thinkpool-pair 0.7.360 → 0.7.361

package/bridge.mjs

@@ -77,7 +77,7 @@ import { explicitKeepAwakeChoice, keepAwakeEnabled, saveKeepAwakePreference, sta
 
 const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
-import { legacyBuilderCompletionAllowed, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
+import { legacyBuilderCompletionAllowed, normalizeBaselineEvidence, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
 import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, resolveHermesOpenModel, assertRuntimeModelCompatible } from './flow-models.mjs'
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
 // the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
@@ -130,7 +130,7 @@ import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce,
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { realtimeRecoveryDecision, turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage, acknowledgePendingScheduledOutcome, commitRecordedScheduledOutcome, deletePendingScheduledOutcome, loadPendingScheduledOutcome, loadPendingScheduledOutcomes, savePendingScheduledOutcome } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, appendCurrentPersonRequest, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, appendCurrentPersonRequest, buildCheckpointFromLog, buildRecapFromLog, resolveCheckpointCarry, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
 import { createLatestReplayPump, requestedReplayIds } from './replay-transport.mjs'
 import { classifyCodeEvent, unknownCodeEventNotice } from './code-event-contract.mjs'
 import { fetchPairControlDeliveryAuthority } from './pair-control-authority.mjs'
@@ -2427,6 +2427,13 @@ function emitCodexCompactionControl(entry, text, by = null) {
   bcast('code-event', { term: entry.id, evt })
 }
 
+function armCompactionCheckpoint(entry) {
+  const checkpoint = buildCheckpointFromLog(entry?.log)
+  if (!checkpoint) return false
+  entry.pendingCheckpoint = checkpoint
+  return true
+}
+
 async function runCodexCompaction(entry, request = {}) {
   const recap = buildRecapFromLog(entry.log, RECAP_CAP, { reason: 'compact' })
   if (!recap) {
@@ -2450,6 +2457,7 @@ async function runCodexCompaction(entry, request = {}) {
     if (!entry.session.turnActive && settleLaneControl(entry)) announce()
   }
   if (nativeCompacted === true) {
+    armCompactionCheckpoint(entry)
     const evt = { kind: 'compaction', trigger: 'manual', preTokens, by: request.by, native: true }
     pushLog(entry, evt)
     bcast('code-event', { term: entry.id, evt })
@@ -2468,7 +2476,9 @@ async function runCodexCompaction(entry, request = {}) {
     emitCodexCompactionControl(entry, 'Codex context compaction unavailable right now', request.by)
     return
   }
-  entry.pendingRecap = recap
+  const carry = resolveCheckpointCarry(recap, entry.pendingCheckpoint)
+  entry.pendingRecap = carry.pendingRecap
+  entry.pendingCheckpoint = carry.pendingCheckpoint
   const evt = { kind: 'compaction', trigger: 'manual', preTokens, by: request.by }
   pushLog(entry, evt)
   bcast('code-event', { term: entry.id, evt })
@@ -2523,7 +2533,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
+function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, carryCheckpoint, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
   if (sessions.has(id)) return
   runtime = structuredRuntimeMetadata(runtime) ? runtime : 'claude'
   // Fail closed before exposing a native lane if its bridge semantic contract
@@ -2635,6 +2645,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
   entry.seq = makeSeqCounter(maxSeq(entry.log))
   entry.rolePrompt = rolePrompt || null   // FL-M6 — persisted so a bridge restart restores the flow role prompt
+  entry.flowTaskContract = flowTaskContract && typeof flowTaskContract === 'object' ? flowTaskContract : null
   // lastUsage — the terminal's most recent usage/ctx meter. Persisted (sessionData) +
   // restored so a bridge restart can re-emit it on replay: usage is chrome (kept out of
   // the replayed transcript log), so without this a (re)joiner sees "—" for context until
@@ -2649,10 +2660,17 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // MCP tool AND the FLOW_DONE sentinel-Write intercept: like the conductor's submit, the
   // MCP tool is DEFERRED (needs ToolSearch, which hangs), so lanes signal done by Writing a
   // FLOW_DONE file — a DIRECT tool — which the PreToolUse hook routes here. Returns a message.
-  const markFlowDone = async ({ reviewPass = false } = {}) => {
+  const markFlowDone = async ({ reviewPass = false, baselineEvidence = '' } = {}) => {
     if (!entry.flowSessionId || !entry.flowTaskKey) return 'Not a Flow lane — nothing to mark done.'
     if (entry.flowRole !== 'builder' && !(reviewPass && entry.flowRole === 'reviewer')) return 'This Flow role cannot mark a builder slice done.'
     if (entry.flowDone) return 'This slice is already recorded as done.'
+    let baselineReceipt = ''
+    const requiresBaselineReceipt = !reviewPass && !!entry.flowTaskContract?.baseline?.gate
+    if (requiresBaselineReceipt) {
+      try { baselineReceipt = normalizeBaselineEvidence(baselineEvidence) } catch (e) {
+        return `Slice "${entry.flowTaskKey}" is not done: submit the real bounded baselineEvidence receipt (${e?.message || e}). Observe the assigned pre-edit gate; do not fabricate a RED sentence.`
+      }
+    }
     let commitSha = null
     try { commitSha = execFileSync('git', ['-C', entry.cwd || process.cwd(), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim() } catch { /* no commits yet */ }
     if (!reviewPass && entry.dispatchBaseSha && commitSha === entry.dispatchBaseSha) {
@@ -2681,13 +2699,16 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       ]
       const digest = digestSlice(
         { key: entry.flowTaskKey, title: termNames[id] || entry.flowTaskKey },
-        { acceptanceProof: commitSha ? `committed ${commitSha.slice(0, 8)}` : 'slice done', artifacts },
+        { acceptanceProof: `${baselineReceipt ? `baseline: ${baselineReceipt}; ` : ''}${commitSha ? `committed ${commitSha.slice(0, 8)}` : 'slice done'}`, artifacts },
       )
       appendDigest(entry.flowSessionId, digest, { baseDir: process.cwd() })   // idempotent per (flowId, taskKey)
     } catch (e) {
       process.stderr.write(`\n  ${A.dim}◆ flow digest skip ${entry.flowTaskKey} — ${e?.message || e}${A.rst}\n`)
     }
-    bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl, ...(reviewPass ? { reviewAction: 'pass' } : {}) }, flowChannel)
+    const completedContract = requiresBaselineReceipt
+      ? { ...entry.flowTaskContract, baseline: { ...entry.flowTaskContract.baseline, evidence: baselineReceipt } }
+      : entry.flowTaskContract || null
+    bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl, contract: completedContract, ...(reviewPass ? { reviewAction: 'pass' } : {}) }, flowChannel)
     process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
     entry.flowDone = true   // FL-B3 — retire immediately so it drops from the ≤8 lane cap
     setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
@@ -2870,7 +2891,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, carryCheckpoint: entry.pendingCheckpoint || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -3450,9 +3471,9 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // (slices whose deps just got satisfied).
       ...(entry.flowRole === 'builder' ? [tool(
         'mark_flow_done',
-        "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). No arguments: your commit is read from your worktree. Do not call before your slice actually runs + meets acceptance.",
-        {},
-        async () => ({ content: [{ type: 'text', text: await markFlowDone() }] }),
+        "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. For a gate-first task, pass `baselineEvidence`: the real, bounded pre-edit command/behavior receipt proving the assigned failure/absence. Never fabricate a RED sentence. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). Do not call before the slice actually runs + meets acceptance.",
+        { baselineEvidence: z.string().max(1400).optional().describe('real single-line pre-edit baseline command/behavior receipt; required for new gate-first tasks') },
+        async (args) => ({ content: [{ type: 'text', text: await markFlowDone({ baselineEvidence: args?.baselineEvidence || '' }) }] }),
       )] : []),
       // FL-B1 — the conductor SUBMITS its decomposition through THIS tool, not the built-in
       // ExitPlanMode. In the current SDK, ExitPlanMode is a deferred tool the conductor must
@@ -3462,17 +3483,17 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // reject malformed plans back to the conductor so it re-emits.
       ...(entry.flowRole === 'conductor' ? [tool(
         'submit_flow_plan',
-        'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line>","tasks":[{"key":"<kebab>","title":"…","scope":"…","acceptance":"…","deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. The room validates it is an acyclic DAG, persists the tasks, and shows the approval card. This is how a conductor FINISHES — do NOT use ExitPlanMode, do NOT write a plan file.',
+        'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line; assumptions: …>","tasks":[{"key":"<kebab>","title":"…","scope":"…","acceptance":"observable proof","nonGoals":["bounded exclusion"],"baseline":{"gate":"what fails/is absent before edits","evidence":"optional observed receipt"},"deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. Each builder/fix/scaffold needs acceptance, nonGoals, and a safe bounded baseline gate; review tasks inherit one builder contract. When uncertain, choose and record a safe reversible default; ask only when a choice materially expands scope or authority. The room validates and persists the graph, then shows approval. Do NOT use ExitPlanMode or write a plan file.',
         { plan: z.string().describe('the task-graph as a JSON string (the {summary, tasks:[…]} object)') },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
           if (!entry.flowSessionId || entry.flowRole !== 'conductor') return okText('Not a Flow conductor — there is no flow to submit a plan for.')
           let norm
           try { norm = validatePlanForRuntime(normalizePlanOutput(args?.plan || ''), entry.runtime) }
-          catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.`) }
+          catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON: a non-empty acyclic tasks array; each builder/fix/scaffold has observable acceptance, bounded nonGoals, and a safe baseline gate that says what fails/is absent; each review targets exactly one builder contract.`) }
           bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
           process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
-          return okText(`Plan submitted (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) — the room is showing the human an approval card. You are DONE; stop here and wait for approval (lane dispatch is the room's job).`)
+          return okText(`Plan submitted (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) with gate-first contracts. Safe reversible assumptions belong in the summary; user steering remains authoritative. The room is showing approval. You are DONE; stop here and wait for approval (lane dispatch is the room's job).`)
         },
       )] : []),
       ...(entry.flowRole === 'reviewer' ? [tool(
@@ -3523,7 +3544,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // human turn cannot strand a fresh Codex thread without its recap. It is fired
   // on the init `system` event (see onEvent) — a sendTurn before the input stream is consumed
   // is silently lost (the 2026-07-02 auto-resume bug). Empty string → nothing to carry.
-  entry.pendingRecap = (typeof carryRecap === 'string' && carryRecap.trim()) ? carryRecap : null
+  const carry = resolveCheckpointCarry(carryRecap, carryCheckpoint)
+  entry.pendingRecap = carry.pendingRecap
+  // Native compaction keeps the runtime thread alive, so this checkpoint must not
+  // create a synthetic turn. Persist it separately and prepend it exactly once to
+  // the next real person turn. That makes the post-compact continuation explicit
+  // while preserving the runtime's own compacted context.
+  entry.pendingCheckpoint = carry.pendingCheckpoint
   const terminalRolePrompt = [buildTerminalRolePrompt({
     spawnedBy: entry.spawnedBy,
     spawnDepth: entry.spawnDepth,
@@ -3617,14 +3644,21 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       if (!entry.flowSessionId || entry.flowRole !== 'conductor') return { ok: false, message: 'Not a Flow conductor — nothing to submit.' }
       let norm
       try { norm = validatePlanForRuntime(normalizePlanOutput(planText || ''), entry.runtime) }
-      catch (e) { return { ok: false, message: `Plan REJECTED: ${e?.message || e}. Re-Write FLOW_PLAN.json with valid JSON — a non-empty "tasks" array, every "deps" entry referencing an existing task "key", and no cycles.` } }
+      catch (e) { return { ok: false, message: `Plan REJECTED: ${e?.message || e}. Re-Write FLOW_PLAN.json with valid JSON: a non-empty acyclic tasks array; each builder/fix/scaffold has observable acceptance, bounded nonGoals, and a baseline gate that says what fails/is absent; each review targets exactly one builder contract.` } }
       bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
       process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
-      return { ok: true, message: `Plan SUBMITTED (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) — the room is showing the human an approval card. You are DONE: stop here, do not write anything else, wait for approval (lane dispatch is the room's job).` }
+      return { ok: true, message: `Plan SUBMITTED (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) with gate-first contracts. Record safe reversible assumptions in the summary; user steering remains authoritative. The room is showing approval. You are DONE: stop here and wait for approval.` }
     },
     // FL-B1 (lane side) — a flow lane signals slice-done by Writing FLOW_DONE; the hook
     // routes that Write here (mark_flow_done MCP tool is deferred → ToolSearch → hangs).
-    onLaneDone: entry.flowRole === 'builder' ? (async () => ({ ok: true, message: await markFlowDone() })) : null,
+    onLaneDone: entry.flowRole === 'builder' ? (async (raw) => {
+      let baselineEvidence = ''
+      try {
+        const value = JSON.parse(String(raw || '').trim())
+        baselineEvidence = typeof value?.baselineEvidence === 'string' ? value.baselineEvidence : ''
+      } catch { /* legacy FLOW_DONE content remains compatible with legacy tasks */ }
+      return { ok: true, message: await markFlowDone({ baselineEvidence }) }
+    }) : null,
     // FL-B4 — a review lane records its verdict via FLOW_REVIEW.json (revert-on-fail).
     onReviewVerdict: entry.flowRole === 'reviewer' ? onReviewVerdict : null,
     mcpServers: { thinkpool: peekServer },
@@ -3718,12 +3752,12 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               id, runtime: entry.runtime, model: entry.model || model, effort: entry.effort,
               provider: entry.provider, log: entry.log, commands: entry.commands, mode: entry.mode,
               spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth, cascadeRole: entry.cascadeRole, hop: entry.hop, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId,
-              flowTaskKey: entry.flowTaskKey, flowRole: entry.flowRole, flowReviewTarget: entry.flowReviewTarget,
+              flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole, flowReviewTarget: entry.flowReviewTarget,
               flowReviewTargets: entry.flowReviewTargets, flowReviewSnapshots: entry.flowReviewSnapshots, flowReviewRound: entry.flowReviewRound,
               dispatchBaseSha: entry.dispatchBaseSha, revertTarget: entry.revertTarget, cwd: entry.cwd,
               managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt,
               reviewSliceRoots: entry.reviewSliceRoots, openedAt: entry.openedAt,
-              lastUsage: entry.lastUsage, carryRecap,
+              lastUsage: entry.lastUsage, carryRecap, carryCheckpoint: entry.pendingCheckpoint,
             })
             return sessions.get(id) || null
           },
@@ -3874,6 +3908,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // mid-turn) flash a brief "Compacting…" beat so it isn't silent — we only learn of it
       // post-hoc, so there's no real duration to animate (Max, 2026-07-02).
       if (evt.kind === 'compaction') {
+        armCompactionCheckpoint(entry)
         if (entry.compacting) {
           // MANUAL /compact: attribute the recap card, then CLEAR the "Compacting…"
           // indicator right here — the compact_boundary milestone IS the "done" signal.
@@ -4245,7 +4280,7 @@ function respawnStructured(id, provider) {
   // openStructured seed from the TARGET provider's configured model, which is the
   // only model this lane was ever asked for. A same-env model change never reaches
   // here — that path is an in-place setModel (see provider-switch).
-  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage } = s
+  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, pendingCheckpoint } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -4264,7 +4299,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap })
+  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap, carryCheckpoint: pendingCheckpoint })
   return true
 }
 
@@ -4969,6 +5004,7 @@ channel
     }
     if (/^\/clear\s*$/.test(text)) {
       s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
+      s.pendingCheckpoint = null
       s.pendingCodexCompaction = null // explicit clear supersedes a deferred compact
       if (s.runtime === 'codex' || s.runtime === 'hermes') s.session.clearContext?.()
       else s.session.sendTurn(text)
@@ -5041,6 +5077,7 @@ channel
     let sendText = text
     const carried = []
     if (s.pendingRecap) { carried.push(s.pendingRecap); s.pendingRecap = null }
+    if (s.pendingCheckpoint) { carried.push(s.pendingCheckpoint); s.pendingCheckpoint = null }
     if (s.pendingSideContexts?.length) { carried.push(...s.pendingSideContexts); s.pendingSideContexts = [] }
     if (carried.length) { sendText = appendCurrentPersonRequest(carried, text); s.flush?.() }
     // The browser's `hostPath` is display metadata, not host authority. Rebuild
@@ -5236,7 +5273,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap,
+            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowTaskContract: rec.flowTaskContract, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap, carryCheckpoint: rec.carryCheckpoint,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).
@@ -5511,7 +5548,7 @@ flowChannel
         // Model tiers (2026-07-03-flow-lane-model-tiers): pick the lane's brain by slice_type
         // (scaffold→sonnet, feature/fix/review→opus; env can blanket-override or `inherit` to
         // restore today's exact behavior). undefined → no model key passed (openStructured default).
-        openStructured({ id: laneId, runtime: flowRuntime, cwd: dir, model: flowLaneModelFor({ sliceType: t.slice_type, runtime: flowRuntime, catalog: flowCatalog }), mode: structuredModeForSlice(flowRuntime, { mode: 'bypassPermissions', flowRole: isReview ? 'reviewer' : 'builder' }), rolePrompt: laneRolePrompt, flowSessionId: payload.flowId, flowTaskKey: t.task_key, flowRole: isReview ? 'reviewer' : 'builder', flowReviewTargets: isReview ? (t.deps || []) : [], flowReviewSnapshots, dispatchBaseSha, revertTarget: redispatch?.revertTarget || null, spawnedBy: `flow:${payload.flowId}`, resume: redispatch?.resumeSessionId || undefined, reviewSliceRoots })
+        openStructured({ id: laneId, runtime: flowRuntime, cwd: dir, model: flowLaneModelFor({ sliceType: t.slice_type, runtime: flowRuntime, catalog: flowCatalog }), mode: structuredModeForSlice(flowRuntime, { mode: 'bypassPermissions', flowRole: isReview ? 'reviewer' : 'builder' }), rolePrompt: laneRolePrompt, flowSessionId: payload.flowId, flowTaskKey: t.task_key, flowTaskContract: t.contract || null, flowRole: isReview ? 'reviewer' : 'builder', flowReviewTargets: isReview ? (t.deps || []) : [], flowReviewSnapshots, dispatchBaseSha, revertTarget: redispatch?.revertTarget || null, spawnedBy: `flow:${payload.flowId}`, resume: redispatch?.resumeSessionId || undefined, reviewSliceRoots })
         const le = sessions.get(laneId)
         if (le) {
           // S4 — stamp the surviving revert target on the resumed lane so a later reviewer still
@@ -5535,6 +5572,9 @@ flowChannel
                     t.deps.map((dep) => { const ws = worktreeSpec({ flowId: payload.flowId, taskKey: dep }); return `  - ${dep}: dir ${ws.dir} (branch ${ws.branch})` }).join('\n') + '\n'
                   : '') +
                 `ACCEPTANCE to INDEPENDENTLY verify: ${t.acceptance || t.title}\n` +
+                `INHERITED NON-GOALS (must remain untouched): ${(t.contract?.nonGoals || []).join(' | ') || '(legacy task: none recorded)'}\n` +
+                `INHERITED BASELINE GATE: ${t.contract?.baseline?.gate || '(legacy task: none recorded)'}\n` +
+                `BUILDER BASELINE EVIDENCE (verify; never invent another baseline): ${t.contract?.baseline?.evidence || '(missing — reject unless this is a legacy task)'}\n` +
                 `\nProject (context): ${payload.flowPrompt || ''}\n\n` +
                 (flowRuntime === 'codex' || flowRuntime === 'hermes'
                   ? `Review it without mutating the builder worktree. For write-producing install/build/test commands, copy its source into scratch under your own current worktree first. Submit the structured verdict with the ThinkPool submit_flow_review MCP tool; never write FLOW_REVIEW.json or call mark_flow_done.`
@@ -5543,6 +5583,9 @@ flowChannel
                 `TITLE: ${t.title}\n` +
                 `SCOPE (files you OWN — edit ONLY these): ${t.scope || '(none stated)'}\n` +
                 `ACCEPTANCE (done = this runs + proves it): ${t.acceptance || '(meet the title)'}\n` +
+                `NON-GOALS (must remain untouched): ${(t.contract?.nonGoals || []).join(' | ') || '(legacy task: none recorded)'}\n` +
+                `BASELINE GATE (before edits, observe this real failure/absence): ${t.contract?.baseline?.gate || '(legacy task: none recorded)'}\n` +
+                `BASELINE EVIDENCE: run/observe the pre-edit gate, then retain one real bounded command/behavior receipt for mark_flow_done; never fabricate a RED sentence.\n` +
                 (t.deps && t.deps.length ? `DEPENDS ON (already built): ${t.deps.join(', ')}\n` : '') +
                 // S1 (context-offload) — inject the BOUNDED cross-wave context (loadDigest
                 // enforces CEILING) instead of accumulating full lane transcripts. Filter to

package/claude-session.mjs

@@ -594,7 +594,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     // that Write to the done logic and feed the result back; the file is never written.
     if (onLaneDone && (toolName === 'Write' || toolName === 'Edit') && /(?:^|[/\\])FLOW_DONE(\.[a-zA-Z0-9]+)?$/.test(toolInput?.file_path || '')) {
       let res = { ok: false, message: 'done signal failed' }
-      try { res = (await onLaneDone()) || res } catch (e) { res = { ok: false, message: `done signal failed: ${e?.message || e}` } }
+      try { res = (await onLaneDone(toolInput?.content ?? toolInput?.new_string ?? '')) || res } catch (e) { res = { ok: false, message: `done signal failed: ${e?.message || e}` } }
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
     }
     // S5 (slice 1b) — REVIEW-LANE WRITE-BLOCK. A review lane is ADVERSARIAL: it reads +

package/event-id.mjs

@@ -546,4 +546,4 @@ export function codexUsageReportLine (sessionModel, snapshot) {
  * (`from './event-id.mjs'`) working untouched, including bridge/recap.test.mjs.
  *
  * recap.mjs must stay in bridge/package.json `files` — event-id.mjs imports it. */
-export { CURRENT_PERSON_REQUEST_MARKER, RECAP_CAP, appendCurrentPersonRequest, buildRecapFromLog } from './recap.mjs'
+export { CHECKPOINT_CAP, CURRENT_PERSON_REQUEST_MARKER, RECAP_CAP, appendCurrentPersonRequest, buildCheckpointFromLog, buildRecapFromLog, recapHasCheckpoint, resolveCheckpointCarry } from './recap.mjs'

package/flow-conductor.mjs

@@ -38,7 +38,7 @@ export { normalizePlanOutput }
 // moat, partition by file ownership, plan-in-store-not-context, right-size the slice
 // count (3 focused beats 7 scattered), explicit acyclic deps.
 export const FLOW_CONDUCTOR_PROMPT = [
-  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. If a detail is ambiguous, make a reasonable assumption and note it in the plan summary — do NOT ask. Think, then call submit_flow_plan. That is the whole job.',
+  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. When a detail is ambiguous or the user is unsure, choose the least-invasive reversible default, record that assumption in the summary, and continue. Never ask merely because the user is unsure; ask only when a choice would materially expand scope or authority. User steering always wins. Think, then call submit_flow_plan. That is the whole job.',
 
   'DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed without a prompt) — never delegate it to a spawned agent. Decompose, then Write FLOW_PLAN.json.',
 
@@ -52,10 +52,12 @@ export const FLOW_CONDUCTOR_PROMPT = [
 
   'ACCEPTANCE CRITERIA per slice: how does the lane know it is DONE AND RUNNING? A lane is done when its slice runs in its WebContainer and meets the criteria — not when it has merely written code. State the observable, runnable proof (e.g. "GET /api/todos returns 200 + []", "submitting the form adds a row to the list that persists across reload").',
 
+  'GATE-FIRST CONTRACT per builder/fix/scaffold slice: include an explicit bounded `nonGoals` list (what this slice will not change) and a `baseline` gate describing the real pre-edit condition that must FAIL or be ABSENT. The builder must observe that gate before editing and later supply a bounded evidence receipt; do not invent a RED sentence. A review task must depend on exactly one builder/fix task and inherits that target contract — it verifies the same acceptance, non-goals, and baseline evidence instead of inventing a second baseline.',
+
   'RIGHT-SIZE THE SLICE COUNT. Bias to FEW slices that each carry real weight, not many tiny ones. For a small app: 2-3 slices. Concurrent lanes are bounded (a low dispatch ceiling), so a flat fan-out of well-chosen slices beats a sprawling one. Three focused slices outperform seven scattered ones.',
 
   'SUBMIT BY WRITING FLOW_PLAN.json — when the decomposition is ready, use the Write tool with file_path "FLOW_PLAN.json" and content set to your plan as ONE JSON object. The room validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected with the reason as the tool result — fix it and Write FLOW_PLAN.json again. Do not also narrate the plan in prose. The exact shape:',
-  '{ "summary": "<one line: what we are building>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
+  '{ "summary": "<one line: what we are building; assumptions: …>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "nonGoals": ["<bounded exclusion>"], "baseline": { "gate": "<what currently fails/is absent before edits>", "evidence": "<optional observed command/output receipt>" }, "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
   '`key` values are stable short kebab-case identifiers. `deps` references other tasks\' keys. The content of FLOW_PLAN.json must be ONLY the JSON object (no surrounding prose, no markdown fences).',
 
   'PLAN LIVES IN THE STORE, NOT THE CHAT. Your JSON plan is the artifact — it gets persisted to the task-graph (flow_sessions / flow_tasks) and rendered as an approval card. Do not ALSO narrate a long plan in prose. You may add 1-2 sentences framing the decomposition choice (why these slices, what was coupled), nothing more.',
@@ -65,7 +67,8 @@ export const FLOW_CONDUCTOR_PROMPT = [
 
 export const FLOW_CODEX_CONDUCTOR_PROMPT = [
   'THINKPOOL FLOW CONDUCTOR — you are decomposition-only. Do not build, edit files, run commands, or spawn agents. Read only when needed to make the decomposition concrete.',
-  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each task needs key, title, scope, acceptance, deps, and sliceType (scaffold, feature, fix, or review). Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier. Every review task must depend on exactly ONE builder task; express builder -> review -> downstream explicitly in the DAG.',
+  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each builder/fix/scaffold task needs key, title, scope, observable acceptance, bounded nonGoals, and a baseline {gate,evidence?}; the gate states what currently fails or is absent before edits. Every review task depends on exactly ONE builder task and inherits/verifies that builder contract. Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier.',
+  'When details are ambiguous or the user says they are unsure, choose a safe reversible default, record it in summary.assumptions text, and continue. Do not ask merely because of uncertainty; ask only when a choice materially expands scope or authority. Honor later user steering.',
   'Submit the finished graph by calling the ThinkPool submit_flow_plan MCP tool with one JSON object encoded in its plan argument. Do not write FLOW_PLAN.json and do not use ExitPlanMode. The MCP submission is your only completion path; after it succeeds, stop and wait for the room.',
 ].join(' ')
 
@@ -95,9 +98,11 @@ export const FLOW_LANE_PROMPT = [
 
   'OWN YOUR FILES ONLY. The `scope` names the files/components this lane OWNS — they are DISJOINT from every other lane. Edit ONLY those. Touching another lane\'s files is a collision that breaks the merge — never do it. If you genuinely need a file outside your scope, STOP and say so instead of editing it.',
 
+  'GATE BEFORE EDITS. First reproduce the assigned baseline gate in the real pre-edit state. Record only what you actually observed (a command/behavior + bounded receipt); never fabricate a RED sentence. Preserve the assigned non-goals. If a bounded detail is ambiguous, take the least-invasive reversible default and state it in your receipt; ask only if the choice would materially expand scope or authority.',
+
   'DONE MEANS RUNS. You are not done when you\'ve written code — you\'re done when your slice RUNS and meets the `acceptance` criteria (the observable, runnable proof). Verify it yourself before declaring done. State the proof (the command, the output) when you finish.',
 
-  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root (any content, e.g. "done"). That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, AND is committed.',
+  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root with content `{"baselineEvidence":"<real bounded pre-edit command/behavior receipt>"}`. That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, records real baseline evidence, AND is committed.',
 
   'STAY IN YOUR LANE. Do NOT spawn further lanes (one hop only — the fork-bomb breaker). Do NOT edit other worktrees. If you\'re blocked on a dependency that isn\'t ready, say so + stop — another lane is building it.',
 
@@ -106,8 +111,9 @@ export const FLOW_LANE_PROMPT = [
 
 export const FLOW_CODEX_LANE_PROMPT = [
   'THINKPOOL FLOW — you are one builder lane in an ensemble. The conductor gives you one runnable slice with disjoint scope. Edit only that scope and never touch another lane or worktree.',
+  'Before editing, reproduce the assigned baseline gate in the real pre-edit state. Preserve the explicit non-goals. Record only an actual bounded command/behavior receipt; never manufacture a RED claim. For a bounded ambiguity, take the least-invasive reversible default and state it in that receipt; ask only if a choice would materially expand scope or authority.',
   'Done means the slice runs and its acceptance proof has been observed. Diagnose before changing code, verify with the real command or behavior, and make one focused git commit in your assigned worktree. Do not push.',
-  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
+  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once with the real `baselineEvidence` receipt. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
   'Do not spawn more lanes. If the scope is unsafe or a dependency is missing, report the blocker instead of editing outside your ownership.',
 ].join(' ')
 

package/flow-review.mjs

@@ -17,11 +17,11 @@ import { reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect
 // The reviewer lane's rolePrompt (via startClaudeSession). Mirrors FLOW_LANE_PROMPT's
 // join('  ') style. This lane is ADVERSARIAL — its job is to disprove "done", not to build.
 export const FLOW_REVIEWER_PROMPT = [
-  'THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, its acceptance criteria, and its worktree/branch) arrives as your first message.',
+  'THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, acceptance criteria, inherited non-goals, baseline gate/evidence, and worktree/branch) arrives as your first message.',
 
   'RUN IT, DON\'T TRUST IT. Check out the lane\'s worktree/branch and RUN the slice yourself. "It compiles" is not "it works". Reproduce the acceptance proof with your own hands — run the command, hit the endpoint, submit the form, reload the page. If you cannot independently reproduce the acceptance criteria, that is a REJECT.',
 
-  'HUNT FOR FAILURE. Look where the builder didn\'t: edge cases, empty/malformed input, the second click, the reload, concurrent use, the error path. Check the slice didn\'t regress anything outside its acceptance line. A green happy-path is the floor, not the bar.',
+  'VERIFY THE INHERITED CONTRACT. Check the builder\'s baseline receipt against the real pre-edit claim where feasible; it must be an observed command/behavior, not a fabricated sentence. Check the implementation did not cross its inherited non-goals. Do not invent another baseline. HUNT FOR FAILURE: edge cases, empty/malformed input, the second click, the reload, concurrent use, and the error path. A green happy-path is the floor, not the bar.',
 
   'DEFAULT TO REJECT. If you cannot independently verify EVERY acceptance criterion — reject. Ambiguity, "probably fine", "looks right", an untestable claim, a flaky run — all REJECT. The cost of a false pass (a broken slice merged into the assembly) is far higher than a re-run.',
 
@@ -35,7 +35,7 @@ export const FLOW_REVIEWER_PROMPT = [
 export const FLOW_CODEX_REVIEWER_PROMPT = [
   'THINKPOOL FLOW REVIEW — you are a non-mutating adversarial reviewer. Your native sandbox lets you write only inside your OWN disposable reviewer worktree. The reviewed builder worktree is outside that writable root: never edit, commit, revert, install into, or repair it.',
   'For any install/build/test that produces files, copy the reviewed source into a scratch directory under your own current worktree first, then run the write-producing command against that scratch copy. Read-only inspection may target the reviewed worktree directly.',
-  'Independently reproduce every acceptance criterion and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
+  'Independently reproduce every acceptance criterion, verify the inherited baseline evidence and non-goals without inventing a second baseline, and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
   'Submit each review round by calling the ThinkPool submit_flow_review MCP tool with a JSON verdict: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"allowed reviewed task","exhausted":boolean}. Do not write FLOW_REVIEW.json and do not call mark_flow_done. A pass without exhausted=true may trigger another bounded hunt round; a failure triggers the room revert path.',
 ].join(' ')
 

package/flow-task-graph.mjs

@@ -43,10 +43,82 @@ export const SLICE_TYPE = {
   fix: 'fix',
 }
 
+// Gate-first Flow contracts are stored in flow_tasks.contract (JSONB). Keep every
+// free-text field bounded and single-line: this payload crosses the terminal MCP
+// boundary and is later injected into builder/reviewer prompts.
+export const FLOW_CONTRACT_LIMITS = Object.freeze({
+  maxNonGoals: 6,
+  maxNonGoalChars: 240,
+  maxBaselineGateChars: 600,
+  maxBaselineEvidenceChars: 1400,
+})
+
+const BASELINE_NEGATIVE_SIGNAL = /\b(fail(?:s|ed|ing)?|absent|missing|not\s+(?:present|implemented|available|found)|does\s+not|404|empty)\b/i
+const hasDisallowedControl = (value) => {
+  for (const char of value) {
+    const code = char.charCodeAt(0)
+    if (code === 0x7f || (code < 0x20 && code !== 0x09)) return true
+  }
+  return false
+}
+
+function boundedLine (value, label, max, { required = false } = {}) {
+  if (value == null || value === '') {
+    if (required) throw new Error(`${label} is required`)
+    return ''
+  }
+  if (typeof value !== 'string') throw new Error(`${label} must be a string`)
+  const text = value.trim()
+  if (!text) {
+    if (required) throw new Error(`${label} is required`)
+    return ''
+  }
+  if (text.length > max) throw new Error(`${label} exceeds ${max} characters`)
+  if (hasDisallowedControl(text)) throw new Error(`${label} must be safe single-line text`)
+  return text
+}
+
+export function normalizeBaselineEvidence (value) {
+  return boundedLine(value, 'baseline evidence receipt', FLOW_CONTRACT_LIMITS.maxBaselineEvidenceChars, { required: true })
+}
+
+function contractSource (task) {
+  const source = task?.contract && typeof task.contract === 'object' && !Array.isArray(task.contract)
+    ? { ...task.contract }
+    : {}
+  if (source.nonGoals === undefined) source.nonGoals = task?.nonGoals ?? task?.non_goals
+  if (source.baseline === undefined) source.baseline = task?.baseline ?? task?.baselineGate ?? task?.baseline_gate
+  return source
+}
+
+// Strict for new terminal submissions. `legacy:true` is restore-only: old persisted
+// plans predate this contract and must remain runnable, but they can never be used to
+// submit a new incomplete plan.
+export function normalizeTaskContract (task, { sliceType, legacy = false } = {}) {
+  const source = contractSource(task)
+  if (sliceType === SLICE_TYPE.review) return null
+  const required = !legacy
+  const rawNonGoals = source.nonGoals
+  const values = rawNonGoals == null ? [] : (Array.isArray(rawNonGoals) ? rawNonGoals : [rawNonGoals])
+  if (values.length > FLOW_CONTRACT_LIMITS.maxNonGoals) throw new Error(`non-goals exceeds ${FLOW_CONTRACT_LIMITS.maxNonGoals} items`)
+  const nonGoals = values.map((value) => boundedLine(value, 'non-goal', FLOW_CONTRACT_LIMITS.maxNonGoalChars, { required: true }))
+  if (required && !nonGoals.length) throw new Error('explicit non-goals are required for builder/fix/scaffold tasks')
+
+  const rawBaseline = source.baseline
+  const baselineObject = typeof rawBaseline === 'string' ? { gate: rawBaseline } : rawBaseline
+  if (baselineObject != null && (typeof baselineObject !== 'object' || Array.isArray(baselineObject))) throw new Error('baseline gate must be a string or object')
+  const gate = boundedLine(baselineObject?.gate ?? baselineObject?.expectation, 'baseline gate', FLOW_CONTRACT_LIMITS.maxBaselineGateChars, { required })
+  if (gate && !BASELINE_NEGATIVE_SIGNAL.test(gate)) throw new Error('baseline gate must state what fails or is absent before implementation')
+  const evidence = baselineObject?.evidence == null || baselineObject?.evidence === ''
+    ? ''
+    : normalizeBaselineEvidence(baselineObject.evidence)
+  return { nonGoals, baseline: gate ? { gate, evidence } : null }
+}
+
 // A FlowTask slice. Each is RUNNABLE — a lane can build + run + self-correct it in
 // its own WebContainer (research: the runtime is the moat). Partition by file
 // ownership (scope) so two lanes never edit the same file (a branch is NOT isolation).
-export function makeTask ({ key, title, scope = '', acceptance = '', deps = [], sliceType = SLICE_TYPE.feature }) {
+export function makeTask ({ key, title, scope = '', acceptance = '', deps = [], sliceType = SLICE_TYPE.feature, contract = null }) {
   if (!key || typeof key !== 'string') throw new Error('task key required (string)')
   if (!title) throw new Error('task title required')
   if (!Array.isArray(deps)) throw new Error('deps must be an array of task keys')
@@ -56,6 +128,7 @@ export function makeTask ({ key, title, scope = '', acceptance = '', deps = [],
     title,
     scope,            // files/components this lane OWNS (disjoint from other slices)
     acceptance,       // runnable proof the lane + reviewer use to call it done
+    contract,          // bounded gate-first contract; null only for legacy/restored rows
     deps,             // task keys this depends on (must form a DAG)
     sliceType,
     status: TASK_STATUS.pending,
@@ -142,7 +215,7 @@ export function makeFlowSession ({ prompt, mode = FLOW_MODE.guide, sessionRef =
 // Accepts a parsed object OR a JSON string (optionally ```json-fenced). Throws if the
 // tasks don't form a real DAG. Lives in this shared module so neither the bridge nor
 // the client has to import across the bridge↔src boundary.
-export function normalizePlanOutput (raw) {
+export function normalizePlanOutput (raw, { legacy = false } = {}) {
   let obj = raw
   if (typeof raw === 'string') {
     let s = raw.trim()
@@ -167,9 +240,24 @@ export function normalizePlanOutput (raw) {
       acceptance: String(t.acceptance ?? ''),
       deps: Array.isArray(t.deps) ? t.deps.map(String) : [],
       sliceType: Object.values(SLICE_TYPE).includes(sliceType) ? sliceType : SLICE_TYPE.feature,
+      contract: normalizeTaskContract(t, { sliceType: Object.values(SLICE_TYPE).includes(sliceType) ? sliceType : SLICE_TYPE.feature, legacy }),
     })
   })
   validateDag(tasks)
+  for (const task of tasks) {
+    if (task.sliceType !== SLICE_TYPE.review) continue
+    // New review tasks verify exactly one builder contract. Legacy persisted reviews
+    // keep their prior multi-target shape for restore compatibility only.
+    if (legacy) continue
+    if (task.deps.length !== 1) throw new Error(`review task "${task.key}" must depend on exactly one builder task to inherit its contract`)
+    const target = tasks.find((candidate) => candidate.key === task.deps[0])
+    if (!target || target.sliceType === SLICE_TYPE.review) throw new Error(`review task "${task.key}" must target a builder/fix/scaffold task`)
+    task.contract = {
+      nonGoals: [...(target.contract?.nonGoals || [])],
+      baseline: target.contract?.baseline ? { ...target.contract.baseline } : null,
+      inheritedFrom: target.key,
+    }
+  }
   return { summary, tasks }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.360",
+  "version": "0.7.361",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {

package/recap.mjs

@@ -20,6 +20,13 @@
 
 // Default hard cap for the context-carry recap (chars of transcript body, framing extra).
 export const RECAP_CAP = 20000
+// A checkpoint is deliberately much smaller than its enclosing recap. It is a
+// deterministic index over visible text, not a second transcript or an agent
+// summary. Keeping it bounded independently makes it safe to persist as the
+// pending carry across a reset/restart.
+export const CHECKPOINT_CAP = 6000
+const CHECKPOINT_START = '--- deterministic checkpoint (visible text only; evidence, not hidden state) ---'
+const CHECKPOINT_END = '--- end deterministic checkpoint ---'
 
 // A fresh human turn can race the session-init event that would otherwise send a
 // pending recap by itself. When that happens, the current request must have an
@@ -28,10 +35,156 @@ export const CURRENT_PERSON_REQUEST_MARKER = '--- CURRENT PERSON REQUEST (author
 
 // Recaps are an outbound context source. Keep the same privacy boundary as the
 // bridge manifest without importing Node-only hashing into the browser bundle.
-const UNSAFE_CONTEXT = /(?:\/home\/|\/users\/|\/private\/|\/tmp\/|[a-z]:\\|\\\\|sk[_-][a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|raw transcript|tool args?|chain[ -]of[ -]thought|hidden reasoning)/i
+// A visible turn containing an unsafe span is omitted whole. Partial redaction
+// could preserve enough neighboring material to reconstruct a credential or
+// host location, so this boundary deliberately fails closed.
+const HOST_PATH = /(?:file:\/\/|[a-z]:\\|\\\\|(?:^|[^a-z0-9/])(?:~[\\/]|\/(?:users|home|private|tmp|var\/folders|volumes|root|workspace|workspaces|mnt|srv|opt|etc)\/))/i
+// Traversal is a path segment, not a path prefix. Keep it separate from
+// HOST_PATH so nested forms such as `foo/../secret` and `foo\..\secret`
+// cannot bypass a boundary rule intended for absolute path roots.
+const PATH_TRAVERSAL = /(?:^|[^a-z0-9.])\.\.(?:[\\/]|$)/i
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|sbp_[a-z0-9_-]{20,}|sb_secret_[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|hooks\.slack\.com\/services\/[a-z0-9/_-]{8,})/i
+const SECRET_ASSIGNMENT = /(?:[a-z0-9]+[_ -])*(?:token|secret(?:[_ -]access[_ -]key)?|password|authorization|api[_ -]?key|private[_ -]?key|access[_ -]?key(?:[_ -]?id)?)\s*[:=]\s*\S{4,}/i
+const PROHIBITED_CONTEXT = /(?:BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|raw transcript|tool args?|chain[ -]of[ -]thought|hidden reasoning|system prompt|environment dump|provider key)/i
 const safeRecapText = (value) => {
   const text = String(value || '').trim()
-  return text && !UNSAFE_CONTEXT.test(text) ? text : ''
+  return text && !HOST_PATH.test(text) && !PATH_TRAVERSAL.test(text) && !SECRET_VALUE.test(text) && !SECRET_ASSIGNMENT.test(text) && !PROHIBITED_CONTEXT.test(text) ? text : ''
+}
+
+const clip = (value, cap) => {
+  const text = String(value || '').trim().replace(/\s+/g, ' ')
+  if (!text) return ''
+  return text.length <= cap ? text : `${text.slice(0, Math.max(0, cap - 1)).trimEnd()}…`
+}
+
+const visibleTurns = (log) => {
+  if (!Array.isArray(log)) return []
+  const turns = []
+  for (const event of log) {
+    if (!event || typeof event !== 'object') continue
+    if (event.kind === 'you') {
+      const text = safeRecapText(event.text)
+      if (text) turns.push({ who: 'person', text })
+      continue
+    }
+    if (event.kind !== 'assistant') continue
+    const text = (Array.isArray(event.blocks) ? event.blocks : [])
+      .filter((block) => block?.type === 'text')
+      .map((block) => safeRecapText(block.text))
+      .filter(Boolean)
+      .join('\n')
+    if (text) turns.push({ who: 'assistant', text })
+  }
+  return turns
+}
+
+const unique = (values, cap = 6) => [...new Set(values.filter(Boolean))].slice(0, cap)
+const sentenceCandidates = (turns, matcher, cap = 4) => unique(
+  turns.flatMap((turn) => turn.text.split(/(?<=[.!?])\s+|\n+/)
+    .map((line) => clip(line, 500))
+    .filter((line) => matcher.test(line))),
+  cap,
+)
+
+const publicReceipts = (turns) => {
+  const receipts = []
+  for (const { text } of turns) {
+    // Never infer a receipt from an unsafe source turn; safeRecapText already
+    // rejected host paths, credential-shaped values, and hidden/tool text.
+    for (const sha of text.matchAll(/\b[0-9a-f]{7,40}\b/gi)) receipts.push(`commit ${sha[0]}`)
+    for (const file of text.matchAll(/(?<![\w/])(?:[\w.-]+\/)+[\w.-]+\.(?:[cm]?[jt]sx?|json|md|css|html|py|sh|yml|yaml)\b/g)) receipts.push(`file ${file[0]}`)
+    for (const url of text.matchAll(/https?:\/\/[^\s)\]}>]+/gi)) {
+      const candidate = safeRecapText(url[0])
+      if (candidate) receipts.push(`URL ${candidate}`)
+    }
+  }
+  return unique(receipts, 8)
+}
+
+/*
+ * Build a small, explicit resume checkpoint from *only* the visible person and
+ * assistant text that buildRecapFromLog is allowed to carry. This intentionally
+ * does not read tool calls/results, thinking, runtime state, files, or external
+ * systems. It is heuristic evidence, so labels stay conservative: absence is
+ * stated as "not established" rather than invented work/completion.
+ */
+export function buildCheckpointFromLog(log, cap = CHECKPOINT_CAP) {
+  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
+  if (!budget) return ''
+  const turns = visibleTurns(log)
+  if (!turns.length) return ''
+  const people = turns.filter((turn) => turn.who === 'person')
+  const assistants = turns.filter((turn) => turn.who === 'assistant')
+  const objective = clip(people.at(-1)?.text || 'not established from visible text', 1400)
+  const recent = clip(assistants.at(-1)?.text || turns.at(-1)?.text || 'not established from visible text', 1400)
+  const blockers = sentenceCandidates(turns, /\b(block(?:ed|er|ing)?|cannot|can['’]?t|unable|waiting|stuck|failed|failure|error|unverified)\b/i)
+  const attempted = sentenceCandidates(assistants, /\b(implemented|added|changed|updated|fixed|ran|tested|checked|inspected|tried|attempted|committed|built)\b/i)
+  const completed = sentenceCandidates(assistants, /\b(done|complete(?:d)?|implemented|fixed|passing|passed|succeeded|shipped)\b/i)
+  const next = clip(
+    people.length > 1 ? people.at(-1)?.text :
+      sentenceCandidates(assistants, /\b(next|remaining|follow[- ]?up|todo|will)\b/i, 1)[0] || 'not established from visible text',
+    1000,
+  )
+  const lines = [
+    CHECKPOINT_START,
+    `Objective / live request: ${objective}`,
+    `Current step / recent work: ${recent}`,
+    `Blockers: ${blockers.length ? blockers.join(' | ') : 'none stated in visible text'}`,
+    `Attempted / completed actions: ${attempted.length || completed.length ? unique([...attempted, ...completed], 6).join(' | ') : 'not established from visible text'}`,
+    `Receipts: ${publicReceipts(turns).join(' | ') || 'none safely detected'}`,
+    `Next action: ${next}`,
+    CHECKPOINT_END,
+  ]
+  // Preserve explicit labels under a small caller cap; trim values before
+  // trimming structure so a checkpoint never becomes a misleading fragment.
+  let checkpoint = lines.join('\n')
+  if (checkpoint.length <= budget) return checkpoint
+  const minimal = [
+    lines[0],
+    'Objective / live request:',
+    'Current step / recent work:',
+    'Blockers:',
+    'Attempted / completed actions:',
+    'Receipts:',
+    'Next action:',
+    lines.at(-1),
+  ].join('\n')
+  // A partial envelope could be mistaken for a complete checkpoint. Fail closed
+  // rather than omit a label or expose an over-budget payload.
+  if (minimal.length > budget) return ''
+  const allowance = budget - minimal.length - 6 // one separating space per field
+  const values = [objective, recent, blockers.join(' | '), unique([...attempted, ...completed], 6).join(' | '), publicReceipts(turns).join(' | '), next]
+  const shares = values.map((value) => clip(value, Math.max(0, Math.floor(allowance / values.length))))
+  checkpoint = [
+    lines[0],
+    `Objective / live request: ${shares[0] || 'not established'}`,
+    `Current step / recent work: ${shares[1] || 'not established'}`,
+    `Blockers: ${shares[2] || 'none stated'}`,
+    `Attempted / completed actions: ${shares[3] || 'not established'}`,
+    `Receipts: ${shares[4] || 'none safely detected'}`,
+    `Next action: ${shares[5] || 'not established'}`,
+    lines.at(-1),
+  ].join('\n')
+  return checkpoint
+}
+
+export function recapHasCheckpoint(value) {
+  const text = String(value || '')
+  return text.includes(CHECKPOINT_START) && text.includes(CHECKPOINT_END)
+}
+
+// A recap that already contains the checkpoint is the sole delivery owner.
+// Resolve this in one place for both restored sessions and the live fallback
+// compaction path; otherwise an older separately-persisted checkpoint can sit
+// beside the recap and be prepended a second time on the next person turn.
+export function resolveCheckpointCarry(carryRecap, carryCheckpoint) {
+  const pendingRecap = typeof carryRecap === 'string' && carryRecap.trim()
+    ? carryRecap
+    : null
+  const pendingCheckpoint = !recapHasCheckpoint(pendingRecap) && typeof carryCheckpoint === 'string' && carryCheckpoint.trim()
+    ? carryCheckpoint
+    : null
+  return { pendingRecap, pendingCheckpoint }
 }
 
 export function appendCurrentPersonRequest(carried, text) {
@@ -88,7 +241,7 @@ const FRAMING = {
 
    `reason` selects the framing only; the windowing is identical and the default
    ('switch') is byte-for-byte what this function returned before the S4 extraction. */
-export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } = {}) {
+export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch', includeCheckpoint = true } = {}) {
   if (!Array.isArray(log) || !log.length) return ''
   const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
   if (!budget) return ''
@@ -127,6 +280,11 @@ export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } =
   kept.reverse()
   const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
   const frame = FRAMING[reason] || FRAMING.switch
+  // Side-lane snapshots already have their own explicit handoff contract. A
+  // deterministic resume checkpoint belongs only to a lane that is actually
+  // losing SDK context (switch, wake, or compaction); adding it to side
+  // snapshots duplicates visible text and can exceed their bounded payload.
+  const checkpoint = includeCheckpoint ? buildCheckpointFromLog(log) : ''
   return [
     frame.header,
     frame.body,
@@ -134,5 +292,6 @@ export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } =
     '--- conversation so far (oldest → newest) ---',
     body,
     '--- end recap ---',
+    checkpoint,
   ].join('\n')
 }

package/side-lane.mjs

@@ -12,7 +12,7 @@ export const SIDE_MAIN_TURN_PROMPT = `A room member chose Bring to main.
 Read the side-lane handoff below, incorporate the relevant findings into the main lane's current work, and respond now. If the handoff recommends a next step that is already authorized and in scope, take it; otherwise explain the concrete impact on the current work.`
 
 export function sideSnapshot(log) {
-  return buildRecapFromLog(Array.isArray(log) ? log : [], SIDE_RECAP_CAP)
+  return buildRecapFromLog(Array.isArray(log) ? log : [], SIDE_RECAP_CAP, { includeCheckpoint: false })
 }
 
 export function assistantTextSince(log, afterSeq = 0) {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 20,
+  "bundleVersion": 21,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,13 +130,13 @@
     },
     {
       "id": "flow-completion",
-      "version": 2,
+      "version": 3,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, and a real pre-edit failure/absence gate; completion supplies the observed baseline evidence and the exact dependent reviewer inherits it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [