thinkpool-pair 0.7.220 → 0.7.222

package/bridge.mjs

@@ -55,9 +55,10 @@ import { canonicalRoomFilePath, waitForNativeImages } from './codex-images.mjs'
 import { createManagedLaneWorktree, removeManagedLaneWorktree } from './lane-worktree.mjs'
 import { commandOnPath } from './agent-detect.mjs'
 
-const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
-import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
-import { normalizePlanOutput, laneModelFor } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph; laneModelFor — per-slice model tier (2026-07-03-flow-lane-model-tiers)
+const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
+import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
+import { legacyBuilderCompletionAllowed, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
+import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, assertRuntimeModelCompatible } from './flow-models.mjs'
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
 // the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
 // which enforces the CEILING). Consume the store — the internals live in flow-context-store.mjs.
@@ -65,7 +66,7 @@ import { writeLaneArtifact, digestSlice, appendDigest, resumeLane } from './flow
 import { createFlowWorktree, worktreeSpec } from './flow-worktree.mjs'
 import { startPreview, stopAllPreviews, previews } from './flow-preview.mjs'
 import { ViewportManager, createViewportTools, sharedViewportBrowser } from './viewport.mjs'
-import { designPrompt, resolveDesignSource, restoreDesignSources, syncRealtimeAuth, validateDesignRequest } from './design-edit.mjs'
+import { designPrompt, resolveDesignSource, resolveManifestDesignSource, restoreDesignSources, syncRealtimeAuth, validateDesignRequest } from './design-edit.mjs'
 // FL-M9 — per-lane preview servers leak (one per done lane, never stopped until shutdown).
 // Lane previews are keyed `lane:<flowId>:<laneId>`; stop a whole flow's set when it assembles
 // (the assembled preview supersedes them) or when a lane is reverted.
@@ -75,7 +76,7 @@ function stopFlowPreviews (flowId, laneId = null) {
     if (laneId ? key === `lane:${flowId}:${laneId}` : key.startsWith(`lane:${flowId}:`)) { try { h.stop() } catch { /* noop */ } }
   }
 }
-import { FLOW_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
+import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
@@ -89,6 +90,7 @@ import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from
 // Spec: docs/specs/2026-06-30-flow-build-s4-clean-redispatch.md
 import { prepareRedispatch, redispatchKey } from './flow-redispatch.mjs'
 import { sanitizeSession } from './transcript-sanitize.mjs'
+import { executeFlowRevert } from './flow-host-revert.mjs'
 // ACCEPTED LIMITATION — this registry is in-memory only. A bridge restart in the window between
 // a flow-revert kill and the next dispatch wave loses the pending resume record, so the task
 // re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on
@@ -101,7 +103,7 @@ const flowRedispatch = new Map()
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, laneStatusOf } from './cross-terminal.mjs'
-import { armInterruptedResume, sendInterruptedContinue, supersedeInterruptedResume } from './interrupted-resume.mjs'
+import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, armInterruptedResume, sendInterruptedContinue, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, codexUsageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
@@ -1321,8 +1323,8 @@ const handleManifest = async (box, file, term, trustedDesignSource = false) => {
   try { m = JSON.parse(fs.readFileSync(full, 'utf8')) } catch { return }
   if (!m?.slug) return
   const producer = trustedDesignSource ? sessions.get(term) : null
-  const designRecord = producer && m.source
-    ? resolveDesignSource(m.source, producer.cwd || process.cwd())
+  const designRecord = producer
+    ? resolveManifestDesignSource(m, producer.cwd || process.cwd())
     : null
   // 2026-07-07: these used to swallow read errors silently — a transient
   // unreadable file (race with the render script, permissions, mid-write)
@@ -1646,7 +1648,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, runtime = 'claude', model, effort, resume, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, rolePrompt, flowSessionId, flowTaskKey, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
+function openStructured({ id, runtime = 'claude', model, effort, resume, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, rolePrompt, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   runtime = runtime === 'codex' ? 'codex' : 'claude'
   // No explicit mode → a sensible default per runtime (see defaultModeForRuntime):
@@ -1656,6 +1658,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // entry.mode), a flow lane, and spawn_terminal (inherits the parent's mode +
   // its own bypass-escalation gate) all pass an explicit mode and skip this.
   mode = STRUCTURED_MODES.has(mode) ? mode : defaultModeForRuntime(runtime)
+  assertRuntimeModelCompatible({ runtime, provider, model })
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
   // separately: the label resolved the provider's configured model while the SDK got the
@@ -1663,14 +1666,15 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // lane opened while focused on Fable therefore showed `glm-4.6` and sent
   // `claude-fable-5` → 400 [1211][Unknown Model]. One value, one truth.
   // undefined → omit the SDK option entirely and let the provider env/endpoint default.
+  const codexModels = runtime === 'codex' ? readCodexModels() : []
   const laneModel = runtime === 'codex'
-    ? (model || readCodexDefaultModel() || undefined)
+    ? resolveCodexModel(model || readCodexDefaultModel() || undefined, codexModels)
     : effectiveLaneModel({ provider, model, configuredModel: resolveProviderEnv(provider)?.ANTHROPIC_MODEL })
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
   // stripped it and the lane reverted to a plain tab — the t6 "no chip" bug).
   effort = new Set(['low', 'medium', 'high', 'xhigh', 'max']).has(effort) ? effort : 'high'
-  const entry = { cmd: runtime, runtime, kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode, effort, models: runtime === 'codex' ? readCodexModels() : undefined,
+  const entry = { cmd: runtime, runtime, kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode, effort, models: runtime === 'codex' ? codexModels : undefined,
     // model: truthful active-model label — now the SAME `laneModel` the SDK is given, so the
     // chip cannot disagree with the wire. When this lane runs on a custom (non-anthropic)
     // registered provider the SDK id is impersonated (see the onEvent guard below), so
@@ -1684,10 +1688,18 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       ? (laneModel || null)
       : (laneModel || providerNameMap()[provider] || provider),
     provider: provider || null, spawnedBy: spawnedBy || undefined, sideParent: sideParent || undefined, sideTask: sideTask || undefined, pendingSideContexts: Array.isArray(pendingSideContexts) ? pendingSideContexts.filter(Boolean).slice(-4) : [], flowSessionId: flowSessionId || null, flowTaskKey: flowTaskKey || null, cwd: cwd || null, managedWorktree: managedWorktree || null,
+    flowRole: flowRole || (flowSessionId ? (flowTaskKey ? ((flowReviewTargets?.length || reviewSliceRoots?.length) ? 'reviewer' : 'builder') : 'conductor') : null),
+    flowReviewTarget: flowReviewTarget || null,
+    flowReviewTargets: Array.isArray(flowReviewTargets) && flowReviewTargets.length ? flowReviewTargets.filter(Boolean) : (flowReviewTarget ? [flowReviewTarget] : []),
+    flowReviewRound: Number.isInteger(flowReviewRound) && flowReviewRound >= 0 ? flowReviewRound : 0,
+    dispatchBaseSha: dispatchBaseSha || null,
+    revertTarget: revertTarget || null,
+    cwd: cwd || null, managedWorktree: managedWorktree || null,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
     // first transcript event ts, so even the first post-fix restart is ordered right.
     openedAt: openedAt || (Array.isArray(log) ? (log.find((e) => e?.ts)?.ts || 0) : 0) || Date.now() }
+  entry.interruptedRecap = restoredTurnOpen(entry.log) ? buildRecapFromLog(entry.log, RECAP_CAP) : null
   // Slice 3 — a permission card left unanswered past the grace window pushes
   // "<lane> — needs you: <what>"; answering it anywhere retracts the banner
   // everywhere. Worker/flow lanes are excluded at arm() time (isUserFacingLane).
@@ -1715,11 +1727,15 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // MCP tool AND the FLOW_DONE sentinel-Write intercept: like the conductor's submit, the
   // MCP tool is DEFERRED (needs ToolSearch, which hangs), so lanes signal done by Writing a
   // FLOW_DONE file — a DIRECT tool — which the PreToolUse hook routes here. Returns a message.
-  const markFlowDone = async () => {
+  const markFlowDone = async ({ reviewPass = false } = {}) => {
     if (!entry.flowSessionId || !entry.flowTaskKey) return 'Not a Flow lane — nothing to mark done.'
+    if (entry.flowRole !== 'builder' && !(reviewPass && entry.flowRole === 'reviewer')) return 'This Flow role cannot mark a builder slice done.'
     if (entry.flowDone) return 'This slice is already recorded as done.'
     let commitSha = null
     try { commitSha = execFileSync('git', ['-C', entry.cwd || process.cwd(), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* no commits yet */ }
+    if (!reviewPass && entry.dispatchBaseSha && commitSha === entry.dispatchBaseSha) {
+      return `Slice "${entry.flowTaskKey}" is not done: HEAD is still the dispatch base (${commitSha.slice(0, 8)}). Commit the verified implementation first.`
+    }
     let previewUrl = null
     try { const pv = await startPreview({ dir: entry.cwd || process.cwd(), id: `lane:${entry.flowSessionId}:${id}` }); previewUrl = pv.url } catch { /* preview best-effort */ }
     // S1 (context-offload) — digest THIS closed slice into the durable store so the next
@@ -1749,7 +1765,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     } catch (e) {
       process.stderr.write(`\n  ${A.dim}◆ flow digest skip ${entry.flowTaskKey} — ${e?.message || e}${A.rst}\n`)
     }
-    bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl }, flowChannel)
+    bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl, ...(reviewPass ? { reviewAction: 'pass' } : {}) }, flowChannel)
     process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
     entry.flowDone = true   // FL-B3 — retire immediately so it drops from the ≤8 lane cap
     setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
@@ -1761,14 +1777,22 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // never reverted). On FAIL → broadcast flow-revert for the reviewed slice (the client flips
   // it to pending → the next wave rebuilds it). Either way the review lane itself is done.
   const onReviewVerdict = async (raw) => {
-    if (!entry.flowSessionId || !entry.flowTaskKey) return { ok: false, message: 'Not a Flow review lane.' }
+    if (!entry.flowSessionId || !entry.flowTaskKey || entry.flowRole !== 'reviewer') return { ok: false, message: 'Not a Flow review lane.' }
     let v, target = null
     try {
       v = parseReviewVerdict(raw)
       const o = typeof raw === 'string' ? JSON.parse(String(raw).replace(/```(?:json)?|```/g, '').trim()) : raw
-      target = (o && (o.taskKey || o.target)) || (entry.flowReviewTarget || null)
+      const requested = o && (o.taskKey || o.target)
+      const allowed = entry.flowReviewTargets
+      if (!allowed.length) throw new Error('review lane has no authorized target')
+      if (entry.runtime === 'codex' && allowed.length !== 1) throw new Error('Codex review lane must have exactly one authorized target')
+      if (requested && !allowed.includes(requested)) throw new Error(`taskKey ${JSON.stringify(requested)} is outside this review lane`)
+      target = requested || (allowed.length === 1 ? allowed[0] : null)
+      if (!target) throw new Error('taskKey is required when reviewing more than one slice')
     } catch (e) {
-      return { ok: false, message: `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
+      return { ok: false, message: entry.runtime === 'codex'
+        ? `Review verdict REJECTED: ${e?.message || e}. Re-call submit_flow_review with a valid authorized taskKey.`
+        : `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
     }
     // E1 A1/A2 — the BOUNDED reviewer loop, live side. Each FLOW_REVIEW.json write is ONE
     // hunt round; the governor decides continue-vs-stop from the round count + the lane's
@@ -1779,6 +1803,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     // for live-room verification (bridge is inert until published); the decision logic is
     // unit-proven in flow-review.loop.test.mjs + flow-review-reflect.test.mjs.
     const round = (entry.flowReviewRound = (entry.flowReviewRound || 0) + 1)
+    entry.flush?.()
     const b = flowBudgets.get(entry.flowSessionId) || null
     const decision = reviewReflectionDecision({
       round,
@@ -1794,7 +1819,9 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       const next = round + 1
       try {
         entry.session?.sendTurn(
-          `[Flow review — round ${next}/${REVIEW_DEFAULTS.maxRounds}] The happy path held, but you have NOT reported your checks exhausted and you are under both the round and budget ceilings. Dig one more round: hunt the edge cases, the reload, the second click, concurrent use, the error path — the places the builder didn't. Then re-Write FLOW_REVIEW.json — pass:false with a specific reason if you break it, or pass:true AND exhausted:true if you genuinely have nothing left to check.`,
+          entry.runtime === 'codex'
+            ? `[Flow review — round ${next}/${REVIEW_DEFAULTS.maxRounds}] The happy path held, but you have NOT reported your checks exhausted. Dig one more round, then call submit_flow_review again — pass:false with specific evidence if you break it, or pass:true AND exhausted:true only when nothing remains to check.`
+            : `[Flow review — round ${next}/${REVIEW_DEFAULTS.maxRounds}] The happy path held, but you have NOT reported your checks exhausted and you are under both the round and budget ceilings. Dig one more round: hunt the edge cases, the reload, the second click, concurrent use, the error path — the places the builder didn't. Then re-Write FLOW_REVIEW.json — pass:false with a specific reason if you break it, or pass:true AND exhausted:true if you genuinely have nothing left to check.`,
         )
       } catch { /* lane may have closed mid-verdict */ }
       process.stderr.write(`\n  ${A.dim}◆ review round ${round} inconclusive — digging again (${next}/${REVIEW_DEFAULTS.maxRounds}) on ${target || entry.flowTaskKey}${A.rst}\n`)
@@ -1804,11 +1831,24 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     // Terminal outcome. reject → revert the reviewed slice; surface → hand the inconclusive
     // result to the pair WITHOUT reverting (no failure was reproduced); pass → accept.
     if (decision.action === 'reject' && target) {
-      bcast('flow-revert', { term: id, flowId: entry.flowSessionId, taskKey: target }, flowChannel)
+      const reverted = await handleFlowRevert({ term: id, flowId: entry.flowSessionId, taskKey: target, reviewTaskKey: entry.flowTaskKey })
+      if (!reverted.ok) persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review could not revert ${target}: ${reverted.error || reverted.ignored || 'unknown error'}` })
       process.stderr.write(`\n  ${A.yel}◆ review REJECT (round ${round}) — reverting ${target}: ${v.reasons.join('; ').slice(0, 120)}${A.rst}\n`)
     } else {
       process.stderr.write(`\n  ${A.cyan}◆ review ${decision.action.toUpperCase()} (round ${round}) — ${target || entry.flowTaskKey}${A.rst}\n`)
     }
+    // Durable room-visible verdict. `persistAgentEvent` below is intentionally
+    // filtered from the transcript (push/unread transport only), while this control
+    // row is archived with the reviewer lane and broadcast to both room members.
+    // In particular, a held review must show its exact findings instead of leaving
+    // the red task state unexplained after the ephemeral Flow broadcast is gone.
+    const visibleReview = {
+      kind: 'control',
+      text: `Flow review ${decision.action.toUpperCase()} — ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}`,
+    }
+    pushLog(entry, visibleReview)
+    bcast('code-event', { term: id, evt: visibleReview })
+    entry.flush?.()
     // P3 (pair co-adjudication) — surface the TERMINAL verdict into the ROOM as a
     // challengeable prompt, ALONGSIDE the gate action above. A solo Bugbot's verdict is
     // final; ours is a prompt for the two humans + Pool to argue. Additive: an extra
@@ -1828,13 +1868,31 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
         findings: v.reasons,
       }),
     }, flowChannel)
-    const doneMsg = await markFlowDone()
+    let doneMsg = ''
+    if (decision.action === 'pass') {
+      doneMsg = await markFlowDone({ reviewPass: true })
+    } else {
+      if (decision.action === 'surface') {
+        bcast('flow-review-held', { term: id, flowId: entry.flowSessionId, reviewTaskKey: entry.flowTaskKey, taskKey: target, reasons: v.reasons }, flowChannel)
+        persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review held ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}` })
+      }
+      // A reject must rebuild the target and then run a fresh reviewer. Retire that
+      // reviewer now. A surfaced inconclusive review is different: keep its lane
+      // alive with the durable control row above so either room member can open the
+      // held review, read the exact findings, and continue/adjudicate after reload.
+      // Neither outcome emits task-done or permits assembly.
+      if (decision.action === 'reject') {
+        entry.flowDone = true
+        entry.flush?.()
+        setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
+      }
+    }
     const label = decision.action === 'reject'
       ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 140)})`
       : decision.action === 'surface'
         ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${decision.reason}`
         : `PASS (round ${round})`
-    return { ok: true, message: `Review verdict recorded: ${label}. ${doneMsg}` }
+    return { ok: true, message: `Review verdict recorded: ${label}.${doneMsg ? ` ${doneMsg}` : ''}` }
   }
   // Identity for the durable archive — pushLog appends every new transcript event to
   // <room>/<id>.events.jsonl keyed off these. Seed the archive once from the restored
@@ -1880,7 +1938,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewRound: entry.flowReviewRound || 0, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -1962,7 +2020,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // OWN receipt card — no text reaches the other agent without a person at BOTH
       // ends. crossRoomPostDecision caps it at one per turn and blocks a room reached
       // via cross-room post from posting onward. Kill-switch: TP_PAIRBUS_OFF.
-      tool(
+      ...(!entry.flowRole ? [tool(
         'post_to_session',
         'Hand a task or message to an agent in ANOTHER of your ThinkPool Code sessions — your own room on this machine, or your partner\'s room reachable through the pair (a room code from list_sessions). Pass `session` (the room code), `text` (what to send), and optionally `terminal` (which agent lane in that room). A person in YOUR room approves sending AND a person in the TARGET room approves receiving before it is delivered. An agent reached this way cannot post onward to a third room. Read the target with read_session first, and use this sparingly — only when the people clearly want the rooms to coordinate.',
         {
@@ -1987,13 +2045,13 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           if (res?.error) return okText(res.error)
           return okText(res?.ok ? `Delivered to room ${target}${res.ref ? ` (lane ${res.ref})` : ''} — it will respond in its own room; check back with read_session.` : `Room ${target} did not accept the message.`)
         },
-      ),
+      )] : []),
       // Tier C — directed cross-lane action. WRITES into a sibling AGENT lane.
       // The PreToolUse gate (claude-session.mjs) already enforced: precheck passed
       // + a human approved the card. This handler routes only; it re-asserts the
       // bounds defensively. Targets AGENT terminals only (not human shells —
       // injecting keystrokes into someone's shell is out of scope for v1).
-      tool(
+      ...(!entry.flowRole ? [tool(
         'post_to_terminal',
         'Send a message or task to ANOTHER AGENT terminal in this ThinkPool Code room. Use `terminal` (a ref/id/command from read_terminal) and `text` (what to send). A person in the room must approve before it is delivered, and an agent reached via a cross-post cannot post onward. Targets agent terminals only, not plain shells. Use read_terminal first to understand the sibling.',
         {
@@ -2030,7 +2088,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           try { te.session.sendTurn(msg) } catch { return okText(`Could not deliver to terminal ${target.ref} — it may have just closed.`) }
           return okText(`Delivered to terminal ${target.ref} (${target.cmd}). It will respond in its own lane; check back with read_terminal.`)
         },
-      ),
+      )] : []),
       // Tier C+ — SPAWN a fresh agent lane the caller OWNS. The motivating bug:
       // an agent fanned a research task into SIBLINGS that were already busy (a
       // release lane, a Q&A lane) because it had no way to make its own lanes.
@@ -2041,13 +2099,14 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // cap, TP_SPAWN_OFF kill-switch). A person's lane (hop 0) may spawn conductors
       // (hop 1) which may spawn workers (hop 2); hop 2 can never spawn onward — the
       // fork-bomb breaker, now one level deeper (2026-07-10 cascade-spawn-depth spec).
-      tool(
+      ...(!entry.flowRole ? [tool(
         'spawn_terminal',
-        'Open a NEW agent terminal (Claude or Codex) in this ThinkPool Code room — YOUR lane to use, not a sibling that is already working. The runtime defaults to inheriting this lane, or pass `runtime` to dispatch across runtimes. Choose `model` explicitly from advertised metadata when practical: for Codex use Luna/Mini for mechanical work, Terra for ordinary feature/fix work, and Sol only for repeated-failure, architecture/conductor, or adversarial final-review work; never inherit Sol by default, and omit `model` for runtime fallback when the named tier is unavailable. Give the lane an initial `task`, collect its result later with read_terminal, then ALWAYS close_terminal it — a finished lane left open holds a slot against the room cap and blocks the next fan-out. By default the new lane INHERITS your current permission mode. ALWAYS prefer spawning a fresh lane over post_to_terminal into one that is already busy. Bounded by cascade depth, the room terminal cap, and per-turn limits.',
+        'Open a NEW agent terminal (Claude or Codex) in this ThinkPool Code room — YOUR lane to use, not a sibling that is already working. The runtime defaults to inheriting this lane, or pass `runtime` to dispatch across runtimes. Choose `model` explicitly from advertised metadata when practical: for Codex use Luna/Mini for mechanical work, Terra for ordinary feature/fix work, and Sol only for repeated-failure, architecture/conductor, or adversarial final-review work; never inherit Sol by default, and omit `model` for runtime fallback when the named tier is unavailable. For cascades, pass sliceType=scaffold for mechanical work, feature/fix for builders, and review for adversarial verification (review never routes to the cheap tier); an explicit model overrides slice tiering. Omit sliceType to preserve ordinary model inheritance/default behavior. Give the lane an initial `task`, collect its result with read_terminal, then ALWAYS close_terminal it — a finished lane left open holds a slot against the room cap and blocks the next fan-out. By default the new lane INHERITS your current permission mode. ALWAYS prefer spawning a fresh lane over post_to_terminal into one that is already busy. Bounded by cascade depth, the room terminal cap, and per-turn limits.',
         {
           name: z.string().max(80).optional().describe('a short label for the new lane so the room (and you) can find it, e.g. "Research: topologies"'),
           task: z.string().optional().describe('an initial task to hand the new lane immediately; omit to open it idle'),
           model: z.string().optional().describe('optional model for the chosen runtime, e.g. opus / sonnet / gpt-5.6-sol'),
+          sliceType: z.enum(['scaffold', 'feature', 'fix', 'review']).optional().describe('optional cascade slice tier; omitted preserves normal inheritance/default, explicit model wins'),
           runtime: z.enum(['claude', 'codex']).optional().describe('agent runtime for the new lane; defaults to inheriting this lane'),
           provider: z.string().optional().describe('optional registered LLM provider id to run this lane on (from the account\'s provider registry); omit for the default Claude/Anthropic path'),
           mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('permission mode for the new lane; defaults to inheriting YOUR current mode. Raising a lane to bypassPermissions from a non-bypass lane asks the room to confirm once.'),
@@ -2056,6 +2115,16 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
           const childRuntime = args?.runtime || entry.runtime || 'claude'
           if (childRuntime === 'codex' && args?.provider) return okText('A Codex lane uses its Codex/OpenAI login in v1; custom bridge providers are not wired to Codex yet. Omit provider or spawn a Claude lane for that provider.')
+          const childCatalog = childRuntime === 'codex' ? readCodexModels() : []
+          if (childRuntime === 'codex' && args?.model && !modelCatalogValues(childCatalog).has(args.model)) {
+            return okText(`Could not open a Codex lane on ${JSON.stringify(args.model)} — that model is not in this host's visible Codex catalog.`)
+          }
+          if (childRuntime === 'claude' && !args?.provider && args?.model && /^gpt-/i.test(args.model)) {
+            return okText(`Could not open a Claude lane on Codex model ${JSON.stringify(args.model)}. Choose runtime="codex" or a Claude model.`)
+          }
+          const childModel = args?.model || (args?.sliceType
+            ? spawnedLaneModelFor({ sliceType: args.sliceType, runtime: childRuntime, catalog: childCatalog })
+            : undefined)
           const now = Date.now()
           const gate = spawnDecision({
             hop: entry.hop || 0,
@@ -2090,7 +2159,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           // plan-mode lane would stall on ExitPlanMode cards. An explicit args.mode still wins;
           // otherwise inherit, but fall plan → default (an autonomous worker doesn't plan-gate).
           const childMode = args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode)
-          openStructured({ id: newId, runtime: childRuntime, model: args?.model, provider: args?.provider, mode: childMode })
+          openStructured({ id: newId, runtime: childRuntime, model: childModel, provider: args?.provider, mode: childMode })
           const ne = sessions.get(newId)
           if (!ne) { if (args?.name) { delete termNames[newId]; saveNames(room, termNames) } return okText('Could not open a new lane — the terminal cap may have just been reached. Close one and retry.') }
           ne.spawnedBy = id   // ownership: only the spawner may close_terminal it
@@ -2109,11 +2178,11 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           }
           return okText(`Opened idle agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''}. Hand it work with post_to_terminal, or a person can type into it.`)
         },
-      ),
+      )] : []),
       // Research lane — run a REAL multi-source search + adversarial verification and
       // return sourced, verdict-tagged findings. Calls the verified web backend
       // (/api/research-run) as the room owner; plan-gated + budget-capped server-side.
-      tool(
+      ...(!entry.flowRole ? [tool(
         'research',
         'Run a REAL multi-source web research + verification on a factual question and surface sourced, verdict-tagged findings to the room. Use when the people would genuinely benefit from looking something up or settling an external-fact question — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over current facts. OFFER it first in plain language ("want me to spawn a research lane on that?") and only call it once they agree — it spends (plan-gated: Free 5 / Plus 100 runs per month) and takes ~1 minute. It searches the web, reads sources, and returns each claim marked HELD or REJECTED with citations. Present the findings clearly and let both people weigh the sources.',
         {
@@ -2144,13 +2213,13 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
             `\n\nPresent these to the room and let both people weigh the sources — flag which held claims rest on a source they might not trust.`
           )
         },
-      ),
+      )] : []),
       // Tier C+ — CLOSE a lane the caller spawned. Restricted to self-spawned agent
       // lanes (spawnedBy === this id): an agent must never be able to kill a sibling
       // someone else is working in, nor the host/attached terminal. The fan-out
       // cleanup half of spawn_terminal. Routes through endStructured (same path as
       // the web's code-close), which no-ops if the id isn't a live session.
-      tool(
+      ...(!entry.flowRole ? [tool(
         'close_terminal',
         'Close an agent lane that YOU opened with spawn_terminal (identified by ref/id/name). You can only close lanes you spawned yourself — never a sibling someone else is working in, and never the main terminal. Use it to clean up after a fan-out once you have collected the results with read_terminal.',
         {
@@ -2167,38 +2236,47 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
           endStructured(target.id)
           return okText(`Closed agent lane ${target.ref}${target.name ? ` ("${target.name}")` : ''}.`)
         },
-      ),
+      )] : []),
       // Flow lane → mark this slice done (lane-done return path). Reads the lane's
       // worktree HEAD as commit_sha (the atomic-revert target) + broadcasts
       // flow-task-done → the room flips the task done + dispatches the next wave
       // (slices whose deps just got satisfied).
-      tool(
+      ...(entry.flowRole === 'builder' ? [tool(
         'mark_flow_done',
         "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). No arguments: your commit is read from your worktree. Do not call before your slice actually runs + meets acceptance.",
         {},
         async () => ({ content: [{ type: 'text', text: await markFlowDone() }] }),
-      ),
+      )] : []),
       // FL-B1 — the conductor SUBMITS its decomposition through THIS tool, not the built-in
       // ExitPlanMode. In the current SDK, ExitPlanMode is a deferred tool the conductor must
       // ToolSearch for — and it hangs there, wedging every flow in `planning`. A dedicated MCP
       // tool removes all dependence on plan-mode/ExitPlanMode/deferred-tool discovery: validate
       // the task-graph here, broadcast flow-plan (the same path the old interception used), and
       // reject malformed plans back to the conductor so it re-emits.
-      tool(
+      ...(entry.flowRole === 'conductor' ? [tool(
         'submit_flow_plan',
         'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line>","tasks":[{"key":"<kebab>","title":"…","scope":"…","acceptance":"…","deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. The room validates it is an acyclic DAG, persists the tasks, and shows the approval card. This is how a conductor FINISHES — do NOT use ExitPlanMode, do NOT write a plan file.',
         { plan: z.string().describe('the task-graph as a JSON string (the {summary, tasks:[…]} object)') },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
-          if (!entry.flowSessionId) return okText('Not a Flow conductor — there is no flow to submit a plan for.')
+          if (!entry.flowSessionId || entry.flowRole !== 'conductor') return okText('Not a Flow conductor — there is no flow to submit a plan for.')
           let norm
-          try { norm = normalizePlanOutput(args?.plan || '') }
+          try { norm = validatePlanForRuntime(normalizePlanOutput(args?.plan || ''), entry.runtime) }
           catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.`) }
           bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
           process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
           return okText(`Plan submitted (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) — the room is showing the human an approval card. You are DONE; stop here and wait for approval (lane dispatch is the room's job).`)
         },
-      ),
+      )] : []),
+      ...(entry.flowRole === 'reviewer' ? [tool(
+        'submit_flow_review',
+        'ThinkPool Flow REVIEWER ONLY — submit one bounded adversarial review round. Pass `verdict` as JSON: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"authorized reviewed task","exhausted":boolean}. This is the only review completion path; do not call mark_flow_done and do not write FLOW_REVIEW.json.',
+        { verdict: z.string().describe('the structured review verdict as a JSON string') },
+        async (args) => {
+          const result = await onReviewVerdict(args?.verdict || '')
+          return { content: [{ type: 'text', text: result.message }] }
+        },
+      )] : []),
     ],
   })
   // S5 (slice 1b) — the review-lane write-block, wired into the live PreToolUse path.
@@ -2265,15 +2343,15 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     // A Flow CONDUCTOR (flowSessionId set, no flowTaskKey) must DECOMPOSE, not explore via
     // a fan-out of Task/Explore subagents, and must not build. Hard-block Task/Bash/Write for
     // conductors so it reads with Read/Grep/Glob and submits via the FLOW_PLAN.json sentinel.
-    blockSubagents: !!flowSessionId && !flowTaskKey,
+    blockSubagents: entry.flowRole === 'conductor',
     // FL-B1 — the conductor submits its task-graph by Writing FLOW_PLAN.json; the PreToolUse
     // hook intercepts that Write and calls this. Validate the DAG and broadcast flow-plan (the
     // client persists it + shows the approval card); a malformed plan comes straight back to
     // the conductor as the tool result so it re-emits. Returns { ok, message }.
     onSubmitPlan: (planText) => {
-      if (!entry.flowSessionId) return { ok: false, message: 'Not a Flow conductor — nothing to submit.' }
+      if (!entry.flowSessionId || entry.flowRole !== 'conductor') return { ok: false, message: 'Not a Flow conductor — nothing to submit.' }
       let norm
-      try { norm = normalizePlanOutput(planText || '') }
+      try { norm = validatePlanForRuntime(normalizePlanOutput(planText || ''), entry.runtime) }
       catch (e) { return { ok: false, message: `Plan REJECTED: ${e?.message || e}. Re-Write FLOW_PLAN.json with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.` } }
       bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
       process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
@@ -2281,9 +2359,9 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     },
     // FL-B1 (lane side) — a flow lane signals slice-done by Writing FLOW_DONE; the hook
     // routes that Write here (mark_flow_done MCP tool is deferred → ToolSearch → hangs).
-    onLaneDone: flowTaskKey ? (async () => ({ ok: true, message: await markFlowDone() })) : null,
+    onLaneDone: entry.flowRole === 'builder' ? (async () => ({ ok: true, message: await markFlowDone() })) : null,
     // FL-B4 — a review lane records its verdict via FLOW_REVIEW.json (revert-on-fail).
-    onReviewVerdict: flowTaskKey ? onReviewVerdict : null,
+    onReviewVerdict: entry.flowRole === 'reviewer' ? onReviewVerdict : null,
     mcpServers: { thinkpool: peekServer },
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
@@ -2316,15 +2394,32 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
     onEvent: (evt) => {
       // Self-heal a stale resume — the saved SDK session expired. Reopen fresh,
       // keeping the transcript (scrollback survives; live context is gone).
-      if (resume && !entry.recovered && evt.kind === 'error' && /No conversation found/i.test(evt.message || '')) {
-        entry.recovered = true
-        process.stderr.write(`\n  ◆ saved session expired — starting fresh (transcript kept).\n`)
-        try { entry.session?.end() } catch { /* noop */ }
-        try { entry.mockupWatcher?.close() } catch { /* noop */ }
-        try { void entry.viewport?.stop()?.catch(() => {}) } catch { /* noop */ }
-        sessions.delete(id)
-        openStructured({ id, runtime: entry.runtime, model, log: entry.log, commands: entry.commands, mode: entry.mode, provider: entry.provider, spawnedBy: entry.spawnedBy, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, rolePrompt: entry.rolePrompt, cwd: entry.cwd, managedWorktree: entry.managedWorktree })
-        return
+      if (resume && evt.kind === 'error') {
+        const recoveryRecap = entry.interruptedRecap || buildRecapFromLog(entry.log, RECAP_CAP)
+        const recovery = recoverMissingResumeOnce(entry, {
+          message: evt.message,
+          recap: recoveryRecap,
+          reopen: (carryRecap) => {
+            try { entry.mockupWatcher?.close() } catch { /* noop */ }
+            sessions.delete(id)
+            openStructured({
+              id, runtime: entry.runtime, model: entry.model || model, effort: entry.effort,
+              provider: entry.provider, log: entry.log, commands: entry.commands, mode: entry.mode,
+              spawnedBy: entry.spawnedBy, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, flowSessionId: entry.flowSessionId,
+              flowTaskKey: entry.flowTaskKey, flowRole: entry.flowRole, flowReviewTarget: entry.flowReviewTarget,
+              flowReviewTargets: entry.flowReviewTargets, flowReviewRound: entry.flowReviewRound,
+              dispatchBaseSha: entry.dispatchBaseSha, revertTarget: entry.revertTarget, cwd: entry.cwd,
+              managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt,
+              reviewSliceRoots: entry.reviewSliceRoots, openedAt: entry.openedAt,
+              lastUsage: entry.lastUsage, carryRecap,
+            })
+            return sessions.get(id) || null
+          },
+        })
+        if (recovery.recovered) {
+          process.stderr.write(`\n  ◆ saved session expired — started fresh with transcript recap (${recovery.delivery}).\n`)
+          return
+        }
       }
       // Stamp a wall-clock ts AND a stable cid on every transcript event before
       // it's logged + broadcast. ts: lets the web client sort agent turns
@@ -2398,7 +2493,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // explicit signal (FLOW_DONE / mark_flow_done), which left the slice stuck 'dispatched'
       // forever → the flow never assembled. Auto-record on turn-end (idempotent — markFlowDone
       // no-ops if already done, so the explicit sentinel still works as the fast path).
-      if (entry.flowSessionId && entry.flowTaskKey && evt.kind === 'result' && !entry.flowDone) {
+      if (entry.flowSessionId && entry.flowTaskKey && !entry.flowDone && legacyBuilderCompletionAllowed({ runtime: entry.runtime, flowRole: entry.flowRole, eventKind: evt.kind, eventSubtype: evt.subtype })) {
         Promise.resolve().then(() => markFlowDone()).catch(() => { /* best-effort */ })
       }
       // The init system event carries the session's slash command list. Stash it
@@ -2419,11 +2514,8 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // human turn arrived first, the code-turn handler already consumed + cleared it
       // (prepended to that turn), so this no-ops. Spec: docs/specs/2026-07-08-provider-switch-context-carry.md.
       if (evt.kind === 'system' && entry.pendingRecap) {
-        const recap = entry.pendingRecap
-        entry.pendingRecap = null
-        entry.flush?.()
-        try { entry.session?.sendTurn(recap) } catch { /* not live — stays idle, user can continue manually */ }
-        process.stderr.write(`\n  ◆ carried ${recap.length}c context recap into fresh session (${id.slice(0, 8)}) after provider/restore switch.\n`)
+        const recapLength = entry.pendingRecap.length
+        if (dispatchPendingRecap(entry)) process.stderr.write(`\n  ◆ carried ${recapLength}c context recap into fresh session (${id.slice(0, 8)}) after provider/restore switch.\n`)
       }
       // A background-warmed terminal is now live — free its warmer slot so the next queued
       // idle terminal starts booting.
@@ -2730,7 +2822,7 @@ function respawnStructured(id, provider) {
   // openStructured seed from the TARGET provider's configured model, which is the
   // only model this lane was ever asked for. A same-env model change never reaches
   // here — that path is an in-place setModel (see provider-switch).
-  const { runtime, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  const { runtime, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -2749,7 +2841,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
+  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, sideParent, sideTask, pendingSideContexts, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap })
   return true
 }
 
@@ -3530,49 +3622,32 @@ channel
           const okey = (r) => r._bt || r.openedAt || r.savedAt || 0
           all.sort((a, b) => okey(a) - okey(b))
           if (all.length) for (const rec of all) {
+            const wasInterrupted = restoredTurnOpen(rec.log || [])
+            const resumable = canResume(rec)
+            const recoveryRecap = wasInterrupted ? buildRecapFromLog(rec.log || [], RECAP_CAP) : ''
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, effort: rec.effort, provider: rec.runtime === 'codex' ? undefined : rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, sideParent: rec.sideParent, sideTask: rec.sideTask, pendingSideContexts: rec.pendingSideContexts, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, carryRecap: rec.carryRecap,
+            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, effort: rec.effort, provider: rec.runtime === 'codex' ? undefined : rec.provider || undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, sideParent: rec.sideParent, sideTask: rec.sideTask, pendingSideContexts: rec.pendingSideContexts, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewRound: rec.flowReviewRound, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).
-              defer: !rec.flowSessionId && !restoredTurnOpen(rec.log || []) })
+              defer: !rec.flowSessionId && !wasInterrupted })
             const re = sessions.get(rec.id)
-            if (re && rec.flowReviewTarget) re.flowReviewTarget = rec.flowReviewTarget
-            // S4 — a resumed re-dispatch lane keeps its surviving revert target across a bridge restart.
-            if (re && rec.revertTarget) re.revertTarget = rec.revertTarget
             // FL-M6 — a flow LANE whose turn had already ENDED before the restart finished its
             // slice, but its done-signal was lost while the bridge was down (resume won't re-run
             // an ended turn, so it would sit idle → the flow stalls forever). Reconcile: re-record
             // it done. A lane still MID-turn (restoredTurnOpen) resumes + finishes normally.
-            if (re && rec.flowTaskKey && !restoredTurnOpen(rec.log || [])) {
+            const lastTerminal = [...(rec.log || [])].reverse().find((event) => event?.kind === 'result' || event?.kind === 'error')
+            if (re && rec.flowTaskKey && legacyBuilderCompletionAllowed({ runtime: re.runtime, flowRole: re.flowRole, eventKind: lastTerminal?.kind, eventSubtype: lastTerminal?.subtype, interrupted: wasInterrupted })) {
               setTimeout(() => { try { re.markFlowDone?.() } catch { /* noop */ } }, 2000)
             }
-            // Auto-resume (Max, 2026-07-02): a PLAIN terminal (NOT a flow lane — those have their
-            // own re-dispatch) that was MID-TURN when the bridge stopped picks the work back up
-            // instead of sitting aborted. If its SDK context resumes (canResume), send ONE
-            // "continue" — like the user typing "continue" after a restart. We DON'T fire on a
-            // fixed timer: a resume takes ~40s to become live (MCP boot + sanitizeSession), and a
-            // 2.5s sendTurn pushed into an input stream nothing is consuming yet is silently lost
-            // (the 2026-07-02 "didn't autocontinue" bug). Instead FLAG it here and fire the single
-            // continue when the session's init `system` event actually arrives (onEvent), i.e. the
-            // instant it's live. openStructured already closed the interrupted turn idle, so a
-            // continue that can't be delivered just leaves it idle (recoverable) — never a hang.
-            if (re && !rec.flowSessionId && canResume(rec) && restoredTurnOpen(rec.log || [])) {
-              const recovery = armInterruptedResume(re)
+            // Every interrupted role resumes exactly once. Flow lanes do not have a
+            // startup redispatch path; excluding them here stranded conductors/builders.
+            if (re && wasInterrupted) {
+              const recovery = recoverInterruptedTurn(re, { resumable, recap: recoveryRecap })
               if (recovery === 'sent') process.stderr.write(`\n  ◆ auto-resumed interrupted Codex turn (${rec.id.slice(0, 8)}) — sent continue.\n`)
-            }
-            // Context-carry (2026-07-08): the SAME mid-turn case but the SDK context CANNOT
-            // resume (canResume false — a stale/expired session). A bare "continue" would land
-            // in a blank backend, so instead carry a plain-text recap of the visible log as the
-            // first turn — the interrupted work resumes WITH its history. Mid-turn only
-            // (restoredTurnOpen): we never arm an unprompted turn on an idle restored lane (its
-            // transcript stays visible; the person starts their next request fresh). If the
-            // person types before this recap fires, the code-turn handler prepends it instead.
-            // Flow lanes re-dispatch separately (excluded above).
-            else if (re && !rec.flowSessionId && !canResume(rec) && restoredTurnOpen(rec.log || [])) {
-              re.pendingRecap = buildRecapFromLog(rec.log || [], RECAP_CAP)
+              else if (recovery === 'recap-sent') process.stderr.write(`\n  ◆ resumed interrupted Codex turn (${rec.id.slice(0, 8)}) with a fresh context recap.\n`)
             }
           }
           // Fresh open: ONLY for an explicit `-- <claude>` share. In account mode
@@ -3612,6 +3687,36 @@ channel
     }
   })
 
+async function handleFlowRevert(payload) {
+  try {
+    return await executeFlowRevert({
+      payload,
+      bridgeName: name,
+      lanes: [...sessions.entries()],
+      prepareLane: (entry, p) => prepareRedispatch({
+        lane: { cwd: entry.cwd, session: entry.session, commitSha: entry.commitSha, revertTarget: p.commitSha ?? entry.commitSha ?? entry.revertTarget ?? null },
+        sanitize: sanitizeSession,
+      }),
+      rememberRedispatch: (prepared, _entry, p) => {
+        flowRedispatch.set(redispatchKey(p.flowId, p.taskKey), { resumeSessionId: prepared.resumeSessionId, revertTarget: prepared.revertTarget })
+        if (prepared.healed) process.stderr.write(`\n  ${A.dim}◆ flow re-dispatch heal — ${p.taskKey}: ${prepared.healed} dangling tool block(s) healed before resume.${A.rst}\n`)
+      },
+      endLane: (laneId) => { try { endStructured(laneId) } catch { /* already gone */ } },
+      stopPreview: stopFlowPreviews,
+      wait: () => new Promise((resolve) => setTimeout(resolve, 400)),
+      revert: (p) => revertLane({ flowId: p.flowId, taskKey: p.taskKey }),
+      broadcastReverted: (out) => {
+        bcast('flow-reverted', { term: 'flow', flowId: out.flowId, taskKey: out.taskKey, reviewTaskKey: out.reviewTaskKey, branch: out.branch }, flowChannel)
+        process.stderr.write(`\n  ${A.yel}◆ flow slice reverted — ${out.taskKey} (${out.branch}).${A.rst}\n`)
+      },
+      onPrepError: (error, _entry, p) => process.stderr.write(`\n  ${A.yel}◆ flow re-dispatch prep failed (${p.taskKey}): ${error?.message || error} — will re-dispatch fresh.${A.rst}\n`),
+    })
+  } catch (error) {
+    process.stderr.write(`\n  ${A.yel}◆ flow revert failed: ${error?.message || error}${A.rst}\n`)
+    return { ok: false, error: error?.message || String(error) }
+  }
+}
+
 // ── Thinkpool Flow control channel (tpflow:<room>) ──────────────────────────
 // Separate from the room channel above so the web's useFlow hook can own its own
 // topic without colliding with the room's tpcode channel (see the flowChannel def +
@@ -3630,6 +3735,16 @@ flowChannel
     if (!payload?.flowId) return
     if (payload.host && payload.host !== name) return
     for (const [, e] of sessions) if (e.flowSessionId === payload.flowId) return   // already conducting this flow
+    const origin = payload.originTerm ? sessions.get(payload.originTerm) : null
+    // A current client names the invoking terminal. Only the bridge that actually
+    // owns that terminal may launch its conductor; never trust a spoofed runtime/model
+    // from a broadcast received by another machine. Legacy clients omitted originTerm
+    // and were Claude-only, so that exact path remains supported.
+    if (payload.originTerm && !origin) return
+    const flowRuntime = origin ? normalizeFlowRuntime(origin.runtime, null) : 'claude'
+    if (!flowRuntime) return
+    const flowCatalog = flowRuntime === 'codex' ? (origin?.models || readCodexModels()) : []
+    const conductorModel = flowConductorModelFor({ runtime: flowRuntime, originModel: origin?.model, catalog: flowCatalog })
     const cid = randomUUID()
     termNames[cid] = `Flow · ${String(payload.flowId).slice(0, 6)}`
     saveNames(room, termNames)
@@ -3640,7 +3755,7 @@ flowChannel
     // Model tiers (2026-07-03-flow-lane-model-tiers): the conductor keeps whatever brain it was
     // given by default (TP_FLOW_CONDUCTOR_MODEL unset → undefined → today's behavior); set the env
     // to pin a cheaper/smarter conductor. Lanes get tiered below via laneModelFor.
-    openStructured({ id: cid, model: process.env.TP_FLOW_CONDUCTOR_MODEL || undefined, mode: 'default', rolePrompt: FLOW_CONDUCTOR_PROMPT, flowSessionId: payload.flowId, spawnedBy: `flow:${payload.flowId}` })
+    openStructured({ id: cid, runtime: flowRuntime, model: conductorModel, mode: flowRuntime === 'codex' ? 'plan' : 'default', rolePrompt: flowRuntime === 'codex' ? FLOW_CODEX_CONDUCTOR_PROMPT : FLOW_CONDUCTOR_PROMPT, flowSessionId: payload.flowId, flowRole: 'conductor', spawnedBy: `flow:${payload.flowId}` })
     const ce = sessions.get(cid)
     if (ce?.session) { try { ce.session.sendTurn(payload.prompt || '') } catch { /* session still starting */ } }
     process.stderr.write(`\n  ${A.mag}◆ flow conductor launched — flow ${String(payload.flowId).slice(0, 8)} (plan mode).${A.rst}\n`)
@@ -3654,6 +3769,14 @@ flowChannel
     // building (DB writes stay room-side, member-authed).
     if (!payload?.flowId || !Array.isArray(payload.tasks)) return
     if (payload.host && payload.host !== name) return
+    const conductor = [...sessions.values()].find((entry) => entry.flowSessionId === payload.flowId && entry.flowRole === 'conductor')
+    if (!conductor) {
+      process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — this bridge has no live/restored conductor for ${String(payload.flowId).slice(0, 8)}.${A.rst}\n`)
+      return
+    }
+    const flowRuntime = normalizeFlowRuntime(conductor.runtime, null)
+    if (!flowRuntime) return
+    const flowCatalog = flowRuntime === 'codex' ? (conductor.models || readCodexModels()) : []
     const assignments = []
     // Step 6 — cap concurrent Flow lanes (invariant: ≤ FLOW_LIMITS.maxConcurrentLanes).
     // Overflow tasks stay pending; the room re-dispatches them in the next wave.
@@ -3682,7 +3805,13 @@ flowChannel
         // Step 4 — a `review` slice gets the adversarial reviewer prompt (try-to-break),
         // every other slice gets the builder prompt.
         const isReview = t.slice_type === 'review'
+        if (!validReviewTargetShape(t, flowRuntime)) {
+          process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — Codex review ${t.task_key} must target exactly one dependency.${A.rst}\n`)
+          continue
+        }
         const { dir } = createFlowWorktree({ flowId: payload.flowId, taskKey: t.task_key })
+        let dispatchBaseSha = null
+        try { dispatchBaseSha = execFileSync('git', ['-C', dir, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* non-git fixture */ }
         const laneId = randomUUID()
         termNames[laneId] = `Flow · ${t.task_key}`
         saveNames(room, termNames)
@@ -3715,12 +3844,14 @@ flowChannel
         // a lane later, on demand, via activateLaneSkill — never the base prompt here.
         // S4 — resume: on a re-dispatch, replay the killed lane's HEALED transcript (Heal-3'd,
         // no dangling tool_use → no 400) instead of a cold start; undefined for a fresh lane.
-        const laneBase = isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT
+        const laneBase = flowRuntime === 'codex'
+          ? (isReview ? FLOW_CODEX_REVIEWER_PROMPT : FLOW_CODEX_LANE_PROMPT)
+          : (isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT)
         const laneRolePrompt = buildLanePrompt({ base: laneBase })
         // Model tiers (2026-07-03-flow-lane-model-tiers): pick the lane's brain by slice_type
         // (scaffold→sonnet, feature/fix/review→opus; env can blanket-override or `inherit` to
         // restore today's exact behavior). undefined → no model key passed (openStructured default).
-        openStructured({ id: laneId, cwd: dir, model: laneModelFor(t.slice_type), mode: 'bypassPermissions', rolePrompt: laneRolePrompt, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}`, resume: redispatch?.resumeSessionId || undefined, reviewSliceRoots })
+        openStructured({ id: laneId, runtime: flowRuntime, cwd: dir, model: flowLaneModelFor({ sliceType: t.slice_type, runtime: flowRuntime, catalog: flowCatalog }), mode: flowRuntime === 'codex' && isReview ? 'review' : 'bypassPermissions', rolePrompt: laneRolePrompt, flowSessionId: payload.flowId, flowTaskKey: t.task_key, flowRole: isReview ? 'reviewer' : 'builder', flowReviewTargets: isReview ? (t.deps || []) : [], dispatchBaseSha, revertTarget: redispatch?.revertTarget || null, spawnedBy: `flow:${payload.flowId}`, resume: redispatch?.resumeSessionId || undefined, reviewSliceRoots })
         const le = sessions.get(laneId)
         if (le) {
           // S4 — stamp the surviving revert target on the resumed lane so a later reviewer still
@@ -3745,7 +3876,9 @@ flowChannel
                   : '') +
                 `ACCEPTANCE to INDEPENDENTLY verify: ${t.acceptance || t.title}\n` +
                 `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
-                `Review it — run it, hunt for failure. When done, use the Write tool to write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}. That Write IS your verdict.`
+                (flowRuntime === 'codex'
+                  ? `Review it without mutating the builder worktree. For write-producing install/build/test commands, copy its source into scratch under your own current worktree first. Submit the structured verdict with the ThinkPool submit_flow_review MCP tool; never write FLOW_REVIEW.json or call mark_flow_done.`
+                  : `Review it — run it, hunt for failure. When done, use the Write tool to write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}. That Write IS your verdict.`)
               : `[Flow lane — slice "${t.task_key}" of flow ${String(payload.flowId).slice(0, 8)}]\n` +
                 `TITLE: ${t.title}\n` +
                 `SCOPE (files you OWN — edit ONLY these): ${t.scope || '(none stated)'}\n` +
@@ -3757,7 +3890,8 @@ flowChannel
                 ((crossWave) => crossWave ? `${crossWave}\n` : '')(
                   assembleCrossWaveContext(payload.flowId, { baseDir: process.cwd(), deps: t.deps }).text) +
                 `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
-                `Build your slice. Own only your files. Done = it runs + meets acceptance. Commit when done.`
+                `Build your slice. Own only your files. Done = it runs + meets acceptance. Commit when done.` +
+                (flowRuntime === 'codex' ? ` Then call the ThinkPool mark_flow_done MCP tool; do not write FLOW_DONE.` : '')
             try { le.session.sendTurn(spec) } catch { /* session still starting */ }
           }
         }
@@ -3809,45 +3943,7 @@ flowChannel
     // Step 4 — atomic per-lane revert: roll back ONE slice (remove its worktree +
     // branch) without touching the others, when adversarial review rejects it. The
     // room re-dispatches the reverted task on the next wave.
-    if (!payload?.flowId || !payload?.taskKey) return
-    if (payload.host && payload.host !== name) return
-    try {
-      // FL-M8 — tear down the lane's live session FIRST. revertLane does `git worktree
-      // remove --force`; pulling the worktree out from under a still-running lane corrupts
-      // its process state. Retire it, let the SDK release the cwd, THEN remove the tree.
-      let killed = false
-      for (const [sid, e] of sessions) {
-        if (e.flowSessionId === payload.flowId && e.flowTaskKey === payload.taskKey && !e.flowDone) {
-          // S4 slice 2 — prepare a CLEAN re-dispatch BEFORE we kill the lane + remove its
-          // worktree. prepareRedispatch heals the transcript (Heal-3 consumer — a dangling
-          // tool_use from a mid-tool-call kill gets a synthetic tool_result so a resume can't
-          // 400) and captures the resume sessionId + the revert target (which revertLane's
-          // branch delete would otherwise destroy). We record it under flowId::taskKey so the
-          // next flow-dispatch wave resumes the healed session. Idempotent: healing an
-          // already-clean transcript is a no-op. No per-lane topic is captured — the resumed
-          // lane reuses the room-wide tpflow broadcast, so there is no H41 collision to guard.
-          try {
-            const prep = prepareRedispatch({
-              lane: { cwd: e.cwd, session: e.session, commitSha: e.commitSha, revertTarget: payload.commitSha ?? e.commitSha ?? null },
-              sanitize: sanitizeSession,
-            })
-            flowRedispatch.set(redispatchKey(payload.flowId, payload.taskKey), {
-              resumeSessionId: prep.resumeSessionId,
-              revertTarget: prep.revertTarget,
-            })
-            if (prep.healed) process.stderr.write(`\n  ${A.dim}◆ flow re-dispatch heal — ${payload.taskKey}: ${prep.healed} dangling tool block(s) healed before resume.${A.rst}\n`)
-          } catch (err) { process.stderr.write(`\n  ${A.yel}◆ flow re-dispatch prep failed (${payload.taskKey}): ${err?.message || err} — will re-dispatch fresh.${A.rst}\n`) }
-          e.flowDone = true
-          try { endStructured(sid) } catch { /* already gone */ }
-          stopFlowPreviews(payload.flowId, sid)   // FL-M9 — drop the reverted lane's preview
-          killed = true
-        }
-      }
-      if (killed) await new Promise((r) => setTimeout(r, 400))
-      const { branch } = revertLane({ flowId: payload.flowId, taskKey: payload.taskKey })
-      bcast('flow-reverted', { term: 'flow', flowId: payload.flowId, taskKey: payload.taskKey, branch }, flowChannel)
-      process.stderr.write(`\n  ${A.yel}◆ flow slice reverted — ${payload.taskKey} (${branch}).${A.rst}\n`)
-    } catch (e) { process.stderr.write(`\n  ${A.yel}◆ flow revert failed: ${e?.message || e}${A.rst}\n`) }
+    await handleFlowRevert(payload)
   })
   .on('broadcast', { event: 'flow-cancel' }, ({ payload }) => {
     // A user cancelled the flow (or it was interrupted). The client also flips the DB

package/codex-session.mjs

@@ -39,6 +39,7 @@ export const CODEX_MODE_CONFIG = {
   default:           { sandbox: 'workspace-write', approvalPolicy: 'untrusted' },
   acceptEdits:       { sandbox: 'workspace-write', approvalPolicy: 'on-request' },
   plan:              { sandbox: 'read-only',       approvalPolicy: 'never' },
+  review:            { sandbox: 'workspace-write', approvalPolicy: 'never' },
   bypassPermissions: { sandbox: 'danger-full-access', approvalPolicy: 'never' },
 }
 
@@ -73,6 +74,15 @@ export function defaultModeForRuntime(runtime) {
   return runtime === 'codex' ? 'bypassPermissions' : 'default'
 }
 
+export function codexWritableDirsForSandbox(sandbox, writableDirs = []) {
+  return normalizeCodexSandbox(sandbox) === 'read-only' ? [] : writableDirs
+}
+
+export function codexExtraWritableDirsForMode(mode, sandbox, writableDirs = []) {
+  if (mode === 'review') return []
+  return codexWritableDirsForSandbox(sandbox, writableDirs)
+}
+
 export function readCodexDefaultModel({ home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), fsImpl = fs } = {}) {
   try {
     const text = fsImpl.readFileSync(path.join(home, 'config.toml'), 'utf8')
@@ -183,11 +193,15 @@ export function codexPublishAccess({ cwd, env = process.env, tmpdir = os.tmpdir(
   }
 }
 
+export const CODEX_ROOM_CASCADE_REMINDER = [
+  'THINKPOOL ROOM WORKFLOW: delegated work belongs in visible spawn_terminal lanes, never hidden in-process subagents. Each lane owns its own worktree. For a genuinely decomposable task, state a short plan in chat, use sliceType scaffold for mechanical work, feature/fix for builders, and review for adversarial verification; review must use a balanced model tier. Read results, verify the integrated outcome, and close every lane you spawned so it does not consume room capacity.',
+].join(' ')
+
 export function buildCodexPrompt({ text, rolePrompt, roomContext, firstTurn = false }) {
   const context = typeof roomContext === 'function' ? roomContext() : roomContext
   const additions = [
     firstTurn ? CODEX_THINKPOOL_FIRST_TURN_PREAMBLE : '',
-    rolePrompt,
+    rolePrompt || CODEX_ROOM_CASCADE_REMINDER,
     context,
   ].map((v) => String(v || '').trim()).filter(Boolean)
   if (!additions.length) return String(text ?? '')
@@ -470,7 +484,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         appServer = appServerFactory({
           cwd,
           env: childEnv,
-          args: buildCodexAppServerArgs({ providerConfig, mcpUrl: peer?.url, writableDirs: publishAccess.writableDirs }),
+          args: buildCodexAppServerArgs({ providerConfig, mcpUrl: peer?.url, writableDirs: codexExtraWritableDirsForMode(activeMode, sandbox, publishAccess.writableDirs) }),
           onNotification: appServerNotification,
           onServerRequest: appServerRequest,
           onClose: (error) => {
@@ -572,7 +586,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       approvalPolicy: modeConfig.approvalPolicy,
       providerConfig,
       mcpUrl: peer?.url,
-      writableDirs: publishAccess.writableDirs,
+      writableDirs: codexExtraWritableDirsForMode(activeMode, sandbox, publishAccess.writableDirs),
       images: Array.isArray(options.images) ? options.images : [],
       prompt,
     })

package/design-edit.mjs

@@ -48,6 +48,15 @@ export function resolveDesignSource(file, workspaceRoot) {
   return { previewId, revision, sourcePath, workspaceRoot: root, source }
 }
 
+// Older lane worktrees predate the explicit `source` manifest field and emit the
+// authored mockup path as `html` only. Preserve the explicit field when present;
+// otherwise let the same containment/generated-output checks decide whether the
+// HTML path is canonical editable source or view-only render evidence.
+export function resolveManifestDesignSource(manifest, workspaceRoot) {
+  if (!manifest || typeof manifest !== 'object') return null
+  return resolveDesignSource(manifest.source || manifest.html, workspaceRoot)
+}
+
 // Design provenance is intentionally host-only, but it must survive a bridge
 // restart. Rebuild the in-memory registry from manifests already written by the
 // trusted lane render workflow; do not re-upload or re-broadcast old cards.
@@ -68,8 +77,7 @@ export function restoreDesignSources(box, workspaceRoot, term, limit = 100) {
   for (const { file } of files) {
     try {
       const manifest = JSON.parse(fs.readFileSync(file, 'utf8'))
-      if (!manifest?.source) continue
-      const record = resolveDesignSource(manifest.source, workspaceRoot)
+      const record = resolveManifestDesignSource(manifest, workspaceRoot)
       if (!record) continue
       Object.assign(record, {
         term,

package/flow-conductor.mjs

@@ -63,6 +63,12 @@ export const FLOW_CONDUCTOR_PROMPT = [
   'MODE-AWARE. The user picked a mode — steer (watch every lane live), guide (DEFAULT: approve this plan, then review at phase boundaries), or autopilot (full-auto with a budget cap + adaptive escalation that pulls them in only if a lane stalls). Produce the full plan now regardless; the mode changes how much the human intervenes later, not how you decompose.',
 ].join(' ')
 
+export const FLOW_CODEX_CONDUCTOR_PROMPT = [
+  'THINKPOOL FLOW CONDUCTOR — you are decomposition-only. Do not build, edit files, run commands, or spawn agents. Read only when needed to make the decomposition concrete.',
+  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each task needs key, title, scope, acceptance, deps, and sliceType (scaffold, feature, fix, or review). Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier. Every review task must depend on exactly ONE builder task; express builder -> review -> downstream explicitly in the DAG.',
+  'Submit the finished graph by calling the ThinkPool submit_flow_plan MCP tool with one JSON object encoded in its plan argument. Do not write FLOW_PLAN.json and do not use ExitPlanMode. The MCP submission is your only completion path; after it succeeds, stop and wait for the room.',
+].join(' ')
+
 // Env vars handed to a conductor session via startClaudeSession({ env }). The conductor
 // reads these to know which Flow run it owns + what mode the human picked.
 export function buildConductorEnv ({ flowSessionId, mode, budgetCapAutopilot = null }) {
@@ -98,6 +104,13 @@ export const FLOW_LANE_PROMPT = [
   'BE RIGOROUS, NOT VIBES. Trace the data path, root-cause before fixing, verify before claiming done. A lane that ships a guess costs the whole ensemble.',
 ].join(' ')
 
+export const FLOW_CODEX_LANE_PROMPT = [
+  'THINKPOOL FLOW — you are one builder lane in an ensemble. The conductor gives you one runnable slice with disjoint scope. Edit only that scope and never touch another lane or worktree.',
+  'Done means the slice runs and its acceptance proof has been observed. Diagnose before changing code, verify with the real command or behavior, and make one focused git commit in your assigned worktree. Do not push.',
+  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
+  'Do not spawn more lanes. If the scope is unsafe or a dependency is missing, report the blocker instead of editing outside your ownership.',
+].join(' ')
+
 // Env vars handed to a lane session so it knows its Flow run + which task it owns.
 export function buildLaneEnv ({ flowSessionId, taskKey, laneId }) {
   return {
@@ -238,4 +251,3 @@ export function activateLaneSkill (name, { publicDir, customDir, fs } = {}) {
   const dirs = publicDir === undefined && customDir === undefined ? flowSkillDirs() : { publicDir, customDir }
   return skillLoadBody(name, { ...dirs, ...(fs ? { fs } : {}) })
 }
-

package/flow-host-revert.mjs

@@ -0,0 +1,42 @@
+// Host-owned Flow revert lifecycle. Supabase broadcast channels use self:false,
+// so a reviewer on this bridge must call this handler directly; remote broadcasts
+// delegate to the same function.
+export async function executeFlowRevert({
+  payload,
+  bridgeName,
+  lanes = [],
+  prepareLane,
+  rememberRedispatch,
+  endLane,
+  stopPreview,
+  revert,
+  broadcastReverted,
+  wait = () => Promise.resolve(),
+  onPrepError = () => {},
+} = {}) {
+  if (!payload?.flowId || !payload?.taskKey) return { ok: false, ignored: 'invalid' }
+  if (payload.host && payload.host !== bridgeName) return { ok: false, ignored: 'wrong-host' }
+  let killed = false
+  for (const [laneId, entry] of lanes) {
+    if (entry?.flowSessionId !== payload.flowId || entry?.flowTaskKey !== payload.taskKey || entry?.flowDone) continue
+    try {
+      const prepared = prepareLane?.(entry, payload)
+      if (prepared) rememberRedispatch?.(prepared, entry, payload)
+    } catch (error) { onPrepError(error, entry, payload) }
+    entry.flowDone = true
+    endLane?.(laneId, entry)
+    stopPreview?.(payload.flowId, laneId)
+    killed = true
+  }
+  if (killed) await wait()
+  const reverted = await revert(payload)
+  const result = {
+    ok: true,
+    flowId: payload.flowId,
+    taskKey: payload.taskKey,
+    reviewTaskKey: payload.reviewTaskKey || null,
+    branch: reverted?.branch || null,
+  }
+  await broadcastReverted(result)
+  return result
+}

package/flow-models.mjs

@@ -0,0 +1,77 @@
+// Runtime-aware model routing for Flow and ordinary room cascades.
+// Pure over the supplied environment/catalog so the bridge never sends a model slug
+// that the selected runtime did not advertise.
+
+const CLAUDE_TIERS = {
+  scaffold: 'sonnet',
+  feature: 'opus',
+  fix: 'opus',
+  review: 'opus',
+}
+
+const CODEX_SCAFFOLD = ['gpt-5.6-luna', 'gpt-5.4-mini', 'gpt-5.3-codex-spark']
+const CODEX_BALANCED = ['gpt-5.6-terra', 'gpt-5.4']
+
+export function normalizeFlowRuntime(runtime, fallback = null) {
+  if (runtime === 'claude' || runtime === 'codex') return runtime
+  return fallback === 'claude' || fallback === 'codex' ? fallback : null
+}
+
+export function modelCatalogValues(catalog = []) {
+  return new Set((Array.isArray(catalog) ? catalog : []).map((model) => (
+    typeof model === 'string' ? model : model?.value || model?.slug
+  )).filter(Boolean))
+}
+
+function firstVisible(candidates, catalog) {
+  const visible = modelCatalogValues(catalog)
+  for (const candidate of candidates) if (visible.has(candidate)) return candidate
+  if (candidates === CODEX_SCAFFOLD) {
+    for (const model of visible) if (/spark/i.test(model)) return model
+  }
+  return undefined
+}
+
+export function flowLaneModelFor({ sliceType, runtime = 'claude', catalog = [], env = process.env } = {}) {
+  if (normalizeFlowRuntime(runtime, 'claude') === 'codex') {
+    const override = env.TP_FLOW_CODEX_LANE_MODEL
+    if (override === 'inherit') return undefined
+    if (override) return modelCatalogValues(catalog).has(override) ? override : undefined
+    return firstVisible(sliceType === 'scaffold' ? CODEX_SCAFFOLD : CODEX_BALANCED, catalog)
+  }
+  const override = env.TP_FLOW_CLAUDE_LANE_MODEL || env.TP_FLOW_LANE_MODEL
+  if (override === 'inherit') return undefined
+  if (override) return override
+  return CLAUDE_TIERS[sliceType] || 'opus'
+}
+
+export function flowConductorModelFor({ runtime = 'claude', originModel, catalog = [], env = process.env } = {}) {
+  if (normalizeFlowRuntime(runtime, 'claude') === 'codex') {
+    const override = env.TP_FLOW_CODEX_CONDUCTOR_MODEL
+    if (override === 'inherit') return undefined
+    const visible = modelCatalogValues(catalog)
+    if (override) return visible.has(override) ? override : undefined
+    return originModel && visible.has(originModel) ? originModel : undefined
+  }
+  const override = env.TP_FLOW_CLAUDE_CONDUCTOR_MODEL || env.TP_FLOW_CONDUCTOR_MODEL
+  if (override === 'inherit') return undefined
+  // Claude non-regression: the conductor historically inherited the host default,
+  // not the invoking lane's selected model.
+  return override || undefined
+}
+
+export function spawnedLaneModelFor({ explicitModel, sliceType, runtime = 'claude', catalog = [], env = process.env } = {}) {
+  return explicitModel || flowLaneModelFor({ sliceType, runtime, catalog, env })
+}
+
+export function resolveCodexModel(requested, catalog = []) {
+  if (!requested) return undefined
+  return modelCatalogValues(catalog).has(requested) ? requested : undefined
+}
+
+export function assertRuntimeModelCompatible({ runtime = 'claude', provider = null, model } = {}) {
+  if (runtime === 'claude' && (!provider || provider === 'anthropic') && /^gpt-/i.test(String(model || ''))) {
+    throw new Error(`Codex model ${JSON.stringify(model)} cannot run on the built-in Claude provider`)
+  }
+  return true
+}

package/flow-review.mjs

@@ -32,6 +32,13 @@ export const FLOW_REVIEWER_PROMPT = [
   'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>", "exhausted": <boolean, optional — true only when you have nothing left to check> }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
 ].join('  ')
 
+export const FLOW_CODEX_REVIEWER_PROMPT = [
+  'THINKPOOL FLOW REVIEW — you are a non-mutating adversarial reviewer. Your native sandbox lets you write only inside your OWN disposable reviewer worktree. The reviewed builder worktree is outside that writable root: never edit, commit, revert, install into, or repair it.',
+  'For any install/build/test that produces files, copy the reviewed source into a scratch directory under your own current worktree first, then run the write-producing command against that scratch copy. Read-only inspection may target the reviewed worktree directly.',
+  'Independently reproduce every acceptance criterion and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
+  'Submit each review round by calling the ThinkPool submit_flow_review MCP tool with a JSON verdict: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"allowed reviewed task","exhausted":boolean}. Do not write FLOW_REVIEW.json and do not call mark_flow_done. A pass without exhausted=true may trigger another bounded hunt round; a failure triggers the room revert path.',
+].join(' ')
+
 // Parse a reviewer's raw verdict. Accepts an object OR a JSON string (optionally
 // ```json-fenced). Tolerant of the fence the model sometimes wraps; throws on garbage.
 // Returns { pass, reasons } — pass coerced to boolean, reasons normalized to string[].

package/flow-task-graph.mjs

@@ -173,6 +173,27 @@ export function normalizePlanOutput (raw) {
   return { summary, tasks }
 }
 
+// Codex review protocol deliberately maps one reviewer lane to one builder target.
+// Claude's legacy Flow plans may review several deps and remain unchanged.
+export function validatePlanForRuntime (plan, runtime = 'claude') {
+  if (runtime !== 'codex') return plan
+  for (const task of plan?.tasks || []) {
+    if (task.sliceType === SLICE_TYPE.review && task.deps.length !== 1) {
+      throw new Error(`Codex review task "${task.key}" must depend on exactly one builder task`)
+    }
+  }
+  return plan
+}
+
+export function validReviewTargetShape (task, runtime = 'claude') {
+  if (!task || task.slice_type !== SLICE_TYPE.review) return true
+  return runtime !== 'codex' || (Array.isArray(task.deps) && task.deps.length === 1)
+}
+
+export function legacyBuilderCompletionAllowed ({ runtime, flowRole, eventKind, eventSubtype, interrupted = false } = {}) {
+  return runtime === 'claude' && flowRole === 'builder' && !interrupted && eventKind === 'result' && eventSubtype === 'success'
+}
+
 // ── Flow lane model tiers ───────────────────────────────────────────────────
 // Spec: docs/specs/2026-07-03-flow-lane-model-tiers.md
 // The conductor thinks; the worker lanes type. Running every lane on the same

package/interrupted-resume.mjs

@@ -11,6 +11,27 @@ export function sendInterruptedContinue(entry) {
   catch { return false }
 }
 
+// A text recap is the fallback when the native thread cannot be resumed. Claude
+// already has a live init event to trigger this; Codex does not -- sending the
+// recap is what starts its fresh exec process. Consume atomically, but restore it
+// if delivery was refused so the next human turn can still prepend the context.
+export function dispatchPendingRecap(entry) {
+  const recap = typeof entry?.pendingRecap === 'string' ? entry.pendingRecap : ''
+  if (!recap.trim()) return false
+  entry.pendingRecap = null
+  try { entry.flush?.() } catch { /* best effort */ }
+  try {
+    if (entry.session?.sendTurn?.(recap) === false) {
+      entry.pendingRecap = recap
+      return false
+    }
+    return true
+  } catch {
+    entry.pendingRecap = recap
+    return false
+  }
+}
+
 export function armInterruptedResume(entry) {
   if (!entry?.session) return 'unavailable'
   if (entry.runtime === 'codex') return sendInterruptedContinue(entry) ? 'sent' : 'unavailable'
@@ -18,6 +39,37 @@ export function armInterruptedResume(entry) {
   return 'armed'
 }
 
+export function recoverInterruptedTurn(entry, { resumable = false, recap = '' } = {}) {
+  if (!entry?.session) return 'unavailable'
+  if (resumable) return armInterruptedResume(entry)
+  if (!String(recap || '').trim()) return 'unavailable'
+  entry.pendingRecap = String(recap)
+  if (entry.runtime === 'codex') return dispatchPendingRecap(entry) ? 'recap-sent' : 'unavailable'
+  return 'recap-armed'
+}
+
+export function isMissingResumeError(message) {
+  return /No conversation found|no rollout found for thread id|thread\/resume[^\n]*failed[^\n]*no rollout/i.test(String(message || ''))
+}
+
+// Bound the stale-native-thread self-heal at the ownership seam. The old entry is
+// marked before teardown/reopen so duplicate error delivery can never fork another
+// process. `reopen` returns the new structured entry; Codex consumes the recap
+// immediately because a fresh exec has no idle init event.
+export function recoverMissingResumeOnce(entry, { message, recap = '', reopen } = {}) {
+  if (!entry || entry.recovered || !isMissingResumeError(message)) return { recovered: false, delivery: 'ignored' }
+  entry.recovered = true
+  try { entry.session?.end?.() } catch { /* already dead */ }
+  let recovered = null
+  try { recovered = reopen?.(String(recap || '')) || null } catch { /* caller surfaces reopen failure */ }
+  if (!recovered) return { recovered: true, delivery: 'unavailable', entry: null }
+  return {
+    recovered: true,
+    delivery: recoverInterruptedTurn(recovered, { resumable: false, recap }),
+    entry: recovered,
+  }
+}
+
 // A real person speaking always wins the race. Otherwise a human turn that starts a
 // cold Claude/Codex runtime can trigger its init event and enqueue a stale second
 // `continue` behind the person's actual request.
@@ -26,4 +78,3 @@ export function supersedeInterruptedResume(entry) {
   entry.pendingAutoResume = false
   return true
 }
-

package/lane-worktree.mjs

@@ -12,11 +12,26 @@ export function createManagedLaneWorktree({ terminalId, cwd = process.cwd(), git
   if (!root) throw new Error('not a git repository')
   const dir = path.join(root, '.thinkpool', 'worktrees', `terminal-${short}`)
   const branch = `thinkpool/terminal/${short}`
+  const base = resolveLaneBase({ root, git })
   fsImpl.mkdirSync(path.dirname(dir), { recursive: true })
-  git(['worktree', 'add', '-b', branch, dir, 'HEAD'], root)
+  git(['worktree', 'add', '-b', branch, dir, base], root)
   return { terminalId: id, root, dir, branch }
 }
 
+// Ordinary lanes should start from the repository's upstream default branch, not
+// whichever parked/stale branch happens to be checked out in the bridge process.
+// Repositories without a remote remain useful: fall back through conventional local
+// defaults and finally HEAD.
+function resolveLaneBase({ root, git }) {
+  for (const candidate of ['origin/HEAD', 'origin/main', 'origin/master', 'main', 'master', 'HEAD']) {
+    try {
+      const resolved = String(git(['rev-parse', '--verify', '--quiet', candidate], root) || '').trim()
+      if (resolved) return candidate
+    } catch { /* try the next base */ }
+  }
+  return 'HEAD'
+}
+
 export function removeManagedLaneWorktree({ terminalId, managedWorktree, git = runGit } = {}) {
   const id = String(terminalId || '')
   const rec = managedWorktree && typeof managedWorktree === 'object' ? managedWorktree : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.220",
+  "version": "0.7.222",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -36,6 +36,8 @@
     "flow-conductor.mjs",
     "flow-worktree.mjs",
     "flow-task-graph.mjs",
+    "flow-models.mjs",
+    "flow-host-revert.mjs",
     "flow-preview.mjs",
     "viewport.mjs",
     "design-edit.mjs",