flowviant 0.40.1 → 0.43.0

package/bin/lib/fleet.mjs

@@ -57,8 +57,10 @@ import {
   SYSTEM_PLAN_CHECK,
   PLAN_CHECK_KICKOFF,
   REGROUND_KICKOFF,
-  SYSTEM_CONSULT,
-  CONSULT_KICKOFF,
+  SYSTEM_PLAN,
+  PLAN_TURN_KICKOFF,
+  SYSTEM_WORK,
+  WORK_TURN_KICKOFF,
   SYSTEM_QUICK_EDIT,
   QUICK_EDIT_KICKOFF,
 } from './claude.mjs';
@@ -191,7 +193,7 @@ function sampleDiffstat(cwd, baseRef, intentId, agentId) {
         signal: AbortSignal.timeout(15_000),
         // The lane, not just the task: the server matches the run on both, so a
         // sample can only ever overwrite the diffstat of THIS lane's own run.
-        body: JSON.stringify({ intentId, agentId, diffstat: stat }),
+        body: JSON.stringify({ taskId: intentId, agentId, diffstat: stat }),
       });
       // Only a sample the server ACCEPTED counts as sent. Marking it delivered
       // before the round-trip meant a dropped request suppressed every retry
@@ -575,7 +577,7 @@ export async function runFleetDaemon() {
           // roster re-serves the job every poll, and each pass reverts the
           // revert — the change flapping in and out of the owner's tree forever.
           await reportMergeOutcome(PATCH_REVERT_DONE_URL, {
-            intentId: job.id,
+            taskId: job.id,
             ok: res.ok,
             error: res.ok ? undefined : String(res.error ?? 'revert failed'),
           });
@@ -693,9 +695,12 @@ export async function runFleetDaemon() {
   const checkingPlans = new Set();
   const processPlanCheckJobs = (jobs) => {
     for (const job of jobs ?? []) {
-      if (!job || typeof job.id !== 'string' || !Array.isArray(job.intents)) continue;
+      // New name first; the roster mirrors `intents` off `tasks` for exactly
+      // this fallback window.
+      const planTasks = Array.isArray(job?.tasks) ? job.tasks : job?.intents;
+      if (!job || typeof job.id !== 'string' || !Array.isArray(planTasks)) continue;
       if (checkingPlans.has(job.id)) continue;
-      if (job.intents.length === 0) continue;
+      if (planTasks.length === 0) continue;
       checkingPlans.add(job.id);
       (async () => {
         try {
@@ -711,7 +716,7 @@ export async function runFleetDaemon() {
           const out = await withWikiLock(async () => {
             ensureWikiWorktree();
             return runTurn({
-              prompt: PLAN_CHECK_KICKOFF({ title: job.title, intents: job.intents }),
+              prompt: PLAN_CHECK_KICKOFF({ title: job.title, intents: planTasks }),
               resume: false,
               system: SYSTEM_PLAN_CHECK,
               cwd: wikiWt,
@@ -721,12 +726,12 @@ export async function runFleetDaemon() {
               label: c.cyan('[plan]'),
             });
           });
-          const checks = parsePlanChecks(out, job.intents);
+          const checks = parsePlanChecks(out, planTasks);
           if (checks === null) {
             warn(`plan check for "${job.title}": no usable JSON — leaving the plan as drafted`);
           }
           await reportMergeOutcome(PLAN_CHECK_DONE_URL, {
-            intentId: job.id,
+            taskId: job.id,
             checks: checks ?? [],
           });
           if (checks?.length) {
@@ -737,7 +742,7 @@ export async function runFleetDaemon() {
         } catch (e) {
           warn(`plan check failed for "${job.title}": ${e?.message ?? e}`);
           // Clear the flag anyway — a stuck job would re-run every poll forever.
-          await reportMergeOutcome(PLAN_CHECK_DONE_URL, { intentId: job.id, checks: [] });
+          await reportMergeOutcome(PLAN_CHECK_DONE_URL, { taskId: job.id, checks: [] });
         } finally {
           checkingPlans.delete(job.id);
         }
@@ -745,21 +750,155 @@ export async function runFleetDaemon() {
     }
   };
 
-  // Consults — a planning question aimed at THIS machine, answered by reading
-  // the repo. Deliberately the lightest job on the roster: same read-only
-  // detached checkout the plan check uses, no MCP, no writes, no run recorded.
+  // ── Planning sessions ────────────────────────────────────────────────────
+  //
+  // A turn in a plan thread, answered inside a HELD session. This was the
+  // consult, which answered one question in prose and kept nothing: it existed
+  // because the planner was a different, weaker brain and this turn's only job
+  // was to correct it from the real code. That planner is gone, so the session
+  // reads the repo AND writes the plan, over many turns, in one context.
+  //
+  // Two things changed shape as a result.
+  //
+  // ONE WORKTREE PER PLAN, not the shared `wikiWt`. Every CLI here resumes with
+  // "continue the last session in this directory" (`--continue`, `resume
+  // --last`) rather than by session id, so the WORKING DIRECTORY *is* the
+  // session handle. A shared directory would have made two plans on one machine
+  // take turns wearing each other's context — and the wiki queue hard-resets
+  // that directory between tasks, which would pull the files out from under a
+  // session mid-argument. A private detached checkout per plan also means plan
+  // turns no longer queue behind the wiki lock.
+  //
+  // IT CARRIES MCP. A consult passed none — nothing to write. A session spawns
+  // slices, re-shapes them, drops them and maintains the spec, all of which are
+  // control-plane calls. The token is the fleet's PLAN principal, whose entire
+  // tool set is those five: it cannot claim, cannot open a worktree, cannot
+  // commit. That absence is the product rule, not a hardening measure — it is
+  // what makes "add a dark mode toggle" typed at a plan add a slice instead of
+  // building one, with nothing reading the sentence to decide.
   const CONSULT_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/consult-done');
+  const PLAN_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/plan-token');
   const answering = new Set();
-  const consultAttempts = new Map(); // consultId -> tries
-  /** Give up after this many turns on one question. A /consult-done that never
+  const consultAttempts = new Map(); // turn id -> tries
+  /** Give up after this many turns on one message. A /consult-done that never
    *  reaches the server (offline, 500) would otherwise re-run the whole Claude
    *  turn every poll, forever, on the owner's quota. */
   const MAX_CONSULT_TRIES = 3;
-  /** ONE consult at a time. They all read the same worktree, and the roster can
-   *  hand back a batch — un-awaited spawns meant N pending questions became N
-   *  concurrent `claude` processes on someone's laptop. */
+  /** ONE planning turn at a time on this machine. Sessions are per-plan so they
+   *  no longer collide on a directory, but the roster can hand back a batch, and
+   *  un-awaited spawns would put N concurrent CLI processes on someone's laptop
+   *  for what is, on the human's side, a chat. */
   let consultChain = Promise.resolve();
 
+  /**
+   * The plan credential, cached until it stops working.
+   *
+   * Minted lazily rather than at startup: most daemons never host a planning
+   * session, and a token nobody uses is a credential sitting on disk for no
+   * reason. Rotated by the server on every mint, so a re-mint after a 401 is the
+   * recovery path.
+   */
+  let planToken = null;
+  const mintPlanToken = async (force = false) => {
+    if (planToken && !force) return planToken;
+    try {
+      const res = await fetch(PLAN_TOKEN_URL, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+      });
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      planToken = data?.data?.token ?? null;
+      return planToken;
+    } catch {
+      return null;
+    }
+  };
+
+  /**
+   * This plan's session directory — its context, expressed as a place.
+   *
+   * A detached checkout at base, like a consult's, but PRIVATE and PERSISTENT:
+   * private so `--continue` resumes this argument rather than whichever ran last
+   * on the box, persistent so it survives the daemon restarting or updating
+   * under it. Re-pointed at the current base each turn, because "reads your
+   * code" has to mean the code as it is now — a plan that runs for days would
+   * otherwise keep answering from the commit it was opened at.
+   *
+   * Returns null when the id is not a safe path segment: it comes off the wire.
+   */
+  const planWtFor = (planId) => {
+    if (!isSafePathSegment(planId)) return null;
+    const wt = join(baseDir, 'plans', planId);
+    const fresh = !existsSync(wt);
+    if (fresh) {
+      try {
+        git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+      } catch {
+        git(['worktree', 'prune'], repoRoot);
+        try {
+          git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+        } catch {
+          return null;
+        }
+      }
+    } else {
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+        git(['checkout', '--detach', baseRef], wt);
+        git(['reset', '--hard', baseRef], wt);
+        git(['clean', '-fd'], wt);
+      } catch {
+        /* offline, or a turn left it dirty — read what we have */
+      }
+    }
+    return { wt, fresh };
+  };
+
+  /**
+   * Retire the least-recently-touched session directories.
+   *
+   * The bound belongs HERE, in the machine, and never in the interface: ten
+   * plans open across a team is ten checkouts on one box, which is a resource
+   * question. Announcing a session limit in the app would be advertising
+   * capacity, which this product does not do. A retired session simply rebuilds
+   * from the spec next time it is asked for — the fallback the server already
+   * expects, and which the thread says out loud when it happens.
+   */
+  const MAX_PLAN_SESSIONS = 8;
+  const planTouched = new Map(); // planId -> ms
+  const retireIdlePlanSessions = () => {
+    const dir = join(baseDir, 'plans');
+    if (!existsSync(dir)) return;
+    let ids;
+    try {
+      ids = readdirSync(dir);
+    } catch {
+      return;
+    }
+    if (ids.length <= MAX_PLAN_SESSIONS) return;
+    const oldestFirst = ids.sort(
+      (a, b) => (planTouched.get(a) ?? 0) - (planTouched.get(b) ?? 0)
+    );
+    for (const id of oldestFirst.slice(0, ids.length - MAX_PLAN_SESSIONS)) {
+      try {
+        git(['worktree', 'remove', '--force', join(dir, id)], repoRoot);
+      } catch {
+        try {
+          rmSync(join(dir, id), { recursive: true, force: true });
+        } catch {
+          /* it is a directory we will overwrite next time; not worth failing a turn */
+        }
+      }
+      planTouched.delete(id);
+    }
+    try {
+      git(['worktree', 'prune'], repoRoot);
+    } catch {
+      /* best effort */
+    }
+  };
+
   // Quick edits — a SECOND Claude alongside a task this machine is already
   // building. Unlike every other roster job it does not get a worktree of its
   // own: the whole point is to work in the one the running task opened, on that
@@ -797,7 +936,7 @@ export async function runFleetDaemon() {
       joinChain = joinChain.then(async () => {
         let settled = false;
         try {
-          const target = worktreeBuilding(job.intentId);
+          const target = worktreeBuilding(job.taskId ?? job.intentId);
           if (!target) {
             // The run ended (or moved) between the human pressing ⚡ and this
             // poll. Settle rather than retry: there is no worktree to join, and
@@ -818,11 +957,11 @@ export async function runFleetDaemon() {
           const claim = await postForData(JOIN_TAKE_URL, { joinId: job.id });
           if (!claim?.taken) return;
           note(
-            `${c.cyan('quick')} ${c.dim(`— ${job.askedByName || 'someone'} on "${job.intentTitle || 'a task'}"`)}`
+            `${c.cyan('quick')} ${c.dim(`— ${job.askedByName || 'someone'} on "${job.taskTitle || job.intentTitle || 'a task'}"`)}`
           );
           const out = await runTurn({
             prompt: QUICK_EDIT_KICKOFF({
-              intentTitle: job.intentTitle,
+              intentTitle: job.taskTitle ?? job.intentTitle,
               instruction: job.instruction,
               askedByName: job.askedByName,
             }),
@@ -872,57 +1011,89 @@ export async function runFleetDaemon() {
       answering.add(job.id);
       consultChain = consultChain.then(async () => {
         try {
-          note(`${c.cyan('ask')} ${c.dim(`— ${job.askedByName || 'someone'} asked about "${job.planTitle || 'a plan'}"`)}`);
-          // Serialised against the wiki queue as well: that queue hard-resets
-          // this worktree mid-turn, which would pull the files out from under a
-          // consult that is reading them.
-          // A consult's prompt is steered by a question ANY project editor can
-          // type, so the profile is the enforcement and a runtime that cannot
-          // express it does not get the job. Today that means Claude; see the
-          // `profiles` notes in runtimes.mjs for exactly what Codex is missing.
-          const consultRt = pickRuntimeFor('consult');
-          if (!consultRt) {
-            warn('a consult is waiting, but no installed CLI can run a read-only turn');
+          note(`${c.cyan('plan')} ${c.dim(`— ${job.askedByName || 'someone'} on "${job.planTitle || 'a plan'}"`)}`);
+          // The profile is the enforcement, not the prompt: this turn is steered
+          // by anything a project editor can type, and it holds write tools. A
+          // runtime that cannot express `plan` does not get the job rather than
+          // getting it with guarantees nobody wrote down — which today excludes
+          // Antigravity, whose mediated shape fits a build and not an argument.
+          const planRt = pickRuntimeFor('plan');
+          if (!planRt) {
+            warn('a planning turn is waiting, but no installed CLI can run a planning session');
             return;
           }
-          await withWikiLock(async () => {
-            ensureWikiWorktree();
-            const out = await runTurn({
-              prompt: CONSULT_KICKOFF({
+          const token = await mintPlanToken();
+          if (!token) {
+            warn('a planning turn is waiting, but the plan credential could not be minted');
+            return;
+          }
+          const dir = planWtFor(job.taskId);
+          if (!dir) {
+            warn(`a planning turn is waiting, but its session directory could not be opened`);
+            return;
+          }
+          planTouched.set(job.taskId, Date.now());
+          // Resume only when this plan already HAS a session here. A fresh
+          // directory means either the first turn or a session we retired, and
+          // both want the same thing: start over from the spec, which the
+          // kickoff carries. `--continue` against an empty directory is not an
+          // error on every CLI, so asking `fresh` is what keeps it honest.
+          const resume = !dir.fresh && Boolean(job.sessionRef);
+          const mcp = mcpFor(planRt, token, mcpUrl);
+          let out;
+          try {
+            out = await runTurn({
+              prompt: PLAN_TURN_KICKOFF({
+                planId: job.taskId,
                 planTitle: job.planTitle,
                 question: job.question,
                 askedByName: job.askedByName,
+                // Sent only when we are NOT resuming: a live session already has
+                // the argument in its context, and re-stating the spec every
+                // turn would spend tokens telling it what it just wrote. On a
+                // rebuild it is the whole inheritance.
+                spec: resume ? null : job.spec,
               }),
-              resume: false,
-              system: SYSTEM_CONSULT,
-              cwd: wikiWt,
-              // TRULY read-only — no Write/Edit/rm, no MCP. The prompt also says
-              // not to change anything, but the prompt is what an injected
-              // question competes with; the toolset is what it cannot.
-              readOnly: true,
-              runtime: consultRt,
-              label: c.cyan('[ask]'),
-            });
-            const answer = (out || '').trim();
-            const posted = await reportMergeOutcome(CONSULT_DONE_URL, {
-              consultId: job.id,
-              ok: answer.length > 0,
-              // Scrub: an answer can quote config or env-adjacent code.
-              answer: envScrub(answer).slice(0, 8000),
+              resume,
+              system: SYSTEM_PLAN,
+              cwd: dir.wt,
+              // Read the repo, write the PLAN. No Edit/Write/commit anywhere in
+              // the toolset — the prompt says so too, but the prompt is what an
+              // injected message competes with.
+              planPerm: true,
+              mcpArgs: mcp.args,
+              mcpEnv: mcp.env,
+              runtime: planRt,
+              label: c.cyan('[plan]'),
             });
-            if (posted) consultAttempts.delete(job.id);
-            ok(`${c.cyan('ask')} ${c.dim('— answered in the plan thread')}`);
+          } finally {
+            if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
+          }
+          const answer = (out || '').trim();
+          const posted = await reportMergeOutcome(CONSULT_DONE_URL, {
+            consultId: job.id,
+            ok: answer.length > 0,
+            // Scrub: a reply can quote config or env-adjacent code.
+            answer: envScrub(answer).slice(0, 8000),
+            // The handle the server stores, reported on EVERY turn: a session we
+            // had to rebuild comes back under a new directory state, and a
+            // stored handle that does not follow it leaves later turns trying to
+            // resume something that is gone.
+            sessionRef: dir.wt,
           });
+          if (posted) consultAttempts.delete(job.id);
+          ok(`${c.cyan('plan')} ${c.dim('— replied in the plan thread')}`);
+          retireIdlePlanSessions();
         } catch (e) {
-          // Settle it. A question that cannot be answered must not re-burn a
-          // Claude turn every poll, and silence would leave the human waiting on
-          // a machine that already gave up.
+          // Settle it. A turn that cannot be answered must not re-burn quota
+          // every poll, and silence would leave the human waiting on a machine
+          // that already gave up.
           await reportMergeOutcome(CONSULT_DONE_URL, {
             consultId: job.id,
             ok: false,
-            answer: e?.message ?? 'the read failed',
+            answer: e?.message ?? 'the planning turn failed',
           });
-          warn(`consult failed: ${e?.message ?? e}`);
+          warn(`planning turn failed: ${e?.message ?? e}`);
         } finally {
           answering.delete(job.id);
         }
@@ -930,6 +1101,315 @@ export async function runFleetDaemon() {
     }
   };
 
+  // ── Work sessions — the Workbench tabs ─────────────────────────────────────
+  //
+  // A tab is a held Claude session with BUILD permissions in a PERSISTENT
+  // worktree on its own branch. The opposite of a plan directory on both
+  // counts: nothing here is detached and nothing is ever reset — uncommitted
+  // state between turns IS the session, and blowing it away would be closing
+  // the human's editor mid-thought.
+  const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
+  const WORK_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-turn-done');
+  const workAnswering = new Set();
+  const workAttempts = new Map(); // turn id -> tries
+  const MAX_WORK_TRIES = 3;
+  /** Per-SESSION serialization, parallel ACROSS sessions: turns within one tab
+   *  must land in order (they share a directory and a context), but two tabs
+   *  are two terminals — the human opened both on purpose. */
+  const workChains = new Map(); // sessionId -> Promise
+
+  let workToken = null;
+  const mintWorkToken = async (force = false) => {
+    if (workToken && !force) return workToken;
+    try {
+      const res = await fetch(WORK_TOKEN_URL, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+      });
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      workToken = data?.data?.token ?? null;
+      return workToken;
+    } catch {
+      return null;
+    }
+  };
+
+  /**
+   * This tab's worktree — its held context, expressed as a place, ON A BRANCH.
+   *
+   * Fresh: branch `session/<id>` off the current base. Existing: touched not at
+   * all — no fetch-reset-clean like a plan directory, because the dirty state
+   * is the point. If the directory was retired but the branch survives, the
+   * worktree re-attaches to the branch and the committed work is still there.
+   */
+  const sessionWtFor = (sessionId) => {
+    if (!isSafePathSegment(sessionId)) return null;
+    const wt = join(baseDir, 'sessions', sessionId);
+    const fresh = !existsSync(wt);
+    if (fresh) {
+      const branch = `session/${sessionId}`;
+      try {
+        git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+      } catch {
+        git(['worktree', 'prune'], repoRoot);
+        try {
+          // The branch may already exist (a retired directory's work) — attach.
+          git(['worktree', 'add', wt, branch], repoRoot);
+        } catch {
+          try {
+            git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+          } catch {
+            return null;
+          }
+        }
+      }
+    }
+    return { wt, fresh };
+  };
+
+  /**
+   * Retire the least-recently-touched CLEAN session directories past the cap.
+   * A dirty worktree is never touched — uncommitted work is the human's, and a
+   * resource bound does not outrank it. Committed work survives retirement on
+   * the session branch either way.
+   */
+  const MAX_WORK_DIRS = 12;
+  const workTouched = new Map(); // sessionId -> ms
+  const retireIdleWorkSessions = () => {
+    const dir = join(baseDir, 'sessions');
+    if (!existsSync(dir)) return;
+    let ids;
+    try {
+      ids = readdirSync(dir);
+    } catch {
+      return;
+    }
+    if (ids.length <= MAX_WORK_DIRS) return;
+    const oldestFirst = ids.sort(
+      (a, b) => (workTouched.get(a) ?? 0) - (workTouched.get(b) ?? 0)
+    );
+    let excess = ids.length - MAX_WORK_DIRS;
+    for (const id of oldestFirst) {
+      if (excess <= 0) break;
+      const wt = join(dir, id);
+      try {
+        if (git(['status', '--porcelain'], wt).trim() !== '') continue; // dirty — skip
+        git(['worktree', 'remove', wt], repoRoot);
+        workTouched.delete(id);
+        excess--;
+      } catch {
+        /* leave it; a directory we can't cleanly remove is not worth a turn */
+      }
+    }
+    try {
+      git(['worktree', 'prune'], repoRoot);
+    } catch {
+      /* best effort */
+    }
+  };
+
+  const processWorkTurns = (jobs) => {
+    for (const job of jobs ?? []) {
+      if (!job || typeof job.id !== 'string' || !job.body || !job.sessionId) continue;
+      if (workAnswering.has(job.id)) continue;
+      const tries = (workAttempts.get(job.id) ?? 0) + 1;
+      if (tries > MAX_WORK_TRIES) continue;
+      workAttempts.set(job.id, tries);
+      workAnswering.add(job.id);
+      const chain = workChains.get(job.sessionId) ?? Promise.resolve();
+      workChains.set(
+        job.sessionId,
+        chain.then(async () => {
+          try {
+            note(
+              `${c.cyan('tab')} ${c.dim(`— ${job.askedByName || 'the owner'} in "${job.sessionName || 'a session'}"`)}`
+            );
+            const workRt = pickRuntimeFor('build');
+            if (!workRt) {
+              warn('a session turn is waiting, but no installed CLI can build here');
+              return;
+            }
+            const token = await mintWorkToken();
+            if (!token) {
+              warn('a session turn is waiting, but the work credential could not be minted');
+              return;
+            }
+            const dir = sessionWtFor(job.sessionId);
+            if (!dir) {
+              warn('a session turn is waiting, but its worktree could not be opened');
+              return;
+            }
+            workTouched.set(job.sessionId, Date.now());
+            const resume = !dir.fresh && Boolean(job.sessionRef);
+            const mcp = mcpFor(workRt, token, mcpUrl);
+            let out;
+            try {
+              out = await runTurn({
+                prompt: WORK_TURN_KICKOFF({
+                  sessionId: job.sessionId,
+                  sessionName: job.sessionName,
+                  message: job.body,
+                  askedByName: job.askedByName,
+                }),
+                resume,
+                system: SYSTEM_WORK,
+                cwd: dir.wt,
+                mcpArgs: mcp.args,
+                mcpEnv: mcp.env,
+                runtime: workRt,
+                label: c.cyan('[tab]'),
+              });
+            } finally {
+              if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
+            }
+            const answer = (out || '').trim();
+            const posted = await reportMergeOutcome(WORK_DONE_URL, {
+              turnId: job.id,
+              ok: answer.length > 0,
+              // Scrub: a reply can quote config or env-adjacent code.
+              answer: envScrub(answer).slice(0, 16000),
+              sessionRef: dir.wt,
+            });
+            if (posted) workAttempts.delete(job.id);
+            ok(`${c.cyan('tab')} ${c.dim('— replied in the session')}`);
+            retireIdleWorkSessions();
+          } catch (e) {
+            await reportMergeOutcome(WORK_DONE_URL, {
+              turnId: job.id,
+              ok: false,
+              answer: e?.message ?? 'the session turn failed',
+            });
+            warn(`session turn failed: ${e?.message ?? e}`);
+          } finally {
+            workAnswering.delete(job.id);
+          }
+        })
+      );
+    }
+  };
+
+  // Ship — a session's branch merging to main, on the human's word.
+  //
+  // --no-ff, NEVER squash: every delivered card carries commit shas as its
+  // receipts, and a squash would point them all at commits that no longer
+  // exist on main. Sequence: refuse a dirty worktree (auto-committing someone's
+  // mid-thought state is not shipping, it is guessing), fold main INTO the
+  // branch first so conflicts surface in the worktree where the session can
+  // resolve them, collect the branch's own commits (the server's
+  // reconciliation input), then merge outward through a throwaway worktree so
+  // nobody's checkout moves. Failures report INTO the tab — a ship that failed
+  // silently leaves the human believing their work is on main.
+  const SHIP_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/ship-done');
+  const shipping = new Set();
+  let shipChain = Promise.resolve();
+
+  const processShipJobs = (jobs) => {
+    for (const job of jobs ?? []) {
+      if (!job || typeof job.sessionId !== 'string') continue;
+      if (shipping.has(job.sessionId)) continue;
+      shipping.add(job.sessionId);
+      shipChain = shipChain.then(async () => {
+        const done = (payload) =>
+          reportMergeOutcome(SHIP_DONE_URL, { sessionId: job.sessionId, ...payload }).catch(
+            () => {}
+          );
+        try {
+          if (!isSafePathSegment(job.sessionId)) {
+            await done({ ok: false, error: 'invalid session id' });
+            return;
+          }
+          note(`${c.cyan('ship')} ${c.dim(`— "${job.sessionName || job.sessionId}"`)}`);
+          const wt = join(baseDir, 'sessions', job.sessionId);
+          if (!existsSync(wt)) {
+            await done({ ok: false, error: 'no session worktree on this machine' });
+            return;
+          }
+          if (git(['status', '--porcelain'], wt) !== '') {
+            await done({
+              ok: false,
+              error:
+                'the session has uncommitted changes — ask it to commit or discard them first',
+            });
+            return;
+          }
+          try {
+            git(['fetch', 'origin', '--quiet'], repoRoot);
+          } catch {
+            /* offline fetch — merge against what we have */
+          }
+          // Fold main into the branch FIRST: conflicts land here, in the
+          // session's own worktree, where the next turn can resolve them.
+          try {
+            git(['merge', '--no-edit', baseRef], wt);
+          } catch {
+            try {
+              git(['merge', '--abort'], wt);
+            } catch {
+              /* nothing in progress */
+            }
+            await done({
+              ok: false,
+              error: 'conflicts with main — ask the session to resolve them, then ship again',
+            });
+            return;
+          }
+          // The branch's own commits — the server's reconciliation input.
+          // --no-merges: fold-commits describe plumbing, not work.
+          const commits = git([
+            'log',
+            `${baseRef}..HEAD`,
+            '--no-merges',
+            '--format=%H%x09%s',
+          ], wt)
+            .split('\n')
+            .filter(Boolean)
+            .map((l) => {
+              const [sha, ...rest] = l.split('\t');
+              return { sha, subject: envScrub(rest.join('\t')).slice(0, 200) };
+            });
+          if (commits.length === 0) {
+            await done({ ok: false, error: 'nothing to ship — no commits on the session branch' });
+            return;
+          }
+          // Merge outward through a throwaway worktree so no checkout moves.
+          const branch = `session/${job.sessionId}`;
+          const tmp = join(baseDir, 'ship', job.sessionId);
+          try {
+            try {
+              git(['worktree', 'remove', '--force', tmp], repoRoot);
+            } catch {
+              /* not there — fine */
+            }
+            git(['worktree', 'add', '--detach', tmp, baseRef], repoRoot);
+            git([
+              'merge',
+              '--no-ff',
+              branch,
+              '-m',
+              `ship(${job.sessionName || job.sessionId.slice(0, 8)}): ${commits.length} commit${commits.length === 1 ? '' : 's'}`,
+            ], tmp);
+            git(['push', 'origin', `HEAD:${baseBranchName(baseRef)}`], tmp);
+          } finally {
+            try {
+              git(['worktree', 'remove', '--force', tmp], repoRoot);
+              git(['worktree', 'prune'], repoRoot);
+            } catch {
+              /* best effort */
+            }
+          }
+          await done({ ok: true, commits });
+          ok(`${c.cyan('ship')} ${c.dim(`— ${commits.length} commit${commits.length === 1 ? '' : 's'} on main`)}`);
+        } catch (e) {
+          await done({ ok: false, error: envScrub(e?.message ?? 'the merge failed').slice(0, 500) });
+          warn(`ship failed: ${e?.message ?? e}`);
+        } finally {
+          shipping.delete(job.sessionId);
+        }
+      });
+    }
+  };
+
   const processMergeJobs = (jobs) => {
     for (const job of jobs ?? []) {
       if (!job || typeof job.id !== 'string') continue; // a null element would wedge the loop
@@ -946,7 +1426,7 @@ export async function runFleetDaemon() {
           if (!isValidPrUrl(job.prUrl, originSlug(repoRoot))) {
             mergeAttempts.delete(job.id);
             await reportMergeOutcome(MERGE_FAILED_URL, {
-              intentId: job.id,
+              taskId: job.id,
               message: 'refused: PR URL is not a pull request in this repository',
             });
             warn(`merge REFUSED for "${job.title}": untrusted PR URL ${String(job.prUrl)}`);
@@ -973,7 +1453,7 @@ export async function runFleetDaemon() {
               if (!/no changes|already/i.test(err)) {
                 mergeAttempts.delete(job.id);
                 await reportMergeOutcome(MERGE_FAILED_URL, {
-                  intentId: job.id,
+                  taskId: job.id,
                   message: `could not retarget the stacked PR onto ${baseBranchName(baseRef)} — merging it now would land in the branch below it, not ${baseBranchName(baseRef)}`,
                 });
                 warn(`merge held for "${job.title}": retarget failed — ${err.split('\n')[0]}`);
@@ -1010,7 +1490,7 @@ export async function runFleetDaemon() {
           }
           if (merged) {
             mergeAttempts.delete(job.id);
-            await reportMergeOutcome(MERGE_DONE_URL, { intentId: job.id });
+            await reportMergeOutcome(MERGE_DONE_URL, { taskId: job.id });
             ok(`${c.cyan('merged')} ${c.dim(`— ${job.title} → ${baseRef}`)}`);
             // The code just landed — re-ground the living wiki for what shipped
             // (touched nodes re-read + a persistent feature-history node).
@@ -1023,7 +1503,7 @@ export async function runFleetDaemon() {
             // button + notifies) — the job disappears from the roster.
             mergeAttempts.delete(job.id);
             await reportMergeOutcome(MERGE_FAILED_URL, {
-              intentId: job.id,
+              taskId: job.id,
               message: failedReason,
             });
             warn(`merge failed for "${job.title}": ${failedReason} — reported to the thread`);
@@ -1083,7 +1563,7 @@ export async function runFleetDaemon() {
           } else if (job.prUrl || job.branch) {
             warn(`cleanup REFUSED for "${job.title}": untrusted PR/branch value`);
           }
-          await reportMergeOutcome(CLEANUP_DONE_URL, { intentId: job.id });
+          await reportMergeOutcome(CLEANUP_DONE_URL, { taskId: job.id });
           ok(`${c.cyan('cleaned')} ${c.dim(`— ${job.title}`)}`);
         } finally {
           cleaning.delete(job.id);
@@ -1397,7 +1877,7 @@ export async function runFleetDaemon() {
             // sweep), so a failing re-ground can't loop-burn quota. Only a
             // crash BEFORE this line leaves the job listed for a retry.
             regroundAttempts.delete(task.intentId);
-            await reportMergeOutcome(REGROUND_DONE_URL, { intentId: task.intentId });
+            await reportMergeOutcome(REGROUND_DONE_URL, { taskId: task.intentId });
           }
         } catch (e) {
           warn(`wiki ${task.type} failed: ${e.message}`);
@@ -1526,6 +2006,8 @@ export async function runFleetDaemon() {
     processPatchRevertJobs(roster.patchRevertJobs);
     processPlanCheckJobs(roster.planCheckJobs);
     processConsultJobs(roster.consultJobs);
+    processWorkTurns(roster.workTurnJobs);
+    processShipJobs(roster.shipJobs);
     processJoinJobs(roster.joinJobs);
     processCleanupJobs(roster.cleanupJobs);
     const rosterIds = new Set(roster.agents.map((a) => a.agentId));
@@ -1553,7 +2035,13 @@ export async function runFleetDaemon() {
         mintedAt.set(a.agentId, Date.now());
       }
       hasWorkByAgent.set(a.agentId, !!a.hasWork);
-      if (a.next && typeof a.next.intentId === 'string') nextByAgent.set(a.agentId, a.next);
+      // The hint's task id, new name first. Normalized ONTO `intentId` here so
+      // every downstream read (poll worker, kickoff, diffstat attribution)
+      // keeps its one spelling — intent is still the daemon's internal word,
+      // taskId is the wire's.
+      const nextId = a.next && (a.next.taskId ?? a.next.intentId);
+      if (a.next && typeof nextId === 'string')
+        nextByAgent.set(a.agentId, { ...a.next, intentId: nextId });
       else nextByAgent.delete(a.agentId);
       if (!workers.has(a.agentId)) {
         // Local ceiling, enforced and not merely requested. The roster can carry
@@ -1647,8 +2135,9 @@ export async function runFleetDaemon() {
     // whose earlier mint failed.
     enqueueSweep(roster.codeMapJob);
     for (const j of roster.regroundJobs ?? []) {
-      if (!j || typeof j.intentId !== 'string') continue; // a null element would throw + wedge the loop
-      enqueueReground(j.intentId, j.prUrl, j.title, j.dirtiesPages);
+      const rid = j && (j.taskId ?? j.intentId); // new name first, old as fallback
+      if (!j || typeof rid !== 'string') continue; // a null element would throw + wedge the loop
+      enqueueReground(rid, j.prUrl, j.title, j.dirtiesPages);
     }
     void drainWiki();