flowviant 0.78.0 → 0.79.0

package/bin/lib/work.mjs

@@ -188,6 +188,7 @@ export function createWorkManager({
   const PR_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/pr-done');
   const AGENT_PLAN_CLAIM_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-plan-claim');
   const AGENT_PLAN_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-plan-done');
+  const AGENT_PLAN_ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-plan-activity');
   const AGENT_TURN_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-turn-done');
   const AGENT_ACTIVITY_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-activity');
   const AGENT_PARKED_URL = FLEET_URL.replace(/\/agents\/?$/, '/agent-parked');
@@ -574,8 +575,11 @@ export function createWorkManager({
       // path), but a server bug or compromise sending `../../etc` would
       // otherwise point a session's measured directory anywhere on the box and
       // defeat the port attribution. `sessionWorktreeReport` and `placeWtFor`
-      // already reject an unsafe segment; doing it here covers every consumer
-      // (the preview-claim `placeDir` did not re-check). REPO_PLACE resolves to
+      // already reject an unsafe segment; checking at the intake covers the
+      // consumers that do not (the preview-claim `placeDir` did not re-check).
+      // NOT the only writer: `processWorkTurns` stores a turn job's place too,
+      // and keeps the same check — validating one intake and not the other is
+      // one deploy away from validating neither. REPO_PLACE resolves to
       // repoRoot, so it is allowed through despite not being a path segment.
       if (typeof place === 'string' && place && (place === REPO_PLACE || isSafePathSegment(place)))
         sessionPlaces.set(sid, place);
@@ -2480,9 +2484,26 @@ export function createWorkManager({
       // run it again while the report is merely undelivered.
       if (pendingWorkReports.has(job.id)) continue;
       workAnswering.add(job.id);
-      // Serialized by PLACE: two tabs sharing a worktree take turns in it
-      // rather than editing the same files at the same time.
       const place = job.place || job.sessionId;
+      /**
+       * VALIDATED AT THE TRUST BOUNDARY, exactly as `learnPlaces` validates
+       * the roster's map — this is the OTHER writer of `sessionPlaces`, in the
+       * same reconcile tick, BEFORE the preview jobs and the sweep read it. An
+       * unchecked value stored here reaches every `placeDir` consumer: the
+       * turn is spawned in it, `burstListeners` measures it, and a share would
+       * publicly tunnel a directory OUTSIDE the checkout — the exact traversal
+       * the preview feature's port attribution exists to prevent. Settled out
+       * loud rather than skipped, because a silently dropped turn strands the
+       * tab for the server's whole expiry window.
+       */
+      if (place !== REPO_PLACE && !isSafePathSegment(place)) {
+        void settleWorkTurn(job.id, {
+          ok: false,
+          answer:
+            'the server named a working directory this machine refuses to use — close and reopen the tab, then send the message again',
+        }).finally(() => workAnswering.delete(job.id));
+        continue;
+      }
       // Remembered for every other beat — the sweep, ship, the preview
       // re-check — so they all ask the same directory this turn runs in.
       sessionPlaces.set(job.sessionId, place);
@@ -3346,7 +3367,7 @@ export function createWorkManager({
           };
           // The machine may have no git identity, and a merge COMMIT needs
           // one. Prefer the user's own config; fall back to the daemon's (the
-          // same fallback checkpointWip uses) so a bare machine doesn't fail
+          // same fallback ship's merge keeps) so a bare machine doesn't fail
           // the fold with "Please tell me who you are".
           let idEnv = null;
           try {
@@ -3617,6 +3638,65 @@ export function createWorkManager({
     }
   };
 
+  /**
+   * WHAT THE PLANNER IS DOING, RELAYED — the agent turn's narration channel,
+   * on a PRESS instead of an agent.
+   *
+   * This turn was already streaming and the daemon was already reading it:
+   * `streamJson` humanizes every read, grep, command and thought and prints
+   * it behind `[plan]` on the operator's terminal. Every one of those lines
+   * was then thrown away, so a Deploy press said "planning" on the board and
+   * nothing else for as long as it took — which on an overnight queue is the
+   * whole night. Forwarding the CLI's own tail costs nothing that is not
+   * already being computed.
+   *
+   * IT IS THE CLI'S WORDS, OR THE MACHINE'S — never a stage, a percentage or
+   * an estimate of how far along a model is. Flowviant relays.
+   *
+   * SCRUBBED AND CAPPED HERE rather than at each call site, so a phase marker
+   * added later cannot skip either. Fire-and-forget with every failure
+   * swallowed: narration is a readout, and it must never fail or delay the
+   * turn it describes. A daemon that never calls this is a machine that has
+   * not narrated, which is the only thing an absent line can mean.
+   */
+  const postAgentPlanActivity = async (planId, line) => {
+    const text = envScrub(String(line ?? '')).slice(0, 400);
+    if (!text) return;
+    try {
+      await fetch(AGENT_PLAN_ACTIVITY_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: JSON.stringify({ planId, line: text }),
+      });
+    } catch {
+      /* a readout — losing a line costs nothing */
+    }
+  };
+
+  /**
+   * A WEDGED PLANNING CLI IS STOPPED AT FIFTEEN MINUTES.
+   *
+   * `runTurn` has no timer of its own. A CLI that hangs — a login prompt
+   * nobody is there to answer, a model client stalled on a socket — therefore
+   * runs until something else kills it, holding `planning`, which is what
+   * blocks every auto-update on this machine, and spending whatever the
+   * operator's account is charged for a live session.
+   *
+   * FIFTEEN because the server fails a claimed press at THIRTY (its
+   * `PLAN_JOB_TTL_MS`, measured from `claimedAt`): half of that leaves this
+   * side — the only side that knows the CLI is still running — time to stop it
+   * and have its settle land, instead of the press expiring into a sentence
+   * that blames a machine which never spoke. Nothing legitimate is cut off
+   * either way: this turn reads a card selection and writes nothing, and the
+   * shape of it is minutes.
+   */
+  const PLAN_TURN_TIMEOUT_MS = 15 * 60_000;
+
   const claimAgentPlan = async (id) => {
     try {
       const res = await fetch(AGENT_PLAN_CLAIM_URL, {
@@ -3658,7 +3738,28 @@ export function createWorkManager({
       ['diff', '--name-only', `${baseRef()}...HEAD`],
       ['ls-files', '--others', '--exclude-standard'],
     ]) {
-      const r = git(args, wt);
+      /**
+       * `git()` THROWS; it does not return a non-string.
+       *
+       * The guard below was `if (typeof r !== 'string') continue`, which is a
+       * value `execFileSync` can never produce — so every one of these calls
+       * was effectively unguarded. And this runs over the LIVE AGENTS a plan
+       * job carries, which include agents still in `planning`: they have no
+       * worktree yet, so `git diff` in a directory that does not exist exits
+       * non-zero and throws straight out of `runAgentPlan` — after the press
+       * has been claimed and before the try/finally below. The press then sat
+       * `planning` until its expiry, having spent nothing and explained
+       * nothing, on what would be an ordinary second Deploy.
+       *
+       * An agent whose files cannot be read contributes none. That is the
+       * honest answer and it is what the planner should be told.
+       */
+      let r;
+      try {
+        r = git(args, wt);
+      } catch {
+        continue;
+      }
       if (typeof r !== 'string') continue;
       for (const line of r.split('\n')) {
         const f = line.trim();
@@ -3702,11 +3803,49 @@ export function createWorkManager({
       await postAgentPlan({ id, error: 'no CLI on this machine can run a read-only turn' });
       return;
     }
+
+    /**
+     * ONE LINE AT A TIME, AT MOST ONE EVERY TWO SECONDS — the throttle the
+     * agent turn's narration keeps, for the same reason: a turn emits hundreds
+     * of lines and only the latest is ever rendered. Held per RUN rather than
+     * in a map keyed by press, because one press is one turn and there is
+     * nothing for the clock to outlive.
+     */
+    let lastPlanBeat = 0;
+    const narrate = (line) => {
+      const now = Date.now();
+      if (now - lastPlanBeat < 2_000) return;
+      lastPlanBeat = now;
+      void postAgentPlanActivity(id, line);
+    };
+    /**
+     * THE MACHINE'S OWN VOICE, for the moments only this side can see — the
+     * CLI process actually starting, and this press waiting its turn for the
+     * checkout. Both are FACTS measured here, not a reading of the model's
+     * progress, and both are invisible from a browser: a press held behind a
+     * ship's writer lock looks exactly like a press whose CLI is thinking.
+     *
+     * Never dropped by the throttle above — these are moments, not a stream —
+     * and they stamp its clock so the next model line does not overwrite one
+     * the instant it lands.
+     */
+    const say = (line) => {
+      lastPlanBeat = Date.now();
+      void postAgentPlanActivity(id, line);
+    };
     const liveAgents = (Array.isArray(job.liveAgents) ? job.liveAgents : []).map((a) => ({
       id: String(a?.id ?? ''),
       name: String(a?.name ?? ''),
       status: String(a?.status ?? ''),
-      changedFiles: agentChangedFiles(a?.placeId),
+      // Belt: `agentChangedFiles` is defensive internally, but it resolves a
+      // place first and this whole block sits outside the try below.
+      changedFiles: (() => {
+        try {
+          return agentChangedFiles(a?.placeId);
+        } catch {
+          return [];
+        }
+      })(),
     }));
 
     let out = '';
@@ -3714,9 +3853,29 @@ export function createWorkManager({
      *  a leaked entry keeps the daemon permanently "busy" — which blocks every
      *  auto-update from that moment on, silently, until a restart. */
     let planChild = null;
+    let planTimer = null;
+    /** The cap fired: the CLI was still running when this machine stopped it. */
+    let wedged = false;
+    // Said BEFORE the lock is asked for, because a reader only waits when a
+    // writer holds the checkout or is queued ahead of it — which is exactly
+    // this condition, read one line before we join the queue.
+    const busy = placeLocks.get(REPO_PLACE);
+    if (busy && (busy.writing || busy.waiters.some((w) => w.write)))
+      say('waiting for the checkout — a ship or another turn on this machine is holding it');
     try {
       await inPlace(REPO_PLACE, false, async () => {
-        out = await runTurn({
+        /**
+         * THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close`
+         * after the kill — the shape the project check's timeout already
+         * keeps. A SIGKILLed process whose stdio a grandchild still holds can
+         * be slow to emit `close`, or never emit it, and this promise is what
+         * holds the claimed press open.
+         */
+        let stopWaiting = () => {};
+        const capped = new Promise((r) => {
+          stopWaiting = r;
+        });
+        const turn = runTurn({
           prompt: AGENT_PLAN_KICKOFF({
             tasks,
             liveAgents,
@@ -3731,19 +3890,61 @@ export function createWorkManager({
           streamJson: true,
           answerFromResult: true,
           label: c.cyan('[plan]'),
+          // The CLI's own tail, forwarded to the press. Same rule as an agent
+          // turn's: throttled, overwritten rather than appended, and never
+          // awaited by the turn.
+          onActivity: (a) => {
+            if (a?.label) narrate(String(a.label));
+          },
           onSpawn: (ch) => {
             planChild = ch;
             workChildren.set(ch, null);
+            say(`${RUNTIMES[rt]?.label ?? rt} started on this machine`);
+            /**
+             * ARMED AT THE SPAWN, not at the claim: time spent waiting for the
+             * checkout is not a wedged CLI, and a press that never got to run
+             * is what the server's own clock is for.
+             *
+             * The CHILD, never its group — the rule teardown keeps. A
+             * read-only planning turn starts no dev server, so there is
+             * nothing behind it worth signalling and everything to lose by
+             * signalling somebody else's.
+             */
+            planTimer = setTimeout(() => {
+              wedged = true;
+              try {
+                ch.kill('SIGKILL');
+              } catch {
+                /* already gone */
+              }
+              stopWaiting('');
+            }, PLAN_TURN_TIMEOUT_MS);
+            planTimer.unref?.();
           },
         });
+        out = await Promise.race([turn, capped]);
       });
     } catch (e) {
       await postAgentPlan({ id, error: envScrub(String(e?.message || e)).slice(0, 500) });
       return;
     } finally {
+      if (planTimer) clearTimeout(planTimer);
       if (planChild) workChildren.delete(planChild);
     }
 
+    if (wedged) {
+      // NEVER LEAVE A CLAIMED PRESS UNREPORTED — the belt the merge lane wears
+      // beneath this one. The machine's own words, because the machine is the
+      // only side that knows: the server would have expired this press in
+      // another fifteen minutes with a sentence blaming a daemon that had in
+      // fact answered.
+      await postAgentPlan({
+        id,
+        error: 'the planning turn ran past fifteen minutes on this machine and was stopped',
+      });
+      return;
+    }
+
     const proposal = parseProposal(out);
     if (!proposal) {
       await postAgentPlan({
@@ -3787,8 +3988,13 @@ export function createWorkManager({
   // UNLEASED, unlike a plan or a kill. The server hands out at most one turn
   // per agent per poll and its settle is conditional on the row still being
   // pending, so a second daemon cannot advance the queue twice. What it could
-  // do is run a CLI twice in one worktree, which is what this in-flight set and
-  // the place lock prevent — the same discipline `processWorkTurns` keeps.
+  // do is run a CLI twice in one worktree. The in-flight set below cannot
+  // prevent that alone: it is keyed by TURN id, so it never sees the
+  // DIFFERENT turn the server's TTL-skip hands out while an expired turn's
+  // CLI is still running — and a reader lock would run the two side by side.
+  // So an agent turn takes its place's lock as a WRITER: an agent is ONE
+  // process by definition, and its `a-<id>` place is its own — no tab ever
+  // stands there, so the tabs' turns-run-concurrently law is untouched.
   const agentTurns = new Set(); // turn ids in flight on this tick
   /**
    * The CLI a live agent turn is running in, by PLACE.
@@ -3805,14 +4011,29 @@ export function createWorkManager({
    *  emptied, so run the project's own check in the worktree we are already
    *  standing in. A job lane for that would need a claim, a floor and a settle
    *  to say something this reply already can. */
-  /** Turn ids whose work is DONE but whose report has not landed. The same
-   *  skip-guard `pendingWorkReports` is for a tab, and for the same reason: a
-   *  settle that fails to POST must not re-run the turn — that is a second CLI,
-   *  a second set of commits, and the operator's quota spent again. */
-  const agentReported = new Set();
+  /**
+   * Turns whose work is DONE but whose settle has not landed, keyed to the
+   * finished BODY. The delivery half of what `pendingWorkReports` is for a
+   * tab: a settle that fails to POST must not re-run the turn — that is a
+   * second CLI, a second set of commits, and the operator's quota spent again
+   * — but a guard that only SKIPPED left the other half undone. One failed
+   * POST parked the agent for the server's whole six-hour expiry, holding a
+   * cap slot the entire time, and then expired into "nobody ran it" — a false
+   * sentence about a turn this machine finished. The server's settle is
+   * idempotent (conditional on the row still being pending), so a re-offer of
+   * a held turn re-POSTs the stored body instead: safe, and it lands the
+   * moment the network heals rather than six hours later.
+   *
+   * BOUNDED by the roster itself: a held body's clock is refreshed while the
+   * server keeps offering its turn, and once offering stops — settled by the
+   * re-POST, or expired server-side — the grace below is all that keeps it.
+   */
+  const agentReported = new Map(); // turnId -> { body, at }
+  const AGENT_REPORT_GRACE_MS = 30 * 60_000;
 
   const postAgentTurn = async (body) => {
-    agentReported.add(String(body.turnId));
+    const turnId = String(body.turnId);
+    agentReported.set(turnId, { body, at: Date.now() });
     try {
       const res = await fetch(AGENT_TURN_DONE_URL, {
         method: 'POST',
@@ -3825,14 +4046,19 @@ export function createWorkManager({
         body: JSON.stringify(body),
       });
       const j = await res.json().catch(() => null);
-      // Landed. Forgetting it keeps the guard from growing without bound; a
-      // re-offer of a settled turn is refused server-side anyway.
-      if (res.ok) agentReported.delete(String(body.turnId));
+      // Landed, or REFUSED: a 4xx is the server saying this settle will never
+      // be accepted (expired, already settled, unknown turn), and re-POSTing a
+      // refusal forever is the wedge wearing a retry's clothes. 408/429 stay
+      // retryable, the same split `postSettle` makes for a tab.
+      if (
+        res.ok ||
+        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
+      )
+        agentReported.delete(turnId);
       return j?.data ?? null;
     } catch {
-      // Unsettled, and the id STAYS in the guard: the server expires the turn
-      // and the agent lands in Stuck saying nobody ran it, which is far better
-      // than running it again for six hours.
+      // Unsettled — a network error, so the body STAYS held and the next
+      // re-offer retries the POST rather than the CLI.
       return null;
     }
   };
@@ -3953,7 +4179,10 @@ export function createWorkManager({
       return;
     }
 
-    await inPlace(place, false, async () => {
+    // A WRITER on the agent's own place — see the lane header. Only `a-<id>`
+    // places: those are agents' by construction, and anything else here would
+    // be a tab's directory, where a turn is a reader by the product's own law.
+    await inPlace(place, place.startsWith('a-'), async () => {
       const dir = placeWtFor(place);
       if (!dir) {
         // No worktree and none could be cut. `nothing` rather than an invented
@@ -4074,6 +4303,20 @@ export function createWorkManager({
             /* a missing marker only costs one un-resumed turn */
           }
         }
+        /**
+         * AN ACTION THAT CHANGES WHAT THE MACHINE WOULD MEASURE MUST CAUSE A
+         * NEW MEASUREMENT — the rule every session settle keeps, and the one
+         * lane that did not. An agent's branch diff, head sha and trailered
+         * commits only refreshed on the ≤60s sweep, so review opened right
+         * after a turn described the branch as it was BEFORE the work.
+         *
+         * Here rather than after the settle POST because the CLI has exited,
+         * so the tree is final — and because a queue that just emptied runs
+         * the project's check next, which may hold this function for ten
+         * minutes. Fire-and-forget on an endpoint that already exists, so no
+         * floor: it must never delay the settle behind it.
+         */
+        void reportSessionWorktree(place).catch(() => {});
       }
 
       const commits = commitsBetween(wt, before);
@@ -4148,13 +4391,46 @@ export function createWorkManager({
   };
 
   const processAgentTurnJobs = (jobs) => {
-    if (!Array.isArray(jobs) || jobs.length === 0) return;
-    for (const job of jobs.slice(0, 4)) {
+    const list = Array.isArray(jobs) ? jobs : [];
+    if (agentReported.size) {
+      // The roster is the held bodies' clock: an offered turn is still pending
+      // server-side and worth retrying; one the roster stopped naming was
+      // settled or expired, and holding its body past a generous grace would
+      // grow this map for the life of the process. The server's own expiry is
+      // the true bound — the grace only covers its POST racing a final offer.
+      const offered = new Set(list.map((j) => String(j?.id || '')));
+      const now = Date.now();
+      for (const [id, held] of agentReported) {
+        if (offered.has(id)) held.at = now;
+        else if (now - held.at > AGENT_REPORT_GRACE_MS) agentReported.delete(id);
+      }
+    }
+    for (const job of list.slice(0, 4)) {
       const id = String(job?.id || '');
       if (!id || agentTurns.has(id)) continue;
-      // Already RAN here; only the report is outstanding. Re-running it would
-      // spend the operator's quota again and write a second set of commits.
-      if (agentReported.has(id)) continue;
+      const held = agentReported.get(id);
+      if (held) {
+        // Already RAN here; only the settle is outstanding. Re-POST the held
+        // body — never the CLI, which would spend the operator's quota again
+        // and write a second set of commits. The reply can still carry the one
+        // instruction a settle can (`review: true`, the queue just emptied),
+        // so the project's check runs from here too, under the same writer
+        // lock the turn itself would have held.
+        agentTurns.add(id);
+        void (async () => {
+          const reply = await postAgentTurn(held.body);
+          const place = String(job.placeId || '');
+          const wt = typeof held.body.worktree === 'string' ? held.body.worktree : null;
+          if (reply?.review === true && isSafePathSegment(place) && wt && existsSync(wt)) {
+            await inPlace(place, place.startsWith('a-'), () =>
+              runCheck(String(job.agentId || ''), wt)
+            );
+          }
+        })()
+          .catch(() => {})
+          .finally(() => agentTurns.delete(id));
+        continue;
+      }
       if (!job.agentId || !job.placeId) continue;
       agentTurns.add(id);
       void runAgentTurn(job).finally(() => agentTurns.delete(id));
@@ -4382,8 +4658,8 @@ export function createWorkManager({
   /**
    * A merge COMMIT needs a git identity and the machine may have none. Prefer
    * the operator's own config; fall back to the daemon's, the same fallback
-   * `checkpointWip` and ship both use, so a bare machine does not fail the fold
-   * with "Please tell me who you are".
+   * ship's merge keeps, so a bare machine does not fail the fold with
+   * "Please tell me who you are".
    */
   const gitMerge = (args, cwd) => {
     let idEnv = null;
@@ -4409,18 +4685,37 @@ export function createWorkManager({
     const agentId = String(job.agentId);
     const place = String(job.placeId || '');
     if (!isSafePathSegment(place)) {
+      // Before the claim, and before `report` exists — this one is not covered
+      // by the belt below because there is nothing yet to be un-reported.
       await postAgentMerge({ agentId, ok: false, detail: 'the agent has no worktree here' });
       return;
     }
     if (!(await claimAgentMerge(agentId))) return;
 
+    /**
+     * NO EXIT PATH MAY LEAVE A CLAIMED MERGE UNREPORTED — the same belt the
+     * ship path carries, and this function did not.
+     *
+     * Every branch below reports, but an UNEXPECTED throw reports nothing:
+     * several `git()` calls in here are bare, and `git()` is `execFileSync`,
+     * which throws on any non-zero exit. The agent then sits in `merging`,
+     * which refuses Stop and refuses an answer, until an expiry fires — with
+     * nothing anywhere saying what went wrong.
+     */
+    let reported = false;
+    const report = async (body) => {
+      reported = true;
+      await postAgentMerge(body);
+    };
+
     // A WRITER on the place, exactly as a ship is. It folds base in and pushes
     // with git in that directory, and no CLI can coordinate with something it
     // does not know exists.
-    await inPlace(place, true, async () => {
+    try {
+      await inPlace(place, true, async () => {
       const wt = join(baseDir, 'sessions', place);
       if (!existsSync(wt)) {
-        await postAgentMerge({ agentId, ok: false, detail: 'the worktree is gone' });
+        await report({ agentId, ok: false, detail: 'the worktree is gone' });
         return;
       }
       try {
@@ -4437,7 +4732,7 @@ export function createWorkManager({
         try {
           gitMerge(['merge', '--no-edit', baseRef()], wt);
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: envScrub(String(e?.message || e)).slice(0, 2000),
@@ -4460,7 +4755,7 @@ export function createWorkManager({
       if (!branch) {
         // A detached HEAD names no branch, so there is nothing to merge and
         // nothing to record. An ambiguity in git, not a rule of ours.
-        await postAgentMerge({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
+        await report({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
         return;
       }
       const tip = (git(['rev-parse', 'HEAD'], wt) || '').trim();
@@ -4470,7 +4765,7 @@ export function createWorkManager({
         // Already on base — an idempotent re-offer, or an agent that changed
         // nothing. Reported as a SUCCESS: the branch's work is on base, which
         // is what the caller is asking about.
-        await postAgentMerge({ agentId, ok: true, sha: tip || undefined });
+        await report({ agentId, ok: true, sha: tip || undefined });
         return;
       }
       /**
@@ -4504,7 +4799,7 @@ export function createWorkManager({
             timeout: 20_000,
           });
         } catch (e) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail:
@@ -4516,7 +4811,7 @@ export function createWorkManager({
         }
         const prBase = baseBranchName(baseRef());
         if (branch === prBase) {
-          await postAgentMerge({
+          await report({
             agentId,
             ok: false,
             detail: `this agent is on the base branch (${prBase}) — there is nothing to open a pull request from`,
@@ -4531,19 +4826,34 @@ export function createWorkManager({
           // token in its userinfo — so this one line is the only place on the
           // agent merge path that can leak a credential into a stored,
           // team-visible `mergeError`.
-          await postAgentMerge({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
+          await report({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
           return;
         }
         let prUrl = null;
         try {
           const j = JSON.parse(
-            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
+            execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state,baseRefName'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
               timeout: 30_000,
             }).toString()
           );
-          if (j?.state === 'OPEN' && typeof j?.url === 'string') prUrl = j.url.trim();
+          if (j?.state === 'OPEN' && typeof j?.url === 'string') {
+            // Adoptable only when it points at the project's own base. A PR
+            // somebody opened by hand against another branch would otherwise
+            // be merged INTO that branch, and the ok settle would claim work
+            // reached base that landed somewhere else entirely. Refused only
+            // on a MEASURED mismatch — an absent field adopts as before.
+            if (typeof j?.baseRefName === 'string' && j.baseRefName !== prBase) {
+              await report({
+                agentId,
+                ok: false,
+                detail: `the open pull request for ${branch} targets ${j.baseRefName}, not ${prBase} — retarget or close it, then approve again`,
+              });
+              return;
+            }
+            prUrl = j.url.trim();
+          }
         } catch {
           /* no PR for this branch at all — created below */
         }
@@ -4559,7 +4869,7 @@ export function createWorkManager({
               .trim();
             prUrl = out.split('\n').filter(Boolean).pop() ?? null;
           } catch (e) {
-            await postAgentMerge({ agentId, ok: false, detail: ghFirstLine(e) });
+            await report({ agentId, ok: false, detail: ghFirstLine(e) });
             return;
           }
         }
@@ -4574,7 +4884,7 @@ export function createWorkManager({
           // Already merged is a SUCCESS: a re-offered job, or somebody merged
           // it in the browser. The observer closes the cards either way.
           if (!/already merged/i.test(line)) {
-            await postAgentMerge({
+            await report({
               agentId,
               ok: false,
               detail:
@@ -4583,11 +4893,46 @@ export function createWorkManager({
             return;
           }
         }
-        // THE TIP, not a merge commit: the merge commit was made on GitHub and
-        // this machine has not fetched it. It identifies the state we asked to
-        // be merged, which is what the receipt is for — the cards themselves
-        // close when the landed observer sees the commits arrive on base.
-        await postAgentMerge({ agentId, ok: true, sha: tip });
+        // VERIFY before reporting ok: modern gh exits 0 on an already-MERGED
+        // PR, and on a repo with a merge queue or auto-merge it exits 0 after
+        // ENQUEUEING — in both, "merged" is a claim about the future. The tip
+        // being an ancestor of base is the fact `ok` asserts, and the server
+        // closes every delivered card on this sha the moment it hears it — so
+        // measure it, with one short retry for the fetch racing GitHub's
+        // merge commit. The same guard the session PR path carries.
+        const tipOnBase = () => {
+          try {
+            git(['merge-base', '--is-ancestor', tip, baseRef()], repoRoot);
+            return true;
+          } catch {
+            return false;
+          }
+        };
+        let landedOnBase = false;
+        for (let attempt = 0; attempt < 2 && !landedOnBase; attempt++) {
+          if (attempt > 0) await new Promise((r) => setTimeout(r, 2000));
+          try {
+            git(['fetch', 'origin', '--quiet'], repoRoot);
+          } catch {
+            /* offline — the check below answers from what we have */
+          }
+          landedOnBase = tipOnBase();
+        }
+        if (!landedOnBase) {
+          await report({
+            agentId,
+            ok: false,
+            detail:
+              "GitHub accepted the merge, but this branch's tip is not on the base branch — a merge queue may still be running it, or the PR that merged was an older one. Approve again once it lands." +
+              (prUrl && PR_URL_RE.test(prUrl) ? ` The pull request is at ${prUrl}.` : ''),
+          });
+          return;
+        }
+        // THE TIP, not the merge commit GitHub made: the tip identifies the
+        // state we asked to be merged, which is what the receipt is for — the
+        // cards themselves close when the landed observer sees the commits
+        // arrive on base.
+        await report({ agentId, ok: true, sha: tip });
         onRepoChanged();
         landed.observe();
         return;
@@ -4607,17 +4952,29 @@ export function createWorkManager({
           warn,
         });
       } catch (e) {
-        await postAgentMerge({
+        await report({
           agentId,
           ok: false,
           detail: envScrub(String(e?.message || e)).slice(0, 2000),
         });
         return;
       }
-      await postAgentMerge({ agentId, ok: true, sha: tip });
+      await report({ agentId, ok: true, sha: tip });
       onRepoChanged();
       landed.observe();
-    });
+      });
+    } finally {
+      if (!reported) {
+        // Belt over braces. A merge this daemon claimed and cannot account for
+        // is a FAILURE, said out loud, so the agent goes back to Review with a
+        // reason instead of waiting out an expiry that blames nobody.
+        await postAgentMerge({
+          agentId,
+          ok: false,
+          detail: 'the merge did not complete — check the daemon log',
+        }).catch(() => {});
+      }
+    }
   };
 
   const processAgentMergeJobs = (jobs) => {
@@ -4687,6 +5044,10 @@ export function createWorkManager({
     // into a card nobody can explain.
     agentTurns.size > 0 ||
     agentMerges.size > 0 ||
+    // A finished agent turn whose settle has not landed lives only in this
+    // process; a restart here is the six-hour park the held body exists to
+    // prevent. Same reason the tab's report queues are below.
+    agentReported.size > 0 ||
     shipping.size > 0 ||
     workChildren.size > 0 ||
     workAnswering.size > 0 ||