thinkpool-pair 0.7.107 → 0.7.108

package/account.mjs

@@ -420,13 +420,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // channel is RLS-gated to {me, P}); I only ever answer for rooms I serve AND share
   // with P (roomPartner === P) — defense in depth behind the channel firewall.
   const onPeerListReq = (partnerUid, ch, payload) => {
-    if (process.env.TP_PAIRBUS_OFF === '1') return
+    // EN-M4 — the kill-switch must gate the ANSWERING side too. TP_CROSSROOM_OFF on THIS
+    // device means "no cross-session reach here", which has to include refusing to EXPOSE
+    // this device's rooms to a peer — otherwise a partner still reads in while you've opted
+    // out. (TP_PAIRBUS_OFF already disables the bus entirely.)
+    if (process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return
     const rooms = [...children.keys()].filter((r) => roomPartner.get(r) === partnerUid).map((r) => ({ code: r, name: roomNames.get(r) || null, host: machine }))
     try { ch.send({ type: 'broadcast', event: 'peer-list-res', payload: { nonce: payload?.nonce, rooms } }) } catch { /* channel down */ }
   }
   const onPeerPeekReq = (partnerUid, ch, payload) => {
     const reply = (extra) => { try { ch.send({ type: 'broadcast', event: 'peer-peek-res', payload: { nonce: payload?.nonce, ...extra } }) } catch { /* channel down */ } }
-    if (process.env.TP_PAIRBUS_OFF === '1') return reply({ error: 'Cross-session reach is off on this device.' })
+    if (process.env.TP_PAIRBUS_OFF === '1' || process.env.TP_CROSSROOM_OFF === '1') return reply({ error: 'Cross-session reach is off on this device.' })
     const target = String(payload?.targetRoom || '').toUpperCase().trim()
     const tc = children.get(target)
     if (!tc || roomPartner.get(target) !== partnerUid) return reply({ error: `Room ${target} is not a room this device shares with you.` })

package/bridge.mjs

@@ -40,11 +40,26 @@ import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv } from './flow-conductor.mjs'
+import { normalizePlanOutput } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph
 import { createFlowWorktree, worktreeSpec } from './flow-worktree.mjs'
-import { startPreview, stopAllPreviews } from './flow-preview.mjs'
-import { FLOW_REVIEWER_PROMPT, revertLane } from './flow-review.mjs'
+import { startPreview, stopAllPreviews, previews } from './flow-preview.mjs'
+// FL-M9 — per-lane preview servers leak (one per done lane, never stopped until shutdown).
+// Lane previews are keyed `lane:<flowId>:<laneId>`; stop a whole flow's set when it assembles
+// (the assembled preview supersedes them) or when a lane is reverted.
+function stopFlowPreviews (flowId, laneId = null) {
+  for (const [key, h] of previews) {
+    if (typeof key !== 'string') continue
+    if (laneId ? key === `lane:${flowId}:${laneId}` : key.startsWith(`lane:${flowId}:`)) { try { h.stop() } catch { /* noop */ } }
+  }
+}
+import { FLOW_REVIEWER_PROMPT, revertLane, parseReviewVerdict } from './flow-review.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
-import { canDispatch, FLOW_LIMITS } from './flow-budget.mjs'
+import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
+// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's
+// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next
+// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
+// broadcasts; without persistent state the cap can never bite.
+const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
@@ -1041,6 +1056,48 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // an old seq, which is what keeps the between-turns restart dup-free (see
   // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
   entry.seq = makeSeqCounter(maxSeq(entry.log))
+  entry.rolePrompt = rolePrompt || null   // FL-M6 — persisted so a bridge restart restores the flow role prompt
+  // FL-B1 (lane side) — record a flow lane's slice as done. Shared by the mark_flow_done
+  // MCP tool AND the FLOW_DONE sentinel-Write intercept: like the conductor's submit, the
+  // MCP tool is DEFERRED (needs ToolSearch, which hangs), so lanes signal done by Writing a
+  // FLOW_DONE file — a DIRECT tool — which the PreToolUse hook routes here. Returns a message.
+  const markFlowDone = async () => {
+    if (!entry.flowSessionId || !entry.flowTaskKey) return 'Not a Flow lane — nothing to mark done.'
+    if (entry.flowDone) return 'This slice is already recorded as done.'
+    let commitSha = null
+    try { commitSha = execFileSync('git', ['-C', entry.cwd || process.cwd(), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* no commits yet */ }
+    let previewUrl = null
+    try { const pv = await startPreview({ dir: entry.cwd || process.cwd(), id: `lane:${entry.flowSessionId}:${id}` }); previewUrl = pv.url } catch { /* preview best-effort */ }
+    bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl }, flowChannel)
+    process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
+    entry.flowDone = true   // FL-B3 — retire immediately so it drops from the ≤8 lane cap
+    setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
+    return `Slice "${entry.flowTaskKey}" recorded as DONE${commitSha ? ` (commit ${commitSha.slice(0, 8)})` : ''}${previewUrl ? `. Live preview: ${previewUrl}` : ''}. The room dispatches dependent slices + assembles when all are done. You are finished — stop here.`
+  }
+  entry.markFlowDone = markFlowDone   // FL-M6 — callable from the restore path to reconcile a finished-during-restart lane
+  // FL-B4 — an adversarial REVIEW lane records its verdict by Writing FLOW_REVIEW.json (the
+  // review gate was dead code: reviewers had no working emit path, so a failing slice was
+  // never reverted). On FAIL → broadcast flow-revert for the reviewed slice (the client flips
+  // it to pending → the next wave rebuilds it). Either way the review lane itself is done.
+  const onReviewVerdict = async (raw) => {
+    if (!entry.flowSessionId || !entry.flowTaskKey) return { ok: false, message: 'Not a Flow review lane.' }
+    let v, target = null
+    try {
+      v = parseReviewVerdict(raw)
+      const o = typeof raw === 'string' ? JSON.parse(String(raw).replace(/```(?:json)?|```/g, '').trim()) : raw
+      target = (o && (o.taskKey || o.target)) || (entry.flowReviewTarget || null)
+    } catch (e) {
+      return { ok: false, message: `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
+    }
+    if (!v.pass && target) {
+      bcast('flow-revert', { term: id, flowId: entry.flowSessionId, taskKey: target }, flowChannel)
+      process.stderr.write(`\n  ${A.yel}◆ review FAIL — reverting ${target}: ${v.reasons.join('; ').slice(0, 120)}${A.rst}\n`)
+    } else {
+      process.stderr.write(`\n  ${A.cyan}◆ review PASS — ${target || entry.flowTaskKey}${A.rst}\n`)
+    }
+    const doneMsg = await markFlowDone()
+    return { ok: true, message: `Review verdict recorded: ${v.pass ? 'PASS' : `FAIL — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 160)})`}. ${doneMsg}` }
+  }
   // Identity for the durable archive — pushLog appends every new transcript event to
   // <room>/<id>.events.jsonl keyed off these. Seed the archive once from the restored
   // (≤2000) log so the retained window is immediately pageable; no-op if it already
@@ -1070,7 +1127,12 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   if (entry.log.length) process.stderr.write(`\n  ◆ restored ${entry.log.length} prior events (${id.slice(0, 8)})${resume ? ' + resuming live context' : ''}.\n`)
   // Persist the permission mode alongside the transcript so a bridge restart
   // restores the session in the SAME mode (a bypass room stays bypass on resume).
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, spawnedBy: entry.spawnedBy })
+  // FL-M6 — persist the flow context so a bridge restart restores a lane's identity. Without
+  // flowSessionId/flowTaskKey a restored lane can't mark done + the conductor loses its
+  // subagent-block; without cwd it runs outside its worktree; without rolePrompt it loses its
+  // Flow role. blockSubagents / onLaneDone / onReviewVerdict / onSubmitPlan all derive from
+  // these, so restoring them restores the whole behavior.
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -1130,11 +1192,13 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
-          entry.pairPeekCount = (entry.pairPeekCount || 0) + 1
-          if (entry.pairPeekCount > CROSSROOM.peekPerTurnCap) return okText(`Cross-session read limit reached for this turn (${CROSSROOM.peekPerTurnCap}). Continue with what you have.`)
+          // EN-m2 — validate BEFORE spending the per-turn budget so a malformed / self-room
+          // (no-op) call doesn't burn the allowance.
           const target = String(args?.session || '').toUpperCase().trim()
           if (!target) return okText('Name a room code to read (call list_sessions to see them).')
           if (target === room) return okText('That is this room — use read_terminal for terminals in your own room.')
+          entry.pairPeekCount = (entry.pairPeekCount || 0) + 1
+          if (entry.pairPeekCount > CROSSROOM.peekPerTurnCap) return okText(`Cross-session read limit reached for this turn (${CROSSROOM.peekPerTurnCap}). Continue with what you have.`)
           const res = await pairRequest('pair-peek-req', { targetRoom: target, terminal: args?.terminal, lines: args?.lines })
           if (res?.error) return okText(res.error)
           return okText(res?.text || `Room ${target} returned nothing.`)
@@ -1198,6 +1262,9 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
           if (target.kind !== 'agent') return okText(`Terminal ${target.ref} is a shell, not an agent — cross-posting is only allowed to agent terminals.`)
           const te = sessions.get(target.id)
           if (!te?.session) return okText(`Terminal ${target.ref} is no longer live.`)
+          // Guard a missing/blank text (parity with post_to_session) — never inject an empty
+          // turn, and don't burn the per-turn budget on a no-op.
+          if (!args?.text || !String(args.text).trim()) return okText('Nothing to send — provide a non-empty `text` for the post.')
           entry.postCount = (entry.postCount || 0) + 1
           const fromRef = String(id).slice(0, 8)
           const msg = `[From: terminal ${fromRef}'s agent — relayed via ThinkPool cross-terminal, approved by a person in the room]\n${args.text}`
@@ -1253,7 +1320,10 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
           // Inherit the spawner's permission mode by default (so a bypass orchestrator's
           // lanes run autonomously); an explicit `mode` overrides. The PreToolUse gate
           // already confirmed any bypass-escalation from a non-bypass lane before we got here.
-          const childMode = args?.mode || entry.mode
+          // PM-m1 — never INHERIT plan mode into a spawned worker lane: a lane spawned from a
+          // plan-mode lane would stall on ExitPlanMode cards. An explicit args.mode still wins;
+          // otherwise inherit, but fall plan → default (an autonomous worker doesn't plan-gate).
+          const childMode = args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode)
           openStructured({ id: newId, model: args?.model, mode: childMode })
           const ne = sessions.get(newId)
           if (!ne) { if (args?.name) { delete termNames[newId]; saveNames(room, termNames) } return okText('Could not open a new lane — the terminal cap may have just been reached. Close one and retry.') }
@@ -1303,19 +1373,27 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         'mark_flow_done',
         "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). No arguments: your commit is read from your worktree. Do not call before your slice actually runs + meets acceptance.",
         {},
-        async () => {
+        async () => ({ content: [{ type: 'text', text: await markFlowDone() }] }),
+      ),
+      // FL-B1 — the conductor SUBMITS its decomposition through THIS tool, not the built-in
+      // ExitPlanMode. In the current SDK, ExitPlanMode is a deferred tool the conductor must
+      // ToolSearch for — and it hangs there, wedging every flow in `planning`. A dedicated MCP
+      // tool removes all dependence on plan-mode/ExitPlanMode/deferred-tool discovery: validate
+      // the task-graph here, broadcast flow-plan (the same path the old interception used), and
+      // reject malformed plans back to the conductor so it re-emits.
+      tool(
+        'submit_flow_plan',
+        'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line>","tasks":[{"key":"<kebab>","title":"…","scope":"…","acceptance":"…","deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. The room validates it is an acyclic DAG, persists the tasks, and shows the approval card. This is how a conductor FINISHES — do NOT use ExitPlanMode, do NOT write a plan file.',
+        { plan: z.string().describe('the task-graph as a JSON string (the {summary, tasks:[…]} object)') },
+        async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
-          if (!entry.flowSessionId || !entry.flowTaskKey) return okText('Not a Flow lane — nothing to mark done.')
-          let commitSha = null
-          try { commitSha = execFileSync('git', ['-C', entry.cwd || process.cwd(), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* no commits yet */ }
-          // Step 3 runtime: serve this lane's worktree so the room can iframe a live
-          // preview. Static serve — works for the no-build single-file artifact; URL
-          // rides the done broadcast.
-          let previewUrl = null
-          try { const pv = await startPreview({ dir: entry.cwd || process.cwd(), id: `lane:${id}` }); previewUrl = pv.url } catch { /* preview best-effort */ }
-          bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl }, flowChannel)
-          process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
-          return okText(`Slice "${entry.flowTaskKey}" marked done${commitSha ? ` (commit ${commitSha.slice(0, 8)})` : ' (no commit yet — commit, then re-call)'}${previewUrl ? `. Live preview: ${previewUrl}` : ''}. The room records it + dispatches any slices that depended on you.`)
+          if (!entry.flowSessionId) return okText('Not a Flow conductor — there is no flow to submit a plan for.')
+          let norm
+          try { norm = normalizePlanOutput(args?.plan || '') }
+          catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.`) }
+          bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
+          process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
+          return okText(`Plan submitted (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) — the room is showing the human an approval card. You are DONE; stop here and wait for approval (lane dispatch is the room's job).`)
         },
       ),
     ],
@@ -1323,10 +1401,27 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   entry.session = startClaudeSession({
     cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
     // A Flow CONDUCTOR (flowSessionId set, no flowTaskKey) must DECOMPOSE, not explore via
-    // a fan-out of Task/Explore subagents — those raise permission cards in plan mode (which
-    // now land on the hidden conductor terminal) and the model ignores the prompt rule not
-    // to. Hard-block the Task tool for conductors so it reads with Read/Grep/Glob + ExitPlanMode.
+    // a fan-out of Task/Explore subagents, and must not build. Hard-block Task/Bash/Write for
+    // conductors so it reads with Read/Grep/Glob and submits via the FLOW_PLAN.json sentinel.
     blockSubagents: !!flowSessionId && !flowTaskKey,
+    // FL-B1 — the conductor submits its task-graph by Writing FLOW_PLAN.json; the PreToolUse
+    // hook intercepts that Write and calls this. Validate the DAG and broadcast flow-plan (the
+    // client persists it + shows the approval card); a malformed plan comes straight back to
+    // the conductor as the tool result so it re-emits. Returns { ok, message }.
+    onSubmitPlan: (planText) => {
+      if (!entry.flowSessionId) return { ok: false, message: 'Not a Flow conductor — nothing to submit.' }
+      let norm
+      try { norm = normalizePlanOutput(planText || '') }
+      catch (e) { return { ok: false, message: `Plan REJECTED: ${e?.message || e}. Re-Write FLOW_PLAN.json with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.` } }
+      bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
+      process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
+      return { ok: true, message: `Plan SUBMITTED (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) — the room is showing the human an approval card. You are DONE: stop here, do not write anything else, wait for approval (lane dispatch is the room's job).` }
+    },
+    // FL-B1 (lane side) — a flow lane signals slice-done by Writing FLOW_DONE; the hook
+    // routes that Write here (mark_flow_done MCP tool is deferred → ToolSearch → hangs).
+    onLaneDone: flowTaskKey ? (async () => ({ ok: true, message: await markFlowDone() })) : null,
+    // FL-B4 — a review lane records its verdict via FLOW_REVIEW.json (revert-on-fail).
+    onReviewVerdict: flowTaskKey ? onReviewVerdict : null,
     mcpServers: { thinkpool: peekServer },
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
@@ -1354,6 +1449,21 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
       // id, an event that arrives both live AND in a reconnect replay renders
       // twice (the 2026-06-19 duplicate-message bug). See event-id.mjs.
       stampEvent(evt)
+      // FL-B2 — fold this flow lane's completed-turn output tokens into its budget so the
+      // autopilot cap can halt the next wave before overrun (output_tokens = the billed
+      // reasoning+output spend the indicator already tracks; conservative enough for a guard).
+      if (entry.flowSessionId && entry.flowTaskKey && evt.kind === 'result' && evt.usage) {
+        const b = flowBudgets.get(entry.flowSessionId)
+        if (b) flowBudgets.set(entry.flowSessionId, recordSpend(b, evt.usage.output_tokens || 0))
+      }
+      // FL-B1 (lane) — a flow lane that ENDS ITS TURN is done: a bypass lane runs its slice
+      // to completion in one turn, then narrates "done" and stops. Models often skip the
+      // explicit signal (FLOW_DONE / mark_flow_done), which left the slice stuck 'dispatched'
+      // forever → the flow never assembled. Auto-record on turn-end (idempotent — markFlowDone
+      // no-ops if already done, so the explicit sentinel still works as the fast path).
+      if (entry.flowSessionId && entry.flowTaskKey && evt.kind === 'result' && !entry.flowDone) {
+        Promise.resolve().then(() => markFlowDone()).catch(() => { /* best-effort */ })
+      }
       // The init system event carries the session's slash command list. Stash it
       // on the entry so the ANNOUNCE can hand it to clients that connect/reload
       // AFTER init (the one-time code-event would miss them), then re-announce.
@@ -1458,6 +1568,24 @@ function allowPending(s) {
   }
 }
 
+// PM-M3 — switching to acceptEdits must ALSO retroactively clear the cards it would
+// auto-approve (non-destructive writes), same reasoning as allowPending for bypass:
+// setPermissionMode only applies going forward, so without this a flip to acceptEdits
+// leaves the user staring at write cards the new mode is meant to auto-allow. Only
+// write-class, non-high-risk cards clear; Bash/network/destructive/plan/ask stay gated.
+const ACCEPT_EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit'])
+function acceptEditsPending(s) {
+  if (!s?.pending) return
+  for (const [key, p] of s.pending) {
+    const tn = p?.payload?.toolName
+    const risk = p?.payload?.risk
+    if (risk === 'plan' || risk === 'ask' || risk === 'high') continue
+    if (!ACCEPT_EDIT_TOOLS.has(tn)) continue
+    try { p.resolve('allow') } catch { /* noop */ }
+    s.pending.delete(key)
+  }
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
@@ -1468,6 +1596,13 @@ function endStructured(id) {
     sessions.delete(id)
     bcast('term-exit', { id })
     fireImageCleanup(id)   // drop this term's screenshots from Storage (COGS)
+    // EN-m3 — closing a spawner ORPHANS the lanes it spawned (only that spawner could
+    // close_terminal them; they can never be closed otherwise + keep occupying the caps).
+    // Cascade-close its direct children (spawnedBy === this id — a real terminal id, not a
+    // `flow:<id>` marker, so flow lanes are untouched; maxHop:1 means no deeper recursion).
+    for (const [cid, ce] of [...sessions]) {
+      if (ce.spawnedBy === id) endStructured(cid)
+    }
   }
   deleteSession(room, id)   // remove <id>.json so loadAll() won't bring it back
   if (s) announce()
@@ -1674,6 +1809,7 @@ channel
     s.postCount = 0
     s.pairPeekCount = 0   // cross-room read budget resets with the in-room ones (Tier 1)
     s.crossRoomPostCount = 0   // Tier 3 cross-room post budget resets on a real human turn
+    s.spawnCount = 0   // EN-M3 — spawn budget MUST reset too, else turn 2+ can never spawn a lane
     s.hop = 0
     s.roomHop = 0   // a human turn is room-hop 0 — clears any injected cross-room hop depth
     const text = String(payload.text)
@@ -1741,6 +1877,8 @@ channel
       s.mode = payload.mode; s.session.setMode(payload.mode)  // track for persist/restore
       // Flipping to bypass = "stop asking, including the cards this turn already raised."
       if (payload.mode === 'bypassPermissions') allowPending(s)
+      // Flipping to acceptEdits = "auto-approve writes" — clear the write cards already raised.
+      else if (payload.mode === 'acceptEdits') acceptEditsPending(s)
     }
   })
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
@@ -1788,7 +1926,21 @@ channel
           // Closed sessions are unlinked by deleteSession, so a file existing on disk ==
           // a session that was live at shutdown (never an explicitly closed one).
           const all = loadAll(room)
-          if (all.length) for (const rec of all) openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy })
+          if (all.length) for (const rec of all) {
+            // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
+            // bridge restart: the conductor keeps its subagent-block + plan interception, and
+            // lanes keep their worktree cwd + the ability to mark done.
+            openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt })
+            const re = sessions.get(rec.id)
+            if (re && rec.flowReviewTarget) re.flowReviewTarget = rec.flowReviewTarget
+            // FL-M6 — a flow LANE whose turn had already ENDED before the restart finished its
+            // slice, but its done-signal was lost while the bridge was down (resume won't re-run
+            // an ended turn, so it would sit idle → the flow stalls forever). Reconcile: re-record
+            // it done. A lane still MID-turn (restoredTurnOpen) resumes + finishes normally.
+            if (re && rec.flowTaskKey && !restoredTurnOpen(rec.log || [])) {
+              setTimeout(() => { try { re.markFlowDone?.() } catch { /* noop */ } }, 2000)
+            }
+          }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
           // (autoAgent set, no attachedCmd) the web's `?new=1` flow opens the first
           // terminal; opening one here too raced it into TWO terminals — each a
@@ -1830,9 +1982,11 @@ flowChannel
   .on('broadcast', { event: 'flow-start' }, ({ payload }) => {
     // Ensemble Flow — the room asks this bridge to launch a CONDUCTOR for a Flow run.
     // The room already created the flow_sessions row (flowId); the conductor opens in
-    // plan mode (so ExitPlanMode is permitted), seeded with the build prompt. It
-    // decomposes → calls ExitPlanMode(planJson) → the requestPermission flow-plan branch
-    // broadcasts flow-plan back. `host` routes to one bridge in multi-machine rooms.
+    // DEFAULT mode (NOT plan mode — FL-B1: plan mode triggers the model's ExitPlanMode
+    // reflex, and ExitPlanMode is a deferred tool that hangs ToolSearch in the SDK, wedging
+    // every flow in `planning`). It can ONLY read (Read/Grep/Glob auto-allow) + submit: its
+    // Write/Edit/Bash/Task are hard-blocked (blockSubagents), and it finishes by calling the
+    // submit_flow_plan MCP tool → flow-plan broadcast. `host` routes one bridge in multi-machine rooms.
     if (!payload?.flowId) return
     if (payload.host && payload.host !== name) return
     for (const [, e] of sessions) if (e.flowSessionId === payload.flowId) return   // already conducting this flow
@@ -1843,7 +1997,7 @@ flowChannel
     // lanes form ONE Ensemble group (same ensembleRoot) — the drilled flow shows a row of
     // all its terminals to hop between, with a working Back. (No flowTaskKey → it's still
     // the conductor, excluded from the lane cap below.)
-    openStructured({ id: cid, mode: 'plan', rolePrompt: FLOW_CONDUCTOR_PROMPT, flowSessionId: payload.flowId, spawnedBy: `flow:${payload.flowId}` })
+    openStructured({ id: cid, mode: 'default', rolePrompt: FLOW_CONDUCTOR_PROMPT, flowSessionId: payload.flowId, spawnedBy: `flow:${payload.flowId}` })
     const ce = sessions.get(cid)
     if (ce?.session) { try { ce.session.sendTurn(payload.prompt || '') } catch { /* session still starting */ } }
     process.stderr.write(`\n  ${A.mag}◆ flow conductor launched — flow ${String(payload.flowId).slice(0, 8)} (plan mode).${A.rst}\n`)
@@ -1860,9 +2014,26 @@ flowChannel
     const assignments = []
     // Step 6 — cap concurrent Flow lanes (invariant: ≤ FLOW_LIMITS.maxConcurrentLanes).
     // Overflow tasks stay pending; the room re-dispatches them in the next wave.
-    let liveLanes = [...sessions.values()].filter(e => typeof e.spawnedBy === 'string' && e.spawnedBy.startsWith('flow:') && e.flowTaskKey).length  // lanes only — conductor has no flowTaskKey
+    // Live lanes = flow lanes still running (NOT retired-on-done — FL-B3). Conductor has
+    // no flowTaskKey so it never counts.
+    let liveLanes = [...sessions.values()].filter(e => typeof e.spawnedBy === 'string' && e.spawnedBy.startsWith('flow:') && e.flowTaskKey && !e.flowDone).length
+    // FL-B2 — real budget: cap from the dispatch payload (flow_sessions.budget_cap, autopilot
+    // only) with the operator env override; kill-switch refuses all dispatch. A per-flow spend
+    // ledger accumulates across waves (flowBudgets) so the cap bites BEFORE overrun.
+    const ks = killSwitchEnv()
+    if (ks.disabled) { process.stderr.write(`\n  ${A.yel}◆ flow dispatch refused — TP_FLOW_OFF kill-switch is on.${A.rst}\n`); return }
+    const dispMode = payload.mode || 'guide'
+    const capTokens = ks.capFromEnv != null ? ks.capFromEnv : (payload.budgetCap != null ? Number(payload.budgetCap) : null)
+    let budget = flowBudgets.get(payload.flowId) || makeBudget({ capTokens })
+    if (budget.capTokens !== capTokens) budget = { ...budget, capTokens }   // cap can arrive late
+    flowBudgets.set(payload.flowId, budget)
     for (const t of payload.tasks) {
-      const gate = canDispatch({ mode: payload.mode || 'guide', liveLanes, budget: { capTokens: null, spentTokens: 0, killed: false } })
+      // FL-M7 — idempotent dispatch: never spawn a 2nd lane into a slice that already has a
+      // live lane (a re-broadcast / resend would otherwise collide in the same worktree).
+      if ([...sessions.values()].some(e => e.flowSessionId === payload.flowId && e.flowTaskKey === t.task_key && !e.flowDone)) {
+        process.stderr.write(`\n  ${A.dim}◆ flow dispatch skip ${t.task_key} — lane already live.${A.rst}\n`); continue
+      }
+      const gate = canDispatch({ mode: dispMode, liveLanes, budget })
       if (!gate.ok) { process.stderr.write(`\n  ${A.yel}◆ flow dispatch held (${gate.reason}, ${liveLanes}/${FLOW_LIMITS.maxConcurrentLanes} lanes) — ${assignments.length} spawned this wave.${A.rst}\n`); break }
       try {
         // Step 4 — a `review` slice gets the adversarial reviewer prompt (try-to-break),
@@ -1877,16 +2048,30 @@ flowChannel
         // a Flow summoned from a bypass terminal runs hands-off).
         openStructured({ id: laneId, cwd: dir, mode: 'bypassPermissions', rolePrompt: isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}` })
         const le = sessions.get(laneId)
-        if (le?.session) {
-          const spec =
-            `[Flow lane — slice "${t.task_key}" of flow ${String(payload.flowId).slice(0, 8)}]\n` +
-            `TITLE: ${t.title}\n` +
-            `SCOPE (files you OWN — edit ONLY these): ${t.scope || '(none stated)'}\n` +
-            `ACCEPTANCE (done = this runs + proves it): ${t.acceptance || '(meet the title)'}\n` +
-            (t.deps && t.deps.length ? `DEPENDS ON (already built): ${t.deps.join(', ')}\n` : '') +
-            `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
-            `Build your slice. Own only your files. Done = it runs + meets acceptance. Commit when done.`
-          try { le.session.sendTurn(spec) } catch { /* session still starting */ }
+        if (le) {
+          // FL-B4 — a review slice reviews the slices it DEPENDS ON; remember the primary
+          // target so a FAIL verdict knows what to revert even if the model omits taskKey.
+          if (isReview) le.flowReviewTarget = (t.deps && t.deps[0]) || null
+          if (le.session) {
+            const spec = isReview
+              ? `[Flow REVIEW lane — slice "${t.task_key}" of flow ${String(payload.flowId).slice(0, 8)}]\n` +
+                `You are ADVERSARIALLY reviewing the slice(s): ${(t.deps || []).join(', ') || t.title}\n` +
+                (Array.isArray(t.deps) && t.deps.length
+                  ? `Reviewed slice worktree(s) — check out + RUN each yourself:\n` +
+                    t.deps.map((dep) => { const ws = worktreeSpec({ flowId: payload.flowId, taskKey: dep }); return `  - ${dep}: dir ${ws.dir} (branch ${ws.branch})` }).join('\n') + '\n'
+                  : '') +
+                `ACCEPTANCE to INDEPENDENTLY verify: ${t.acceptance || t.title}\n` +
+                `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
+                `Review it — run it, hunt for failure. When done, use the Write tool to write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}. That Write IS your verdict.`
+              : `[Flow lane — slice "${t.task_key}" of flow ${String(payload.flowId).slice(0, 8)}]\n` +
+                `TITLE: ${t.title}\n` +
+                `SCOPE (files you OWN — edit ONLY these): ${t.scope || '(none stated)'}\n` +
+                `ACCEPTANCE (done = this runs + proves it): ${t.acceptance || '(meet the title)'}\n` +
+                (t.deps && t.deps.length ? `DEPENDS ON (already built): ${t.deps.join(', ')}\n` : '') +
+                `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
+                `Build your slice. Own only your files. Done = it runs + meets acceptance. Commit when done.`
+            try { le.session.sendTurn(spec) } catch { /* session still starting */ }
+          }
         }
         assignments.push({ task_key: t.task_key, laneId })
         liveLanes++
@@ -1923,6 +2108,7 @@ flowChannel
       try { initRepo({ dir: outDir }) } catch { /* best-effort */ }
       let previewUrl = null
       try { const pv = await startPreview({ dir: outDir, id: `assembled:${payload.flowId}` }); previewUrl = pv.url } catch { /* best-effort */ }
+      stopFlowPreviews(payload.flowId)   // FL-M9 — the assembled preview supersedes the per-lane ones
       bcast('flow-assembled', { term: 'flow', flowId: payload.flowId, previewUrl, outDir, files: merged.files, conflicts: merged.conflicts }, flowChannel)
       process.stderr.write(`\n  ${A.mag}◆ flow assembled — ${merged.files.length} file(s)${merged.conflicts.length ? `, ${merged.conflicts.length} conflict(s)` : ''}${previewUrl ? ` · preview ${previewUrl}` : ''} (flow ${short}).${A.rst}\n`)
       announce()
@@ -1930,13 +2116,26 @@ flowChannel
       process.stderr.write(`\n  ${A.yel}◆ flow assemble failed: ${e?.message || e}${A.rst}\n`)
     }
   })
-  .on('broadcast', { event: 'flow-revert' }, ({ payload }) => {
+  .on('broadcast', { event: 'flow-revert' }, async ({ payload }) => {
     // Step 4 — atomic per-lane revert: roll back ONE slice (remove its worktree +
     // branch) without touching the others, when adversarial review rejects it. The
     // room re-dispatches the reverted task on the next wave.
     if (!payload?.flowId || !payload?.taskKey) return
     if (payload.host && payload.host !== name) return
     try {
+      // FL-M8 — tear down the lane's live session FIRST. revertLane does `git worktree
+      // remove --force`; pulling the worktree out from under a still-running lane corrupts
+      // its process state. Retire it, let the SDK release the cwd, THEN remove the tree.
+      let killed = false
+      for (const [sid, e] of sessions) {
+        if (e.flowSessionId === payload.flowId && e.flowTaskKey === payload.taskKey && !e.flowDone) {
+          e.flowDone = true
+          try { endStructured(sid) } catch { /* already gone */ }
+          stopFlowPreviews(payload.flowId, sid)   // FL-M9 — drop the reverted lane's preview
+          killed = true
+        }
+      }
+      if (killed) await new Promise((r) => setTimeout(r, 400))
       const { branch } = revertLane({ flowId: payload.flowId, taskKey: payload.taskKey })
       bcast('flow-reverted', { term: 'flow', flowId: payload.flowId, taskKey: payload.taskKey, branch }, flowChannel)
       process.stderr.write(`\n  ${A.yel}◆ flow slice reverted — ${payload.taskKey} (${branch}).${A.rst}\n`)

package/claude-session.mjs

@@ -120,7 +120,7 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  */
 const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null }) {
   const ac = new AbortController()
   let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
@@ -249,23 +249,66 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     const lvl = hookInput.effort?.level
     if (lvl && lvl !== effort) { effort = lvl; emit({ kind: 'effort', level: effort }) }
     // Flow CONDUCTOR hard-stop: a conductor must DECOMPOSE using ONLY Read/Grep/Glob (which
-    // are auto-allowed, no card) then ExitPlanMode. Two things otherwise stall it on a
+    // are auto-allowed, no card) then ExitPlanMode. FOUR tool classes otherwise stall it on a
     // permission card on the now-hidden conductor terminal: (1) Task/Agent subagents — the
     // model's parallelize instinct fans out Explore agents despite the prompt; (2) Bash —
     // the model reaches for `find`/`grep`/`wc`, and Bash is medium-risk → a card in plan
-    // mode. Deny BOTH and tell it to use Grep/Glob/Read instead. (blockSubagents is set only
-    // for the conductor session — lanes build under their own bypass/one-hop rules.)
-    if (blockSubagents && (toolName === 'Task' || toolName === 'Agent' || toolName === 'Bash')) {
+    // mode; (3) Write/Edit — the model's plan-mode habit is to WRITE A PLAN DOC
+    // (`~/.claude/plans/*.md`) instead of emitting the task-graph; that write pops a card AND
+    // never produces tasks, so the flow wedges in `planning` forever (FL-B1). Deny ALL and
+    // redirect to ExitPlanMode. (blockSubagents is set only for the conductor session —
+    // lanes build under their own bypass/one-hop rules.)
+    // FL-B1 — the conductor SUBMITS its decomposition by Writing the task-graph JSON to the
+    // sentinel file FLOW_PLAN.json. Write is a DIRECT (non-deferred) tool, so this avoids the
+    // deferred-tool/ToolSearch path that hangs every other submit route (ExitPlanMode AND the
+    // submit_flow_plan MCP tool are deferred → ToolSearch → hang). We intercept that Write
+    // here (the file is never actually written): validate via onSubmitPlan + broadcast the
+    // plan, then feed the result straight back as the tool result so the conductor re-emits on
+    // a malformed plan or stops on success.
+    const isConductorWrite = toolName === 'Write' || toolName === 'Edit' || toolName === 'MultiEdit' || toolName === 'NotebookEdit'
+    const writePath = toolInput?.file_path || toolInput?.notebook_path || ''
+    if (blockSubagents && isConductorWrite && /(?:^|[/\\])FLOW_PLAN\.json$/i.test(writePath)) {
+      const planText = toolInput?.content ?? toolInput?.new_string ?? ''
+      let res = { ok: false, message: 'Plan submission is not wired for this session.' }
+      try { res = (onSubmitPlan && (await onSubmitPlan(planText))) || res } catch (e) { res = { ok: false, message: `Plan submission failed: ${e?.message || e}` } }
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
+    }
+    if (blockSubagents && (toolName === 'Task' || toolName === 'Agent' || toolName === 'Bash' || isConductorWrite)) {
       const reason = (toolName === 'Bash')
-        ? 'Flow conductors do NOT run Bash — it pops a permission card and stalls the flow. Use the Grep tool (not `grep`/`rg`), the Glob tool (not `find`/`ls`), and Read (not `cat`/`head`) — those run with no prompt. Then DECOMPOSE and call ExitPlanMode once.'
-        : 'Flow conductors do NOT spawn subagents — it stalls the flow on a permission card. Inspect the codebase yourself with Read/Grep/Glob (no prompt). Then DECOMPOSE and call ExitPlanMode once. Do not call Task/Agent again.'
+        ? 'Flow conductors do NOT run Bash — it pops a permission card and stalls the flow. Use the Grep tool (not `grep`/`rg`), the Glob tool (not `find`/`ls`), and Read (not `cat`/`head`) — those run with no prompt. Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json.'
+        : isConductorWrite
+        ? 'Flow conductors do NOT write project or plan-document files. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). To SUBMIT your decomposition, use the Write tool with file_path "FLOW_PLAN.json" and content = your task-graph JSON ({"summary":"…","tasks":[…]}). That single Write IS how you submit — the room ingests it directly. Do not write any other file.'
+        : 'Flow conductors do NOT spawn subagents — it stalls the flow on a permission card. Inspect the codebase yourself with Read/Grep/Glob (no prompt). Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json. Do not call Task/Agent again.'
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }
     }
+    // FL-B4 (review lane) — an adversarial reviewer records its verdict by Writing
+    // FLOW_REVIEW.json; the hook routes it to the verdict logic (revert-on-fail + mark the
+    // review slice done). Same deferred-tool workaround as the builder's FLOW_DONE.
+    if (onReviewVerdict && (toolName === 'Write' || toolName === 'Edit') && /(?:^|[/\\])FLOW_REVIEW(\.[a-zA-Z0-9]+)?$/.test(toolInput?.file_path || '')) {
+      let res = { ok: false, message: 'verdict signal failed' }
+      try { res = (await onReviewVerdict(toolInput?.content ?? toolInput?.new_string ?? '')) || res } catch (e) { res = { ok: false, message: `verdict signal failed: ${e?.message || e}` } }
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
+    }
+    // FL-B1 (lane) — a flow lane signals its slice is done by Writing a file named FLOW_DONE
+    // (the mark_flow_done MCP tool is deferred → ToolSearch → hangs; Write is direct). Route
+    // that Write to the done logic and feed the result back; the file is never written.
+    if (onLaneDone && (toolName === 'Write' || toolName === 'Edit') && /(?:^|[/\\])FLOW_DONE(\.[a-zA-Z0-9]+)?$/.test(toolInput?.file_path || '')) {
+      let res = { ok: false, message: 'done signal failed' }
+      try { res = (await onLaneDone()) || res } catch (e) { res = { ok: false, message: `done signal failed: ${e?.message || e}` } }
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
+    }
     // ThinkPool cross-terminal READ (B2) is read-only + within-room — never
     // prompt, in any mode. It still surfaces as a tool card so the room sees the peek.
     if (toolName === 'mcp__thinkpool__read_terminal') {
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (read-only ThinkPool cross-terminal read).' } }
     }
+    // FL-B1 — the Flow conductor submits its task-graph through this tool (replaces the
+    // deferred/hanging ExitPlanMode). It only broadcasts a plan for HUMAN approval — no FS or
+    // system effect — so auto-allow it (the conductor runs in plan mode, which would otherwise
+    // card it and re-wedge the flow).
+    if (toolName === 'mcp__thinkpool__submit_flow_plan') {
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (Flow plan submission — broadcasts the task-graph for human approval).' } }
+    }
     // ThinkPool cross-ROOM READ (list_sessions / read_session) is read-only. It reaches
     // the account's own other rooms on this machine (Tier 1) and the partner's rooms on
     // the pair bus (Tier 2) — both firewalled server-side (the supervisor only serves

package/flow-conductor.mjs

@@ -24,9 +24,9 @@ export { normalizePlanOutput }
 // moat, partition by file ownership, plan-in-store-not-context, right-size the slice
 // count (3 focused beats 7 scattered), explicit acyclic deps.
 export const FLOW_CONDUCTOR_PROMPT = [
-  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are in PLAN MODE. Your ONLY output action is calling the ExitPlanMode tool EXACTLY ONCE with the task-graph JSON. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — in plan mode those are blocked and will just stall you on a permission prompt. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. If a detail is ambiguous, make a reasonable assumption and note it in the plan summary — do NOT ask. Think, then call ExitPlanMode. That is the whole job.',
+  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. If a detail is ambiguous, make a reasonable assumption and note it in the plan summary — do NOT ask. Think, then call submit_flow_plan. That is the whole job.',
 
-  'DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — in plan mode every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed in plan mode without a prompt) — never delegate it to a spawned agent. Decompose, then ExitPlanMode.',
+  'DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed without a prompt) — never delegate it to a spawned agent. Decompose, then Write FLOW_PLAN.json.',
 
   'THINKPOOL FLOW — you are the CONDUCTOR of an ensemble build. Your job RIGHT NOW (Step 1) is to decompose the user\'s build request into a TASK-GRAPH: a set of RUNNABLE slices with explicit dependencies, then submit that plan for human approval. Do NOT start building and do NOT spawn lanes yet — that happens only after the user approves the plan (Step 2+).',
 
@@ -40,9 +40,9 @@ export const FLOW_CONDUCTOR_PROMPT = [
 
   'RIGHT-SIZE THE SLICE COUNT. Bias to FEW slices that each carry real weight, not many tiny ones. For a small app: 2-3 slices. Concurrent lanes are bounded (a low dispatch ceiling), so a flat fan-out of well-chosen slices beats a sprawling one. Three focused slices outperform seven scattered ones.',
 
-  'SUBMIT VIA ExitPlanMode — when the decomposition is ready, CALL the ExitPlanMode tool, passing your plan as ONE JSON object (a JSON string) in its `plan` argument. The room intercepts that call, validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected and you will be asked to re-emit. Do not also narrate the plan in prose. The exact shape:',
+  'SUBMIT BY WRITING FLOW_PLAN.json — when the decomposition is ready, use the Write tool with file_path "FLOW_PLAN.json" and content set to your plan as ONE JSON object. The room validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected with the reason as the tool result — fix it and Write FLOW_PLAN.json again. Do not also narrate the plan in prose. The exact shape:',
   '{ "summary": "<one line: what we are building>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
-  '`key` values are stable short kebab-case identifiers. `deps` references other tasks\' keys. Put ONLY the JSON in the ExitPlanMode plan argument (no surrounding prose, no markdown fences).',
+  '`key` values are stable short kebab-case identifiers. `deps` references other tasks\' keys. The content of FLOW_PLAN.json must be ONLY the JSON object (no surrounding prose, no markdown fences).',
 
   'PLAN LIVES IN THE STORE, NOT THE CHAT. Your JSON plan is the artifact — it gets persisted to the task-graph (flow_sessions / flow_tasks) and rendered as an approval card. Do not ALSO narrate a long plan in prose. You may add 1-2 sentences framing the decomposition choice (why these slices, what was coupled), nothing more.',
 
@@ -77,7 +77,7 @@ export const FLOW_LANE_PROMPT = [
 
   'DONE MEANS RUNS. You are not done when you\'ve written code — you\'re done when your slice RUNS and meets the `acceptance` criteria (the observable, runnable proof). Verify it yourself before declaring done. State the proof (the command, the output) when you finish.',
 
-  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit); that commit is the revert target if review later rejects it. Then call the `mark_flow_done` tool ONCE: it records your commit as this slice\'s revert target and tells the room the slice is done (which unblocks any slices depending on you). Do not push. Do NOT call mark_flow_done before your slice actually runs + meets acceptance.',
+  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root (any content, e.g. "done"). That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, AND is committed.',
 
   'STAY IN YOUR LANE. Do NOT spawn further lanes (one hop only — the fork-bomb breaker). Do NOT edit other worktrees. If you\'re blocked on a dependency that isn\'t ready, say so + stop — another lane is building it.',
 

package/flow-review.mjs

@@ -26,7 +26,7 @@ export const FLOW_REVIEWER_PROMPT = [
 
   'BE SPECIFIC. Your reasons must name exactly WHAT failed and HOW you found it — the command you ran, the output you got, the acceptance criterion it violated. "Doesn\'t work" is useless. "GET /api/todos returned 500 with `column todos.user_id does not exist`; acceptance required 200 + []" is a usable verdict.',
 
-  'EMIT A VERDICT, NOT A mark_flow_done. You do NOT call mark_flow_done — that is the builder\'s path. You emit a REVIEW VERDICT: a single JSON object `{ "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>" }`. `pass: false` means revert this lane. Put ONLY that JSON object in your verdict (no surrounding prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
+  'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>" }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
 ].join('  ')
 
 // Parse a reviewer's raw verdict. Accepts an object OR a JSON string (optionally

package/flow-task-graph.mjs

@@ -153,14 +153,22 @@ export function normalizePlanOutput (raw) {
   if (!obj || typeof obj !== 'object') throw new Error('plan output is not an object')
   const summary = typeof obj.summary === 'string' && obj.summary.trim() ? obj.summary.trim() : ''
   if (!Array.isArray(obj.tasks) || obj.tasks.length === 0) throw new Error('plan has no tasks')
-  const tasks = obj.tasks.map((t) => makeTask({
-    key: String(t.key),
-    title: String(t.title ?? t.key),
-    scope: String(t.scope ?? ''),
-    acceptance: String(t.acceptance ?? ''),
-    deps: Array.isArray(t.deps) ? t.deps.map(String) : [],
-    sliceType: Object.values(SLICE_TYPE).includes(t.sliceType) ? t.sliceType : SLICE_TYPE.feature,
-  }))
+  const tasks = obj.tasks.map((t) => {
+    // Accept `id` as an alias for `key` and `description` for `scope` — conductors emit
+    // either naming. A task with NO key is rejected (was silently String(undefined) →
+    // task_key "undefined", which broke worktree/dispatch); throwing makes it re-emit.
+    const key = t.key ?? t.id
+    if (key == null || !String(key).trim()) throw new Error('a task is missing its "key"')
+    const sliceType = t.sliceType ?? t.slice_type
+    return makeTask({
+      key: String(key),
+      title: String(t.title ?? key),
+      scope: String(t.scope ?? t.description ?? ''),
+      acceptance: String(t.acceptance ?? ''),
+      deps: Array.isArray(t.deps) ? t.deps.map(String) : [],
+      sliceType: Object.values(SLICE_TYPE).includes(sliceType) ? sliceType : SLICE_TYPE.feature,
+    })
+  })
   validateDag(tasks)
   return { summary, tasks }
 }

package/flow-worktree.mjs

@@ -25,14 +25,27 @@ export function worktreeSpec ({ flowId, taskKey, root = ROOT }) {
   return { branch, dir, wtRoot }
 }
 
-// Create a worktree for a task-lane off `base` (default origin/main). Idempotent: if
-// the dir already holds a worktree, reuse it. Returns { dir, branch, created }.
-export function createFlowWorktree ({ flowId, taskKey, base = 'origin/main', root = ROOT, git = runGit }) {
+// Create a worktree for a task-lane off `base`. Idempotent: if the dir already holds a
+// worktree, reuse it. Returns { dir, branch, created }.
+//
+// FL-M6/dispatch — the base must RESOLVE in this repo. The old hard default `origin/main`
+// threw on any repo without an `origin` remote or a non-`main` default branch (e.g. a
+// fresh `git init` checkout), and the dispatch loop swallowed the throw → NO lane ever
+// spawned. Resolve the first ref that actually exists: caller's base → origin/main →
+// origin/HEAD → main → master → HEAD.
+export function createFlowWorktree ({ flowId, taskKey, base = null, root = ROOT, git = runGit }) {
   const { branch, dir, wtRoot } = worktreeSpec({ flowId, taskKey, root })
   if (fs.existsSync(path.join(dir, '.git'))) return { dir, branch, created: false }
   fs.mkdirSync(wtRoot, { recursive: true })
+  let ref = base
+  if (!ref) {
+    for (const cand of ['origin/main', 'origin/HEAD', 'main', 'master', 'HEAD']) {
+      try { git(['rev-parse', '--verify', '--quiet', cand], root); ref = cand; break } catch { /* try next candidate */ }
+    }
+    ref = ref || 'HEAD'
+  }
   try {
-    git(['worktree', 'add', '-b', branch, dir, base], root)
+    git(['worktree', 'add', '-b', branch, dir, ref], root)
   } catch {
     // Branch already exists (a prior dispatch of this task) — check it out instead.
     git(['worktree', 'add', dir, branch], root)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.107",
+  "version": "0.7.108",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {