flowviant 0.77.5 → 0.78.1

package/bin/lib/work.mjs

@@ -82,6 +82,37 @@ import {
 import { worktreeDiff } from './worktreeDiff.mjs';
 import { homedir } from 'node:os';
 
+/**
+ * A RESUME THAT FOUND NO CONVERSATION, in the CLI's own words.
+ *
+ * "Produced nothing" was the only signal the retry backstop had, and it is not
+ * the signal these failures give: Claude Code answers a dead `--resume` id with
+ * a result event carrying `errors: ['No conversation found with session ID: …']`
+ * AND writes the same line to stderr, so `out` is non-empty, the backstop never
+ * fired, and the turn SETTLED SUCCESSFULLY with the error as its answer. Every
+ * later message in that tab replied the same way — the marker file still held
+ * the dead id, nothing rewrote it (that only happens when an init event is
+ * seen, and there is none), and no surface offered a way to clear it. A tab
+ * bricked forever by its own CLI pruning its history, which it does on its own
+ * schedule.
+ *
+ * Matched on the CLI's phrasing rather than a code, because neither runtime
+ * gives one. Deliberately narrow: it must not swallow a rate limit or a
+ * permission refusal, both of which are real answers that should stand.
+ */
+const RESUME_LOST = [
+  /no conversation found/i,
+  /no session found/i,
+  /session .{0,80}not found/i,
+  /conversation .{0,80}not found/i,
+  /thread .{0,80}not found/i,
+  /trajectory not found/i,
+];
+const resumeConversationLost = (text) => {
+  const t = String(text || '');
+  return t.length > 0 && RESUME_LOST.some((re) => re.test(t));
+};
+
 /**
  * The shape a per-tab model name must have before it rides argv as
  * `--model <name>`. Conservative for the same reason the codex thread id is
@@ -543,8 +574,11 @@ export function createWorkManager({
       // path), but a server bug or compromise sending `../../etc` would
       // otherwise point a session's measured directory anywhere on the box and
       // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
-      // already reject an unsafe segment; doing it here covers every consumer
-      // (the preview-claim `placeDir` did not re-check). REPO_PLACE resolves to
+      // already reject an unsafe segment; checking at the intake covers the
+      // consumers that do not (the preview-claim `placeDir` did not re-check).
+      // NOT the only writer: `processWorkTurns` stores a turn job's place too,
+      // and keeps the same check — validating one intake and not the other is
+      // one deploy away from validating neither. REPO_PLACE resolves to
       // repoRoot, so it is allowed through despite not being a path segment.
       if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
         sessionPlaces.set(sid, place);
@@ -1309,6 +1343,23 @@ export function createWorkManager({
     const pid = Number(job.pid);
     const signal = job.signal === 'KILL' ? 'SIGKILL' : 'SIGTERM';
 
+    /**
+     * CLAIM FIRST, EVEN FOR THE ANSWERS THAT SIGNAL NOTHING.
+     *
+     * `unsupported` and `not_found` cost nothing to produce, which is exactly
+     * why they must be leased: two daemons on one credential are handed the
+     * same job, and the one holding NOTHING reaches these branches without
+     * measuring anything or making a round trip — so it would answer first,
+     * settle the row, and the machine that could actually have signalled would
+     * find the job already closed and never touch the process. The person reads
+     * "the pid is no longer one of this tab's", which is a real sentence, over a
+     * watcher that is still running.
+     *
+     * The server enforces holder-only settles again (it briefly accepted these
+     * two unclaimed, which is the bug above), so an unclaimed post here would
+     * simply be dropped. One extra round trip on a path nobody is waiting on.
+     */
+    if (!(await claimKill(id))) return;
     if (!processesSupported()) {
       await postKill({ id, outcome: 'unsupported' });
       return;
@@ -1324,7 +1375,6 @@ export function createWorkManager({
       await remeasureAfterKill(sessionId);
       return;
     }
-    if (!(await claimKill(id))) return;
     try {
       process.kill(pid, signal);
       // WHAT HAPPENED, not what we did. "We sent a signal" is a fact about us;
@@ -1439,7 +1489,18 @@ export function createWorkManager({
     // outcome because "the machine cannot do this at all" and "GitHub said
     // no" read differently to the person who asked.
     try {
-      execFileSync('gh', ['auth', 'status'], { stdio: ['ignore', 'pipe', 'pipe'] });
+      // TIMED OUT, like every other `gh` call. `execFileSync` blocks the whole
+      // event loop, so a hung `gh` — an expired token whose refresh hits a
+      // black hole, a credential helper waiting on a keyring prompt that has
+      // no terminal — stops the roster poll, every in-flight settle, the
+      // worktree sweep and the deploy heartbeat (whose 3-minute staleness
+      // window then re-queues a deploy this daemon is still running). The
+      // AGENT merge path was given exactly these timeouts in 0.77.1; this
+      // copy, forty lines of the same logic, was missed.
+      execFileSync('gh', ['auth', 'status'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 20_000,
+      });
     } catch (e) {
       const missing = e?.code === 'ENOENT';
       await settlePr({
@@ -1499,6 +1560,7 @@ export function createWorkManager({
           execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
             cwd: repoRoot,
             stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 30_000,
           }).toString()
         );
         return j?.state === 'OPEN' && typeof j?.url === 'string' ? j.url.trim() : null;
@@ -1524,7 +1586,7 @@ export function createWorkManager({
             // call, nothing invented. baseBranchName, not baseRef: gh 422s on
             // a remote-tracking name like origin/main.
             ['pr', 'create', '--head', branch, '--base', baseName, '--fill'],
-            { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'] }
+            { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
           )
             .toString()
             .trim();
@@ -1559,6 +1621,7 @@ export function createWorkManager({
       execFileSync('gh', ['pr', 'merge', branch, '--merge'], {
         cwd: repoRoot,
         stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 120_000,
       });
     } catch (e) {
       const line = ghFirstLine(e);
@@ -2247,15 +2310,41 @@ export function createWorkManager({
    * the pid lives and clears the lock once it is dead.
    */
   const workChildren = new Map(); // child process -> lockPath | null
+  /**
+   * Children whose whole PROCESS GROUP must go, not just the child.
+   *
+   * The standing rule is the opposite — teardown SIGTERMs the CLI child and
+   * never its group, precisely so an unattended auto-update does not kill the
+   * driver's dev server, which a turn started INTO the CLI's group. That rule
+   * is about the CLI's group and stays.
+   *
+   * A project CHECK is a different group entirely: the daemon spawns it itself,
+   * `detached` with `shell: true`, so its group holds the check command and
+   * nothing else — no dev server of anybody's. And `shell: true` is exactly
+   * what makes signalling only the child useless: a compound command like
+   * `npm run lint && npm test` leaves `/bin/sh` as the child, so SIGTERM killed
+   * the shell and the test runner underneath it carried on holding the
+   * worktree — and that place's WRITER lock — through every stop, takeover and
+   * auto-update. The check's own ten-minute timer already kills `-child.pid`
+   * for this reason; teardown simply did not.
+   */
+  const groupKillChildren = new Set();
   const shutdownWork = () => {
     for (const [ch] of workChildren) {
       try {
-        ch.kill('SIGTERM');
+        if (groupKillChildren.has(ch) && ch.pid) process.kill(-ch.pid, 'SIGTERM');
+        else ch.kill('SIGTERM');
       } catch {
-        /* best-effort */
+        // A group that has already gone, or a pid that is no longer a leader.
+        try {
+          ch.kill('SIGTERM');
+        } catch {
+          /* best-effort */
+        }
       }
     }
     workChildren.clear();
+    groupKillChildren.clear();
   };
 
   /**
@@ -2394,9 +2483,26 @@ export function createWorkManager({
       // run it again while the report is merely undelivered.
       if (pendingWorkReports.has(job.id)) continue;
       workAnswering.add(job.id);
-      // Serialized by PLACE: two tabs sharing a worktree take turns in it
-      // rather than editing the same files at the same time.
       const place = job.place || job.sessionId;
+      /**
+       * VALIDATED AT THE TRUST BOUNDARY, exactly as `learnPlaces` validates
+       * the roster's map — this is the OTHER writer of `sessionPlaces`, in the
+       * same reconcile tick, BEFORE the preview jobs and the sweep read it. An
+       * unchecked value stored here reaches every `placeDir` consumer: the
+       * turn is spawned in it, `burstListeners` measures it, and a share would
+       * publicly tunnel a directory OUTSIDE the checkout — the exact traversal
+       * the preview feature's port attribution exists to prevent. Settled out
+       * loud rather than skipped, because a silently dropped turn strands the
+       * tab for the server's whole expiry window.
+       */
+      if (place !== REPO_PLACE && !isSafePathSegment(place)) {
+        void settleWorkTurn(job.id, {
+          ok: false,
+          answer:
+            'the server named a working directory this machine refuses to use — close and reopen the tab, then send the message again',
+        }).finally(() => workAnswering.delete(job.id));
+        continue;
+      }
       // Remembered for every other beat — the sweep, ship, the preview
       // re-check — so they all ask the same directory this turn runs in.
       sessionPlaces.set(job.sessionId, place);
@@ -2816,6 +2922,7 @@ export function createWorkManager({
             toolLog.ev.length > 0 ? toolLog : undefined
           );
 
+
           // THE COMMAND AUDIT — every `$ …` the CLI's stream reports, batched
           // to the server verbatim so an admin can read what actually ran on
           // this box. Same events the narrator renders and forgets; this is
@@ -2973,8 +3080,28 @@ export function createWorkManager({
             // loud): a fresh conversation would silently discard the adoption
             // and answer as a new session wearing its name — the empty adopt
             // turn settles failed below instead.
-            if (!adopting && resume && !(out || '').trim())
+            /**
+             * …OR PRODUCED ONLY THE CLI SAYING THE CONVERSATION IS GONE.
+             *
+             * "Produced nothing" was the whole test, and it is not the shape
+             * these failures take: Claude Code answers a dead `--resume` id
+             * with a result event carrying `errors: ['No conversation found
+             * with session ID: …']` and writes the same line to stderr, so
+             * `out` is non-empty. The backstop never fired, the turn settled
+             * SUCCESSFULLY with that error as its answer, and — because the
+             * marker is only rewritten when an init event is seen, and there
+             * was none — the dead id stayed pinned. Every later message in
+             * that tab replied identically, with nothing on any surface able
+             * to clear it. A tab bricked forever by its own CLI pruning its
+             * history, which it does on its own schedule.
+             */
+            if (
+              !adopting &&
+              resume &&
+              (!(out || '').trim() || resumeConversationLost(out))
+            ) {
               out = await runTurn({ ...turnArgs, resume: false });
+            }
           } finally {
             // The CLI has stopped printing, so stop relaying. The LINE itself
             // is cleared server-side at settle — clearing it here would race
@@ -3239,7 +3366,7 @@ export function createWorkManager({
           };
           // The machine may have no git identity, and a merge COMMIT needs
           // one. Prefer the user's own config; fall back to the daemon's (the
-          // same fallback checkpointWip uses) so a bare machine doesn't fail
+          // same fallback ship's merge keeps) so a bare machine doesn't fail
           // the fold with "Please tell me who you are".
           let idEnv = null;
           try {
@@ -3551,7 +3678,28 @@ export function createWorkManager({
       ['diff', '--name-only', `${baseRef()}...HEAD`],
       ['ls-files', '--others', '--exclude-standard'],
     ]) {
-      const r = git(args, wt);
+      /**
+       * `git()` THROWS; it does not return a non-string.
+       *
+       * The guard below was `if (typeof r !== 'string') continue`, which is a
+       * value `execFileSync` can never produce — so every one of these calls
+       * was effectively unguarded. And this runs over the LIVE AGENTS a plan
+       * job carries, which include agents still in `planning`: they have no
+       * worktree yet, so `git diff` in a directory that does not exist exits
+       * non-zero and throws straight out of `runAgentPlan` — after the press
+       * has been claimed and before the try/finally below. The press then sat
+       * `planning` until its expiry, having spent nothing and explained
+       * nothing, on what would be an ordinary second Deploy.
+       *
+       * An agent whose files cannot be read contributes none. That is the
+       * honest answer and it is what the planner should be told.
+       */
+      let r;
+      try {
+        r = git(args, wt);
+      } catch {
+        continue;
+      }
       if (typeof r !== 'string') continue;
       for (const line of r.split('\n')) {
         const f = line.trim();
@@ -3599,7 +3747,15 @@ export function createWorkManager({
       id: String(a?.id ?? ''),
       name: String(a?.name ?? ''),
       status: String(a?.status ?? ''),
-      changedFiles: agentChangedFiles(a?.placeId),
+      // Belt: `agentChangedFiles` is defensive internally, but it resolves a
+      // place first and this whole block sits outside the try below.
+      changedFiles: (() => {
+        try {
+          return agentChangedFiles(a?.placeId);
+        } catch {
+          return [];
+        }
+      })(),
     }));
 
     let out = '';
@@ -3680,8 +3836,13 @@ export function createWorkManager({
   // UNLEASED, unlike a plan or a kill. The server hands out at most one turn
   // per agent per poll and its settle is conditional on the row still being
   // pending, so a second daemon cannot advance the queue twice. What it could
-  // do is run a CLI twice in one worktree, which is what this in-flight set and
-  // the place lock prevent — the same discipline `processWorkTurns` keeps.
+  // do is run a CLI twice in one worktree. The in-flight set below cannot
+  // prevent that alone: it is keyed by TURN id, so it never sees the
+  // DIFFERENT turn the server's TTL-skip hands out while an expired turn's
+  // CLI is still running — and a reader lock would run the two side by side.
+  // So an agent turn takes its place's lock as a WRITER: an agent is ONE
+  // process by definition, and its `a-<id>` place is its own — no tab ever
+  // stands there, so the tabs' turns-run-concurrently law is untouched.
   const agentTurns = new Set(); // turn ids in flight on this tick
   /**
    * The CLI a live agent turn is running in, by PLACE.
@@ -3698,14 +3859,29 @@ export function createWorkManager({
    *  emptied, so run the project's own check in the worktree we are already
    *  standing in. A job lane for that would need a claim, a floor and a settle
    *  to say something this reply already can. */
-  /** Turn ids whose work is DONE but whose report has not landed. The same
-   *  skip-guard `pendingWorkReports` is for a tab, and for the same reason: a
-   *  settle that fails to POST must not re-run the turn — that is a second CLI,
-   *  a second set of commits, and the operator's quota spent again. */
-  const agentReported = new Set();
+  /**
+   * Turns whose work is DONE but whose settle has not landed, keyed to the
+   * finished BODY. The delivery half of what `pendingWorkReports` is for a
+   * tab: a settle that fails to POST must not re-run the turn — that is a
+   * second CLI, a second set of commits, and the operator's quota spent again
+   * — but a guard that only SKIPPED left the other half undone. One failed
+   * POST parked the agent for the server's whole six-hour expiry, holding a
+   * cap slot the entire time, and then expired into "nobody ran it" — a false
+   * sentence about a turn this machine finished. The server's settle is
+   * idempotent (conditional on the row still being pending), so a re-offer of
+   * a held turn re-POSTs the stored body instead: safe, and it lands the
+   * moment the network heals rather than six hours later.
+   *
+   * BOUNDED by the roster itself: a held body's clock is refreshed while the
+   * server keeps offering its turn, and once offering stops — settled by the
+   * re-POST, or expired server-side — the grace below is all that keeps it.
+   */
+  const agentReported = new Map(); // turnId -> { body, at }
+  const AGENT_REPORT_GRACE_MS = 30 * 60_000;
 
   const postAgentTurn = async (body) => {
-    agentReported.add(String(body.turnId));
+    const turnId = String(body.turnId);
+    agentReported.set(turnId, { body, at: Date.now() });
     try {
       const res = await fetch(AGENT_TURN_DONE_URL, {
         method: 'POST',
@@ -3718,14 +3894,19 @@ export function createWorkManager({
         body: JSON.stringify(body),
       });
       const j = await res.json().catch(() => null);
-      // Landed. Forgetting it keeps the guard from growing without bound; a
-      // re-offer of a settled turn is refused server-side anyway.
-      if (res.ok) agentReported.delete(String(body.turnId));
+      // Landed, or REFUSED: a 4xx is the server saying this settle will never
+      // be accepted (expired, already settled, unknown turn), and re-POSTing a
+      // refusal forever is the wedge wearing a retry's clothes. 408/429 stay
+      // retryable, the same split `postSettle` makes for a tab.
+      if (
+        res.ok ||
+        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
+      )
+        agentReported.delete(turnId);
       return j?.data ?? null;
     } catch {
-      // Unsettled, and the id STAYS in the guard: the server expires the turn
-      // and the agent lands in Stuck saying nobody ran it, which is far better
-      // than running it again for six hours.
+      // Unsettled — a network error, so the body STAYS held and the next
+      // re-offer retries the POST rather than the CLI.
       return null;
     }
   };
@@ -3846,7 +4027,10 @@ export function createWorkManager({
       return;
     }
 
-    await inPlace(place, false, async () => {
+    // A WRITER on the agent's own place — see the lane header. Only `a-<id>`
+    // places: those are agents' by construction, and anything else here would
+    // be a tab's directory, where a turn is a reader by the product's own law.
+    await inPlace(place, place.startsWith('a-'), async () => {
       const dir = placeWtFor(place);
       if (!dir) {
         // No worktree and none could be cut. `nothing` rather than an invented
@@ -4041,13 +4225,46 @@ export function createWorkManager({
   };
 
   const processAgentTurnJobs = (jobs) => {
-    if (!Array.isArray(jobs) || jobs.length === 0) return;
-    for (const job of jobs.slice(0, 4)) {
+    const list = Array.isArray(jobs) ? jobs : [];
+    if (agentReported.size) {
+      // The roster is the held bodies' clock: an offered turn is still pending
+      // server-side and worth retrying; one the roster stopped naming was
+      // settled or expired, and holding its body past a generous grace would
+      // grow this map for the life of the process. The server's own expiry is
+      // the true bound — the grace only covers its POST racing a final offer.
+      const offered = new Set(list.map((j) => String(j?.id || '')));
+      const now = Date.now();
+      for (const [id, held] of agentReported) {
+        if (offered.has(id)) held.at = now;
+        else if (now - held.at > AGENT_REPORT_GRACE_MS) agentReported.delete(id);
+      }
+    }
+    for (const job of list.slice(0, 4)) {
       const id = String(job?.id || '');
       if (!id || agentTurns.has(id)) continue;
-      // Already RAN here; only the report is outstanding. Re-running it would
-      // spend the operator's quota again and write a second set of commits.
-      if (agentReported.has(id)) continue;
+      const held = agentReported.get(id);
+      if (held) {
+        // Already RAN here; only the settle is outstanding. Re-POST the held
+        // body — never the CLI, which would spend the operator's quota again
+        // and write a second set of commits. The reply can still carry the one
+        // instruction a settle can (`review: true`, the queue just emptied),
+        // so the project's check runs from here too, under the same writer
+        // lock the turn itself would have held.
+        agentTurns.add(id);
+        void (async () => {
+          const reply = await postAgentTurn(held.body);
+          const place = String(job.placeId || '');
+          const wt = typeof held.body.worktree === 'string' ? held.body.worktree : null;
+          if (reply?.review === true && isSafePathSegment(place) && wt && existsSync(wt)) {
+            await inPlace(place, place.startsWith('a-'), () =>
+              runCheck(String(job.agentId || ''), wt)
+            );
+          }
+        })()
+          .catch(() => {})
+          .finally(() => agentTurns.delete(id));
+        continue;
+      }
       if (!job.agentId || !job.placeId) continue;
       agentTurns.add(id);
       void runAgentTurn(job).finally(() => agentTurns.delete(id));
@@ -4139,8 +4356,15 @@ export function createWorkManager({
          * orphaned a running test suite inside a worktree the sweep may then
          * try to remove. The ten-minute timer would eventually kill it, but by
          * then it belongs to no daemon and nothing on any surface names it.
+         *
+         * Registered for a GROUP kill: with `shell: true` the child is
+         * `/bin/sh`, and signalling it leaves the runner it started behind —
+         * which is the process actually holding the worktree. See
+         * `groupKillChildren` for why this one is exempt from the
+         * never-signal-the-group rule.
          */
         workChildren.set(child, null);
+        groupKillChildren.add(child);
       } catch (e) {
         // TEXT BEFORE FINISH: `finish` captures `text` by value into the
         // resolved object, so assigning afterwards threw the spawn error away
@@ -4268,8 +4492,8 @@ export function createWorkManager({
   /**
    * A merge COMMIT needs a git identity and the machine may have none. Prefer
    * the operator's own config; fall back to the daemon's, the same fallback
-   * `checkpointWip` and ship both use, so a bare machine does not fail the fold
-   * with "Please tell me who you are".
+   * ship's merge keeps, so a bare machine does not fail the fold with
+   * "Please tell me who you are".
    */
   const gitMerge = (args, cwd) => {
     let idEnv = null;
@@ -4295,18 +4519,37 @@ export function createWorkManager({
     const agentId = String(job.agentId);
     const place = String(job.placeId || '');
     if (!isSafePathSegment(place)) {
+      // Before the claim, and before `report` exists — this one is not covered
+      // by the belt below because there is nothing yet to be un-reported.
       await postAgentMerge({ agentId, ok: false, detail: 'the agent has no worktree here' });
       return;
     }
     if (!(await claimAgentMerge(agentId))) return;
 
+    /**
+     * NO EXIT PATH MAY LEAVE A CLAIMED MERGE UNREPORTED — the same belt the
+     * ship path carries, and this function did not.
+     *
+     * Every branch below reports, but an UNEXPECTED throw reports nothing:
+     * several `git()` calls in here are bare, and `git()` is `execFileSync`,
+     * which throws on any non-zero exit. The agent then sits in `merging`,
+     * which refuses Stop and refuses an answer, until an expiry fires — with
+     * nothing anywhere saying what went wrong.
+     */
+    let reported = false;
+    const report = async (body) => {
+      reported = true;
+      await postAgentMerge(body);
+    };
+
     // A WRITER on the place, exactly as a ship is. It folds base in and pushes
     // with git in that directory, and no CLI can coordinate with something it
     // does not know exists.
-    await inPlace(place, true, async () => {
+    try {
+      await inPlace(place, true, async () => {
       const wt = join(baseDir, 'sessions', place);
       if (!existsSync(wt)) {
-        await postAgentMerge({ agentId, ok: false, detail: 'the worktree is gone' });
+        await report({ agentId, ok: false, detail: 'the worktree is gone' });
         return;
       }
       try {
@@ -4323,7 +4566,7 @@ export function createWorkManager({
         try {
           gitMerge(['merge', '--no-edit', baseRef()], wt);
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: envScrub(String(e?.message || e)).slice(0, 2000),
@@ -4346,7 +4589,7 @@ export function createWorkManager({
       if (!branch) {
         // A detached HEAD names no branch, so there is nothing to merge and
         // nothing to record. An ambiguity in git, not a rule of ours.
-        await postAgentMerge({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
+        await report({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
         return;
       }
       const tip = (git(['rev-parse', 'HEAD'], wt) || '').trim();
@@ -4356,7 +4599,7 @@ export function createWorkManager({
         // Already on base — an idempotent re-offer, or an agent that changed
         // nothing. Reported as a SUCCESS: the branch's work is on base, which
         // is what the caller is asking about.
-        await postAgentMerge({ agentId, ok: true, sha: tip || undefined });
+        await report({ agentId, ok: true, sha: tip || undefined });
         return;
       }
       /**
@@ -4390,7 +4633,7 @@ export function createWorkManager({
             timeout: 20_000,
           });
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail:
@@ -4402,7 +4645,7 @@ export function createWorkManager({
         }
         const prBase = baseBranchName(baseRef());
         if (branch === prBase) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: `this agent is on the base branch (${prBase}) — there is nothing to open a pull request from`,
@@ -4417,19 +4660,34 @@ export function createWorkManager({
           // token in its userinfo — so this one line is the only place on the
           // agent merge path that can leak a credential into a stored,
           // team-visible `mergeError`.
-          await postAgentMerge({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
+          await report({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
           return;
         }
         let prUrl = null;
         try {
           const j = JSON.parse(
-            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
+            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state,baseRefName'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
               timeout: 30_000,
             }).toString()
           );
-          if (j?.state === 'OPEN' && typeof j?.url === 'string') prUrl = j.url.trim();
+          if (j?.state === 'OPEN' && typeof j?.url === 'string') {
+            // Adoptable only when it points at the project's own base. A PR
+            // somebody opened by hand against another branch would otherwise
+            // be merged INTO that branch, and the ok settle would claim work
+            // reached base that landed somewhere else entirely. Refused only
+            // on a MEASURED mismatch — an absent field adopts as before.
+            if (typeof j?.baseRefName === 'string' && j.baseRefName !== prBase) {
+              await report({
+                agentId,
+                ok: false,
+                detail: `the open pull request for ${branch} targets ${j.baseRefName}, not ${prBase} — retarget or close it, then approve again`,
+              });
+              return;
+            }
+            prUrl = j.url.trim();
+          }
         } catch {
           /* no PR for this branch at all — created below */
         }
@@ -4445,7 +4703,7 @@ export function createWorkManager({
               .trim();
             prUrl = out.split('\n').filter(Boolean).pop() ?? null;
           } catch (e) {
-            await postAgentMerge({ agentId, ok: false, detail: ghFirstLine(e) });
+            await report({ agentId, ok: false, detail: ghFirstLine(e) });
             return;
           }
         }
@@ -4460,7 +4718,7 @@ export function createWorkManager({
           // Already merged is a SUCCESS: a re-offered job, or somebody merged
           // it in the browser. The observer closes the cards either way.
           if (!/already merged/i.test(line)) {
-            await postAgentMerge({
+            await report({
               agentId,
               ok: false,
               detail:
@@ -4469,11 +4727,46 @@ export function createWorkManager({
             return;
           }
         }
-        // THE TIP, not a merge commit: the merge commit was made on GitHub and
-        // this machine has not fetched it. It identifies the state we asked to
-        // be merged, which is what the receipt is for — the cards themselves
-        // close when the landed observer sees the commits arrive on base.
-        await postAgentMerge({ agentId, ok: true, sha: tip });
+        // VERIFY before reporting ok: modern gh exits 0 on an already-MERGED
+        // PR, and on a repo with a merge queue or auto-merge it exits 0 after
+        // ENQUEUEING — in both, "merged" is a claim about the future. The tip
+        // being an ancestor of base is the fact `ok` asserts, and the server
+        // closes every delivered card on this sha the moment it hears it — so
+        // measure it, with one short retry for the fetch racing GitHub's
+        // merge commit. The same guard the session PR path carries.
+        const tipOnBase = () => {
+          try {
+            git(['merge-base', '--is-ancestor', tip, baseRef()], repoRoot);
+            return true;
+          } catch {
+            return false;
+          }
+        };
+        let landedOnBase = false;
+        for (let attempt = 0; attempt < 2 && !landedOnBase; attempt++) {
+          if (attempt > 0) await new Promise((r) => setTimeout(r, 2000));
+          try {
+            git(['fetch', 'origin', '--quiet'], repoRoot);
+          } catch {
+            /* offline — the check below answers from what we have */
+          }
+          landedOnBase = tipOnBase();
+        }
+        if (!landedOnBase) {
+          await report({
+            agentId,
+            ok: false,
+            detail:
+              "GitHub accepted the merge, but this branch's tip is not on the base branch — a merge queue may still be running it, or the PR that merged was an older one. Approve again once it lands." +
+              (prUrl && PR_URL_RE.test(prUrl) ? ` The pull request is at ${prUrl}.` : ''),
+          });
+          return;
+        }
+        // THE TIP, not the merge commit GitHub made: the tip identifies the
+        // state we asked to be merged, which is what the receipt is for — the
+        // cards themselves close when the landed observer sees the commits
+        // arrive on base.
+        await report({ agentId, ok: true, sha: tip });
         onRepoChanged();
         landed.observe();
         return;
@@ -4493,17 +4786,29 @@ export function createWorkManager({
           warn,
         });
       } catch (e) {
-        await postAgentMerge({
+        await report({
           agentId,
           ok: false,
           detail: envScrub(String(e?.message || e)).slice(0, 2000),
         });
         return;
       }
-      await postAgentMerge({ agentId, ok: true, sha: tip });
+      await report({ agentId, ok: true, sha: tip });
       onRepoChanged();
       landed.observe();
-    });
+      });
+    } finally {
+      if (!reported) {
+        // Belt over braces. A merge this daemon claimed and cannot account for
+        // is a FAILURE, said out loud, so the agent goes back to Review with a
+        // reason instead of waiting out an expiry that blames nobody.
+        await postAgentMerge({
+          agentId,
+          ok: false,
+          detail: 'the merge did not complete — check the daemon log',
+        }).catch(() => {});
+      }
+    }
   };
 
   const processAgentMergeJobs = (jobs) => {
@@ -4573,6 +4878,10 @@ export function createWorkManager({
     // into a card nobody can explain.
     agentTurns.size > 0 ||
     agentMerges.size > 0 ||
+    // A finished agent turn whose settle has not landed lives only in this
+    // process; a restart here is the six-hour park the held body exists to
+    // prevent. Same reason the tab's report queues are below.
+    agentReported.size > 0 ||
     shipping.size > 0 ||
     workChildren.size > 0 ||
     workAnswering.size > 0 ||