flowviant 0.103.0 → 0.104.0

package/bin/lib/workPreviews.mjs

@@ -1,13 +1,17 @@
 /** Session preview claims, tunnels, and retirement. */
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { isSafePathSegment } from './git.mjs';
-import { originFor } from './listeners.mjs';
-import { openTunnel } from './preview.mjs';
+import { originFor as measuredOrigin } from './listeners.mjs';
+import { openTunnel as openLiveTunnel } from './preview.mjs';
 import { note } from './ui.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
 
-export function createWorkPreviews({ placeDir }) {
-  const PREVIEW_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-done');
-  const PREVIEW_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/preview-claim');
+/** `originFor` and `openTunnel` are injectable only so the lane can be driven
+ *  without a dev server or cloudflared (workPreviews.test.mjs); work.mjs passes
+ *  neither. */
+export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openTunnel = openLiveTunnel }) {
+  const PREVIEW_DONE_URL = fleetEndpoint('preview-done', FLEET_URL);
+  const PREVIEW_CLAIM_URL = fleetEndpoint('preview-claim', FLEET_URL);
 
   // ── SESSION PREVIEWS ──────────────────────────────────────────────────────
   //
@@ -96,7 +100,19 @@ export function createWorkPreviews({ placeDir }) {
     // the component that can be published ahead of a deploy.) A stop for a
     // tunnel whose daemon crashed resolves server-side: an unanswered 'ending'
     // row reads as over once it goes stale.
-    if (live) await postPreview({ sessionId, ended: true, endedReason: reason });
+    //
+    // The ended report names the SHARE it ends (F017, 2026-09-26): a stop
+    // confirm without one could end a replacement share opened on the same
+    // session in the meantime, and the server checks the id when it is
+    // present. A daemon→server report field, so no floor; absent when the
+    // live entry was opened without one (an older server), the old rule.
+    if (live)
+      await postPreview({
+        sessionId,
+        ended: true,
+        endedReason: reason,
+        ...(live.shareId ? { shareId: live.shareId } : {}),
+      });
   };
 
   const processPreviewJobs = (jobs) => {
@@ -164,11 +180,17 @@ export function createWorkPreviews({ placeDir }) {
           // importantly, checking `originFor` again is what keeps the answer
           // to "whose port is this" on the machine that can actually see it —
           // the same rule the gate itself dials by (below).
-          const measured = !originFor(wt, port).error;
-          if (!measured) {
+          //
+          // The refusal is RELAYED in originFor's own words (review 2026-09-26,
+          // F007): "nothing is listening" is only one of its answers, and
+          // posting that sentence for a contested address or a walk that could
+          // not reach the holder told the person a measured absence the
+          // machine never measured. A wire string, not a field — no floor.
+          const refusal = originFor(wt, port).error;
+          if (refusal) {
             await postPreview({
               sessionId,
-              error: `nothing is listening on port ${port} in this worktree.`,
+              error: refusal,
               ...(shareId ? { shareId } : {}),
             });
             return;

package/bin/lib/workProcesses.mjs

@@ -4,12 +4,11 @@ import { isSafePathSegment } from './git.mjs';
 import { measureListeners } from './listeners.mjs';
 import { measureProcesses, liveGroups, processesSupported } from './processes.mjs';
 import { processAlive } from './procRegistry.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
 
-export function createWorkProcesses({ placeDir, reportPlaceWorktrees, state }) {
-  const KILL_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/kill-done');
-  const KILL_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/kill-claim');
-
-  const { sessionGroups } = state;
+export function createWorkProcesses({ placeDir, reportPlaceWorktrees, sessionGroups }) {
+  const KILL_DONE_URL = fleetEndpoint('kill-done', FLEET_URL);
+  const KILL_CLAIM_URL = fleetEndpoint('kill-claim', FLEET_URL);
 
   // ── stopping one measured process ────────────────────────────────────────
   //

package/bin/lib/workPullRequests.mjs

@@ -1,19 +1,30 @@
-/** Session pull-request claims, publishing, and merges. */
+/**
+ * Session pull-request claims, publishing, and merges.
+ *
+ * What is the SESSION's lives here: the lease, which branch a session's job
+ * pushes (its worktree's HEAD, never base, never detached), and the words each
+ * outcome settles with. The GitHub rules themselves — adopt only an open PR
+ * into base, `--fill`, `--merge`, verify the tip — are `prWorkflow.mjs`'s,
+ * shared with the agent approve path.
+ */
 import { existsSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { git, gitNet as gitNetIn, baseBranchName, isSafePathSegment } from './git.mjs';
-
-export const ghFirstLine = (e) =>
-  ((e?.stderr?.toString?.() || e?.message || 'failed').split('\n').find((l) => l.trim()) ||
-    'failed')
-    .slice(0, 400);
-export const PR_URL_RE = /^https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+$/;
+import {
+  ensureOpenPr,
+  findOpenPr,
+  ghFirstLine,
+  ghReady,
+  mergeAndVerifyTip,
+  PR_URL_RE,
+  prTargetsOtherBase,
+} from './prWorkflow.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
+import { REPO_PLACE } from './workPlaces.mjs';
 
 export function createWorkPullRequests({
   placeOf,
-  REPO_PLACE,
   repoRoot,
   baseDir,
   baseRef,
@@ -21,14 +32,14 @@ export function createWorkPullRequests({
   landed,
   onRepoChanged,
 }) {
-  const PR_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/pr-claim');
-  const PR_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/pr-done');
+  const PR_CLAIM_URL = fleetEndpoint('pr-claim', FLEET_URL);
+  const PR_DONE_URL = fleetEndpoint('pr-done', FLEET_URL);
 
   // ── PR-mode jobs (projects.mergeMode === 'pr') ──────────────────────────
   // 'open' = push the session's branch and open a PR; 'merge' = merge it.
   // Both under the operator's own `gh` credential from the daemon's inherited
   // env — the same posture the dispatch-era merge path took, and the same one
-  // claude.mjs documents for turns. LEASED like a kill: two daemons pushing
+  // runTurn.mjs documents for turns. LEASED like a kill: two daemons pushing
   // one branch would open two PRs. NOTHING here closes a card — done is
   // observed by the landed walk when the merge reaches base.
   const prWorking = new Set();
@@ -72,25 +83,14 @@ export function createWorkPullRequests({
     // gh present and authenticated, or the honest 'unsupported' — its own
     // outcome because "the machine cannot do this at all" and "GitHub said
     // no" read differently to the person who asked.
-    try {
-      // TIMED OUT, like every other `gh` call. `execFileSync` blocks the whole
-      // event loop, so a hung `gh` — an expired token whose refresh hits a
-      // black hole, a credential helper waiting on a keyring prompt that has
-      // no terminal — stops the roster poll, every in-flight settle, the
-      // worktree sweep and the deploy heartbeat (whose 3-minute staleness
-      // window then re-queues a deploy this daemon is still running). The
-      // AGENT merge path was given exactly these timeouts in 0.77.1; this
-      // copy, forty lines of the same logic, was missed.
-      execFileSync('gh', ['auth', 'status'], {
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 20_000,
-      });
-    } catch (e) {
-      const missing = e?.code === 'ENOENT';
+    // TIMED OUT, like every other `gh` call (prWorkflow.mjs says why: a hung
+    // `gh` blocks the roster poll, every settle and the deploy heartbeat).
+    const ghDown = ghReady();
+    if (ghDown) {
       await settlePr({
         id,
         outcome: 'unsupported',
-        detail: missing
+        detail: ghDown.missing
           ? 'the GitHub CLI (gh) is not installed on this machine'
           : 'gh is not authenticated on this machine — run `gh auth login` there',
       });
@@ -134,38 +134,11 @@ export function createWorkPullRequests({
       return;
     }
     const pushCwd = existsSync(wt) ? wt : repoRoot;
-    /** Adopt only an OPEN PR. gh's branch finder falls back to the most recent
-     *  MERGED/CLOSED PR when no open one exists, and adopting a dead PR turns
-     *  every later delivery on a long-lived session branch into a silent
-     *  black hole ('opened'/'merged' over work that never moves). */
-    /** …and ONLY ONE THAT TARGETS THE PROJECT'S BASE. A PR somebody opened by
-     *  hand into another branch (`staging`, to try it there) was adopted as
-     *  this delivery's PR, and Approve then merged the unreviewed branch INTO
-     *  that branch — the ancestry check afterwards blamed "an older PR". The
-     *  agent merge path has refused this since it shipped; this is the same
-     *  guard, measured the same way: refused only on a MEASURED mismatch, an
-     *  absent field adopts as before. Returns `{ url, base }` or null. */
-    const openPr = () => {
-      try {
-        const j = JSON.parse(
-          execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state,baseRefName'], {
-            cwd: repoRoot,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            timeout: 30_000,
-          }).toString()
-        );
-        if (j?.state !== 'OPEN' || typeof j?.url !== 'string') return null;
-        return {
-          url: j.url.trim(),
-          base: typeof j?.baseRefName === 'string' ? j.baseRefName : null,
-        };
-      } catch {
-        return null; // no PR for the branch at all
-      }
-    };
-    const otherBase = (pr) =>
-      pr && pr.base && pr.base !== baseName
-        ? `the open pull request for ${branch} targets ${pr.base}, not ${baseName} — retarget or close it, then try again`
+    // A PR into another branch is refused, never adopted (prWorkflow.mjs) —
+    // in the session's words.
+    const otherBase = (target) =>
+      target
+        ? `the open pull request for ${branch} targets ${target}, not ${baseName} — retarget or close it, then try again`
         : null;
     if (job.kind !== 'merge') {
       // OPEN: push, then create — or adopt a PR already OPEN for the branch
@@ -176,51 +149,28 @@ export function createWorkPullRequests({
         await settlePr({ id, outcome: 'failed', detail: ghFirstLine(e) });
         return;
       }
-      const existing = openPr();
-      const wrongBase = otherBase(existing);
-      if (wrongBase) {
-        await settlePr({ id, outcome: 'failed', detail: wrongBase });
+      const pr = ensureOpenPr(branch, baseName, { cwd: repoRoot });
+      if (pr.wrongBase || pr.error) {
+        await settlePr({ id, outcome: 'failed', detail: otherBase(pr.wrongBase) ?? pr.error });
         return;
       }
-      let url = existing?.url ?? null;
-      if (!url) {
-        try {
-          const out = execFileSync(
-            'gh',
-            // `--fill` titles the PR from the branch's own commits — no model
-            // call, nothing invented. baseBranchName, not baseRef: gh 422s on
-            // a remote-tracking name like origin/main.
-            ['pr', 'create', '--head', branch, '--base', baseName, '--fill'],
-            { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
-          )
-            .toString()
-            .trim();
-          url = out.split('\n').filter(Boolean).pop() ?? null;
-        } catch (e) {
-          await settlePr({ id, outcome: 'failed', detail: ghFirstLine(e) });
-          return;
-        }
-      }
       await settlePr({
         id,
         outcome: 'opened',
-        ...(url && PR_URL_RE.test(url) ? { prUrl: url } : {}),
+        ...(pr.url && PR_URL_RE.test(pr.url) ? { prUrl: pr.url } : {}),
       });
       return;
     }
     // MERGE: push FIRST — GitHub merges the REMOTE PR tip, and the quiz the
     // reviewer just passed fingerprinted the LOCAL worktree, so merging
     // without a push would land a stale tip while the observer closed the
-    // cards over commits that never reached base. Then a MERGE COMMIT, never
-    // squash and never rebase — the cards' receipts are commit shas, and a
-    // squash rewrites them off base, which would orphan every receipt AND
-    // blind the landed walk's trailer read.
+    // cards over commits that never reached base.
     // No --delete-branch: the local branch may be a live worktree's HEAD.
     // THE BASE IS RE-ASKED BEFORE THE MERGE, never trusted from the open step:
     // somebody can retarget a PR between Deliver and Approve, and `gh pr merge
     // <branch>` merges whichever open PR the branch has, into whatever it
     // targets now.
-    const wrongBase = otherBase(openPr());
+    const wrongBase = otherBase(prTargetsOtherBase(findOpenPr(branch, { cwd: repoRoot }), baseName));
     if (wrongBase) {
       await settlePr({ id, outcome: 'failed', detail: wrongBase });
       return;
@@ -231,24 +181,8 @@ export function createWorkPullRequests({
       await settlePr({ id, outcome: 'failed', detail: ghFirstLine(e) });
       return;
     }
-    try {
-      execFileSync('gh', ['pr', 'merge', branch, '--merge'], {
-        cwd: repoRoot,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 120_000,
-      });
-    } catch (e) {
-      const line = ghFirstLine(e);
-      if (!/already merged/i.test(line)) {
-        await settlePr({ id, outcome: 'failed', detail: line });
-        return;
-      }
-    }
-    // VERIFY before settling 'merged': modern gh exits 0 on an
-    // already-MERGED PR, so a dead PR from an earlier delivery reads as
-    // success while this branch's newest commits sit unmerged. The branch
-    // tip being an ancestor of base is the fact 'merged' claims — check it,
-    // with one short retry for the fetch racing GitHub's merge commit.
+    // The tip is the LOCAL branch — the state the reviewer approved and the
+    // push just sent; GitHub's merge does not move it.
     const tipSha = (() => {
       try {
         return git(['rev-parse', branch], pushCwd);
@@ -256,26 +190,18 @@ export function createWorkPullRequests({
         return null;
       }
     })();
-    const tipOnBase = () => {
-      if (!tipSha) return false;
-      try {
-        git(['merge-base', '--is-ancestor', tipSha, baseRef()], repoRoot);
-        return true;
-      } catch {
-        return false;
-      }
-    };
-    let merged = false;
-    for (let attempt = 0; attempt < 2 && !merged; attempt++) {
-      if (attempt > 0) await new Promise((r) => setTimeout(r, 2000));
-      try {
-        gitNet(['fetch', 'origin', '--quiet'], 60_000);
-      } catch {
-        /* offline — the check below answers from what we have */
-      }
-      merged = tipOnBase();
+    const merged = await mergeAndVerifyTip(branch, {
+      cwd: repoRoot,
+      tip: tipSha,
+      baseRef,
+      repoRoot,
+      fetchOrigin: () => gitNet(['fetch', 'origin', '--quiet'], 60_000),
+    });
+    if (merged.error) {
+      await settlePr({ id, outcome: 'failed', detail: merged.error });
+      return;
     }
-    if (!merged) {
+    if (merged.notOnBase) {
       await settlePr({
         id,
         outcome: 'failed',

package/bin/lib/workReportQueue.mjs

@@ -0,0 +1,254 @@
+/**
+ * EVERY TURN SETTLES — the settle POSTs, the in-memory queue of reports that
+ * could not be delivered yet, their per-poll retry and reject backoff, and
+ * what a delivered ship report sets off.
+ *
+ * Split out of work.mjs (2026-09-26, SOLID F037). The queue is the skip-guard
+ * that stops a side-effecting turn being re-run over a dropped 200, so its
+ * delivery rules (ok / terminal / reject / retry) have exactly one home; the
+ * session lane settles through `settleWorkTurn`, the ship lane through
+ * `settleShip`, and the plan and check lanes through `postBestEffort`. The
+ * attempts counter is the session lane's, handed in by name, because a
+ * terminal delivery is what may forget it.
+ */
+import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { git } from './git.mjs';
+import { sweepMergedBranch } from './shipSweep.mjs';
+import { note } from './ui.mjs';
+import { fleetEndpoint } from './fleetWire.mjs';
+
+export function createWorkReportQueue({
+  repoRoot,
+  baseRef,
+  workAttempts,
+  artifacts,
+  landed,
+  onRepoChanged,
+  reportPlaceWorktrees,
+  burstListeners,
+}) {
+  const WORK_DONE_URL = fleetEndpoint('work-turn-done', FLEET_URL);
+  const SHIP_DONE_URL = fleetEndpoint('ship-done', FLEET_URL);
+  /**
+   * EVERY turn settles — the work loop's prime contract. A pending turn nobody
+   * answers holds one of the tab's slots until the server expires it (24h);
+   * silence is the worst outcome. So a report that cannot be DELIVERED right
+   * now is queued in memory and retried at the top of every poll, and a turn
+   * whose finished answer sits in that queue is never re-run — a session turn
+   * has side effects (edits, commits, cards), and a dropped 200 must not apply
+   * them twice.
+   */
+  const pendingWorkReports = new Map(); // turnId -> work-turn-done body
+  const pendingShipReports = new Map(); // sessionId -> ship-done body
+  /** POST a settle body. Four outcomes, and the split between the last two is
+   *  load-bearing:
+   *   - 'ok' — delivered.
+   *   - 'terminal' — the EXPLICIT per-endpoint statuses under which the server
+   *     will never re-offer the job (403 not this fleet's session, 404 unknown
+   *     turn, 409 ship already settled). Only these may drop the report AND
+   *     the attempts counter: they are the statuses where forgetting is safe
+   *     because the job is gone server-side too.
+   *   - 'reject' — any OTHER 4xx (a 400 from deploy skew, an edge/WAF rule):
+   *     the server refused this BODY, but the job row may still be pending and
+   *     riding every poll. The report must stay QUEUED — it is the skip-guard
+   *     that stops the turn being re-run with all its side effects — but
+   *     re-POSTing a body the server just refused every poll is spam, so
+   *     delivery backs off. Treating this as terminal once re-ran whole
+   *     non-idempotent CLI turns in a loop; treating it as plain retry
+   *     hammered a refused body forever.
+   *   - 'retry' — network errors, 408, 429 and 5xx: nothing was decided. */
+  const postSettle = async (url, body, terminalStatuses) => {
+    try {
+      const res = await fetch(url, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(30_000),
+        body: JSON.stringify(body),
+      });
+      if (res.ok) return 'ok';
+      if (terminalStatuses.includes(res.status)) return 'terminal';
+      if (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
+        return 'reject';
+      return 'retry';
+    } catch {
+      return 'retry';
+    }
+  };
+
+  /** Retry-After, in ms — seconds or an HTTP-date — capped so one bad or
+   *  hostile header cannot stall a caller for an hour. Falls back to the
+   *  caller's own backoff when the header is absent or unparseable. */
+  const retryAfterMs = (res, fallbackMs) => {
+    const h = res?.headers?.get?.('retry-after');
+    if (h == null) return fallbackMs;
+    const secs = Number(h);
+    if (Number.isFinite(secs)) return Math.max(0, Math.min(secs * 1000, 60_000));
+    const at = Date.parse(h);
+    return Number.isFinite(at) ? Math.max(0, Math.min(at - Date.now(), 60_000)) : fallbackMs;
+  };
+
+  /**
+   * A best-effort settle POST, AWAITED INLINE by a caller with no per-poll
+   * queue of its own to retry from — unlike `postSettle` above, whose callers
+   * requeue a 'retry'/'reject' outcome themselves. Bounded attempts: 408/429
+   * retry honouring Retry-After, 5xx retries on a short fixed backoff, and
+   * any OTHER 4xx is the server's considered answer — retrying it would just
+   * spend the same refusal again, so it counts as delivered, the existing
+   * trace convention. A network error retries the same way and is then
+   * swallowed: unsettled, and the server expires the job so the asker is
+   * told, never spun.
+   */
+  const postBestEffort = async (url, body, { attempts = 4, timeoutMs = 30_000 } = {}) => {
+    for (let i = 0; i < attempts; i += 1) {
+      let res;
+      try {
+        res = await fetch(url, {
+          method: 'POST',
+          headers: {
+            Authorization: `Bearer ${FLEET_TOKEN}`,
+            'User-Agent': USER_AGENT,
+            'Content-Type': 'application/json',
+          },
+          signal: AbortSignal.timeout(timeoutMs),
+          body: JSON.stringify(body),
+        });
+      } catch {
+        if (i === attempts - 1) return false;
+        await new Promise((r) => setTimeout(r, 2_000 * (i + 1)));
+        continue;
+      }
+      if (res.ok) return true;
+      if (res.status === 408 || res.status === 429) {
+        if (i === attempts - 1) return false;
+        await new Promise((r) => setTimeout(r, retryAfterMs(res, 2_000 * (i + 1))));
+        continue;
+      }
+      if (res.status >= 500) {
+        if (i === attempts - 1) return false;
+        await new Promise((r) => setTimeout(r, 2_000 * (i + 1)));
+        continue;
+      }
+      return true; // any other 4xx — the server's considered answer
+    }
+    return false;
+  };
+
+  /** How long a REJECTED report sits out before re-offering its body — long
+   *  enough that a deploy-skew 400 costs a handful of POSTs a day, short
+   *  enough that a server fix picks the report up the same morning. */
+  const REJECT_RETRY_MS = 10 * 60 * 1000;
+  const reportBackoff = new Map(); // turnId|sessionId -> earliest next attempt
+  const settleWorkTurn = async (turnId, payload) => {
+    const body = { turnId, ...payload };
+    const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
+    if (r === 'retry' || r === 'reject') {
+      pendingWorkReports.set(turnId, body);
+      if (r === 'reject') reportBackoff.set(turnId, Date.now() + REJECT_RETRY_MS);
+    } else {
+      pendingWorkReports.delete(turnId);
+      workAttempts.delete(turnId);
+      reportBackoff.delete(turnId);
+    }
+    return r;
+  };
+  const settleShip = async (sessionId, payload) => {
+    const body = { sessionId, ...payload };
+    const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
+    if (r === 'retry' || r === 'reject') {
+      pendingShipReports.set(sessionId, body);
+      if (r === 'reject') reportBackoff.set(sessionId, Date.now() + REJECT_RETRY_MS);
+    } else {
+      pendingShipReports.delete(sessionId);
+      reportBackoff.delete(sessionId);
+      // The report has landed, so the idempotency path no longer needs the
+      // branch to exist. See `sweepMergedSessionBranch`.
+      sweepMergedSessionBranch(sessionId);
+      // AND THE DIFFSTAT IS NOW WRONG BY DEFINITION. A ship folds base in,
+      // merges the tip out and deletes the branch, so a fresh measurement reads
+      // `ahead: 0` with an empty diffstat — and without this the rail keeps
+      // rendering the ENTIRE pre-ship diff while the transcript two hundred
+      // pixels away says "Shipped to main". The ship button re-arms over a
+      // branch that is already merged. Same rule the kill path just learned:
+      // an action that changes what the machine would measure must cause a new
+      // measurement, and the 60s sweep is not that.
+      void reportPlaceWorktrees(sessionId).catch(() => {});
+      burstListeners(sessionId);
+      // …and the REPO picture changed too: the session branch is gone and base
+      // moved. Without this the Repository block keeps counting a branch the
+      // ship just deleted.
+      onRepoChanged();
+      // The ship's push moved the local origin/<base> ref — observe now, so
+      // the landed report (and anything trailered a ship carried) lands on
+      // this beat rather than the next 3-minute fetch.
+      void landed.observe().catch(() => {});
+    }
+    return r;
+  };
+
+  /** See `shipSweep.mjs`. Bound to this manager's repo, base and report queue. */
+  const sweepMergedSessionBranch = (sessionId) =>
+    sweepMergedBranch(sessionId, {
+      git,
+      repoRoot,
+      baseRef: baseRef(),
+      note,
+      // The report queue is consulted at CALL time, never captured — a sweep
+      // scheduled while a report was outstanding must still see it land.
+      isReportPending: (id) => pendingShipReports.has(id),
+    });
+
+  let flushingReports = false;
+  const flushWorkReports = async () => {
+    // Held artifact uploads ride this beat too — the settle retry's own shape —
+    // and are never awaited: a readout's retry must not hold a settle's.
+    void artifacts.retryPending().catch(() => {});
+    if (flushingReports) return;
+    if (pendingWorkReports.size === 0 && pendingShipReports.size === 0) return;
+    flushingReports = true;
+    try {
+      for (const [id, body] of [...pendingWorkReports]) {
+        // A rejected body sits out its backoff; the queued entry itself stays
+        // — it is the skip-guard against re-running a turn whose side effects
+        // already happened.
+        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
+        const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
+        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
+        else if (r !== 'retry') {
+          pendingWorkReports.delete(id);
+          workAttempts.delete(id);
+          reportBackoff.delete(id);
+        }
+      }
+      for (const [id, body] of [...pendingShipReports]) {
+        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
+        const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
+        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
+        else if (r !== 'retry') {
+          pendingShipReports.delete(id);
+          reportBackoff.delete(id);
+          // Delivered late is still delivered — same sweep as the immediate
+          // path, and it must be here too or a report that needed a retry
+          // would leave its branch behind forever.
+          sweepMergedSessionBranch(id);
+        }
+      }
+    } finally {
+      flushingReports = false;
+    }
+  };
+
+  return {
+    pendingWorkReports,
+    pendingShipReports,
+    postBestEffort,
+    REJECT_RETRY_MS,
+    settleWorkTurn,
+    settleShip,
+    flushWorkReports,
+    sweepMergedSessionBranch,
+  };
+}