flowviant 0.125.23 → 0.125.25

package/README.md

@@ -328,6 +328,20 @@ pinned because [npm 12 removed shrinkwrap support](https://github.com/npm/cli/bl
 and omits it from tarballs; npm 12 consumers also ignore that lockfile.
 No sibling repository or separate app deploy key is required.
 
+### Agent worktree startup and restart protection (0.125.24)
+
+Card launches verify their exact Git worktree and repository before starting,
+including after tool preparation. Fresh empty leftover directories are
+initialized; nonempty invalid directories are preserved. Verified Codex
+launches use an explicit cwd and the daemon's repository checks. Agent turns,
+retirement and manual fast-forwarding honor live CLI PID/start-time receipts
+across daemon restarts. Existing begun work still needs its worktree, surviving
+branch or published recovery copy; restarting the daemon alone does not reset
+a stuck board agent. No new wire floor or database migration is required.
+Published on npm and the standalone download channel on 2026-10-26. Running
+daemons receive the version signal from the app and update when idle, unless
+automatic updates are disabled.
+
 ### Staged artifact handoff revisions (0.125.18)
 
 A failed handoff's retry drops every pending source the agent's

package/bin/lib/artifactReporter.mjs

@@ -297,7 +297,7 @@ export function createArtifactReporter({
 
   /** Upload what this turn changed in `placeDir`. Resolves to the number of
    *  bodies SENT this call (delivered or held), for the tests and the log. */
-  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null, requiredOutputs = null, referenceCapture = false }) => {
+  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null, requiredOutputs = null, evidenceNames = [], referenceCapture = false }) => {
     if (!placeDir || (!sessionId && !agentId)) return 0;
     const changes = iterationChanges(placeDir, before);
     const protectedNames = imageRevisionProtection(before?.stored, before?.imageRevision);
@@ -334,9 +334,13 @@ export function createArtifactReporter({
     // discovery window. Re-walk safely, then verify the built bytes against
     // the prepared version before sending anything to storage.
     const discovered = idle ? [] : listChanged(placeDir, before);
-    const entries = required.size
-      ? [...scanArtifacts(placeDir, { all: true, includeNames: new Set(required.keys()) }),
-        ...discovered.filter(e => !artifactTypeFor(e.name))] // unsupported files still report by name
+    // Verification evidence is explicitly selected too, but never becomes a
+    // required producer input. Multiple review attempts can exceed the normal
+    // discovery window; retain their reports and captures on the same turn.
+    const selected = new Set([...required.keys(), ...evidenceNames]);
+    const entries = selected.size
+      ? [...scanArtifacts(placeDir, { all: true, includeNames: selected }),
+        ...discovered.filter(e => !selected.has(e.name) && (!required.size || !artifactTypeFor(e.name)))]
       : discovered;
     const changed = idle ? [] : entries.filter((e) =>
       !removing.has(artifactStoredName(e.name)) && (!includeNames || includeNames.has(e.name)));

package/bin/lib/intermediateArtifacts.mjs

@@ -11,6 +11,7 @@ import { ensureRealSubdir, realDirState } from './ownedDirs.mjs';
 import { scrub, secretIn } from './uplinkScrub.mjs';
 import { exportModelPage } from './modelExport.mjs';
 import { usableModelGlb } from './modelExportProtocol.mjs';
+import { uiReviewEvidenceNames } from './uiReviewArtifacts.mjs';
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex');
 const safeName = name => typeof name === 'string' && name.length <= 400 &&
@@ -18,6 +19,8 @@ const safeName = name => typeof name === 'string' && name.length <= 400 &&
 const copyPath = (sha256, name) => `.flowviant/artifacts/.handoff/${sha256}/${name}`;
 const taskOf = job => job.task?.id ?? job.repositoryTaskId ?? null;
 
+export class IntermediateArtifactCapacityError extends Error {}
+
 export function readIntermediateFile(wt, relative, max = ARTIFACT_BINARY_MODEL_MAX_BYTES) {
   if (!safeName(relative) || !relative.startsWith('.flowviant/artifacts/')) throw new Error('Unsafe intermediate artifact path.');
   const parts = dirname(relative).split('/');
@@ -99,9 +102,22 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     let state;
     try { state = JSON.parse(readFileSync(path, 'utf8')); }
     catch (error) { if (error.code === 'ENOENT') return { version: 1, agentId, files: [], pending: null }; throw new Error('The intermediate artifact receipt could not be read. Restore it before retrying.'); }
-    if (state.version !== 1 || state.agentId !== agentId || !Array.isArray(state.files) || state.files.length > 160 ||
+    if (state.version !== 1 || state.agentId !== agentId || !Array.isArray(state.files) || state.files.length > ARTIFACT_MAX_PER_AGENT ||
         state.files.some(f => !safeName(f.name) || f.path !== copyPath(f.sha256, f.name) || !/^[a-f0-9]{64}$/.test(f.sha256)))
       throw new Error('The intermediate artifact receipt has invalid identity or paths.');
+    // Older daemons put verification reports and captures in this producer
+    // receipt. Migrate the references, never delete the original evidence.
+    const evidence = uiReviewEvidenceNames(state.files, ref => {
+      let bytes;
+      try { bytes = readIntermediateFile(wt, ref.path, artifactMaxBytesFor(ref.name)); }
+      catch (error) {
+        if (error.code !== 'ENOENT' || realDirState(privateFiles) !== 'dir') throw error;
+        bytes = readRegular(join(privateFiles, ref.sha256), artifactMaxBytesFor(ref.name));
+      }
+      if (hash(bytes) !== ref.sha256) throw new Error('Review receipt hash mismatch');
+      return bytes;
+    });
+    state.files = state.files.filter(ref => !evidence.has(ref.name));
     return state;
   };
   const save = state => {
@@ -145,7 +161,12 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     const state = load(), taskId = taskOf(job);
     const identity = { agentId, taskId, turnId, taskKind };
     const standing = scanArtifacts(wt, { all: true });
-    let changed = changedArtifacts(before, standing);
+    const evidence = uiReviewEvidenceNames(standing, entry => readIntermediateFile(wt, `.flowviant/artifacts/${entry.name}`, artifactMaxBytesFor(entry.name)));
+    const changed = changedArtifacts(before, standing);
+    const evidenceNames = [...new Set([...changed.map(entry => entry.name), ...(state.pending?.sources ?? []).map(ref => ref.name)].filter(name => evidence.has(name)))];
+    let producerChanges = changed.filter(entry => !evidence.has(entry.name));
+    if (state.pending && !state.pending.recovery)
+      state.pending.sources = state.pending.sources.filter(ref => !evidence.has(ref.name));
     // Failed export/storage retries are tied to a card and exact source hash.
     // A changed page is a new version; it never reuses a previous GLB receipt.
     // A source the agent's iteration declaration discards or replaces is the
@@ -155,11 +176,11 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
       throw new Error('An exact producer recovery is pending. Retry that producer before starting different work.');
     if (pending?.recovery) {
       identity.recoveredFromTurnId = pending.recoverySourceTurnId ?? pending.turnId;
-      changed = changed.filter(e => pending.sources.some(s => s.name === e.name));
+      producerChanges = producerChanges.filter(e => pending.sources.some(s => s.name === e.name));
     }
     const discarded = pending ? declaredDiscards(wt) : new Set();
     if (pending) for (const ref of pending.sources) {
-      if (!pending.recovery && (changed.some(e => e.name === ref.name) || discarded.has(artifactStoredName(ref.name)))) continue;
+      if (!pending.recovery && (producerChanges.some(e => e.name === ref.name) || discarded.has(artifactStoredName(ref.name)))) continue;
       const entry = standing.find(e => e.name === ref.name);
       let bytes;
       try { bytes = readIntermediateFile(wt, `.flowviant/artifacts/${ref.name}`, artifactMaxBytesFor(ref.name)); }
@@ -167,16 +188,16 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
       if (hash(bytes) !== ref.sha256)
         throw new Error(`Required intermediate output ${ref.name} is missing or changed since the failed handoff. Restore it or revise the producer explicitly, then retry.`);
       if (!entry) throw new Error(`Required intermediate output ${ref.name} is outside the safe artifact walk (non-hidden paths with at most ${ARTIFACT_MAX_DEPTH} directories). Move it to a supported artifact path and retry this producer.`);
-      if (!changed.some(e => e.name === entry.name)) changed.push(entry);
+      if (!producerChanges.some(e => e.name === entry.name)) producerChanges.push(entry);
     }
-    if (taskKind === 'model' && !changed.some(e => /\.html?$/i.test(e.name)) && (job.kind !== 'task' || job.redo === true) && taskId) {
+    if (taskKind === 'model' && !producerChanges.some(e => /\.html?$/i.test(e.name)) && (job.kind !== 'task' || job.redo === true) && taskId) {
       for (const ref of state.files.filter(f => f.taskId === taskId && f.taskKind === 'model' && /\.html?$/i.test(f.name))) {
         const entry = standing.find(e => e.name === ref.name);
-        if (entry) changed.push(entry);
+        if (entry) producerChanges.push(entry);
       }
     }
-    const pages = taskKind === 'model' ? changed.filter(e => /\.html?$/i.test(e.name)) : [];
-    const outputs = changed.filter(e => artifactTypeFor(e.name));
+    const pages = taskKind === 'model' ? producerChanges.filter(e => /\.html?$/i.test(e.name)) : [];
+    const outputs = producerChanges.filter(e => artifactTypeFor(e.name));
     state.pending = { taskId, turnId, ...(pending?.recovery ? { recovery: true, recoverySourceTurnId: identity.recoveredFromTurnId } : {}), sources: outputs.map(e => ({ name: e.name, sha256: hash(readIntermediateFile(wt, `.flowviant/artifacts/${e.name}`, artifactMaxBytesFor(e.name))) })), exports: pending?.exports ?? [] };
     save(state);
     const exports = [];
@@ -207,7 +228,12 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     // would prune one of this very handoff's files and then falsely claim
     // complete delivery.
     if (outputs.length > ARTIFACT_MAX_PER_AGENT)
-      throw new Error(`This producer requires ${outputs.length} output files including model exports; artifact storage retains at most ${ARTIFACT_MAX_PER_AGENT} files per agent. Narrow this producer's output set before retrying; its handoff is unfinished.`);
+      throw new IntermediateArtifactCapacityError(`This producer requires ${outputs.length} output files including model exports; artifact storage retains at most ${ARTIFACT_MAX_PER_AGENT} files per agent. Narrow this producer's output set before retrying; its handoff is unfinished.`);
+    const retainedNames = new Set(state.files.map(ref => ref.name));
+    const newNames = outputs.filter(entry => !retainedNames.has(entry.name));
+    const total = retainedNames.size + newNames.length;
+    if (total > ARTIFACT_MAX_PER_AGENT)
+      throw new IntermediateArtifactCapacityError(`The intermediate artifact receipt has ${retainedNames.size} retained producer files plus ${newNames.length} new files (${total} total); artifact storage retains at most ${ARTIFACT_MAX_PER_AGENT} files per agent. Narrow the producer outputs before retrying; its handoff is unfinished.`);
     const textures = [...state.files.flatMap(f => [...(/\.png$/i.test(f.name) ? [f] : []), ...(f.model?.textureInputs ?? [])]),
       ...outputs.filter(e => /\.png$/i.test(e.name)).map(e => snapshot(wt, e, identity, retain))]
       .map(({ name, path, sha256, taskId, turnId, agentId, taskKind }) => ({ name, path, sha256, taskId, turnId, agentId, taskKind }));
@@ -225,10 +251,9 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     // Retry all prepared files even if their mtime did not change this turn.
     const uploadBefore = Object.assign(new Map(before), before);
     for (const ref of files) uploadBefore.delete(ref.name);
-    return { modelExports: exports, requiredOutputs: files.map(({ name, sha256 }) => ({ name, sha256 })), uploadBefore, commit: () => {
+    return { modelExports: exports, requiredOutputs: files.map(({ name, sha256 }) => ({ name, sha256 })), evidenceNames, uploadBefore, commit: () => {
       const byName = new Map(state.files.map(f => [f.name, f]));
       for (const ref of files) byName.set(ref.name, ref);
-      if (byName.size > 160) throw new Error('The intermediate artifact receipt exceeds 160 files. Narrow the outputs before retrying.');
       save({ ...state, files: [...byName.values()], pending: null });
     } };
   };

package/bin/lib/runTurn.mjs

@@ -204,6 +204,7 @@ function runPlainTurn(opts) {
     const stdinText = rt.stdin?.({ prompt, system, profile: turnProfile.adapterProfile }) ?? null;
     const args = rt.args({
       cardTurn: opts.cardTurn === true,
+      verifiedWorktree: opts.verifiedWorktree === true,
       orchestration: opts.orchestration === true,
       readOnlyCoordination: opts.readOnlyCoordination === true,
       // The lane's own measurement when it decided to orchestrate, so the

package/bin/lib/runtimeCodex.mjs

@@ -270,18 +270,17 @@ export const CODEX_RUNTIME = {
    * the prompt always carries them too. Workbench tabs keep their normal
    * checkout discovery.
    *
-   * `--skip-git-repo-check` is deliberately NOT passed by the build or any
-   * fence but research's: a task always builds in a git worktree, and if it
-   * somehow is not one, failing loudly beats silently editing files nobody
-   * can diff. A write-up reads a COPY with no `.git` and never resumes
-   * (codexResearch.mjs), so its fence passes it.
+   * Agent launches verify their exact worktree root and repository ownership
+   * through git before every spawn. Only those launches may replace Codex's
+   * own repository discovery with `--skip-git-repo-check`; this grants no
+   * project-config trust. Research's isolated copy has its own exception.
    *
    * The prompt positional stays last; runTurn uses `-` and sends the complete
    * framed text through stdin. A whole batch can exceed Linux's single-argument
    * limit even when its argv plus environment is far below ARG_MAX. Both exec
    * and exec resume support `-` (verified on Codex 0.160.0, 2026-10-16).
    */
-  args({ streamInput = false, writableDirs = [], prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads, cardTurn = false, codexVersion, orchestration = false, readOnlyCoordination = false }) {
+  args({ streamInput = false, writableDirs = [], prompt, system, model, effort, resume, resumeThreadId, profile = 'build', vaultDir, cwd, mcp = [], resultSchemaArgs = [], adoptResumeId, agentTools, personal = null, researchIsolation, knowledgeDir, projectReads, cardTurn = false, verifiedWorktree = false, codexVersion, orchestration = false, readOnlyCoordination = false }) {
     // Adoption resumes a conversation in ITS OWN CLI's store (claude forks,
     // agy moves) — codex has no adoptable store wired yet. Reaching here
     // with an adopt id is a wiring mistake upstream, and it fails loudly on
@@ -289,6 +288,8 @@ export const CODEX_RUNTIME = {
     // context with a different brain.
     if (adoptResumeId) throw new Error("codex has no adoptable terminal store — an adopt id can't reach this builder");
     const a = ['exec'];
+    // --cd belongs to exec, before resume (resume has no --cd option).
+    if (verifiedWorktree) a.push('--cd', cwd);
     // BY ID when the caller knows WHICH conversation this is — a Workbench
     // tab's held context, captured off thread.started and stored with its
     // worktree. `--last` resumes the machine's most recent codex conversation,
@@ -298,6 +299,7 @@ export const CODEX_RUNTIME = {
     if (resumeThreadId) a.push('resume', resumeThreadId);
     else if (resume) a.push('resume', '--last');
     a.push('--json');
+    if (verifiedWorktree) a.push('--skip-git-repo-check');
     if (agentTools) {
       a.push('-c', 'project_doc_max_bytes=0');
       // A person's existing developer instructions keep their authority.

package/bin/lib/turnLock.mjs

@@ -18,10 +18,23 @@
  * context), so it is scoped by the tab; the unscoped file is what a daemon
  * from before this change wrote, and is still honored while its CLI lives.
  */
-import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { aliveAndOurs, processStartTime } from './procRegistry.mjs';
 
+/** The child owns the receipt, so a daemon restart still sees its live PID. */
+export function recordTurnLock(path, pid) {
+  if (!path || !pid) return () => {};
+  const start = processStartTime(pid);
+  const value = start ? `${pid}:${start}` : String(pid);
+  writeFileSync(path, value);
+  return () => {
+    try {
+      if (readFileSync(path, 'utf8') === value) rmSync(path);
+    } catch { /* already removed, or replaced by another holder */ }
+  };
+}
+
 /**
  * The spawn lock: the pid of the CLI currently live in this tab. A restarted
  * daemon must not resume the conversation its previous life's orphan still

package/bin/lib/uiReview.mjs

@@ -157,7 +157,7 @@ export async function createUiReview({ wt, signal, capture = captureLocalReview,
     const stop = () => runController.abort();
     controller.signal.addEventListener('abort', stop, { once: true });
     const timer = setTimeout(stop, timeoutMs);
-    const record = { status: 'unavailable', before: reviewSourceState(wt), basis: reviewDiagnostic(input.basis), fixture: reviewDiagnostic(input.fixture.description),
+    const record = { purpose: 'ui-review', status: 'unavailable', before: reviewSourceState(wt), basis: reviewDiagnostic(input.basis), fixture: reviewDiagnostic(input.fixture.description),
       requestedScenarios: input.scenarios.map(s => ({ name: reviewDiagnostic(s.name), path: reviewDiagnostic(s.path), actions: s.actions.map(a => ({ type: a.type, ...(a.selector ? { selector: reviewDiagnostic(a.selector) } : {}) })) })),
       scenarios: [], consoleErrors: [], failedRequests: [] };
     let child, proxy, scratch, artifactDir, untrack;

package/bin/lib/uiReviewArtifacts.mjs

@@ -0,0 +1,30 @@
+/** Identify only files explicitly owned by a measured UI-review report.
+ * Legacy reports predate the purpose marker. A folder prefix alone never
+ * exempts producer data from handoff; unknown/unreadable reports exempt none.
+ * read receives the entry so callers can use immutable receipt bytes. */
+export function uiReviewEvidenceNames(entries, read) {
+  const evidence = new Set();
+  const byName = new Map(entries.map(entry => [entry.name, entry]));
+  for (const entry of entries) {
+    if (!/^ui-review-[a-f0-9]{8}-[a-f0-9]{3}\/report\.json$/.test(entry.name)) continue;
+    try {
+      const report = JSON.parse(read(entry));
+      const folder = entry.name.slice(0, -'/report.json'.length);
+      if (report.folder !== `.flowviant/artifacts/${folder}` ||
+          report.artifact !== `${report.folder}/report.json` ||
+          !report.before || !report.after || !Array.isArray(report.requestedScenarios) || !Array.isArray(report.scenarios) ||
+          (report.purpose !== undefined && report.purpose !== 'ui-review') ||
+          (report.screenshots !== undefined && !Array.isArray(report.screenshots))) continue;
+      const screenshots = report.screenshots ?? [];
+      if (screenshots.some(name => typeof name !== 'string' || !/^(desktop|mobile)-\d+-(initial|final|failure)\.png$/.test(name))) continue;
+      evidence.add(entry.name);
+      for (const name of screenshots) evidence.add(`${folder}/${name}`);
+      const delivery = byName.get(`${folder}/delivery-state.json`);
+      if (delivery) {
+        const state = JSON.parse(read(delivery));
+        if (state.finalState && typeof state.latestMatches === 'boolean' && Array.isArray(state.imageInputs)) evidence.add(delivery.name);
+      }
+    } catch { /* Unknown evidence remains an ordinary producer output. */ }
+  }
+  return evidence;
+}

package/bin/lib/uiReviewBrowser.mjs

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir, platform } from 'node:os';
@@ -39,6 +40,7 @@ export const LOCAL_REVIEW_BOOTSTRAP = `for (const name of ['RTCPeerConnection',
 export async function captureLocalReview({ origin, scenarios, artifactDir, signal,
   browser = resolveBrowser(), spawnImpl = spawn, timeoutMs = UI_REVIEW_TIMEOUT_MS, onChild = () => () => {} }) {
   const result = { status: 'unavailable', scenarios: [], consoleErrors: [], failedRequests: [], screenshots: [] };
+  const capturesByHash = new Map();
   if (!browser) return { ...result, reason: 'No Chrome/Chromium/Edge found; no browser checks ran.' };
   if (browser.viaWindows) return { ...result, reason: 'WSL Windows interop cannot carry the scoped DevTools pipe.' };
   if (signal?.aborted) return { ...result, reason: 'Review was cancelled before launch.' };
@@ -158,9 +160,19 @@ export async function captureLocalReview({ origin, scenarios, artifactDir, signa
             const shot = await send('Page.captureScreenshot', { format: 'png' });
             const bytes = Buffer.from(shot.data ?? '', 'base64');
             if (!bytes.length || bytes.length > 2 * 1024 * 1024) throw new Error('Screenshot was empty or exceeded the retained artifact size.');
-            const name = `${viewport.name}-${index + 1}-${phase}.png`;
-            writeFileSync(join(artifactDir, name), bytes, { flag: 'wx' });
-            row.screenshots.push(name); result.screenshots.push(name);
+            const sha256 = createHash('sha256').update(bytes).digest('hex');
+            let name = capturesByHash.get(sha256);
+            if (!name) {
+              name = `${viewport.name}-${index + 1}-${phase}.png`;
+              writeFileSync(join(artifactDir, name), bytes, { flag: 'wx' });
+              capturesByHash.set(sha256, name);
+              result.screenshots.push(name);
+            }
+            // Each capture keeps its viewport/scenario/phase even when its
+            // exact pixels already have a retained file in this review run.
+            row.captures ??= [];
+            row.captures.push({ phase, name, sha256 });
+            if (!row.screenshots.includes(name)) row.screenshots.push(name);
           };
           captureFailure = () => screenshot('failure');
           await screenshot('initial');

package/bin/lib/work.mjs

@@ -450,6 +450,7 @@ export function createWorkManager({
   // Retirement asks the agent lane which CLI to stop.
   const { heldSessionIds, retireWorkSessions, freshenManualPlaces } = createWorkRetire({
     repositoryPlaces, repoRoot,
+    sessionMetaPath,
     baseDir,
     baseRef,
     placeOf,

package/bin/lib/workAgentTurnBegun.mjs

@@ -13,6 +13,7 @@
  * through the one turn-done wire (workAgentTurnReports.mjs). Null means go on.
  */
 import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { git, sessionBranchRef } from './git.mjs';
 import { worktreePath } from './workPlaces.mjs';
 
@@ -49,6 +50,9 @@ export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublished
   // null directory AND a null ref below, and the null ref stands the guard
   // down — the same fail-open direction as an unreadable repo.
   const wtDir = worktreePath(baseDir, place);
+  // A shell left by an interrupted setup is not the agent's git worktree.
+  // The launch path validates ownership and readability before using it.
+  const hasWorktree = Boolean(wtDir && existsSync(join(wtDir, '.git')));
   const ref = sessionBranchRef(place);
   let hasBranch = false;
   /**
@@ -76,7 +80,7 @@ export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublished
       else branchMeasured = false;
     }
   }
-  if (branchMeasured && !existsSync(wtDir) && !hasBranch) {
+  if (branchMeasured && !hasWorktree && !hasBranch) {
     /**
      * …UNLESS THE WORK IS ON THE REMOTE (0.86.0).
      *
@@ -110,6 +114,6 @@ export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublished
     // opens a worktree on it below — the same path a directory somebody
     // cleaned up already takes, on commits this box now genuinely holds.
   }
-  if (hasBranch || (wtDir && existsSync(wtDir))) onAvailable();
+  if (hasBranch || hasWorktree) onAvailable();
   return null;
 }

package/bin/lib/workAgentTurnExecution.mjs

@@ -31,6 +31,8 @@ import { finishRepositoryDelivery, allResolutionsCommitted } from './repositoryD
 import { MODEL, PROJECT_ID } from './config.mjs';
 import { setRuntimeLimit } from './daemonState.mjs';
 import { gitOrNull } from './git.mjs';
+import { assertWorktree } from './worktreeHealth.mjs';
+import { placeTurnLockedByLivePid, recordTurnLock } from './turnLock.mjs';
 import { turnCommits } from './turnReceipts.mjs';
 import { addUsage } from './turnUsage.mjs';
 import { stashCard, stashGaps } from './agentCards.mjs';
@@ -65,7 +67,7 @@ import { ORCHESTRATED_POSTURES, orchestratesPosture } from './orchestratorPrompt
 import { knownCodexModels } from './runtimeOfferings.mjs';
 import { codexSubagentsSafe } from './runtimeCodex.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
-import { createIntermediateArtifacts } from './intermediateArtifacts.mjs';
+import { createIntermediateArtifacts, IntermediateArtifactCapacityError } from './intermediateArtifacts.mjs';
 import { createUiReview } from './uiReview.mjs';
 import { createVideoRender } from './videoRender.mjs';
 import { withUiReview, appendUiReviewEvidence } from './uiReviewTurn.mjs';
@@ -148,6 +150,10 @@ export function createAgentTurnExecution({
       return;
     }
     const wt = dir.wt;
+    const worktreeRepo = repositoryRun?.sources.find(r => r.wt === wt)?.repoRoot ?? repoRoot;
+    assertWorktree(wt, worktreeRepo);
+    const turnLock = sessionMetaPath(wt, 'flowviant-turn.lock', place);
+    if (placeTurnLockedByLivePid(sessionMetaPath(wt, 'flowviant-turn.lock'))) return;
     /**
      * NEITHER OF THESE MAY THROW. `git()` throws on a non-zero exit, and both
      * of these exit non-zero in states a real worktree reaches: `symbolic-ref`
@@ -412,6 +418,10 @@ export function createAgentTurnExecution({
     let videoNote = '';
     const runCli = (args) => {
       if (run.interrupted) return Promise.resolve('');
+      // Preparation awaits external work; remeasure before each fresh or
+      // resumed spawn, before replacing Codex's own repository discovery.
+      assertWorktree(wt, worktreeRepo);
+      args.verifiedWorktree = true;
       args = withUiReview(args, uiReviewNote, uiReview?.env);
       args = withUiReview(args, videoNote);
       return runTurnImpl(args);
@@ -667,6 +677,10 @@ export function createAgentTurnExecution({
         // (runTurn.mjs, `initHarvestFor`). An agent-only box learns from the
         // startup probe and its Terminal tabs.
         onSpawn: (ch) => {
+          let releaseTurnLock;
+          try { releaseTurnLock = recordTurnLock(turnLock, ch.pid); }
+          catch (error) { killGroup(ch); throw error; }
+          ch.once('close', releaseTurnLock);
           if (orchestrator && rt === 'codex') run.live?.connect((id, body) => orchestrator.input(id, body));
           if (rt !== 'claude') reportDelivery('agent', job, 'taken');
           brief?.running(true);
@@ -813,6 +827,9 @@ export function createAgentTurnExecution({
         try { intermediateDelivery = await intermediate.prepare({ job, turnId, taskKind, before: artifactsBefore, signal: setupController.signal }); }
         catch (error) {
           if (run.interrupted) throw error;
+          // A measured storage overflow must stop before sending a subset
+          // that could evict this producer's already retained inputs.
+          if (error instanceof IntermediateArtifactCapacityError) throw error;
           // The failed page still has its preview/files for repair. Reporting
           // those bytes cannot turn a failed export into a delivered card.
           try { await artifacts.report({ placeDir: wt, before: artifactsBefore, agentId, turnId, requireStored: kind.artifact != null }); }
@@ -821,7 +838,7 @@ export function createAgentTurnExecution({
         }
       }
       await artifacts.report({ placeDir: wt, before: intermediateDelivery?.uploadBefore ?? artifactsBefore, agentId, turnId,
-        requireStored: kind.artifact != null, requiredOutputs: intermediateDelivery?.requiredOutputs });
+        requireStored: kind.artifact != null, requiredOutputs: intermediateDelivery?.requiredOutputs, evidenceNames: intermediateDelivery?.evidenceNames });
     }
 
 

package/bin/lib/workPlaces.mjs

@@ -13,9 +13,10 @@
  * so a lane that learns a place cannot store one unvalidated.
  */
 import { readRepositoryPlace } from './repositoryPlaces.mjs';
-import { existsSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { git, isSafePathSegment, hasCommits, gitFailure, sessionBranch } from './git.mjs';
+import { assertWorktree } from './worktreeHealth.mjs';
 
 /** The place id meaning "the checkout", not a worktree. Must match the
  *  server's REPO_PLACE — it is a wire value, not a local convention. The
@@ -213,6 +214,7 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
    * same way adoption resolves a cwd, and for the same reason.
    */
   const placeWtFor = (placeId, baseAt) => {
+    placeWtFor.lastError = null;
     if (placeId === REPO_PLACE) {
       // The checkout. `fresh: false` on purpose — nothing was opened, so no
       // caller may treat this as a newly-cut branch.
@@ -220,7 +222,14 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
     }
     const wt = worktreePath(baseDir, placeId);
     if (!wt) return null;
-    const fresh = !existsSync(wt);
+    let fresh;
+    try {
+      fresh = !existsSync(wt) || readdirSync(wt).length === 0;
+      if (!fresh) assertWorktree(wt, repoRoot);
+    } catch (error) {
+      placeWtFor.lastError = error.message;
+      return null;
+    }
     if (fresh) {
       const branch = sessionBranch(placeId);
       // `baseAt` is the adoption override: a tab born from a terminal session
@@ -276,6 +285,8 @@ export function createWorkPlaces({ repoRoot, baseDir, baseRef, onRepoChanged })
       // always did (runTurn.mjs spawns with `{...process.env}`), so anything
       // exported in the shell the daemon was started from is present here.
     }
+    try { assertWorktree(wt, repoRoot); }
+    catch (error) { placeWtFor.lastError = error.message; return null; }
     return { wt, fresh };
   };
 

package/bin/lib/workRetire.mjs

@@ -12,6 +12,7 @@ import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { git, isSafePathSegment } from './git.mjs';
 import { PERSON_PLACE_PREFIX } from './workPlaces.mjs';
+import { placeTurnLockedByLivePid } from './turnLock.mjs';
 
 export function createWorkRetire({
   repositoryPlaces,
@@ -24,6 +25,7 @@ export function createWorkRetire({
   workTokens,
   agentChildren,
   sweepMergedSessionBranch,
+  sessionMetaPath,
 }) {
   /**
    * Retire the worktrees of sessions the server says are CLOSED.
@@ -111,6 +113,8 @@ export function createWorkRetire({
       if (placeLocks.has(placeOf(id)) || shipping.has(id)) continue; // still draining here
       const wt = join(dir, id);
       try {
+        const places = repositoryPlaces?.stateFor(id) ? repositoryPlaces.entries(id).filter(r => r.writable).map(r => r.wt) : [wt];
+        if (places.some(path => placeTurnLockedByLivePid(sessionMetaPath?.(path, 'flowviant-turn.lock')))) continue;
         // Uncommitted work is the human's — a resource sweep does not outrank
         // it, closed tab or not. (The non-force remove would refuse anyway;
         // the explicit check keeps the intent legible.)
@@ -179,6 +183,7 @@ export function createWorkRetire({
       if (placeLocks.has(place)) continue;
       const wt = join(baseDir, 'sessions', place);
       try {
+        if (placeTurnLockedByLivePid(sessionMetaPath?.(wt, 'flowviant-turn.lock'))) continue;
         if (git(['status', '--porcelain'], wt).trim() !== '') continue;
         git(['merge', '--ff-only', baseRef()], wt);
       } catch {

package/bin/lib/worktreeHealth.mjs

@@ -0,0 +1,23 @@
+/** Verify the directory itself, rather than a parent git happened to discover. */
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { git } from './git.mjs';
+
+export function assertWorktree(wt, repoRoot) {
+  try {
+    const top = realpathSync(git(['rev-parse', '--show-toplevel'], wt));
+    if (top !== realpathSync(wt)) throw new Error('the directory is not a git worktree root');
+    const common = (dir) => realpathSync(resolve(dir, git(['rev-parse', '--git-common-dir'], dir)));
+    if (common(wt) !== common(repoRoot)) throw new Error('the worktree belongs to another repository');
+    const registered = git(['worktree', 'list', '--porcelain', '-z'], repoRoot).split('\0')
+      .some(line => {
+        if (!line.startsWith('worktree ')) return false;
+        try { return realpathSync(line.slice(9)) === top; } catch { return false; }
+      });
+    if (!registered) throw new Error('the worktree is not registered with this repository');
+    git(['rev-parse', '--verify', 'HEAD'], wt);
+  } catch (error) {
+    const why = error.stderr?.toString().trim() || error.message;
+    throw new Error(`The worktree at ${wt} is unavailable: ${why}`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.23",
+  "version": "0.125.25",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {