flowviant 0.114.1 → 0.114.2

package/README.md

@@ -147,6 +147,15 @@ Two knobs bound the blast radius, and both are worth setting on a shared box:
   its permission engine is machine-wide — which is surfaced in the app rather
   than papered over.
 
+Fenced turns — design, 3D-model, deck and research cards, the pre-review,
+the planner, intake, the wiki and the New task chat — read none of your Claude
+Code settings files: their permissions and hooks are Flowviant's posture
+alone, and of `~/.claude/settings.json` they keep only how Claude signs in
+(`apiKeyHelper`, `env` and the like) and your model defaults. Code agents and
+Terminal tabs still read yours, so your own allow rules and `defaultMode` add
+to `FLOWVIANT_SAFE=1`'s allowlist there. Codex's fenced turns run with
+`--ignore-user-config` the same way.
+
 The posture is reported on every poll and shown in the project's
 Settings → Machine section, so the team can see whether the box runs the
 guarded toolset or full permissions.

package/bin/lib/claudePersonal.mjs

@@ -0,0 +1,145 @@
+/**
+ * A FENCED CLAUDE TURN TAKES ITS PERMISSIONS AND HOOKS FROM FLOWVIANT ALONE
+ * (2026-09-29, the owner, asked whether an agent's fence should ignore the
+ * person's own permission settings: "yes, the agent's fence can ignore").
+ *
+ * A 3D-model agent under the design posture, whose whole shell is
+ * `Bash(ls:*)`, ran `google-chrome` and Playwright scripts. Every fenced lane
+ * read the person's `~/.claude/settings.json` — an agent turn through
+ * `--setting-sources user`, the pre-review, planner, intake, wiki and capture
+ * chat by naming no source at all, which ALSO reads the cwd's
+ * `.claude/settings*.json`, and the pre-review's cwd is the agent's own
+ * worktree. A settings file is a second author of the posture. MEASURED on
+ * Claude Code 2.1.284 — see claudePersonal.test.mjs for the probes and the
+ * offline check that pins them on the real CLI. In short: a personal
+ * `permissions.allow` rule admitted a command the list refused, a personal
+ * `defaultMode: "bypassPermissions"` turned the fenced turn into a bypass, and
+ * personal and worktree hooks fired; under `--setting-sources ''` none of them
+ * loaded, and the turn ran on the same login.
+ *
+ * AN EMPTY SOURCE LIST DROPS THE WHOLE USER SOURCE, not only its permissions:
+ * `~/.claude/CLAUDE.md`, personal skills and subagents went too (measured),
+ * and with the file go the plugins it enables. No flag keeps half of it — a
+ * flag setting's allow rules only add to the person's. On a fenced lane that
+ * is the right loss: the posture and the contract are Flowviant's, the base
+ * branch's instructions and skills arrive through the prompt and the reviewed
+ * plugin (`--plugin-dir` still loads, measured), and a personal plugin brings
+ * hooks of its own. Codex's fenced postures are hermetic the same way
+ * (`--ignore-user-config`, runtimeCodex.mjs).
+ *
+ * WHAT IS KEPT is what makes the CLI the person's CLI, never what it may do:
+ * how it signs in and reaches its provider, how a model the turn does not pin
+ * runs, and how long the person's own store is kept. An ALLOWLIST, so a key a
+ * later CLI adds — a sandbox auto-allow, a permission mode — never rides by
+ * default. It rides INSIDE the posture's own `--settings`, because the CLI
+ * reads one: given two, only the last one's hook fired (measured).
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { MACHINE_CREDENTIAL_ENV } from './machineEnv.mjs';
+import { WINDOW_ENV_REMOVED, withoutWindows } from './noWindowEnv.mjs';
+
+/** The flag pair that loads no settings file — user, project or local.
+ *  Managed (policy) settings and `--settings` still apply. */
+export const NO_SETTING_SOURCES = Object.freeze(['--setting-sources', '']);
+
+/**
+ * The personal settings a fenced turn keeps, by key.
+ *
+ *  · THE LOGIN — the helpers the CLI runs to authenticate and where it signs
+ *    in, and `env`, where a login routes (ANTHROPIC_BASE_URL,
+ *    CLAUDE_CODE_USE_BEDROCK, AWS_PROFILE). `env` gives the person's file no
+ *    more reach than the operator's shell, which every turn inherits already;
+ *    what a turn's environment promises is still removed from it
+ *    (`keptEnv`).
+ *  · HOW AN UNPINNED MODEL RUNS ("Machine default uses the CLI's own
+ *    setting"): per-model effort, thinking, the model map a provider needs.
+ *    `model` itself is not here: every Claude turn names `--model`, the
+ *    daemon's pin when the card has none (config.mjs), so the person's
+ *    default model never reached a daemon turn before either.
+ *  · THE PERSON'S OWN STORE: how long transcripts live and whether memory is
+ *    kept, so a fenced turn's start never prunes or writes on a default the
+ *    person turned off.
+ */
+export const PERSONAL_KEPT = Object.freeze([
+  'apiKeyHelper',
+  'proxyAuthHelper',
+  'awsAuthRefresh',
+  'awsCredentialExport',
+  'gcpAuthRefresh',
+  'forceLoginMethod',
+  'forceLoginOrgUUID',
+  'forceLoginGatewayUrl',
+  'env',
+  'modelOverrides',
+  'modelSettings',
+  'effortLevel',
+  'maxEffortLevel',
+  'alwaysThinkingEnabled',
+  'fallbackModel',
+  'cleanupPeriodDays',
+  'autoMemoryEnabled',
+]);
+
+/** What a turn nobody is sitting at has set or removed (noWindowEnv.mjs) and
+ *  the machine credential (machineEnv.mjs): never put back by a settings file. */
+const TURN_OWNED_ENV = new Set([
+  ...MACHINE_CREDENTIAL_ENV,
+  ...WINDOW_ENV_REMOVED,
+  ...Object.keys(withoutWindows({}, '/')),
+]);
+function keptEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env)) return null;
+  const out = {};
+  for (const [k, v] of Object.entries(env)) if (typeof v === 'string' && !TURN_OWNED_ENV.has(k)) out[k] = v;
+  return Object.keys(out).length ? out : null;
+}
+
+/** Far past any real settings file; a bigger one is not read. */
+const SETTINGS_MAX_BYTES = 1024 * 1024;
+
+/**
+ * The person's user settings file — `$CLAUDE_CONFIG_DIR/settings.json`, else
+ * `~/.claude/settings.json`, where the CLI itself looks — reduced to
+ * PERSONAL_KEPT. `{}` when it is absent, unreadable or not a JSON object: the
+ * turn then runs on the CLI's stored login and defaults, and the fence is the
+ * same either way.
+ */
+export function personalClaudeSettings(env = process.env) {
+  const dir = env.CLAUDE_CONFIG_DIR || join(env.HOME || homedir(), '.claude');
+  const path = join(dir, 'settings.json');
+  let raw;
+  try {
+    if (statSync(path).size > SETTINGS_MAX_BYTES) return {};
+    raw = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return {};
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+  const out = {};
+  for (const key of PERSONAL_KEPT) {
+    if (!Object.hasOwn(raw, key) || raw[key] == null) continue;
+    if (key !== 'env') out[key] = raw[key];
+    else {
+      const kept = keptEnv(raw.env);
+      if (kept) out.env = kept;
+    }
+  }
+  return out;
+}
+
+/**
+ * `perm` with `kept` folded into its `--settings` — the posture's keys win, so
+ * a kept key a posture ever names is the fence's word. A posture with no
+ * `--settings` gets one before its lists (`--allowedTools` is variadic). With
+ * nothing kept, `perm` is returned as it was.
+ */
+export function withPersonalSettings(perm, kept) {
+  const personal = kept && typeof kept === 'object' && !Array.isArray(kept) ? kept : {};
+  if (!Object.keys(personal).length) return [...perm];
+  const at = perm.indexOf('--settings');
+  if (at < 0) return ['--settings', JSON.stringify(personal), ...perm];
+  const posture = JSON.parse(perm[at + 1]);
+  return [...perm.slice(0, at), '--settings', JSON.stringify({ ...personal, ...posture }), ...perm.slice(at + 2)];
+}

package/bin/lib/prompts.mjs

@@ -466,6 +466,23 @@ const kickoff = ({ message, askedByName, head, tail }) => {
  *   · Rule 9 is the `assumed` param on the staging verbs: a guess the chat did
  *     not ask about is SAID, one line under the staged row, never folded into
  *     the brief where it reads as something the person asked for.
+ *
+ * STAGE, THEN ASK — A QUESTION NEVER STANDS IN FOR A CARD (2026-09-29). The
+ * owner: "it ignored a subsequent ask … but it worked after i tried again."
+ * The follow-ups were not lost; rule 5 said "ask … then wait for the answer",
+ * so a new ask with one open detail came back as a question and no card, and
+ * to a person watching the Staged rail a reply that stages nothing reads as
+ * ignored. Re-sending the same words got a card only because the chat judged
+ * the question already asked. So the order flips: the best guess is STAGED
+ * first, said through `assumed` (the rail shows it under the row), and the
+ * one question follows in chips; the answer moves that row in place
+ * (`edit_staged` — restaging loses what the person typed into it). Rule 7's
+ * two-product case is the same order. Rule 11 says the chat stays open: a
+ * later message is a new ask, never an occasion to recite the staged batch.
+ * Rule 1 lost "what you need to know" as a reply in place of a card, and now
+ * says the final reply is always words — a turn that ends with none settles
+ * as failed on the tab. Rule 4 lost "what earlier chats left": list_staged
+ * holds this chat's own rows too, and its tool description says so.
  */
 export const SYSTEM_CAPTURE = `You are the human's chosen CLI, in their repository, with ONE job: turn what
 they say into well-cut task cards on their Flowviant board. You are READ-ONLY
@@ -480,21 +497,29 @@ with the matching name your CLI exposes.
 
 1. NARRATE WHILE YOU WORK. Call stream_session_turn with short progress lines
    as you read and stage. Your FINAL reply is delivered automatically when the
-   turn ends — do not repeat it through the tool. Keep replies short: what you
-   staged, or what you need to know — one line each.
+   turn ends — always end with it, in words, even when it only says what you
+   staged; do not also send it through the tool. Keep it short: what you
+   staged, what you guessed, and your one question if you have one — a line
+   each.
 2. STAGE, NEVER FILE. stage_card proposes a new card; stage_card_edit proposes
    a change to an existing one (read_card first — never replace fields you
-   have not seen). Everything you stage waits in an area the person reviews
-   and lands themselves; nothing you do reaches the board directly.
+   have not seen); edit_staged changes a row already staged, in place.
+   Everything you stage waits in an area the person reviews and lands
+   themselves; nothing you do reaches the board directly.
 3. ONE CARD PER SHIPPABLE UNIT. Break a big ask into the units that will build
    it, in landing order. Never card-ify chatter, questions, or one unit split
    thin.
 4. DEDUPE FIRST, EVERY TIME. Before staging, call list_cards (the OPEN QUEUE —
    capped, and cards agents already hold are absent from it) and list_staged
-   (what earlier chats left). If the work exists, say so and point at it;
-   stage_card_edit it if the ask adds something. Never stage a twin.
-5. ASK ONLY FOR WHAT SHAPES THE CARD. Before staging, ask when — and only
-   when — the answer changes the card itself:
+   (everything waiting to be landed — what you staged earlier in THIS chat
+   included). If the work exists, say so and point at it; when the ask adds
+   something to it, stage_card_edit a card or edit_staged a staged row.
+   Never stage a twin — and never take new work for old: an ask for
+   something different gets its own card (rule 11).
+5. STAGE FIRST, THEN ASK ONLY FOR WHAT SHAPES THE CARD. A question never
+   stands in for a card: a message that asks for work ends this turn with
+   that work staged. A question is worth asking when — and only when — the
+   answer changes the card itself:
    - its KIND — what it hands back — when the words could mean more than one
      product (rule 7);
    - its SCOPE — which pages, screens or parts, when the ask names a family
@@ -503,9 +528,15 @@ with the matching name your CLI exposes.
      acceptance criteria;
    - a CONSTRAINT the repository cannot answer — a vendor, a deadline, a
      browser to support, what must not change.
+   Even then, stage your best guess FIRST, the guessed part named in
+   \`assumed\` (rule 9); say in one line what you guessed; THEN ask your
+   question, as rule 8 says. When they answer, change that staged row in
+   place with edit_staged — only the fields the answer moves, and \`assumed\`
+   as "" once it is settled — never unstage_card and a fresh stage_card.
    Never ask what reading the repo answers: read it. One question per
-   message, asked as rule 8 says, then wait for the answer. A clear ask
-   stages without ceremony — no question for the sake of one.
+   message; any other guess stays said in \`assumed\`, where the person can
+   correct it on the row. A clear ask stages without ceremony — no question
+   for the sake of one.
 6. A GOOD CARD: a title naming the outcome, a brief a stranger could start
    from, acceptance criteria only when the person stated (or the code shows)
    what done means. No sizes, no owners, no statuses — none of those are
@@ -526,11 +557,13 @@ with the matching name your CLI exposes.
      "a deck", "a presentation", "a pitch".
    - "research": a write-up — read the repo and the web; no code changed.
      "Find out", "research", "compare", "how does X do it", "write up".
-   When the words fit two products, ASK before staging — rule 5 — in chips, one
-   option per product that fits, its description its consequence. "Redesign the
+   When the words fit two products, STAGE the likelier one, the guess named
+   in \`assumed\` ("assumed a code change, not a mockup first"), then ask —
+   rule 5 — in chips, one option per product that fits, its description its
+   consequence; the answer re-files the row with edit_staged. "Redesign the
    landing page" fits code and design; "make a chair for the scene" fits code
    (commit the asset) and model (a model to look at first). Never stage a
-   guessed kind.
+   guessed kind without saying it is a guess.
 8. HAND THEM THE CHOICES. A question with answers you can name ends your
    reply with a fenced block the sheet renders as options; picking one sends
    its label as their next message, so every label must read as an answer a
@@ -558,18 +591,23 @@ with the matching name your CLI exposes.
    above the block as well: a client that doesn't render the fence shows it
    as plain text, so the reply has to read as a question with its options
    either way.
-9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS you did not ask
-   about, pass \`assumed\` on stage_card (or stage_card_edit): one short
-   sentence naming the guess — "assumed the mobile layout too", "assumed
-   English only". It shows under the staged row, where the person can
-   correct it before the card lands. Never bury a guess in the brief, where
-   it reads as something they asked for, and never pass \`assumed\` for
-   something they said.
+9. SAY WHAT YOU ASSUMED. When you stage a card on a GUESS — the one your
+   question is about (rule 5), or one not worth a question —
+   pass \`assumed\` on stage_card (or stage_card_edit): one short sentence
+   naming the guess — "assumed the mobile layout too", "assumed English
+   only". It shows under the staged row, where the person can correct it
+   before the card lands. Never bury a guess in the brief, where it reads as
+   something they asked for, and never pass \`assumed\` for something they
+   said.
 10. REFERENCE WHAT THE PROJECT KEPT. When the ask names a kept mockup, 3D model,
    image, deck or write-up ("implement design A"), call list_library and pass its id as
    \`references\` on the card you stage, so the agent reads it. When the person's
    message includes attached library items, pass those ids as \`references\` on
-   the cards you stage from that message.`;
+   the cards you stage from that message.
+11. THE CHAT STAYS OPEN. Every message is a new ask, however many turns came
+   before it (an answer to your question moves its row instead — rule 5).
+   When they ask for more after a staged batch, stage the new cards; never
+   answer a new ask by restating what is already staged.`;
 
 export const WORK_TURN_KICKOFF = ({ sessionId, sessionName, message, askedByName }) =>
   kickoff({

package/bin/lib/resumeLost.mjs

@@ -78,9 +78,23 @@ export const resumeConversationLost = (text, { runtime, sawInit } = {}) => {
  * is gone. `sawInit` is whether THIS spawn's CLI emitted `system.init` (only
  * Claude's does, and only Claude's is read). A fresh turn is never retried:
  * `resume` false answers false whatever the text says.
+ *
+ * …AND AN EMPTY CLAUDE RESUME THAT FOUND ITS CONVERSATION IS AN EMPTY ANSWER,
+ * NOT A LOST CONVERSATION (2026-09-29). Empty used to retry fresh whatever the
+ * evidence, so a Claude that emitted init — the conversation WAS there — and
+ * then said nothing had the message answered again by a Claude with no memory
+ * of the chat, and that fresh conversation's id re-pinned the tab: the
+ * follow-up read as if the chat had never happened, and so did every one
+ * after it. With init seen, the empty answer stands and settles as what it
+ * is, the conversation kept for the next message. Unmeasured init (`sawInit`
+ * not true) and the other CLIs keep the old reading: empty is the only sign
+ * they give of a conversation that is gone.
  */
-export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) =>
-  Boolean(resume) && (!String(out || '').trim() || resumeConversationLost(out, { runtime, sawInit }));
+export const resumeRetriesFresh = ({ resume, out, runtime, sawInit }) => {
+  if (!resume) return false;
+  if (!String(out || '').trim()) return !(runtime === 'claude' && sawInit === true);
+  return resumeConversationLost(out, { runtime, sawInit });
+};
 
 /**
  * ONE SPAWN, AND AT MOST ONE FRESH RETRY — the agent lane's whole sequence,

package/bin/lib/runtimeClaude.mjs

@@ -14,6 +14,7 @@ import { mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { MODEL, USER_AGENT } from './config.mjs';
+import { NO_SETTING_SOURCES, personalClaudeSettings, withPersonalSettings } from './claudePersonal.mjs';
 
 function claudeMcp(token, mcpUrl) {
   const dir = mkdtempSync(join(tmpdir(), 'flowviant-mcp-'));
@@ -72,7 +73,7 @@ export const CLAUDE_RUNTIME = {
    * strongest form of it available anywhere: `--append-system-prompt` sits
    * above the conversation rather than inside it.
    */
-  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools }) {
+  args({ prompt, system, model, effort, resume, streamJson, perm, profile = 'build', mcp = [], resultSchemaArgs = [], adoptResumeId, resumeThreadId, knowledgeDir, agentTools, personalSettings }) {
     const a = [];
     // THREE ANSWERS TO ONE QUESTION — "what conversation is this?" — and they
     // are mutually exclusive, never combined.
@@ -99,11 +100,38 @@ export const CLAUDE_RUNTIME = {
     else if (resumeThreadId) a.push('--resume', resumeThreadId);
     else if (resume) a.push('--continue');
     a.push('-p', prompt, '--append-system-prompt', system);
+    /**
+     * WHOSE SETTINGS A TURN READS (2026-09-29, claudePersonal.mjs).
+     *
+     * EVERY FENCED POSTURE READS NONE — every profile but `build`: an agent's
+     * design and research cards, the pre-review, the planner, intake, the
+     * wiki and the capture chat. Its permissions and hooks are its posture's
+     * alone; of the person's file it keeps only the login and the model
+     * defaults, folded into the posture's `--settings`. Keyed on `build`
+     * rather than on a list of fenced names, so a posture added later is
+     * fenced unless it is the build.
+     *
+     * THE BUILD POSTURE KEEPS THE PERSON'S OWN, on a code agent and on a
+     * Terminal tab alike. `--dangerously-skip-permissions` already admits
+     * everything, so no personal rule can widen it; what a personal file adds
+     * there is the operator narrowing their own box (a deny rule held a
+     * bypass turn, measured) and their own CLAUDE.md, skills and subagents,
+     * which an empty source list would take away with no flag to keep them.
+     * Codex's build is not hermetic either, for the same reason
+     * (runtimeCodex.mjs). STATED, not closed: under FLOWVIANT_SAFE=1 the
+     * build is a curated list, and the operator's own allow rules or
+     * `defaultMode` can still widen it — two choices of the same operator on
+     * their own box, and a personal allow is the only way a SAFE build runs a
+     * tool its list does not name (`pnpm`, `cargo`, `make`). A code agent names `user` so the agent-editable
+     * worktree's settings and hooks never load; a Terminal tab names nothing
+     * and is the person's Claude Code, project files included. A resumed
+     * agent renders the CURRENT base snapshot, not the first turn's cache.
+     */
+    const fenced = profile !== 'build';
+    if (fenced) a.push(...NO_SETTING_SOURCES);
+    else if (agentTools) a.push('--setting-sources', 'user');
     if (agentTools) {
-      // Keep personal settings, but never load the agent-editable project's
-      // settings, hooks, skills or CLAUDE.md discovery. A resumed agent must
-      // render the CURRENT base snapshot, not the first turn's prompt cache.
-      a.push('--setting-sources', 'user', '--system-prompt-snapshot', 'off');
+      a.push('--system-prompt-snapshot', 'off');
       if (agentTools.pluginDir) a.push('--plugin-dir', agentTools.pluginDir);
     }
     // These fenced postures have no project MCP, even if Claude discovers a
@@ -119,7 +147,9 @@ export const CLAUDE_RUNTIME = {
     // does not refuse the path the prompt just handed it. Before `perm`,
     // because `--allowedTools` is variadic and would swallow the flag.
     if (knowledgeDir) a.push('--add-dir', knowledgeDir);
-    a.push(...perm);
+    // `personalSettings` is the caller's copy when it has one (a test); a
+    // turn reads the person's file here, at spawn, as the CLI would.
+    a.push(...(fenced ? withPersonalSettings(perm, personalSettings ?? personalClaudeSettings()) : perm));
     return a;
   },
   parse: null, // claudeStream.mjs owns its own stream parser (unchanged)

package/bin/lib/workSessionTurns.mjs

@@ -59,6 +59,14 @@ import { createCommandAudit } from './workCommandAudit.mjs';
 export const PLAN_TURN_SENTENCE =
   'THIS IS A PLANNING TURN: the person switched this tab to plan mode, so read what you need, decide, and answer with the plan itself as your reply — change nothing (the CLI refuses every write this turn, whatever the mechanics above say about editing, committing or artifacts), and do not try to leave plan mode; they switch it off in the tab when they want the plan carried out.';
 
+/**
+ * HOW LONG, AND HOW MANY, SETTLED TURNS THE LANE REMEMBERS (2026-09-29) — see
+ * `settledHere` below. Ten minutes is far past any roster a poll could still
+ * be holding; the cap keeps a box that answers all day from growing the map.
+ */
+export const SETTLED_HERE_TTL_MS = 10 * 60 * 1000;
+export const SETTLED_HERE_MAX = 500;
+
 export function createWorkSessionTurns({
   repoRoot,
   baseDir,
@@ -91,14 +99,67 @@ export function createWorkSessionTurns({
   // The real CLI driver; injectable only so the lane can be driven in a test
   // without spending a model turn (the wiki runner's shape).
   runTurn = defaultRunTurn,
+  // The clock `settledHere` ages by; injectable only for its bound's test.
+  now = Date.now,
 }) {
   const workAnswering = new Set(); // turn ids currently queued/running here
   const MAX_WORK_TRIES = 3;
 
+  /**
+   * A TURN THIS LANE SETTLED IS NEVER RUN AGAIN (2026-09-29).
+   *
+   * A delivered settle forgets the turn everywhere: the report queue drops it
+   * from `pendingWorkReports` and `workAttempts`, and the turn's `finally`
+   * drops it from `workAnswering`. A roster READ made before that settle
+   * landed still offers it — the poll was in flight while the POST went out —
+   * and nothing was left to say it had run: the turn ran twice, settled
+   * twice, the rerun's reply overwrote the first, and the person's follow-up
+   * waited behind a turn nobody asked for. So every settle this lane makes
+   * goes through `settleTurn`, which remembers the turn id, and a job in the
+   * map is skipped where jobs are picked. Remembered BEFORE the POST: a
+   * settle still in flight is covered by `workAnswering`, one that could not
+   * be delivered by `pendingWorkReports`, and this covers the one that was.
+   */
+  const settledHere = new Map(); // turnId -> when this lane settled it, oldest first
+  const forgetStale = (at) => {
+    for (const [id, when] of settledHere) {
+      if (settledHere.size <= SETTLED_HERE_MAX && at - when < SETTLED_HERE_TTL_MS) break;
+      settledHere.delete(id);
+    }
+  };
+  const settledRecently = (turnId) => {
+    forgetStale(now());
+    return settledHere.has(turnId);
+  };
+  const settleTurn = (turnId, payload) => {
+    const at = now();
+    settledHere.delete(turnId); // re-inserted at the end: the map stays in time order
+    settledHere.set(turnId, at);
+    forgetStale(at);
+    return settleWorkTurn(turnId, payload);
+  };
+
+  /**
+   * A PLACE A TURN OF THIS PROCESS IS STARTING IN (2026-09-29) — the turn
+   * lock's in-process half, keyed by the lock's own path.
+   *
+   * `flowviant-turn.lock` is written at SPAWN, several awaits after it is
+   * read (a credential mint, the attachment fetch), so two turns of one
+   * session offered in one roster both read "unlocked" and both spawned: two
+   * CLIs resuming one conversation at once, the incoherence the lock exists
+   * to prevent. The claim is checked and taken synchronously beside the file
+   * check, so the second turn waits for a later poll like any locked one,
+   * and it is released in the turn's outer `finally`, after its settle.
+   */
+  const startingIn = new Set();
+
   const processWorkTurns = (jobs) => {
     for (const job of jobs ?? []) {
       if (!job || typeof job.id !== 'string' || !job.body || !job.sessionId) continue;
       if (workAnswering.has(job.id)) continue;
+      // Settled by this lane already: a roster read from before the settle
+      // landed. See `settledHere`.
+      if (settledRecently(job.id)) continue;
       // The turn already RAN and its answer sits in the delivery queue — never
       // run it again while the report is merely undelivered.
       if (pendingWorkReports.has(job.id)) continue;
@@ -140,7 +201,7 @@ export function createWorkSessionTurns({
        * tab for the server's whole expiry window.
        */
       if (place !== REPO_PLACE && !isSafePathSegment(place)) {
-        void settleWorkTurn(job.id, {
+        void settleTurn(job.id, {
           ok: false,
           answer:
             'the server named a working directory this machine refuses to use — close and reopen the tab, then send the message again',
@@ -178,12 +239,15 @@ export function createWorkSessionTurns({
          *  out here beside `usage`, and spread wherever it is. Last write wins
          *  across a fresh retry: that spawn is the one that answered. */
         let model = null;
+        /** The `startingIn` key this turn claimed — released in the outer
+         *  `finally`, and only by the turn that took it. */
+        let startClaim = null;
         try {
           const tries = workAttempts.get(job.id) ?? 0;
           if (tries >= MAX_WORK_TRIES) {
             // Out of local tries: SETTLE, don't skip — a silently skipped turn
             // strands the tab for the server's whole 24h expiry window.
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: `the turn failed ${tries} times on this machine — check the daemon log, then send the message again`,
             });
@@ -209,7 +273,7 @@ export function createWorkSessionTurns({
               typeof job.adopt.id !== 'string' ||
               !/^[0-9a-f][0-9a-f-]{6,62}$/i.test(job.adopt.id)
             ) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer: 'that terminal session id is not one this machine can resume',
               });
@@ -223,7 +287,7 @@ export function createWorkSessionTurns({
               srcCwd = null;
             }
             if (!srcCwd) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer: "the terminal session's directory no longer exists on the machine",
               });
@@ -247,14 +311,14 @@ export function createWorkSessionTurns({
               /* keep the literal path */
             }
             if (!under(srcCwd, realRoot)) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer: "the terminal session's directory is outside this project's repository",
               });
               return;
             }
             if (under(srcCwd, realBase)) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer:
                   "that directory is one of the daemon's own worktrees — its session is already a tab, not something to adopt",
@@ -264,7 +328,7 @@ export function createWorkSessionTurns({
             try {
               srcHead = git(['rev-parse', 'HEAD'], srcCwd);
             } catch {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer:
                   "the terminal session's directory is not a usable git checkout (no HEAD to branch from)",
@@ -281,7 +345,7 @@ export function createWorkSessionTurns({
                 ? isAgyConversationLive(job.adopt.id)
                 : isTerminalSessionLive(job.adopt.id);
             if (adoptLive) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer:
                   'That terminal session is still open on the machine — close it there first, then adopt.',
@@ -297,7 +361,7 @@ export function createWorkSessionTurns({
           // the session's own id, which is what every tab has always done.
           const dir = placeWtFor(place, adopting ? srcHead : undefined);
           if (!dir) {
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer:
                 'the session worktree could not be opened on the machine — check the daemon log',
@@ -308,13 +372,20 @@ export function createWorkSessionTurns({
           // life, most likely; the lock outlives a restart. Leave the job
           // pending and look again next poll; spawning a second CLI would put
           // two Claudes in one held context. Costs no attempt: nothing ran.
+          // …AND ONE OF OURS MAY BE ABOUT TO: `startingIn`, checked and
+          // claimed with no await between, because the file is only written
+          // at spawn. Keyed by the lock's path (the directory, when the git
+          // dir cannot be named) — the file lock's own scope.
           const lockPath = sessionMetaPath(dir.wt, 'flowviant-turn.lock');
-          if (turnLockedByLivePid(lockPath)) {
+          const startKey = lockPath || dir.wt;
+          if (startingIn.has(startKey) || turnLockedByLivePid(lockPath)) {
             warn(
               `a turn is already running in "${job.sessionName || job.sessionId}" — waiting for it to finish`
             );
             return;
           }
+          startingIn.add(startKey);
+          startClaim = startKey;
           // WHICH BRAIN the roster says this tab speaks (null/absent = Claude,
           // which is what every tab ran on until now) — honored by
           // sessionRuntime: on a first turn a named runtime IS the pick, and a
@@ -327,14 +398,14 @@ export function createWorkSessionTurns({
           if (rt.mismatch) {
             // Something upstream changed this tab's identity mid-life. A held
             // context must never be answered by a different brain — say so.
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: `this tab is pinned to ${rt.mismatch.pin} but the server says it is a ${rt.mismatch.runtime} tab — reopen a new tab`,
             });
             return;
           }
           if (rt.missing) {
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: `this session runs on ${rt.missing}, which is no longer installed on the machine — reinstall it, or open a new tab`,
             });
@@ -346,14 +417,14 @@ export function createWorkSessionTurns({
             // tab can run on (Antigravity has no MCP config, and the session's
             // whole control plane rides one). An honest sentence beats the
             // mcpFor throw this used to crash into every turn.
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: `this session runs on ${rt.unsupported}, which cannot drive a Terminal tab on this machine — open a new tab`,
             });
             return;
           }
           if (!rt.id) {
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer:
                 'No coding CLI is installed on the machine — install Claude Code (or another supported CLI), then send the message again',
@@ -366,7 +437,7 @@ export function createWorkSessionTurns({
             // (--conversation). Codex has no adoptable store yet, and its
             // args builder backstops this with a loud throw — but a sentence
             // here beats a stack there.
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer:
                 'adopting this terminal session needs its own CLI on the machine — install it, then try again',
@@ -383,7 +454,7 @@ export function createWorkSessionTurns({
            */
           const planTurn = job.planMode === true && job.capture !== true;
           if (planTurn && rt.id !== 'claude') {
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: `plan mode runs on Claude Code only, and this tab is ${rt.id} — turn plan off in the tab, then send the message again`,
             });
@@ -409,7 +480,7 @@ export function createWorkSessionTurns({
               return;
             }
             if (mint?.gone) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer:
                   'Flowviant no longer offers this session to this machine — the tab may have been closed or moved',
@@ -417,7 +488,7 @@ export function createWorkSessionTurns({
               return;
             }
             if (!mint?.token) {
-              await settleWorkTurn(job.id, {
+              await settleTurn(job.id, {
                 ok: false,
                 answer:
                   'the machine could not mint a session credential from Flowviant — check its connection, then send the message again',
@@ -765,6 +836,11 @@ export function createWorkSessionTurns({
              * that tab replied identically, with nothing on any surface able
              * to clear it. A tab bricked forever by its own CLI pruning its
              * history, which it does on its own schedule.
+             *
+             * An EMPTY Claude resume that emitted init is not retried
+             * (2026-09-29, resumeLost.mjs): its conversation was found, and a
+             * fresh run would answer with no memory of the chat and re-pin the
+             * tab to that new conversation.
              */
             if (
               !adopting &&
@@ -831,7 +907,7 @@ export function createWorkSessionTurns({
             // transcript is most likely gone (cleaned, expired, deleted). Say
             // exactly that; no sessionRef is recorded, so the server keeps
             // offering the adoption and a retry after the user checks is cheap.
-            await settleWorkTurn(job.id, {
+            await settleTurn(job.id, {
               ok: false,
               answer: "Couldn't resume the terminal session — it may have been removed.",
               // Whatever it DID before coming back empty is exactly the
@@ -862,13 +938,24 @@ export function createWorkSessionTurns({
               }
             }
           }
-          await settleWorkTurn(job.id, {
+          /**
+           * NO WORDS, SAID AS MEASURED (2026-09-29). Claude's init event means
+           * it ran in this conversation — kept, and resumed by the next
+           * message, since an empty resume that found it no longer runs fresh
+           * (resumeLost.mjs) — and its result held no words. "Signed out" is
+           * a guess, left to the case where no init came.
+           */
+          const noWords =
+            rt.id === 'claude' && seenClaudeSession
+              ? 'Claude Code ran in this conversation and returned no words — send the message again'
+              : 'the turn produced no output on the machine — its CLI may be signed out; try again';
+          await settleTurn(job.id, {
             ok: answer.length > 0,
             answer:
               answer.length > 0
                 ? // Scrub: a reply can quote config or env-adjacent code.
                   envScrub(answer).slice(0, 16000)
-                : 'the turn produced no output on the machine — its CLI may be signed out; try again',
+                : noWords,
             // Only a turn that actually SPOKE proves a conversation lives
             // here. Recording the path unconditionally is how a crashed first
             // turn used to brick resume for the session's whole life.
@@ -883,7 +970,7 @@ export function createWorkSessionTurns({
           if (answer.length > 0) ok(`${c.cyan('tab')} ${c.dim('— replied in the session')}`);
           else warn('session turn produced no output — settled as failed');
         } catch (e) {
-          await settleWorkTurn(job.id, {
+          await settleTurn(job.id, {
             ok: false,
             // Scrub, like every string that leaves this machine: an exception
             // routinely quotes command output, and command output can quote a
@@ -899,6 +986,7 @@ export function createWorkSessionTurns({
           warn(`session turn failed: ${e?.message ?? e}`);
         } finally {
           workAnswering.delete(job.id);
+          if (startClaim) startingIn.delete(startClaim);
           // Nothing spawned, or everything already has: releasing twice is the
           // normal case and costs nothing. A reservation that leaked would
           // shrink this machine's ceiling for the life of the process.
@@ -928,5 +1016,5 @@ export function createWorkSessionTurns({
     }
   };
 
-  return { processWorkTurns, workAnswering };
+  return { processWorkTurns, workAnswering, settledHere };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.114.1",
+  "version": "0.114.2",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {