flowviant 0.125.6 → 0.125.9

package/bin/lib/workAgentTurnReports.mjs

@@ -14,11 +14,13 @@
  * Daemon→server reports, every one of them: no version floor, and a permanent
  * 4xx is the server saying it will never take the body (see each POST).
  */
+import { join } from 'node:path';
+import { createReportJournal } from './reportJournal.mjs';
 import { FLEET_URL } from './config.mjs';
 import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
 import { fleetHeaders, postFleetJson } from './fleetPost.mjs';
 
-export function createAgentTurnReports({ REJECT_RETRY_MS }) {
+export function createAgentTurnReports({ REJECT_RETRY_MS, baseDir = null }) {
   const AGENT_TURN_DONE_URL = fleetEndpoint('agent-turn-done', FLEET_URL);
   const AGENT_TRACE_URL = fleetEndpoint('agent-trace', FLEET_URL);
   const AGENT_ACTIVITY_URL = fleetEndpoint('agent-activity', FLEET_URL);
@@ -40,8 +42,17 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
    * BOUNDED by the roster itself: a held body's clock is refreshed while the
    * server keeps offering its turn, and once offering stops — settled by the
    * re-POST, or expired server-side — the grace below is all that keeps it.
+   *
+   * EVERY HELD BODY IS JOURNALED (2026-10-20), not only a merge recovery's.
+   * Any agent turn whose body was held in memory alone lost it to a restart
+   * between the answer and the server's 200, and the server's re-offer to the
+   * successor ran the turn again. The settle is bound to the machine
+   * credential, not the process, so the successor's re-POST lands it.
    */
-  const agentReported = new Map(); // turnId -> { body, at }
+  const journal = baseDir ? createReportJournal(join(baseDir, 'agent-recovery-reports')) : null;
+  const agentReported = new Map((journal?.load().work ?? []).filter(([id, held]) =>
+    held?.body?.turnId === id && typeof held.at === 'number'));
+  const persistRecovery = () => journal?.save(new Map(agentReported), new Map()); // turnId -> { body, at }
   const agentRejectedUntil = new Map(); // turnId -> earliest re-POST of a refused body
   const AGENT_REPORT_GRACE_MS = 30 * 60_000;
 
@@ -53,6 +64,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
   const postAgentTurn = async (body) => {
     const turnId = String(body.turnId);
     agentReported.set(turnId, { body, at: Date.now() });
+    persistRecovery();
     try {
       const res = await postFleetJson(AGENT_TURN_DONE_URL, body, { timeoutMs: 30_000 });
       const j = await res.json().catch(() => null);
@@ -68,9 +80,10 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
        * class. So a refused body stays HELD — it is the skip-guard — and its
        * re-POST backs off instead of hammering a body the server just refused.
        */
-      if (res.ok) {
+      if (res.ok && (body.mergeResolved === undefined || typeof j?.data?.settled === 'boolean')) {
         agentReported.delete(turnId);
         agentRejectedUntil.delete(turnId);
+        persistRecovery();
       } else if (isConsideredRefusal(res.status)) {
         agentRejectedUntil.set(turnId, Date.now() + REJECT_RETRY_MS);
       }
@@ -114,6 +127,21 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
     }
   };
 
+  /** The CLI's context measure for a running turn (2026-10-19); the server
+   *  drops one whose turn already settled. Best effort, like the line. */
+  const postAgentContext = async (agentId, turnId, context) => {
+    try {
+      await fetch(AGENT_ACTIVITY_URL, {
+        method: 'POST',
+        headers: fleetHeaders(),
+        signal: AbortSignal.timeout(15_000),
+        body: JSON.stringify({ agentId, turnId, context }),
+      });
+    } catch {
+      /* a readout; the next measurement replaces it */
+    }
+  };
+
   const postAgentParked = async (reason, runtime) => {
     try {
       await fetch(AGENT_PARKED_URL, {
@@ -145,6 +173,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
       else if (now - held.at > AGENT_REPORT_GRACE_MS) {
         agentReported.delete(id);
         agentRejectedUntil.delete(id);
+        persistRecovery();
       }
     }
   };
@@ -153,6 +182,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
     postAgentTurn,
     postAgentTrace,
     postAgentActivity,
+    postAgentContext,
     postAgentParked,
     pruneHeldReports,
     agentReported,

package/bin/lib/workAgentTurnShape.mjs

@@ -24,7 +24,7 @@
  */
 import { AGENT_TASK_KICKOFF, AGENT_HUMAN_KICKOFF, SYSTEM_AGENT_FOR, withProjectContext } from './prompts.mjs';
 import { INTERNAL_WAIT_CONTRACT } from './agentInternalWait.mjs';
-import { ORCHESTRATOR_CONTRACT } from './orchestratorPrompt.mjs';
+import { orchestratorContract } from './orchestratorPrompt.mjs';
 
 /** What every kickoff of this job is handed: the agent, the card and its
  *  discussion, the job's context handoffs, the card's files, the place in
@@ -74,8 +74,10 @@ export const agentFollowupKickoff = (job, followup, { cardFiles, messageFiles, o
     messageFiles,
   });
 
-/** The turn's system prompt, in its fixed section order. */
-export function agentTurnSystem({ taskKind, runtimeLabel, prerequisitesAccepted, knowledgeDir, artifactsAccepted, toolsNote, artifactInstructions, toolInstructions, repositoryRun, orchestrated }) {
+/** The turn's system prompt, in its fixed section order. `orchestration` is
+ *  null on a solo run, else what the contract names: `{ posture, runtime,
+ *  model, effort }` (orchestratorPrompt.mjs). */
+export function agentTurnSystem({ taskKind, runtimeLabel, prerequisitesAccepted, knowledgeDir, artifactsAccepted, toolsNote, artifactInstructions, toolInstructions, repositoryRun, orchestration = null }) {
   // The knowledge paragraph, when this box holds a library — the same
   // composer the tabs use, so an agent and a tab can never be told two
   // different things about the same directory.
@@ -86,5 +88,5 @@ export function agentTurnSystem({ taskKind, runtimeLabel, prerequisitesAccepted,
     // ARTIFACTS (0.94.0), while the server can show one — an agent's
     // land on its page, under the facts row.
     artifacts: artifactsAccepted,
-  }) + (toolsNote ? `\n\n${toolsNote}` : '') + (artifactInstructions ? `\n\n${artifactInstructions}` : '') + `\n\n${INTERNAL_WAIT_CONTRACT}` + (toolInstructions ? `\n\n${toolInstructions}` : '') + (repositoryRun ? `\n\n${repositoryRun.note}\nRepository command argv: ${JSON.stringify([repositoryRun.tool?.config.command, ...(repositoryRun.tool?.config.args.slice(0, -1) ?? []), "__repository", "<name>"])}` : '') + (orchestrated ? `\n\n${ORCHESTRATOR_CONTRACT}` : '');
+  }) + (toolsNote ? `\n\n${toolsNote}` : '') + (artifactInstructions ? `\n\n${artifactInstructions}` : '') + `\n\n${INTERNAL_WAIT_CONTRACT}` + (toolInstructions ? `\n\n${toolInstructions}` : '') + (repositoryRun ? `\n\n${repositoryRun.note}\nRepository command argv: ${JSON.stringify([repositoryRun.tool?.config.command, ...(repositoryRun.tool?.config.args.slice(0, -1) ?? []), "__repository", "<name>"])}` : '') + (orchestration ? `\n\n${orchestratorContract(orchestration)}` : '');
 }

package/bin/lib/workAgentTurns.mjs

@@ -1,3 +1,4 @@
+import { reportAgentOutcome } from './workActivity.mjs';
 /**
  * THE AGENT-TURN LANE: which offered turns run on this machine, and that each
  * one is settled exactly once.
@@ -27,7 +28,7 @@ import { createAgentTurnReports } from './workAgentTurnReports.mjs';
 import { createAgentTurnExecution } from './workAgentTurnExecution.mjs';
 import { failedTurnSettlement, interruptedTurnSettlement } from './workAgentTurnOutcome.mjs';
 import { turnCommits } from './turnReceipts.mjs';
-import { killGroup } from './processGroup.mjs';
+import { interruptThenKill } from './processGroup.mjs';
 import { createDeliveryReporter } from './workDelivery.mjs';
 import { createAgentBriefRunner } from './workAgentBriefRunner.mjs';
 
@@ -64,11 +65,12 @@ export function createWorkAgentTurns({
     postAgentTurn,
     postAgentTrace,
     postAgentActivity,
+    postAgentContext,
     postAgentParked,
     pruneHeldReports,
     agentReported,
     agentRejectedUntil,
-  } = createAgentTurnReports({ REJECT_RETRY_MS });
+  } = createAgentTurnReports({ REJECT_RETRY_MS, baseDir });
 
   // ── AGENT TURNS: one task per prompt ───────────────────────────────────────
   //
@@ -135,6 +137,7 @@ export function createWorkAgentTurns({
     agentChildren,
     postAgentTrace,
     postAgentActivity,
+    postAgentContext,
     postAgentParked,
     fetchAgentFiles,
     makeLiveMessages,
@@ -203,7 +206,8 @@ export function createWorkAgentTurns({
     };
     const settleOnce = (body) => {
       settled = true;
-      return postAgentTurn(withLiveReceipts(body));
+      reportAgentOutcome(job, body);
+      return postAgentTurn(withLiveReceipts(job.kind === 'merge_resolve' ? { ...body, mergeResolved: body.mergeResolved ?? false } : body));
     };
 
     // A WRITER on the agent's own place — see the lane header. Only `a-<id>`
@@ -219,11 +223,11 @@ export function createWorkAgentTurns({
         if (settled) return;
         const commits = turnCommits({ repositoryReceipts: measured.repositoryReceipts, wt: measured.wt, before: measured.before, baseRef });
         if (run.interrupted) {
-          await postAgentTurn(withLiveReceipts(interruptedTurnSettlement({ turnId, ran: measured.ranCli === true, commits, usage: measured.usage, model: measured.model, branch: measured.branch, wt: measured.wt })));
+          await settleOnce(interruptedTurnSettlement({ turnId, ran: measured.ranCli === true, commits, usage: measured.usage, model: measured.model, branch: measured.branch, wt: measured.wt }));
           return;
         }
-        await postAgentTurn(
-          withLiveReceipts(failedTurnSettlement({
+        await settleOnce(
+          failedTurnSettlement({
             turnId,
             error,
             commits,
@@ -231,7 +235,7 @@ export function createWorkAgentTurns({
             model: measured.model,
             branch: measured.branch,
             wt: measured.wt,
-          }))
+          })
         );
       }
     }, () => {
@@ -434,7 +438,7 @@ export function createWorkAgentTurns({
         run.interrupted = true;
         run.abortSetup?.();
         const child = agentChildren.get(run.place);
-        if (child) killGroup(child);
+        if (child) interruptThenKill(child);
         continue;
       }
       if (agentReported.has(id) || notRunningSaid.has(id)) continue;

package/bin/lib/workAttachments.mjs

@@ -54,6 +54,8 @@ export function createWorkAttachments() {
    * doing that check is one deploy away from being zero places.
    */
   const UPLOAD_DIR = '.flowviant/uploads';
+  /** The pause before a file fetch's one retry. */
+  const RETRY_FETCH_MS = 1_000;
   // `safeFileName` (bin/lib/safeFileName.mjs — the server's rule, one daemon
   // home): THE EXTENSION SURVIVES A CUT, and it is idempotent over its own
   // output, so re-applying it to what the server already sanitized is a no-op
@@ -151,10 +153,17 @@ export function createWorkAttachments() {
       if (!a?.id || typeof a.id !== 'string' || !/^[0-9a-f-]{8,64}$/i.test(a.id)) continue;
       if (Number(a.size) > ATTACHMENT_MAX_BYTES) continue;
       try {
-        const res = await fetch(`${FILE_URL[endpoint]}/${a.id}`, {
+        // ONE MORE TRY for a blip (2026-10-19): a dropped connection or a 5xx
+        // cost the file outright. A 4xx is the server's answer and stands.
+        const get = () => fetch(`${FILE_URL[endpoint]}/${a.id}`, {
           headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
           signal: AbortSignal.timeout(60_000),
         });
+        let res = await get().catch(() => null);
+        if (!res || res.status >= 500) {
+          await new Promise((r) => setTimeout(r, RETRY_FETCH_MS));
+          res = await get();
+        }
         if (!res.ok) continue;
         const buf = Buffer.from(await res.arrayBuffer());
         if (buf.byteLength === 0 || buf.byteLength > ATTACHMENT_MAX_BYTES) continue;
@@ -187,12 +196,25 @@ export function createWorkAttachments() {
     return landed;
   };
 
-  /** @returns relative paths written, in the order the human attached them. */
-  const fetchAttachments = async (wt, attachments) => {
+  /**
+   * A TAB MESSAGE'S FILES, each `{ path }` landed or `{ missed: name }`
+   * (2026-10-19). The Terminal listed only what arrived, on the argument that
+   * its person is watching and re-attaches — but the person sees the file's
+   * chip on their message whether it arrived or not, and a CLI told nothing
+   * answered as if it had read it. Named, a miss is said in the reply, as the
+   * agent lane's always were (`fetchAgentFiles`).
+   */
+  const fetchTabFiles = async (wt, attachments) => {
     if (!Array.isArray(attachments) || attachments.length === 0) return [];
-    return (await landFiles(wt, attachments.slice(0, 8), 'attachment', false)).filter(Boolean);
+    const list = attachments.slice(0, 8);
+    const landed = await landFiles(wt, list, 'attachment', false);
+    return list.map((a, i) => (landed[i] ? { path: landed[i] } : { missed: safeUploadName(a?.name) }));
   };
 
+  /** @returns relative paths written, in the order the human attached them. */
+  const fetchAttachments = async (wt, attachments) =>
+    (await fetchTabFiles(wt, attachments)).flatMap((f) => (f.path ? [f.path] : []));
+
   /**
    * AN AGENT TURN'S FILES (0.112.0), read off the wire (agentFiles.mjs: each
    * origin at the server's cap, message files first) and fetched from
@@ -218,5 +240,5 @@ export function createWorkAttachments() {
     return out;
   };
 
-  return { fetchAttachments, fetchAgentFiles };
+  return { fetchAttachments, fetchTabFiles, fetchAgentFiles };
 }

package/bin/lib/workIntake.mjs

@@ -1,3 +1,4 @@
+import { reportWorkOutcome } from './workActivity.mjs';
 /** One leased incoming ticket, drafted by this machine's read-only CLI. */
 import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
@@ -39,12 +40,17 @@ export function createWorkIntake({
   const claim = (id) =>
     claimFleetLease(claiming, { id }, { won: (r) => r.status === 200 && r.json?.ok === true });
 
-  const report = async (body) => {
+  const sendReport = async (body) => {
     await postBestEffort(done, { ...body, instance: DAEMON_INSTANCE });
   };
 
   const run = async (job, releaseSlot) => {
     const id = String(job.id);
+    const work = { kind: 'intake', id, name: job.title || 'Incoming ticket', turnId: id };
+    const report = body => {
+      reportWorkOutcome(work, { outcome: body.outcome === INTAKE_OUTCOMES.drafted ? 'drafted' : 'nothing', answer: body.error });
+      return sendReport(body);
+    };
     // No stand-down check here, as in the plan lane: a standing-down loop stops
     // processing the roster, and the one spawn gate is runTurn's own
     // (standDownGate.mjs; its pin keeps the askers few).
@@ -80,7 +86,7 @@ export function createWorkIntake({
             cwd: repoRoot,
             runtime,
             answerFromResult: true,
-            label: c.cyan('[intake]'),
+            work,
             // There is no MCP principal for a ticket, and no model or effort pin:
             // this one-shot reader uses the machine's consult defaults.
             onUsage: (u) => { usage = addUsage(usage, { ...u, runtime }); },

package/bin/lib/workMergeBatch.mjs

@@ -1,3 +1,5 @@
+import { reportWorkOutcome } from './workActivity.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
 /** The daemon holds every selected place while one personal CLI integrates it. */
 import { trackedRepositorySetup } from './repositorySetup.mjs';
 import { git } from './git.mjs';
@@ -25,6 +27,7 @@ export function createWorkMergeBatch({ repositoryPlaces, repoRoot, baseDir, inPl
   };
   return async (job) => {
     const spec = job.batch.spec;
+    const work = { kind: 'batch merge', id: spec.id, name: 'Selected merge', turnId: spec.id };
     const hold = admit?.('churn');
     if (hold) return;
     const release = admit?.reserve?.() ?? (() => {});
@@ -33,6 +36,7 @@ export function createWorkMergeBatch({ repositoryPlaces, repoRoot, baseDir, inPl
       const claim = await request('agent-merge-batch-claim', { batchId: spec.id });
       if (!claim?.claimed) return;
       claimed = true;
+      createTurnOutput({ work }).event('Merge started', 'start');
       if (spec.members.some((m) => !isSafePathSegment(m.placeId))) throw new Error('A selected agent has no valid worktree identity.');
       // Renewal covers a long coordinator or validation command, not just Git beats.
       timer = setInterval(() => { void request('agent-merge-batch-progress', { batchId: spec.id, progress: {} }).catch(() => {}); }, 60_000);
@@ -68,7 +72,7 @@ export function createWorkMergeBatch({ repositoryPlaces, repoRoot, baseDir, inPl
                 turnArgs: { prompt: mergeBatchPrompt(context), system: MERGE_BATCH_SYSTEM,
                   runtime, profile: 'build', knowledgeDir: knowledgeDirFor(repoRoot), model: leader.model || undefined, effort: leader.effort || undefined,
                   cwd: context.repositories[0].integrationWorktree, writableDirs: context.repositories.filter((r) => !r.alreadyLanded).map((r) => r.integrationWorktree),
-                  answerFromResult: true, label: '[batch merge]' } });
+                  answerFromResult: true, work } });
               if (result.wedged) throw new Error('The coordinating CLI ran out of time. Retry the batch to continue with its saved integration work.');
               return candidateObjects(String(result.out ?? '')).find((r) => r.status === 'delivered' || r.status === 'blocked');
             } finally { if (child) groupKillChildren?.delete(child); }
@@ -84,9 +88,11 @@ export function createWorkMergeBatch({ repositoryPlaces, repoRoot, baseDir, inPl
         reporting = true;
         const done = await request('agent-merge-batch-done', { batchId: spec.id, ok: true });
         if (!done?.settled) throw new Error('The combined merge result has not been acknowledged. Retry will remeasure base.');
+        reportWorkOutcome(work, { outcome: 'merged' });
         onRepoChanged(); landed.observe();
       });
     } catch (e) {
+      if (claimed) reportWorkOutcome(work, { outcome: 'nothing', answer: relayedText([e?.stdout, e?.stderr, e?.message].filter(Boolean).join('\n')) });
       // After a successful push/report attempt, leave the lease for replay: a transport
       // failure says nothing about whether the server committed the final receipt.
       if (claimed && !reporting) {

package/bin/lib/workNarration.mjs

@@ -82,7 +82,39 @@ export function createWorkNarration() {
       }, wait);
       timer.unref?.(); // never hold the process open for a spinner
     };
+    // THE CONTEXT READOUT rides the same door with its turn (2026-10-19):
+    // the latest measurement only, one POST at a time, never a turn's failure.
+    // The server writes no narration line for a context post.
+    let ctxPending = null;
+    let ctxSending = false;
+    const sendContext = async () => {
+      ctxSending = true;
+      while (ctxPending && !stopped) {
+        const context = ctxPending;
+        ctxPending = null;
+        try {
+          await fetch(ACTIVITY_URL, {
+            method: 'POST',
+            headers: {
+              Authorization: `Bearer ${FLEET_TOKEN}`,
+              'User-Agent': USER_AGENT,
+              'Content-Type': 'application/json',
+            },
+            signal: AbortSignal.timeout(10_000),
+            body: JSON.stringify({ sessionId, turnId, lines: [], context }),
+          });
+        } catch {
+          /* a readout is decoration, like the line */
+        }
+      }
+      ctxSending = false;
+    };
     return {
+      context(measured) {
+        if (!turnId || stopped || !measured) return;
+        ctxPending = measured;
+        if (!ctxSending) void sendContext();
+      },
       line(label) {
         // Scrub, like every string that leaves this machine: a narration line
         // is the CLI's own stdout — a command echoing an env var, a read of a

package/bin/lib/workPlanRecovery.mjs

@@ -0,0 +1,50 @@
+/** The person's own CLI diagnoses planning, under the ordinary consult fence. */
+import { candidateObjects } from './modelJson.mjs';
+import { scrub } from './uplinkScrub.mjs';
+import { fleetRequest } from './fleetPost.mjs';
+import { DAEMON_INSTANCE } from './config.mjs';
+
+export const PLAN_RECOVERY_SYSTEM = `You are recovering the person's retained Plan press.
+Read the original selection, failure, retained evidence, answers and repository.
+Establish the cause before claiming a repair. Diagnose/debug the planning failure
+with the available read-only tools. Repair the planning approach, context or output
+instructions. Do not change repository files, start agents or approve work.
+Retry count is never a reason to ask the person to click Plan again.
+Only ask for an answer, credential action or changed-scope decision that reading
+and diagnosis cannot supply. Ask one specific question and explain what it settles.
+Return one JSON object: {"status":"repaired","summary":"cause and corrected approach"}
+or {"status":"question","question":"specific question","context":"findings"}.
+A repaired result is followed automatically by a fresh planning turn on the same
+selection and chosen CLI/model/effort. The result is a proposal for human review. When recovery.start is present, the person
+already approved only that Start group: diagnose its admission or pickup failure,
+preserve its exact ordered selection, CLI and creation/attachment choice, and
+repair only its planning context. A valid same-scope repair continues that approval
+automatically; any genuine scope decision needs a specific question first.`;
+
+export function parsePlanDiagnosis(out) {
+  for (const v of candidateObjects(String(out ?? ''))) {
+    if (v.status === 'repaired' && typeof v.summary === 'string' && v.summary.trim())
+      return { status: 'repaired', summary: scrub(v.summary) };
+    if (v.status === 'question' && typeof v.question === 'string' && v.question.trim())
+      return { status: 'question', question: scrub(v.question), ...(typeof v.context === 'string' ? { context: scrub(v.context) } : {}) };
+  }
+  return null;
+}
+
+/** Unknown transport state never means Stop. Only an answered holder read does. */
+export async function watchPlanAttempt(url, job) {
+  const controller = new AbortController();
+  let busy = false;
+  const check = async () => {
+    if (busy) return;
+    busy = true;
+    try {
+      const r = await fleetRequest(url, { body: { id: job.id, attempt: job.attempt, instance: DAEMON_INSTANCE }, timeoutMs: 15_000 });
+      if (r.ok && r.json?.data?.active === false) controller.abort();
+    } finally { busy = false; }
+  };
+  await check();
+  const timer = setInterval(check, 5_000);
+  timer.unref?.();
+  return { signal: controller.signal, check, stop: () => clearInterval(timer) };
+}

package/bin/lib/workReportQueue.mjs

@@ -19,6 +19,7 @@ import { sweepMergedBranch } from './shipSweep.mjs';
 import { note } from './ui.mjs';
 import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
 import { fleetRequest } from './fleetPost.mjs';
+import { createReportJournal } from './reportJournal.mjs';
 
 export function createWorkReportQueue({
   repoRoot,
@@ -29,6 +30,9 @@ export function createWorkReportQueue({
   onRepoChanged,
   reportPlaceWorktrees,
   burstListeners,
+  /** Where the queue survives a restart (`reportJournal.mjs`); absent, the
+   *  queue lives in memory only, as it did before 2026-10-19. */
+  journalDir = null,
 }) {
   const WORK_DONE_URL = fleetEndpoint('work-turn-done', FLEET_URL);
   const SHIP_DONE_URL = fleetEndpoint('ship-done', FLEET_URL);
@@ -43,6 +47,16 @@ export function createWorkReportQueue({
    */
   const pendingWorkReports = new Map(); // turnId -> work-turn-done body
   const pendingShipReports = new Map(); // sessionId -> ship-done body
+  // …AND ON DISK, so a restart between the answer and the 200 delivers the
+  // answer rather than re-running the turn (reportJournal.mjs). Seeded once;
+  // the first poll's flush delivers what a previous process left.
+  const journal = journalDir ? createReportJournal(journalDir) : null;
+  if (journal) {
+    const kept = journal.load();
+    for (const [id, body] of kept.work) pendingWorkReports.set(id, body);
+    for (const [id, body] of kept.ship) pendingShipReports.set(id, body);
+  }
+  const persist = () => journal?.save(pendingWorkReports, pendingShipReports);
   /** POST a settle body. Four outcomes, and the split between the last two is
    *  load-bearing:
    *   - 'ok' — delivered.
@@ -142,10 +156,13 @@ export function createWorkReportQueue({
   const deliver = async (q, id, body) => {
     const r = await postSettle(q.url, body, q.terminal);
     if (r === 'retry' || r === 'reject') {
+      const fresh = !q.pending.has(id);
       q.pending.set(id, body);
+      if (fresh) persist();
       if (r === 'reject') reportBackoff.set(backoffKey(q, id), Date.now() + REJECT_RETRY_MS);
     } else {
-      q.pending.delete(id);
+      const held = q.pending.delete(id);
+      if (held) persist();
       reportBackoff.delete(backoffKey(q, id));
       q.delivered(id);
     }