thinkpool-pair 0.7.361 → 0.7.363

package/bridge.mjs

@@ -77,7 +77,7 @@ import { explicitKeepAwakeChoice, keepAwakeEnabled, saveKeepAwakePreference, sta
 
 const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
-import { legacyBuilderCompletionAllowed, normalizeBaselineEvidence, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
+import { legacyBuilderCompletionAllowed, normalizeBaselineEvidence, normalizePlanOutput, validatePlanForRuntime, validateTaskContractSeal, validReviewTargetShape } from './flow-task-graph.mjs'
 import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, resolveHermesOpenModel, assertRuntimeModelCompatible } from './flow-models.mjs'
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
 // the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
@@ -97,6 +97,9 @@ function stopFlowPreviews (flowId, laneId = null) {
   }
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
+import { createFlowReviewReceipt, createFlowReviewSingleFlight, isFlowReviewReceipt } from './flow-receipt.mjs'
+import { collectFlowScopeEvidence, normalizeFlowScopeEvidence } from './flow-scope-evidence.mjs'
+import { formatPastWorkSearch, searchPastWork } from './past-work-search.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
 import { IMMUTABLE_REVIEW_READ_TOOL_EXTRAS, UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
@@ -124,12 +127,35 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
+const changedFilesBetween = (cwd, baseSha, candidateSha) => {
+  if (!cwd || !baseSha || !candidateSha) return null
+  try {
+    return execFileSync('git', ['-C', cwd, 'diff', '--name-only', '--diff-filter=ACMRD', `${baseSha}..${candidateSha}`], {
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).split('\n').map((line) => line.trim()).filter(Boolean)
+  } catch {
+    return null
+  }
+}
+const worktreeChanges = (cwd) => {
+  try {
+    return execFileSync('git', ['-C', cwd, 'status', '--porcelain=v1', '--untracked-files=all'], {
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).split('\n').map((line) => line.trim()).filter(Boolean)
+  } catch {
+    return null
+  }
+}
 import { formatPeek, PEEK, readTerminalTurnBudgetDecision, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, settleLaneControl, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { realtimeRecoveryDecision, turnInFlight } from './update-gate.mjs'
-import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage, acknowledgePendingScheduledOutcome, commitRecordedScheduledOutcome, deletePendingScheduledOutcome, loadPendingScheduledOutcome, loadPendingScheduledOutcomes, savePendingScheduledOutcome } from './session-store.mjs'
+import { saveSession, flushSession, deleteSession, loadAll, loadArchived, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage, acknowledgePendingScheduledOutcome, commitRecordedScheduledOutcome, deletePendingScheduledOutcome, loadPendingScheduledOutcome, loadPendingScheduledOutcomes, savePendingScheduledOutcome } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, appendCurrentPersonRequest, buildCheckpointFromLog, buildRecapFromLog, resolveCheckpointCarry, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
 import { createLatestReplayPump, requestedReplayIds } from './replay-transport.mjs'
 import { classifyCodeEvent, unknownCodeEventNotice } from './code-event-contract.mjs'
@@ -966,11 +992,13 @@ const MIN_TURN_MS = Number(process.env.TP_NOTIFY_MIN_TURN_MS) > 0
   ? Number(process.env.TP_NOTIFY_MIN_TURN_MS) : DEFAULT_MIN_TURN_MS
 function persistAgentEvent (payload) {
   if (AGENT_NOTIFY_OFF || !codeAuthToken || !myServeUid || !room) return
+  const { eventId, ...eventPayload } = payload || {}
+  const stableId = typeof eventId === 'string' && /^[A-Za-z0-9_-]{1,120}$/.test(eventId) ? eventId : randomUUID()
   const row = {
-    id: `ae:${randomUUID()}`,
+    id: `ae:${stableId}`,
     session_code: room,
     author_id: myServeUid,
-    payload: { __agent: true, ts: Date.now(), ...payload },
+    payload: { __agent: true, ts: Date.now(), ...eventPayload },
   }
   fetch(`${SUPABASE_URL}/rest/v1/code_messages`, {
     method: 'POST',
@@ -2533,7 +2561,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, carryCheckpoint, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
+function openStructured({ id, runtime = 'claude', model, models, effort, resume, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, rolePrompt, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, carryCheckpoint, lastUsage, receivedTurnCids, scheduleRunId, scheduleDeadlineAt, scheduleOutcomeRecorded, scheduleAdmissionLease }) {
   if (sessions.has(id)) return
   runtime = structuredRuntimeMetadata(runtime) ? runtime : 'claude'
   // Fail closed before exposing a native lane if its bridge semantic contract
@@ -2606,6 +2634,9 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     flowReviewTargets: Array.isArray(flowReviewTargets) && flowReviewTargets.length ? flowReviewTargets.filter(Boolean) : (flowReviewTarget ? [flowReviewTarget] : []),
     flowReviewSnapshots: Array.isArray(flowReviewSnapshots) ? flowReviewSnapshots.filter((item) => item?.taskKey && item?.sha && item?.cwd) : [],
     flowReviewRound: Number.isInteger(flowReviewRound) && flowReviewRound >= 0 ? flowReviewRound : 0,
+    flowReviewConclusion: flowReviewConclusion?.taskKey && ['pass', 'reject', 'surface'].includes(flowReviewConclusion?.action) && isFlowReviewReceipt(flowReviewConclusion?.receipt)
+      ? { taskKey: flowReviewConclusion.taskKey, action: flowReviewConclusion.action, round: flowReviewConclusion.round, receipt: flowReviewConclusion.receipt }
+      : null,
     dispatchBaseSha: dispatchBaseSha || null,
     revertTarget: revertTarget || null,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
@@ -2676,6 +2707,25 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     if (!reviewPass && entry.dispatchBaseSha && commitSha === entry.dispatchBaseSha) {
       return `Slice "${entry.flowTaskKey}" is not done: HEAD is still the dispatch base (${commitSha.slice(0, 8)}). Commit the verified implementation first.`
     }
+    if (!reviewPass) {
+      const dirty = worktreeChanges(entry.cwd || process.cwd())
+      if (dirty == null) return `Slice "${entry.flowTaskKey}" is not done: the bridge could not verify a clean worktree.`
+      if (dirty.length) return `Slice "${entry.flowTaskKey}" is not done: commit or remove every remaining worktree change before completion (${dirty.slice(0, 4).join(', ')}).`
+    }
+    let scopeEvidence = null
+    if (!reviewPass && entry.flowTaskContract?.scopePaths?.length) {
+      const changed = changedFilesBetween(entry.cwd || process.cwd(), entry.dispatchBaseSha, commitSha)
+      if (!changed) return `Slice "${entry.flowTaskKey}" is not done: the bridge could not derive its Git scope footprint.`
+      scopeEvidence = collectFlowScopeEvidence({
+        log: entry.log,
+        repoRoot: entry.cwd || process.cwd(),
+        declared: entry.flowTaskContract.scopePaths,
+        changed,
+      })
+      if (!scopeEvidence.held) {
+        return `Slice "${entry.flowTaskKey}" is not done: scope drift detected in ${scopeEvidence.unexpected.join(', ')}. The approved scope must be amended before these files can ship.`
+      }
+    }
     let previewUrl = null
     try { const pv = await startPreview({ dir: entry.cwd || process.cwd(), id: `lane:${entry.flowSessionId}:${id}` }); previewUrl = pv.url } catch { /* preview best-effort */ }
     // S1 (context-offload) — digest THIS closed slice into the durable store so the next
@@ -2706,8 +2756,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       process.stderr.write(`\n  ${A.dim}◆ flow digest skip ${entry.flowTaskKey} — ${e?.message || e}${A.rst}\n`)
     }
     const completedContract = requiresBaselineReceipt
-      ? { ...entry.flowTaskContract, baseline: { ...entry.flowTaskContract.baseline, evidence: baselineReceipt } }
-      : entry.flowTaskContract || null
+      ? { ...entry.flowTaskContract, baseline: { ...entry.flowTaskContract.baseline, evidence: baselineReceipt }, ...(scopeEvidence ? { scopeEvidence } : {}) }
+      : entry.flowTaskContract
+        ? { ...entry.flowTaskContract, ...(scopeEvidence ? { scopeEvidence } : {}) }
+        : null
     bcast('flow-task-done', { term: id, flowId: entry.flowSessionId, taskKey: entry.flowTaskKey, laneId: id, commitSha, previewUrl, contract: completedContract, ...(reviewPass ? { reviewAction: 'pass' } : {}) }, flowChannel)
     process.stderr.write(`\n  ${A.cyan}◆ flow slice done — ${entry.flowTaskKey} (${commitSha ? commitSha.slice(0, 8) : 'no commit'})${previewUrl ? ` · preview ${previewUrl}` : ''}${A.rst}\n`)
     entry.flowDone = true   // FL-B3 — retire immediately so it drops from the ≤8 lane cap
@@ -2719,7 +2771,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // review gate was dead code: reviewers had no working emit path, so a failing slice was
   // never reverted). On FAIL → broadcast flow-revert for the reviewed slice (the client flips
   // it to pending → the next wave rebuilds it). Either way the review lane itself is done.
-  const onReviewVerdict = async (raw) => {
+  const processReviewVerdict = async (raw) => {
     if (!entry.flowSessionId || !entry.flowTaskKey || entry.flowRole !== 'reviewer') return { ok: false, message: 'Not a Flow review lane.' }
     let v, target = null
     try {
@@ -2737,6 +2789,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         ? `Review verdict REJECTED: ${e?.message || e}. Re-call submit_flow_review with a valid authorized taskKey.`
         : `Review verdict REJECTED: ${e?.message || e}. Re-Write FLOW_REVIEW.json with {"pass":<boolean>,"reasons":["<specific finding>"],"taskKey":"<the slice you reviewed>"}.` }
     }
+    if (entry.flowReviewConclusion) return { ok: true, message: `Review already concluded for ${entry.flowReviewConclusion.taskKey}; receipt ${entry.flowReviewConclusion.receipt.cid || 'recorded'}.` }
     // E1 A1/A2 — the BOUNDED reviewer loop, live side. Each FLOW_REVIEW.json write is ONE
     // hunt round; the governor decides continue-vs-stop from the round count + the lane's
     // REAL budget (flowBudgets ledger). A bare pass:true (happy path held, not yet exhausted)
@@ -2778,15 +2831,53 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     } else {
       process.stderr.write(`\n  ${A.cyan}◆ review ${decision.action.toUpperCase()} (round ${round}) — ${target || entry.flowTaskKey}${A.rst}\n`)
     }
-    // Durable room-visible verdict. `persistAgentEvent` below is intentionally
-    // filtered from the transcript (push/unread transport only), while this control
-    // row is archived with the reviewer lane and broadcast to both room members.
-    // In particular, a held review must show its exact findings instead of leaving
-    // the red task state unexplained after the ephemeral Flow broadcast is gone.
-    const visibleReview = {
-      kind: 'control',
-      text: `Flow review ${decision.action.toUpperCase()} — ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}`,
+    // Durable room-visible verdict. Bind a conclusive pass to the exact immutable
+    // builder snapshot plus the acceptance digest inherited at approval time. A
+    // missing/malformed proof can never look like a verified pass: it becomes a
+    // held receipt and assembly stays blocked for pair adjudication.
+    const reviewedTaskKey = target || entry.flowTaskKey
+    const targetSnapshot = entry.flowReviewSnapshots.find((item) => item.taskKey === reviewedTaskKey) || null
+    const acceptanceDigest = entry.flowTaskContract?.digest || null
+    let terminalAction = decision.action
+    let receiptReasons = v.reasons.length ? v.reasons : [decision.reason]
+    let visibleReview
+    try {
+      visibleReview = createFlowReviewReceipt({
+        taskKey: reviewedTaskKey,
+        outcome: terminalAction === 'surface' ? 'held' : terminalAction,
+        rounds: round,
+        candidateSha: targetSnapshot?.sha,
+        acceptanceDigest,
+        scope: targetSnapshot?.scopeEvidence,
+        reasons: receiptReasons,
+      })
+    } catch (error) {
+      if (terminalAction !== 'pass') {
+        return { ok: false, message: `Review verdict REJECTED: ${error?.message || error}.` }
+      }
+      terminalAction = 'surface'
+      receiptReasons = [...receiptReasons, 'Exact candidate or sealed acceptance proof is missing; pass was held.']
+      visibleReview = createFlowReviewReceipt({
+        taskKey: reviewedTaskKey,
+        outcome: 'held',
+        rounds: round,
+        candidateSha: targetSnapshot?.sha,
+        acceptanceDigest,
+        scope: targetSnapshot?.scopeEvidence,
+        reasons: receiptReasons,
+      })
+    }
+    visibleReview.cid = randomUUID()
+    entry.flowReviewConclusion = {
+      taskKey: reviewedTaskKey,
+      action: terminalAction,
+      round,
+      receipt: visibleReview,
     }
+    // Persist the conclusion before emitting side effects. A retry or restart
+    // can reconstruct a missing transcript row from this safe receipt, but can
+    // never conclude the same review twice.
+    entry.flush?.()
     pushLog(entry, visibleReview)
     bcast('code-event', { term: id, evt: visibleReview })
     entry.flush?.()
@@ -2796,45 +2887,53 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     // broadcast, does NOT change the revert/gate flow.
     bcast('flow-review-verdict', {
       term: id, flowId: entry.flowSessionId,
-      taskKey: target || entry.flowTaskKey,
-      pass: v.pass,
-      reasons: v.reasons,
-      action: decision.action,
+      taskKey: reviewedTaskKey,
+      pass: terminalAction === 'pass',
+      reasons: receiptReasons,
+      action: terminalAction,
       rounds: round,
-      surfaceToPair: decision.surfaceToPair,
+      surfaceToPair: terminalAction === 'surface' || decision.surfaceToPair,
       prompt: pairAdjudicationPrompt({
-        action: decision.action,
-        reason: decision.reason,
-        taskKey: target || entry.flowTaskKey,
-        findings: v.reasons,
+        action: terminalAction,
+        reason: terminalAction === decision.action ? decision.reason : receiptReasons.at(-1),
+        taskKey: reviewedTaskKey,
+        findings: receiptReasons,
       }),
     }, flowChannel)
     let doneMsg = ''
-    if (decision.action === 'pass') {
+    if (terminalAction === 'pass') {
       doneMsg = await markFlowDone({ reviewPass: true })
     } else {
-      if (decision.action === 'surface') {
-        bcast('flow-review-held', { term: id, flowId: entry.flowSessionId, reviewTaskKey: entry.flowTaskKey, taskKey: target, reasons: v.reasons }, flowChannel)
-        persistAgentEvent({ kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review held ${target || entry.flowTaskKey}: ${v.reasons.join('; ') || decision.reason}` })
+      if (terminalAction === 'surface') {
+        bcast('flow-review-held', { term: id, flowId: entry.flowSessionId, reviewTaskKey: entry.flowTaskKey, taskKey: target, reasons: receiptReasons }, flowChannel)
+        persistAgentEvent({ eventId: visibleReview.cid, kind: 'needs-input', term: id, termName: termNames[id] || null, summary: `Flow review held ${reviewedTaskKey}: ${receiptReasons.join('; ') || decision.reason}` })
       }
       // A reject must rebuild the target and then run a fresh reviewer. Retire that
       // reviewer now. A surfaced inconclusive review is different: keep its lane
       // alive with the durable control row above so either room member can open the
       // held review, read the exact findings, and continue/adjudicate after reload.
       // Neither outcome emits task-done or permits assembly.
-      if (decision.action === 'reject') {
+      if (terminalAction === 'reject') {
         entry.flowDone = true
         entry.flush?.()
         setTimeout(() => { try { endStructured(id) } catch { /* already gone */ } }, 2500)
       }
     }
-    const label = decision.action === 'reject'
-      ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${v.reasons.join('; ').slice(0, 140)})`
-      : decision.action === 'surface'
-        ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${decision.reason}`
+    const label = terminalAction === 'reject'
+      ? `REJECT (round ${round}) — reverting ${target || '(no target)'} (${receiptReasons.join('; ').slice(0, 140)})`
+      : terminalAction === 'surface'
+        ? `SURFACED to the pair after ${round} round${round === 1 ? '' : 's'} — ${receiptReasons.at(-1) || decision.reason}`
         : `PASS (round ${round})`
     return { ok: true, message: `Review verdict recorded: ${label}.${doneMsg ? ` ${doneMsg}` : ''}` }
   }
+  const runFlowReviewVerdict = createFlowReviewSingleFlight()
+  const onReviewVerdict = async (raw) => {
+    if (entry.flowReviewConclusion) return { ok: true, message: `Review already concluded for ${entry.flowReviewConclusion.taskKey}; receipt ${entry.flowReviewConclusion.receipt.cid || 'recorded'}.` }
+    // One terminal verdict is one transaction. In particular, reject awaits the
+    // host revert before it can persist its conclusion; without this single-flight
+    // fence two simultaneous submissions can both cross that await and revert/emit.
+    return runFlowReviewVerdict(() => processReviewVerdict(raw))
+  }
   // Identity for the durable archive — pushLog appends every new transcript event to
   // <room>/<id>.events.jsonl keyed off these. Seed the archive once from the restored
   // (≤2000) log so the retained window is immediately pageable; no-op if it already
@@ -2891,13 +2990,19 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, carryCheckpoint: entry.pendingCheckpoint || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, effort: entry.effort, model: entry.model || null, models: entry.runtime === 'hermes' ? (entry.models || []) : undefined, provider: entry.provider || null, spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth || 0, cascadeRole: entry.cascadeRole || null, hop: entry.hop || 0, sideParent: entry.sideParent, sideTask: entry.sideTask, scheduleRunId: entry.scheduleRunId || null, scheduleDeadlineAt: entry.scheduleDeadlineAt || null, scheduleOutcomeRecorded: entry.scheduleOutcomeRecorded === true, scheduleAdmissionLease: entry.scheduleAdmissionLease || null, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole || null, flowReviewTargets: entry.flowReviewTargets || [], flowReviewSnapshots: entry.flowReviewSnapshots || [], flowReviewRound: entry.flowReviewRound || 0, flowReviewConclusion: entry.flowReviewConclusion, dispatchBaseSha: entry.dispatchBaseSha || null, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null, carryRecap: entry.pendingRecap || null, carryCheckpoint: entry.pendingCheckpoint || null, receivedTurnCids: [...entry.receivedTurnCids].slice(-1000) })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
   // 1.5s saveSession debounce window) and on shutdown (so events since the last
   // debounced write aren't lost). Contract #2: restart resumes, no lost messages.
   entry.flush = () => flushSession(room, id, sessionData())
+  if (entry.flowReviewConclusion?.receipt && !entry.log.some((event) => event?.cid === entry.flowReviewConclusion.receipt.cid)) {
+    const restoredReceipt = { ...entry.flowReviewConclusion.receipt }
+    pushLog(entry, restoredReceipt)
+    bcast('code-event', { term: id, evt: restoredReceipt })
+    entry.flush()
+  }
   if (entry.scheduleOutcomeRecorded && entry.scheduleAdmissionLease) {
     void releaseScheduledAdmissionForEntry(entry).then((released) => {
       if (released) entry.flush?.()
@@ -3091,6 +3196,44 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           return { content: [{ type: 'text', text }] }
         },
       ),
+      ...(!entry.flowRole ? [tool(
+        'search_past_work',
+        'Search bounded saved terminal work from THIS ThinkPool room. Returns privacy-filtered excerpts for prior decisions, failed attempts, commands, checks, and Flow receipts. Every hit cites the room, terminal, date, and event sequence. It never searches another room, exposes prompts or host paths, or changes state.',
+        {
+          query: z.string().min(2).max(160).describe('specific terms from the prior decision, failure, command, check, or feature'),
+          limit: z.number().int().min(1).max(8).optional().describe('maximum cited hits; default 8'),
+        },
+        async (args) => {
+          if (entry.pastWorkSearchTurnRev !== entry._turnRev) {
+            entry.pastWorkSearchTurnRev = entry._turnRev
+            entry.pastWorkSearchCount = 0
+          }
+          if ((entry.pastWorkSearchCount || 0) >= 3) {
+            return { content: [{ type: 'text', text: 'Past-work search limit reached for this turn (3). Use the cited results already returned or narrow the next room turn.' }] }
+          }
+          entry.pastWorkSearchCount = (entry.pastWorkSearchCount || 0) + 1
+          const records = new Map()
+          for (const record of loadArchived(room, 40)) {
+            if (!record?.id || !Array.isArray(record.log)) continue
+            records.set(record.id, { id: record.id, name: termNames[record.id] || record.name || 'Archived terminal', savedAt: record.savedAt || record._archivedAt, log: record.log })
+          }
+          for (const [terminalId, terminalEntry] of sessions) {
+            records.set(terminalId, {
+              id: terminalId,
+              name: termNames[terminalId] || `Terminal ${String(terminalId).slice(0, 8)}`,
+              savedAt: terminalEntry.openedAt || Date.now(),
+              log: terminalEntry.log || [],
+            })
+          }
+          let results
+          try {
+            results = searchPastWork([...records.values()], args?.query || '', { room, limit: args?.limit })
+          } catch (error) {
+            return { content: [{ type: 'text', text: `Past-work search rejected: ${error?.message || error}` }] }
+          }
+          return { content: [{ type: 'text', text: formatPastWorkSearch(results, args?.query || '') }] }
+        },
+      )] : []),
       // Tier 1 cross-ROOM peek — list_sessions / read_session. Read-only reach into the
       // account's OTHER rooms (this session's sibling SESSIONS, not just sibling terminals),
       // routed through the account supervisor over IPC (pairRequest). Auto-allowed by the
@@ -3471,7 +3614,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // (slices whose deps just got satisfied).
       ...(entry.flowRole === 'builder' ? [tool(
         'mark_flow_done',
-        "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. For a gate-first task, pass `baselineEvidence`: the real, bounded pre-edit command/behavior receipt proving the assigned failure/absence. Never fabricate a RED sentence. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). Do not call before the slice actually runs + meets acceptance.",
+        "ThinkPool Flow ONLY — call this ONCE when your slice is built, RUNS, and meets its acceptance criteria. For a gate-first task, pass `baselineEvidence`: the real, bounded pre-edit command/behavior receipt proving the assigned failure/absence. Never fabricate a RED sentence. The bridge derives the edited-file footprint from Git, compares it with the sealed scopePaths, and refuses unexpected touches. Records your latest commit as the slice's atomic-revert target and signals the room that this slice is done (which unblocks slices that depended on you). Do not call before the slice actually runs + meets acceptance.",
         { baselineEvidence: z.string().max(1400).optional().describe('real single-line pre-edit baseline command/behavior receipt; required for new gate-first tasks') },
         async (args) => ({ content: [{ type: 'text', text: await markFlowDone({ baselineEvidence: args?.baselineEvidence || '' }) }] }),
       )] : []),
@@ -3483,14 +3626,14 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // reject malformed plans back to the conductor so it re-emits.
       ...(entry.flowRole === 'conductor' ? [tool(
         'submit_flow_plan',
-        'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line; assumptions: …>","tasks":[{"key":"<kebab>","title":"…","scope":"…","acceptance":"observable proof","nonGoals":["bounded exclusion"],"baseline":{"gate":"what fails/is absent before edits","evidence":"optional observed receipt"},"deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. Each builder/fix/scaffold needs acceptance, nonGoals, and a safe bounded baseline gate; review tasks inherit one builder contract. When uncertain, choose and record a safe reversible default; ask only when a choice materially expands scope or authority. The room validates and persists the graph, then shows approval. Do NOT use ExitPlanMode or write a plan file.',
+        'ThinkPool Flow CONDUCTOR ONLY — submit your decomposition for human approval. Call this ONCE when your task-graph is ready. Pass it as `plan`: a JSON string {"summary":"<one line; assumptions: …>","tasks":[{"key":"<kebab>","title":"…","scope":"human-readable ownership","scopePaths":["repo/file.js","repo/directory/**"],"acceptance":"observable proof","nonGoals":["bounded exclusion"],"baseline":{"gate":"what fails/is absent before edits","evidence":"optional observed receipt"},"deps":["<key>"],"sliceType":"feature|scaffold|review|fix"}]}. Each builder/fix/scaffold needs acceptance, machine-readable repo-relative scopePaths, nonGoals, and a safe bounded baseline gate; review tasks inherit one builder contract. When uncertain, choose and record a safe reversible default; ask only when a choice materially expands scope or authority. The room validates and persists the graph, then shows approval. Do NOT use ExitPlanMode or write a plan file.',
         { plan: z.string().describe('the task-graph as a JSON string (the {summary, tasks:[…]} object)') },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
           if (!entry.flowSessionId || entry.flowRole !== 'conductor') return okText('Not a Flow conductor — there is no flow to submit a plan for.')
           let norm
           try { norm = validatePlanForRuntime(normalizePlanOutput(args?.plan || ''), entry.runtime) }
-          catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON: a non-empty acyclic tasks array; each builder/fix/scaffold has observable acceptance, bounded nonGoals, and a safe baseline gate that says what fails/is absent; each review targets exactly one builder contract.`) }
+          catch (e) { return okText(`Plan REJECTED: ${e?.message || e}. Re-call submit_flow_plan with valid JSON: a non-empty acyclic tasks array; each builder/fix/scaffold has observable acceptance, repo-relative scopePaths, bounded nonGoals, and a safe baseline gate that says what fails/is absent; each review targets exactly one builder contract.`) }
           bcast('flow-plan', { term: id, flowId: entry.flowSessionId, plan: JSON.stringify(norm) }, flowChannel)
           process.stderr.write(`\n  ${A.mag}◆ flow plan submitted — flow ${String(entry.flowSessionId).slice(0, 8)} (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}).${A.rst}\n`)
           return okText(`Plan submitted (${norm.tasks.length} slice${norm.tasks.length === 1 ? '' : 's'}) with gate-first contracts. Safe reversible assumptions belong in the summary; user steering remains authoritative. The room is showing approval. You are DONE; stop here and wait for approval (lane dispatch is the room's job).`)
@@ -3753,7 +3896,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               provider: entry.provider, log: entry.log, commands: entry.commands, mode: entry.mode,
               spawnedBy: entry.spawnedBy, spawnDepth: entry.spawnDepth, cascadeRole: entry.cascadeRole, hop: entry.hop, sideParent: entry.sideParent, sideTask: entry.sideTask, pendingSideContexts: entry.pendingSideContexts, pendingWorkerCompletions: entry.pendingWorkerCompletions, workerCompletionsInFlight: entry.workerCompletionsInFlight, sliceType: entry.sliceType, flowSessionId: entry.flowSessionId,
               flowTaskKey: entry.flowTaskKey, flowTaskContract: entry.flowTaskContract, flowRole: entry.flowRole, flowReviewTarget: entry.flowReviewTarget,
-              flowReviewTargets: entry.flowReviewTargets, flowReviewSnapshots: entry.flowReviewSnapshots, flowReviewRound: entry.flowReviewRound,
+              flowReviewTargets: entry.flowReviewTargets, flowReviewSnapshots: entry.flowReviewSnapshots, flowReviewRound: entry.flowReviewRound, flowReviewConclusion: entry.flowReviewConclusion,
               dispatchBaseSha: entry.dispatchBaseSha, revertTarget: entry.revertTarget, cwd: entry.cwd,
               managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt,
               reviewSliceRoots: entry.reviewSliceRoots, openedAt: entry.openedAt,
@@ -4280,7 +4423,7 @@ function respawnStructured(id, provider) {
   // openStructured seed from the TARGET provider's configured model, which is the
   // only model this lane was ever asked for. A same-env model change never reaches
   // here — that path is an in-place setModel (see provider-switch).
-  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, pendingCheckpoint } = s
+  const { runtime, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, pendingCheckpoint } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -4299,7 +4442,7 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap, carryCheckpoint: pendingCheckpoint })
+  openStructured({ id, runtime, provider, log, commands, mode, spawnedBy, spawnDepth, cascadeRole, hop, sideParent, sideTask, pendingSideContexts, pendingWorkerCompletions, workerCompletionsInFlight, sliceType, flowSessionId, flowTaskKey, flowTaskContract, flowRole, flowReviewTarget, flowReviewTargets, flowReviewSnapshots, flowReviewRound, flowReviewConclusion, dispatchBaseSha, revertTarget, cwd, managedWorktree, rolePrompt, reviewSliceRoots, openedAt, lastUsage, carryRecap, carryCheckpoint: pendingCheckpoint })
   return true
 }
 
@@ -5273,7 +5416,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowTaskContract: rec.flowTaskContract, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap, carryCheckpoint: rec.carryCheckpoint,
+            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, models: rec.models, effort: rec.effort, provider: rec.runtime === 'claude' ? rec.provider || undefined : undefined, resume: resumable ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, spawnDepth: rec.spawnDepth, cascadeRole: rec.cascadeRole, hop: rec.hop, sideParent: rec.sideParent, sideTask: rec.sideTask, scheduleRunId: rec.scheduleRunId, scheduleDeadlineAt: rec.scheduleDeadlineAt, scheduleOutcomeRecorded: rec.scheduleOutcomeRecorded, scheduleAdmissionLease: rec.scheduleAdmissionLease, pendingSideContexts: rec.pendingSideContexts, pendingWorkerCompletions: rec.pendingWorkerCompletions, workerCompletionsInFlight: rec.workerCompletionsInFlight, sliceType: rec.sliceType, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, flowTaskContract: rec.flowTaskContract, flowRole: rec.flowRole, flowReviewTarget: rec.flowReviewTarget, flowReviewTargets: rec.flowReviewTargets, flowReviewSnapshots: rec.flowReviewSnapshots, flowReviewRound: rec.flowReviewRound, flowReviewConclusion: rec.flowReviewConclusion, dispatchBaseSha: rec.dispatchBaseSha, revertTarget: rec.revertTarget, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage, receivedTurnCids: rec.receivedTurnCids, carryRecap: wasInterrupted ? recoveryRecap : rec.carryRecap, carryCheckpoint: rec.carryCheckpoint,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).
@@ -5496,6 +5639,13 @@ flowChannel
         // Step 4 — a `review` slice gets the adversarial reviewer prompt (try-to-break),
         // every other slice gets the builder prompt.
         const isReview = t.slice_type === 'review'
+        try {
+          validateTaskContractSeal(t, { legacy: t.contract == null })
+        } catch (error) {
+          process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — ${t.task_key || 'task'} failed its sealed acceptance contract: ${error?.message || error}${A.rst}\n`)
+          bcast('flow-dispatch-held', { term: 'flow', flowId: payload.flowId, taskKey: t.task_key || null, reason: 'sealed acceptance contract mismatch' }, flowChannel)
+          continue
+        }
         if (!validReviewTargetShape(t, flowRuntime)) {
           process.stderr.write(`\n  ${A.yel}◆ flow dispatch held — ${flowRuntime === 'hermes' ? 'Hermes' : 'Codex'} review ${t.task_key} must target exactly one dependency.${A.rst}\n`)
           continue
@@ -5529,7 +5679,26 @@ flowChannel
           const cwd = worktreeSpec({ flowId: payload.flowId, taskKey: dep }).dir
           let sha = null
           try { sha = execFileSync('git', ['-C', cwd, 'rev-parse', 'HEAD'], { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() } catch { /* target is not safely reviewable */ }
-          return { taskKey: dep, cwd, sha }
+          let scopeEvidence = null
+          if (sha && t.contract?.scopePaths?.length) {
+            let baseSha = null
+            try {
+              baseSha = execFileSync('git', ['-C', cwd, 'merge-base', sha, 'origin/main'], {
+                encoding: 'utf8',
+                timeout: 3000,
+                stdio: ['ignore', 'pipe', 'ignore'],
+              }).trim()
+            } catch { /* missing immutable base holds the review below */ }
+            const changed = changedFilesBetween(cwd, baseSha, sha)
+            if (changed) {
+              const mechanical = collectFlowScopeEvidence({ log: [], repoRoot: cwd, declared: t.contract.scopePaths, changed })
+              const observed = normalizeFlowScopeEvidence(t.contract.scopeEvidence)
+              scopeEvidence = observed
+                ? { ...mechanical, read: observed.read, verified: observed.verified }
+                : mechanical
+            }
+          }
+          return { taskKey: dep, cwd, sha, ...(scopeEvidence ? { scopeEvidence } : {}) }
         }).filter((item) => item.sha) : []
         // Lanes build autonomously in their own worktree — bypassPermissions so they
         // don't stall on a card for every write/bash (matches the user's expectation that
@@ -5545,6 +5714,7 @@ flowChannel
           ? (isReview ? FLOW_CODEX_REVIEWER_PROMPT : FLOW_CODEX_LANE_PROMPT)
           : (isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT)
         const laneRolePrompt = buildLanePrompt({ base: laneBase })
+        const sealedReviewAcceptance = t.contract?.acceptancePack?.task?.acceptance
         // Model tiers (2026-07-03-flow-lane-model-tiers): pick the lane's brain by slice_type
         // (scaffold→sonnet, feature/fix/review→opus; env can blanket-override or `inherit` to
         // restore today's exact behavior). undefined → no model key passed (openStructured default).
@@ -5571,7 +5741,7 @@ flowChannel
                   ? `Reviewed slice worktree(s) — check out + RUN each yourself:\n` +
                     t.deps.map((dep) => { const ws = worktreeSpec({ flowId: payload.flowId, taskKey: dep }); return `  - ${dep}: dir ${ws.dir} (branch ${ws.branch})` }).join('\n') + '\n'
                   : '') +
-                `ACCEPTANCE to INDEPENDENTLY verify: ${t.acceptance || t.title}\n` +
+                `ACCEPTANCE to INDEPENDENTLY verify: ${sealedReviewAcceptance || t.acceptance || t.title}\n` +
                 `INHERITED NON-GOALS (must remain untouched): ${(t.contract?.nonGoals || []).join(' | ') || '(legacy task: none recorded)'}\n` +
                 `INHERITED BASELINE GATE: ${t.contract?.baseline?.gate || '(legacy task: none recorded)'}\n` +
                 `BUILDER BASELINE EVIDENCE (verify; never invent another baseline): ${t.contract?.baseline?.evidence || '(missing — reject unless this is a legacy task)'}\n` +

package/code-event-contract.mjs

@@ -64,6 +64,7 @@ export const CODE_EVENT_REGISTRY = Object.freeze({
   'needs-resolved': E,
   continuation: E,
   'turn-done': E,
+  'flow-review-receipt': E,
 })
 
 export const CODE_EVENT_KINDS = Object.freeze(Object.keys(CODE_EVENT_REGISTRY))

package/flow-receipt.mjs

@@ -0,0 +1,122 @@
+// Flow review receipts are deliberately smaller than a review verdict. They cross
+// from a private reviewer lane into a shared transcript, so this module only
+// admits the evidence a pair can act on. Prompts, environment, paths, logs, and
+// hidden reasoning never have a field in the public shape.
+
+import { normalizeFlowScopeEvidence } from './flow-scope-evidence.mjs'
+
+export const FLOW_REVIEW_RECEIPT_KIND = 'flow-review-receipt'
+
+const MAX_TASK_KEY = 120
+const MAX_LINE = 180
+const MAX_LINES = 4
+const OUTCOMES = new Set(['pass', 'reject', 'held'])
+const DIGEST = /^[a-f0-9]{64}$/
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|sbp_[a-z0-9_-]{20,}|sb_secret_[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|hooks\.slack\.com\/services\/[a-z0-9/_-]{8,})/i
+const SECRET_OR_PRIVATE = /(?:api[_ -]?key|access[_ -]?token|\btoken\s*[=:]|auth(?:orization)?|bearer\s+|secret|password|private[_ -]?key|system\s+prompt|raw\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\benv(?:ironment)?\b|\.env\b)/i
+const HOST_PATH = /(?:^~[\\/]|^\.?[\\/]|(?:^|\s)\/[\w.-]+|[A-Za-z]:\\|\\\\|(?:^|[\\/])(?:Users|home|var|tmp|private|workspace)(?:[\\/]|$)|\.thinkpool[\\/])/i
+const PATH_TRAVERSAL = /(?:^|[^a-z0-9.])\.\.(?:[\\/]|$)/i
+
+function cleanText(value, max) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > max) return null
+  if (/\r|\n/.test(value) || SECRET_VALUE.test(value) || SECRET_OR_PRIVATE.test(value) || HOST_PATH.test(value) || PATH_TRAVERSAL.test(value)) return null
+  const text = value.replace(/\s+/g, ' ').trim()
+  return text && text.length <= max ? text : null
+}
+
+function cleanLines(value) {
+  if (!Array.isArray(value)) return []
+  const out = []
+  for (const line of value) {
+    const safe = cleanText(line, MAX_LINE)
+    if (safe && !out.includes(safe)) out.push(safe)
+    if (out.length === MAX_LINES) break
+  }
+  return out
+}
+
+function cleanTaskKey(value) {
+  const taskKey = cleanText(value, MAX_TASK_KEY)
+  if (!taskKey || !/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(taskKey) || taskKey.includes('..')) return null
+  return taskKey
+}
+
+function cleanSha(value) {
+  if (typeof value !== 'string') return null
+  const sha = value.trim().toLowerCase()
+  return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha) ? sha : null
+}
+
+function cleanRounds(value) {
+  return Number.isInteger(value) && value >= 1 && value <= 99 ? value : null
+}
+
+function cleanDigest(value) {
+  if (typeof value !== 'string') return null
+  const digest = value.trim().toLowerCase()
+  return DIGEST.test(digest) ? digest : null
+}
+
+// Build the only wire shape the renderer accepts. Optional fields are omitted
+// rather than represented as null, making absence honest (notably deployment).
+export function createFlowReviewReceipt(input = {}) {
+  const taskKey = cleanTaskKey(input.taskKey)
+  const outcome = typeof input.outcome === 'string' ? input.outcome.toLowerCase() : ''
+  const rounds = cleanRounds(input.rounds)
+  if (!taskKey || !OUTCOMES.has(outcome) || rounds == null) {
+    throw new TypeError('Invalid flow review receipt identity')
+  }
+
+  const receipt = {
+    kind: FLOW_REVIEW_RECEIPT_KIND,
+    taskKey,
+    outcome,
+    rounds,
+    checks: cleanLines(input.checks),
+    reasons: cleanLines(input.reasons),
+  }
+  const candidateSha = cleanSha(input.candidateSha)
+  const acceptanceDigest = cleanDigest(input.acceptanceDigest)
+  const scope = normalizeFlowScopeEvidence(input.scope)
+  // Presence, not truthiness, is intentional: deployments are never inferred
+  // from a pass/reject outcome or from a candidate SHA.
+  const deployment = Object.hasOwn(input, 'deployment') ? cleanText(input.deployment, MAX_LINE) : null
+  if (candidateSha) receipt.candidateSha = candidateSha
+  if (acceptanceDigest) receipt.acceptanceDigest = acceptanceDigest
+  receipt.verified = Boolean(candidateSha && acceptanceDigest)
+  if (outcome === 'pass' && !receipt.verified) {
+    throw new TypeError('Passing flow review receipt requires an exact candidate and acceptance digest')
+  }
+  if (scope) receipt.scope = scope
+  if (outcome === 'pass' && !scope?.held) {
+    throw new TypeError('Passing flow review receipt requires a held scope footprint')
+  }
+  if (deployment) receipt.deployment = deployment
+  return receipt
+}
+
+export function isFlowReviewReceipt(value) {
+  try {
+    const receipt = createFlowReviewReceipt(value)
+    return receipt.kind === value?.kind
+  } catch {
+    return false
+  }
+}
+
+// A review lane may receive the same terminal submission twice (tool retry,
+// double click, or concurrent provider delivery). Serialize the whole verdict
+// transaction—not just receipt emission—so an awaited revert cannot run twice.
+export function createFlowReviewSingleFlight() {
+  let pending = null
+  return async function runFlowReviewVerdict(operation) {
+    if (pending) return pending
+    const current = (async () => operation())()
+    pending = current
+    try {
+      return await current
+    } finally {
+      if (pending === current) pending = null
+    }
+  }
+}

package/flow-scope-evidence.mjs

@@ -0,0 +1,117 @@
+import path from 'node:path'
+
+const MAX_SCOPE_PATHS = 32
+const MAX_PATH = 180
+const MAX_OBSERVED = 32
+const MAX_CHECKS = 8
+const MAX_CHECK = 220
+const PRIVATE_PATH = /(?:^|\/)(?:\.env(?:\.|$)|\.git(?:\/|$)|\.thinkpool(?:\/|$)|node_modules(?:\/|$))/
+const SECRET = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|gh[pousr]_[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i
+const VERIFY_COMMAND = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|build|lint|check|typecheck|verify)\b|(?:^|\s)node\s+--test\b|(?:vitest|jest|playwright|eslint|tsc)\b/i
+
+function uniqueSorted(values, max = MAX_OBSERVED) {
+  return [...new Set(values)].sort().slice(0, max)
+}
+
+function repoPath(value, { allowPattern = false } = {}) {
+  if (typeof value !== 'string') return null
+  let text = value.trim().replaceAll('\\', '/')
+  if (!text || text.length > MAX_PATH || text.startsWith('/') || /^[A-Za-z]:\//.test(text)) return null
+  const directoryPattern = allowPattern && text.endsWith('/**')
+  if (text.includes('*') && !directoryPattern) return null
+  const bare = directoryPattern ? text.slice(0, -3) : text
+  if (!bare || bare.endsWith('/') || bare.split('/').some((part) => !part || part === '.' || part === '..')) return null
+  if (PRIVATE_PATH.test(bare)) return null
+  const last = bare.split('/').at(-1)
+  if (allowPattern && !directoryPattern && !last.includes('.') && !/^(?:Dockerfile|Makefile|LICENSE|README)$/i.test(last)) return null
+  text = directoryPattern ? `${bare}/**` : bare
+  return text
+}
+
+export function normalizeFlowScopePaths(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_SCOPE_PATHS) {
+    throw new TypeError(`scope paths must contain 1-${MAX_SCOPE_PATHS} repo-relative entries`)
+  }
+  const paths = []
+  for (const item of value) {
+    const safe = repoPath(item, { allowPattern: true })
+    if (!safe) throw new TypeError(`invalid scope path: ${JSON.stringify(item)}`)
+    if (!paths.includes(safe)) paths.push(safe)
+  }
+  return paths.sort()
+}
+
+export function classifyFlowScope({ declared, changed } = {}) {
+  const safeDeclared = normalizeFlowScopePaths(declared)
+  const safeChanged = uniqueSorted((Array.isArray(changed) ? changed : []).map((item) => repoPath(item)).filter(Boolean))
+  const unexpected = safeChanged.filter((file) => !safeDeclared.some((scope) =>
+    scope.endsWith('/**') ? file.startsWith(scope.slice(0, -2)) : file === scope
+  ))
+  return { declared: safeDeclared, changed: safeChanged, unexpected, held: unexpected.length === 0 }
+}
+
+function observedPath(value, repoRoot) {
+  if (typeof value !== 'string' || !value.trim()) return null
+  const absoluteRoot = path.resolve(repoRoot)
+  const absolute = path.isAbsolute(value) ? path.resolve(value) : path.resolve(absoluteRoot, value)
+  const relative = path.relative(absoluteRoot, absolute).replaceAll('\\', '/')
+  if (!relative || relative.startsWith('../') || path.isAbsolute(relative)) return null
+  return repoPath(relative)
+}
+
+function safeCheck(value, repoRoot) {
+  if (typeof value !== 'string') return null
+  let command = value.replaceAll(path.resolve(repoRoot), '.').replace(/\s+/g, ' ').trim()
+  if (!command || command.length > MAX_CHECK || SECRET.test(command) || !VERIFY_COMMAND.test(command)) return null
+  return command
+}
+
+export function collectFlowScopeEvidence({ log = [], repoRoot, declared, changed } = {}) {
+  const classified = classifyFlowScope({ declared, changed })
+  const reads = []
+  const checks = new Map()
+  const successful = new Set()
+  for (const event of Array.isArray(log) ? log : []) {
+    if (event?.kind === 'assistant') {
+      for (const block of event.blocks || []) {
+        if (block?.type !== 'tool_use') continue
+        const name = String(block.name || '').toLowerCase()
+        if (['read', 'read_file', 'edit', 'write'].includes(name)) {
+          const candidate = block.input?.file_path ?? block.input?.path
+          const safe = observedPath(candidate, repoRoot)
+          if (safe) reads.push(safe)
+        }
+        if (name === 'bash' || name === 'exec_command' || name === 'command_execution') {
+          const command = safeCheck(block.input?.command ?? block.input?.cmd, repoRoot)
+          if (block.id && command) checks.set(block.id, command)
+        }
+      }
+    } else if (event?.kind === 'tool_result' && event.toolUseId && event.isError !== true) {
+      successful.add(event.toolUseId)
+    }
+  }
+  return {
+    declared: classified.declared,
+    read: uniqueSorted(reads),
+    changed: classified.changed,
+    verified: uniqueSorted([...checks].filter(([id]) => successful.has(id)).map(([, command]) => command), MAX_CHECKS),
+    unexpected: classified.unexpected,
+    held: classified.held,
+  }
+}
+
+export function normalizeFlowScopeEvidence(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+  try {
+    const classified = classifyFlowScope({ declared: value.declared, changed: value.changed })
+    const read = uniqueSorted((Array.isArray(value.read) ? value.read : []).map((item) => repoPath(item)).filter(Boolean))
+    const verified = uniqueSorted((Array.isArray(value.verified) ? value.verified : [])
+      .map((item) => typeof item === 'string' && item.length <= MAX_CHECK && !SECRET.test(item) && VERIFY_COMMAND.test(item) ? item.trim() : null)
+      .filter(Boolean), MAX_CHECKS)
+    if (Boolean(value.held) !== classified.held) return null
+    if (JSON.stringify(uniqueSorted(Array.isArray(value.unexpected) ? value.unexpected : [])) !== JSON.stringify(classified.unexpected)) return null
+    return { declared: classified.declared, read, changed: classified.changed, verified, unexpected: classified.unexpected, held: classified.held }
+  } catch {
+    return null
+  }
+}

package/flow-task-graph.mjs

@@ -51,9 +51,23 @@ export const FLOW_CONTRACT_LIMITS = Object.freeze({
   maxNonGoalChars: 240,
   maxBaselineGateChars: 600,
   maxBaselineEvidenceChars: 1400,
+  maxScopePaths: 32,
+  maxScopePathChars: 180,
 })
 
 const BASELINE_NEGATIVE_SIGNAL = /\b(fail(?:s|ed|ing)?|absent|missing|not\s+(?:present|implemented|available|found)|does\s+not|404|empty)\b/i
+const CONTRACT_DIGEST = /^[a-f0-9]{64}$/
+const SHA256_K = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]
+const rotateRight = (value, bits) => (value >>> bits) | (value << (32 - bits))
 const hasDisallowedControl = (value) => {
   for (const char of value) {
     const code = char.charCodeAt(0)
@@ -78,25 +92,153 @@ function boundedLine (value, label, max, { required = false } = {}) {
   return text
 }
 
+function normalizeScopePath (value) {
+  if (typeof value !== 'string') return null
+  const text = value.trim().replaceAll('\\', '/')
+  if (!text || text.length > FLOW_CONTRACT_LIMITS.maxScopePathChars || text.startsWith('/') || /^[A-Za-z]:\//.test(text)) return null
+  const directoryPattern = text.endsWith('/**')
+  if (text.includes('*') && !directoryPattern) return null
+  const bare = directoryPattern ? text.slice(0, -3) : text
+  if (!bare || bare.endsWith('/') || bare.split('/').some((part) => !part || part === '.' || part === '..')) return null
+  if (/(?:^|\/)(?:\.env(?:\.|$)|\.git(?:\/|$)|\.thinkpool(?:\/|$)|node_modules(?:\/|$))/.test(bare)) return null
+  const last = bare.split('/').at(-1)
+  if (!directoryPattern && !last.includes('.') && !/^(?:Dockerfile|Makefile|LICENSE|README)$/i.test(last)) return null
+  return directoryPattern ? `${bare}/**` : bare
+}
+
+export function normalizeTaskScopePaths (value, { fallbackScope = '', required = true } = {}) {
+  let values = value
+  if (values == null && fallbackScope) {
+    const inferred = normalizeScopePath(fallbackScope)
+    if (inferred) values = [inferred]
+  }
+  if (values == null) values = []
+  if (!Array.isArray(values)) throw new Error('scopePaths must be an array')
+  if (values.length > FLOW_CONTRACT_LIMITS.maxScopePaths) throw new Error(`scopePaths exceeds ${FLOW_CONTRACT_LIMITS.maxScopePaths} entries`)
+  const out = []
+  for (const item of values) {
+    const safe = normalizeScopePath(item)
+    if (!safe) throw new Error(`invalid scope path: ${JSON.stringify(item)}`)
+    if (!out.includes(safe)) out.push(safe)
+  }
+  if (required && out.length === 0) throw new Error('machine-readable scopePaths are required for builder/fix/scaffold tasks')
+  return out.sort()
+}
+
 export function normalizeBaselineEvidence (value) {
   return boundedLine(value, 'baseline evidence receipt', FLOW_CONTRACT_LIMITS.maxBaselineEvidenceChars, { required: true })
 }
 
+// This is deliberately a small synchronous SHA-256 implementation instead of a
+// Node crypto import or WebCrypto: the task graph must stay byte-identical and run
+// in both the bridge's Node runtime and the browser bundle.
+function sha256Hex (message) {
+  const source = new TextEncoder().encode(message)
+  const totalLength = Math.ceil((source.length + 9) / 64) * 64
+  const bytes = new Uint8Array(totalLength)
+  bytes.set(source)
+  bytes[source.length] = 0x80
+  let bitLength = BigInt(source.length) * 8n
+  for (let index = totalLength - 1; index >= totalLength - 8; index--) {
+    bytes[index] = Number(bitLength & 0xffn)
+    bitLength >>= 8n
+  }
+
+  const hash = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]
+  const words = new Uint32Array(64)
+  for (let offset = 0; offset < bytes.length; offset += 64) {
+    for (let index = 0; index < 16; index++) {
+      const start = offset + (index * 4)
+      words[index] = ((bytes[start] << 24) | (bytes[start + 1] << 16) | (bytes[start + 2] << 8) | bytes[start + 3]) >>> 0
+    }
+    for (let index = 16; index < 64; index++) {
+      const low = rotateRight(words[index - 15], 7) ^ rotateRight(words[index - 15], 18) ^ (words[index - 15] >>> 3)
+      const high = rotateRight(words[index - 2], 17) ^ rotateRight(words[index - 2], 19) ^ (words[index - 2] >>> 10)
+      words[index] = (words[index - 16] + low + words[index - 7] + high) >>> 0
+    }
+
+    let [a, b, c, d, e, f, g, h] = hash
+    for (let index = 0; index < 64; index++) {
+      const sigma1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
+      const choose = (e & f) ^ (~e & g)
+      const temp1 = (h + sigma1 + choose + SHA256_K[index] + words[index]) >>> 0
+      const sigma0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
+      const majority = (a & b) ^ (a & c) ^ (b & c)
+      const temp2 = (sigma0 + majority) >>> 0
+      h = g
+      g = f
+      f = e
+      e = (d + temp1) >>> 0
+      d = c
+      c = b
+      b = a
+      a = (temp1 + temp2) >>> 0
+    }
+    hash[0] = (hash[0] + a) >>> 0
+    hash[1] = (hash[1] + b) >>> 0
+    hash[2] = (hash[2] + c) >>> 0
+    hash[3] = (hash[3] + d) >>> 0
+    hash[4] = (hash[4] + e) >>> 0
+    hash[5] = (hash[5] + f) >>> 0
+    hash[6] = (hash[6] + g) >>> 0
+    hash[7] = (hash[7] + h) >>> 0
+  }
+  return hash.map((word) => word.toString(16).padStart(8, '0')).join('')
+}
+
+// The acceptance pack belongs to the builder target. A review task copies that
+// target's digest, so its inherited target is bound without re-hashing reviewer
+// prose or later baseline evidence receipts.
+function acceptancePack ({ key, title, scope, scopePaths, acceptance, sliceType, nonGoals, baselineGate, inheritedReviewerTarget = key, version = 2 }) {
+  const pack = {
+    version,
+    task: { key, title, scope, acceptance, sliceType },
+    nonGoals: [...nonGoals].sort(),
+    baselineGate,
+    inheritedReviewerTarget,
+  }
+  if (version >= 2) pack.task.scopePaths = normalizeTaskScopePaths(scopePaths, { fallbackScope: scope })
+  return pack
+}
+
+export function acceptancePackDigest (input) {
+  return sha256Hex(JSON.stringify(acceptancePack(input)))
+}
+
 function contractSource (task) {
   const source = task?.contract && typeof task.contract === 'object' && !Array.isArray(task.contract)
     ? { ...task.contract }
     : {}
   if (source.nonGoals === undefined) source.nonGoals = task?.nonGoals ?? task?.non_goals
   if (source.baseline === undefined) source.baseline = task?.baseline ?? task?.baselineGate ?? task?.baseline_gate
+  if (source.scopePaths === undefined) source.scopePaths = task?.scopePaths ?? task?.scope_paths
   return source
 }
 
+function normalizeProvidedContractDigest (source) {
+  if (source.digest === undefined) return null
+  if (typeof source.digest !== 'string' || !CONTRACT_DIGEST.test(source.digest)) {
+    throw new Error('contract digest must be a lowercase SHA-256 hex string')
+  }
+  return source.digest
+}
+
+function normalizeProvidedAcceptancePack (source) {
+  if (source.acceptancePack === undefined) return null
+  if (!source.acceptancePack || typeof source.acceptancePack !== 'object' || Array.isArray(source.acceptancePack)) {
+    throw new Error('contract acceptance pack must be an object')
+  }
+  return source.acceptancePack
+}
+
 // Strict for new terminal submissions. `legacy:true` is restore-only: old persisted
 // plans predate this contract and must remain runnable, but they can never be used to
 // submit a new incomplete plan.
 export function normalizeTaskContract (task, { sliceType, legacy = false } = {}) {
   const source = contractSource(task)
-  if (sliceType === SLICE_TYPE.review) return null
+  const digest = normalizeProvidedContractDigest(source)
+  const sealedPack = normalizeProvidedAcceptancePack(source)
+  if (sliceType === SLICE_TYPE.review) return legacy ? null : { digest, acceptancePack: sealedPack }
   const required = !legacy
   const rawNonGoals = source.nonGoals
   const values = rawNonGoals == null ? [] : (Array.isArray(rawNonGoals) ? rawNonGoals : [rawNonGoals])
@@ -112,7 +254,100 @@ export function normalizeTaskContract (task, { sliceType, legacy = false } = {})
   const evidence = baselineObject?.evidence == null || baselineObject?.evidence === ''
     ? ''
     : normalizeBaselineEvidence(baselineObject.evidence)
-  return { nonGoals, baseline: gate ? { gate, evidence } : null }
+  const scopePaths = normalizeTaskScopePaths(source.scopePaths, { fallbackScope: task?.scope ?? task?.description ?? '', required })
+  return { nonGoals, baseline: gate ? { gate, evidence } : null, scopePaths, digest, acceptancePack: sealedPack }
+}
+
+function bindContractDigest (task, { legacy = false } = {}) {
+  const sealedPack = acceptancePack({
+    key: task.key,
+    title: task.title,
+    scope: task.scope,
+    scopePaths: task.contract.scopePaths,
+    acceptance: task.acceptance,
+    sliceType: task.sliceType,
+    nonGoals: task.contract.nonGoals,
+    baselineGate: task.contract.baseline?.gate || '',
+    inheritedReviewerTarget: task.key,
+    version: legacy ? 1 : 2,
+  })
+  const digest = sha256Hex(JSON.stringify(sealedPack))
+  if (task.contract.digest && task.contract.digest !== digest) throw new Error(`task "${task.key}" contract digest does not match its acceptance pack`)
+  if (task.contract.acceptancePack && JSON.stringify(task.contract.acceptancePack) !== JSON.stringify(sealedPack)) {
+    throw new Error(`task "${task.key}" sealed acceptance pack does not match its task fields`)
+  }
+  task.contract.digest = digest
+  task.contract.acceptancePack = sealedPack
+}
+
+// The browser persists normalized task rows before approval, then later sends a
+// ready row back to the bridge for dispatch. Recompute the seal at that final
+// boundary so changed acceptance/scope/non-goals can never ride beside an old hash.
+export function validateTaskContractSeal (task, { legacy = false } = {}) {
+  const contract = task?.contract
+  if (!contract?.digest && legacy) return true
+  if (!contract || typeof contract !== 'object' || !contract.digest || !contract.acceptancePack) {
+    throw new Error('task is missing its sealed acceptance contract')
+  }
+  const pack = contract.acceptancePack
+  const packTask = pack?.task
+  if (!packTask || typeof packTask !== 'object' || !Array.isArray(pack.nonGoals)) {
+    throw new Error('task sealed acceptance pack is malformed')
+  }
+  const canonicalPack = acceptancePack({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    scopePaths: packTask.scopePaths,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+    version: pack.version === 1 ? 1 : 2,
+  })
+  if (JSON.stringify(pack) !== JSON.stringify(canonicalPack)) throw new Error('task sealed acceptance pack is not canonical')
+  if (acceptancePackDigest({
+    key: packTask.key,
+    title: packTask.title,
+    scope: packTask.scope,
+    scopePaths: packTask.scopePaths,
+    acceptance: packTask.acceptance,
+    sliceType: packTask.sliceType,
+    nonGoals: pack.nonGoals,
+    baselineGate: pack.baselineGate,
+    inheritedReviewerTarget: pack.inheritedReviewerTarget,
+    version: pack.version === 1 ? 1 : 2,
+  }) !== contract.digest) throw new Error('task acceptance digest does not match its sealed pack')
+
+  const sliceType = task.sliceType ?? task.slice_type
+  const key = task.key ?? task.task_key
+  const deps = Array.isArray(task.deps) ? task.deps : []
+  if (sliceType === SLICE_TYPE.review) {
+    if (contract.inheritedFrom !== packTask.key || deps.length !== 1 || deps[0] !== packTask.key) {
+      throw new Error('review task no longer targets its sealed builder')
+    }
+    if (pack.inheritedReviewerTarget !== packTask.key || task.acceptance !== packTask.acceptance) {
+      throw new Error(`review task "${key}" changed after its builder acceptance pack was sealed`)
+    }
+    return true
+  }
+  const livePack = acceptancePack({
+    key,
+    title: task.title,
+    scope: task.scope ?? '',
+    scopePaths: contract.scopePaths,
+    acceptance: task.acceptance ?? '',
+    sliceType,
+    nonGoals: contract.nonGoals || [],
+    baselineGate: contract.baseline?.gate || '',
+    inheritedReviewerTarget: key,
+    version: pack.version === 1 ? 1 : 2,
+  })
+  if (JSON.stringify(livePack) !== JSON.stringify(canonicalPack)) {
+    throw new Error(`task "${key}" changed after its acceptance pack was sealed`)
+  }
+  return true
 }
 
 // A FlowTask slice. Each is RUNNABLE — a lane can build + run + self-correct it in
@@ -244,6 +479,9 @@ export function normalizePlanOutput (raw, { legacy = false } = {}) {
     })
   })
   validateDag(tasks)
+  for (const task of tasks) {
+    if (task.sliceType !== SLICE_TYPE.review) bindContractDigest(task, { legacy })
+  }
   for (const task of tasks) {
     if (task.sliceType !== SLICE_TYPE.review) continue
     // New review tasks verify exactly one builder contract. Legacy persisted reviews
@@ -252,11 +490,21 @@ export function normalizePlanOutput (raw, { legacy = false } = {}) {
     if (task.deps.length !== 1) throw new Error(`review task "${task.key}" must depend on exactly one builder task to inherit its contract`)
     const target = tasks.find((candidate) => candidate.key === task.deps[0])
     if (!target || target.sliceType === SLICE_TYPE.review) throw new Error(`review task "${task.key}" must target a builder/fix/scaffold task`)
+    if (task.contract.digest && task.contract.digest !== target.contract.digest) {
+      throw new Error(`review task "${task.key}" contract digest does not match target "${target.key}"`)
+    }
     task.contract = {
       nonGoals: [...(target.contract?.nonGoals || [])],
       baseline: target.contract?.baseline ? { ...target.contract.baseline } : null,
+      scopePaths: [...(target.contract?.scopePaths || [])],
       inheritedFrom: target.key,
+      digest: target.contract.digest,
+      acceptancePack: target.contract.acceptancePack,
     }
+    // Reviewer-authored prose is not an authority boundary. Normalize the live
+    // review row to the builder's sealed acceptance so dispatch and the prompt
+    // cannot silently substitute a weaker criterion.
+    task.acceptance = target.contract.acceptancePack.task.acceptance
   }
   return { summary, tasks }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.361",
+  "version": "0.7.363",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -93,6 +93,9 @@
     "design-edit.mjs",
     "design-source-contract.mjs",
     "flow-review.mjs",
+    "flow-receipt.mjs",
+    "flow-scope-evidence.mjs",
+    "past-work-search.mjs",
     "review-check.mjs",
     "flow-review-gate.mjs",
     "flow-review-reflect.mjs",

package/past-work-search.mjs

@@ -0,0 +1,105 @@
+const MAX_QUERY = 160
+const MAX_RESULTS = 8
+const MAX_RECORDS = 48
+const MAX_EVENTS = 800
+const MAX_EXCERPT = 260
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i
+const PRIVATE_WORDS = /(?:system\s+prompt|hidden\s+reasoning|chain[ -]of[ -]thought|\bpassword\b|private[_ -]?key|\.env\b)/i
+const HOST_PATH = /(?:^|[\s=("'`])(?:~\/|\/(?:Users|home|var|tmp|private|workspace)\/|[A-Za-z]:\\|\\\\)[^\s)"'`]*/i
+
+function textContent(content) {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return ''
+  return content.map((item) => typeof item === 'string' ? item : item?.text || '').join(' ')
+}
+
+function safeExcerpt(value) {
+  if (typeof value !== 'string') return null
+  const line = value.replace(/\s+/g, ' ').trim()
+  if (!line || SECRET_VALUE.test(line) || PRIVATE_WORDS.test(line) || HOST_PATH.test(line)) return null
+  return line.slice(0, MAX_EXCERPT)
+}
+
+function eventCandidates(event) {
+  if (!event || typeof event !== 'object') return []
+  if (event.kind === 'flow-review-receipt') {
+    const scope = event.scope
+    return [
+      `Flow ${event.outcome || 'review'}: ${event.taskKey || ''}`,
+      ...(event.checks || []).map((line) => `Check: ${line}`),
+      ...(event.reasons || []).map((line) => `Finding: ${line}`),
+      ...((scope?.changed || []).map((line) => `Edited: ${line}`)),
+      ...((scope?.unexpected || []).map((line) => `Unexpected: ${line}`)),
+    ]
+  }
+  if (event.kind === 'assistant') {
+    const out = []
+    for (const block of event.blocks || []) {
+      if (block?.type === 'text') out.push(block.text)
+      if (block?.type === 'tool_use') {
+        const name = String(block.name || '')
+        if (/^(?:bash|exec_command|command_execution)$/i.test(name)) {
+          const command = block.input?.command ?? block.input?.cmd
+          if (command) out.push(`Command: ${command}`)
+        }
+      }
+    }
+    return out
+  }
+  if (event.kind === 'you') return [event.text]
+  if (event.kind === 'tool_result') return [`Result: ${textContent(event.content)}`]
+  if (event.kind === 'result') return [event.resultText]
+  return []
+}
+
+function queryParts(query) {
+  const text = String(query || '').replace(/\s+/g, ' ').trim()
+  if (text.length < 2 || text.length > MAX_QUERY) throw new TypeError(`past-work query must contain 2-${MAX_QUERY} characters`)
+  if (SECRET_VALUE.test(text) || PRIVATE_WORDS.test(text) || HOST_PATH.test(text)) return null
+  return { text, lower: text.toLowerCase(), tokens: text.toLowerCase().split(/[^a-z0-9._/-]+/).filter((token) => token.length > 1) }
+}
+
+export function searchPastWork(records, query, { room, limit = MAX_RESULTS } = {}) {
+  const parsed = queryParts(query)
+  if (!parsed) return []
+  const boundedLimit = Math.max(1, Math.min(MAX_RESULTS, Number(limit) || MAX_RESULTS))
+  const results = []
+  for (const record of (Array.isArray(records) ? records : []).slice(0, MAX_RECORDS)) {
+    const terminal = safeExcerpt(record?.name) || 'Unnamed terminal'
+    const events = Array.isArray(record?.log) ? record.log.slice(-MAX_EVENTS) : []
+    for (const event of events) {
+      for (const raw of eventCandidates(event)) {
+        const excerpt = safeExcerpt(raw)
+        if (!excerpt) continue
+        const lower = excerpt.toLowerCase()
+        const tokenHits = parsed.tokens.filter((token) => lower.includes(token)).length
+        if (!lower.includes(parsed.lower) && (!parsed.tokens.length || tokenHits !== parsed.tokens.length)) continue
+        results.push({
+          room: String(room || '').trim() || 'current',
+          terminal,
+          terminalId: String(record?.id || '').slice(0, 80),
+          ts: Number(event?.ts) || Number(record?.savedAt) || 0,
+          seq: Number.isFinite(Number(event?.seq)) ? Number(event.seq) : null,
+          excerpt,
+          score: (lower.includes(parsed.lower) ? 10 : 0) + tokenHits + (excerpt.startsWith('Command:') ? 0 : 1),
+        })
+      }
+    }
+  }
+  return results
+    .sort((a, b) => b.score - a.score || b.ts - a.ts)
+    .slice(0, boundedLimit)
+    .map(({ score, ...result }) => result)
+}
+
+export function formatPastWorkSearch(results, query) {
+  const safeQuery = safeExcerpt(String(query || '').trim())
+  if (!results.length) return safeQuery
+    ? `No cited past work matched “${safeQuery}” in this room.`
+    : 'No cited past work matched that privacy-filtered query in this room.'
+  return results.map((result, index) => {
+    const date = result.ts ? new Date(result.ts).toISOString().slice(0, 10) : 'date unavailable'
+    const event = result.seq == null ? 'saved transcript' : `event ${result.seq}`
+    return `${index + 1}. ${result.excerpt}\n   [Room ${result.room} · ${result.terminal} · ${date} · ${event}]`
+  }).join('\n')
+}

package/session-store.mjs

@@ -426,6 +426,28 @@ export function loadAll(room) {
   return listRecs(room).sort((a, b) => (a.savedAt || 0) - (b.savedAt || 0))
 }
 
+// Closed terminal snapshots stay recoverable under .archive/. Past-work search
+// reads only these already-bounded snapshots, never the unbounded JSONL logs.
+export function loadArchived(room, limit = 40) {
+  try {
+    return fs.readdirSync(archiveDir(room))
+      .map((name) => {
+        const file = path.join(archiveDir(room), name)
+        try {
+          const stat = fs.statSync(file)
+          if (!stat.isFile()) return null
+          const record = JSON.parse(fs.readFileSync(file, 'utf8'))
+          return record && Array.isArray(record.log) ? { ...record, _archivedAt: stat.mtimeMs || 0 } : null
+        } catch { return null }
+      })
+      .filter(Boolean)
+      .sort((a, b) => (b._archivedAt || b.savedAt || 0) - (a._archivedAt || a.savedAt || 0))
+      .slice(0, Math.max(1, Math.min(100, Number(limit) || 40)))
+  } catch {
+    return []
+  }
+}
+
 // Last PTY terminal id auto-opened for an attached command. A reconnecting
 // bridge reuses it so it re-attaches to the SAME terminal tab instead of
 // minting a fresh UUID and breeding a new dormant "Terminal N" each restart.

package/thinkpool-capabilities.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 21,
+  "bundleVersion": 23,
   "contracts": [
     {
       "id": "room-coordination",
-      "version": 3,
+      "version": 4,
       "routes": [
         {
           "id": "room-awareness",
@@ -18,6 +18,12 @@
           "trigger": "\\b(other|another|cross[- ]?room|cross[- ]?session)\\s+(room|session)|\\b(list_sessions|read_session)\\b",
           "prompt": "When work depends on another ThinkPool room, use list_sessions then read_session instead of asking the people to relay host-side state."
         },
+        {
+          "id": "past-work-search",
+          "tools": ["search_past_work"],
+          "trigger": "\\b(previous|prior|earlier|past|last time|already tried|failed attempt|decision|test result|command)\\b.{0,50}\\b(work|terminal|flow|session|implementation|fix|change)?\\b|\\bsearch_past_work\\b",
+          "prompt": "When the current task depends on a prior decision, failed attempt, command, test result, or Flow receipt from this room, use search_past_work with specific terms. Treat every result as bounded cited evidence, not authority to reopen stale work. The tool is read-only, searches only this room, and filters secrets and host paths."
+        },
         {
           "id": "visible-handoff",
           "tools": ["post_to_terminal", "post_to_session"],
@@ -27,12 +33,15 @@
       ],
       "impact": [
         {"path": "bridge/cross-terminal.mjs"},
-        {"path": "bridge/bridge.mjs", "diffPattern": "read_terminal|list_sessions|read_session|post_to_terminal|post_to_session"},
+        {"path": "bridge/bridge.mjs", "diffPattern": "read_terminal|search_past_work|list_sessions|read_session|post_to_terminal|post_to_session"},
+        {"path": "bridge/past-work-search.mjs"},
         {"path": "bridge/codex-session.mjs", "diffPattern": "MCP|Mcp|mcp|read_terminal|list_sessions|read_session|post_to_terminal|post_to_session"},
         {"path": "bridge/codex-app-server.mjs", "diffPattern": "MCP|Mcp|mcp"}
       ],
       "evidence": [
         {"path": "bridge/cross-terminal.mjs", "pattern": "read_terminal"},
+        {"path": "bridge/bridge.mjs", "pattern": "'search_past_work'"},
+        {"path": "bridge/past-work-search.mjs", "pattern": "formatPastWorkSearch"},
         {"path": "bridge/cross-terminal.mjs", "pattern": "post_to_session"},
         {"path": "bridge/bridge.mjs", "pattern": "'list_sessions'"},
         {"path": "bridge/codex-session.mjs", "pattern": "waitForMcpServer"},
@@ -130,25 +139,30 @@
     },
     {
       "id": "flow-completion",
-      "version": 3,
+      "version": 5,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, and a real pre-edit failure/absence gate; completion supplies the observed baseline evidence and the exact dependent reviewer inherits it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, machine-readable repo-relative scopePaths, and a real pre-edit failure/absence gate. Approval seals that acceptance pack with a stable digest. Completion supplies observed baseline evidence without changing the digest, derives edited files from Git, and refuses unexpected touches. The exact dependent reviewer inherits the contract and the bridge recomputes the scope footprint from the immutable candidate. A conclusive pass binds one bounded terminal receipt to the exact reviewed candidate SHA, acceptance digest, and held scope; missing or drifted proof holds the Flow instead of completing it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [
         {"path": "bridge/bridge.mjs", "diffPattern": "submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check"},
         {"path": "bridge/flow-review.mjs"},
+        {"path": "bridge/flow-receipt.mjs"},
+        {"path": "bridge/flow-scope-evidence.mjs"},
         {"path": "bridge/flow-review-gate.mjs"},
         {"path": "bridge/flow-task-graph.mjs"}
       ],
       "evidence": [
         {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_plan'"},
         {"path": "bridge/bridge.mjs", "pattern": "'mark_flow_done'"},
-        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"}
+        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"},
+        {"path": "bridge/flow-task-graph.mjs", "pattern": "acceptancePackDigest"},
+        {"path": "bridge/flow-receipt.mjs", "pattern": "Passing flow review receipt requires a held scope footprint"},
+        {"path": "bridge/flow-scope-evidence.mjs", "pattern": "classifyFlowScope"}
       ]
     },
     {