flowviant 0.116.0 → 0.124.0

package/bin/lib/workPlaceReports.mjs

@@ -12,14 +12,15 @@
  */
 import { readFileSync } from 'node:fs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, MACHINE_HOST } from './config.mjs';
-import { gitNetAsync, isSafePathSegment } from './git.mjs';
+import { gitNetAsync } from './git.mjs';
 import { measureListeners, listenersSupported } from './listeners.mjs';
 import { processesSupported } from './processes.mjs';
 import { titleForSession } from './claudeSessions.mjs';
+import { RESUME_MARKERS } from './conversationIds.mjs';
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { myPubB64 } from './boxIdentity.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { REPO_PLACE } from './workPlaces.mjs';
+import { isValidPlace } from './workPlaces.mjs';
 
 export function createWorkPlaceReports({
   repoRoot,
@@ -94,7 +95,9 @@ export function createWorkPlaceReports({
     // The session's PLACE, not its name: a tab in the checkout is measured in
     // the checkout, and a tab sharing another tab's worktree is measured there.
     const place = placeOf(sessionId);
-    if (place !== REPO_PLACE && !isSafePathSegment(place)) return null;
+    // The one validity rule (`isValidPlace`, workPlaces.mjs, audit 2026-10-10
+    // F141) — not a third spelling of it.
+    if (!isValidPlace(place)) return null;
     const wt = placeDir(sessionId);
     const d = worktreeDiff(wt, baseRef());
     if (!d) return null;
@@ -138,7 +141,7 @@ export function createWorkPlaceReports({
     // exactly as it found it.
     let title = null;
     try {
-      const marker = sessionMetaPath(wt, 'flowviant-claude-session', sessionId);
+      const marker = sessionMetaPath(wt, RESUME_MARKERS.claude, sessionId);
       if (marker) title = titleForSession(wt, readFileSync(marker, 'utf8').trim());
     } catch {
       /* no marker yet — this tab has not spoken, or is not Claude */

package/bin/lib/workPlaces.mjs

@@ -7,18 +7,62 @@
  * one of these four questions, and they have to agree: a tab in the checkout
  * measured against `sessions/<id>` reports nothing, and a marker written
  * unscoped hands one tab another's conversation. One home keeps them one
- * answer. The trust boundary (`isSafePathSegment` / `REPO_PLACE`) lives here
- * with the map it guards; the session lane is the only other writer and keeps
- * the same check (its comment says why).
+ * answer. The trust boundary (`isValidPlace`) lives here with the map it
+ * guards, and `notePlace` is the map's ONLY writer: the roster's intake and
+ * the session lane's turn intake both go through it (audit 2026-10-10, F141),
+ * so a lane that learns a place cannot store one unvalidated.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { git, isSafePathSegment, hasCommits, gitFailure } from './git.mjs';
+import { git, isSafePathSegment, hasCommits, gitFailure, sessionBranch } from './git.mjs';
 
 /** The place id meaning "the checkout", not a worktree. Must match the
- *  server's REPO_PLACE — it is a wire value, not a local convention. */
+ *  server's REPO_PLACE — it is a wire value, not a local convention. The
+ *  release parity gate holds it there (2026-10-10, audit F163). */
 export const REPO_PLACE = 'repo';
 
+/** A PERSON's place starts with this — the server's `userPlace(userId)` is
+ *  `u-<userId>` — which is how the worktree sweep tells a person's manual copy
+ *  (fast-forwarded) from an agent's or a session's (never touched). A wire
+ *  value too, held to `userPlace` by the release parity gate (2026-10-10,
+ *  audit F163). */
+export const PERSON_PLACE_PREFIX = 'u-';
+
+/**
+ * A PLACE THIS MACHINE WILL RESOLVE: the checkout, or a safe path segment.
+ *
+ * The value becomes the directory a turn is SPAWNED in and a preview port is
+ * measured against — the security boundary for the whole preview feature. The
+ * server resolves place to an enum (never a path), but a server bug or
+ * compromise sending `../../etc` would otherwise point a session's measured
+ * directory anywhere on the box. REPO_PLACE resolves to repoRoot, so it is
+ * allowed through despite not being a path segment.
+ */
+export function isValidPlace(place) {
+  return typeof place === 'string' && (place === REPO_PLACE || isSafePathSegment(place));
+}
+
+/**
+ * A PLACE'S OWN WORKTREE DIRECTORY — `sessions/<place>` under the worktrees
+ * root — or null for an id that is not a safe path segment. Pure.
+ *
+ * No REPO_PLACE arm, on purpose: the agent lanes hold an AGENT's place, which
+ * is never the checkout, so a stray `'repo'` there keeps naming a directory
+ * that does not exist rather than becoming the operator's checkout.
+ */
+export function worktreePath(baseDir, place) {
+  return isSafePathSegment(place) ? join(baseDir, 'sessions', place) : null;
+}
+
+/**
+ * THE DIRECTORY A PLACE RESOLVES TO: the checkout for REPO_PLACE, its own
+ * worktree otherwise, null for an unsafe id. Pure — `placeDir` is this over
+ * the session map, and nothing else spells the rule.
+ */
+export function placePath({ repoRoot, baseDir }, place) {
+  return place === REPO_PLACE ? repoRoot : worktreePath(baseDir, place);
+}
+
 export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged }) {
   /**
    * WHERE EACH SESSION WORKS, learned from the turns we are handed.
@@ -66,36 +110,59 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
    * Absence of the whole map still means "an older server said nothing", which
    * is the only thing absence can safely mean.
    */
+  /**
+   * THE MAP'S ONE WRITER — validate, then store; false (and nothing stored)
+   * for a place this machine refuses.
+   *
+   * VALIDATED AT THE TRUST BOUNDARY (`isValidPlace` says why). There were two
+   * writers — the roster's intake below and the session lane's turn intake —
+   * each spelling the check, with a comment keeping them in step by hand:
+   * validating one intake and not the other is one deploy away from
+   * validating neither. Now there is one door, and the map is not handed out.
+   */
+  const notePlace = (sessionId, place) => {
+    if (!isValidPlace(place)) return false;
+    sessionPlaces.set(sessionId, place);
+    return true;
+  };
   const learnPlaces = (map) => {
     if (!map || typeof map !== 'object') return;
     for (const [sid, place] of Object.entries(map)) {
-      // VALIDATE AT THE TRUST BOUNDARY. `placeDir` joins this value straight
-      // into `sessions/<place>` and it is the directory a turn is SPAWNED in
-      // and a preview port is measured against — the security boundary for the
-      // whole preview feature. The server resolves place to an enum (never a
-      // path), but a server bug or compromise sending `../../etc` would
-      // otherwise point a session's measured directory anywhere on the box and
-      // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
-      // already reject an unsafe segment; checking at the intake covers the
-      // consumers that do not (the preview-claim `placeDir` did not re-check).
-      // NOT the only writer: `processWorkTurns` stores a turn job's place too,
-      // and keeps the same check — validating one intake and not the other is
-      // one deploy away from validating neither. REPO_PLACE resolves to
-      // repoRoot, so it is allowed through despite not being a path segment.
-      if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
-        sessionPlaces.set(sid, place);
+      // `sessionWorktreeReport` and `placeWtFor` already reject an unsafe
+      // segment; checking at the intake covers the consumers that do not (the
+      // preview-claim `placeDir` did not re-check).
       // null / '' / an unsafe value: the server is telling us this tab is in its
       // OWN worktree (or is malformed). Falling back to the default requires
       // forgetting, not ignoring.
-      else sessionPlaces.delete(sid);
+      if (!notePlace(sid, place)) sessionPlaces.delete(sid);
     }
   };
+  /** The directory a PLACE resolves to, on this machine's roots. */
+  const dirOfPlace = (place) => placePath({ repoRoot, baseDir }, place);
   /** The DIRECTORY a session works in. Every path that used to build
    *  `sessions/<id>` by hand goes through here, or a tab in the checkout gets
-   *  measured against a directory that does not exist. */
-  const placeDir = (sessionId) => {
-    const place = placeOf(sessionId);
-    return place === REPO_PLACE ? repoRoot : join(baseDir, 'sessions', place);
+   *  measured against a directory that does not exist. Null for a session id
+   *  that is not a safe segment and has learnt no place. */
+  const placeDir = (sessionId) => dirOfPlace(placeOf(sessionId));
+
+  /**
+   * THE BRANCH STANDING IN `wt` — what is actually checked out, not what we
+   * named it at birth — as `{ branch }`, or `{ detached: true }` when HEAD
+   * names no branch. A directory that is gone (a retired or closed tab) cannot
+   * be asked, so `fallback` is the answer: the one case where the recorded
+   * name is the only thing there is.
+   *
+   * Moved verbatim out of ship and the PR lane (audit 2026-10-10, F141), which
+   * spelled it twice so that "which branch would ship" and "which branch would
+   * open a PR" agreed only by hand.
+   */
+  const branchAt = (wt, fallback) => {
+    if (!existsSync(wt)) return { branch: fallback };
+    try {
+      return { branch: git(['symbolic-ref', '--short', 'HEAD'], wt) };
+    } catch {
+      return { detached: true };
+    }
   };
 
   /**
@@ -132,12 +199,11 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
       // caller may treat this as a newly-cut branch.
       return { wt: repoRoot, fresh: false };
     }
-    if (!isSafePathSegment(placeId)) return null;
-    const sessionId = placeId;
-    const wt = join(baseDir, 'sessions', sessionId);
+    const wt = worktreePath(baseDir, placeId);
+    if (!wt) return null;
     const fresh = !existsSync(wt);
     if (fresh) {
-      const branch = `session/${sessionId}`;
+      const branch = sessionBranch(placeId);
       // `baseAt` is the adoption override: a tab born from a terminal session
       // branches from THAT checkout's HEAD, because the conversation being
       // resumed was had against those commits — putting it on the project base
@@ -224,5 +290,21 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
     }
   };
 
-  return { sessionPlaces, placeOf, learnPlaces, placeDir, placeWtFor, sessionMetaPath };
+  /**
+   * WHEN `git worktree add` CUT THIS WORKTREE: its private git dir's
+   * `commondir`, written once at creation and left alone by commits, lock,
+   * repair and move. A recreated worktree is a new birth. Null for the
+   * checkout (no such file) and for anything unreadable — read by the
+   * artifact reporter, which then has no evidence a place held older rows.
+   */
+  const worktreeBornAt = (wt) => {
+    const path = sessionMetaPath(wt, 'commondir');
+    try {
+      return path ? statSync(path).mtimeMs : null;
+    } catch {
+      return null;
+    }
+  };
+
+  return { placeOf, notePlace, learnPlaces, placeDir, branchAt, placeWtFor, sessionMetaPath, worktreeBornAt };
 }

package/bin/lib/workPreviews.mjs

@@ -1,10 +1,11 @@
 /** Session preview claims, tunnels, and retirement. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { isSafePathSegment } from './git.mjs';
 import { originFor as measuredOrigin } from './listeners.mjs';
 import { openTunnel as openLiveTunnel } from './preview.mjs';
 import { note } from './ui.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
 
 /** `originFor` and `openTunnel` are injectable only so the lane can be driven
  *  without a dev server or cloudflared (workPreviews.test.mjs); work.mjs passes
@@ -19,7 +20,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // generated password, on a quick tunnel. This daemon never starts an app: the
   // deleted live-preview feature ran a repo-declared command through a shell,
   // and that is the reason it is deleted. Here the human runs their own server,
-  // `listenersIn` notices it, and this only ever wraps a port that measurement
+  // `measureListeners` notices it, and this only ever wraps a port that measurement
   // already named for that session.
   //
   // CLAIM BEFORE ACTING. Two daemons legitimately share one fleet credential —
@@ -35,47 +36,26 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // Returns the parsed JSON (or null on any failure) rather than discarding
   // it — an OPEN settle's caller needs to see `data.settled === false`, the
   // sharper share-id check on the server's side of a re-share racing the
-  // open's own round trip (see the openTunnel call site below).
-  const postPreview = async (body) => {
-    try {
-      const res = await fetch(PREVIEW_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-      return await res.json().catch(() => null);
-    } catch {
-      /* the row stops being confirmed and reads as ended — which is true */
-      return null;
-    }
-  };
+  // open's own round trip (see the openTunnel call site below). On a failure
+  // the row stops being confirmed and reads as ended — which is true.
+  const postPreview = (body) => settleLease(PREVIEW_DONE_URL, body, { timeoutMs: 30_000 });
 
   // `shareId` is the share the daemon was OFFERED, echoed off the job. A
   // re-share inside the claim's round trip rotates the id server-side, so a
   // claim naming the old one matches nothing and this daemon opens no tunnel
   // for a request that no longer exists. Absent-safe: an older server that
   // does not read the field just claims on the place alone, the old rule.
-  const claimPreview = async (sessionId, shareId) => {
+  // Could not claim → do nothing at all. The other daemon may have.
+  const claimPreview = (sessionId, shareId) =>
+    claimFleetLease(PREVIEW_CLAIM_URL, { sessionId, ...(shareId ? { shareId } : {}) });
+
+  /** Stop a tunnel (a live entry or an open's result) without letting its
+   *  teardown throw into the lane: the stop is best-effort everywhere. */
+  const stopQuietly = (live) => {
     try {
-      const res = await fetch(PREVIEW_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ sessionId, instance: DAEMON_INSTANCE, ...(shareId ? { shareId } : {}) }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
+      live?.stop();
     } catch {
-      return false; // could not claim → do nothing at all. The other daemon may have.
+      /* best-effort */
     }
   };
 
@@ -85,13 +65,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   const stopPreview = async (sessionId, reason) => {
     const live = livePreviews.get(sessionId);
     livePreviews.delete(sessionId);
-    if (live) {
-      try {
-        live.stop();
-      } catch {
-        /* best-effort */
-      }
-    }
+    stopQuietly(live);
     // Confirm only a teardown we actually PERFORMED. The stop job is a
     // broadcast — every daemon on the credential gets it — and the one holding
     // nothing used to answer instantly, flipping the row to 'ended' so the
@@ -115,6 +89,15 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       });
   };
 
+  /** One teardown per session at a time: a session mid-claim (an open or
+   *  another stop on its way) is left to that claim, and the next tick asks
+   *  again. The stop job and a closed tab share this guard. */
+  const stopOnce = (sessionId, reason) => {
+    if (previewClaiming.has(sessionId)) return;
+    previewClaiming.add(sessionId);
+    void stopPreview(sessionId, reason).finally(() => previewClaiming.delete(sessionId));
+  };
+
   const processPreviewJobs = (jobs) => {
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 5)) {
@@ -123,9 +106,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       if (!isSafePathSegment(sessionId)) continue;
 
       if (job?.action === 'stop') {
-        if (previewClaiming.has(sessionId)) continue;
-        previewClaiming.add(sessionId);
-        void stopPreview(sessionId, 'stopped').finally(() => previewClaiming.delete(sessionId));
+        stopOnce(sessionId, 'stopped');
         continue;
       }
 
@@ -171,6 +152,13 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
       if (previewClaiming.has(sessionId)) continue;
       previewClaiming.add(sessionId);
 
+      // EVERY report about this job's share names the share (F017,
+      // 2026-09-26): an un-scoped `ended` or `error` could end a replacement
+      // share opened on the same session in the meantime. One spelling, so a
+      // new teardown callback cannot forget it (audit 2026-10-10, F162).
+      // Absent when the job carried none (an older server), the old rule.
+      const settleShare = (body) => postPreview({ sessionId, ...body, ...(shareId ? { shareId } : {}) });
+
       void (async () => {
         try {
           if (!(await claimPreview(sessionId, shareId))) return; // somebody else has it
@@ -188,21 +176,13 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
           // machine never measured. A wire string, not a field — no floor.
           const refusal = originFor(wt, port).error;
           if (refusal) {
-            await postPreview({
-              sessionId,
-              error: refusal,
-              ...(shareId ? { shareId } : {}),
-            });
+            await settleShare({ error: refusal });
             return;
           }
           // Replace anything this session already had — one tab, one door.
           const prev = livePreviews.get(sessionId);
           if (prev) {
-            try {
-              prev.stop();
-            } catch {
-              /* best-effort */
-            }
+            stopQuietly(prev);
             livePreviews.delete(sessionId);
           }
           const t = await openTunnel({
@@ -218,12 +198,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
             // without this the app would print "live" over a 502.
             onDead: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                ended: true,
-                endedReason: 'origin_gone',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ ended: true, endedReason: 'origin_gone' });
             },
             // ATTRIBUTION rides the probe, not just the open: a freed default
             // port (5173…) rebound by any other process on the box would keep
@@ -236,38 +211,27 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
             // owner can re-share the port without restarting the daemon.
             onAbuse: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                ended: true,
-                endedReason: 'abuse',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ ended: true, endedReason: 'abuse' });
             },
             // cloudflared died AFTER publishing (quick tunnels get dropped).
             // Without this the daemon kept heartbeating a hostname that 530s.
             onTunnelGone: () => {
               livePreviews.delete(sessionId);
-              void postPreview({
-                sessionId,
-                error: 'the tunnel dropped — share it again to reopen.',
-                ...(shareId ? { shareId } : {}),
-              });
+              void settleShare({ error: 'the tunnel dropped — share it again to reopen.' });
             },
           });
           if (t.error) {
-            await postPreview({ sessionId, error: t.error, ...(shareId ? { shareId } : {}) });
+            await settleShare({ error: t.error });
             return;
           }
           livePreviews.set(sessionId, { port, shareId, url: t.url, stop: t.stop });
           // The gate we ACTUALLY installed, so the app never asserts a door
           // nobody observed. An older server ignores the field.
-          const settled = await postPreview({
-            sessionId,
+          const settled = await settleShare({
             url: t.url,
             user: t.user,
             password: t.password,
             gate: t.gateMode,
-            ...(shareId ? { shareId } : {}),
           });
           // A re-share (or a Stop) can land inside this open's own round
           // trip and rotate the share id server-side — the settle is then
@@ -279,11 +243,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
           // settle for an older one).
           if (settled?.data?.settled === false) {
             if (livePreviews.get(sessionId)?.stop === t.stop) livePreviews.delete(sessionId);
-            try {
-              t.stop();
-            } catch {
-              /* best-effort */
-            }
+            stopQuietly(t);
           }
         } finally {
           previewClaiming.delete(sessionId);
@@ -292,26 +252,6 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
     }
   };
 
-  /** The sessionIds this machine is still serving — sent on the poll so the
-   *  server can tell a live share from one whose machine went away. Silence
-   *  must never read as "live". */
-  /**
-   * The daemon's own shape check on an argv the server parsed.
-   *
-   * Deliberately a SHAPE check and not a re-parse: the server owns the policy
-   * (which argv[0] are allowed, the install refusal, the length caps) and the
-   * machine owns the refusal to EXECUTE something malformed. It is duplicated
-   * rather than imported because this package ships standalone and cannot
-   * depend on the monorepo — the mirror is small, and `devCommand.ts` is where
-   * the real rules live.
-   */
-  const isPlausibleDevArgv = (argv) =>
-    Array.isArray(argv) &&
-    argv.length > 0 &&
-    argv.length <= 8 &&
-    argv.every((a) => typeof a === 'string' && a.length > 0 && a.length <= 200) &&
-    !argv.some((a) => /[&|;<>`$(){}*?~\\]/.test(a));
-
   // ── DEV RUNS ARE DELETED (2026-08-26) ─────────────────────────────────
   //
   // The machine no longer starts application processes. It never learned to
@@ -321,7 +261,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // per ecosystem forever.
   //
   // Nothing downstream is lost, because SHARING NEVER DEPENDED ON US STARTING
-  // IT. `listenersIn` attributes a listening socket to a place by the cwd of
+  // IT. `measureListeners` attributes a listening socket to a place by the cwd of
   // the process holding it, so a server the driver's own agent started in the
   // tab is measured exactly like one this file used to spawn. The web renders
   // that measured list and a person picks which port to share.
@@ -331,6 +271,9 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
   // and its adopt-across-re-exec dance. If supervision is ever wanted back it
   // returns as "supervise this process", never as "run dev".
 
+  /** The sessionIds this machine is still serving — sent on the poll so the
+   *  server can tell a live share from one whose machine went away. Silence
+   *  must never read as "live". */
   const livePreviewIds = () => [...livePreviews.keys()];
 
   /**
@@ -349,9 +292,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
     const live = new Set(activeIds);
     for (const sessionId of [...livePreviews.keys()]) {
       if (live.has(sessionId)) continue;
-      if (previewClaiming.has(sessionId)) continue;
-      previewClaiming.add(sessionId);
-      void stopPreview(sessionId, 'tab_closed').finally(() => previewClaiming.delete(sessionId));
+      stopOnce(sessionId, 'tab_closed');
     }
   };
 
@@ -359,13 +300,7 @@ export function createWorkPreviews({ placeDir, originFor = measuredOrigin, openT
    *  them would strand a public hostname until the box rebooted — the exact
    *  case `reapOrphanPreviews` exists to clean up after an UNgraceful death. */
   const shutdownPreviews = () => {
-    for (const [, live] of livePreviews) {
-      try {
-        live.stop();
-      } catch {
-        /* best-effort */
-      }
-    }
+    for (const [, live] of livePreviews) stopQuietly(live);
     livePreviews.clear();
   };
 

package/bin/lib/workProcesses.mjs

@@ -1,10 +1,11 @@
 /** Claims and execution for stopping a measured session process. */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { isSafePathSegment } from './git.mjs';
 import { measureListeners } from './listeners.mjs';
 import { measureProcesses, liveGroups, processesSupported } from './processes.mjs';
 import { processAlive } from './procRegistry.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
 
 export function createWorkProcesses({ placeDir, reportPlaceWorktrees, sessionGroups }) {
   const KILL_DONE_URL = fleetEndpoint('kill-done', FLEET_URL);
@@ -47,41 +48,13 @@ export function createWorkProcesses({ placeDir, reportPlaceWorktrees, sessionGro
   // is the failure this whole comment is about.
   const killing = new Set(); // job ids in flight on this tick
 
-  const postKill = async (body) => {
-    try {
-      await fetch(KILL_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-    } catch {
-      /* unsettled, and the server expires it — the asker is told, never spun */
-    }
-  };
+  // Unsettled on any failure, and the server expires it — the asker is told,
+  // never spun.
+  const postKill = (body) => settleLease(KILL_DONE_URL, body, { timeoutMs: 30_000 });
 
-  const claimKill = async (id) => {
-    try {
-      const res = await fetch(KILL_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
-    } catch {
-      return false; // the peer may hold it; doing nothing is the safe answer
-    }
-  };
+  // Could not claim → do nothing: the peer may hold it (fleetPost.mjs's
+  // `claimFleetLease`, the one double-run guard).
+  const claimKill = (id) => claimFleetLease(KILL_CLAIM_URL, { id });
 
   /**
    * Is this pid, RIGHT NOW, one of the things we told the browser about for