobalModels().find((m) => m.id.toLowerCase() === lc);
+  const plugin = global ? null : listPluginModels().find((m) => m.id.toLowerCase() === lc);
+  if (!global && !plugin) return res.status(404).json({ error: `unknown model id ${JSON.stringify(id)}` });
+  if (plugin && plugin.secrets.length) {
+    // Don't burn a spawn guaranteed to fail — resolveModelEnv drops unset secrets.
+    const unset = pluginModelSecretStatus(plugin.plugin)
+      .filter((s) => plugin.secrets.includes(s.key) && !s.set).map((s) => s.key);
+    if (unset.length) {
+      return badRequest(res, `secret ${unset.join(', ')} is not set — configure it in the plugin's settings`);
+    }
+  }
+  if (modelTestsInFlight.has(lc)) return badRequest(res, 'test already running for this model');
+  modelTestsInFlight.add(lc);
+  try {
+    res.json(await testModel(id));
+  } finally {
+    modelTestsInFlight.delete(lc);
+  }
+});
+
 // ---------------------------------------------------------------------------
 // Workflow templates (global store at ~/.worca-cc/workflows). Topology only;
 // model/effort/cycles live in per-project run-config. CRUD mirrors the
@@ -2550,6 +3305,10 @@ function nodeDefaultsError(raw, models, where) {
   const effort = typeof raw.effort === 'string' ? raw.effort.trim() : '';
   const entry = model ? models.find((m) => m.id === model) : null;
   if (model && !entry) return `unknown model "${model}"`;
+  // subagentModel is a fixed alias enum, NOT a catalog id: validated via the
+  // shared helper so a typo is a 400 with the same message every writer uses.
+  const subIssue = subagentModelIssue(raw.subagentModel);
+  if (subIssue) return subIssue;
   if (!effort) return '';
   if (!EFFORTS.includes(effort)) return `unknown effort "${effort}"`;
   if (!entry) return 'select a model before choosing an effort';
@@ -2557,11 +3316,15 @@ function nodeDefaultsError(raw, models, where) {
   return '';
 }
 
-app.get('/api/workflows', async (_req, res) => {
+app.get('/api/workflows', async (req, res) => {
   try {
-    // The built-in default is never persisted to the user store; callers
-    // prepend it (CONTRACT: GET -> { workflows: [DEFAULT_WORKFLOW, ...listWorkflows()] }).
-    res.json({ workflows: [DEFAULT_WORKFLOW, ...(await listWorkflows())] }); // CONV-1: await
+    if (isTruthy(req.query.archived)) {
+      const all = await listWorkflows({ includeArchived: true });
+      return res.json({ workflows: all.filter((w) => w.archivedAt) });
+    }
+    // CONTRACT: [ GRAPH_DEFAULT_WORKFLOW, ...listWorkflows() ]. The built-in is
+    // never a persisted row (listWorkflows filters its id), so it cannot appear twice.
+    res.json({ workflows: [GRAPH_DEFAULT_WORKFLOW, ...(await listWorkflows())] });
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
@@ -2569,51 +3332,80 @@ app.get('/api/workflows', async (_req, res) => {
 
 app.get('/api/workflows/:id', async (req, res) => {
   try {
-    const tpl = await readWorkflow(req.params.id); // CONV-1: await; returns DEFAULT_WORKFLOW for "wf_default"
-    if (!tpl) return res.status(404).json({ error: 'workflow not found' });
-    res.json(tpl);
+    // ONE gate, ONE message: an archived id explains itself instead of reading
+    // as a plain 404 (assertRunnableWorkflow owns both texts). checkGraph:false —
+    // this is a READ (the Composer's Open): a template stranded by an agent-port
+    // edit must still load, or the user could never repair it. The RUN path keeps
+    // the graph check.
+    res.json(await assertRunnableWorkflow(req.params.id, { checkGraph: false }));
   } catch (err) {
+    if (err && (err.code === 'NOT_FOUND' || err.code === 'ARCHIVED')) {
+      return res.status(404).json({ error: err.message });
+    }
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
 });
 
 app.post('/api/workflows', async (req, res) => {
   const body = req.body || {};
-  // Build the candidate template from the editor payload (topology only).
-  const tpl = {
+  // The v1 pipeline format is RETIRED: only graphs are accepted (spec §10.2).
+  // The whole v1 arm (its steps-borne node defaults, validateWorkflow and
+  // writeWorkflow) died with it — nothing reaches the v1 store through the API.
+  if (body.version !== 2) {
+    return badRequest(res, 'v1 pipeline templates are no longer accepted — save a graph (version 2)');
+  }
+  // ── v2 graph save ──────────────────────────────────────────────────────────
+  // The 422 body is the SHARED validator's issue list, by construction: the
+  // composer renders exactly what it would have computed locally, so the server
+  // and the client can never disagree about why a graph is illegal.
+  const graph = {
+    id: typeof body.id === 'string' ? body.id : undefined,
     name: typeof body.name === 'string' ? body.name.trim() : '',
-    domain: typeof body.domain === 'string' ? body.domain : undefined, // writeWorkflow normDomain → 'general' if absent/blank/malformed
-    steps: Array.isArray(body.steps) ? body.steps : [],
-    feedbacks: Array.isArray(body.feedbacks) ? body.feedbacks : [],
+    domain: typeof body.domain === 'string' ? body.domain : undefined,
+    nodes: Array.isArray(body.nodes) ? body.nodes : [],
+    wires: Array.isArray(body.wires) ? body.wires : [],
+    ...(body.canvas && typeof body.canvas === 'object' ? { canvas: body.canvas } : {}),
   };
-  if (!tpl.name) return badRequest(res, 'name is required');
+  if (!graph.name) return badRequest(res, 'name is required');
   try {
-    // Per-node defaults ride along in steps (§4.4); hold them to the same catalog
-    // rules as PATCH .../defaults so an imported template cannot smuggle in a
-    // model id that no per-project override would be allowed to name.
+    // Catalog validation FIRST: a v2 node's `config` IS its defaults block (§4),
+    // so a value the per-project override could not name must not ride in
+    // through a template save. nodeDefaultsError checks the tunables (model +
+    // effort against the catalog, subagentModel against the alias enum), so
+    // only AGENT_TUNABLES are handed to it — topology keys (awaitAll, arity,
+    // planStoreSeed) never are.
     const models = await listModels('');
-    for (const group of tpl.steps) {
-      for (const node of Array.isArray(group) ? group : []) {
-        if (!node || typeof node !== 'object' || node.defaults === undefined) continue;
-        const err = nodeDefaultsError(node.defaults, models, `node "${node.id}"`);
-        if (err) return badRequest(res, err);
-      }
+    for (const n of graph.nodes) {
+      if (!n || n.kind !== 'agent' || !n.config || typeof n.config !== 'object') continue;
+      const picked = Object.fromEntries(
+        AGENT_TUNABLES.filter((k) => k in n.config).map((k) => [k, n.config[k]]));
+      const bad = nodeDefaultsError(picked, models, `node "${n.id}"`);
+      if (bad) return badRequest(res, bad);
     }
-    const registry = loadAgentRegistry(AGENTS_DIR);
-    const { ok, errors, warnings } = validateWorkflow(tpl, registry);
-    if (!ok) return res.status(400).json({ error: 'invalid workflow', errors, warnings });
-    // writeWorkflow stamps id/createdAt/updatedAt and writes atomically (temp+rename).
-    const workflow = await writeWorkflow(tpl); // CONV-1: await
-    res.status(201).json({ workflow, warnings });
+    const portsFn = registryPortsFn(loadAgentRegistry(AGENTS_DIR));
+    const { errors, warnings } = validateGraph({ ...graph, version: 2 }, portsFn);
+    if (errors.length) return res.status(422).json({ error: 'invalid graph', errors, warnings });
+    // rejectCollision (MAJ-5): the body carried no id, so wf_<slug(name)> is a
+    // GUESS — it must never silently replace a pipeline the user can see.
+    const workflow = await writeGraphWorkflow(graph, { rejectCollision: true });
+    return res.status(201).json({ workflow, warnings });
   } catch (err) {
-    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+    // C-3: a name that slugs onto the reserved wf_default is a caller error, not
+    // a server fault — 422, the same code the validator's refusal uses. MAJ-5: a
+    // minted id already in use is a 409 carrying that id, so the dialog can offer
+    // rename/overwrite. Both bodies carry NO issues/errors array on purpose:
+    // app.js's saveWorkflow maps `error` straight into the save dialog's message
+    // line, verbatim.
+    if (err && err.code === 'RESERVED_NAME') return res.status(422).json({ error: err.message });
+    if (err && err.code === 'ID_TAKEN') return res.status(409).json({ error: err.message, id: err.id });
+    return res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
 });
 
 // ---------------------------------------------------------------------------
 // PATCH /api/workflows/:id/defaults -> set the template's per-node defaults
 // (newpipeline-ux-design.md §4.4). body: { defaults: { [nodeId]: {model?, effort?,
-// fanOut?, askQuestions?} | null } }; null (or an empty block) clears a node, an
+// fanOut?, askQuestions?, subagentModel?} | null } }; null (or an empty block) clears a node, an
 // absent node keeps what it has. Model/effort validate against the PROJECT-LESS
 // catalog (predefined ⊕ global ⊕ plugin) — defaults are global, so a legacy
 // per-project custom model is deliberately not a valid default.
@@ -2750,32 +3542,769 @@ app.delete('/api/guardrails/:id', async (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Ask Worca (ask-worca-design.md §8). askJobs is SEPARATE from the runs Map —
+// the client's Running badge counts runs entries, and a thread id is the
+// subscription key (§8.3). No store/home access at import time (the chatCtx
+// rule): the Maps are bare and every store call lives inside a handler or
+// bootMaintenance.
+// ---------------------------------------------------------------------------
+const askJobs = new Map();      // threadId -> {turn, messageId, userMessageId, events, seq, status, startedAt, graceTimer}
+// Threads whose DELETE is past its first await (worktree removal spawns git):
+// POST /messages refuses them so no turn can start against rows that are
+// about to cascade (review of PR #376 — a turn started in that window outlived
+// the delete as a live job holding a global slot).
+const askDeleting = new Set();
+const askFollowers = new Map(); // threadId -> Set<{detach}>
+const ASK_JOB_MAX_BUFFER = 5000; // same arithmetic as MAX_BUFFER: deltas dominate; eviction ⇒ client seq-gap re-sync
+
+function askInFlight(threadId) {
+  const job = askJobs.get(threadId);
+  return job && job.status === 'running' ? job : null;
+}
+
+function askRunningCount() {
+  let n = 0;
+  for (const job of askJobs.values()) if (job.status === 'running') n += 1;
+  return n;
+}
+
+/** hello payload: running turns only (§8.2). A job whose slot was just
+ *  reserved (messageId still null — the message route's atomic reservation,
+ *  Task 6) is skipped: it becomes visible once its assistant row exists. */
+function askHello() {
+  const out = [];
+  for (const [threadId, job] of askJobs.entries()) {
+    if (job.status === 'running' && job.messageId) out.push({ threadId, messageId: job.messageId });
+  }
+  return out;
+}
+
+/** Replay a job's stamped ring buffer to one socket. No state snapshot — the
+ *  REST thread GET is the snapshot; the client dedupes by seq (§6.6). */
+function replayAskJob(ws, job) {
+  for (const ev of job.events) send(ws, ev);
+}
+
+/** The stamping closure (§17: reducer frames are BARE; the server stamps).
+ *  Shared by the turn's own ask-start/ask-done/ask-error and every reducer
+ *  frame, so ALL job frames are buffered, replayed and seq-ordered alike. */
+function stampAskFrames(threadId, job) {
+  return (bare) => {
+    const frame = { ...bare, threadId, messageId: job.messageId, seq: ++job.seq };
+    job.events.push(frame);
+    if (job.events.length > ASK_JOB_MAX_BUFFER) job.events.splice(0, job.events.length - ASK_JOB_MAX_BUFFER);
+    broadcast(frame);
+  };
+}
+
+/** The narrow worktree envelope the snapshot GET and the `ask-worktrees` frame
+ *  share (P4 §10): never the full row — threadId/projectDir/updatedAt stay
+ *  server-side. Mirrors the list_worktrees MCP tool (src/core/ask/tools.mjs). */
+function askWorktreesEnvelope(threadId) {
+  return askListWorktrees(threadId).map((w) => ({
+    worktreeId: w.worktreeId, projectKey: w.projectKey, ref: w.ref,
+    commit: w.commit, path: w.path, createdAt: w.createdAt,
+  }));
+}
+
+/** Broadcast the thread's CURRENT worktrees as an out-of-turn frame (seq-less,
+ *  threadId-tagged, like ask-title). Fed by the turn's onWorktreeMutation hook —
+ *  the MCP child opened/removed/navigated a checkout this process never saw —
+ *  and by the manual DELETE route, so every tab's count and popover follow
+ *  without a snapshot GET. Best effort; false when the thread is gone. */
+function emitAskWorktrees(threadId) {
+  try {
+    if (!askGetThread(threadId)) return false;
+    broadcast({ type: 'ask-worktrees', threadId, worktrees: askWorktreesEnvelope(threadId) });
+    return true;
+  } catch { return false; }   // a poke is best effort
+}
+
+/** 400 on shape (spec §8.1 — a DELIBERATE divergence from the house 404-on-
+ *  malformed-param style), null-return contract like badRequest. */
+function askIdParam(res, value, kind) {
+  if (typeof value !== 'string' || !ASK_ID_RE.test(value)) {
+    res.status(400).json({ error: `invalid ${kind} id` });
+    return null;
+  }
+  return value;
+}
+
+app.get('/api/ask/threads', (req, res) => {
+  try {
+    const raw = Number.parseInt(String(req.query.limit ?? ''), 10);
+    const limit = Number.isInteger(raw) && raw > 0 ? Math.min(raw, 200) : 50;
+    const threads = askListThreads({ limit }).map((t) => ({ ...t, inFlight: !!askInFlight(t.id) }));
+    // total = EVERY saved chat (the History popover's meter), not the capped page above.
+    res.json({ threads, total: askCountThreads() });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// Settings → "Delete all chat history": the counts the confirm dialog quotes,
+// read fresh right before it opens.
+app.get('/api/ask/history', (req, res) => {
+  try {
+    res.json({
+      threads: askCountThreads(),
+      worktrees: askCountWorktrees(),
+      attachments: askCountAttachments(),
+      inFlight: askRunningCount(),
+    });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// Bulk delete: every thread through deleteAskThreadFully, SEQUENTIALLY (each
+// worktree removal spawns git — never in parallel), best-effort per thread. The
+// ids come from listThreadIds (no cap), never from the LIMIT-ed listThreads.
+// One JSON at the end; then a seq-less out-of-turn frame so every open tab
+// drops its now-dead st.threadId (the panel would otherwise keep it until the
+// next 404).
+app.delete('/api/ask/threads', async (req, res) => {
+  const removed = { threads: 0, worktrees: 0 };
+  const failed = [];
+  try {
+    for (const id of askListThreadIds()) {
+      try {
+        const r = await deleteAskThreadFully(id);
+        if (r.deleted) {
+          removed.threads += 1;
+          removed.worktrees += r.worktrees;
+        } else failed.push(id);
+      } catch {
+        failed.push(id);
+      }
+    }
+    res.json({ ok: true, removed, failed });
+    broadcast({ type: 'ask-history-cleared' });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+app.post('/api/ask/threads', (req, res) => {
+  try {
+    const body = req.body || {};
+    let title = null;
+    if (body.title !== undefined && body.title !== null && body.title !== '') {
+      if (typeof body.title !== 'string' || body.title.length > 120) {
+        return badRequest(res, 'title must be a string of at most 120 characters');
+      }
+      title = body.title.trim() || null;
+    }
+    const thread = askCreateThread();
+    if (title) askUpdateThread(thread.id, { title });
+    res.status(201).json({ thread: askGetThread(thread.id) });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+app.get('/api/ask/threads/:id', (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  try {
+    const thread = askGetThread(id);
+    if (!thread) return res.status(404).json({ error: 'thread not found' });
+    const job = askInFlight(id);
+    res.json({
+      thread,
+      messages: askListMessages(id),
+      attachments: askListAttachments(id),
+      runLinks: askListRunLinks(id),
+      // P4 §10: the SAME narrow envelope the list_worktrees MCP tool and the
+      // ask-worktrees frame carry — never the full row.
+      worktrees: askWorktreesEnvelope(id),
+      inFlight: job && job.messageId ? { messageId: job.messageId } : null, // null while the slot is only reserved
+    });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+app.patch('/api/ask/threads/:id', (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  try {
+    const body = req.body || {};
+    const patch = {};
+    // Title keeps its original contract exactly: a PATCH that names neither field
+    // still earns the title error, so pre-#397 callers see identical behaviour.
+    if (body.title !== undefined || body.scope === undefined) {
+      const raw = body.title;
+      if (typeof raw !== 'string' || !raw.trim() || raw.length > 120) {
+        return badRequest(res, 'title must be a non-empty string of at most 120 characters');
+      }
+      patch.title = raw.trim();
+    }
+    if (body.scope !== undefined) {
+      // #397: the Ask panel's scope selector. Merged per field into the stored
+      // context — the pin replaces only the target keys, so the last page
+      // context (view, run, diff file) survives a selector change.
+      const sv = askValidateScope(body.scope);
+      if (!sv.ok) return badRequest(res, sv.error);
+      const cur = askGetThread(id);
+      if (!cur) return res.status(404).json({ error: 'thread not found' });
+      const base = cur.context && typeof cur.context === 'object' && !Array.isArray(cur.context) ? { ...cur.context } : {};
+      delete base.projectDir;
+      delete base.projectKey;
+      delete base.workspaceId;
+      patch.context = { ...base, ...sv.scope };
+    }
+    const thread = askUpdateThread(id, patch);
+    if (!thread) return res.status(404).json({ error: 'thread not found' });
+    res.json({ thread });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// §7.5 order: abort the in-flight turn -> detach followers -> remove the chat's
+// worktrees git-properly -> delete the row (tx + cascades) + rm -rf inside
+// deleteThread -> drop the job entry. Shared by the per-thread DELETE and the
+// bulk DELETE; askDeleting brackets the whole thing per id (POST /messages
+// refuses the thread while its delete is past the first await).
+// Returns { deleted, worktrees } — worktrees = rows removeThreadWorktrees removed.
+async function deleteAskThreadFully(id) {
+  askDeleting.add(id);
+  try {
+    const stopJob = () => {
+      const job = askJobs.get(id);
+      if (job && job.turn && typeof job.turn.stop === 'function') {
+        try { job.turn.stop(); } catch { /* best-effort */ }
+      }
+      return job;
+    };
+    stopJob();
+    const followers = askFollowers.get(id);
+    if (followers) {
+      for (const f of [...followers]) {
+        try { f.detach(); } catch { /* best-effort */ }
+      }
+      askFollowers.delete(id);
+    }
+    // P4 §5: git-proper removal of every worktree BEFORE the row cascade — the
+    // rmSync inside askDeleteThread alone would leave stale `git worktree`
+    // registrations in the source repos. Never throws (best-effort per row).
+    const { removed } = await askRemoveThreadWorktrees(id);
+    // Re-read the job AFTER the await: askDeleting blocks new turns, but a turn
+    // that was already mid-start is stopped here rather than left running.
+    const job = stopJob();
+    const deleted = askDeleteThread(id);
+    if (job) {
+      if (job.graceTimer) clearTimeout(job.graceTimer);
+      askJobs.delete(id);
+    }
+    return { deleted, worktrees: removed };
+  } finally {
+    askDeleting.delete(id);
+  }
+}
+
+app.delete('/api/ask/threads/:id', async (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  try {
+    if (!askGetThread(id)) return res.status(404).json({ error: 'thread not found' });
+    await deleteAskThreadFully(id);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// P4 §10: manual worktree delete from the panel. Allowed while a turn is in
+// flight — the model's next operation on it gets a clean tool error.
+app.delete('/api/ask/threads/:id/worktrees/:wtId', async (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  const wtId = askIdParam(res, req.params.wtId, 'worktree');
+  if (!wtId) return;
+  try {
+    if (!askGetThread(id)) return res.status(404).json({ error: 'thread not found' });
+    const out = await askRemoveWorktree({ threadId: id, wtId });
+    emitAskWorktrees(id);   // every open tab's count/popover follows the delete
+    res.json(out);
+  } catch (err) {
+    if (err && err.name === 'AskWorktreeError') return res.status(404).json({ error: err.message });
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+app.get('/api/ask/threads/:id/attachments/:attId', (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  const attId = askIdParam(res, req.params.attId, 'attachment');
+  if (!attId) return;
+  try {
+    if (!askGetThread(id)) return res.status(404).json({ error: 'thread not found' });
+    const att = askGetAttachment(id, attId);
+    const file = att ? askAttachmentPath(id, attId) : null;
+    if (!file) return res.status(404).json({ error: 'attachment not found' });
+    // Text bodies serve as utf-8 text/plain (pre-#398, byte-for-byte: the body
+    // was UTF-8-validated at upload and stored verbatim). Only sniff-verified
+    // allowlisted mimes are ever stored (never scriptable markup like SVG/HTML),
+    // so serving the real mime inline is safe — and it is what lets the
+    // transcript render <img> thumbnails (#398).
+    const type = att.kind === 'text' ? 'text/plain; charset=utf-8' : (att.mime || 'application/octet-stream');
+    // Streamed, not readFileSync + send: a body is immutable under its
+    // store-minted id, so a stat-based ETag/Last-Modified plus a year-long
+    // private immutable cache replaces a 5 MB sync read and sha1 per request —
+    // the transcript re-creates every <img> on each structural render.
+    res.sendFile(path.basename(file), {
+      root: path.dirname(file),
+      dotfiles: 'deny',
+      cacheControl: false,
+      headers: {
+        'Content-Type': type,
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Disposition': 'inline',
+        'Cache-Control': 'private, max-age=31536000, immutable',
+      },
+    }, (err) => {
+      if (!err || res.headersSent) return;
+      if (err.code === 'ENOENT' || err.status === 404) return res.status(404).json({ error: 'attachment not found' });
+      res.status(500).json({ error: err.message || String(err) });
+    });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// D8/§8.1: the chat model catalog. Fresh per request (the /api/config
+// precedent) — a cache would go stale against global-model edits.
+app.get('/api/ask/models', async (_req, res) => {
+  try {
+    res.json(await askCatalog());
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+/** lookupPipelineRow/findPipelineRowById return the RAW `SELECT * FROM pipelines`
+ *  row: snake_case columns, and `branch` is a JSON DOCUMENT
+ *  ({source, feature, worktreeDir, …}), not a branch name. Reading
+ *  row.startedAt/row.branch directly loses the date and pastes a JSON blob into
+ *  the [worca context] line (dry-run-verified). */
+function askRunFromPipelineRow(row) {
+  let branchObj = null;
+  if (typeof row.branch === 'string') {
+    try { branchObj = JSON.parse(row.branch); } catch { branchObj = null; }
+  } else if (row.branch && typeof row.branch === 'object') {
+    branchObj = row.branch;
+  }
+  const branch = branchObj && typeof branchObj.feature === 'string'
+    ? branchObj.feature
+    : (typeof branchObj === 'string' ? branchObj : null);
+  return {
+    id: row.id,
+    title: row.title || '',
+    status: row.status || '',
+    startedAt: row.started_at || row.updated_at || '',
+    branch,
+  };
+}
+
+/** #397: the user-pinned scope of an ask context — {projectKey} | {workspaceId} | null. */
+function askPinnedScope(context) {
+  if (!context || typeof context !== 'object' || context.pinned !== true) return null;
+  if (typeof context.projectKey === 'string' && context.projectKey) return { projectKey: context.projectKey };
+  if (typeof context.workspaceId === 'string' && context.workspaceId) return { workspaceId: context.workspaceId };
+  return null;
+}
+
+/** #397 per-field merge: the pinned scope replaces the page context's TARGET keys
+ *  (projectDir/projectKey/workspaceId); view, run, pipeline and diff-file context
+ *  still follow the page. */
+function askApplyPin(ctx, pin) {
+  const out = { ...ctx, pinned: true };
+  delete out.projectDir;
+  delete out.projectKey;
+  delete out.workspaceId;
+  return { ...out, ...pin };
+}
+
+/** #397 selector PATCH body: {pinned:false} | {pinned:true, projectKey|workspaceId}. */
+function askValidateScope(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, error: 'scope must be an object' };
+  if (typeof raw.pinned !== 'boolean') return { ok: false, error: 'scope.pinned must be true or false' };
+  if (!raw.pinned) return { ok: true, scope: { pinned: false } };
+  const cv = validateClientContext({ projectKey: raw.projectKey, workspaceId: raw.workspaceId });
+  if (!cv.ok) return { ok: false, error: cv.error.replace('context.', 'scope.') };
+  const keys = ['projectKey', 'workspaceId'].filter((k) => cv.context[k]);
+  if (keys.length !== 1) return { ok: false, error: 'scope needs exactly one of projectKey / workspaceId' };
+  return { ok: true, scope: { pinned: true, [keys[0]]: cv.context[keys[0]] } };
+}
+
+/** Resolve the VALIDATED client context into the server-side shape
+ *  buildContextHeader consumes (§6.5: server-resolved rows only — never
+ *  client-supplied titles or paths). Every lookup is individually guarded:
+ *  a vanished row degrades to an absent header line, never a 500. */
+async function resolveAskContext(threadId, ctx = {}, listedAttachments = [], currentMessageId = null) {
+  const out = { now: new Date().toISOString() };
+  if (ctx.pinned === true) out.pinned = true;   // #397: rendered as the [pinned by the user] marker
+  if (ctx.view) out.view = ctx.view;
+  if (ctx.diffPath) out.diffPath = ctx.diffPath;   // client-supplied, already length-checked by validateClientContext
+  try {
+    if (ctx.projectKey || ctx.projectDir) {
+      const projects = await listProjects();
+      const p = projects.find((x) =>
+        (ctx.projectKey && x.key === ctx.projectKey) || (ctx.projectDir && x.path === ctx.projectDir));
+      if (p) out.project = { name: p.name, key: p.key };
+    }
+  } catch { /* absent line */ }
+  try {
+    if (ctx.workspaceId) {
+      const ws = await readWorkspace(ctx.workspaceId);
+      if (ws) {
+        // readWorkspace returns {id, name, projectPaths, projectKeys, …} — there
+        // is NO per-member name object (the {projectName} shape is a local
+        // /api/run construction, ui/server.mjs:894). Member display names are
+        // the path basenames, same as that precedent.
+        out.workspace = {
+          name: ws.name, id: ws.id,
+          members: (ws.projectPaths || []).map((p) => path.basename(p)).filter(Boolean),
+        };
+      }
+    }
+  } catch { /* absent line */ }
+  try {
+    if (ctx.pipelineId) {
+      const key = ctx.workspaceId ? `workspaces/${ctx.workspaceId}` : out.project?.key;
+      const row = (key ? lookupPipelineRow(key, ctx.pipelineId) : null) || findPipelineRowById(ctx.pipelineId);
+      if (row) out.run = askRunFromPipelineRow(row);
+    } else if (ctx.runId && runs.has(ctx.runId)) {
+      const entry = runs.get(ctx.runId);
+      out.run = {
+        id: entry.pipelineId || ctx.runId.slice(0, 8), title: entry.title || '',
+        status: entry.status || '', startedAt: entry.startedAt || '', branch: null,
+      };
+    }
+  } catch { /* absent line */ }
+  // (the ctx.runId branch reads the LIVE runs-Map entry, which really is
+  // camelCase — only the DB pipeline row needs askRunFromPipelineRow)
+  try {
+    const links = askListRunLinks(threadId).slice(0, ASK_LIMITS.headerRuns).map((l) => {
+      const live = runs.get(l.runId);
+      return {
+        id: l.pipelineId || l.runId.slice(0, 8),
+        title: (live && live.title) || '', status: l.status || (live && live.status) || '',
+        phase: l.phase || '',
+      };
+    });
+    if (links.length) out.linkedRuns = links;
+    const cards = [];
+    for (const m of askListMessages(threadId)) {
+      if (!Array.isArray(m.blocks)) continue;
+      for (const b of m.blocks) {
+        if (b && b.kind === 'card') {
+          cards.push({
+            id: b.id, state: b.state, workflowId: b.card && b.card.workflowId,
+            targetName: (b.card && (b.card.projectName || b.card.workspaceName)) || '',
+          });
+        }
+      }
+    }
+    if (cards.length) out.cards = cards.slice(-ASK_LIMITS.headerCards);
+    // §6.5: the CURRENT message's non-inlined files, then EARLIER attachments
+    // newest first — inlined current files must not be double-listed, so the
+    // earlier set excludes the whole current message, not just `listed` ids.
+    const earlier = askListAttachments(threadId)
+      .filter((a) => !currentMessageId || a.messageId !== currentMessageId)
+      .slice(-ASK_LIMITS.headerAttachments)
+      .reverse()
+      .map((a) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime }));
+    const atts = [...listedAttachments.map((a) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime })), ...earlier];
+    if (atts.length) out.attachments = atts.slice(0, ASK_LIMITS.headerAttachments);
+  } catch { /* absent lines */ }
+  return out;
+}
+
+/** R-F: whenever mock mode is on, EVERY ask spawn carries markers. The card is
+ *  the mock propose_run INPUT, derived from page context so a seeded project/
+ *  workspace validates and an empty context exercises the rejection notice. */
+function mockAskCard(ctx = {}, text = '') {
+  const target = ctx.workspaceId
+    ? { workspaceId: ctx.workspaceId }
+    : { projectKey: ctx.projectKey || 'mock-project-00000000' };
+  return { ...target, workflowId: 'wf_default', guardrailsId: 'normal', brief: text.slice(0, 200) || 'Mock run' };
+}
+
+app.post('/api/ask/threads/:id/messages', async (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  try {
+    const thread = askGetThread(id);
+    if (!thread) return res.status(404).json({ error: 'thread not found' });
+    if (askDeleting.has(id)) return res.status(409).json({ error: 'thread is being deleted' });
+    if (askInFlight(id)) return res.status(409).json({ error: 'turn in flight' });
+    // Budget gate (F6), same figure /api/run enforces: Ask spend is folded into the
+    // total window (cost-budget.mjs totalWindowSpendUsd), so chat must stop at
+    // the cap it helps fill instead of spending past it while pipelines are 403'd
+    // (review of PR #376).
+    const budget = budgetStatus();
+    if (budget.blocked) return res.status(403).json({ error: 'total cost limit reached', budget });
+    if (askRunningCount() >= ASK_LIMITS.turnsGlobal) {
+      return res.status(429).json({ error: `at most ${ASK_LIMITS.turnsGlobal} turns may run at once` });
+    }
+    const body = req.body || {};
+    const text = typeof body.text === 'string' ? body.text : '';
+    if (!text.trim()) return badRequest(res, 'text is required');
+    const mv = await validateModelEffort(body.model, body.effort);
+    if (!mv.ok) return badRequest(res, mv.error);
+    const cv = validateClientContext(body.context);
+    if (!cv.ok) return badRequest(res, cv.error);
+    // #397: explicit pin beats page context, per field. A context carrying its own
+    // `pinned` verdict is authoritative — the selector-aware client already merged
+    // (true) or explicitly chose Auto (false). A context WITHOUT one comes from a
+    // pre-selector tab, and inherits the thread's stored pin so a stale tab can
+    // never silently unpin (or re-scope) the conversation.
+    let ctx = cv.context;
+    if (ctx.pinned === undefined) {
+      const inherited = askPinnedScope(thread.context);
+      if (inherited) ctx = askApplyPin(ctx, inherited);
+    }
+
+    // §7.3 — validate EVERY attachment before ANY write (all-or-nothing).
+    const files = [];
+    if (body.attachments !== undefined) {
+      if (!Array.isArray(body.attachments)) return badRequest(res, 'attachments must be an array');
+      if (body.attachments.length > ASK_LIMITS.attachment.maxFiles) {
+        return badRequest(res, `at most ${ASK_LIMITS.attachment.maxFiles} attachments per message`);
+      }
+      const dec = new TextDecoder('utf-8', { fatal: true });
+      for (const a of body.attachments) {
+        const name = a && typeof a.name === 'string' ? a.name : '';
+        const dot = name.lastIndexOf('.');
+        const ext = dot === -1 ? '' : name.slice(dot).toLowerCase();
+        // #398: the extension CLAIMS a type; text kinds are then proven by UTF-8
+        // decoding (as before), binary kinds by their magic number — a body that
+        // does not match its claim is refused here, before any write.
+        const cls = askClassifyExtension(ext);
+        if (!cls) return badRequest(res, `attachment type not allowed: ${name || '(unnamed)'}`);
+        const raw = typeof a.dataBase64 === 'string' ? a.dataBase64 : '';
+        const buf = raw ? Buffer.from(raw, 'base64') : Buffer.alloc(0);
+        if (!buf.length) return badRequest(res, `attachment is empty or not valid base64: ${name}`);
+        const cap = cls.kind === 'text' ? ASK_LIMITS.attachment.maxBytesPerFile : ASK_LIMITS.attachment.maxBytesPerBinaryFile;
+        if (buf.length > cap) {
+          return res.status(413).json({ error: `attachment over ${cap} bytes: ${name}` });
+        }
+        if (cls.kind !== 'text') {
+          const sniffed = askSniffMime(buf);
+          if (sniffed !== cls.mime) {
+            return badRequest(res, `attachment content does not match its extension: ${name}`);
+          }
+          files.push({ name, kind: cls.kind, mime: cls.mime, data: buf, bytes: buf.length });
+          continue;
+        }
+        let bodyText;
+        try { bodyText = dec.decode(buf); } catch { return badRequest(res, `attachment is not valid UTF-8: ${name}`); }
+        if (bodyText.includes('\u0000')) return badRequest(res, `attachment contains NUL bytes: ${name}`);
+        files.push({ name, kind: 'text', mime: cls.mime, text: bodyText, bytes: buf.length });
+      }
+      const total = askThreadAttachmentBytes(id) + files.reduce((s, f) => s + f.bytes, 0);
+      if (total > ASK_LIMITS.attachment.maxBytesPerThread) {
+        return res.status(413).json({ error: 'attachment budget for this thread exceeded' });
+      }
+    }
+
+    // §6.2.2 ATOMIC re-check + slot reservation. Today every await between the
+    // top 409/429 pair and here resolves in microtasks (validateModelEffort ->
+    // composeCatalog; askBuildCatalog -> three synchronous better-sqlite3
+    // reads), so the route is macrotask-atomic and two POSTs cannot interleave
+    // (empirically instrumented). The reservation is what keeps that true if
+    // any of those readers ever becomes genuinely async: it is synchronous —
+    // check-and-set cannot interleave — and runs BEFORE the first write, so a
+    // loser leaves no rows.
+    if (askDeleting.has(id)) return res.status(409).json({ error: 'thread is being deleted' });
+    if (askInFlight(id)) return res.status(409).json({ error: 'turn in flight' });
+    if (askRunningCount() >= ASK_LIMITS.turnsGlobal) {
+      return res.status(429).json({ error: `at most ${ASK_LIMITS.turnsGlobal} turns may run at once` });
+    }
+    const prev = askJobs.get(id);
+    if (prev && prev.graceTimer) clearTimeout(prev.graceTimer); // atomic replace of a grace entry (§8.3)
+    const job = {
+      turn: null, messageId: null, userMessageId: null, // ids filled once the rows exist;
+      events: [], seq: 0, status: 'running',            // askHello()/GET inFlight skip a null messageId
+      startedAt: new Date().toISOString(), graceTimer: null,
+    };
+    askJobs.set(id, job);
+
+    let asstMsg = null;
+    let turn;
+    let echoAttachments = [];
+    try {
+      // Writes. Store the LAST context + model/effort on the thread (§6.5 tail, D8).
+      // `ctx` (pin-merged) rather than cv.context: the stored row is what restores
+      // the selector on reopen and what the MCP child reads for tool defaulting.
+      askUpdateThread(id, { context: ctx, model: mv.model, effort: mv.effort });
+      // §7.4 — NOTHING is stamped on the row before the 202: the thread stays
+      // untitled (the header reads "Ask Worca") until the D13 background title
+      // announces itself. titleWasAuto gates that call: a title given at THREAD
+      // CREATION is the user's, and the haiku call must never fire for it
+      // (§17 Q&A 1). deterministicTitle is only the turn's fallback for an
+      // empty haiku result (turn.mjs _kickoffTitle), never written here.
+      const titleWasAuto = thread.title == null;
+      const deterministicTitle = titleWasAuto ? (askSanitizeTitle(text.slice(0, 80)) || 'New chat') : thread.title;
+      const userMsg = askAppendMessage(id, { role: 'user', text });
+      job.userMessageId = userMsg.id;
+      const attRows = files.map((f) => askAddAttachment(id, userMsg.id, { name: f.name, kind: f.kind, mime: f.mime, text: f.text, data: f.data }));
+      // The decoded binary bodies are on disk now. `files` is captured by this
+      // scope's closures (settleJob, the turn listeners, onOutOfTurn) for the whole
+      // turn plus jobGraceMs, so up to 25 MB of dead Buffers would otherwise stay
+      // reachable per running thread.
+      for (const f of files) f.data = null;
+      echoAttachments = attRows.map((a) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime }));
+      if (attRows.length) {
+        // `kind` is the BLOCK kind, so the attachment's own kind rides as attKind
+        // (the UI keys image thumbnails off it, #398).
+        askSetMessageBlocks(userMsg.id, attRows.map((a) => ({ kind: 'attachment', id: a.id, name: a.name, bytes: a.bytes, attKind: a.kind, mime: a.mime })));
+      }
+      broadcast({ type: 'ask-message', threadId: id, message: askGetMessage(userMsg.id) }); // echo for other tabs
+      asstMsg = askAppendMessage(id, { role: 'assistant', text: '', status: 'streaming', model: mv.model, effort: mv.effort });
+      job.messageId = asstMsg.id;
+
+      // Prompt assembly (§6.5) — the route owns it; the turn only spawns.
+      const catalog = await askBuildCatalog();
+      const systemPrompt = askBuildSystemPrompt(catalog);
+      const withText = attRows.map((a, i) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime, text: files[i].text }));
+      const { inline, listed } = askSelectInlineAttachments(withText);
+      const headerCtx = await resolveAskContext(id, ctx, listed, userMsg.id);
+      const header = askBuildContextHeader(headerCtx);
+      const prompt = askBuildTurnPrompt(header, text, inline);
+      const prior = askListMessages(id).filter((m) => m.seq < userMsg.seq);
+      const restoredPrompt = askBuildRestoredPrompt(prior, prompt);
+      const attachmentNames = {};
+      for (const a of askListAttachments(id)) attachmentNames[a.id] = a.name;
+
+      turn = createAskTurn({
+        threadId: id, assistantMessageId: asstMsg.id, userMessageId: userMsg.id,
+        prompt, systemPrompt, restoredPrompt,
+        model: mv.model, effort: mv.effort,
+        resumeSessionId: thread.sessionId || null,
+        firstTurn: userMsg.seq === 1 && titleWasAuto, // D13 guard: never replace a user-authored title
+        firstText: text,
+        deterministicTitle,
+        pinnedScope: askPinnedScope(ctx),             // #397: proposal defaulting + mismatch flag
+        mock: mockEnabled({}) ? { card: mockAskCard(ctx, text) } : null, // R-F
+        attachmentNames,
+        deps: {
+          onFrame: stampAskFrames(id, job),
+          onOutOfTurn: (f) => broadcast({ ...f, threadId: id }),
+          onCommentMutation: ({ runId }) => { emitDiffCommentsChanged(runId); },
+          onWorktreeMutation: () => { emitAskWorktrees(id); },
+        },
+      });
+      job.turn = turn;
+    } catch (err) {
+      // A write/assembly failure must release the reserved slot and never leave
+      // a `streaming` row for the boot sweep to find.
+      if (askJobs.get(id) === job) askJobs.delete(id);
+      if (asstMsg) {
+        try {
+          askFinishMessage(asstMsg.id, {
+            text: '', blocks: [{ kind: 'notice', text: 'failed to start the turn' }],
+            status: 'error', reason: null, usage: null, costUsd: null, durationMs: null,
+          });
+        } catch { /* thread gone */ }
+      }
+      return res.status(500).json({ error: err && err.message ? err.message : String(err) });
+    }
+    const settleJob = (status) => {
+      if (askJobs.get(id) !== job) return;
+      job.status = status;
+      job.graceTimer = setTimeout(() => {
+        if (askJobs.get(id) === job) askJobs.delete(id);
+      }, ASK_LIMITS.jobGraceMs);
+      job.graceTimer.unref?.();
+    };
+    turn.on('done', () => settleJob('done'));
+    turn.on('error', () => settleJob('error'));
+    // Fire-and-forget with a backstop (startAgentGen shape) — run() never throws.
+    Promise.resolve()
+      .then(() => turn.run())
+      .catch((err) => {
+        console.error(`[worca-ui] ask turn crashed: ${err && err.message ? err.message : err}`);
+        settleJob('error');
+      });
+    // `attachments` carries the store-minted ids so the sender's own echo can key
+    // image thumbnails and the thread budget off them (the ask-message broadcast
+    // may have raced ahead of this response, or been missed on a brand-new thread).
+    res.status(202).json({ userMessageId: job.userMessageId, assistantMessageId: job.messageId, attachments: echoAttachments });
+  } catch (err) {
+    // Only pre-reservation throws land here (`job` is block-scoped to the outer
+    // try and every post-reservation failure returned from the inner catch), so
+    // there is no slot to release.
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// Idempotent stop (the /api/agents/generate/stop family): always {ok:true}
+// after the shape check; the costUsd:null rule lives in the turn (R-C).
+app.post('/api/ask/threads/:id/stop', (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  const job = askInFlight(id);
+  if (job && job.turn && typeof job.turn.stop === 'function') {
+    try { job.turn.stop(); } catch { /* best-effort */ }
+  }
+  res.json({ ok: true });
+});
+
+/** R-B dual update. Flip in the STORE and, when the owning thread's turn is
+ *  still streaming, in the LIVE reducer (updateBlock re-emits the stamped
+ *  ask-card job frame) — otherwise finishMessage at turn end reverts the flip
+ *  with the reducer's stale copy. When no live reducer held the card (turn
+ *  over, or the card sits on an earlier message), re-broadcast the whole
+ *  message so tabs upsert the flipped block by message.id (§6.6 out-of-turn). */
+function flipCard(threadId, cardId, patch) {
+  const block = askUpdateCardBlock(threadId, cardId, patch);
+  if (!block) return null;
+  const job = askInFlight(threadId);
+  const live = job && job.turn && job.turn.reducer ? job.turn.reducer.updateBlock(cardId, patch) : null;
+  if (!live) {
+    const found = askFindCard(threadId, cardId);
+    if (found) broadcast({ type: 'ask-message', threadId, message: found.message });
+  }
+  return block;
+}
+
+// D14 dismiss ("Not now" keeps a stub — the client renders state:'dismissed').
+app.post('/api/ask/threads/:id/cards/:cardId', (req, res) => {
+  const id = askIdParam(res, req.params.id, 'thread');
+  if (!id) return;
+  const cardId = askIdParam(res, req.params.cardId, 'card');
+  if (!cardId) return;
+  try {
+    if (!askGetThread(id)) return res.status(404).json({ error: 'thread not found' });
+    if ((req.body || {}).state !== 'dismissed') return badRequest(res, 'state must be "dismissed"');
+    const found = askFindCard(id, cardId);
+    if (!found) return res.status(404).json({ error: 'card not found' });
+    if (found.block.state !== 'proposed') {
+      return res.status(409).json({ error: `card is ${found.block.state}` });
+    }
+    const block = flipCard(id, cardId, { state: 'dismissed' });
+    // Dismiss is terminal: the card's parked comment ids can never reach a run,
+    // so drop them here exactly as the launch path does at its own success point
+    // (:1155). Own try/catch — comment bookkeeping must never fail the dismiss.
+    try { clearPendingCardComments(cardId); }
+    catch (e) { console.error('[diff-comments] dismiss cleanup failed:', e && e.message ? e.message : e); }
+    res.json({ block });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // /api/agents* -> agent registry + user-agent CRUD, delegated to
 // src/core/agent-store.mjs (layered builtin + ~/.worca-cc/agents user pairs).
 // GET returns palette render order (.order ascending) with origin stamped; the
 // client builds draggable pills (colored dot + displayName + icon) from this.
 // ---------------------------------------------------------------------------
-// Channel vocabulary for the UI editor/wizard: built-in CHANNEL_IDS first, then
-// every CUSTOM id any registry agent references (produces/consumes/
-// optionalConsumes/channelDefs[].id), appended sorted + deduped. Channels are an
-// open vocabulary — a closed list would silently strip custom ids on edit.
-function collectChannelIds(agents) {
-  const customs = new Set();
-  for (const a of Array.isArray(agents) ? agents : []) {
-    if (!a) continue;
-    const ids = [
-      ...(Array.isArray(a.produces) ? a.produces : []),
-      ...(Array.isArray(a.consumes) ? a.consumes : []),
-      ...(Array.isArray(a.optionalConsumes) ? a.optionalConsumes : []),
-      ...(Array.isArray(a.channelDefs) ? a.channelDefs.map((d) => d && d.id) : []),
-    ];
-    for (const id of ids) {
-      if (typeof id === 'string' && id && !CHANNEL_IDS.includes(id)) customs.add(id);
-    }
-  }
-  return [...CHANNEL_IDS, ...[...customs].sort()];
-}
 
 app.get('/api/agents', async (req, res) => {
   try {
@@ -2783,7 +4312,11 @@ app.get('/api/agents', async (req, res) => {
     // §6.6: workspace-only agents stay out of the Composer palette by default;
     // the Agents management view passes ?all=1 to see them too.
     const agents = isTruthy(req.query.all) ? all : all.filter((m) => m.scope !== 'workspace-only');
-    res.json({ agents, channels: collectChannelIds(all) });
+    // mockWriterRoles drives ONE select in the agent form. It is a CLOSED list
+    // (the mock switch in claude-runner.mjs), unlike the open channel vocabulary
+    // it replaces in Task 12: an unknown mockRole is dropped by the registry
+    // with a warning, never rejected.
+    res.json({ agents, mockWriterRoles: [...MOCK_WRITER_ROLES] });
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
@@ -2809,9 +4342,6 @@ function agentErrorStatus(code) {
 function startAgentGen(input) {
   const orch = createAgentGen({
     ...input,
-    // Same open vocabulary as GET /api/agents (callers pass the registry union);
-    // built-ins-only fallback keeps direct/_testing callers working.
-    channels: Array.isArray(input.channels) && input.channels.length ? input.channels : CHANNEL_IDS,
     claude: { permissionMode: 'acceptEdits', mock: isTruthy(process.env.WORCA_MOCK ?? process.env.ORCH_MOCK) },
   });
   // The engine mints its own genId (agen_<uuid>) and tags every emitted event
@@ -2862,7 +4392,7 @@ app.post('/api/agents/generate', async (req, res) => {
     const genId = startAgentGen({
       name, purpose: String(body.purpose || ''), details: String(body.details || ''),
       expectedBefore: pick(body.expectedBefore), expectedAfter: pick(body.expectedAfter),
-      userMarkdown, channels: collectChannelIds(allAgents),
+      userMarkdown,
     });
     res.json({ genId });
   } catch (err) {
@@ -3081,7 +4611,7 @@ app.post('/api/plugins/install', async (req, res) => {
       repoUrl: body.repoUrl.trim(), subdir, name: body.name.trim(), sha: body.sha.trim(), marketplace,
     });
     reloadChatWorkers(body.name.trim());
-    res.json(out); // { ok: true, inventory }
+    res.json(out); // { ok: true, inventory, warnings, ignored }
   } catch (err) {
     sendPluginError(res, err);
   }
@@ -3128,6 +4658,8 @@ app.delete('/api/plugins/:name', async (req, res) => {
   if (!name) return;
   const purge = isTruthy(req.query.purge) || !!(req.body && req.body.purge === true);
   try {
+    // uninstallPlugin also drops the plugin's source bindings (core-side, so
+    // the CLI's `worca plugin remove` clears them identically).
     await uninstallPlugin(name, { purge });
     reloadChatWorkers(name);
     res.json({ ok: true, purged: purge });
@@ -3165,17 +4697,38 @@ app.post('/api/plugins/:name/doctor', async (req, res) => {
 // GET /api/plugins/:name/config -> per-source schema + redacted values. Secrets
 // NEVER travel to the browser: redactedConfig replaces a stored secret with
 // { set: true } (§7.6).
+// ?profile=<id> selects which configuration to echo (multi-profile sources);
+// absent = the default bucket, which is all a single-profile source ever uses.
 app.get('/api/plugins/:name/config', (req, res) => {
   const name = requirePlugin(req, res);
   if (!name) return;
   const manifest = readInstalledManifest(name);
   if (!manifest) return res.status(409).json({ error: 'plugin manifest unreadable — run doctor' });
+  const wanted = typeof req.query.profile === 'string' && req.query.profile ? req.query.profile : null;
+  if (wanted && !isValidProfileId(wanted)) return badRequest(res, 'invalid profile id');
   try {
-    const sources = (manifest.taskSources || []).map((s) => ({
-      id: s.id,
-      schema: s.configSchema,
-      values: redactedConfig(name, s.configSchema),
-    }));
+    const profiles = listProfiles(name);
+    const sources = (manifest.taskSources || []).map((s) => {
+      // For a multi-profile source, "which profile" is a real choice: echo the
+      // requested one, else the first in the roster. A source with no profiles
+      // yet has nothing to show — the UI's move is "create one", not a form.
+      // A requested profile that is not in the roster is a caller error (a
+      // typo'd URL) — echoing an empty form for it would let a Save quietly
+      // create the typo as a real profile. Checked inside the map so the guard
+      // only fires for sources that use profiles at all.
+      if (s.multiProfile && wanted && !profiles.some((p) => p.id === wanted)) {
+        throw Object.assign(new Error(`plugin "${name}" has no profile "${wanted}"`), { code: 'BAD_REQUEST' });
+      }
+      const profile = s.multiProfile ? (wanted || profiles[0]?.id || null) : null;
+      return {
+        id: s.id,
+        schema: s.configSchema,
+        multiProfile: s.multiProfile === true,
+        profile,
+        profiles: s.multiProfile ? profiles : [],
+        values: s.multiProfile && !profile ? {} : redactedConfig(name, s.configSchema, profile),
+      };
+    });
     const channels = (manifest.chatChannels || []).map((c) => ({
       id: c.id,
       displayName: c.displayName,
@@ -3196,7 +4749,78 @@ app.get('/api/plugins/:name/config', (req, res) => {
   }
 });
 
-// PUT /api/plugins/:name/config { sourceId | channelId, values } ->
+// POST /api/plugins/:name/profiles { sourceId, id, label } — create (or relabel)
+// a profile of a multi-profile source. Creating a profile is deliberately
+// separate from saving into it: the roster entry must exist BEFORE the config
+// form has anything to write to.
+app.post('/api/plugins/:name/profiles', (req, res) => {
+  const name = requirePlugin(req, res);
+  if (!name) return;
+  const body = req.body || {};
+  const manifest = readInstalledManifest(name);
+  if (!manifest) return res.status(409).json({ error: 'plugin manifest unreadable — run doctor' });
+  const source = (manifest.taskSources || []).find((s) => s.id === body.sourceId);
+  if (!source) return badRequest(res, 'sourceId does not match a task source of this plugin');
+  if (!source.multiProfile) return badRequest(res, `task source "${source.id}" does not support profiles`);
+  if (!isValidProfileId(body.id)) {
+    return badRequest(res, 'profile id must be lowercase letters, digits and dashes');
+  }
+  // "default" is the implicit bucket every profile-less read/write shares
+  // (chat channels, model secrets, migrated legacy config). Enrolled in the
+  // roster it would become deletable like any member — and deleting it wipes
+  // that shared bucket. createProfile throws too; 400 with the reason here.
+  if (body.id === DEFAULT_PROFILE) {
+    return badRequest(res, `profile id "${DEFAULT_PROFILE}" is reserved — pick another name`);
+  }
+  try {
+    res.json({ ok: true, profile: createProfile(name, body.id, body.label) });
+  } catch (err) {
+    sendPluginError(res, err);
+  }
+});
+
+// DELETE /api/plugins/:name/profiles/:id?sourceId=… — drop a profile, its stored
+// config/secrets/state, and every project binding that named it (a binding
+// pointing at a deleted profile would otherwise resolve to nothing at run time).
+// Binding cleanup is PLUGIN-wide, not per-source: deleteProfile removes the
+// profile's buckets for the whole plugin, so a sibling source's binding naming
+// it would dangle just the same. sourceId is still required — it authorizes the
+// call against a source that actually uses profiles.
+app.delete('/api/plugins/:name/profiles/:id', (req, res) => {
+  const name = requirePlugin(req, res);
+  if (!name) return;
+  const manifest = readInstalledManifest(name);
+  if (!manifest) return res.status(409).json({ error: 'plugin manifest unreadable — run doctor' });
+  const sourceId = typeof req.query.sourceId === 'string' ? req.query.sourceId : '';
+  const sources = manifest.taskSources || [];
+  const source = sources.find((s) => s.id === sourceId) || (sources.length === 1 ? sources[0] : null);
+  if (!source) return badRequest(res, 'sourceId does not match a task source of this plugin');
+  // Mirror the POST guard: a single-profile source only has the implicit
+  // 'default' bucket, and deleting THAT would wipe its entire config/secrets/
+  // state. Same for ids not in the roster — deleteProfile would still drop
+  // whatever buckets happen to share the id (e.g. migrated legacy data under
+  // 'default'), so only roster members are deletable.
+  if (!source.multiProfile) return badRequest(res, `task source "${source.id}" does not support profiles`);
+  if (!isValidProfileId(req.params.id)) return badRequest(res, 'invalid profile id');
+  // Reserved even if a pre-reservation roster enrolled it: deleting "default"
+  // would strip the shared bucket (chat-channel config, model secrets,
+  // migrated legacy data) out of all three files.
+  if (req.params.id === DEFAULT_PROFILE) {
+    return badRequest(res, `profile id "${DEFAULT_PROFILE}" is reserved — it cannot be deleted`);
+  }
+  if (!listProfiles(name).some((p) => p.id === req.params.id)) {
+    return badRequest(res, `plugin "${name}" has no profile "${req.params.id}"`);
+  }
+  try {
+    deleteProfile(name, req.params.id);
+    const unbound = clearBindingsForProfile(name, req.params.id);
+    res.json({ ok: true, unbound });
+  } catch (err) {
+    sendPluginError(res, err);
+  }
+});
+
+// PUT /api/plugins/:name/config { sourceId | channelId, values, profile? } ->
 // writePluginConfig routes secret:true keys to data/secrets.json (0600,
 // atomic). Request values are NEVER logged and NEVER echoed back (the response
 // is a bare receipt). A channelId save also hot-restarts the channel worker.
@@ -3222,6 +4846,8 @@ app.put('/api/plugins/:name/config', (req, res) => {
     }
   }
   let schema;
+  let source = null;
+  let profile = null;
   if (typeof body.channelId === 'string' && body.channelId) {
     const channel = (manifest.chatChannels || []).find((c) => c.id === body.channelId);
     if (!channel) return badRequest(res, 'channelId does not match a chat channel of this plugin');
@@ -3231,12 +4857,22 @@ app.put('/api/plugins/:name/config', (req, res) => {
     const sourceId = typeof body.sourceId === 'string' && body.sourceId
       ? body.sourceId
       : (sources.length === 1 ? sources[0].id : '');
-    const source = sources.find((s) => s.id === sourceId);
+    source = sources.find((s) => s.id === sourceId);
     if (!source) return badRequest(res, 'sourceId does not match a task source of this plugin');
+    profile = typeof body.profile === 'string' && body.profile ? body.profile : null;
+    if (profile && !isValidProfileId(profile)) return badRequest(res, 'invalid profile id');
+    if (source.multiProfile && !profile) return badRequest(res, 'profile is required for this task source');
+    // Saves go only into EXISTING roster members — mirroring the GET guard,
+    // whose whole point is that a Save must not quietly mint a typo'd (or
+    // just-deleted) id as a real profile with secrets stored under it.
+    // Creation stays solely on POST /profiles.
+    if (source.multiProfile && !listProfiles(name).some((p) => p.id === profile)) {
+      return badRequest(res, `plugin "${name}" has no profile "${profile}" — create it first`);
+    }
     schema = source.configSchema;
   }
   try {
-    writePluginConfig(name, schema, body.values);
+    writePluginConfig(name, schema, body.values, profile);
     reloadChatWorkers(name);
     res.json({ ok: true });
   } catch (err) {
@@ -3261,7 +4897,84 @@ app.get('/api/plugins/:name/model-env', (req, res) => {
     if (typeof v === 'string') env[k] = v;
     else secretKeys.push(k);
   }
-  res.json({ id: model.id, label: model.label, efforts: model.efforts, env, secretKeys });
+  // `cost` rides along so "Edit a copy" starts from the plugin's pricing — a
+  // copy that silently dropped it would repay the CLI's by-name figure.
+  res.json({
+    id: model.id, label: model.label, efforts: model.efforts, env, secretKeys,
+    ...(model.cost ? { cost: model.cost } : {}),
+  });
+});
+
+// ---------------------------------------------------------------------------
+// /api/source-bindings -> which PROFILE of a task source a project/workspace
+// pulls from. Set once per project; every run then resolves it silently, which
+// is the point — a per-run dropdown is how you start a pipeline against the
+// wrong tracker without noticing (see src/core/source-bindings.mjs).
+// ---------------------------------------------------------------------------
+
+/** Shared scope parsing for the two binding routes. Accepts a project by key or
+ *  by path (the New Pipeline form knows the path, the Projects view the key). */
+function bindingScope(q = {}) {
+  const workspaceId = typeof q.workspaceId === 'string' && q.workspaceId.trim() ? q.workspaceId.trim() : '';
+  if (workspaceId) return { scopeType: 'workspace', scopeKey: workspaceId };
+  const key = typeof q.projectKey === 'string' && q.projectKey.trim() ? q.projectKey.trim() : '';
+  if (key) return { scopeType: 'project', scopeKey: key };
+  const dir = typeof q.projectDir === 'string' && q.projectDir.trim() ? q.projectDir.trim() : '';
+  if (dir) return { scopeType: 'project', scopeKey: projectKey(path.resolve(dir)) };
+  return null;
+}
+
+// GET /api/source-bindings?projectDir=…|projectKey=…|workspaceId=…
+//   [&plugin=&sourceId=] -> { bindings: [...] } or, when a source is named,
+//   the RESOLVED profile for it: { profile, via, candidates? }.
+app.get('/api/source-bindings', async (req, res) => {
+  const scope = bindingScope(req.query);
+  if (!scope) return badRequest(res, 'projectDir, projectKey or workspaceId is required');
+  const plugin = typeof req.query.plugin === 'string' ? req.query.plugin.trim() : '';
+  const sourceId = typeof req.query.sourceId === 'string' ? req.query.sourceId.trim() : '';
+  try {
+    if (!plugin || !sourceId) return res.json({ ...scope, bindings: listBindingsForScope(scope.scopeType, scope.scopeKey) });
+    // A workspace with no binding of its own inherits from its members when they
+    // agree, so the member keys have to be resolved before asking.
+    let memberKeys;
+    if (scope.scopeType === 'workspace') {
+      const ws = await readWorkspace(scope.scopeKey);
+      memberKeys = ws ? ws.projectKeys : [];
+    }
+    res.json({
+      ...scope,
+      ...resolveProfile({ ...scope, plugin, sourceId, memberKeys, available: listProfileIds(plugin) }),
+    });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// PUT /api/source-bindings { projectDir|projectKey|workspaceId, plugin,
+//   sourceId, profile } — profile:null clears the binding.
+app.put('/api/source-bindings', (req, res) => {
+  const body = req.body || {};
+  const scope = bindingScope(body);
+  if (!scope) return badRequest(res, 'projectDir, projectKey or workspaceId is required');
+  const plugin = typeof body.plugin === 'string' ? body.plugin.trim() : '';
+  const sourceId = typeof body.sourceId === 'string' ? body.sourceId.trim() : '';
+  if (!plugin || !sourceId) return badRequest(res, 'plugin and sourceId are required');
+  const ref = { ...scope, plugin, sourceId };
+  try {
+    if (body.profile === null || body.profile === '') {
+      clearBinding(ref);
+      return res.json({ ok: true, ...scope, profile: null });
+    }
+    if (!isValidProfileId(body.profile)) return badRequest(res, 'invalid profile id');
+    // Binding to a profile that does not exist would resolve to nothing at run
+    // time — reject it here, where the user can still see why.
+    if (!listProfileIds(plugin).includes(body.profile)) {
+      return badRequest(res, `plugin "${plugin}" has no profile "${body.profile}"`);
+    }
+    res.json({ ok: true, ...scope, profile: setBinding(ref, body.profile) });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
 });
 
 // ---------------------------------------------------------------------------
@@ -3303,8 +5016,21 @@ app.post('/api/sources/call', async (req, res) => {
     if (input && typeof input.optionsFrom === 'string' && input.optionsFrom) allowed.add(input.optionsFrom);
   }
   if (!allowed.has(op)) return badRequest(res, `op "${op}" is not allowed for this source`);
+  const profile = typeof body.profile === 'string' && body.profile ? body.profile : null;
+  if (profile && !isValidProfileId(profile)) return badRequest(res, 'invalid profile id');
+  if (source.multiProfile && !profile) return badRequest(res, 'profile is required for this task source');
+  // Same submit-time guards as /api/run: a deleted profile must 400 here, not
+  // fail deep in the connector against an empty bucket, and a profile on a
+  // single-profile source would read (and persist state into) a phantom
+  // bucket instead of the real config.
+  if (source.multiProfile && !listProfileIds(plugin).includes(profile)) {
+    return badRequest(res, `plugin "${plugin}" has no profile "${profile}"`);
+  }
+  if (!source.multiProfile && profile) {
+    return badRequest(res, `task source "${sourceId}" does not use profiles — omit profile`);
+  }
   try {
-    const result = await callSource({ plugin, sourceId, op, args });
+    const result = await callSource({ plugin, sourceId, op, args, profile });
     res.json({ ok: true, result });
   } catch (err) {
     if (err instanceof PluginOpError) {
@@ -3475,11 +5201,32 @@ app.post('/api/chat/test', async (req, res) => {
 app.use((req, res, next) => {
   if (req.method !== 'GET') return next();
   if (req.path.startsWith('/api/') || req.path.startsWith('/ws')) return next();
+  if (req.path === '/vendor' || req.path.startsWith('/vendor/')) return next();
   res.sendFile(path.join(PUBLIC_DIR, 'index.html'), (err) => {
     if (err) next();
   });
 });
 
+// ---------------------------------------------------------------------------
+// The LAST middleware, and the only GLOBAL error handler (`/vendor` keeps its
+// own path-scoped one): every failure answers { error } as JSON (MIN-108).
+// Without it express's default handler renders an HTML page carrying the thrown
+// stack — absolute node_modules paths included — for the two failures that happen
+// BEFORE any route runs: a malformed JSON body and a body past the cap. The
+// four-argument signature is what makes express treat this as an error handler,
+// so `next` stays even though only the headers-sent path uses it.
+// ---------------------------------------------------------------------------
+app.use((err, _req, res, next) => {
+  if (res.headersSent) return next(err);            // let express abort the stream
+  if (err && err.type === 'entity.parse.failed') return res.status(400).json({ error: 'malformed JSON body' });
+  if (err && err.type === 'entity.too.large') return res.status(413).json({ error: 'request body too large' });
+  // Anything else: honour a body-parser 4xx (charset.unsupported / encoding.unsupported
+  // are 415, request.aborted is 400) — a client error logged as a 500 misleads. Ours or
+  // not, it is one line, no stack, never HTML.
+  const status = Number.isInteger(err?.status) && err.status >= 400 && err.status < 500 ? err.status : 500;
+  return res.status(status).json({ error: err && err.message ? err.message : 'internal error' });
+});
+
 /**
  * Boot maintenance, in the PINNED order (§8.12):
  *   1. reconcileStaleRunning — stamps every stale `running` row -> `interrupted`,
@@ -3503,12 +5250,12 @@ app.use((req, res, next) => {
  * everything up to the first `await` — including the reconcile — still runs before
  * `server.listen`, exactly as it did when this was an inline block.
  *
- * @param {{log?: (scope:'run-root'|'legacy', level:string, msg:string) => void}} [args]
+ * @param {{log?: (scope:'run-root'|'legacy'|'ask-worktrees', level:string, msg:string) => void}} [args]
  *        optional sink for the per-candidate lines both sweeps emit; omitted, each
  *        sweep keeps its own console default.
  */
 export async function bootMaintenance({ log } = {}) {
-  const summary = { reconciled: 0, runRoots: null, legacy: null };
+  const summary = { reconciled: 0, sweptV1: 0, runRoots: null, legacy: null, ask: null, askWorktrees: null };
   const sink = (scope) => (typeof log === 'function' ? (level, msg) => log(scope, level, msg) : undefined);
 
   // Runs left 'running' by a previous process that died before writing a terminal
@@ -3521,6 +5268,16 @@ export async function bootMaintenance({ log } = {}) {
     console.error(`[worca-ui] stale-run reconcile failed: ${err && err.message ? err.message : err}`);
   }
 
+  // A DB stamped past 24 by a divergent ladder can still hold v1 resume points
+  // (crash-reconciled runs keep theirs). One idempotent sweep per boot.
+  try {
+    const swept = sweepV1Runs();
+    summary.sweptV1 = swept.length;
+    if (swept.length) console.log(`[worca-ui] retired ${swept.length} run(s) paused on the v1 engine`);
+  } catch (err) {
+    console.error(`[worca-ui] v1-run sweep failed: ${err && err.message ? err.message : err}`);
+  }
+
   try {
     const r = await sweepRunRoots({
       worcaHome: worcaHome(), ...runRootSweepLookups(), log: sink('run-root'),
@@ -3562,6 +5319,34 @@ export async function bootMaintenance({ log } = {}) {
   } catch (err) {
     console.error(`[worca-ui] legacy worktree sweep failed: ${err && err.message ? err.message : err} — nothing was removed`);
   }
+
+  // Ask Worca (§6.2): mark turns orphaned by a restart, sweep stale empty threads.
+  try {
+    const interrupted = sweepStreamingMessages();
+    const emptyThreads = sweepEmptyThreads();
+    summary.ask = { interrupted, emptyThreads };
+    if (interrupted || emptyThreads) {
+      console.log(`[worca-ui] ask sweep: ${interrupted} interrupted turn(s), ${emptyThreads} empty thread(s)`);
+    }
+  } catch (err) {
+    summary.ask = { interrupted: 0, emptyThreads: 0 };
+    console.error(`[worca-ui] ask sweep failed: ${err && err.message ? err.message : err}`);
+  }
+
+  // Ask worktrees (P4 §5): reconcile ask_worktrees rows vs on-disk checkouts
+  // both ways. Three-state inside the sweep: a DB failure aborts with nothing
+  // removed. `sink('ask-worktrees')` is undefined on a log-less boot, which is
+  // exactly the sweep's own default — never call sink(...) directly.
+  try {
+    const r = await sweepAskWorktrees({ log: sink('ask-worktrees') });
+    summary.askWorktrees = r;
+    if (r.removedDirs || r.prunedRows) {
+      console.log(`[worca-ui] ask-worktree sweep: removed ${r.removedDirs} orphan dir(s), dropped ${r.prunedRows} stale row(s)`);
+    }
+    if (r.failed) console.error(`[worca-ui] ask-worktree sweep: ${r.failed} candidate(s) skipped`);
+  } catch (err) {
+    console.error(`[worca-ui] ask-worktree sweep failed: ${err && err.message ? err.message : err}`);
+  }
   return summary;
 }
 
@@ -3606,4 +5391,9 @@ if (isMain) {
 }
 
 export { app, server, runs };
-export const _testing = { wireRun, wireScan, summarizeRuns, startScan, wireAgentGen, startAgentGen, chatActions, chatRouter, channelHost, handleChatInbound, enqueueChatWork, chatNotifier, resumeRun };
+export const _testing = {
+  wireRun, wireScan, summarizeRuns, startScan, wireAgentGen, startAgentGen,
+  chatActions, chatRouter, channelHost, handleChatInbound, enqueueChatWork,
+  chatNotifier, resumeRun, resolveHljsAssets, resolveEsmAsset, askJobs, askFollowers, askDeleting, resolveAskContext, flipCard,
+  emitDiffCommentsChanged, emitAskWorktrees, askWorktreesEnvelope, deleteAskThreadFully,
+};