thinkpool-pair 0.7.112 → 0.7.114

package/bridge.mjs

@@ -39,8 +39,12 @@ import { createClient } from '@supabase/supabase-js'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
-import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv } from './flow-conductor.mjs'
+import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { normalizePlanOutput } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph
+// S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
+// the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
+// which enforces the CEILING). Consume the store — the internals live in flow-context-store.mjs.
+import { writeLaneArtifact, digestSlice, appendDigest, resumeLane } from './flow-context-store.mjs'
 import { createFlowWorktree, worktreeSpec } from './flow-worktree.mjs'
 import { startPreview, stopAllPreviews, previews } from './flow-preview.mjs'
 // FL-M9 — per-lane preview servers leak (one per done lane, never stopped until shutdown).
@@ -53,8 +57,24 @@ function stopFlowPreviews (flowId, laneId = null) {
   }
 }
 import { FLOW_REVIEWER_PROMPT, revertLane, parseReviewVerdict } from './flow-review.mjs'
+import { reviewGateDecision } from './flow-review-gate.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
+// S4 slice 2 — clean re-dispatch. When a lane is killed mid-tool-call (budget/review/restart)
+// and re-dispatched, heal its transcript (Heal-3 consumer, no dangling tool_use → no 400),
+// resume the healed session, and keep its revert target. flowRedispatch (flowId::taskKey →
+// { resumeSessionId, revertTarget }) bridges the flow-revert kill to the next flow-dispatch
+// wave. Re-dispatch opens NO per-lane realtime channel — it reuses the room-wide tpflow
+// broadcast, so no duplicate-subscribe collision is possible (H41; see flow-redispatch.mjs).
+// Spec: docs/specs/2026-06-30-flow-build-s4-clean-redispatch.md
+import { prepareRedispatch, redispatchKey } from './flow-redispatch.mjs'
+import { sanitizeSession } from './transcript-sanitize.mjs'
+// ACCEPTED LIMITATION — this registry is in-memory only. A bridge restart in the window between
+// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task
+// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on
+// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it
+// just loses the resume/revert-target carry. Not worth persisting for that narrow window.
+const flowRedispatch = new Map()
 // FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's
 // completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
@@ -1117,7 +1137,7 @@ function restoredTurnOpen(log) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots }) {
   if (sessions.has(id)) return
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
@@ -1129,6 +1149,10 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
   entry.seq = makeSeqCounter(maxSeq(entry.log))
   entry.rolePrompt = rolePrompt || null   // FL-M6 — persisted so a bridge restart restores the flow role prompt
+  // S5 (slice 1b) — a REVIEW lane's write-block scope: the worktree root(s) of the slice(s)
+  // it reviews (its deps). Persisted so a bridge restart re-arms the structural gate. Empty/
+  // absent on builder lanes → reviewGate stays null → builder toolset UNCHANGED.
+  entry.reviewSliceRoots = Array.isArray(reviewSliceRoots) ? reviewSliceRoots.filter(Boolean) : []
   // FL-B1 (lane side) — record a flow lane's slice as done. Shared by the mark_flow_done
   // MCP tool AND the FLOW_DONE sentinel-Write intercept: like the conductor's submit, the
   // MCP tool is DEFERRED (needs ToolSearch, which hangs), so lanes signal done by Writing a
@@ -1140,6 +1164,33 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
     try { commitSha = execFileSync('git', ['-C', entry.cwd || process.cwd(), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* no commits yet */ }
     let previewUrl = null
     try { const pv = await startPreview({ dir: entry.cwd || process.cwd(), id: `lane:${entry.flowSessionId}:${id}` }); previewUrl = pv.url } catch { /* preview best-effort */ }
+    // S1 (context-offload) — digest THIS closed slice into the durable store so the next
+    // dispatch wave reads a bounded summary + pointers for it (never the full transcript).
+    // Best-effort + fully guarded: a store failure must never block the done signal.
+    try {
+      const worktreeDir = entry.cwd || process.cwd()
+      // Every closed slice must carry ≥1 pointer (appendDigest's zero-pointer guard), so
+      // record a synthetic done-marker artifact in the lane's OWN worktree (content-addressed,
+      // idempotent — a re-dispatched lane re-writing it is a no-op). Then fold in any real
+      // artifacts the lane wrote under .flow/artifacts/ so a resume/peer can find them.
+      const marker = writeLaneArtifact(
+        entry.flowSessionId, entry.flowTaskKey, '_slice.done',
+        JSON.stringify({ taskKey: entry.flowTaskKey, commitSha: commitSha || null, previewUrl: previewUrl || null }),
+        { worktreeDir },
+      )
+      const laneArtifacts = resumeLane(entry.flowSessionId, { worktreeDir })
+      const artifacts = [
+        { taskKey: entry.flowTaskKey, name: '_slice.done', path: marker.path, sha: marker.sha },
+        ...laneArtifacts.map((a) => ({ taskKey: a.taskKey, name: a.name, path: a.path, sha: a.sha })),
+      ]
+      const digest = digestSlice(
+        { key: entry.flowTaskKey, title: termNames[id] || entry.flowTaskKey },
+        { acceptanceProof: commitSha ? `committed ${commitSha.slice(0, 8)}` : 'slice done', artifacts },
+      )
+      appendDigest(entry.flowSessionId, digest, { baseDir: process.cwd() })   // idempotent per (flowId, taskKey)
+    } catch (e) {
+      process.stderr.write(`\n  ${A.dim}◆ flow digest skip ${entry.flowTaskKey} — ${e?.message || e}${A.rst}\n`)
+    }
     bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl }, flowChannel)
     process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
     entry.flowDone = true   // FL-B3 — retire immediately so it drops from the ≤8 lane cap
@@ -1204,7 +1255,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // subagent-block; without cwd it runs outside its worktree; without rolePrompt it loses its
   // Flow role. blockSubagents / onLaneDone / onReviewVerdict / onSubmitPlan all derive from
   // these, so restoring them restores the whole behavior.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [] })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -1470,8 +1521,24 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
       ),
     ],
   })
+  // S5 (slice 1b) — the review-lane write-block, wired into the live PreToolUse path.
+  // Null for builder lanes (no reviewSliceRoots) → their toolset is UNCHANGED. For a review
+  // lane, deny a mutating tool call if it targets ANY reviewed slice's worktree, allowing the
+  // reviewer's own FLOW_REVIEW.json (verdictFile) + all reads + run/test Bash. reviewGateDecision
+  // takes ONE sliceRoot, so we fold over every reviewed slice: deny on the first that denies.
+  const reviewVerdictFile = path.join(cwd || process.cwd(), 'FLOW_REVIEW.json')
+  const reviewGate = (entry.reviewSliceRoots.length)
+    ? ({ toolName, input }) => {
+        for (const sliceRoot of entry.reviewSliceRoots) {
+          const d = reviewGateDecision({ toolName, input, sliceRoot, verdictFile: reviewVerdictFile })
+          if (!d.allow) return d
+        }
+        return { allow: true, reason: 'no reviewed slice targeted' }
+      }
+    : null
   entry.session = startClaudeSession({
     cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
+    reviewGate,
     // A Flow CONDUCTOR (flowSessionId set, no flowTaskKey) must DECOMPOSE, not explore via
     // a fan-out of Task/Explore subagents, and must not build. Hard-block Task/Bash/Write for
     // conductors so it reads with Read/Grep/Glob and submits via the FLOW_PLAN.json sentinel.
@@ -2018,9 +2085,11 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt })
+            openStructured({ id: rec.id, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots })
             const re = sessions.get(rec.id)
             if (re && rec.flowReviewTarget) re.flowReviewTarget = rec.flowReviewTarget
+            // S4 — a resumed re-dispatch lane keeps its surviving revert target across a bridge restart.
+            if (re && rec.revertTarget) re.revertTarget = rec.revertTarget
             // FL-M6 — a flow LANE whose turn had already ENDED before the restart finished its
             // slice, but its done-signal was lost while the bridge was down (resume won't re-run
             // an ended turn, so it would sit idle → the flow stalls forever). Reconcile: re-record
@@ -2131,16 +2200,53 @@ flowChannel
         const laneId = randomUUID()
         termNames[laneId] = `Flow · ${t.task_key}`
         saveNames(room, termNames)
+        // S4 slice 2 — clean re-dispatch. If this task was force-killed mid-tool-call on an
+        // earlier wave, flow-revert left a pending record (its transcript already Heal-3'd, its
+        // resume sessionId + revert target captured). CONSUME it here: resume the healed session
+        // (no dangling tool_use → no 400) instead of a cold start, and carry the revert target
+        // forward (revertLane deleted the branch, so this is the only survivor). Delete the record
+        // on consume so a re-broadcast can't double-resume (idempotent).
+        // H41: the resumed lane opens no realtime channel of its own — it reuses the room-wide
+        // tpflow broadcast channel (opened once at startup), so no duplicate-subscribe collision
+        // is possible. There is no per-lane topic to compute or stamp.
+        const rk = redispatchKey(payload.flowId, t.task_key)
+        const redispatch = flowRedispatch.get(rk) || null
+        if (redispatch) flowRedispatch.delete(rk)
+        // S5 (slice 1b) — a REVIEW lane reviews the slices it DEPENDS ON. Its write-block scope
+        // is those slices' worktree roots; the lane runs in its OWN worktree (dir above), so its
+        // reads/runs/tests + verdict Write are unaffected — only writes INTO a reviewed slice are
+        // denied. Builder lanes get [] → reviewGate stays null → their toolset is UNCHANGED.
+        const reviewSliceRoots = isReview
+          ? (t.deps || []).map((dep) => worktreeSpec({ flowId: payload.flowId, taskKey: dep }).dir)
+          : []
         // Lanes build autonomously in their own worktree — bypassPermissions so they
         // don't stall on a card for every write/bash (matches the user's expectation that
         // a Flow summoned from a bypass terminal runs hands-off).
-        openStructured({ id: laneId, cwd: dir, mode: 'bypassPermissions', rolePrompt: isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}` })
+        // S2 — build the lane's base prompt from the static role prompt PLUS the skill
+        // MANIFEST (metadata only, never bodies; absolute-ceiling capped). buildLanePrompt
+        // reads the skills tree from env (TP_FLOW_SKILLS_DIR / _CUSTOM_DIR) — no tree →
+        // empty manifest → the base prompt is returned unchanged. A body only ever enters
+        // a lane later, on demand, via activateLaneSkill — never the base prompt here.
+        // S4 — resume: on a re-dispatch, replay the killed lane's HEALED transcript (Heal-3'd,
+        // no dangling tool_use → no 400) instead of a cold start; undefined for a fresh lane.
+        const laneBase = isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT
+        const laneRolePrompt = buildLanePrompt({ base: laneBase })
+        openStructured({ id: laneId, cwd: dir, mode: 'bypassPermissions', rolePrompt: laneRolePrompt, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}`, resume: redispatch?.resumeSessionId || undefined, reviewSliceRoots })
         const le = sessions.get(laneId)
         if (le) {
+          // S4 — stamp the surviving revert target on the resumed lane so a later reviewer still
+          // knows what to roll back to (revertLane deleted the branch, so this carry is the only
+          // survivor). No per-lane topic: the lane rides the room-wide tpflow broadcast (H41).
+          if (redispatch) {
+            le.revertTarget = redispatch.revertTarget ?? null
+          }
           // FL-B4 — a review slice reviews the slices it DEPENDS ON; remember the primary
           // target so a FAIL verdict knows what to revert even if the model omits taskKey.
           if (isReview) le.flowReviewTarget = (t.deps && t.deps[0]) || null
-          if (le.session) {
+          // A resumed lane already carries its work in the healed transcript — re-sending the
+          // full build spec would restart it from scratch, discarding the resume. Only seed the
+          // slice spec on a FRESH lane; a resumed lane picks up where it was killed.
+          if (le.session && !redispatch) {
             const spec = isReview
               ? `[Flow REVIEW lane — slice "${t.task_key}" of flow ${String(payload.flowId).slice(0, 8)}]\n` +
                 `You are ADVERSARIALLY reviewing the slice(s): ${(t.deps || []).join(', ') || t.title}\n` +
@@ -2156,6 +2262,11 @@ flowChannel
                 `SCOPE (files you OWN — edit ONLY these): ${t.scope || '(none stated)'}\n` +
                 `ACCEPTANCE (done = this runs + proves it): ${t.acceptance || '(meet the title)'}\n` +
                 (t.deps && t.deps.length ? `DEPENDS ON (already built): ${t.deps.join(', ')}\n` : '') +
+                // S1 (context-offload) — inject the BOUNDED cross-wave context (loadDigest
+                // enforces CEILING) instead of accumulating full lane transcripts. Filter to
+                // this slice's deps so a lane sees its dependencies' closed digests first.
+                ((crossWave) => crossWave ? `${crossWave}\n` : '')(
+                  assembleCrossWaveContext(payload.flowId, { baseDir: process.cwd(), deps: t.deps }).text) +
                 `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
                 `Build your slice. Own only your files. Done = it runs + meets acceptance. Commit when done.`
             try { le.session.sendTurn(spec) } catch { /* session still starting */ }
@@ -2217,6 +2328,25 @@ flowChannel
       let killed = false
       for (const [sid, e] of sessions) {
         if (e.flowSessionId === payload.flowId && e.flowTaskKey === payload.taskKey && !e.flowDone) {
+          // S4 slice 2 — prepare a CLEAN re-dispatch BEFORE we kill the lane + remove its
+          // worktree. prepareRedispatch heals the transcript (Heal-3 consumer — a dangling
+          // tool_use from a mid-tool-call kill gets a synthetic tool_result so a resume can't
+          // 400) and captures the resume sessionId + the revert target (which revertLane's
+          // branch delete would otherwise destroy). We record it under flowId::taskKey so the
+          // next flow-dispatch wave resumes the healed session. Idempotent: healing an
+          // already-clean transcript is a no-op. No per-lane topic is captured — the resumed
+          // lane reuses the room-wide tpflow broadcast, so there is no H41 collision to guard.
+          try {
+            const prep = prepareRedispatch({
+              lane: { cwd: e.cwd, session: e.session, commitSha: e.commitSha, revertTarget: payload.commitSha ?? e.commitSha ?? null },
+              sanitize: sanitizeSession,
+            })
+            flowRedispatch.set(redispatchKey(payload.flowId, payload.taskKey), {
+              resumeSessionId: prep.resumeSessionId,
+              revertTarget: prep.revertTarget,
+            })
+            if (prep.healed) process.stderr.write(`\n  ${A.dim}◆ flow re-dispatch heal — ${payload.taskKey}: ${prep.healed} dangling tool block(s) healed before resume.${A.rst}\n`)
+          } catch (err) { process.stderr.write(`\n  ${A.yel}◆ flow re-dispatch prep failed (${payload.taskKey}): ${err?.message || err} — will re-dispatch fresh.${A.rst}\n`) }
           e.flowDone = true
           try { endStructured(sid) } catch { /* already gone */ }
           stopFlowPreviews(payload.flowId, sid)   // FL-M9 — drop the reverted lane's preview

package/claude-session.mjs

@@ -15,6 +15,7 @@
 import { randomUUID } from 'node:crypto'
 import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
+import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -120,7 +121,25 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  */
 const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null }) {
+// Per-turn salience reminder. The full ThinkPool Code ruleset lives in
+// `appendSystemPrompt` (baked once at session start), but on a long session — heavy
+// tool output, and especially after auto-compaction — the model's attention drifts
+// off a system prompt that sits behind the large host CLAUDE.md. The classic tell:
+// the agent hands the room a host-local path (`open …`, "it's in ~/claude-shots/")
+// or narrates instead of showing, forgetting it's driven from a phone. So we re-state
+// the highest-drift rules as a compact <system-reminder> appended to EVERY user turn,
+// adjacent to where the model's attention actually is — the same trick the host
+// harness uses to keep CLAUDE.md alive. ~120 tokens/turn; changes nothing but salience.
+const TP_ROOM_REMINDER = [
+  'You are Claude in a ThinkPool Code room, driven live from a phone or browser — NOT a local terminal. Keep using the room\'s features.',
+  'ARTIFACTS: never hand the room a local path, a file:// URL, a localhost address, an `open …`/Preview reference, or "it\'s in ~/claude-shots/" — the room cannot see the host. Surface every image by reading the PNG into your turn so it renders inline; for HTML use the $TP_MOCKUP_OUTBOX render helper (inline desktop+mobile card) and/or publish to a GitHub Pages URL and post that link.',
+  'SHOW, don\'t narrate: a picture of the result beats a wall of text on a phone — err toward more screenshots.',
+  'ENSEMBLE: fan parallel work out with spawn_terminal (your own fresh lanes), coordinate via read_terminal / list_sessions; never hijack a busy sibling.',
+  'FLOW / PLANS: write plans as normal chat messages as you form them — the room does not surface plan files or ExitPlanMode text.',
+  'Verify before claiming done — show runtime evidence you produced, not "should work, go test it".',
+].join(' ')
+
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null }) {
   const ac = new AbortController()
   let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
@@ -297,6 +316,19 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       try { res = (await onLaneDone()) || res } catch (e) { res = { ok: false, message: `done signal failed: ${e?.message || e}` } }
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
     }
+    // S5 (slice 1b) — REVIEW-LANE WRITE-BLOCK. A review lane is ADVERSARIAL: it reads +
+    // runs/tests the slice(s) it reviews and emits a verdict, but it must be STRUCTURALLY
+    // unable to Edit/Write/commit the code under review (a reviewer that edits is a second
+    // builder → a false PASS). `reviewGate` is set ONLY on review lanes (bridge.mjs wires it
+    // to reviewGateDecision over the reviewed slices' worktree roots + the lane's own
+    // FLOW_REVIEW.json). It runs AFTER the FLOW_REVIEW.json verdict intercept above, so the
+    // reviewer can still emit its verdict, and BEFORE the normal auto-allow path, so the deny
+    // is structural even in the lane's bypassPermissions mode. Read + run/test stay allowed
+    // (the gate allows read-only tools + non-write Bash — the reviewer's whole method). The
+    // real mitigation for Bash-quoting bypasses is worktree isolation (the review lane runs
+    // in its OWN worktree, not the slice's) — guaranteed by the spawn path.
+    const reviewDeny = reviewGatePreToolDecision({ reviewGate, toolName, toolInput })
+    if (reviewDeny) return reviewDeny
     // ThinkPool cross-terminal READ (B2) is read-only + within-room — never
     // prompt, in any mode. It still surfaces as a tool card so the room sees the peek.
     if (toolName === 'mcp__thinkpool__read_terminal') {
@@ -722,7 +754,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   runQuery()
 
   return {
-    sendTurn(text) { if (!closed) { turnActive = true; sawSuggestion = false; if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },
+    sendTurn(text) { if (!closed) { turnActive = true; sawSuggestion = false; if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; input.push([{ type: 'text', text: String(text) }, { type: 'text', text: `<system-reminder>\n${TP_ROOM_REMINDER}\n</system-reminder>` }]) } },
     // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
     // streaming control request (drives plan-mode behaviour SDK-side); the local
     // `mode` drives our PreToolUse auto-approve policy. Echo so the room syncs.

package/flow-conductor.mjs

@@ -14,6 +14,20 @@
 // it drifts from the canonical src module). One logical source, two reachable copies.
 import { FLOW_MODE, FLOW_STATUS, normalizePlanOutput } from './flow-task-graph.mjs'
 
+// S1 (context-offload) — read the conductor's BOUNDED cross-wave context from the durable
+// digest store instead of accumulating full lane transcripts. loadDigest already enforces
+// the hard CEILING (summary + pointers per closed slice, truncated before it grows), so
+// the assembled cross-wave context can never overflow the conductor's head. Consume the
+// store — do NOT re-implement it (canonical src/lib/flow/contextStore.js, mirror here).
+import { loadDigest } from './flow-context-store.mjs'
+// Progressive skill registry (S2). Bridge-local mirror of src/lib/flow/skillRegistry.js
+// (same tarball-boundary reason as flow-task-graph). `manifest()` yields compact
+// METADATA ONLY (name/description/whenToUse — never a SKILL.md body); `loadBody(name)`
+// returns a single body on demand. This wiring injects the manifest into a lane's base
+// prompt and loads a body only when the lane activates that skill. DO NOT edit the
+// registry here — consume it.
+import { manifest as skillManifest, loadBody as skillLoadBody } from './flow-skill-registry.mjs'
+
 // Re-export the shared plan normalizer so bridge callers import Flow pieces from one
 // place. The implementation lives in the shared model (src/lib/flow/taskGraph.js).
 export { normalizePlanOutput }
@@ -93,3 +107,135 @@ export function buildLaneEnv ({ flowSessionId, taskKey, laneId }) {
   }
 }
 
+// ── assembleCrossWaveContext ────────────────────────────────────────────────
+// S1 (context-offload) — the conductor's bounded cross-wave context for a dispatch
+// wave. Reads the durable digest store (loadDigest, which enforces the hard CEILING)
+// and renders the closed-slice digests as a compact block a lane can be seeded with:
+// a one-line summary + artifact pointers per closed slice, NOT full transcripts.
+//
+// Before S1, each newly-dispatched lane was told only the NAMES of the slices it
+// depends on (`DEPENDS ON (already built): a, b`) with no content, and the conductor
+// itself would (across many waves) accumulate full lane output in its chat context —
+// the overflow this slice fixes. Now the ordered digest is the ONLY cross-wave carrier,
+// and its size is capped by loadDigest's CEILING guarantee (JSON.stringify(digest)
+// length ≤ CEILING), so the assembled context is bounded across ≥2 waves by construction.
+//
+// Returns { text, digest } — `text` is the ready-to-embed block (empty string when the
+// flow has no closed slices yet), `digest` is the raw bounded array (for tests/assertions).
+// Pure over an injected fs so it's unit-testable against a temp digest store.
+export function assembleCrossWaveContext (flowId, { baseDir, deps = null, fs } = {}) {
+  if (!flowId || !baseDir) return { text: '', digest: [] }
+  let digest
+  try {
+    digest = loadDigest(flowId, { baseDir, ...(fs ? { fs } : {}) })
+  } catch {
+    // A malformed/absent digest store must never wedge dispatch — degrade to no context.
+    return { text: '', digest: [] }
+  }
+  // If the caller named the current slice's deps, prefer them (so a lane sees its
+  // dependencies first); otherwise show every closed slice. loadDigest already bounds
+  // the whole set under CEILING, so filtering only ever shrinks the block.
+  const wanted = Array.isArray(deps) && deps.length ? new Set(deps) : null
+  const shown = wanted ? digest.filter((d) => wanted.has(d.taskKey)) : digest
+  if (!shown.length) return { text: '', digest }
+  const lines = shown.map((d) => {
+    const ptrs = (d.pointers || [])
+      .map((p) => `${p.name}@${String(p.sha).slice(0, 8)}`)
+      .join(', ')
+    return `  - ${d.summary}${ptrs ? ` [artifacts: ${ptrs}]` : ''}`
+  })
+  const text = `CLOSED SLICES (bounded digest — summary + artifact pointers, not full output):\n${lines.join('\n')}`
+  return { text, digest }
+}
+
+// ── Progressive skill loading (S2) ───────────────────────────────────────────
+// A lane boots knowing only the skill MANIFEST (a tiny menu: name + one-line
+// description + whenToUse) — never the bodies. It pulls a full SKILL.md body in only
+// when it actually activates that skill. This is the DeerFlow steal: metadata in the
+// base prompt, body on demand. The token win (manifest ≪ Σ bodies) is the whole point.
+
+// Resolve the skill directories a Flow lane draws from. publicDir = built-in
+// product-facing skills; customDir = optional user/room-level overrides. Both come from
+// env so the bridge operator can point them at a real skills tree; absent → undefined,
+// which the registry treats as "no skills" (empty manifest, loadBody clean-misses). This
+// is deliberately NOT the .claude/skills dev-side harness — that stays out of scope.
+export function flowSkillDirs (env = process.env) {
+  return {
+    publicDir: env.TP_FLOW_SKILLS_DIR || undefined,
+    customDir: env.TP_FLOW_SKILLS_CUSTOM_DIR || undefined,
+  }
+}
+
+// ── Absolute manifest ceiling (S2 blocker 2) ─────────────────────────────────
+// The token-win invariant (manifest ≪ Σ bodies) is only a RELATIVE ratio — it does
+// nothing to bound the ABSOLUTE size of the manifest block that lands in EVERY lane's
+// base prompt. Custom skills are user/room-uploadable (H1/S6), so a single skill with a
+// pathological description/whenToUse (a 200KB blob) would balloon the base prompt
+// unbounded. These caps give the ceiling teeth: each field is truncated per-entry, and
+// the whole rendered block is hard-capped, with a visible marker where content is cut.
+export const MANIFEST_MAX_CHARS = 4096        // absolute ceiling on the rendered block
+export const MANIFEST_FIELD_MAX = 240         // per-field (description / whenToUse) cap
+const TRUNC_MARK = '…[truncated]'
+
+// Truncate a single metadata field to MANIFEST_FIELD_MAX chars with a visible marker.
+function clampField (s) {
+  const str = typeof s === 'string' ? s : ''
+  if (str.length <= MANIFEST_FIELD_MAX) return str
+  return str.slice(0, MANIFEST_FIELD_MAX - TRUNC_MARK.length) + TRUNC_MARK
+}
+
+// Render the compact manifest as a prompt block — METADATA ONLY. Each entry is one line:
+// the skill name, its one-line description, and (if present) whenToUse. There is NO code
+// path here that can emit a SKILL.md body: this function only ever sees manifest entries
+// (which carry no body), so a body cannot leak into the base prompt through it.
+// Returns '' for an empty manifest so the base prompt is unchanged when no skills exist.
+//
+// ABSOLUTE CEILING: every field is clamped to MANIFEST_FIELD_MAX, and the assembled block
+// is hard-capped at MANIFEST_MAX_CHARS — entries that would push past the ceiling are
+// dropped and a visible marker names how many were omitted. A pathological huge-metadata
+// skill therefore cannot grow the base prompt beyond MANIFEST_MAX_CHARS (+ a small header).
+export function renderSkillManifestBlock (entries) {
+  if (!Array.isArray(entries) || entries.length === 0) return ''
+  const header = [
+    'AVAILABLE SKILLS (menu only — names + descriptions, NOT the instructions). You boot',
+    'knowing this menu; you do NOT carry any skill\'s full instructions. When a task matches',
+    'a skill (or you invoke it slash-style), the room loads that ONE skill\'s full body for',
+    'you on demand — never all of them, never up front. The menu:',
+  ].join('\n')
+
+  const rendered = []
+  let used = header.length
+  let dropped = 0
+  for (const e of entries) {
+    const when = e.whenToUse ? ` — use when: ${clampField(e.whenToUse)}` : ''
+    const line = `  • ${e.name}: ${clampField(e.description)}${when}`
+    // +1 for the '\n' joining this line to what precedes it.
+    if (used + 1 + line.length > MANIFEST_MAX_CHARS) { dropped++; continue }
+    rendered.push(line)
+    used += 1 + line.length
+  }
+  if (dropped > 0) {
+    rendered.push(`  …[${dropped} more skill(s) omitted — manifest ceiling reached]`)
+  }
+  return [header, ...rendered].join('\n')
+}
+
+// Build a lane's base prompt: the static FLOW_LANE_PROMPT (or FLOW_REVIEWER-style base
+// passed in) PLUS the skill MANIFEST block — metadata only, never bodies. This is what a
+// lane session boots with. The token win vs. inlining bodies is asserted in tests.
+// dirs/fs are injectable for unit-testing against temp fixtures; default to env dirs.
+export function buildLanePrompt ({ base = FLOW_LANE_PROMPT, publicDir, customDir, fs } = {}) {
+  const dirs = publicDir === undefined && customDir === undefined ? flowSkillDirs() : { publicDir, customDir }
+  const entries = skillManifest({ ...dirs, ...(fs ? { fs } : {}) })
+  const block = renderSkillManifestBlock(entries)
+  return block ? `${base}\n\n${block}` : base
+}
+
+// Load exactly ONE skill's full body, on demand, when a lane activates it. Returns the
+// SKILL.md body string, or null on a clean miss (unknown / disabled skill — never a
+// throw). Callers inject this into the lane mid-task; it is never part of the base prompt.
+export function activateLaneSkill (name, { publicDir, customDir, fs } = {}) {
+  const dirs = publicDir === undefined && customDir === undefined ? flowSkillDirs() : { publicDir, customDir }
+  return skillLoadBody(name, { ...dirs, ...(fs ? { fs } : {}) })
+}
+

package/flow-context-store.mjs

@@ -0,0 +1,387 @@
+// Thinkpool Flow — durable per-lane context-offload store.
+//
+// Three design patterns fused (docs/specs/2026-06-30-flow-build-s1-context-offload.md):
+// • DBOS-style durable steps — each artifact write is idempotent + content-addressed by
+//   (taskKey, name) + sha256; a re-dispatched lane resumes instead of duplicating work.
+// • Headroom-style digest ceiling — the conductor reads one-line summary + pointers per
+//   closed slice, capped at CEILING bytes; never an unbounded transcript.
+// • Statewright-style structural containment — a hard path guard rejects any taskKey or
+//   name that would escape <worktreeDir>/.flow/artifacts/; structural, not an instruction.
+//   Reuses the approach from bridge/flow-assembly.mjs (inlineSingleHtml resolve) and
+//   bridge/flow-preview.mjs (resolveUnderRoot) — two existing containment sites.
+//
+// Pure module — canonical at src/lib/flow/contextStore.js, mirrored byte-identically
+// at bridge/flow-context-store.mjs (same reason as taskGraph / flowBudget: the bridge
+// ships as thinkpool-pair npm package and can't import across the bridge↔src boundary
+// at publish time). Sync: bridge/flow-context-store.sync.test.js.
+//
+// Node built-ins only (node:crypto, node:fs, node:path) — no new deps.
+// All fs calls are injectable ({fs} opts) so logic is unit-testable against temp dirs.
+
+import { createHash } from 'node:crypto'
+import nodeFs from 'node:fs'
+import path from 'node:path'
+
+// Hard ceiling for the conductor's assembled digest context (bytes of serialized JSON).
+// When accumulated size would exceed CEILING, each over-budget entry is truncated to
+// { taskKey, summary, pointers } — never drops a pointer, never silently grows past this.
+export const CEILING = 32 * 1024  // 32 KB
+
+// ── containment ──────────────────────────────────────────────────────────────
+// Resolve `segments` under `base`. Returns the absolute path iff it stays strictly
+// inside `base`, otherwise null. Same approach as flow-assembly.mjs (inlineSingleHtml
+// resolve) and flow-preview.mjs (resolveUnderRoot) — reused, not re-invented.
+//
+// STRUCTURAL (not ENOENT-based): every rejection is a pure string-level check that
+// fires before any filesystem call. Do not add fs.exists/stat calls here.
+function containedPath (base, ...segments) {
+  for (const seg of segments) {
+    if (!seg || typeof seg !== 'string') return null
+    if (path.isAbsolute(seg)) return null
+    if (seg.includes('\0')) return null
+    // STRUCTURAL: reject any segment that contains a path separator character.
+    // Prevents 'real/link/escape' and 'a/../../evil' from normalising into a valid
+    // sub-path without escaping the per-entry rel-check below. This is the key
+    // structural gate — no ENOENT dependency.
+    if (seg.includes('/') || seg.includes('\\')) return null
+    // STRUCTURAL: reject bare '.' and '..' as full segments (belt-and-suspenders;
+    // the rel.startsWith('..') check below would also catch '..' after path.join).
+    if (seg === '..' || seg === '.') return null
+    // Reject zero-width / Unicode format chars (ZWSP U+200B, ZWNJ U+200C, etc.):
+    // trim() does NOT strip them; require at least one real identifier char.
+    if (!/[A-Za-z0-9_.-]/.test(seg)) return null
+  }
+  const joined = path.join(...segments)
+  const abs = path.resolve(base, joined)
+  const rel = path.relative(base, abs)
+  // rel === '' means abs === base (the directory itself) — not a valid write target
+  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) return null
+  return abs
+}
+
+// ── safeSegmentId ─────────────────────────────────────────────────────────────
+// Validate that `val` is a safe single path-segment identifier (used for flowId).
+// Rejects: null/non-string, empty, whitespace-only, null bytes, absolute paths,
+// path separators (/ or \), bare '.' or '..'. Prevents flowId from escaping the
+// digest base directory when interpolated into path.join calls.
+function safeSegmentId (val) {
+  if (!val || typeof val !== 'string') return false
+  if (!val.trim()) return false
+  if (val.includes('\0')) return false
+  if (path.isAbsolute(val)) return false
+  if (val.includes('/') || val.includes('\\')) return false
+  if (val === '..' || val === '.') return false
+  // Reject zero-width / Unicode format chars (ZWSP U+200B, ZWNJ U+200C, etc.):
+  // trim() does NOT strip them; require at least one real identifier char.
+  if (!/[A-Za-z0-9_.-]/.test(val)) return false
+  return true
+}
+
+// ── assertLeafContained ────────────────────────────────────────────────────────
+// Leaf-level (final-component) containment for a WRITE target — the artifact file or
+// the digest .jsonl. The dir-level realpathSync guards in the callers contain the
+// PARENT directory, but fs.writeFileSync / fs.appendFileSync follow a symlink planted
+// AT the leaf itself, so a symlink at <dest> would let the write escape an
+// already-contained directory. realpathSync(dir) never inspects the leaf's own type —
+// only lstatSync does, because it does NOT follow the final component. It reveals the
+// leaf as a symlink regardless of what the link points at, which is why one check
+// covers all three escape flavors:
+//   • ENOENT   → no leaf yet; the write will create a regular file → safe, return.
+//   • symlink  → reject (absolute-, relative-, AND chained-target symlinks alike —
+//                lstat stops at the first hop, so a symlink→symlink→victim chain and a
+//                relative "../../.." target are both caught here).
+//   • regular  → realpathSync must still resolve strictly under `canonicalDir`.
+// Must be called BEFORE any idempotency readFileSync of the leaf (which would itself
+// follow a leaf symlink). This is the leaf half of containment; the dir half stays in
+// the callers (writeLaneArtifact / appendDigest). (B5 breaks 1-3.)
+function assertLeafContained (fs, leafPath, canonicalDir) {
+  let st
+  try {
+    st = fs.lstatSync(leafPath)
+  } catch (e) {
+    if (e && e.code === 'ENOENT') return  // leaf absent — write creates a regular file
+    throw e
+  }
+  if (st.isSymbolicLink()) {
+    throw new Error(`symlink escape: refusing to write through a symlink at leaf "${leafPath}"`)
+  }
+  // Non-symlink leaf: re-verify its real path is still strictly inside the canonical dir.
+  const real = fs.realpathSync(leafPath)
+  if (!real.startsWith(canonicalDir + path.sep)) {
+    throw new Error(`symlink escape: resolved leaf "${real}" escapes canonical dir "${canonicalDir}"`)
+  }
+}
+
+// ── writeLaneArtifact ─────────────────────────────────────────────────────────
+// Write `content` (string | Buffer) under <worktreeDir>/.flow/artifacts/<taskKey>/<name>.
+// Returns { path, bytes, sha } where sha is the sha256 hex of the content.
+//
+// IDEMPOTENT: if (taskKey, name) already holds byte-identical content, skips the write
+// and returns the same { path, bytes, sha }. Safe to call multiple times on the same
+// artifact — a re-dispatched lane writing what's already there is a no-op.
+//
+// STRUCTURAL PATH GUARD: rejects any taskKey or name that would escape the artifacts
+// base (no '..', no absolute paths, no null bytes, no path separators, no whitespace-only).
+// Throws on violation before any filesystem call is made.
+//
+// REALPATH CONTAINMENT GUARD (directory level): after the structural string checks and
+// mkdirSync, resolves the real path of taskDir via fs.realpathSync and verifies it is
+// still inside the canonical artifacts root (fs.realpathSync(worktreeDir) +
+// '/.flow/artifacts'). Catches symlinks planted at any DIRECTORY level — .flow,
+// .flow/artifacts, or the taskKey dir — in one pass.
+//
+// LEAF CONTAINMENT GUARD (file level): the dir guard cannot see a symlink planted at the
+// dest file itself (realpathSync(dir) never inspects the leaf's type). assertLeafContained
+// lstat's the dest and rejects a leaf symlink — absolute-, relative-, or chained-target —
+// before fs.writeFileSync (or the idempotency readFileSync) can follow it out of the dir.
+export function writeLaneArtifact (flowId, taskKey, name, content, { worktreeDir, fs = nodeFs } = {}) {
+  if (!flowId || typeof flowId !== 'string') throw new Error('flowId required (string)')
+  if (!taskKey || typeof taskKey !== 'string' || !taskKey.trim()) throw new Error('taskKey required (non-empty string)')
+  if (!name || typeof name !== 'string' || !name.trim()) throw new Error('name required (non-empty string)')
+  if (!worktreeDir) throw new Error('worktreeDir required')
+
+  const artifactsBase = path.join(worktreeDir, '.flow', 'artifacts')
+
+  const taskDir = containedPath(artifactsBase, taskKey)
+  if (!taskDir) throw new Error(`taskKey "${taskKey}" rejected — path escapes artifacts base or is invalid`)
+
+  const dest = containedPath(artifactsBase, taskKey, name)
+  if (!dest) throw new Error(`name "${name}" rejected — path escapes artifacts base or is invalid`)
+
+  const buf = Buffer.isBuffer(content) ? content : Buffer.from(content)
+  const sha = createHash('sha256').update(buf).digest('hex')
+
+  fs.mkdirSync(taskDir, { recursive: true })
+
+  // REALPATH CONTAINMENT (directory level): after mkdirSync, resolve the real path of
+  // taskDir and verify it is still inside the canonical artifacts root.
+  // fs.realpathSync(worktreeDir) handles the case where the worktree itself lives under a
+  // legitimately-symlinked path; the canonical root is then built as a plain string (no
+  // further symlink-following), so a symlink planted at .flow, .flow/artifacts, or the
+  // taskKey directory is caught in one structural pass — its resolved path escapes the
+  // canonical root, and we throw.
+  // Replaces the per-position lstatSync whack-a-mole (was: check taskDir, check dest).
+  const canonicalWorktreeDir = fs.realpathSync(worktreeDir)
+  const canonicalRoot = path.join(canonicalWorktreeDir, '.flow', 'artifacts')
+  const canonicalTaskDir = fs.realpathSync(taskDir)
+  if (!canonicalTaskDir.startsWith(canonicalRoot + path.sep)) {
+    throw new Error(
+      `symlink escape: resolved path "${canonicalTaskDir}" escapes ` +
+      `canonical artifacts root "${canonicalRoot}"`
+    )
+  }
+
+  // LEAF CONTAINMENT (file level): the dir guard above contains the directory, but
+  // fs.writeFileSync follows a symlink planted AT the dest file itself — a symlink at
+  // <taskDir>/<name> (absolute-, relative-, or chained-target) would let the write escape
+  // the contained dir. Must run BEFORE the idempotency read below, which also follows a
+  // leaf symlink via readFileSync. (B5 breaks 1 & 3.)
+  assertLeafContained(fs, dest, canonicalTaskDir)
+
+  // Idempotency: if file already exists with identical bytes, skip the write.
+  // Safe now — assertLeafContained has proven dest is a regular file (or absent).
+  if (fs.existsSync(dest)) {
+    const existing = fs.readFileSync(dest)
+    if (existing.equals(buf)) return { path: dest, bytes: buf.length, sha }
+  }
+
+  fs.writeFileSync(dest, buf)
+  return { path: dest, bytes: buf.length, sha }
+}
+
+// ── digestSlice ───────────────────────────────────────────────────────────────
+// Pure (no fs): compute a digest entry for a closed task. Returns { taskKey, summary,
+// acceptanceProof, pointers }. Callers persist via appendDigest; the conductor reads
+// back via loadDigest with the CEILING compression applied.
+//
+// summary:  a single line, <= 120 chars: "[taskKey] title" optionally with the first
+//           line of acceptanceProof appended. Guaranteed to contain no newlines.
+// pointers: [{ taskKey, name, path, sha }] from the artifacts written during the task.
+//           Artifacts whose taskKey/name/path/sha are missing/empty/undefined are
+//           silently dropped — prevents String(undefined) = "undefined" from leaking
+//           into pointer fields (DG-3).
+export function digestSlice (task, { acceptanceProof = '', artifacts = [] } = {}) {
+  if (!task || !task.key) throw new Error('task with .key required')
+  const base = `[${task.key}] ${task.title ?? task.key}`
+  const firstLine = acceptanceProof ? String(acceptanceProof).split('\n')[0].trim() : ''
+  const summary = (firstLine ? `${base} — ${firstLine}` : base).slice(0, 120)
+  // DG-3: filter out artifacts with any missing/empty/undefined field before mapping.
+  // (artifacts ?? []) handles an explicit null — destructuring default only fires for
+  // undefined; passing artifacts:null leaves artifacts===null here, and null.filter throws.
+  // String(undefined) = "undefined" would produce bogus pointer field values.
+  const pointers = (artifacts ?? [])
+    .filter(a =>
+      a.taskKey != null && String(a.taskKey).trim() &&
+      a.name != null && String(a.name).trim() &&
+      a.path != null && String(a.path).trim() &&
+      a.sha != null && String(a.sha).trim()
+    )
+    .map(a => ({
+      taskKey: String(a.taskKey),
+      name: String(a.name),
+      path: String(a.path),
+      sha: String(a.sha),
+    }))
+  return { taskKey: task.key, summary, acceptanceProof: String(acceptanceProof), pointers }
+}
+
+// ── appendDigest ─────────────────────────────────────────────────────────────
+// Persist a digest entry (from digestSlice) to <baseDir>/.flow/digests/<flowId>.jsonl.
+// Append-only JSONL — insertion order is preserved for loadDigest.
+//
+// FLOWID CONTAINMENT: flowId is validated as a safe single path segment (no traversal,
+// separators, null bytes, or whitespace-only) before being interpolated into the path.
+// Prevents appendDigest('../../../victim', ...) from escaping baseDir (DG-1).
+//
+// LEAF CONTAINMENT: after the dir-level realpath check, assertLeafContained lstat's the
+// <flowId>.jsonl file and rejects a leaf symlink (absolute-, relative-, or chained-target)
+// before fs.appendFileSync can follow it out of the digests dir (B5 break 2).
+//
+// ZERO-POINTER guard: rejects any digest with an empty pointers array. Every persisted
+// entry must have >=1 artifact pointer (invariant d). A task with no artifacts must not
+// call appendDigest — the caller decides whether to skip or synthesize a pointer first.
+//
+// IDEMPOTENT: if the same (flowId, taskKey) is already persisted, this is a no-op.
+// Calling appendDigest twice with the same digest never creates duplicate entries.
+export function appendDigest (flowId, digest, { baseDir, fs = nodeFs } = {}) {
+  if (!safeSegmentId(flowId)) throw new Error(`flowId "${flowId}" rejected — must be a non-empty single path segment (no traversal, separators, or null bytes)`)
+  if (!baseDir) throw new Error('baseDir required')
+  if (!digest || !digest.taskKey) throw new Error('digest.taskKey required')
+  // ZERO-POINTER guard: every persisted digest must carry >=1 valid pointer (invariant d).
+  if (!digest.pointers || digest.pointers.length === 0) {
+    throw new Error(
+      `digest for "${digest.taskKey}" has no pointers — ` +
+      'a closed slice must produce >=1 artifact pointer before persisting'
+    )
+  }
+  const dir = path.join(baseDir, '.flow', 'digests')
+  fs.mkdirSync(dir, { recursive: true })
+
+  // REALPATH CONTAINMENT: verify the resolved digests directory is still under the
+  // canonical base — same one-pass approach as writeLaneArtifact. Catches symlinks
+  // planted at .flow or .flow/digests. fs.realpathSync(baseDir) handles a legitimately-
+  // symlinked base; canonicalDigestsDir is built as a plain string thereafter.
+  const canonicalBase = fs.realpathSync(baseDir)
+  const canonicalDigestsDir = path.join(canonicalBase, '.flow', 'digests')
+  const canonicalDir = fs.realpathSync(dir)
+  if (canonicalDir !== canonicalDigestsDir) {
+    throw new Error(
+      `symlink escape: resolved digests dir "${canonicalDir}" escapes ` +
+      `canonical digests root "${canonicalDigestsDir}"`
+    )
+  }
+
+  const file = path.join(dir, `${flowId}.jsonl`)
+
+  // LEAF CONTAINMENT (file level): the dir guard above contains the digests directory, but
+  // fs.appendFileSync follows a symlink planted AT the <flowId>.jsonl leaf — a symlink
+  // there (absolute-, relative-, or chained-target) would let the append escape the
+  // contained dir. Must run BEFORE the idempotency readFileSync below, which also follows
+  // a leaf symlink. (B5 break 2.)
+  assertLeafContained(fs, file, canonicalDir)
+
+  // IDEMPOTENCY: skip if the same taskKey is already persisted for this flowId.
+  // Re-digesting the same (flowId, taskKey) is a no-op — no duplicate lines.
+  if (fs.existsSync(file)) {
+    const lines = String(fs.readFileSync(file, 'utf8')).split('\n').filter(l => l.trim())
+    for (const line of lines) {
+      try {
+        if (JSON.parse(line).taskKey === digest.taskKey) return
+      } catch { /* skip malformed lines */ }
+    }
+  }
+  fs.appendFileSync(file, JSON.stringify(digest) + '\n')
+}
+
+// ── loadDigest ────────────────────────────────────────────────────────────────
+// Load all closed-slice digests for `flowId` from <baseDir>/.flow/digests/<flowId>.jsonl,
+// applying the hard CEILING compression:
+//   • While accumulated serialized size + full-entry length <= CEILING → include full entry
+//   • Else if slim (no acceptanceProof) fits → include slim
+//   • Else → drop the entry; never exceed CEILING
+//
+// FLOWID CONTAINMENT: flowId is validated as a safe single path segment before use
+// in path construction — same rule as appendDigest (DG-1).
+//
+// CEILING tracking is exact: accumulated == JSON.stringify(result).length at all times,
+// accounting for the outer '['/']' and comma separators between entries.
+//
+// Dedup by taskKey (first occurrence wins) and skips zero-pointer entries for safety
+// against old data that may pre-date the appendDigest zero-pointer guard.
+//
+// Returns digests in insertion order. Total JSON.stringify(result).length <= CEILING.
+export function loadDigest (flowId, { baseDir, fs = nodeFs } = {}) {
+  if (!safeSegmentId(flowId)) throw new Error(`flowId "${flowId}" rejected — must be a non-empty single path segment (no traversal, separators, or null bytes)`)
+  if (!baseDir) throw new Error('baseDir required')
+  const file = path.join(baseDir, '.flow', 'digests', `${flowId}.jsonl`)
+  if (!fs.existsSync(file)) return []
+  const lines = String(fs.readFileSync(file, 'utf8')).split('\n').filter(l => l.trim())
+  const result = []
+  const seen = new Set()  // dedup by taskKey — first occurrence wins
+  // Track exact JSON.stringify(result).length:
+  //   '[' entries.join(',') ']' = 2 + sum(entryLen) + (n-1 commas)
+  // Start at 2 for the outer brackets. Each entry adds (comma if not first) + entryLen.
+  // Invariant: accumulated === JSON.stringify(result).length after every push.
+  let accumulated = 2  // '[' + ']'
+  for (const line of lines) {
+    let entry
+    try { entry = JSON.parse(line) } catch { continue }
+    if (!entry.taskKey) continue
+    // Dedup: appendDigest should prevent duplicates, but guard here for old data
+    if (seen.has(entry.taskKey)) continue
+    // Safety: skip zero-pointer entries (appendDigest now rejects them, but old JSONL may have them)
+    if (!entry.pointers || entry.pointers.length === 0) continue
+    seen.add(entry.taskKey)
+    const slim = { taskKey: entry.taskKey, summary: entry.summary, pointers: entry.pointers }
+    const comma = result.length > 0 ? 1 : 0  // comma separator before every entry except the first
+    const fullLen = line.length
+    const slimLen = JSON.stringify(slim).length
+    if (accumulated + comma + fullLen <= CEILING) {
+      result.push(entry)
+      accumulated += comma + fullLen
+    } else if (accumulated + comma + slimLen <= CEILING) {
+      // Full would exceed ceiling: emit the slim form (never drop the pointer)
+      result.push(slim)
+      accumulated += comma + slimLen
+    }
+    // else: neither full nor slim fits within CEILING — drop this entry.
+    // The hard guarantee: JSON.stringify(result).length <= CEILING always holds.
+  }
+  return result
+}
+
+// ── resumeLane ────────────────────────────────────────────────────────────────
+// Re-read a lane's own prior artifacts from <worktreeDir>/.flow/artifacts/.
+// Returns an array of { taskKey, name, path, bytes, sha } — identical to what
+// writeLaneArtifact would have returned for each artifact originally written.
+//
+// IDEMPOTENT: calling multiple times on the same worktree gives the same result.
+// A re-dispatched lane calls this on startup to reconstruct its prior state without
+// redoing any writes. Artifacts whose files are unreadable are silently skipped.
+export function resumeLane (flowId, { worktreeDir, fs = nodeFs } = {}) {
+  if (!flowId) throw new Error('flowId required')
+  if (!worktreeDir) throw new Error('worktreeDir required')
+  const artifactsBase = path.join(worktreeDir, '.flow', 'artifacts')
+  if (!fs.existsSync(artifactsBase)) return []
+  // [SCOPE: accepted] The read path here is intentionally NOT realpath-checked.
+  // resumeLane reads artifacts but does not write; traversing a symlink-redirected path
+  // cannot exfiltrate data the caller couldn't already read by other means. The worktree
+  // is trusted, non-shared, and single-user by design (git worktree, browser-side flow).
+  // The WRITE path in writeLaneArtifact IS realpath-checked — that's where containment
+  // matters. If the threat model changes (multi-user, shared fs), add realpath here too.
+  const artifacts = []
+  for (const taskKey of fs.readdirSync(artifactsBase)) {
+    const taskDirPath = path.join(artifactsBase, taskKey)
+    let stat
+    try { stat = fs.statSync(taskDirPath) } catch { continue }
+    if (!stat.isDirectory()) continue
+    for (const name of fs.readdirSync(taskDirPath)) {
+      const filePath = path.join(taskDirPath, name)
+      let buf
+      try { buf = fs.readFileSync(filePath) } catch { continue }
+      const sha = createHash('sha256').update(buf).digest('hex')
+      artifacts.push({ taskKey, name, path: filePath, bytes: buf.length, sha })
+    }
+  }
+  return artifacts
+}

package/flow-redispatch.mjs

@@ -0,0 +1,72 @@
+// Thinkpool Flow — S4 clean lane kill + re-dispatch (slice 2, flow-redispatch-clean).
+//
+// When a lane is force-killed mid-tool-call (budget kill-switch, review reject, restart)
+// and re-dispatched, three things must hold before the new lane replays the old work:
+//
+//   (a) HEALED TRANSCRIPT — a lane killed mid-tool-call leaves an assistant message with a
+//       tool_use block that has NO matching tool_result. On the next SDK replay Anthropic
+//       400s ("tool_use ids were found without tool_result blocks"). sanitizeSession's
+//       Heal 3 (bridge/transcript-sanitize.mjs — DONE, do not rewrite) injects a synthetic
+//       tool_result placeholder. We CONSUME it here: run it on the dying lane's transcript
+//       so a resume is clean. Idempotent — a clean transcript is a no-op.
+//
+//   (d) REVERT TARGET PRESERVED — revertLane deletes the lane's branch (`git branch -D`), which
+//       destroys the commit the killed lane made. The revert target (commit_sha, recorded
+//       room-side on flow_tasks) must survive the re-dispatch so a later reviewer still knows
+//       what to roll back to. We carry it in the pending-redispatch record.
+//
+// H41 (realtime collision) — NOT this module's concern, by construction. A re-dispatched lane
+// opens NO realtime channel of its own: the bridge opens exactly two channels ONCE at startup
+// (`tpcode:<room>` presence + `tpflow:<room>` presence-free broadcast), and a re-dispatched
+// lane reuses the existing room-wide `tpflow:<room>` broadcast. With no per-lane subscribe there
+// is no second .subscribe() to race a presence callback (feedback_no_duplicate_realtime_channel,
+// Flow #134/#136), so no duplicate-subscribe collision is possible. Earlier drafts computed a
+// per-lane `flowRedispatchTopic` — it was dead (never read by any subscribe) and was removed so
+// a future reader doesn't mistake it for live realtime coverage.
+//
+// DBOS-idempotent: re-running prepareRedispatch on an already-clean lane heals nothing and
+// re-dispatch of a lane with no pending record resumes nothing — both are no-ops.
+//
+// Pure over an injected `sanitize` so it's unit-testable without touching a real transcript.
+// Spec: docs/specs/2026-06-30-flow-build-s4-clean-redispatch.md.
+
+/**
+ * Prepare a killed lane for clean re-dispatch. Heals its transcript (so a resume can't 400 on
+ * a dangling tool_use) and returns everything the re-dispatch needs to resume cleanly.
+ *
+ * @param {object}   o
+ * @param {object}   o.lane      the killed lane's session entry (needs cwd, session.sessionId, commitSha/flowReviewTarget)
+ * @param {function} o.sanitize  (cwd, sessionId) => { blocks } — inject sanitizeSession here (the Heal-3 consumer)
+ * @returns {{ resumeSessionId: string|null, revertTarget: string|null, healed: number, cwd: string|null }}
+ */
+export function prepareRedispatch ({ lane, sanitize }) {
+  const cwd = lane?.cwd || null
+  const resumeSessionId = lane?.session?.sessionId || lane?.sessionId || null
+  // Revert target survives the branch deletion: prefer an explicitly recorded commit, else
+  // any commitSha the lane carried. null when the lane never committed (nothing to preserve).
+  const revertTarget = lane?.revertTarget ?? lane?.commitSha ?? null
+
+  let healed = 0
+  // Heal ONLY when there's a transcript to heal (a resumable session). No sessionId → the lane
+  // never got a live SDK session, so there is nothing to replay and nothing to heal (no-op).
+  if (resumeSessionId && typeof sanitize === 'function') {
+    try {
+      const r = sanitize(cwd, resumeSessionId)
+      healed = (r && typeof r.blocks === 'number') ? r.blocks : 0
+    } catch {
+      healed = 0 // a sanitize failure must never block re-dispatch — worst case, resume as before
+    }
+  }
+
+  return { resumeSessionId, revertTarget, healed, cwd }
+}
+
+/**
+ * A pending-redispatch registry. When flow-revert kills a lane, it records the prepared
+ * re-dispatch (keyed by flowId+taskKey) so the next flow-dispatch wave resumes the healed
+ * session on a clean topic with the revert target intact. Idempotent: re-dispatching a task
+ * with no pending record (a first, never-killed dispatch) resolves to a fresh lane (no resume).
+ */
+export function redispatchKey (flowId, taskKey) {
+  return `${flowId}::${taskKey}`
+}

package/flow-review-gate.mjs

@@ -40,7 +40,7 @@
 //   reviewer's worktree, not the slice. The wiring layer that provisions the reviewer lane
 //   MUST guarantee this worktree isolation — this gate cannot substitute for it.
 
-import { realpathSync as nodeRealpathSync } from 'node:fs'
+import { realpathSync as nodeRealpathSync, readlinkSync, lstatSync } from 'node:fs'
 import path from 'node:path'
 
 // ── Tool classification ───────────────────────────────────────────────────────
@@ -175,7 +175,17 @@ function _assessFilePath ({
           }
         }
       } catch {
-        // verdictFile doesn't exist yet — no symlink possible; allow.
+        // verdictFile doesn't exist yet — realpathSync(verdictFile) threw ENOENT.
+        // That does NOT prove "no symlink possible": a symlinked ANCESTOR directory (or a
+        // dangling symlink named FLOW_REVIEW.json) can still resolve the write into the slice.
+        // Realpath the nearest EXISTING ancestor and re-check containment of the full target.
+        const realAncestor = _realpathNearestAncestor(resolvedVerdict, _realpath)
+        if (realAncestor && (_isUnder(realAncestor, canonicalSliceRoot) || _isUnder(realAncestor, inputSliceRoot))) {
+          return {
+            allow: false,
+            reason: `verdictFile "${verdictFile}" resolves (via a symlinked path component) to "${realAncestor}" inside sliceRoot — denied`,
+          }
+        }
       }
       return { allow: true, reason: `write to verdictFile (${path.basename(verdictFile)}) — allowed` }
     }
@@ -201,12 +211,67 @@ function _assessFilePath ({
       }
     }
   } catch {
-    // ENOENT or other — step 1 already handled the in-slice case.
+    // ENOENT — the file (or a component of it) doesn't exist yet, so realpathSync(filePath)
+    // threw before it could follow any symlinked ANCESTOR directory. Step 1 only normalized
+    // '..' — it did NOT resolve a symlinked path component (e.g. scratch/link → sliceRoot,
+    // then Write scratch/link/PWNED.js lands in the slice). Realpath the nearest EXISTING
+    // ancestor, re-join the un-created tail, and re-check containment.
+    const realAncestor = _realpathNearestAncestor(resolved, _realpath)
+    if (realAncestor && (_isUnder(realAncestor, canonicalSliceRoot) || _isUnder(realAncestor, inputSliceRoot))) {
+      return {
+        allow: false,
+        reason: `${toolName} to "${filePath}" resolves (via a symlinked path component) to "${realAncestor}" inside sliceRoot — denied`,
+      }
+    }
   }
 
   return { allow: true, reason: `${toolName} to "${filePath}" is outside sliceRoot — allowed` }
 }
 
+// ── _realpathNearestAncestor ────────────────────────────────────────────────────
+// For a target path that does NOT fully exist (realpathSync threw ENOENT), walk UP to the
+// nearest existing ancestor directory, realpath-resolve THAT (following any symlinked
+// component), then re-join the remaining un-created tail. The returned absolute path is what
+// the write would ACTUALLY land on once created — which is what containment must be tested
+// against. Returns null only if even the filesystem root can't be resolved (never expected).
+function _realpathNearestAncestor (resolved, _realpath) {
+  // If the LEAF itself is a symlink (existing but DANGLING — its target doesn't exist, so
+  // realpathSync(resolved) threw), follow the link one hop and resolve from THERE. This is the
+  // dangling-verdict-symlink case: scratch/FLOW_REVIEW.json → <sliceRoot>/evil.js. path.resolve
+  // does NOT follow symlinks, so without this the write's true landing spot is invisible.
+  try {
+    if (lstatSync(resolved).isSymbolicLink()) {
+      const linkTarget = readlinkSync(resolved)
+      const absTarget = path.isAbsolute(linkTarget)
+        ? linkTarget
+        : path.resolve(path.dirname(resolved), linkTarget)
+      // Recurse: the target may itself be non-existent / chained through more symlinks.
+      try {
+        return _realpath(absTarget)
+      } catch {
+        return _realpathNearestAncestor(absTarget, _realpath)
+      }
+    }
+  } catch {
+    // lstat failed — leaf doesn't exist at all; fall through to ancestor walk below.
+  }
+
+  let ancestor = path.dirname(resolved)
+  const tail = [path.basename(resolved)]
+  // Walk up until an ancestor resolves, or we hit the root (dirname is a fixed point).
+  while (true) {
+    try {
+      const realAncestor = _realpath(ancestor)
+      return path.join(realAncestor, ...tail.reverse())
+    } catch {
+      const parent = path.dirname(ancestor)
+      if (parent === ancestor) return null // reached root without resolving — give up
+      tail.push(path.basename(ancestor))
+      ancestor = parent
+    }
+  }
+}
+
 // ── _assessBashCommand ────────────────────────────────────────────────────────
 // HEURISTIC — see BASH LIMITATION comment at top of file.
 
@@ -294,6 +359,41 @@ function _assessBashCommand ({ cmd, inputSliceRoot, canonicalSliceRoot }) {
   return { allow: true, reason: 'Bash command allowed (no write-to-slice pattern detected)' }
 }
 
+// ── reviewGatePreToolDecision ───────────────────────────────────────────────────
+// S5 (slice 1b) — the LIVE PreToolUse wiring seam. Lives HERE (not in claude-session.mjs)
+// so it stays SDK-free and unit-testable: claude-session.mjs pulls the Claude Agent SDK at
+// module load, which isn't resolvable in the test env. The PreToolUse hook imports and calls
+// this; the integration test imports it directly.
+//
+// `reviewGate` is a per-review-lane closure (bridge.mjs folds reviewGateDecision over the
+// reviewed slices' worktree roots); it is NULL on builder lanes. Returns:
+//   • null       → fall through to the normal permission path (read / run-test / verdict).
+//   • deny payload → a terminal PreToolUse `permissionDecision: 'deny'` the hook returns
+//                    immediately — BEFORE the auto-allow/bypass path, so the block is
+//                    structural even in the lane's bypassPermissions mode.
+// A throwing reviewGate fails CLOSED (deny) — never a silent allow. Builder lanes
+// (reviewGate=null) always return null here → their toolset is UNCHANGED.
+export function reviewGatePreToolDecision ({ reviewGate, toolName, toolInput }) {
+  if (!reviewGate) return null
+  let g = null
+  try {
+    g = reviewGate({ toolName, input: toolInput })
+  } catch (e) {
+    g = { allow: false, reason: `review gate error — denied: ${e?.message || e}` }
+  }
+  if (g && g.allow === false) {
+    return {
+      continue: true,
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: `Blocked (Flow review lane): ${g.reason} You REVIEW the slice — you do not edit it. Read it, run it to reproduce acceptance, then emit your verdict by Writing FLOW_REVIEW.json.`,
+      },
+    }
+  }
+  return null
+}
+
 // ── helpers ───────────────────────────────────────────────────────────────────
 
 // Returns true if `filePath` equals `dir` OR is strictly inside it.

package/flow-skill-registry.mjs

@@ -0,0 +1,140 @@
+// Thinkpool Flow — progressive skill registry.
+//
+// A Flow lane boots with only skill METADATA (name + description + whenToUse) injected
+// into its base prompt — the compact manifest(). The full SKILL.md body loads ON DEMAND
+// via loadBody(name) only when the lane actually activates that skill. Token win: the
+// manifest is orders of magnitude smaller than the sum of all skill bodies.
+//
+// Format: each skill lives at <dir>/<skill-name>/SKILL.md with agentskills.io YAML
+// frontmatter (name, description, and optional whenToUse). The body is the full SKILL.md
+// file content (frontmatter included) — the complete text a lane sees on activation.
+//
+// Public/custom split: publicDir carries built-in product skills; customDir (optional)
+// carries user/room-level overrides. Custom skills override public ones by `name` field.
+//
+// Pure module — canonical at src/lib/flow/skillRegistry.js, mirrored byte-identically
+// at bridge/flow-skill-registry.mjs (same reason as taskGraph / contextStore: the bridge
+// ships as thinkpool-pair npm package and can't import across the bridge↔src boundary
+// at publish time). Sync: bridge/flow-skill-registry.sync.test.js.
+//
+// Node built-ins only (node:fs, node:path) — no new deps.
+// All fs calls are injectable (fs option) so logic is unit-testable against temp dirs.
+
+import nodeFs from 'node:fs'
+import nodePath from 'node:path'
+
+// ── parseFrontmatter ──────────────────────────────────────────────────────────
+// Parse agentskills.io YAML-like frontmatter from a SKILL.md string.
+// Returns { meta: { name, description, whenToUse? } } or null if malformed/missing.
+// Required fields: name, description — missing either → null (skill skipped from manifest).
+// Tolerant: unknown YAML fields silently ignored; only scalar key:value pairs parsed.
+function parseFrontmatter (content) {
+  if (typeof content !== 'string') return null
+  // Strip BOM if present
+  const s = content.charCodeAt(0) === 0xFEFF ? content.slice(1) : content
+  if (!s.startsWith('---')) return null
+  const afterOpen = s.slice(3)
+  // Closing delimiter: a line that is exactly '---' (accept \r\n or \n line endings)
+  const closeMatch = afterOpen.match(/\r?\n---(?:\r?\n|$)/)
+  if (!closeMatch) return null
+  const yamlBlock = afterOpen.slice(0, closeMatch.index)
+
+  // Scalar key: value extraction only — not a full YAML parser; lists/nested maps silently mis-parsed.
+  const meta = {}
+  for (const line of yamlBlock.split(/\r?\n/)) {
+    const colonIdx = line.indexOf(':')
+    if (colonIdx === -1) continue
+    const key = line.slice(0, colonIdx).trim()
+    const val = line.slice(colonIdx + 1).trim()
+    if (key) meta[key] = val
+  }
+
+  // Both name and description are required for a valid skill entry
+  if (!meta.name || !meta.description) return null
+  return { meta }
+}
+
+// ── scanDir ───────────────────────────────────────────────────────────────────
+// Scan `dir` for skill entries. Each valid skill is a subdirectory containing a SKILL.md
+// with parseable frontmatter (name + description required). Malformed SKILL.md → skipped
+// without throwing. Missing or inaccessible dir → returns [].
+// Returns [{ name, description, whenToUse?, _path }] where _path is the absolute SKILL.md
+// path (internal — stripped from manifest() output, used by loadBody).
+function scanDir (dir, { fs = nodeFs } = {}) {
+  if (!dir) return []
+  let entries
+  try {
+    entries = fs.readdirSync(dir)
+  } catch (e) {
+    if (e && (e.code === 'ENOENT' || e.code === 'ENOTDIR')) return []
+    throw e
+  }
+  const skills = []
+  for (const entry of entries) {
+    const skillDir = nodePath.join(dir, entry)
+    let stat
+    // lstatSync does NOT follow symlinks — a symlinked entry returns isSymbolicLink()=true
+    // and isDirectory()=false, so it is skipped. Using statSync would follow the link and
+    // allow scanning a directory outside publicDir/customDir (symlink escape vector).
+    try { stat = fs.lstatSync(skillDir) } catch { continue }
+    if (!stat.isDirectory()) continue
+    const skillMdPath = nodePath.join(skillDir, 'SKILL.md')
+    // Belt-and-suspenders: lstat the SKILL.md too — skip if it is itself a symlink.
+    // Covers a file-level symlink inside a real (non-symlinked) skill dir.
+    let skillMdStat
+    try { skillMdStat = fs.lstatSync(skillMdPath) } catch { continue }
+    if (skillMdStat.isSymbolicLink()) continue
+    let content
+    try { content = fs.readFileSync(skillMdPath, 'utf8') } catch { continue }
+    const parsed = parseFrontmatter(content)
+    if (!parsed) continue  // malformed — skip silently, do not throw
+    const { meta } = parsed
+    const skill = { name: meta.name, description: meta.description, _path: skillMdPath }
+    if (meta.whenToUse) skill.whenToUse = meta.whenToUse
+    skills.push(skill)
+  }
+  return skills
+}
+
+// ── manifest ──────────────────────────────────────────────────────────────────
+// Build the compact skill manifest: an array of { name, description, whenToUse? } per
+// skill — METADATA ONLY, no SKILL.md body. This is what a lane injects into its base
+// prompt to know which skills are available without loading any body.
+//
+// Merge rule: publicDir skills load first; customDir skills then override/extend by
+// `name`. A custom skill with the same name as a public skill replaces it in the result.
+//
+// Returns [] if both dirs are absent or contain no valid skills.
+export function manifest ({ publicDir, customDir, fs = nodeFs } = {}) {
+  const publicSkills = scanDir(publicDir, { fs })
+  const customSkills = scanDir(customDir, { fs })
+  // Merge: public first, custom overrides by name
+  const byName = new Map()
+  for (const s of publicSkills) byName.set(s.name, s)
+  for (const s of customSkills) byName.set(s.name, s)
+  // Return compact entries — strip internal _path
+  return [...byName.values()].map(({ name, description, whenToUse }) => {
+    const entry = { name, description }
+    if (whenToUse !== undefined) entry.whenToUse = whenToUse
+    return entry
+  })
+}
+
+// ── loadBody ──────────────────────────────────────────────────────────────────
+// Load the full SKILL.md content for the named skill, on demand.
+// customDir is checked before publicDir (a custom skill overrides a public of the same name).
+// Unknown name / skill not found in either dir → returns null (clean miss, never throws).
+export function loadBody (name, { publicDir, customDir, fs = nodeFs } = {}) {
+  if (!name || typeof name !== 'string') return null
+  // Custom takes priority over public — check custom first
+  for (const dir of [customDir, publicDir]) {
+    const skills = scanDir(dir, { fs })
+    const found = skills.find(s => s.name === name)
+    if (found) {
+      try {
+        return fs.readFileSync(found._path, 'utf8')
+      } catch { /* skill file disappeared — try next dir */ }
+    }
+  }
+  return null  // clean miss — not found in either dir
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.112",
+  "version": "0.7.114",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -24,6 +24,9 @@
     "flow-review-gate.mjs",
     "flow-assembly.mjs",
     "flow-budget.mjs",
+    "flow-context-store.mjs",
+    "flow-redispatch.mjs",
+    "flow-skill-registry.mjs",
     "serve-dir.mjs",
     "service.mjs",
     "presence.mjs",