flowviant 0.115.0 → 0.117.0

package/bin/lib/desktopContract.mjs

@@ -8,12 +8,11 @@ import { FLEET_URL, MACHINE_HOST, USER_AGENT, VERSION } from './config.mjs';
 import { listStoredProjects } from './credentials.mjs';
 import { readStoredPubB64 } from './boxIdentity.mjs';
 import { daemonRunningFor, drainingFor } from './instance.mjs';
-import { runningViaNpx } from './launchCommand.mjs';
+import { installChannel } from './launchCommand.mjs';
 import { boxesUrlFrom, classifyMachineResponse, fetchBoxesFor } from './machines.mjs';
 import { daemonLockPid, daemonLogPath, readDaemonState } from './daemonState.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
 import { readClaudeAuthStatus } from './runtimeAuth.mjs';
-import { runningCompiledBinary } from './update.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 
 /**
@@ -40,9 +39,8 @@ export function busyOf(liveState, now = Date.now()) {
   return liveState.busy;
 }
 
-export function installChannel() {
-  return runningCompiledBinary() ? 'binary' : runningViaNpx() ? 'npx' : 'npm-g';
-}
+// One home for the channel (launchCommand.mjs); re-exported for views.mjs.
+export { installChannel };
 
 export function desktopStatus({ entries = listStoredProjects(), runtimes = detectRuntimes(), runningFor = daemonRunningFor, stateFor = readDaemonState, pidFor = daemonLockPid, drainFor = drainingFor, nowMs = Date.now(), authFor = readClaudeAuthStatus, refreshAuth = false } = {}) {
   const runtimeRows = runtimes.map((rt) => ({

package/bin/lib/env.mjs

@@ -92,7 +92,18 @@ import { learnSecrets } from './uplinkScrub.mjs';
  * monorepo's shared types. The daemon holds its own line for the same reason
  * every other boundary in this file does — a report that the server will
  * reject is a report nobody sees, and clamping here is what makes the
- * difference visible as a smaller list rather than a 400.
+ * difference visible as a smaller list.
+ *
+ * ── THE RELEASE GATE HOLDS THEM (2026-10-10, audit F093) ──
+ *
+ * `ENV_REPORT_BOUNDS` and `ENV_NAME_RE` are exported for
+ * `scripts/check-app-parity.mjs`, which compares them with the shared
+ * `MACHINE_ENV_MAX_FILES` / `_MAX_VARS` / `_MAX_NAME` / `_FP_LENGTH` and
+ * `machineEnvVarSchema`'s name pattern. Drift would be silent: POST
+ * /fleet/env-report answers a body its schema refuses with 200 `stored:false`
+ * (and its reader drops a bad file alone), so this lane would see `ok`, dedup,
+ * and the comparison sheet would simply stop hearing from this box. `vars` is
+ * a TOTAL on both ends (the server's reader spends one budget across files).
  *
  * ── THE REPORT'S CAPS ARE NOT THE SCRUBBER'S, AND THAT ASYMMETRY IS
  *    DELIBERATE (2026-09-21, the review) ──
@@ -112,23 +123,41 @@ import { learnSecrets } from './uplinkScrub.mjs';
  * actually read, so the totals are honest about a directory somebody has let
  * grow without this scan walking an unbounded list of files on the poll's beat.
  */
-const MAX_ENV_FILES = 8;
-const MAX_ENV_VARS = 200; // TOTAL across every file, not per file — REPORT only
-const MAX_ENV_NAME_CHARS = 64;
+export const ENV_REPORT_BOUNDS = Object.freeze({ files: 8, vars: 200, name: 64, fp: 8 });
+const MAX_ENV_FILES = ENV_REPORT_BOUNDS.files;
+const MAX_ENV_VARS = ENV_REPORT_BOUNDS.vars; // TOTAL across every file, not per file — REPORT only
+const MAX_ENV_NAME_CHARS = ENV_REPORT_BOUNDS.name;
 const MAX_ENV_FILE_BYTES = 256 * 1024;
 const MAX_SCAN_FILES = 64;
 const MAX_SCRUB_VALUES = 2000;
-const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /** `.env`, `.env.local`, `.env.production` … and never a template. A file whose
  *  name ends `.example` / `.sample` / `.template` is somebody's DOCUMENTATION
  *  of the shape, committed on purpose, and its "values" are placeholders — so
  *  it would fingerprint `your-key-here` on every box and report them as
  *  agreeing, which is the exact opposite of what a comparison is for. */
-const isEnvFileName = (name) =>
+export const isEnvFileName = (name) =>
   (name === '.env' || name.startsWith('.env.')) &&
   !/\.(example|sample|template)$/i.test(name);
 
+/**
+ * THE OTHER RULE FOR "AN ENV FILE", AND WHY THE TWO DIFFER (2026-10-10, the
+ * audit's F085; it moved here from deployCheckout.mjs so both live in one
+ * place). `isEnvFileName` decides what the COMPARISON REPORT reads at the
+ * checkout root: `.env*` minus templates, because a template's placeholders
+ * would fingerprint as agreement. This one decides what a DEPLOY COPIES into
+ * its throwaway worktree, at every tracked directory three levels deep: every
+ * `.env*` and `.dev.vars` a build might load, templates included, because a
+ * build that reads one must find it. Copying is about making the build work;
+ * reporting is about a screen a person reads. The deploy lane teaches the
+ * scrubber the files it actually copied (deployRunner.mjs), so the wider rule
+ * never widens what goes unredacted. (vaultArtefacts.mjs keeps a third, wider
+ * net on purpose: it looks only for files the deleted vault wrote, which it
+ * recognises by their header, never by their name alone.)
+ */
+export const isCheckoutEnvFile = (name) => /^(?:\.env(?:\..+)?|\.dev\.vars)$/.test(name);
+
 /**
  * ONE LINE OF DOTENV. Blank lines and `#` comments are skipped, an optional
  * `export ` prefix is allowed, the line is split on the FIRST `=` (a value may
@@ -230,6 +259,55 @@ function closingQuoteLine(lines, start, quote) {
   return lines.length;
 }
 
+/**
+ * ONE DOTENV FILE'S TEXT → `[{ name, value }]`, the variables in force — pure
+ * (2026-10-10, extracted from `scanEnvFiles` so the deploy lane parses the
+ * nested files it copies with the SAME rules the report uses).
+ *
+ * A MAP, because LAST WRITE WINS inside one file — which is how a dotenv
+ * loader resolves a repeated key, so the fingerprint reported is the one
+ * actually in force. It also makes the totals honest: a file that sets the
+ * same key forty times counts once, not forty times.
+ */
+export function parseEnvText(text) {
+  const byName = new Map();
+  const lines = String(text ?? '').split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const parsed = parseEnvLine(lines[i]);
+    if (!parsed) continue;
+    // A VALUE WE CANNOT READ IS REPORTED AS NOTHING. The variable is
+    // dropped from BOTH halves and the scan steps over its continuation
+    // lines, so a PEM body can never be read as variables of its own.
+    if (parsed.unterminated) {
+      i = closingQuoteLine(lines, i, parsed.unterminated);
+      continue;
+    }
+    // A NAME THAT FAILS EITHER TEST IS DROPPED, NEVER TRUNCATED: a cut name
+    // is a DIFFERENT VARIABLE, and a comparison screen rendering two boxes'
+    // truncated names as the same row is worse than rendering neither.
+    if (parsed.name.length > MAX_ENV_NAME_CHARS) continue;
+    if (!ENV_NAME_RE.test(parsed.name)) continue;
+    if (!byName.has(parsed.name) && byName.size >= MAX_SCRUB_VALUES) continue;
+    byName.set(parsed.name, parsed.value);
+  }
+  return [...byName].map(([name, value]) => ({ name, value }));
+}
+
+/**
+ * The values in ONE env file, for the scrubber — `[]` for anything that is not
+ * a regular file under the scan's size cap (the same `lstat` refusal of a
+ * symlink, for the same reason; see `scanEnvFiles`). Never throws.
+ */
+export function readEnvFileValues(path) {
+  try {
+    const st = lstatSync(path);
+    if (!st.isFile() || st.size > MAX_ENV_FILE_BYTES) return [];
+    return parseEnvText(readFileSync(path, 'utf8'));
+  } catch {
+    return [];
+  }
+}
+
 /**
  * A VALUE FINGERPRINT — sha256 over `<projectId>\n<value>`, first 8 hex
  * characters.
@@ -249,8 +327,22 @@ function closingQuoteLine(lines, start, quote) {
  * `development`, `production`, `postgres`, `localhost`, `info` — so anybody who
  * could read a stored report could recover those values with one precomputed
  * table, and the eight characters that were chosen to be uninformative became
- * a lookup key instead. Salting with the project id makes the table worthless
- * without knowing which project it is for, and makes it per-project even then.
+ * a lookup key instead. Salting with the project id stops ONE table serving
+ * every project, and that is all it stops.
+ *
+ * ── WHAT THE SALT DOES NOT STOP (2026-10-10, audit F094) ──
+ *
+ * The project id is no secret: every member of the project has it in the URL,
+ * and it is stored beside the report. To anyone who knows it, this digest
+ * still CONFIRMS A GUESS — hash `postgres`, `changeme` or every six-digit PIN
+ * with the id and compare eight hex — so for a weak value it is a per-project
+ * dictionary oracle, not "useless for recovering it". The server therefore
+ * never serves it back: the app's comparison receives an opaque equality group
+ * per (file, name) instead (`envComparisonView` in the app's
+ * `machineEnvReports.ts`). Keying this digest with a secret no member holds —
+ * an HMAC under the machine credential, with a scheme marker so mixed daemons
+ * read as "not comparable" rather than `differs` — is the at-rest half, and it
+ * is still an open item, not done here.
  *
  * IT COSTS THE FEATURE NOTHING, and that is what makes the trade obvious: the
  * screen compares the BOXES OF ONE PROJECT. Two projects agreeing on a value is
@@ -263,7 +355,7 @@ function closingQuoteLine(lines, start, quote) {
  * deliberately SHORT so nobody mistakes it for a commitment to the value.
  */
 const fingerprint = (salt, value) =>
-  createHash('sha256').update(`${salt}\n${value}`, 'utf8').digest('hex').slice(0, 8);
+  createHash('sha256').update(`${salt}\n${value}`, 'utf8').digest('hex').slice(0, ENV_REPORT_BOUNDS.fp);
 
 /**
  * READ THE CHECKOUT'S `.env*` FILES AND REPORT WHAT IS IN THEM BY NAME.
@@ -353,36 +445,13 @@ export function scanEnvFiles(repoRoot, salt) {
       // file and contributes nothing, and neither is a SYMLINK: see above.
       const st = lstatSync(abs);
       if (!st.isFile() || st.size > MAX_ENV_FILE_BYTES) continue;
-      // A MAP, because LAST WRITE WINS inside one file — which is how a dotenv
-      // loader resolves a repeated key, so the fingerprint reported is the one
-      // actually in force. It also makes the totals honest: a file that sets
-      // the same key forty times counts once, not forty times.
-      const byName = new Map();
-      const lines = readFileSync(abs, 'utf8').split('\n');
-      for (let i = 0; i < lines.length; i++) {
-        const parsed = parseEnvLine(lines[i]);
-        if (!parsed) continue;
-        // A VALUE WE CANNOT READ IS REPORTED AS NOTHING. The variable is
-        // dropped from BOTH halves and the scan steps over its continuation
-        // lines, so a PEM body can never be read as variables of its own.
-        if (parsed.unterminated) {
-          i = closingQuoteLine(lines, i, parsed.unterminated);
-          continue;
-        }
-        // A NAME THAT FAILS EITHER TEST IS DROPPED, NEVER TRUNCATED: a cut name
-        // is a DIFFERENT VARIABLE, and a comparison screen rendering two boxes'
-        // truncated names as the same row is worse than rendering neither.
-        if (parsed.name.length > MAX_ENV_NAME_CHARS) continue;
-        if (!ENV_NAME_RE.test(parsed.name)) continue;
-        if (!byName.has(parsed.name) && byName.size >= MAX_SCRUB_VALUES) continue;
-        byName.set(parsed.name, parsed.value);
-      }
-      out.varsTotal += byName.size;
+      const parsed = parseEnvText(readFileSync(abs, 'utf8'));
+      out.varsTotal += parsed.length;
       // Decided BEFORE this file spends any budget, so `budget` reaching zero
       // inside a file still lets that file's own entry carry what it got.
       const reporting = canReport && budget > 0 && out.files.length < MAX_ENV_FILES;
       const vars = [];
-      for (const [n, value] of byName) {
+      for (const { name: n, value } of parsed) {
         // THE SCRUB LIST IS NOT BOUNDED BY THE REPORT'S CAPS — see the bounds
         // block above. A secret dropped for being the 201st is a secret in the
         // server's database.

package/bin/lib/fleet.mjs

@@ -10,8 +10,8 @@
  * what order. What a lane DOES lives beside it — the poll's query string
  * (fleetRoster.mjs), the machine's own reports (fleetReports.mjs), holdership
  * and the terminal signals (holder.mjs), the wiki runner (wikiRunner.mjs), the
- * checkout job lanes (fleetJobs.mjs), the start steps (fleetStartup.mjs), the
- * reconcile wait (fleetWake.mjs), and session/agent work (work.mjs).
+ * start steps (fleetStartup.mjs), the reconcile wait (fleetWake.mjs), and
+ * session/agent work (work.mjs).
  *
  * Over the 500-line mark as ONE LIFECYCLE, not as debt: what is left is the
  * intake order over roster keys, and most of its length is the argument for
@@ -38,7 +38,7 @@ import { emitMachineEvent } from './daemonLogging.mjs';
 import { writeDaemonState } from './daemonState.mjs';
 import { repoRootOrDie, detectBaseRef, baseBranchName, excludeInWorktree, usableBaseRef } from './git.mjs';
 import { c, info, note, ok, warn, fail } from './ui.mjs';
-import { sleep } from './claude.mjs';
+import { sleep } from './sleep.mjs';
 import { reapOrphanPreviews } from './previewRegistry.mjs';
 import { preflight } from './preflight.mjs';
 import { connectStream } from './stream.mjs';
@@ -75,7 +75,6 @@ import {
 } from './fleetReports.mjs';
 import { createHolderWatch, obeyRosterCommands } from './holder.mjs';
 import { createWikiRunner } from './wikiRunner.mjs';
-import { createCleanupLane, createPatchRevertLane } from './fleetJobs.mjs';
 import { installSignalHandlers, takeInstanceLockOrExit, tidyWorktreeHome, worktreeHome } from './fleetStartup.mjs';
 import { createReconcileWait } from './fleetWake.mjs';
 
@@ -235,7 +234,10 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   // never-squash law — and every server since the pivot sends `mergeJobs: []`
   // (a wire fossil, `rosterResponse.ts`). Merges run through `prWorkflow.mjs`
   // (session PR job, agent approve) and `shipMerge.mjs`, and nowhere else.
-  const processPatchRevertJobs = createPatchRevertLane({ repoRoot });
+  // Its two checkout siblings went the same way (audit 2026-10-10, F083): no
+  // server sends `patchRevertJobs` (a `git revert` in this checkout) or
+  // `cleanupJobs` (`gh pr close --delete-branch`, a remote branch delete), and
+  // their settle routes died with dispatch, so nothing here reads either key.
 
   // ── Work sessions — the Workbench tabs ─────────────────────────────────────
   //
@@ -314,8 +316,6 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
   });
   workShutdown = shutdownWork; // teardown can now reach the live session CLIs
 
-  const processCleanupJobs = createCleanupLane({ repoRoot, getBaseRef });
-
   // Living-wiki work: one cartographer turn at a time, off the agents'
   // checkouts (wikiRunner.mjs). Wiki work needs no agent online.
   wiki = createWikiRunner({ repoRoot, baseDir, repoKey, getBaseRef, admit });
@@ -505,7 +505,6 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // taking new work — the skip-if-pending guards make the ordering safe, but
     // delivering first keeps the tab honest a poll sooner.
     void flushWorkReports();
-    processPatchRevertJobs(roster.patchRevertJobs);
     // WHERE each live tab works, BEFORE anything measures one: the sweep below
     // and every preview check ask `placeOf`, and a tab nobody has typed into
     // yet has taught it nothing.
@@ -617,7 +616,6 @@ export async function runFleetDaemon({ afterLock = null } = {}) {
     // startup on purpose: a daemon that has been up since before this release
     // gets measured too, without needing a restart to earn its own menu.
     probeSkillsOnce(repoRoot);
-    processCleanupJobs(roster.cleanupJobs);
     // Announce roster membership only when it changes (not every poll).
     const sig = [...new Set(roster.agents.map((a) => a.agentId))].sort().join(',');
     if (sig !== rosterSig) {

package/bin/lib/fleetPost.mjs

@@ -1,40 +1,187 @@
 /**
- * ONE DAEMON→SERVER POST THAT ANSWERS ONLY "WAS IT ACCEPTED" — the settle a
- * job lane sends when it is done (`patch-revert-done`, `cleanup-done`,
- * `reground-done`) and the machine telemetry beat (`/fleet/machine`).
+ * THE DAEMON'S MACHINE-CREDENTIAL REQUEST — the headers, the timeout and the
+ * body every `/fleet/*` call shares, and the few answers built on it: a settle
+ * that says only "was it accepted" (`postToFleet`), the lease claim that stops
+ * two daemons acting on one job (`claimFleetLease`), the lease settle that
+ * follows it (`settleLease`), and the bounded best-effort settle
+ * (`postBestEffort`).
  *
- * Split out of fleet.mjs (SOLID audit 2026-09-26, F038) because four lanes in
- * three modules share it — the job lanes (fleetJobs.mjs), the wiki runner
- * (wikiRunner.mjs) and the machine report (fleetReports.mjs) — and it was a
- * closure inside `runFleetDaemon` that only one of them could reach. It was
- * called `reportMergeOutcome` there, a name left over from the deleted
- * dispatch-era merge lane; the body is unchanged.
+ * Split out of fleet.mjs (SOLID audit 2026-09-26, F038) because lanes in
+ * other modules share `postToFleet` — today the wiki runner (wikiRunner.mjs)
+ * and the machine report (fleetReports.mjs) — and it was a closure inside
+ * `runFleetDaemon` that only one of them could reach. It was called
+ * `reportMergeOutcome` there, a name left over from the deleted dispatch-era
+ * merge lane. The patch-revert and cleanup lanes that also settled through it
+ * were deleted with their dead roster keys (audit 2026-10-10, F083).
  *
- * A DAEMON→SERVER REPORT, so no floor: the report's presence is the
+ * ONE REQUEST SKELETON (audit 2026-10-10, F071/F082/F102/F136/F138/F154/F744).
+ * The `Authorization: Bearer …` / `User-Agent` / `Content-Type` block and its
+ * `AbortSignal.timeout` were hand-built at ~37 sites in 23 files, and the
+ * copies had drifted (mcp-cli's had no timeout at all; wikiRunner's abandon
+ * post was a near copy of `postToFleet`). The lease claim — the double-run
+ * guard — was five byte-identical copies. Each caller still passes its OWN
+ * timeout and keeps its OWN status policy; only the request and the claim's
+ * winner test moved here.
+ *
+ * `fetch` is the global, resolved at CALL time inside each function — tests
+ * swap `globalThis.fetch` after import, and that must keep working.
+ *
+ * A DAEMON→SERVER REPORT needs no floor: the report's presence is the
  * capability, and a lane that gets `false` back retries on its own beat.
  */
 
-import { FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { isCredentialRejection } from './authReject.mjs';
+import { isConsideredRefusal, isNotNow, retryAfterMs } from './fleetWire.mjs';
+
+/** The machine credential's headers. `token` defaults to the LIVE binding
+ *  (config.mjs's `let FLEET_TOKEN`, which a project switch re-points), read
+ *  at call time. `json: false` for a GET or a multipart body. */
+export function fleetHeaders({ json = true, token = FLEET_TOKEN } = {}) {
+  return {
+    Authorization: `Bearer ${token}`,
+    'User-Agent': USER_AGENT,
+    ...(json ? { 'Content-Type': 'application/json' } : {}),
+  };
+}
+
+/** A body as it goes on the wire: a string is already serialised (the
+ *  readout lanes dedup on the exact string they post), anything else is
+ *  JSON-encoded, and `undefined` sends no body. */
+const wireBody = (body) => (body === undefined || typeof body === 'string' ? body : JSON.stringify(body));
+
+/**
+ * A JSON POST with the machine credential, returning the RESPONSE — for a
+ * caller that reads it itself. Rejects on a network error or a timeout
+ * exactly as `fetch` does.
+ */
+export async function postFleetJson(url, body, { timeoutMs = 30_000, token, signal } = {}) {
+  return fetch(url, {
+    method: 'POST',
+    headers: fleetHeaders({ token }),
+    signal: signal ?? AbortSignal.timeout(timeoutMs),
+    body: wireBody(body),
+  });
+}
+
+/**
+ * ONE REQUEST, ANSWERED AS A SHAPE — never a throw.
+ *
+ *   { ok, status, json, credentialRejected, retryAfterMs, error }
+ *
+ * `status` is null (and `error` set) when nothing answered: a network error
+ * or the timeout. `json` is the parsed body, or null when it was not JSON.
+ * `credentialRejected` is authReject.mjs's one rule — a 401/403 wearing the
+ * API's own `{ success: false }` envelope, never the bare status (an edge
+ * 403 is somebody else's answer). `retryAfterMs` is the server's Retry-After,
+ * capped, or null when it sent none.
+ */
+export async function fleetRequest(url, { method = 'POST', body, timeoutMs = 30_000, token, signal } = {}) {
+  let res;
+  try {
+    const sent = wireBody(body);
+    res = await fetch(url, {
+      method,
+      headers: fleetHeaders({ json: sent !== undefined, token }),
+      signal: signal ?? AbortSignal.timeout(timeoutMs),
+      ...(sent !== undefined ? { body: sent } : {}),
+    });
+  } catch (error) {
+    return { ok: false, status: null, json: null, credentialRejected: false, retryAfterMs: null, error };
+  }
+  let json = null;
+  try {
+    json = typeof res.json === 'function' ? await res.json() : null;
+  } catch {
+    json = null; // not JSON — an edge page, an empty body
+  }
+  return {
+    ok: Boolean(res.ok),
+    status: res.status,
+    json,
+    credentialRejected: isCredentialRejection(res.status, res.headers?.get?.('content-type'), json),
+    retryAfterMs: retryAfterMs(res, null),
+    error: null,
+  };
+}
 
 /** Returns whether the server actually accepted it. Callers that spend a
  *  Claude turn per attempt need to know: swallowing the failure silently made
  *  an unreachable endpoint look identical to a settled job, so the turn
- *  re-ran on every poll. */
-export async function postToFleet(url, body) {
+ *  re-ran on every poll. Never throws — the job reappears next poll if this
+ *  failed. */
+export async function postToFleet(url, body, { timeoutMs = 30_000 } = {}) {
+  return (await fleetRequest(url, { body, timeoutMs })).ok;
+}
+
+/**
+ * CLAIM A LEASE BEFORE ACTING — the double-run guard (audit 2026-10-10,
+ * F138). Two daemons legitimately share one credential and are handed the
+ * same job array, so a lane that opens a tunnel, signals a pid, pushes a
+ * branch or runs a deploy claims the job first and does NOTHING unless it
+ * won. The rules, which were five hand copies:
+ *   - the body names this PROCESS (`instance: DAEMON_INSTANCE`), never only
+ *     the credential — a token cannot tell two holders apart;
+ *   - the winner is read from the BODY (`data.claimed === true`), never
+ *     inferred from the status;
+ *   - any failure — a network error, a timeout, a non-JSON answer — is "not
+ *     claimed": the peer may hold it, and doing nothing is the safe answer.
+ * `won` is for a route that answers in another shape (intake's `{ ok: true }`
+ * on a 200); it is handed `fleetRequest`'s result.
+ */
+export async function claimFleetLease(
+  url,
+  fields,
+  { timeoutMs = 15_000, won = (r) => r.json?.data?.claimed === true } = {}
+) {
   try {
-    const res = await fetch(url, {
-      method: 'POST',
-      headers: {
-        Authorization: `Bearer ${FLEET_TOKEN}`,
-        'User-Agent': USER_AGENT,
-        'Content-Type': 'application/json',
-      },
-      signal: AbortSignal.timeout(30_000),
-      body: JSON.stringify(body),
-    });
-    return res.ok;
+    const r = await fleetRequest(url, { body: { ...fields, instance: DAEMON_INSTANCE }, timeoutMs });
+    if (r.error) return false;
+    return won(r) === true;
   } catch {
-    /* best-effort — the job reappears next poll if this failed */
     return false;
   }
 }
+
+/**
+ * SETTLE A HELD LEASE — the outcome POST that follows a claim, stamped with
+ * the same `instance` (only the holder may settle). Returns the parsed reply
+ * (a preview open reads `data.settled`), or null when nothing usable came
+ * back. Never throws: an unsettled lease expires server-side and the asker
+ * is told, never spun.
+ */
+export async function settleLease(url, body, { timeoutMs = 30_000 } = {}) {
+  const r = await fleetRequest(url, { body: { ...body, instance: DAEMON_INSTANCE }, timeoutMs });
+  return r.json ?? null;
+}
+
+/**
+ * A best-effort settle POST, AWAITED INLINE by a caller with no per-poll
+ * queue of its own to retry from — unlike workReportQueue's `postSettle`,
+ * whose callers requeue a 'retry'/'reject' outcome themselves. Bounded
+ * attempts: 408/429 retry honouring Retry-After, 5xx retries on a short fixed
+ * backoff, and any OTHER 4xx is the server's considered answer — retrying it
+ * would just spend the same refusal again, so it counts as delivered, the
+ * existing trace convention. A network error retries the same way and is
+ * then swallowed: unsettled, and the server expires the job so the asker is
+ * told, never spun.
+ *
+ * Moved here from inside `createWorkReportQueue` (audit 2026-10-10, F136): it
+ * closed over nothing of the queue's. work.mjs still INJECTS it into the
+ * plan, check and intake lanes, so their tests hand in fakes.
+ */
+export async function postBestEffort(url, body, { attempts = 4, timeoutMs = 30_000 } = {}) {
+  for (let i = 0; i < attempts; i += 1) {
+    const r = await fleetRequest(url, { body, timeoutMs });
+    if (r.ok) return true;
+    if (isConsideredRefusal(r.status)) return true; // the server's considered answer
+    const notNow = isNotNow(r.status);
+    // Only a network error, 408/429 or a 5xx retries; anything else (a stray
+    // 1xx/3xx) was never retried and still is not.
+    if (!r.error && !notNow && r.status < 500) return true;
+    if (i === attempts - 1) return false;
+    const backoff = 2_000 * (i + 1);
+    await new Promise((done) => setTimeout(done, notNow ? (r.retryAfterMs ?? backoff) : backoff));
+  }
+  return false;
+}