wicked-crew 0.7.34 → 0.7.36

package/dist/api/routes.js

@@ -5,7 +5,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds } from '../core/adapter.js';
+import { CampaignsUnsupportedError, ChatUnsupportedError, CoreAdapter, ElicitationUnsupportedError, SteeringUnsupportedError, humanGatePhaseIds, settingsFilePath } from '../core/adapter.js';
 import { codeGraphDb, codeGraphErrorStatus, requirementsGraph } from '../core/repoPaths.js';
 import { resolveCursorUnit } from '../core/cursor.js';
 import { detectRefusal } from './gate-cache.js';
@@ -26,7 +26,7 @@ import { InvalidDiffBaseError, MERGE_BASE_LITERAL, NotARegularFileError, Unresol
 import { DocRunIndex } from '../interactive/doc-run-index.js';
 import { listInteractiveDocs } from '../interactive/docs-index.js';
 import { TestSetIndex } from '../qe/test-sets.js';
-import { resolveProjectGraphBinding } from '../projects/graph.js';
+import { estateExe, resolveProjectGraphBinding } from '../projects/graph.js';
 import { registerProjectRoutes } from '../projects/routes.js';
 import { registerCampaignRoutes } from '../campaigns/routes.js';
 import { registerGovernanceWikiRoutes } from './governance-wiki.js';
@@ -36,11 +36,12 @@ import { registerTestingRoutes } from './testing.js';
 import { registerSkillsRoutes } from './skills.js';
 import { disabledSkillsHealth } from '../skills/runtime.js';
 import { STATE_HOME_BLOCKER_CODE, STATE_HOME_REMEDY, isEngineStateHomeRefusal, stateHomeBlockerBody, } from '../projects/state-home-preflight.js';
-import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE } from '../skills/base-skill.js';
+import { BASE_SKILL_POLICIES, BASE_SKILL_REF_SHAPE, baseSkillRemedy } from '../skills/base-skill.js';
 import { noEligibleSeatBody, parseNoEligibleSeat } from '../core/engine-roster.js';
 import { ProjectSettingsStore } from '../projects/settings.js';
 import { boundOrigin, InteractiveBridgePool } from '../interactive/bridge-pool.js';
 import { composeDeliverText, factsFromRun, framedDeliverText, runUrlFor } from '../core/deliver-text.js';
+import { resolvePullRequest as resolvePullRequestViaGh } from '../core/deliver.js';
 import { registerInteractiveProxy } from '../interactive/proxy-routes.js';
 import { registerInteractiveDocDelete } from '../interactive/doc-delete-routes.js';
 import { registerInteractiveDocList } from '../interactive/doc-list-routes.js';
@@ -54,7 +55,7 @@ import { RetryIndex } from './retry-index.js';
 import { GroupIndex } from './group-index.js';
 import { RunTimingIndex, recordRunLaunched } from './run-timing-index.js';
 import { GuidanceIndex } from './guidance-index.js';
-import { DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, } from './delivery-index.js';
+import { DeliveryIndex, gitRunBranchIsEmpty, gitWorktreeIsClean, isDeliverConflictStranded, prUrlFrom, canDeliverResolver, } from './delivery-index.js';
 import { DeliveryDerivationCache } from './delivery-cache.js';
 import { gitReprovisionWorktree, runDeliverScript, } from './post-hoc-deliver.js';
 import { LOCAL_ACTOR } from './auth.js';
@@ -82,6 +83,17 @@ const STATUS_ORDER = {
 function sortActionableFirst(views) {
     return [...views].sort((a, b) => (STATUS_ORDER[a.session.status] ?? 9) - (STATUS_ORDER[b.session.status] ?? 9));
 }
+/**
+ * The whole-graph counts from `wicked-estate stats --db` stdout (`nodes=N edges=M files=F …`, the
+ * first line estate prints — `main.rs`'s `stats` summary). `undefined` when the line does not parse
+ * (an older/newer estate, an error message): the caller leaves `CodeGraphData.totals` ABSENT.
+ */
+export function parseEstateTotals(stdout) {
+    const m = /^nodes=(\d+) edges=(\d+) files=(\d+)/m.exec(stdout);
+    if (m === null)
+        return undefined;
+    return { nodes: Number(m[1]), edges: Number(m[2]), files: Number(m[3]) };
+}
 function codeGraphDbOr503(repo, reply) {
     try {
         return codeGraphDb(repo);
@@ -364,6 +376,13 @@ export const LaunchSchema = z.object({
      *  sharing a label form one `RunGroup` on `GET /campaigns`. Persisted/echoed like
      *  `campaignId` (as `AgentSession.group_label`). */
     groupLabel: z.string().min(1).max(200).optional(),
+    /** DES-L9 / crew#550 (api-types 0.38.0) — REVISE an OPEN same-repository pull request: its head
+     *  branch becomes the run's base and the deliver phase pushes the run's commits onto it (no
+     *  second PR), commenting the run record. Needs `repoRef` + `workflow` and `deliver: "pr"`
+     *  (explicit `"none"` is a 400; a daemon that resolves the omitted field to `none` is a 409).
+     *  Resolved via `gh pr view` at launch — not OPEN / a fork / gh failure ⇒ 409, nothing launched.
+     *  Send it only when `GET /health.capabilities.revisesPr === true` (engine ≥ 0.7.27). */
+    revisesPr: z.number().int().positive().optional(),
 }).strict().refine((b) => b.deliver !== 'pr' || b.workflow !== undefined, {
     message: 'deliver: "pr" requires a workflow — a free-text run has no def to append the deliver phase to',
     path: ['deliver'],
@@ -376,11 +395,26 @@ export const LaunchSchema = z.object({
 }).refine((b) => b.campaignId === undefined || b.groupLabel === undefined, {
     message: 'campaignId and groupLabel are mutually exclusive — a run files onto ONE grouping surface (an existing campaign, or a label group)',
     path: ['groupLabel'],
+}).refine((b) => b.revisesPr === undefined || (b.repoRef !== undefined && b.workflow !== undefined), {
+    message: 'revisesPr needs repoRef and workflow — a revision bases a repo-scoped, def-driven run on the pull request\'s branch',
+    path: ['revisesPr'],
+}).refine((b) => b.revisesPr === undefined || b.deliver !== 'none', {
+    message: 'revisesPr needs deliver: "pr" — a launch that declines delivery has no phase to push the revision with',
+    path: ['revisesPr'],
 });
+/** `POST /runs/:id/gate` (api-types 0.38.0 `GateDecision`; DES-L1 PR-2). Additive arms: `action`
+ *  names the arm (`approve` | `request_changes` | `reject`; absent = today's two-arm mapping of
+ *  `approve`), `amendScope` says where an approve's `amend` lands (`cursor` = the gated unit, today's
+ *  behaviour | `creator` = the first creator phase at/after the cursor — an intake steer reaches the
+ *  phase that implements). `request_changes` sends a NOT-PASS review back to the creator with the
+ *  findings in context (`amend` = the operator's note). A disagreement between `action` and
+ *  `approve` is a 400 that names both. */
 export const GateSchema = z.object({
     approve: z.boolean(),
     amend: z.string().optional(),
-}).strict();
+    action: z.enum(['approve', 'request_changes', 'reject']).optional(),
+    amendScope: z.enum(['cursor', 'creator']).optional(),
+}).strict().refine((b) => b.action === undefined || (b.action === 'approve') === b.approve, { message: '`action` disagrees with `approve`: request_changes and reject require approve: false; approve requires approve: true', path: ['action'] }).refine((b) => b.amendScope === undefined || b.approve, { message: '`amendScope` applies to an approve only (approve: true)', path: ['amendScope'] });
 /** `PUT /runs/:id/guidance` (DES-UX-002 §7.2, CREW-UX-7) — the durable pre-gate note body.
  *  The empty string is a legal body: it CLEARS the note. The byte cap is checked in the route
  *  (not zod's char-counting `max`) so the 400 names the actual limit. */
@@ -444,6 +478,24 @@ const STUDIO_SETTINGS_KEY = /^studio\.[a-z][a-z0-9-]*$/;
  * ceiling on ONE key, not on the patch.
  */
 const STUDIO_SETTINGS_MAX_BYTES = 512 * 1024;
+/**
+ * Stamp the required `seq` onto the daemon-authored frames of a ts-sorted merge. A watchdog frame
+ * has no engine `seq` — the engine's log never saw it — so each one rides the seq of the engine
+ * record it FOLLOWS (0 before the first). The served array is therefore monotonic non-decreasing in
+ * `seq`, and a consumer that re-sorts by seq (studio's narrator) keeps every frame beside the event
+ * it was captured after, instead of dropping it to the front on a missing key.
+ */
+function withServedSeq(merged) {
+    let seq = 0;
+    return merged.map((e) => {
+        if (!('daemon' in e)) {
+            if (typeof e.seq === 'number')
+                seq = e.seq;
+            return e;
+        }
+        return { ...e, seq };
+    });
+}
 /**
  * The daemon REST surface. Every endpoint is a thin wrapper over one adapter /
  * core-ts call (DES-STUDIO-001 §2). `session`/`phase` nouns are now `run`/`unit`.
@@ -489,6 +541,7 @@ runtime = {}) {
     const guidanceIndex = runtime.guidanceIndex ?? new GuidanceIndex();
     const chatScopes = runtime.chatScopes ?? new ChatScopeIndex();
     const chatTurns = runtime.chatTurns ?? new ChatTurnIndex();
+    const chatTranscripts = runtime.chatTranscripts;
     const deliveryIndex = runtime.deliveryIndex ?? new DeliveryIndex();
     // Wave 6: the doc↔run binding and the registered test sets — `createServer` injects the real
     // ones; a directly-driven route set gets an empty index (every run `document_id: null`, no sets).
@@ -508,11 +561,17 @@ runtime = {}) {
     // the daemon's sweep/warm feed it. The default (a directly-driven route set) is COLD and
     // unstarted — no background timer under a unit test, reads degrade to the stat-only
     // tri-state — while `createServer` injects a started one over the production probes.
+    // Def-awareness (crew#481 / D-14): the ONE predicate the run DTOs' cache, the campaigns rollup and
+    // the resume 409 classify from. A fake adapter with no registry (`listWorkflows` absent) resolves
+    // no def ⇒ `runCanDeliver(view, null)` ⇒ candidate — byte-for-byte today's read.
+    const canDeliver = runtime.canDeliver ??
+        canDeliverResolver(() => (typeof adapter.listWorkflows === 'function' ? adapter.listWorkflows() : []), (m) => app.log.warn(m));
     const deliveryCache = runtime.deliveryCache ??
         new DeliveryDerivationCache({
             listViews: () => adapter.sessionsDetail(),
             probes: vacuityProbes,
             isDelivered: (runId) => deliveryIndex.urlFor(runId) !== undefined,
+            canDeliver,
         });
     const deliverExec = runtime.deliverExec ?? runDeliverScript;
     // crew#524: the deliver phase's script asks THIS daemon for the run-derived PR text, and the PR
@@ -528,6 +587,8 @@ runtime = {}) {
     const estateTool = runtime.callEstateTool ?? callEstateTool;
     /** Repo root for a repo ref, from the registry — shared by the reprovision path below. */
     const repoRootOf = async (repoRef) => (await adapter.listRepos()).find((r) => r.id === repoRef)?.root_path;
+    /** DES-L9: PR number → head branch, through `gh pr view` unless the runtime injected an answerer. */
+    const resolvePullRequest = runtime.resolvePullRequest ?? resolvePullRequestViaGh;
     // The run-DTO joins (DES-UX-001 §8.2/§8.3, DES-UX-002 §7.2): `project_id` from the membership
     // record — `null` = genuinely unfiled, so the field is ALWAYS present on served runs —
     // `retry_of` from the lineage index and `guidance` from the guidance index, each set only
@@ -577,7 +638,7 @@ runtime = {}) {
             return { delivery: 'delivered', deliverUrl: url };
         if (conflictStrand)
             return { delivery: 'stranded' };
-        return deliveryCache.read(view.session);
+        return deliveryCache.read(view);
     };
     const decorateRun = (view) => {
         const conflictStrand = normalizeStranded(view);
@@ -607,6 +668,11 @@ runtime = {}) {
         const createdAt = runTimingIndex.createdAtFor(view.session.id);
         if (createdAt !== undefined)
             view.session.created_at = createdAt;
+        // `ended_at` (crew#496 / studio#230; api-types 0.38.0): the same posture from the `run.ended`
+        // entry the daemon records at the run's terminal frame — ABSENT when it has none.
+        const endedAt = runTimingIndex.endedAtFor(view.session.id);
+        if (endedAt !== undefined)
+            view.session.ended_at = endedAt;
         const state = resolveDelivery(view, conflictStrand);
         view.session.delivery = state.delivery;
         if (state.deliverUrl !== undefined)
@@ -634,19 +700,26 @@ runtime = {}) {
         // probe honestly reports no gate.
         const capabilities = typeof adapter.engineCapabilities === 'function'
             ? adapter.engineCapabilities()
-            : { deliverGate: false };
+            : { deliverGate: false, revisesPr: false };
         // wicked-core#411 / crew#497: the state-home blocker rides the health probe as a WARNING. The
         // daemon still SERVES (status stays ok — studio must load and show the blocker) but refuses to
         // launch while the state home holds an entry the worker Read fence cannot classify. Re-surveyed
         // per probe (two readdirs) so an entry that appears after boot is reported without a restart;
         // the field is ABSENT when there is nothing to say, and on a route set booted without the watch.
         const stateHome = runtime.stateHome !== undefined ? await runtime.stateHome.refresh() : null;
-        const warnings = stateHome === null
-            ? []
-            : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }));
         // crew#554: the BASE skill posture for the next launch — the composer's confirm line
         // ("discipline skill: <name> gen N" / "MISSING — …"). Cached by the skills runtime: no I/O.
         const baseSkill = runtime.skills?.baseSkill() ?? null;
+        // F-W1-102: the base skill's ERROR rides `warnings` too. A daemon under `require` with no published
+        // generation holding the skill (the crew-only install: no wicked-garden) REFUSES every launch at
+        // intake — it must never read "status ok, no warnings". The SAME finding object as
+        // `baseSkill.finding` and `/diagnostics.skills.findings[]` (one surface, no new field;
+        // `HealthWarning.kind` is open); status stays ok because the daemon serves and studio must load
+        // and show it — exactly the state-home blocker's precedent above.
+        const warnings = [
+            ...(stateHome === null ? [] : stateHome.findings.map((f) => ({ kind: f.kind, severity: f.severity, message: f.message }))),
+            ...(baseSkill?.finding ? [{ kind: baseSkill.finding.kind, severity: baseSkill.finding.severity, message: baseSkill.finding.message }] : []),
+        ];
         return {
             status: 'ok',
             version: PKG_VERSION,
@@ -1157,6 +1230,36 @@ runtime = {}) {
         }
         if (deliver === 'pr')
             input.deliver = 'pr';
+        // DES-L9 / crew#550 — REVISION: `revisesPr` names an OPEN same-repository pull request whose
+        // head branch becomes the run's base (`baseRef`, crew-internal → the engine's
+        // `LaunchSpec.base_ref`) and the push target of the composed deliver phase — the PR gains
+        // exactly the run's commits, no second PR. Resolved HERE via `gh pr view` (5 s; the engine has
+        // no GitHub client) and refused by name on anything but OPEN + same repo. Judged AFTER the
+        // deliver resolution (F5): a launch this daemon resolved to `none` (deliverDefault) has no
+        // phase to push with — a revision that pushes nothing would be a silent no-op.
+        let revisesPr;
+        if (b.revisesPr !== undefined) {
+            if (deliver !== 'pr') {
+                return reply.code(409).send({
+                    error: `revisesPr needs deliver: pr — this daemon resolved the launch to none (deliverDefault); send deliver: "pr"`,
+                });
+            }
+            const revisedRepo = b.repoRef;
+            if (revisedRepo === undefined) {
+                // Unreachable past the schema refine; kept so the type narrows honestly.
+                return reply.code(400).send({ error: 'revisesPr needs repoRef' });
+            }
+            const root = await repoRootOf(revisedRepo);
+            if (root === undefined) {
+                return reply.code(404).send({ error: `repoRef names an unknown repo: ${revisedRepo}` });
+            }
+            const resolved = await resolvePullRequest(root, b.revisesPr);
+            if (!resolved.ok)
+                return reply.code(409).send({ error: resolved.error });
+            revisesPr = { number: b.revisesPr, headRef: resolved.pr.headRef, url: resolved.pr.url };
+            input.baseRef = revisesPr.headRef;
+            input.revisesPr = revisesPr;
+        }
         // Retry lineage (DES-UX-001 §8.3): `retryOf` must name an EXISTING run — recording lineage
         // to a run that never existed would be provenance pointing at nothing, so the launch fails
         // loudly (400, before anything is committed) rather than filing a dangling edge.
@@ -1212,6 +1315,9 @@ runtime = {}) {
                 // CREW-UX-3: the trail is the durable record of lineage — the retry index (and a
                 // restarted daemon's hydrate) reads it back from exactly this entry.
                 ...(b.retryOf !== undefined ? { retryOf: b.retryOf } : {}),
+                // DES-L9: the revised PR (number, head branch, URL) — the retry index (and a restarted
+                // daemon's hydrate) reads it back from here so a stranded revision re-pushes to THAT PR.
+                ...(revisesPr !== undefined ? { revisesPr, baseRef: revisesPr.headRef } : {}),
                 // wicked-studio#27: the trail is likewise the durable record of the group attach —
                 // the group index (and a restarted daemon's hydrate) reads it back from here.
                 ...(b.campaignId !== undefined ? { campaignId: b.campaignId } : {}),
@@ -1219,6 +1325,8 @@ runtime = {}) {
             });
             if (b.retryOf !== undefined)
                 retryIndex.set(runId, b.retryOf);
+            if (revisesPr !== undefined)
+                retryIndex.setRevisesPr(runId, revisesPr);
             if (b.campaignId !== undefined)
                 groupIndex.set(runId, { campaignId: b.campaignId });
             else if (b.groupLabel !== undefined)
@@ -1279,9 +1387,8 @@ runtime = {}) {
             // composer renders a clear card (skill, policy, remedy) instead of a generic launch 400.
             if (/\bbase skill\b.*\brefused at intake\b/is.test(msg)) {
                 const posture = runtime.skills?.baseSkill() ?? null;
-                const remedy = posture !== null && posture.inCatalog
-                    ? `the skill is in the catalog — POST /skills/publish hands it to the next launch; or set baseSkillPolicy "warn" (PUT /settings) to run without the discipline directive`
-                    : `install a wicked-garden that ships the skill, POST /skills/refresh-baseline, then POST /skills/publish; or set baseSkillPolicy "warn" (PUT /settings) to run without the discipline directive`;
+                // F-W1-102: the SAME remedy sentence the /health finding and `wicked-crew status` carry.
+                const remedy = baseSkillRemedy(posture?.inCatalog ?? false);
                 return reply.code(422).send({ code: 'base_skill_refused', error: msg, baseSkill: posture, remedy });
             }
             const busy = /busy|in flight|already/i.test(msg);
@@ -1419,7 +1526,10 @@ runtime = {}) {
         const origin = boundOrigin(app.server.address());
         // The workflow DEFINITION (a user-registered workflow's view carries the engine instance id).
         const def = resolveRunWorkflow(run, listWorkflowsSafe());
-        const text = composeDeliverText(factsFromRun(decorateRun(run), runUrlFor(origin, id), { workflowId: def?.id ?? null }));
+        const text = composeDeliverText(factsFromRun(decorateRun(run), runUrlFor(origin, id), {
+            workflowId: def?.id ?? null,
+            revisesPr: retryIndex.revisesPrFor(id) ?? null,
+        }));
         return reply.type('text/plain; charset=utf-8').send(framedDeliverText(text));
     });
     // ── Post-hoc delivery (crew#393) — lift a stranded run's worktree into a PR ──
@@ -1520,6 +1630,9 @@ runtime = {}) {
         // the throwaway down after the lift.
         let result;
         let worktreeGone = false;
+        // DES-L9: a stranded REVISION re-pushes onto its PR's branch (re-checked OPEN via the same
+        // resolver), never a new PR; a PR that closed meanwhile is a named 409.
+        let revisionRefused;
         try {
             // The worktree admin (reprovision), the deliver spawn, AND the throwaway teardown all run
             // under the per-repo lock, so a second stranded run in this repo cannot touch
@@ -1544,10 +1657,27 @@ runtime = {}) {
                     // holds (the fallback), and names this daemon so the script can re-ask at delivery.
                     const origin = boundOrigin(app.server.address());
                     const def = resolveRunWorkflow(run, listWorkflowsSafe());
+                    const revising = retryIndex.revisesPrFor(id);
+                    let revisesPr = null;
+                    if (revising !== undefined) {
+                        const revisedRoot = await repoRootOf(repoRef);
+                        const again = revisedRoot === undefined
+                            ? { ok: false, error: `repo ${repoRef} is no longer registered — cannot re-check pull request #${revising.number}` }
+                            : await resolvePullRequest(revisedRoot, revising.number);
+                        if (!again.ok) {
+                            revisionRefused = again.error;
+                            return;
+                        }
+                        revisesPr = { number: revising.number, headRef: again.pr.headRef, url: again.pr.url };
+                    }
                     result = await deliverExec(workdir, s.problem ?? undefined, {
                         runId: id,
                         apiOrigin: origin,
-                        facts: factsFromRun(run, runUrlFor(origin, id), { workflowId: def?.id ?? null }),
+                        facts: factsFromRun(run, runUrlFor(origin, id), {
+                            workflowId: def?.id ?? null,
+                            revisesPr: revisesPr === null ? null : { number: revisesPr.number, url: revisesPr.url },
+                        }),
+                        revisesPr,
                     });
                 }
                 finally {
@@ -1567,6 +1697,9 @@ runtime = {}) {
                 error: `run ${id}'s worktree is gone (${s.workdir}) — nothing left to deliver`,
             });
         }
+        if (revisionRefused !== undefined) {
+            return reply.code(409).send({ error: revisionRefused });
+        }
         if (result === undefined) {
             // Unreachable: the lock body assigns `result` on every path that is not `worktreeGone`.
             return reply.code(500).send({ error: `deliver for run ${id} produced no result` });
@@ -1783,7 +1916,8 @@ runtime = {}) {
                 // taken out by the council-bench / dispatch-timeout path, not by admission, so admission's
                 // list never named it. Every requested-or-defaulted seat that is not in `seats` is named
                 // here with the most specific cause the daemon knows: its own "no credential" report
-                // (`auth`), this daemon's council bench (`bench`), else the dispatch budget (`budget`).
+                // (`auth`), else the dispatch budget (`budget`). (R5b: crew keeps no council bench of its
+                // own any more — the engine benches per run and says so in `unitDistributed.degradedReason`.)
                 for (const key of clis) {
                     if (seats.some((s) => s.cliKey === key) || refused.some((r) => r.cliKey === key))
                         continue;
@@ -1798,13 +1932,6 @@ runtime = {}) {
                             source: 'auth',
                         });
                     }
-                    else if (st?.council_bench !== undefined) {
-                        refused.push({
-                            cliKey: key,
-                            reason: `not seated — ${st.council_ineligible_reason ?? 'benched by this daemon’s recent councils'}`,
-                            source: 'bench',
-                        });
-                    }
                     else {
                         refused.push({
                             cliKey: key,
@@ -1878,7 +2005,7 @@ runtime = {}) {
                         projectAttachError = message(err);
                     }
                 }
-                if (!chatScopes.set(chatId, scope, token, refused)) {
+                if (!chatScopes.set(chatId, scope, token, refused, engine)) {
                     // The reservation was cancelled while the open was in flight — an engine `chatClosed` or a
                     // `DELETE` for this id (Copilot, #518). Nothing was recorded; tear the chat down (engine
                     // session, scratch root, and the filing just made) instead of returning a stale 201.
@@ -1927,6 +2054,19 @@ runtime = {}) {
             chatScopes.release(chatId, token);
         }
     });
+    /**
+     * The ONE 409 `turn_in_flight` body (review NIT): the send route and the re-seat route refuse for
+     * the same reason and promise the same shape, so they build it in one place and cannot drift.
+     * `nothingHappened` names what did NOT happen on this route — their only difference.
+     */
+    const turnInFlightBody = (chatId, inFlight, nothingHappened) => ({
+        code: 'turn_in_flight',
+        error: `${inFlight.busy.join(', ')} ${inFlight.busy.length === 1 ? 'is' : 'are'} still answering the previous ` +
+            `message in this chat (turn ${inFlight.turnId}, ${Math.round(inFlight.ageMs / 1000)}s ago: ` +
+            `“${inFlight.excerpt}”) — wait for the reply, or target only idle seats. ${nothingHappened}`,
+        chatId,
+        turn: inFlight,
+    });
     const ChatMessageSchema = z.object({
         text: z.string().min(1).max(65536),
         targets: z.array(z.string().min(1)).min(1).max(8).optional(),
@@ -1944,28 +2084,103 @@ runtime = {}) {
         if (!parsed.success) {
             return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
         }
-        const inFlight = chatTurns.inFlight(id, parsed.data.targets);
+        // DES-L5 §5-c (F-E2E-041): the audience is decided HERE — the named targets, else the engine's
+        // warm seats — so the turn can be opened BEFORE the engine call, in the same tick as the
+        // predicate below: two racing sends can no longer both pass `inFlight` during the await, and a
+        // `chatDelta` that lands before `chatSend` resolves is already stamped with its `turn_id`.
+        const audience = parsed.data.targets ?? (await adapter.chatSeats(id));
+        if (audience.length === 0) {
+            return reply.code(409).send({ error: `chat '${id}' has no warm seats — open it first` });
+        }
+        const inFlight = chatTurns.inFlight(id, audience);
         if (inFlight !== null) {
-            const ageS = Math.round(inFlight.ageMs / 1000);
-            return reply.code(409).send({
-                code: 'turn_in_flight',
-                error: `${inFlight.busy.join(', ')} ${inFlight.busy.length === 1 ? 'is' : 'are'} still answering the previous ` +
-                    `message in this chat (turn ${inFlight.turnId}, ${ageS}s ago: “${inFlight.excerpt}”) — wait for the ` +
-                    `reply, or target only idle seats. Nothing was sent.`,
-                chatId: id,
-                turn: inFlight,
-            });
+            return reply.code(409).send(turnInFlightBody(id, inFlight, 'Nothing was sent.'));
         }
+        // Sync, same tick as `inFlight`: the window is closed before anything yields.
+        const turn = chatTurns.begin(id, audience, parsed.data.text);
         try {
             const seats = await adapter.chatSend(id, parsed.data.text, parsed.data.targets);
-            const turn = chatTurns.begin(id, seats, parsed.data.text);
+            if (turn !== null) {
+                // The engine's answer is the truth: the reserved audience is squared with the seats it
+                // reached, and the operator's message joins the transcript with exactly those seats.
+                chatTurns.reconcile(id, turn.turnId, seats);
+                chatTranscripts?.appendUser(id, turn.turnId, parsed.data.text, seats);
+            }
             return reply.code(202).send({ seats, ...(turn !== null ? { turnId: turn.turnId } : {}) });
         }
         catch (err) {
+            // Nothing went out: the reservation is retracted so the next send is not refused for it.
+            if (turn !== null)
+                chatTurns.abort(id, turn.turnId);
             const msg = message(err);
             return reply.code(/no warm seats/.test(msg) ? 409 : 400).send({ error: msg });
         }
     });
+    // F-W1-005 (wave-1 P6): re-seat NAMED seats on a LIVE chat — the retry lever for a seat the open
+    // refused (or whose session died). Re-runs the engine's per-seat `chat_ensure` through `chatOpen`
+    // with the IDENTICAL scope recorded at open (a different scope would evict every warm seat —
+    // Copilot, #426; the index retains what the engine was handed). Explicit seats bypass the daemon's
+    // default pre-filter exactly as `clis` on `POST /chats` does: the engine refuses per seat and its
+    // reason rides the outcome, then `refused[]` and a `chatSeatRefused` frame — the same shapes the
+    // 201 carries, so the thread and the picker read one story. Never a new chat, never a new pool key.
+    const ChatSeatsSchema = z.object({
+        clis: z.array(z.string().min(1)).min(1).max(8),
+    }).strict();
+    app.post(`${V}/chats/:id/seats`, 
+    // Typed like every neighbouring chat route (review HIGH-1): the names bind the 0.39.0 api-types
+    // mirror to this row — `ChatSeatsBody { clis }` in, `ChatSeatsResponse { chatId, seats, refused }`
+    // out (the 201's own `ChatSeatOutcome` / `ChatSeatRefusal` shapes, which 0.38.0 already ships).
+    {
+        config: {
+            manifest: {
+                requestType: 'ChatSeatsBody',
+                responseType: 'ChatSeatsResponse',
+                statusCodes: [200, 400, 404, 409],
+            },
+        },
+    }, async (req, reply) => {
+        const { id } = req.params;
+        const parsed = ChatSeatsSchema.safeParse(req.body);
+        if (!parsed.success) {
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid request body'));
+        }
+        const engine = chatScopes.engineOf(id);
+        if (engine === undefined) {
+            return reply.code(404).send({
+                error: `chat ${id} is not open on this daemon — open a chat first, then re-seat into it`,
+            });
+        }
+        const clis = [...new Set(parsed.data.clis)];
+        // A seat mid-turn is not re-warmed under its own reply (the same rule as a send).
+        const inFlight = chatTurns.inFlight(id, clis);
+        if (inFlight !== null) {
+            return reply.code(409).send(turnInFlightBody(id, inFlight, 'No seat was re-warmed.'));
+        }
+        try {
+            const seats = await adapter.chatOpen(id, clis, engine.cwd, {
+                codeGraphDb: engine.codeGraphDb,
+                readRoots: engine.readRoots,
+            });
+            const refused = chatScopes.foldSeats(id, seats);
+            const projectId = projects.index.projectOf(id) ?? undefined;
+            for (const s of seats) {
+                if (s.ok)
+                    continue;
+                runtime.broadcast?.({
+                    type: 'chatSeatRefused',
+                    chat: id,
+                    cliKey: s.cliKey,
+                    reason: s.error ?? 'the engine refused the seat',
+                    source: 'engine',
+                    ...(projectId !== undefined ? { project_id: projectId } : {}),
+                });
+            }
+            return { chatId: id, seats, refused };
+        }
+        catch (err) {
+            return reply.code(400).send({ error: message(err) });
+        }
+    });
     // Enumerate live chats (FINDING-027 gap 4). Chat sessions deliberately outlive the page, and
     // their ids are minted client-side — so before this route the only record of an orphaned seat
     // lived in the tab that abandoned it, and an operator could not reclaim one without restarting
@@ -2012,6 +2227,9 @@ runtime = {}) {
                 seats: await adapter.chatSeats(id),
                 scope: chatScopes.get(id) ?? null,
                 refused: chatScopes.refusedOf(id) ?? null,
+                // DES-L5 (D-13): the transcript so far, append order — `[]` before the first persisted
+                // turn; the file goes with the chat on `chatClosed`, so a reclaimed id answers `[]` too.
+                ...(chatTranscripts !== undefined ? { messages: chatTranscripts.read(id) } : {}),
             };
         }
         catch (err) {
@@ -2154,7 +2372,10 @@ runtime = {}) {
             isSteeringAuthorRun(run, adapter.listWorkflows());
         const gatePrompt = steeringPropose ? gateCache.get(id)?.prompt : undefined;
         try {
-            const status = await adapter.confirmGate(id, parsed.data.approve, parsed.data.amend);
+            // All five positionals, explicit `undefined` for the absent ones (DES-L1 PR-2; the
+            // gate-arms tripwire pins the arity). An engine refusal (no creator to send back to,
+            // an engine older than the arm) surfaces as the existing 409 below.
+            const status = await adapter.confirmGate(id, parsed.data.approve, parsed.data.amend, parsed.data.action, parsed.data.amendScope);
             // WHO approved/rejected — the gate-decision audit (task #88). The engine
             // records THAT the gate resolved (interaction_requests / gateDecided);
             // only this HTTP layer knows the authenticated principal behind it.
@@ -2163,6 +2384,8 @@ runtime = {}) {
                 detail: {
                     approve: parsed.data.approve,
                     ...(parsed.data.amend !== undefined ? { amend: parsed.data.amend } : {}),
+                    ...(parsed.data.action !== undefined ? { action: parsed.data.action } : {}),
+                    ...(parsed.data.amendScope !== undefined ? { amendScope: parsed.data.amendScope } : {}),
                     status,
                 },
             });
@@ -2575,14 +2798,22 @@ runtime = {}) {
         if (!ids.includes(id)) {
             return reply.code(404).send({ error: 'Run not found' });
         }
-        const events = await adapter.runEvents(id);
-        if (events === null) {
+        const engineEvents = await adapter.runEvents(id);
+        if (engineEvents === null) {
             // Same shape as the gate route's 503, and for the same reason: "no events" would report a
             // missing binding as a fact about the run. The run may well have a rich history.
             return reply.code(503).send({
                 error: 'Run history is unavailable: this wicked-core build has no event-log read binding',
             });
         }
+        // wicked-studio#284: the stall watchdog's frames are daemon-authored — the engine's log never
+        // saw them — so a reloaded page used to lose the "needs you" facts the live socket carried.
+        // Merge the remembered frames in capture order beside the engine's; they carry `daemon: true`
+        // and no engine `seq`.
+        const daemonFrames = runtime.stallFrames?.(id) ?? [];
+        const events = daemonFrames.length === 0
+            ? engineEvents
+            : withServedSeq([...engineEvents, ...daemonFrames].sort((a, b) => a.ts - b.ts));
         // An empty array here is a real answer, not a failure: runs that predate the log have no
         // history, and saying so is the honest response.
         // Both spellings of "several types" mean the same thing: `?type=a,b` and `?type=a&type=b`.
@@ -3152,17 +3383,28 @@ runtime = {}) {
             if (q.focus !== undefined && q.focus.trim() !== '') {
                 args.push('--focus', q.focus.trim());
             }
-            const { stdout } = await execCapped('wicked-estate', args, {
-                timeout: 30_000,
-                cwd: repo.root_path,
-            });
+            // Whole-graph `totals` beside the served slice (crew#505 / F-RC1-100; api-types 0.38.0):
+            // `graph-view --limit` emits only the slice, so `stats` alone read "my repo has 150 symbols".
+            // `wicked-estate stats --db` prints `nodes=N edges=M files=F …`; both spawns run under
+            // `Promise.all` (one round trip, not two), the SAME daemon-side CLI posture as `graph-view`.
+            // A stats spawn that fails or prints something else leaves `totals` ABSENT and the slice
+            // still 200 — the tile then knows only the slice, never a substituted count.
+            const exe = estateExe();
+            const [{ stdout }, statsOut] = await Promise.all([
+                execCapped(exe, args, { timeout: 30_000, cwd: repo.root_path }),
+                execCapped(exe, ['stats', '--db', dbPath], { timeout: 30_000, cwd: repo.root_path })
+                    .then((r) => r.stdout)
+                    .catch(() => null),
+            ]);
             const raw = JSON.parse(stdout);
             const fileCount = new Set(raw.nodes.map((n) => n.file)).size;
+            const totals = statsOut === null ? undefined : parseEstateTotals(statsOut);
             const built = {
                 graph: {
                     nodes: raw.nodes,
                     edges: raw.edges,
                     stats: { nodeCount: raw.nodes.length, edgeCount: raw.edges.length, fileCount },
+                    ...(totals !== undefined ? { totals } : {}),
                 },
             };
             return reply.send(built);
@@ -3316,7 +3558,11 @@ runtime = {}) {
     // The store is SHARED with the skin (crew#323): beside the engine's own keys it round-trips
     // the studio's `studio.*` preference blobs verbatim — see `CrewSystemSettings`'s index
     // signature in core/types.ts, which states that rather than leaving it to a client comment.
-    app.get(`${V}/settings`, async () => ({ settings: await adapter.getSettings() }));
+    // crew#494 (F-007 — FIX-IT-ALL L10-6): the System page showed a LITERAL settings path; the daemon
+    // now says where its settings file actually is (`WICKED_CREW_SYSTEM_SETTINGS` honoured) as the
+    // additive `path` (api-types 0.38.0 `SettingsResponse.path?`; adjudicated §4.6 — `path`, not
+    // `settings_path`).
+    app.get(`${V}/settings`, async () => ({ settings: await adapter.getSettings(), path: settingsFilePath() }));
     app.put(`${V}/settings`, async (req, reply) => {
         const patch = req.body;
         if (typeof patch !== 'object' || patch === null || Array.isArray(patch)) {
@@ -3406,7 +3652,7 @@ runtime = {}) {
             const p = patch.baseSkillPolicy;
             if (typeof p !== 'string' || !BASE_SKILL_POLICIES.has(p)) {
                 return reply.code(400).send({
-                    error: "baseSkillPolicy must be 'warn' (runs proceed without a missing base skill, with a diagnostics warning) or 'require' (the engine refuses launches at intake until the published snapshot holds it)",
+                    error: "baseSkillPolicy must be 'require' — the only policy (the engine refuses launches at intake until the published snapshot holds the base skill); 'warn' was deleted in crew 0.7.35: it ran seats UNGROUNDED. Set baseSkillRef \"\" to turn the base skill off explicitly",
                 });
             }
         }
@@ -3819,6 +4065,8 @@ runtime = {}) {
         vacuity: vacuityProbes,
         // A non-probe derivation throw in the rollup is a defect — error level, loud in diagnostics.
         logDefect: (m) => app.log.error(m),
+        // crew#481: the SAME def-awareness the run DTOs apply — one predicate, every surface.
+        canDeliver,
     });
     // ── Governance wiki management (wiki-mgmt) — scoreboard + honest empty-state meta ──────────
     // Browse (`GET /governance/rules` + facets) and retire (`DELETE /governance/rules/:id`) stay