wicked-crew 0.7.32 → 0.7.34

package/dist/api/routes.d.ts

@@ -7,11 +7,14 @@ import type { ElicitationCache } from './elicitation-cache.js';
 import { QeGateCache } from '../qe/gate-events.js';
 import type { ConformanceRule, SteeringType } from '../core/types.js';
 import { SeatHealthTracker } from './seat-health.js';
+import { type RosterWithStanding } from './roster-standing.js';
+import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex } from './chat-scope.js';
 import { DocRunIndex } from '../interactive/doc-run-index.js';
 import { TestSetIndex } from '../qe/test-sets.js';
 import { type ProjectRoutesDeps } from '../projects/routes.js';
 import { type SkillsRuntime } from '../skills/runtime.js';
+import { type StateHomeWatch } from '../projects/state-home-preflight.js';
 import type { EvalRunStore } from './eval-store.js';
 import { InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import type { DocGroundingStore } from '../interactive/doc-grounding.js';
@@ -82,7 +85,7 @@ export declare function policyProposalToRule(proposalId: string, kindType: strin
  * schema does not accept — so `.strict()` is what turns that trip into a 400 instead of an
  * unworkflowed run reported as `201`.
  */
-export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     problem: z.ZodString;
     sessionId: z.ZodOptional<z.ZodString>;
     clisJson: z.ZodOptional<z.ZodString>;
@@ -101,6 +104,12 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
      *  defaults to `"pr"` (flippable via the `deliverDefault` setting), everything else to
      *  `"none"` — see the resolution below. */
     deliver: z.ZodOptional<z.ZodEnum<["pr", "none"]>>;
+    /** F-E2E-030 — who confirms the deliver phase. `'human'` (the default when omitted): the engine
+     *  pauses before the composed `deliver` Tool unit pushes and opens the PR, whatever
+     *  `humanConfirm` says. `'auto'`: the caller's EXPLICIT opt-out — the push and PR follow verify
+     *  unattended, under the daemon's active gh account; a UI sending it must name the posture
+     *  "auto-deliver" to its operator. Additive; an older daemon's schema rejects it with a 400. */
+    deliverGate: z.ZodOptional<z.ZodEnum<["human", "auto"]>>;
     /** DES-UX-001 §8.3 (CREW-UX-3) — the run this launch retries. Must name an EXISTING run id
      *  (the route checks the store and 400s with a named error otherwise); persisted via the
      *  `run.launched` audit entry + retry index and echoed as `AgentSession.retry_of`. */
@@ -128,6 +137,7 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }, {
     problem: string;
     workflow?: string | undefined;
@@ -141,6 +151,7 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }>, {
     problem: string;
     workflow?: string | undefined;
@@ -154,6 +165,7 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }, {
     problem: string;
     workflow?: string | undefined;
@@ -167,6 +179,7 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }>, {
     problem: string;
     workflow?: string | undefined;
@@ -180,6 +193,7 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }, {
     problem: string;
     workflow?: string | undefined;
@@ -193,6 +207,35 @@ export declare const LaunchSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
     retryOf?: string | undefined;
     entityMode?: "shared" | "isolated" | undefined;
     humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
+}>, {
+    problem: string;
+    workflow?: string | undefined;
+    deliver?: "pr" | "none" | undefined;
+    projectId?: string | undefined;
+    repoRef?: string | undefined;
+    campaignId?: string | undefined;
+    groupLabel?: string | undefined;
+    clisJson?: string | undefined;
+    sessionId?: string | undefined;
+    retryOf?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
+}, {
+    problem: string;
+    workflow?: string | undefined;
+    deliver?: "pr" | "none" | undefined;
+    projectId?: string | undefined;
+    repoRef?: string | undefined;
+    campaignId?: string | undefined;
+    groupLabel?: string | undefined;
+    clisJson?: string | undefined;
+    sessionId?: string | undefined;
+    retryOf?: string | undefined;
+    entityMode?: "shared" | "isolated" | undefined;
+    humanConfirm?: string | undefined;
+    deliverGate?: "auto" | "human" | undefined;
 }>;
 export declare const GateSchema: z.ZodObject<{
     approve: z.ZodBoolean;
@@ -285,6 +328,10 @@ export interface RuntimeDeps {
      *  `chatClosed` frames (so a reclaimed chat's scratch root goes with it); a directly-driven
      *  route set gets a fresh one. */
     chatScopes?: ChatScopeIndex;
+    /** Per-chat turn index (F-RECON-017) — `createServer` feeds one from the CoreEvent fold so
+     *  `POST /chats/:id/messages` refuses a send to a seat still mid-turn; a directly-driven route
+     *  set gets a fresh one (tests fold frames into it themselves). */
+    chatTurns?: ChatTurnIndex;
     /** Run→delivered-PR index (CREW-UX-8, crew#321) — `createServer` hydrates one from the audit
      *  trail so a restarted daemon still echoes `delivery`; a directly-driven route set gets a
      *  fresh one. */
@@ -326,6 +373,11 @@ export interface RuntimeDeps {
     /** Seat sign-in presence probe (seat sign-in) — injectable so route tests never read the
      *  developer's real dotfiles. Defaults to the file/env heuristic in seat-signin.ts. */
     signedIn?: (seatKey: string, workerConfigRoot?: string) => boolean | null;
+    /** The roster WITH crew's standing (`api/roster-standing.ts`) — `createServer` injects its single
+     *  instance so the routes, the interactive seams and the adapter's own launches all bench the
+     *  same seats (F-RECON-002/003); a directly-driven route set builds one over `seatHealth` +
+     *  `signedIn` above. */
+    rosterWithStanding?: RosterWithStanding;
     /** The `/ws` fan-out, for the few routes that say something to a thread themselves (a refused
      *  chat seat, F-2R2-007). Absent (unit tests, library use) = nothing is broadcast. */
     broadcast?: (frame: CoreEvent) => void;
@@ -363,6 +415,12 @@ export interface RuntimeDeps {
      *  (seeded from the installed plugin, published); a directly-driven route set gets none and
      *  `/skills*` answers 503 unless a test injects one over a fixture root. */
     skills?: SkillsRuntime;
+    /** The live state-home classification (wicked-core#411 / crew#497) — `createServer` surveys the
+     *  daemon state home at boot and hands the watch here; the routes re-survey on demand, report it
+     *  on `/diagnostics.stateHome` + `/health.warnings`, and answer `POST /runs` 409 while a handed
+     *  snapshot derives a state home with an entry the fence cannot classify. A directly-driven route
+     *  set (tests) gets none: no survey, no warning, no gate — never a fabricated clean answer. */
+    stateHome?: StateHomeWatch;
     /** The document ↔ run binding (wave 6, F-4R2-006) read off the interactive seams' handoff ledgers —
      *  `createServer` builds one over the four ledger sources; a directly-driven route set gets an
      *  EMPTY one (`document_id: null` on every run). */
@@ -392,16 +450,16 @@ export declare const ChatOpenSchema: z.ZodObject<{
     projectId: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     projectId?: string | undefined;
+    chatId?: string | undefined;
     clis?: string[] | undefined;
     repoRef?: string | undefined;
     repoRefs?: string[] | undefined;
-    chatId?: string | undefined;
 }, {
     projectId?: string | undefined;
+    chatId?: string | undefined;
     clis?: string[] | undefined;
     repoRef?: string | undefined;
     repoRefs?: string[] | undefined;
-    chatId?: string | undefined;
 }>;
 export declare function registerRoutes(app: FastifyInstance, adapter: CoreAdapter, gateCache: GateCache, elicitationCache: ElicitationCache, qeGateEvents?: QeGateCache, projects?: ProjectRoutesDeps, security?: SecurityDeps, runtime?: RuntimeDeps): void;
 //# sourceMappingURL=routes.d.ts.map

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAE5K,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EAET,WAAW,EAEZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAInD,OAAO,KAAK,EAEV,eAAe,EAYf,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EACL,cAAc,EAMf,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAIzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAqB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAiC7C;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AA0FD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GACzC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA6D3E;AAqFD;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;0FAEsF;IACtF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;sCAEkC;IAClC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;0FACsF;IACtF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACvC;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;mFAE+E;IAC/E,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;yGACqG;IACrG,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;2FAEuF;IACvF,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;0CAGsC;IACtC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;gFAE4E;IAC5E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;wDAEoD;IACpD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;mCAE+B;IAC/B,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH;;;GAGG;AACH,eAAO,MAAM,cAAc;;;IAGzB,kFAAkF;;IAElF,6DAA6D;;IAE7D;0EACsE;;;;;;;;;;;;;;EAE7D,CAAC;AAEZ,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CAo8GN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAE5K,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EAET,WAAW,EAEZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAInD,OAAO,KAAK,EAEV,eAAe,EAWf,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,cAAc,EAMf,MAAM,iBAAiB,CAAC;AAYzB,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAIzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAqB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAiC7C;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AA0FD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GACzC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA6D3E;AAqFD;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;;;oGAIgG;;IAEhG;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;0FAEsF;IACtF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;sCAEkC;IAClC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;uEAEmE;IACnE,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;;4BAGwB;IACxB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;0FACsF;IACtF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACvC;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;mFAE+E;IAC/E,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;yGACqG;IACrG,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;2FAEuF;IACvF,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;0CAGsC;IACtC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;gFAE4E;IAC5E,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;mGAI+F;IAC/F,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;wDAEoD;IACpD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;mCAE+B;IAC/B,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH;;;GAGG;AACH,eAAO,MAAM,cAAc;;;IAGzB,kFAAkF;;IAElF,6DAA6D;;IAE7D;0EACsE;;;;;;;;;;;;;;EAE7D,CAAC;AAEZ,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CAqjHN"}

package/dist/api/routes.js

@@ -17,7 +17,9 @@ import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
 import { callEstateTool, EstateMcpError } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
-import { chatSeatAdmission, seatStanding } from './seat-standing.js';
+import { chatSeatAdmission } from './seat-standing.js';
+import { rosterWithStandingFactory } from './roster-standing.js';
+import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex, chatScopeDeps, prepareChatScratch, removeChatScratch, resolveChatScope, } from './chat-scope.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
 import { InvalidDiffBaseError, MERGE_BASE_LITERAL, NotARegularFileError, UnresolvableDiffBaseError, branchDiff, isPlainRef, readFileCapped, worktreeDiff, } from './run-files.js';
@@ -33,6 +35,9 @@ import { isSteeringAuthorRun, landSteeringProposal } from './steering-landing.js
 import { registerTestingRoutes } from './testing.js';
 import { registerSkillsRoutes } from './skills.js';
 import { disabledSkillsHealth } from '../skills/runtime.js';
+import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
+import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE } from '../skills/base-skill.js';
+import { noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { composeDeliverText, factsFromRun, framedDeliverText, runUrlFor } from '../core/deliver-text.js';
@@ -339,6 +344,12 @@ export const LaunchSchema = z.object({
      *  defaults to `"pr"` (flippable via the `deliverDefault` setting), everything else to
      *  `"none"` — see the resolution below. */
     deliver: z.enum(['pr', 'none']).optional(),
+    /** F-E2E-030 — who confirms the deliver phase. `'human'` (the default when omitted): the engine
+     *  pauses before the composed `deliver` Tool unit pushes and opens the PR, whatever
+     *  `humanConfirm` says. `'auto'`: the caller's EXPLICIT opt-out — the push and PR follow verify
+     *  unattended, under the daemon's active gh account; a UI sending it must name the posture
+     *  "auto-deliver" to its operator. Additive; an older daemon's schema rejects it with a 400. */
+    deliverGate: z.enum(['human', 'auto']).optional(),
     /** DES-UX-001 §8.3 (CREW-UX-3) — the run this launch retries. Must name an EXISTING run id
      *  (the route checks the store and 400s with a named error otherwise); persisted via the
      *  `run.launched` audit entry + retry index and echoed as `AgentSession.retry_of`. */
@@ -356,6 +367,12 @@ export const LaunchSchema = z.object({
 }).strict().refine((b) => b.deliver !== 'pr' || b.workflow !== undefined, {
     message: 'deliver: "pr" requires a workflow — a free-text run has no def to append the deliver phase to',
     path: ['deliver'],
+}).refine((b) => b.deliverGate === undefined || b.deliver !== 'none', {
+    // F-E2E-030: a deliver-gate posture on a launch that declines delivery is a contradiction the
+    // caller should hear about, not a silent no-op. (A launch that OMITS `deliver` may still
+    // resolve to no deliver unit — repo-less, free-text, read-only def; the field is then inert.)
+    message: 'deliverGate has no meaning with deliver: "none" — there is no deliver phase to gate',
+    path: ['deliverGate'],
 }).refine((b) => b.campaignId === undefined || b.groupLabel === undefined, {
     message: 'campaignId and groupLabel are mutually exclusive — a run files onto ONE grouping surface (an existing campaign, or a label group)',
     path: ['groupLabel'],
@@ -471,6 +488,7 @@ runtime = {}) {
     const runTimingIndex = runtime.runTimingIndex ?? new RunTimingIndex();
     const guidanceIndex = runtime.guidanceIndex ?? new GuidanceIndex();
     const chatScopes = runtime.chatScopes ?? new ChatScopeIndex();
+    const chatTurns = runtime.chatTurns ?? new ChatTurnIndex();
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     // Wave 6: the doc↔run binding and the registered test sets — `createServer` injects the real
     // ones; a directly-driven route set gets an empty index (every run `document_id: null`, no sets).
@@ -611,7 +629,32 @@ runtime = {}) {
     // null / [] for the rest ("where declared", never invented). See src/api/endpoint-manifest.ts.
     app.get(`${V}/health`, { config: { manifest: { statusCodes: [200] } } }, async () => {
         const ping = await adapter.ping();
-        return { status: 'ok', version: PKG_VERSION, ping };
+        // F-E2E-030: what this deployment can keep. A composer reads `capabilities.deliverGate`
+        // before it promises "pauses at the deliver gate"; a stub-driven route set without the
+        // probe honestly reports no gate.
+        const capabilities = typeof adapter.engineCapabilities === 'function'
+            ? adapter.engineCapabilities()
+            : { deliverGate: false };
+        // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
+        // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
+        // launch while the state home holds an entry the worker Read fence cannot classify. Re-surveyed
+        // per probe (two readdirs) so an entry that appears after boot is reported without a restart;
+        // the field is ABSENT when there is nothing to say, and on a route set booted without the watch.
+        const stateHome = runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null;
+        const warnings = stateHome === null
+            ? []
+            : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }));
+        // crew#554: the BASE skill posture for the next launch — the composer's confirm line
+        // ("discipline skill: <name> gen N" / "MISSING — …"). Cached by the skills runtime: no I/O.
+        const baseSkill = runtime.skills?.baseSkill() ?? null;
+        return {
+            status: 'ok',
+            version: PKG_VERSION,
+            ping,
+            capabilities,
+            baseSkill,
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
     });
     // The daemon's self-knowledge surface (diagnostics): what is deployed, what it stores, what
     // has gone wrong recently, and whether ACP is really working across the CLIs — the answer
@@ -659,6 +702,11 @@ runtime = {}) {
             // Is the governance evidence LANDING (crew#495): the store, the records on it, the dead
             // letters — with a `governance.deadletter` finding the moment the outbox holds one.
             governance,
+            // The state-home classification (wicked-core#411 / crew#497): which state home the worker
+            // Read fence classifies, every entry it cannot classify there (top level and skills root),
+            // who classified (the engine, or crew's registry copy on an older addon) and whether that
+            // refuses launches — re-surveyed per read. `null` on a route set booted without the watch.
+            stateHome: runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null,
         };
     });
     // Who am I talking to the daemon as? (task #88). In local mode this is
@@ -702,41 +750,14 @@ runtime = {}) {
         return { port, host };
     });
     // The council seats for the launch form (static production roster), each carrying its RUNTIME
-    // health (crew#274). The roster is declarative — every configured seat is listed — and `health`
-    // is what the platform has observed: default active with no message; inactive + the error
-    // excerpt after a seat-level failure, until an ok output or the recovery probe flips it back.
-    // Existing fields ride through verbatim (the seat still round-trips into `clisJson` on launch)
-    // — the spread is deliberately NOT a field whitelist, which is what lets the engine's
-    // `login_invocation` (seat sign-in, wicked-core PR#278) pass through untouched. Each seat also
-    // gains `signed_in`: the cheap file/env presence heuristic, computed against the LIVE
-    // `WICKED_WORKER_HOME` env — the same value the engine reads at the next worker spawn, kept
-    // current by `applyWorkerConfigRoot` at boot and on every settings change.
-    //
-    // Each seat ALSO carries its STANDING (F-2R2-009): `auth` re-reads `signed_in` for what it means
-    // (a `signed_out` codex is benched on its first ballot; a `not_required` opencode answers on its
-    // free tier), and `council_eligible` says what a council would do with the seat as far as the
-    // daemon can tell. `POST /chats` seats its defaults through the SAME standing, so the roster and
-    // the chat never disagree about a seat.
-    const rosterWithStanding = () => {
-        const workerRoot = process.env['WICKED_WORKER_HOME'];
-        return CoreAdapter.roster().map((seat) => {
-            const key = String(seat.key);
-            const health = seatHealth.healthFor(key);
-            const signed = signedIn(key, workerRoot === '' ? undefined : workerRoot);
-            return {
-                ...seat,
-                health,
-                signed_in: signed,
-                // The bench is THIS daemon's council evidence (councilSeatFailed, bounded window) — the
-                // prediction learns from what the engine actually did with the seat (#533 review, F-1).
-                ...seatStanding(seat, signed, health, seatHealth.councilBenchFor(key), 
-                // F-A45-006: the seat's OWN "no credential" report (a ballot's "No API key found", a
-                // worker's 401, an auth ACP fallback) overrides the file probe — `auth` flips, not only
-                // `council_eligible`, and the evidence rides on the wire.
-                seatHealth.authFailureFor(key)),
-            };
-        });
-    };
+    // health (crew#274) and its STANDING (F-2R2-009) — `api/roster-standing.ts` is the ONE accessor
+    // every launch path shares (F-RECON-002/003: the interactive seams, the adapter's onboarding
+    // launch and `wicked-crew start` used to hand the engine the RAW registry roster, so signed-out
+    // seats were convened and even elected). `createServer` injects the daemon's single instance
+    // (built over the same `seatHealth`); a directly-driven route set builds an equivalent one here.
+    // `POST /chats` seats its defaults through the SAME standing, so the roster and the chat never
+    // disagree about a seat.
+    const rosterWithStanding = runtime.rosterWithStanding ?? rosterWithStandingFactory({ seatHealth, signedIn });
     app.get(`${V}/roster`, async () => ({ roster: rosterWithStanding() }));
     // Open a file/folder with the OS default application (crew#273) — the studio Files tab's
     // click-to-open. The open MUST happen daemon-side (the SPA cannot spawn a process), which is
@@ -1031,10 +1052,13 @@ runtime = {}) {
                 requestType: 'LaunchRunBody',
                 responseType: '{ runId: string }',
                 // 404/409: unknown project / unknown campaignId (wicked-studio#27) /
-                // archived-or-synthesized project + busy engine (see the catch below); 400: zod
-                // reject or a retryOf naming no existing run; 501: campaignId attach on an engine
-                // addon without the campaign bindings ("upgrade the engine").
-                statusCodes: [201, 400, 404, 409, 501],
+                // archived-or-synthesized project + busy engine + the state-home blocker
+                // (`state_home_unregistered`) + a roster with no eligible seat (`no_eligible_seat`,
+                // wicked-core#461 — see the catch below); 400: zod reject or a retryOf naming no
+                // existing run; 422: the base-skill intake refusal (`base_skill_refused`, crew#554);
+                // 501: campaignId attach on an engine addon without the campaign bindings ("upgrade
+                // the engine").
+                statusCodes: [201, 400, 404, 409, 422, 501],
             },
         },
     }, async (req, reply) => {
@@ -1043,6 +1067,18 @@ runtime = {}) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
         const b = parsed.data;
+        // wicked-core#411 / crew#497: the state-home blocker, judged BEFORE anything is resolved or
+        // committed. While the handed skills snapshot derives a state home with an entry the worker
+        // Read fence cannot classify, the engine refuses this launch at intake (and an engine before
+        // that fix refused it at the run's first worker, after councils and the intake gate) — so the
+        // daemon answers the typed 409 itself, naming every entry and the remedy, until they are gone.
+        // Re-surveyed per launch: the entries named are the ones there NOW.
+        if (runtime.stateHome !== undefined) {
+            const stateHome = await runtime.stateHome.refresh();
+            if (stateHome.refusesLaunches) {
+                return reply.code(409).send(stateHomeBlockerBody(stateHome));
+            }
+        }
         const input = {
             problem: b.problem,
             sessionId: b.sessionId ?? randomUUID(),
@@ -1055,6 +1091,11 @@ runtime = {}) {
             input.entityMode = b.entityMode;
         if (b.humanConfirm !== undefined)
             input.humanConfirm = b.humanConfirm;
+        // F-E2E-030: only the explicit `'auto'` opts out of the engine's deliver gate. `'human'` and
+        // an omitted field both leave `autoDeliver` off the input — the gate is the engine's default,
+        // so the wire never has to say "gate me" to be gated.
+        if (b.deliverGate === 'auto')
+            input.autoDeliver = true;
         if (b.repoRef !== undefined)
             input.repoRef = b.repoRef;
         if (b.workflow !== undefined)
@@ -1196,6 +1237,34 @@ runtime = {}) {
         }
         catch (err) {
             const msg = message(err);
+            // The engine's own intake refusal (wicked-core#411 `StateHomeConfigError`) is a configuration
+            // error, not a malformed request: the same typed 409 the pre-check above answers, over a fresh
+            // survey — the pre-check saw a clean state home (or an addon that could not classify), the
+            // engine did not.
+            if (isEngineStateHomeRefusal(msg)) {
+                const stateHome = runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null;
+                return reply
+                    .code(409)
+                    .send(stateHome !== null && stateHome.unregistered.length > 0
+                    ? stateHomeBlockerBody(stateHome)
+                    : {
+                        error: msg,
+                        code: STATE_HOME_BLOCKER_CODE,
+                        stateHome: stateHome?.stateHome ?? null,
+                        unregistered: [],
+                        remedy: STATE_HOME_REMEDY,
+                    });
+            }
+            // wicked-core#461 / crew#556: the engine's typed `NoEligibleSeat` intake refusal — the plan
+            // needs a seat and every seat of the roster was benched by the launcher (signed out / quota /
+            // not installed). A 409 with a typed body, not the 400 the generic arm below answered: the
+            // request is well-formed and succeeds unchanged once a seat is signed in — the conflict is
+            // with the roster's standing (the `state_home_unregistered` rule) — and not a 5xx: the engine
+            // is healthy and said no, naming every seat and its cause.
+            const noSeat = parseNoEligibleSeat(msg);
+            if (noSeat !== null) {
+                return reply.code(409).send(noEligibleSeatBody(msg, noSeat));
+            }
             // An unknown/archived project is a state conflict on a real resource, not a malformed
             // request: 404/409 per the projects error mapping; anything else keeps the launch 400/409.
             if (b.projectId !== undefined && /project.*not registered/i.test(msg)) {
@@ -1204,6 +1273,17 @@ runtime = {}) {
             if (b.projectId !== undefined && /archived|'default'|synthesized/i.test(msg)) {
                 return reply.code(409).send({ error: msg });
             }
+            // crew#554 / wicked-core#468: the engine refused the launch AT INTAKE because the handed
+            // skills snapshot lacks the run's BASE skill (`SkillsError::BaseSkillRefused` — the message
+            // names the skill and "refused at intake"). Nothing was planned or persisted. A typed 422 so a
+            // composer renders a clear card (skill, policy, remedy) instead of a generic launch 400.
+            if (/\bbase skill\b.*\brefused at intake\b/is.test(msg)) {
+                const posture = runtime.skills?.baseSkill() ?? null;
+                const remedy = posture !== null && posture.inCatalog
+                    ? `the skill is in the catalog — POST /skills/publish hands it to the next launch; or set baseSkillPolicy "warn" (PUT /settings) to run without the discipline directive`
+                    : `install a wicked-garden that ships the skill, POST /skills/refresh-baseline, then POST /skills/publish; or set baseSkillPolicy "warn" (PUT /settings) to run without the discipline directive`;
+                return reply.code(422).send({ code: 'base_skill_refused', error: msg, baseSkill: posture, remedy });
+            }
             const busy = /busy|in flight|already/i.test(msg);
             return reply.code(busy ? 409 : 400).send({ error: msg });
         }
@@ -1851,15 +1931,35 @@ runtime = {}) {
         text: z.string().min(1).max(65536),
         targets: z.array(z.string().min(1)).min(1).max(8).optional(),
     }).strict();
+    // F-RECON-017: a message sent while a targeted seat is still answering the previous one is
+    // REFUSED, not queued. The engine queues silently (the worker gets the text the instant the
+    // previous turn's final block lands) and its reply frames carry no message correlation, so the
+    // recon saw Q2's reply render under Q3's bubble. The daemon's own turn index (`chat-turns.ts`)
+    // is the record: 409 `turn_in_flight` names the turn and the busy seats — a send that targets
+    // only IDLE seats passes (a stalled seat never blocks a follow-up to the one that answered) —
+    // and the 202 returns the `turnId` the reply frames are stamped with (`turn_id`) on `/ws`.
     app.post(`${V}/chats/:id/messages`, async (req, reply) => {
         const { id } = req.params;
         const parsed = ChatMessageSchema.safeParse(req.body);
         if (!parsed.success) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
+        const inFlight = chatTurns.inFlight(id, parsed.data.targets);
+        if (inFlight !== null) {
+            const ageS = Math.round(inFlight.ageMs / 1000);
+            return reply.code(409).send({
+                code: 'turn_in_flight',
+                error: `${inFlight.busy.join(', ')} ${inFlight.busy.length === 1 ? 'is' : 'are'} still answering the previous ` +
+                    `message in this chat (turn ${inFlight.turnId}, ${ageS}s ago: “${inFlight.excerpt}”) — wait for the ` +
+                    `reply, or target only idle seats. Nothing was sent.`,
+                chatId: id,
+                turn: inFlight,
+            });
+        }
         try {
             const seats = await adapter.chatSend(id, parsed.data.text, parsed.data.targets);
-            return reply.code(202).send({ seats });
+            const turn = chatTurns.begin(id, seats, parsed.data.text);
+            return reply.code(202).send({ seats, ...(turn !== null ? { turnId: turn.turnId } : {}) });
         }
         catch (err) {
             const msg = message(err);
@@ -1924,6 +2024,7 @@ runtime = {}) {
         // (crew#502); the id stays parked until the engine's `chatClosed` is observed, so a delayed
         // close can never land on a chat that reused it (Copilot, #518).
         chatScopes.beginClose(id);
+        chatTurns.closed(id);
         try {
             await adapter.chatClose(id);
             return { ok: true };
@@ -3289,6 +3390,26 @@ runtime = {}) {
                     .send({ error: "deliverDefault must be 'pr' or 'none'" });
             }
         }
+        // baseSkillRef / baseSkillPolicy (crew#554 / wicked-core#468): the discipline skill EVERY
+        // governed unit is told to follow, and what a snapshot without it means. Both decide whether
+        // launches carry the directive or are refused at intake, so a typo is a 400, never a silently
+        // dropped key. The name is exported to the engine verbatim: a skill-name shape only.
+        if (Object.hasOwn(patch, 'baseSkillRef')) {
+            const r = patch.baseSkillRef;
+            if (typeof r !== 'string' || !BASE_SKILL_REF_SHAPE.test(r.trim())) {
+                return reply.code(400).send({
+                    error: 'baseSkillRef must be a skill name (lowercase letters, digits, "-", "_", ":", ".", up to 128 chars — e.g. "wicked-garden-governed-worker"), or "" to turn the base skill off',
+                });
+            }
+        }
+        if (Object.hasOwn(patch, 'baseSkillPolicy')) {
+            const p = patch.baseSkillPolicy;
+            if (typeof p !== 'string' || !BASE_SKILL_POLICIES.has(p)) {
+                return reply.code(400).send({
+                    error: "baseSkillPolicy must be 'warn' (runs proceed without a missing base skill, with a diagnostics warning) or 'require' (the engine refuses launches at intake until the published snapshot holds it)",
+                });
+            }
+        }
         // Skin-owned keys (crew#323): allowed through, but VALIDATED rather than trusted. The
         // daemon does not read these values, so the only two things it can check are the two that
         // can hurt it — a value it cannot persist, and a value big enough to bloat settings.json.
@@ -3329,6 +3450,8 @@ runtime = {}) {
             'workerStallEscalateAction',
             'workerStallMaxEscalations',
             'deliverDefault',
+            'baseSkillRef',
+            'baseSkillPolicy',
         ];
         const safe = {};
         for (const key of allowed) {
@@ -3354,6 +3477,12 @@ runtime = {}) {
         // WICKED_WORKER_HOME per worker spawn — never cached — so this alone makes the change live
         // at the next spawn: no daemon restart, no engine restart.
         applyWorkerConfigRoot(settings.worker_config_root);
+        // Re-judge and re-export the BASE skill (crew#554) — the engine reads WICKED_BASE_SKILL_REF at
+        // intake, per launch, so this alone makes a changed name or policy live at the next launch.
+        // Only when the patch named either key: an unrelated settings write must not re-log the seam.
+        if (Object.hasOwn(safe, 'baseSkillRef') || Object.hasOwn(safe, 'baseSkillPolicy')) {
+            runtime.skills?.configureBaseSkill(settings);
+        }
         // (No skills re-apply: the skills root is not a setting — skills/runtime.ts, codex round 5.)
         // `changed` names every persisted key, engine and `studio.*` alike; `ignored` (present only
         // when there is one) is where a dropped unknown key stops being invisible.