Follow up PR #265: refine chapters, diagrams, and add S20 (#283)

* feat: s01-s14 docs quality overhaul — tool pipeline, single-agent, knowledge & resilience

Rewrite code.py and README (zh/en/ja) for s01-s14, each chapter building
incrementally on the previous. Key fixes across chapters:

- s01-s04: agent loop, tool dispatch, permission pipeline, hooks
- s05-s08: todo write, subagent, skill loading, context compact
- s09-s11: memory system, system prompt assembly, error recovery
- s12-s14: task graph, background tasks, cron scheduler

All chapters CC source-verified. Code inherits fixes forward (PROMPT_SECTIONS,
json.dumps cache, real-state context, can_start dep protection, etc.).

* feat: s15-s19 docs quality overhaul — multi-agent platform: teams, protocols, autonomy, worktree, MCP tools

Rewrite code.py and README (zh/en/ja) for s15-s19, the multi-agent platform
chapters. Each chapter inherits all previous fixes and adds one mechanism:

- s15: agent teams (TeamCreate, teammate threads, shared task list)
- s16: team protocols (plan approval, shutdown handshake, consume_inbox)
- s17: autonomous agents (idle polling, auto-claim, consume_lead_inbox)
- s18: worktree isolation (git worktree, bind_task, cwd switching, safety)
- s19: MCP tools (MCPClient, normalize_mcp_name, assemble_tool_pool, no cache)

All appendix source code references verified against CC source. Config priority
corrected: claude.ai < plugin < user < project < local.

* fix: 5 regressions across s05-s19 — glob safety, todo validation, memory extraction, protocol types, dep crash

- s05-s09: glob results now filter with is_relative_to(WORKDIR) (inherited from s02)
- s06-s08: todo_write validates content/status required fields (inherited from s05)
- s09: extract_memories uses pre-compression snapshot instead of compacted messages
- s16: submit_plan docstring clarifies protocol-only (not code-level gate)
- s17-s19: match_response restores type mismatch validation (from s16)
- s17-s19: claim_task deps list handles missing dep files without crashing

* fix: s12 Todo V2 logic reversal, s14/s15 cron range validation, s18/s19 worktree name validation

- s12 README (zh/en/ja): fix Todo V2 direction — interactive defaults to Task,
  non-interactive/SDK defaults to TodoWrite. Fix env var name to
  CLAUDE_CODE_ENABLE_TASKS (not TODO_V2).
- s14/s15: add _validate_cron_field with per-field range checks (minute 0-59,
  hour 0-23, dom 1-31, month 1-12, dow 0-6), step > 0, range lo <= hi.
  Replace old try/except validation that only caught exceptions.
- s18/s19: add validate_worktree_name() to remove_worktree and keep_worktree,
  not just create_worktree.

* fix: align s16-s19 teaching tool consistency

* fix pr265 chapter diagrams

* Add comprehensive s20 harness chapter

* Fix chapter smoke test regressions

* Clarify README tutorial track transition

---------

Co-authored-by: Haoran <bill-billion@outlook.com>

s18_worktree_isolation/README.en.md

@@ -0,0 +1,208 @@
+# s18: Worktree Isolation — Separate Directories, No Conflicts
+
+[中文](README.md) · [English](README.en.md) · [日本語](README.ja.md)
+
+s01 → ... → s16 → s17 → `s18` → [s19](../s19_mcp_plugin/) → s20
+
+> *"Separate directories, no conflicts"* — Tasks own the goal, worktrees own the directory, bound by ID.
+>
+> **Harness Layer**: Isolation — Parallel execution in separate directories.
+
+---
+
+## The Problem
+
+In s17, Alice and Bob both work in the same directory. Alice's task is "refactor auth module", Bob's task is "refactor UI login page".
+
+Alice calls `write_file("config.py", ...)`. Bob also calls `write_file("config.py", ...)`. Both edit the same file, overwriting each other. And there's no clean rollback — you can't tell whose changes are whose.
+
+s15-s17 solved "who does what" (task system) and "how to communicate" (message bus), but not "where to work".
+
+---
+
+## The Solution
+
+![Worktree Overview](images/worktree-overview.en.svg)
+
+Git worktree lets you create multiple independent working directories in the same repo, each with its own branch. Alice works in `.worktrees/auth-refactor/`, Bob in `.worktrees/ui-login/` — no conflicts.
+
+Carries forward S17's teaching-version MessageBus, protocols, and autonomous claiming. This chapter adds:
+
+| Capability | Purpose |
+|------------|---------|
+| create_worktree | Create isolated directory + branch for a task |
+| bind_task_to_worktree | Bind task and directory (no status change) |
+| remove_worktree / keep_worktree | Cleanup or preserve after completion |
+| validate_worktree_name | Reject path traversal and illegal characters |
+
+---
+
+## How It Works
+
+### Creation: Task-Worktree Binding
+
+```python
+def create_worktree(name: str, task_id: str = "") -> str:
+    validate_worktree_name(name)       # Only [A-Za-z0-9._-]{1,64}
+    path = WORKTREES_DIR / name
+    ok, result = run_git(["worktree", "add", str(path), "-b", f"wt/{name}", "HEAD"])
+    if not ok:
+        return f"Git error: {result}"
+    if task_id:
+        bind_task_to_worktree(task_id, name)
+    log_event("create", name, task_id)
+    return f"Worktree '{name}' created at {path}"
+
+def bind_task_to_worktree(task_id: str, worktree_name: str):
+    task = load_task(task_id)
+    task.worktree = worktree_name       # Write worktree field only
+    save_task(task)                     # Status stays pending, waits for teammate claim
+```
+
+Binding rule: one task binds to one worktree. Binding does NOT change task status — the task stays `pending`, and advances to `in_progress` only when a teammate claims it. This way Lead can pre-create tasks and worktrees, and teammates naturally claim worktree-bound tasks during idle.
+
+### Teammate Tool Cwd Switching
+
+Teaching version maintains a `wt_ctx` dict per teammate, tracking the current worktree path. When a teammate claims a task with a worktree, `wt_ctx` is automatically set to the worktree path; the teammate's `bash`, `read_file`, `write_file` execute in the worktree directory:
+
+```python
+# Inside teammate thread
+wt_ctx = {"path": None}
+
+def _run_claim_task(task_id):
+    result = claim_task(task_id, owner=name)
+    if "Claimed" in result:
+        task = load_task(task_id)
+        if task.worktree:
+            wt_ctx["path"] = str(WORKTREES_DIR / task.worktree)
+    return result
+
+def _run_bash(command):
+    return run_bash(command, cwd=wt_ctx["path"])  # Execute in worktree
+```
+
+This is a teaching simplification. Real CC's EnterWorktree uses `process.chdir()` to switch the entire process directory, and AgentTool isolation uses `cwdOverride` to wrap sub-agent execution.
+
+### Cleanup: Keep or Remove
+
+After task completion, two choices:
+
+```python
+def remove_worktree(name: str, discard_changes: bool = False) -> str:
+    # Safety check: refuse by default if changes exist
+    if not discard_changes:
+        files, commits = _count_worktree_changes(path)
+        if files > 0 or commits > 0:
+            return "Has uncommitted changes. Use discard_changes=true to force, or keep_worktree"
+    ok, _ = run_git(["worktree", "remove", str(path), "--force"])
+    if not ok:
+        return "Remove failed"
+    run_git(["branch", "-D", f"wt/{name}"])
+    log_event("remove", name)
+
+def keep_worktree(name: str) -> str:
+    log_event("keep", name)
+    return f"Worktree '{name}' kept for review (branch: wt/{name})"
+```
+
+Keep = preserve branch for manual review and merge. Remove = refuse by default if uncommitted changes; requires `discard_changes=true` to confirm. Does NOT auto-complete task — task completion is triggered explicitly by the teammate's `complete_task`.
+
+### Event Log: Auditable
+
+Each lifecycle operation writes to a log for auditing:
+
+```python
+def log_event(event_type: str, worktree_name: str, task_id: str = ""):
+    event = {"type": event_type, "worktree": worktree_name,
+             "task_id": task_id, "ts": time.time()}
+    # append to .worktrees/events.jsonl
+```
+
+Event types: `create`, `remove`, `keep`. Teaching version logs events for manual auditing; full recovery would need an index or `git worktree list` scanning.
+
+### run_git: Returns Success/Failure
+
+```python
+def run_git(args: list[str]) -> tuple[bool, str]:
+    r = subprocess.run(["git"] + args, cwd=WORKDIR, ...)
+    return r.returncode == 0, output
+```
+
+`create_worktree` and `remove_worktree` only write event logs after successful git commands, ensuring logs reflect actual state.
+
+---
+
+## Changes from s17
+
+| Component | Before (s17) | After (s18) |
+|-----------|-------------|-------------|
+| Working directory | All agents share WORKDIR | Each task can bind to a git worktree |
+| Task data | id/subject/status/owner/blockedBy | + worktree field |
+| Teammate tool cwd | Always WORKDIR | Auto-switches when claiming worktree-bound task |
+| New functions | — | create_worktree, bind_task_to_worktree, remove_worktree, keep_worktree, validate_worktree_name |
+| Worktree safety | None | Name validation + refuse removal with changes |
+| Event log | None | events.jsonl lifecycle auditing |
+| Lead tools | 14 (s17) | + create_worktree, remove_worktree, keep_worktree (17) |
+| Teammate tools | 8 (s17) | 8 (bash/read/write execute in worktree cwd) |
+
+---
+
+## Try It
+
+```sh
+cd learn-claude-code
+python s18_worktree_isolation/code.py
+```
+
+Try this prompt:
+
+`Create two tasks, then create worktrees for each (bind with task_id). Spawn alice and bob. Watch them auto-claim and work in isolated directories.`
+
+What to observe: Do both worktrees show different branches in `git status`? After claiming a worktree-bound task, does the teammate's bash run in the worktree directory? Does `remove_worktree` refuse when there are changes? Is task status still `pending` after binding?
+
+---
+
+## What's Next
+
+Agent teams can now self-organize in isolated workspaces. But Agent capabilities are limited to the tools we wrote — bash, read, write, task...
+
+What if users already have their own tools? Like an internal Jira API, or a custom deployment system?
+
+s19 MCP Plugin → Give Agent a plugin system. External tools connect via standard protocol; Agent doesn't need to know who wrote them.
+
+<details>
+<summary>Deep Dive into CC Source</summary>
+
+CC's worktree system has two paths: **EnterWorktree** (current session switches in) and **AgentTool isolation** (sub-agent isolation).
+
+### EnterWorktree: Current Session Switch
+
+`EnterWorktreeTool.ts:92-97` after creating the worktree, immediately calls `process.chdir(worktreePath)`, `setCwd()`, `setOriginalCwd()`, `saveWorktreeState()`. The current session's working directory switches directly to the worktree — not a prompt hint, but a process-level directory change.
+
+`ExitWorktreeTool.ts:261-320` both keep and remove call `restoreSessionToOriginalCwd()` to restore the original directory. Remove checks for uncommitted changes (`ExitWorktreeTool.ts:190-220`), refusing without `discard_changes: true`.
+
+### AgentTool Isolation: Sub-Agent Isolation
+
+`AgentTool.tsx:590-641` when `isolation: "worktree"`, calls `createAgentWorktree()` to create a worktree, uses `cwdOverridePath` to wrap sub-agent execution. All sub-agent operations automatically run in the worktree directory. `AgentTool/prompt.ts:272` tells the model: this is a temporary worktree, auto-cleanup if no changes, return path and branch if changes exist.
+
+`worktree.ts:902-951` `createAgentWorktree()` does NOT modify global session cwd, only for sub-agent use. `worktree.ts:961-1020` `removeAgentWorktree()` deletes from the main repo root.
+
+### Name Validation
+
+`worktree.ts:76-84` validates slug: rejects `.`/`..`, allows `[a-zA-Z0-9._-]`. `worktree.ts:48` defines `VALID_WORKTREE_SLUG_SEGMENT`. Teaching version's `validate_worktree_name` uses the same rule.
+
+### Path and Branch Naming
+
+Real path is `.claude/worktrees/`, branch name `worktree-{slug}` (`worktree.ts:204-227`, slashes replaced with `+`). Teaching version uses `.worktrees/` and `wt/{name}` for simplicity.
+
+Creation uses `git worktree add -B` (`worktree.ts:326-328`), preferring `origin/<defaultBranch>` over current HEAD.
+
+### State Management
+
+CC has no task-worktree binding. Worktree state is managed through `PersistedWorktreeSession` (`worktree.ts:756-768`), with fields including `originalCwd`, `worktreePath`, `worktreeName`, `worktreeBranch`, `originalBranch`, `originalHeadCommit`, `sessionId`, etc. — no taskId field. `saveWorktreeState()` (`sessionStorage.ts:2883-2920`) writes to session transcript with `type: 'worktree-state'`.
+
+Teaching version uses the task's `worktree` field for binding, a teaching simplification. CC treats worktree and task as two independent systems, connected through the Agent's context understanding.
+
+</details>
+
+<!-- translation-sync: zh@v1, en@v1, ja@v0 -->

s18_worktree_isolation/README.ja.md

@@ -0,0 +1,208 @@
+# s18: Worktree Isolation — それぞれのディレクトリ、互いに干渉しない
+
+[中文](README.md) · [English](README.en.md) · [日本語](README.ja.md)
+
+s01 → ... → s16 → s17 → `s18` → [s19](../s19_mcp_plugin/) → s20
+
+> *"それぞれのディレクトリ、互いに干渉しない"* — タスクは目標を管理、worktree はディレクトリを管理、ID で紐付け。
+>
+> **Harness 層**: 隔離 — 並列実行のディレクトリ分離。
+
+---
+
+## 課題
+
+s17 では、Alice も Bob も同じディレクトリで作業。Alice のタスクは「認証モジュールのリファクタリング」、Bob のタスクは「UI ログインページのリファクタリング」。
+
+Alice が `write_file("config.py", ...)` を呼び出し、Bob も `write_file("config.py", ...)` を呼び出す。両者が同じファイルを編集し、互いに上書き。クリーンなロールバックもできない——どの変更が誰のものか区別できない。
+
+s15-s17 は「誰が何をするか」（タスクシステム）と「どう通信するか」（メッセージバス）を解決したが、「どこで作業するか」は未解決。
+
+---
+
+## ソリューション
+
+![Worktree Overview](images/worktree-overview.ja.svg)
+
+Git worktree を使うと、同じリポジトリ内に複数の独立した作業ディレクトリを作成でき、それぞれが独自のブランチを持つ。Alice は `.worktrees/auth-refactor/` で作業、Bob は `.worktrees/ui-login/` で作業——互いに干渉しない。
+
+S17 の教学版 MessageBus、プロトコル、自治認領機構を踏襲。本章の追加：
+
+| 機能 | 目的 |
+|------|------|
+| create_worktree | タスク用の独立ディレクトリ + 独立ブランチを作成 |
+| bind_task_to_worktree | タスクとディレクトリを紐付け（状態は変更しない） |
+| remove_worktree / keep_worktree | 完了後のクリーンアップまたは保持 |
+| validate_worktree_name | パストラバーサルと不正文字を拒否 |
+
+---
+
+## 仕組み
+
+### 作成：タスク-Worktree 紐付け
+
+```python
+def create_worktree(name: str, task_id: str = "") -> str:
+    validate_worktree_name(name)       # [A-Za-z0-9._-]{1,64} のみ許可
+    path = WORKTREES_DIR / name
+    ok, result = run_git(["worktree", "add", str(path), "-b", f"wt/{name}", "HEAD"])
+    if not ok:
+        return f"Git error: {result}"
+    if task_id:
+        bind_task_to_worktree(task_id, name)
+    log_event("create", name, task_id)
+    return f"Worktree '{name}' created at {path}"
+
+def bind_task_to_worktree(task_id: str, worktree_name: str):
+    task = load_task(task_id)
+    task.worktree = worktree_name       # worktree フィールドのみ書き込み
+    save_task(task)                     # 状態は pending のまま、チームメイトの claim を待つ
+```
+
+紐付けルール：1 つのタスクに 1 つの worktree を紐付け。紐付けはタスクの状態を変更しない——タスクは `pending` のままで、チームメイトが認領した時に `in_progress` に進む。これにより Lead は事前にタスクと worktree を作成でき、チームメイトは idle 時に自然に worktree 紐付け済みタスクを認領する。
+
+### チームメイトツールの cwd 切り替え
+
+教学版は各チームメイトに `wt_ctx` 辞書を維持し、現在の worktree パスを追跡。チームメイトが worktree 紐付けタスクを認領すると、`wt_ctx` が自動的に worktree パスに設定され、チームメイトの `bash`、`read_file`、`write_file` は worktree ディレクトリで実行される：
+
+```python
+# チームメイトスレッド内部
+wt_ctx = {"path": None}
+
+def _run_claim_task(task_id):
+    result = claim_task(task_id, owner=name)
+    if "Claimed" in result:
+        task = load_task(task_id)
+        if task.worktree:
+            wt_ctx["path"] = str(WORKTREES_DIR / task.worktree)
+    return result
+
+def _run_bash(command):
+    return run_bash(command, cwd=wt_ctx["path"])  # worktree で実行
+```
+
+これは教学簡略化。真实 CC の EnterWorktree は `process.chdir()` でプロセス全体のディレクトリを切り替え、AgentTool isolation は `cwdOverride` でサブエージェント実行をラップする。
+
+### クリーンアップ：Keep または Remove
+
+タスク完了後、2 つの選択肢：
+
+```python
+def remove_worktree(name: str, discard_changes: bool = False) -> str:
+    # 安全チェック：変更がある場合デフォルトで拒否
+    if not discard_changes:
+        files, commits = _count_worktree_changes(path)
+        if files > 0 or commits > 0:
+            return "未コミットの変更あり。discard_changes=true で強制削除、または keep_worktree で保持"
+    ok, _ = run_git(["worktree", "remove", str(path), "--force"])
+    if not ok:
+        return "削除失敗"
+    run_git(["branch", "-D", f"wt/{name}"])
+    log_event("remove", name)
+
+def keep_worktree(name: str) -> str:
+    log_event("keep", name)
+    return f"Worktree '{name}' kept for review (branch: wt/{name})"
+```
+
+Keep = ブランチを保持し、手動 review 後にマージ。Remove = 未コミット変更がある場合デフォルトで拒否、`discard_changes=true` で確認が必要。タスクの自動 complete はしない——タスク完了はチームメイトの `complete_task` で明示的にトリガー。
+
+### イベントログ：監査可能
+
+各ライフサイクル操作はログに記録され、監査に利用：
+
+```python
+def log_event(event_type: str, worktree_name: str, task_id: str = ""):
+    event = {"type": event_type, "worktree": worktree_name,
+             "task_id": task_id, "ts": time.time()}
+    # .worktrees/events.jsonl に append
+```
+
+イベントタイプ：`create`、`remove`、`keep`。教学版はイベントを記録するだけで手動監査用。完全な復元には index または `git worktree list` スキャンが必要。
+
+### run_git：成功/失敗を返す
+
+```python
+def run_git(args: list[str]) -> tuple[bool, str]:
+    r = subprocess.run(["git"] + args, cwd=WORKDIR, ...)
+    return r.returncode == 0, output
+```
+
+`create_worktree` と `remove_worktree` は git コマンド成功後のみイベントログに書き込み、ログが実際の状態を反映することを保証。
+
+---
+
+## s17 からの変更
+
+| コンポーネント | 変更前 (s17) | 変更後 (s18) |
+|--------------|------------|------------|
+| 作業ディレクトリ | 全 Agent が WORKDIR を共有 | 各タスクが git worktree に紐付け可能 |
+| タスクデータ | id/subject/status/owner/blockedBy | + worktree フィールド |
+| チームメイトツール cwd | 常に WORKDIR | worktree 紐付けタスク認領時に自動切り替え |
+| 新規関数 | — | create_worktree, bind_task_to_worktree, remove_worktree, keep_worktree, validate_worktree_name |
+| worktree 安全性 | なし | name 検証 + 変更ありの場合削除拒否 |
+| イベントログ | なし | events.jsonl ライフサイクル監査 |
+| Lead ツール | 14 (s17) | + create_worktree, remove_worktree, keep_worktree (17) |
+| チームメイトツール | 8 (s17) | 8（bash/read/write が worktree cwd で実行） |
+
+---
+
+## 試してみる
+
+```sh
+cd learn-claude-code
+python s18_worktree_isolation/code.py
+```
+
+以下のプロンプトを試してください：
+
+`Create two tasks, then create worktrees for each (bind with task_id). Spawn alice and bob. Watch them auto-claim and work in isolated directories.`
+
+観察ポイント：2 つの worktree の `git status` 出力は異なるブランチを表示しているか？チームメイトが worktree 紐付けタスクを認領後、bash コマンドは worktree ディレクトリで実行されているか？`remove_worktree` は変更がある場合に拒否するか？紐付け後のタスク状態は `pending` のままか？
+
+---
+
+## 次の章
+
+Agent チームが隔離されたワークスペースで自己組織化できるようになった。しかし Agent の能力はツールに制限される——bash、read、write、task...
+
+もしユーザーが独自のツールを持っていたら？例えば社内 Jira API や独自デプロイシステム？
+
+s19 MCP Plugin → Agent にプラグインシステムを追加。外部ツールが標準プロトコルで接続、Agent は誰が書いたか知る必要がない。
+
+<details>
+<summary>CC ソースコード深掘り</summary>
+
+CC の worktree システムには 2 つのパスがある：**EnterWorktree**（現在のセッションが切り替え）と **AgentTool isolation**（サブエージェント隔離）。
+
+### EnterWorktree：現在のセッション切り替え
+
+`EnterWorktreeTool.ts:92-97` worktree 作成後、直ちに `process.chdir(worktreePath)`、`setCwd()`、`setOriginalCwd()`、`saveWorktreeState()` を呼び出し。現在のセッションの作業ディレクトリが直接 worktree に切り替わる——プロンプトのヒントではなく、プロセスレベルのディレクトリ変更。
+
+`ExitWorktreeTool.ts:261-320` keep/remove どちらも `restoreSessionToOriginalCwd()` で元のディレクトリに復元。Remove は未コミット変更をチェック（`ExitWorktreeTool.ts:190-220`）、`discard_changes: true` なしでは拒否。
+
+### AgentTool Isolation：サブエージェント隔離
+
+`AgentTool.tsx:590-641` `isolation: "worktree"` の場合、`createAgentWorktree()` を呼び出して worktree を作成し、`cwdOverridePath` でサブエージェント実行をラップ。サブエージェントの全操作が自動的に worktree ディレクトリで実行される。`AgentTool/prompt.ts:272` はモデルに伝える：これは一時的な worktree、変更なしで自動クリーンアップ、変更ありの場合はパスとブランチを返す。
+
+`worktree.ts:902-951` `createAgentWorktree()` はグローバル session cwd を変更せず、サブエージェント専用。`worktree.ts:961-1020` `removeAgentWorktree()` はメインリポジトリルートから削除。
+
+### name 検証
+
+`worktree.ts:76-84` slug を検証：`.`/`..` を拒否、`[a-zA-Z0-9._-]` を許可。`worktree.ts:48` で `VALID_WORKTREE_SLUG_SEGMENT` を定義。教学版の `validate_worktree_name` も同じルールを使用。
+
+### パスとブランチ命名
+
+実際のパスは `.claude/worktrees/`、ブランチ名は `worktree-{slug}`（`worktree.ts:204-227`、スラッシュは `+` に置換）。教学版は `.worktrees/` と `wt/{name}` で簡略化。
+
+作成時は `git worktree add -B`（`worktree.ts:326-328`）を使用し、現在の HEAD より `origin/<defaultBranch>` を優先。
+
+### 状態管理
+
+CC にはタスク-worktree 紐付けがない。Worktree 状態は `PersistedWorktreeSession`（`worktree.ts:756-768`）で管理、フィールドは `originalCwd`、`worktreePath`、`worktreeName`、`worktreeBranch`、`originalBranch`、`originalHeadCommit`、`sessionId` 等を含む——taskId フィールドはない。`saveWorktreeState()`（`sessionStorage.ts:2883-2920`）は `type: 'worktree-state'` で session transcript に書き込み。
+
+教学版はタスクの `worktree` フィールドで紐付けを行う教学簡略化。CC は worktree とタスクを 2 つの独立システムとして扱い、Agent のコンテキスト理解で関連付ける。
+
+</details>
+
+<!-- translation-sync: zh@v1, en@v1, ja@v1 -->

s18_worktree_isolation/README.md

@@ -0,0 +1,208 @@
+# s18: Worktree Isolation — 各干各的，互不干扰
+
+[中文](README.md) · [English](README.en.md) · [日本語](README.ja.md)
+
+s01 → ... → s16 → s17 → `s18` → [s19](../s19_mcp_plugin/) → s20
+
+> *"各干各的目录, 互不干扰"* — 任务管目标, worktree 管目录, 按 ID 绑定。
+>
+> **Harness 层**: 隔离 — 并行执行的目录隔离。
+
+---
+
+## 问题
+
+s17 中，Alice 和 Bob 都在同一个目录下工作。Alice 的任务是"重构认证模块"，Bob 的任务是"重构 UI 登录页"。
+
+Alice `write_file("config.py", ...)`。Bob 也 `write_file("config.py", ...)`。两个人改同一个文件，互相覆盖。而且无法干净地回滚——分不清哪些改动是谁的。
+
+s15-s17 解决了"谁干什么"（任务系统）和"怎么通信"（消息总线），但没解决"在哪干"。
+
+---
+
+## 解决方案
+
+![Worktree Overview](images/worktree-overview.svg)
+
+Git worktree 让你在同一仓库中创建多个独立的工作目录，每个有自己的分支。Alice 在 `.worktrees/auth-refactor/` 下工作，Bob 在 `.worktrees/ui-login/` 下工作——互不干扰。
+
+沿用 S17 的教学版 MessageBus、协议和自治认领机制。本章新增：
+
+| 能力 | 作用 |
+|------|------|
+| create_worktree | 为任务创建独立目录 + 独立分支 |
+| bind_task_to_worktree | 把任务和工作目录绑定（不改状态） |
+| remove_worktree / keep_worktree | 完成后清理或保留 |
+| validate_worktree_name | 拒绝路径穿越和非法字符 |
+
+---
+
+## 工作原理
+
+### 创建：任务-Worktree 绑定
+
+```python
+def create_worktree(name: str, task_id: str = "") -> str:
+    validate_worktree_name(name)       # 只允许 [A-Za-z0-9._-]{1,64}
+    path = WORKTREES_DIR / name
+    ok, result = run_git(["worktree", "add", str(path), "-b", f"wt/{name}", "HEAD"])
+    if not ok:
+        return f"Git error: {result}"
+    if task_id:
+        bind_task_to_worktree(task_id, name)
+    log_event("create", name, task_id)
+    return f"Worktree '{name}' created at {path}"
+
+def bind_task_to_worktree(task_id: str, worktree_name: str):
+    task = load_task(task_id)
+    task.worktree = worktree_name       # 只写 worktree 字段
+    save_task(task)                     # 状态保持 pending，等队友 claim
+```
+
+绑定规则：一个任务绑定一个 worktree。绑定不改任务状态——任务仍是 `pending`，队友自动认领时才推进到 `in_progress`。这样 Lead 可以提前创建任务和 worktree，队友 idle 时自然认领带 worktree 的任务。
+
+### 队友工具的 cwd 切换
+
+教学版给每个队友维护一个 `wt_ctx` 字典，记录当前 worktree 路径。队友认领带 worktree 的任务时，`wt_ctx` 自动设置为 worktree 路径；队友的 `bash`、`read_file`、`write_file` 在 worktree 目录下执行：
+
+```python
+# 队友线程内部
+wt_ctx = {"path": None}
+
+def _run_claim_task(task_id):
+    result = claim_task(task_id, owner=name)
+    if "Claimed" in result:
+        task = load_task(task_id)
+        if task.worktree:
+            wt_ctx["path"] = str(WORKTREES_DIR / task.worktree)
+    return result
+
+def _run_bash(command):
+    return run_bash(command, cwd=wt_ctx["path"])  # 在 worktree 下执行
+```
+
+这是教学简化。真实 CC 的 EnterWorktree 用 `process.chdir()` 切换整个进程目录，AgentTool isolation 用 `cwdOverride` 包住子 agent 执行。
+
+### 收尾：Keep 还是 Remove
+
+任务完成后，两个选择：
+
+```python
+def remove_worktree(name: str, discard_changes: bool = False) -> str:
+    # 安全检查：有改动时默认拒绝
+    if not discard_changes:
+        files, commits = _count_worktree_changes(path)
+        if files > 0 or commits > 0:
+            return "有未提交改动，使用 discard_changes=true 强制删除，或 keep_worktree 保留"
+    ok, _ = run_git(["worktree", "remove", str(path), "--force"])
+    if not ok:
+        return "删除失败"
+    run_git(["branch", "-D", f"wt/{name}"])
+    log_event("remove", name)
+
+def keep_worktree(name: str) -> str:
+    log_event("keep", name)
+    return f"Worktree '{name}' kept for review (branch: wt/{name})"
+```
+
+Keep = 留着分支，等人工 review 后合并到主分支。Remove = 有改动时默认拒绝，需要 `discard_changes=true` 确认。不自动 complete task——任务完成由队友的 `complete_task` 显式触发。
+
+### 事件流：可审计
+
+每次生命周期操作写入日志，方便排查：
+
+```python
+def log_event(event_type: str, worktree_name: str, task_id: str = ""):
+    event = {"type": event_type, "worktree": worktree_name,
+             "task_id": task_id, "ts": time.time()}
+    # append to .worktrees/events.jsonl
+```
+
+事件类型：`create`（创建）、`remove`（删除）、`keep`（保留）。教学版只记录事件用于人工排查；完整恢复还需要 index 或 `git worktree list` 扫描。
+
+### run_git：返回成功/失败
+
+```python
+def run_git(args: list[str]) -> tuple[bool, str]:
+    r = subprocess.run(["git"] + args, cwd=WORKDIR, ...)
+    return r.returncode == 0, output
+```
+
+`create_worktree` 和 `remove_worktree` 只在 git 命令成功后才写事件日志，保证日志反映真实状态。
+
+---
+
+## 相对 s17 的变更
+
+| 组件 | 之前 (s17) | 之后 (s18) |
+|------|-----------|-----------|
+| 工作目录 | 所有 Agent 共享 WORKDIR | 每个任务可绑定独立 git worktree |
+| Task 数据 | id/subject/status/owner/blockedBy | + worktree 字段 |
+| 队友工具 cwd | 始终 WORKDIR | 认领带 worktree 的任务时自动切换 |
+| 新函数 | — | create_worktree, bind_task_to_worktree, remove_worktree, keep_worktree, validate_worktree_name |
+| worktree 安全 | 无 | name 校验 + 有改动时拒绝删除 |
+| 事件日志 | 无 | events.jsonl 生命周期审计 |
+| Lead 工具 | 14 (s17) | + create_worktree, remove_worktree, keep_worktree (17) |
+| 队友工具 | 8 (s17) | 8（bash/read/write 在 worktree cwd 执行） |
+
+---
+
+## 试一下
+
+```sh
+cd learn-claude-code
+python s18_worktree_isolation/code.py
+```
+
+试试这个 prompt：
+
+`Create two tasks, then create worktrees for each (bind with task_id). Spawn alice and bob. Watch them auto-claim and work in isolated directories.`
+
+观察重点：两个 worktree 的 `git status` 输出是否显示不同的分支？队友认领带 worktree 的任务后，bash 命令是否在 worktree 目录下执行？`remove_worktree` 对有改动的 worktree 是否拒绝？`.tasks/` 中的任务在绑定后状态是否仍为 `pending`？
+
+---
+
+## 接下来
+
+Agent 团队能在隔离的工作空间中自组织了。但 Agent 的能力受限于我们给它写的工具——bash、read、write、task...
+
+如果用户已经有了自己的工具怎么办？比如一个公司内部的 Jira API、一个自建的部署系统？
+
+s19 MCP Plugin → 给 Agent 装一个插件系统。外部工具通过标准协议接入，Agent 不需要知道它们是谁写的。
+
+<details>
+<summary>深入 CC 源码</summary>
+
+CC 的 worktree 系统有两条路径：**EnterWorktree**（当前会话切入）和 **AgentTool isolation**（子 agent 隔离）。
+
+### EnterWorktree：当前会话切换
+
+`EnterWorktreeTool.ts:92-97` 创建 worktree 后立即 `process.chdir(worktreePath)`、`setCwd()`、`setOriginalCwd()`、`saveWorktreeState()`。当前会话的工作目录直接切换到 worktree——不是 prompt 提醒，而是进程级目录变更。
+
+`ExitWorktreeTool.ts:261-320` 的 keep/remove 都会 `restoreSessionToOriginalCwd()` 恢复原目录。Remove 时检查未提交改动（`ExitWorktreeTool.ts:190-220`），没有 `discard_changes: true` 就拒绝删除。
+
+### AgentTool isolation：子 agent 隔离
+
+`AgentTool.tsx:590-641` 在 `isolation: "worktree"` 时调用 `createAgentWorktree()` 创建 worktree，用 `cwdOverridePath` 包住子 agent 执行。子 agent 的所有操作自动在 worktree 目录下进行。`AgentTool/prompt.ts:272` 告诉模型：这是临时 worktree，无改动自动清理，有改动返回路径和分支。
+
+`worktree.ts:902-951` 的 `createAgentWorktree()` 不修改全局 session cwd，只给子 agent 用。`worktree.ts:961-1020` 的 `removeAgentWorktree()` 从主 repo root 删除。
+
+### name 校验
+
+`worktree.ts:76-84` 校验 slug：拒绝 `.`/`..`，允许 `[a-zA-Z0-9._-]`。`worktree.ts:48` 定义 `VALID_WORKTREE_SLUG_SEGMENT`。教学版的 `validate_worktree_name` 用同样的规则。
+
+### 路径和分支命名
+
+真实路径是 `.claude/worktrees/`，分支名 `worktree-{slug}`（`worktree.ts:204-227`，斜杠用 `+` 替代）。教学版用 `.worktrees/` 和 `wt/{name}` 简化。
+
+创建时用 `git worktree add -B`（`worktree.ts:326-328`），优先基于 `origin/<defaultBranch>` 而非当前 HEAD。
+
+### 状态管理
+
+CC 没有 task-worktree 绑定。Worktree 状态通过 `PersistedWorktreeSession`（`worktree.ts:756-768`）管理，字段包括 `originalCwd`、`worktreePath`、`worktreeName`、`worktreeBranch`、`originalBranch`、`originalHeadCommit`、`sessionId` 等——没有 taskId。`saveWorktreeState()`（`sessionStorage.ts:2883-2920`）以 `type: 'worktree-state'` 写入 session transcript。
+
+教学版用 task 的 `worktree` 字段做绑定，是教学简化。CC 把 worktree 和 task 作为两个独立系统，通过 Agent 理解上下文来关联。
+
+</details>
+
+<!-- translation-sync: zh@v1, en@v0, ja@v0 -->

s18_worktree_isolation/code.py

@@ -0,0 +1,996 @@
+#!/usr/bin/env python3
+"""
+s18: Worktree Isolation — git worktree + task-directory binding + event log.
+
+Run:  python s18_worktree_isolation/code.py
+Need: pip install anthropic python-dotenv + .env with ANTHROPIC_API_KEY
+
+Changes from s17:
+  - Task dataclass gains worktree field (str | None)
+  - validate_worktree_name: reject path traversal and illegal chars
+  - create_worktree: validate name, git worktree add, optional task binding
+  - bind_task_to_worktree: write worktree field only, keep task pending
+  - remove_worktree: safety check before force, no auto-complete
+  - run_git returns (ok, output), events only on success
+  - Teammate tools: + complete_task, run in worktree cwd when bound
+  - scan_unclaimed_tasks: uses can_start() for dependency checking
+  - idle_poll: checks claim result, dispatches shutdown in IDLE
+  - consume_lead_inbox: unified inbox consumer
+  - 3 new Lead tools: create_worktree, remove_worktree, keep_worktree
+
+ASCII topology:
+  Main repo (/)
+    ├── .worktrees/auth/  (branch: wt/auth)  ← Task #1
+    ├── .worktrees/ui/    (branch: wt/ui)     ← Task #2
+    ├── .tasks/task_xxx.json (worktree: "auth")
+    └── .worktrees/events.jsonl
+"""
+
+import os, subprocess, json, time, random, threading, re
+from pathlib import Path
+from datetime import datetime
+from dataclasses import dataclass, asdict, field
+
+try:
+    import readline
+    readline.parse_and_bind('set bind-tty-special-chars off')
+except ImportError:
+    pass
+
+from anthropic import Anthropic
+from dotenv import load_dotenv
+
+load_dotenv(override=True)
+if os.getenv("ANTHROPIC_BASE_URL"):
+    os.environ.pop("ANTHROPIC_AUTH_TOKEN", None)
+
+WORKDIR = Path.cwd()
+client = Anthropic(base_url=os.getenv("ANTHROPIC_BASE_URL"))
+MODEL = os.environ["MODEL_ID"]
+
+# ── Task System (from s12 + s18 worktree field) ──
+
+TASKS_DIR = WORKDIR / ".tasks"
+TASKS_DIR.mkdir(exist_ok=True)
+
+
+@dataclass
+class Task:
+    id: str
+    subject: str
+    description: str
+    status: str
+    owner: str | None
+    blockedBy: list[str]
+    worktree: str | None = None      # s18: bound worktree name
+
+
+def _task_path(task_id: str) -> Path:
+    return TASKS_DIR / f"{task_id}.json"
+
+
+def create_task(subject: str, description: str = "",
+                blockedBy: list[str] | None = None) -> Task:
+    task = Task(
+        id=f"task_{int(time.time())}_{random.randint(0, 9999):04d}",
+        subject=subject, description=description,
+        status="pending", owner=None,
+        blockedBy=blockedBy or [],
+    )
+    save_task(task)
+    return task
+
+
+def save_task(task: Task):
+    _task_path(task.id).write_text(json.dumps(asdict(task), indent=2))
+
+
+def load_task(task_id: str) -> Task:
+    return Task(**json.loads(_task_path(task_id).read_text()))
+
+
+def list_tasks() -> list[Task]:
+    return [Task(**json.loads(p.read_text()))
+            for p in sorted(TASKS_DIR.glob("task_*.json"))]
+
+
+def get_task_json(task_id: str) -> str:
+    task = load_task(task_id)
+    return json.dumps(asdict(task), indent=2)
+
+
+def can_start(task_id: str) -> bool:
+    task = load_task(task_id)
+    for dep_id in task.blockedBy:
+        if not _task_path(dep_id).exists():
+            return False
+        if load_task(dep_id).status != "completed":
+            return False
+    return True
+
+
+def claim_task(task_id: str, owner: str = "agent") -> str:
+    task = load_task(task_id)
+    if task.status != "pending":
+        return f"Task {task_id} is {task.status}, cannot claim"
+    if task.owner:
+        return f"Task {task_id} already owned by {task.owner}"
+    if not can_start(task_id):
+        deps = [d for d in task.blockedBy
+                if _task_path(d).exists() and load_task(d).status != "completed"]
+        missing = [d for d in task.blockedBy if not _task_path(d).exists()]
+        parts = []
+        if deps: parts.append(f"blocked by: {deps}")
+        if missing: parts.append(f"missing deps: {missing}")
+        return "Cannot start — " + ", ".join(parts)
+    task.owner = owner
+    task.status = "in_progress"
+    save_task(task)
+    print(f"  \033[36m[claim] {task.subject} → in_progress\033[0m")
+    return f"Claimed {task.id} ({task.subject})"
+
+
+def complete_task(task_id: str) -> str:
+    task = load_task(task_id)
+    if task.status != "in_progress":
+        return f"Task {task_id} is {task.status}, cannot complete"
+    task.status = "completed"
+    save_task(task)
+    unblocked = [t.subject for t in list_tasks()
+                 if t.status == "pending" and t.blockedBy and can_start(t.id)]
+    print(f"  \033[32m[complete] {task.subject} ✓\033[0m")
+    msg = f"Completed {task.id} ({task.subject})"
+    if unblocked:
+        msg += f"\nUnblocked: {', '.join(unblocked)}"
+    return msg
+
+
+# ── Worktree System (s18 new) ──
+
+WORKTREES_DIR = WORKDIR / ".worktrees"
+WORKTREES_DIR.mkdir(exist_ok=True)
+
+VALID_WT_NAME = re.compile(r'^[A-Za-z0-9._-]{1,64}$')
+
+
+def validate_worktree_name(name: str) -> str | None:
+    """Return error message if invalid, None if valid."""
+    if not name:
+        return "Worktree name cannot be empty"
+    if name == "." or name == "..":
+        return f"'{name}' is not a valid worktree name"
+    if not VALID_WT_NAME.match(name):
+        return (f"Invalid worktree name '{name}': "
+                "only letters, digits, dots, underscores, dashes (1-64 chars)")
+    return None
+
+
+def run_git(args: list[str]) -> tuple[bool, str]:
+    """Run git command. Return (ok, output)."""
+    try:
+        r = subprocess.run(["git"] + args, cwd=WORKDIR,
+                           capture_output=True, text=True, timeout=30)
+        out = (r.stdout + r.stderr).strip()
+        out = out[:5000] if out else "(no output)"
+        return r.returncode == 0, out
+    except subprocess.TimeoutExpired:
+        return False, "Error: git timeout"
+
+
+def log_event(event_type: str, worktree_name: str, task_id: str = ""):
+    """Append a lifecycle event to events.jsonl."""
+    event = {"type": event_type, "worktree": worktree_name,
+             "task_id": task_id, "ts": time.time()}
+    events_file = WORKTREES_DIR / "events.jsonl"
+    with open(events_file, "a") as f:
+        f.write(json.dumps(event) + "\n")
+
+
+def create_worktree(name: str, task_id: str = "") -> str:
+    """Create a git worktree with a dedicated branch. Optionally bind to a task."""
+    err = validate_worktree_name(name)
+    if err:
+        return f"Error: {err}"
+    path = WORKTREES_DIR / name
+    if path.exists():
+        return f"Worktree '{name}' already exists at {path}"
+    ok, result = run_git(["worktree", "add", str(path), "-b", f"wt/{name}", "HEAD"])
+    if not ok:
+        return f"Git error: {result}"
+    if task_id:
+        bind_task_to_worktree(task_id, name)
+    log_event("create", name, task_id)
+    print(f"  \033[33m[worktree] created: {name} at {path}\033[0m")
+    return f"Worktree '{name}' created at {path}"
+
+
+def bind_task_to_worktree(task_id: str, worktree_name: str):
+    """Write worktree field to task. Keep status as pending for auto-claim."""
+    task = load_task(task_id)
+    task.worktree = worktree_name
+    save_task(task)
+    print(f"  \033[33m[bind] {task.subject} → worktree:{worktree_name}\033[0m")
+
+
+def _count_worktree_changes(path: Path) -> tuple[int, int]:
+    """Count uncommitted files and commits in a worktree."""
+    try:
+        r1 = subprocess.run(["git", "status", "--porcelain"],
+                            cwd=path, capture_output=True, text=True, timeout=10)
+        files = len([l for l in r1.stdout.strip().splitlines() if l.strip()])
+        r2 = subprocess.run(["git", "log", "@{push}..HEAD", "--oneline"],
+                            cwd=path, capture_output=True, text=True, timeout=10)
+        commits = len([l for l in r2.stdout.strip().splitlines() if l.strip()])
+        return files, commits
+    except Exception:
+        return -1, -1
+
+
+def remove_worktree(name: str, discard_changes: bool = False) -> str:
+    """Remove worktree. Refuses if uncommitted changes unless discard_changes."""
+    err = validate_worktree_name(name)
+    if err:
+        return err
+    path = WORKTREES_DIR / name
+    if not path.exists():
+        return f"Worktree '{name}' not found"
+    if not discard_changes:
+        files, commits = _count_worktree_changes(path)
+        if files < 0:
+            return (f"Cannot verify worktree '{name}' status. "
+                    "Use discard_changes=true to force removal.")
+        if files > 0 or commits > 0:
+            return (f"Worktree '{name}' has {files} uncommitted file(s) "
+                    f"and {commits} unpushed commit(s). "
+                    "Use discard_changes=true to force removal, "
+                    "or keep_worktree to preserve for review.")
+    ok1, _ = run_git(["worktree", "remove", str(path), "--force"])
+    if not ok1:
+        return f"Failed to remove worktree directory for '{name}'"
+    run_git(["branch", "-D", f"wt/{name}"])
+    log_event("remove", name)
+    print(f"  \033[33m[worktree] removed: {name}\033[0m")
+    return f"Worktree '{name}' removed"
+
+
+def keep_worktree(name: str) -> str:
+    """Keep worktree for manual review. Branch preserved."""
+    err = validate_worktree_name(name)
+    if err:
+        return err
+    log_event("keep", name)
+    print(f"  \033[36m[worktree] kept: {name}\033[0m")
+    return f"Worktree '{name}' kept for review (branch: wt/{name})"
+
+
+# ── Prompt Assembly (from s10) ──
+
+PROMPT_SECTIONS = {
+    "identity": "You are a coding agent. Act, don't explain.",
+    "tools": "Available tools: bash, read_file, write_file, "
+             "create_task, list_tasks, get_task, claim_task, complete_task, "
+             "spawn_teammate, send_message, check_inbox, "
+             "request_shutdown, request_plan, review_plan, "
+             "create_worktree, remove_worktree, keep_worktree.",
+    "workspace": f"Working directory: {WORKDIR}",
+    "memory": "Relevant memories are injected below when available.",
+}
+
+
+def assemble_system_prompt(context: dict) -> str:
+    sections = [PROMPT_SECTIONS["identity"],
+                PROMPT_SECTIONS["tools"],
+                PROMPT_SECTIONS["workspace"]]
+    if context.get("memories"):
+        sections.append(f"Relevant memories:\n{context['memories']}")
+    return "\n\n".join(sections)
+
+
+_last_context_hash, _last_prompt = None, None
+
+
+def get_system_prompt(context: dict) -> str:
+    global _last_context_hash, _last_prompt
+    h = json.dumps(context, sort_keys=True)
+    if h == _last_context_hash and _last_prompt:
+        return _last_prompt
+    _last_context_hash, _last_prompt = h, assemble_system_prompt(context)
+    return _last_prompt
+
+
+# ── Basic Tools ──
+
+def safe_path(p: str, cwd: Path = None) -> Path:
+    base = cwd or WORKDIR
+    path = (base / p).resolve()
+    if not path.is_relative_to(base):
+        raise ValueError(f"Path escapes workspace: {p}")
+    return path
+
+
+def run_bash(command: str, cwd: Path = None) -> str:
+    try:
+        r = subprocess.run(command, shell=True, cwd=cwd or WORKDIR,
+                           capture_output=True, text=True, timeout=120)
+        out = (r.stdout + r.stderr).strip()
+        return out[:50000] if out else "(no output)"
+    except subprocess.TimeoutExpired:
+        return "Error: Timeout (120s)"
+
+
+def run_read(path: str, limit: int | None = None, cwd: Path = None) -> str:
+    try:
+        lines = safe_path(path, cwd).read_text().splitlines()
+        if limit and limit < len(lines):
+            lines = lines[:limit] + [f"... ({len(lines) - limit} more lines)"]
+        return "\n".join(lines)
+    except Exception as e:
+        return f"Error: {e}"
+
+
+def run_write(path: str, content: str, cwd: Path = None) -> str:
+    try:
+        fp = safe_path(path, cwd)
+        fp.parent.mkdir(parents=True, exist_ok=True)
+        fp.write_text(content)
+        return f"Wrote {len(content)} bytes to {path}"
+    except Exception as e:
+        return f"Error: {e}"
+
+
+# ── MessageBus (from s15) ──
+
+MAILBOX_DIR = WORKDIR / ".mailboxes"
+MAILBOX_DIR.mkdir(exist_ok=True)
+
+
+class MessageBus:
+    def send(self, from_agent: str, to_agent: str, content: str,
+             msg_type: str = "message", metadata: dict = None):
+        msg = {"from": from_agent, "to": to_agent,
+               "content": content, "type": msg_type,
+               "ts": time.time(), "metadata": metadata or {}}
+        inbox = MAILBOX_DIR / f"{to_agent}.jsonl"
+        with open(inbox, "a") as f:
+            f.write(json.dumps(msg) + "\n")
+        print(f"  \033[33m[bus] {from_agent} → {to_agent}: "
+              f"({msg_type}) {content[:50]}\033[0m")
+
+    def read_inbox(self, agent: str) -> list[dict]:
+        inbox = MAILBOX_DIR / f"{agent}.jsonl"
+        if not inbox.exists():
+            return []
+        msgs = [json.loads(line) for line in inbox.read_text().splitlines()
+                if line.strip()]
+        inbox.unlink()
+        return msgs
+
+
+BUS = MessageBus()
+active_teammates: dict[str, bool] = {}
+
+# ── Protocol State (from s16) ──
+
+@dataclass
+class ProtocolState:
+    request_id: str
+    type: str
+    sender: str
+    target: str
+    status: str
+    payload: str
+    created_at: float = field(default_factory=time.time)
+
+
+pending_requests: dict[str, ProtocolState] = {}
+
+
+def new_request_id() -> str:
+    return f"req_{random.randint(0, 999999):06d}"
+
+
+def match_response(response_type: str, request_id: str, approve: bool):
+    state = pending_requests.get(request_id)
+    if not state:
+        print(f"  \033[31m[protocol] unknown request_id: {request_id}\033[0m")
+        return
+    if state.type == "shutdown" and response_type != "shutdown_response":
+        print(f"  \033[31m[protocol] type mismatch: expected shutdown_response, "
+              f"got {response_type}\033[0m")
+        return
+    if state.type == "plan_approval" and response_type != "plan_approval_response":
+        print(f"  \033[31m[protocol] type mismatch: expected plan_approval_response, "
+              f"got {response_type}\033[0m")
+        return
+    state.status = "approved" if approve else "rejected"
+    icon = "✓" if approve else "✗"
+    color = "32" if approve else "31"
+    print(f"  \033[{color}m[protocol] {state.type} {icon} "
+          f"({request_id}: {state.status})\033[0m")
+
+
+def consume_lead_inbox(route_protocol=True) -> list[dict]:
+    msgs = BUS.read_inbox("lead")
+    if route_protocol:
+        for msg in msgs:
+            meta = msg.get("metadata", {})
+            req_id = meta.get("request_id", "")
+            msg_type = msg.get("type", "")
+            if req_id and msg_type.endswith("_response"):
+                match_response(msg_type, req_id, meta.get("approve", False))
+    return msgs
+
+
+# ── Autonomous Agent (from s17, + worktree cwd) ──
+
+IDLE_POLL_INTERVAL = 5
+IDLE_TIMEOUT = 60
+
+
+def scan_unclaimed_tasks() -> list[dict]:
+    """Find pending, unowned tasks with all dependencies completed."""
+    unclaimed = []
+    for f in sorted(TASKS_DIR.glob("task_*.json")):
+        task = json.loads(f.read_text())
+        if (task.get("status") == "pending"
+                and not task.get("owner")
+                and can_start(task["id"])):
+            unclaimed.append(task)
+    return unclaimed
+
+
+def idle_poll(agent_name: str, messages: list,
+              name: str, role: str) -> str:
+    """Poll for 60s. Return 'work', 'shutdown', or 'timeout'."""
+    for _ in range(IDLE_TIMEOUT // IDLE_POLL_INTERVAL):
+        time.sleep(IDLE_POLL_INTERVAL)
+
+        inbox = BUS.read_inbox(agent_name)
+        if inbox:
+            for msg in inbox:
+                if msg.get("type") == "shutdown_request":
+                    req_id = msg.get("metadata", {}).get("request_id", "")
+                    BUS.send(name, "lead", "Shutting down gracefully.",
+                             "shutdown_response",
+                             {"request_id": req_id, "approve": True})
+                    print(f"  \033[35m[protocol] {name} approved shutdown "
+                          f"in idle ({req_id})\033[0m")
+                    return "shutdown"
+
+            messages.append({"role": "user",
+                "content": "<inbox>" + json.dumps(inbox) + "</inbox>"})
+            print(f"  \033[36m[idle] {name} found inbox messages\033[0m")
+            return "work"
+
+        unclaimed = scan_unclaimed_tasks()
+        if unclaimed:
+            task_data = unclaimed[0]
+            result = claim_task(task_data["id"], agent_name)
+            if "Claimed" in result:
+                wt_info = ""
+                if task_data.get("worktree"):
+                    wt_path = WORKTREES_DIR / task_data["worktree"]
+                    wt_info = f"\nWork directory: {wt_path}"
+                messages.append({"role": "user",
+                    "content": f"<auto-claimed>Task {task_data['id']}: "
+                               f"{task_data['subject']}{wt_info}</auto-claimed>"})
+                print(f"  \033[32m[idle] {name} auto-claimed: "
+                      f"{task_data['subject']}\033[0m")
+                return "work"
+            print(f"  \033[33m[idle] {name} claim failed: "
+                  f"{result}\033[0m")
+
+    print(f"  \033[31m[idle] {name} timeout ({IDLE_TIMEOUT}s)\033[0m")
+    return "timeout"
+
+
+# ── Teammate Thread (from s15 + s16 + s17 + s18) ──
+
+def spawn_teammate_thread(name: str, role: str, prompt: str) -> str:
+    if name in active_teammates:
+        return f"Teammate '{name}' already exists"
+
+    system = (f"You are '{name}', a {role}. "
+              f"Use tools to complete tasks. "
+              f"You can list and claim tasks from the board. "
+              f"If a task has a worktree, work in that directory.")
+
+    def handle_inbox_message(name: str, msg: dict, messages: list):
+        msg_type = msg.get("type", "message")
+        meta = msg.get("metadata", {})
+        req_id = meta.get("request_id", "")
+
+        if msg_type == "shutdown_request":
+            BUS.send(name, "lead", "Shutting down gracefully.",
+                     "shutdown_response",
+                     {"request_id": req_id, "approve": True})
+            print(f"  \033[35m[protocol] {name} approved shutdown "
+                  f"({req_id})\033[0m")
+            return True
+
+        if msg_type == "plan_approval_response":
+            approve = meta.get("approve", False)
+            if approve:
+                messages.append({"role": "user",
+                    "content": "[Plan approved] Proceed with the task."})
+            else:
+                messages.append({"role": "user",
+                    "content": f"[Plan rejected] Feedback: {msg['content']}"})
+        return False
+
+    def run():
+        # Track current worktree for this teammate's cwd
+        wt_ctx = {"path": None}
+
+        def _wt_cwd() -> Path | None:
+            p = wt_ctx["path"]
+            return Path(p) if p else None
+
+        def _run_bash(command: str) -> str:
+            return run_bash(command, cwd=_wt_cwd())
+
+        def _run_read(path: str) -> str:
+            return run_read(path, cwd=_wt_cwd())
+
+        def _run_write(path: str, content: str) -> str:
+            return run_write(path, content, cwd=_wt_cwd())
+
+        def _run_list_tasks():
+            tasks = list_tasks()
+            if not tasks:
+                return "No tasks."
+            return "\n".join(
+                f"  {t.id}: {t.subject} [{t.status}]"
+                + (f" (wt:{t.worktree})" if t.worktree else "")
+                for t in tasks)
+
+        def _run_claim_task(task_id: str):
+            result = claim_task(task_id, owner=name)
+            if "Claimed" in result:
+                # Set worktree cwd if task has one
+                task = load_task(task_id)
+                if task.worktree:
+                    wt_ctx["path"] = str(WORKTREES_DIR / task.worktree)
+                else:
+                    wt_ctx["path"] = None
+            return result
+
+        def _run_complete_task(task_id: str):
+            result = complete_task(task_id)
+            wt_ctx["path"] = None
+            return result
+
+        messages = [{"role": "user", "content": prompt}]
+        sub_tools = [
+            {"name": "bash", "description": "Run a shell command.",
+             "input_schema": {"type": "object",
+                              "properties": {"command": {"type": "string"}},
+                              "required": ["command"]}},
+            {"name": "read_file", "description": "Read file.",
+             "input_schema": {"type": "object",
+                              "properties": {"path": {"type": "string"}},
+                              "required": ["path"]}},
+            {"name": "write_file", "description": "Write file.",
+             "input_schema": {"type": "object",
+                              "properties": {"path": {"type": "string"},
+                                             "content": {"type": "string"}},
+                              "required": ["path", "content"]}},
+            {"name": "send_message",
+             "description": "Send message to another agent.",
+             "input_schema": {"type": "object",
+                              "properties": {"to": {"type": "string"},
+                                             "content": {"type": "string"}},
+                              "required": ["to", "content"]}},
+            {"name": "submit_plan",
+             "description": "Submit a plan for Lead approval.",
+             "input_schema": {"type": "object",
+                              "properties": {"plan": {"type": "string"}},
+                              "required": ["plan"]}},
+            {"name": "list_tasks",
+             "description": "List all tasks on the board.",
+             "input_schema": {"type": "object", "properties": {},
+                              "required": []}},
+            {"name": "claim_task",
+             "description": "Claim a pending task.",
+             "input_schema": {"type": "object",
+                              "properties": {"task_id": {"type": "string"}},
+                              "required": ["task_id"]}},
+            {"name": "complete_task",
+             "description": "Mark an in-progress task as completed.",
+             "input_schema": {"type": "object",
+                              "properties": {"task_id": {"type": "string"}},
+                              "required": ["task_id"]}},
+        ]
+
+        sub_handlers = {
+            "bash": _run_bash, "read_file": _run_read,
+            "write_file": _run_write,
+            "send_message": lambda to, content: (BUS.send(name, to, content),
+                                                  "Sent")[1],
+            "submit_plan": lambda plan: _teammate_submit_plan(name, plan),
+            "list_tasks": _run_list_tasks,
+            "claim_task": _run_claim_task,
+            "complete_task": _run_complete_task,
+        }
+
+        # Outer loop: WORK → IDLE cycle
+        while True:
+            if len(messages) <= 3:
+                messages.insert(0, {"role": "user",
+                    "content": f"<identity>You are '{name}', role: {role}. "
+                               f"Continue your work.</identity>"})
+
+            # WORK phase
+            should_shutdown = False
+            for _ in range(10):
+                inbox = BUS.read_inbox(name)
+                for msg in inbox:
+                    stopped = handle_inbox_message(name, msg, messages)
+                    if stopped:
+                        should_shutdown = True
+                        break
+                if should_shutdown:
+                    break
+                if inbox and not should_shutdown:
+                    non_protocol = [m for m in inbox
+                                    if m.get("type") == "message"]
+                    if non_protocol:
+                        messages.append({"role": "user",
+                            "content": "<inbox>" + json.dumps(non_protocol) + "</inbox>"})
+
+                try:
+                    response = client.messages.create(
+                        model=MODEL, system=system, messages=messages[-20:],
+                        tools=sub_tools, max_tokens=8000)
+                except Exception:
+                    break
+                messages.append({"role": "assistant", "content": response.content})
+                if response.stop_reason != "tool_use":
+                    break
+                results = []
+                for block in response.content:
+                    if block.type == "tool_use":
+                        handler = sub_handlers.get(block.name)
+                        output = handler(**block.input) if handler else "Unknown"
+                        results.append({"type": "tool_result",
+                                        "tool_use_id": block.id,
+                                        "content": str(output)})
+                messages.append({"role": "user", "content": results})
+
+            if should_shutdown:
+                break
+
+            # IDLE phase
+            idle_result = idle_poll(name, messages, name, role)
+            if idle_result == "shutdown":
+                break
+            if idle_result == "timeout":
+                break
+
+        # Summary
+        summary = "Done."
+        for msg in reversed(messages):
+            if msg["role"] == "assistant" and isinstance(msg["content"], list):
+                for b in msg["content"]:
+                    if getattr(b, "type", None) == "text":
+                        summary = b.text
+                        break
+                else:
+                    continue
+                break
+        BUS.send(name, "lead", summary, "result")
+        active_teammates.pop(name, None)
+        print(f"  \033[32m[teammate] {name} finished\033[0m")
+
+    active_teammates[name] = True
+    threading.Thread(target=run, daemon=True).start()
+    print(f"  \033[36m[teammate] {name} spawned as {role}\033[0m")
+    return f"Teammate '{name}' spawned as {role} (autonomous)"
+
+
+def _teammate_submit_plan(from_name: str, plan: str) -> str:
+    req_id = new_request_id()
+    pending_requests[req_id] = ProtocolState(
+        request_id=req_id, type="plan_approval",
+        sender=from_name, target="lead",
+        status="pending", payload=plan)
+    BUS.send(from_name, "lead", plan,
+             "plan_approval_request",
+             {"request_id": req_id})
+    return f"Plan submitted ({req_id}). Waiting for approval..."
+
+
+# ── Lead Protocol Tools (from s16) ──
+
+def run_request_shutdown(teammate: str) -> str:
+    req_id = new_request_id()
+    pending_requests[req_id] = ProtocolState(
+        request_id=req_id, type="shutdown",
+        sender="lead", target=teammate,
+        status="pending", payload="")
+    BUS.send("lead", teammate, "Please shut down gracefully.",
+             "shutdown_request",
+             {"request_id": req_id})
+    print(f"  \033[35m[protocol] shutdown_request → {teammate} "
+          f"({req_id})\033[0m")
+    return f"Shutdown request sent to {teammate} (req: {req_id})"
+
+
+def run_request_plan(teammate: str, task: str) -> str:
+    BUS.send("lead", teammate, f"Please submit a plan for: {task}",
+             "message")
+    return f"Asked {teammate} to submit a plan"
+
+
+def run_review_plan(request_id: str, approve: bool,
+                    feedback: str = "") -> str:
+    state = pending_requests.get(request_id)
+    if not state:
+        return f"Request {request_id} not found"
+    if state.status != "pending":
+        return f"Request {request_id} already {state.status}"
+    state.status = "approved" if approve else "rejected"
+    BUS.send("lead", state.sender,
+             feedback or ("Approved" if approve else "Rejected"),
+             "plan_approval_response",
+             {"request_id": request_id, "approve": approve})
+    icon = "✓" if approve else "✗"
+    print(f"  \033[32m[protocol] plan {icon} ({request_id})\033[0m")
+    return f"Plan {'approved' if approve else 'rejected'} ({request_id})"
+
+
+# ── Lead Worktree Tools (s18 new) ──
+
+def run_create_worktree(name: str, task_id: str = "") -> str:
+    return create_worktree(name, task_id)
+
+
+def run_remove_worktree(name: str, discard_changes: bool = False) -> str:
+    return remove_worktree(name, discard_changes)
+
+
+def run_keep_worktree(name: str) -> str:
+    return keep_worktree(name)
+
+
+# ── Basic tool handlers ──
+
+def run_create_task(subject: str, description: str = "",
+                    blockedBy: list[str] | None = None) -> str:
+    task = create_task(subject, description, blockedBy)
+    deps = f" (blockedBy: {', '.join(blockedBy)})" if blockedBy else ""
+    print(f"  \033[34m[create] {task.subject}{deps}\033[0m")
+    return f"Created {task.id}: {task.subject}{deps}"
+
+
+def run_list_tasks() -> str:
+    tasks = list_tasks()
+    if not tasks:
+        return "No tasks."
+    return "\n".join(
+        f"  {t.id}: {t.subject} [{t.status}]"
+        + (f" (wt:{t.worktree})" if t.worktree else "")
+        for t in tasks)
+
+
+def run_get_task(task_id: str) -> str:
+    return get_task_json(task_id)
+
+
+def run_claim_task(task_id: str) -> str:
+    return claim_task(task_id, owner="agent")
+
+
+def run_complete_task(task_id: str) -> str:
+    return complete_task(task_id)
+
+
+def run_spawn_teammate(name: str, role: str, prompt: str) -> str:
+    return spawn_teammate_thread(name, role, prompt)
+
+
+def run_send_message(to: str, content: str) -> str:
+    BUS.send("lead", to, content)
+    return f"Sent to {to}"
+
+
+def run_check_inbox() -> str:
+    msgs = consume_lead_inbox(route_protocol=True)
+    if not msgs:
+        return "(inbox empty)"
+    lines = []
+    for m in msgs:
+        meta = m.get("metadata", {})
+        req_id = meta.get("request_id", "")
+        tag = f" [{m['type']} req:{req_id}]" if req_id else f" [{m['type']}]"
+        lines.append(f"  [{m['from']}]{tag} {m['content'][:200]}")
+    return "\n".join(lines)
+
+
+# ── Tool Definitions ──
+
+TOOLS = [
+    {"name": "bash", "description": "Run a shell command.",
+     "input_schema": {"type": "object",
+                      "properties": {"command": {"type": "string"}},
+                      "required": ["command"]}},
+    {"name": "read_file", "description": "Read file contents.",
+     "input_schema": {"type": "object",
+                      "properties": {"path": {"type": "string"},
+                                     "limit": {"type": "integer"}},
+                      "required": ["path"]}},
+    {"name": "write_file", "description": "Write content to a file.",
+     "input_schema": {"type": "object",
+                      "properties": {"path": {"type": "string"},
+                                     "content": {"type": "string"}},
+                      "required": ["path", "content"]}},
+    {"name": "create_task",
+     "description": "Create a task.",
+     "input_schema": {"type": "object",
+                      "properties": {"subject": {"type": "string"},
+                                     "description": {"type": "string"},
+                                     "blockedBy": {"type": "array",
+                                                   "items": {"type": "string"}}},
+                      "required": ["subject"]}},
+    {"name": "list_tasks",
+     "description": "List all tasks.",
+     "input_schema": {"type": "object", "properties": {}, "required": []}},
+    {"name": "get_task",
+     "description": "Get full details of a specific task.",
+     "input_schema": {"type": "object",
+                      "properties": {"task_id": {"type": "string"}},
+                      "required": ["task_id"]}},
+    {"name": "claim_task",
+     "description": "Claim a pending task.",
+     "input_schema": {"type": "object",
+                      "properties": {"task_id": {"type": "string"}},
+                      "required": ["task_id"]}},
+    {"name": "complete_task",
+     "description": "Complete an in-progress task.",
+     "input_schema": {"type": "object",
+                      "properties": {"task_id": {"type": "string"}},
+                      "required": ["task_id"]}},
+    {"name": "spawn_teammate",
+     "description": "Spawn an autonomous teammate agent.",
+     "input_schema": {"type": "object",
+                      "properties": {"name": {"type": "string"},
+                                     "role": {"type": "string"},
+                                     "prompt": {"type": "string"}},
+                      "required": ["name", "role", "prompt"]}},
+    {"name": "send_message",
+     "description": "Send message to a teammate.",
+     "input_schema": {"type": "object",
+                      "properties": {"to": {"type": "string"},
+                                     "content": {"type": "string"}},
+                      "required": ["to", "content"]}},
+    {"name": "check_inbox",
+     "description": "Check inbox for messages and protocol responses.",
+     "input_schema": {"type": "object", "properties": {}, "required": []}},
+    {"name": "request_shutdown",
+     "description": "Request a teammate to shut down gracefully.",
+     "input_schema": {"type": "object",
+                      "properties": {"teammate": {"type": "string"}},
+                      "required": ["teammate"]}},
+    {"name": "request_plan",
+     "description": "Ask a teammate to submit a plan for review.",
+     "input_schema": {"type": "object",
+                      "properties": {"teammate": {"type": "string"},
+                                     "task": {"type": "string"}},
+                      "required": ["teammate", "task"]}},
+    {"name": "review_plan",
+     "description": "Approve or reject a submitted plan.",
+     "input_schema": {"type": "object",
+                      "properties": {
+                          "request_id": {"type": "string"},
+                          "approve": {"type": "boolean"},
+                          "feedback": {"type": "string"}},
+                      "required": ["request_id", "approve"]}},
+    # s18 new: worktree tools
+    {"name": "create_worktree",
+     "description": "Create an isolated git worktree with its own branch.",
+     "input_schema": {"type": "object",
+                      "properties": {"name": {"type": "string"},
+                                     "task_id": {"type": "string"}},
+                      "required": ["name"]}},
+    {"name": "remove_worktree",
+     "description": "Remove a worktree. Refuses if uncommitted changes unless discard_changes=true.",
+     "input_schema": {"type": "object",
+                      "properties": {"name": {"type": "string"},
+                                     "discard_changes": {"type": "boolean"}},
+                      "required": ["name"]}},
+    {"name": "keep_worktree",
+     "description": "Keep a worktree for manual review.",
+     "input_schema": {"type": "object",
+                      "properties": {"name": {"type": "string"}},
+                      "required": ["name"]}},
+]
+
+TOOL_HANDLERS = {
+    "bash": run_bash, "read_file": run_read, "write_file": run_write,
+    "create_task": run_create_task, "list_tasks": run_list_tasks,
+    "get_task": run_get_task,
+    "claim_task": run_claim_task, "complete_task": run_complete_task,
+    "spawn_teammate": run_spawn_teammate,
+    "send_message": run_send_message, "check_inbox": run_check_inbox,
+    "request_shutdown": run_request_shutdown,
+    "request_plan": run_request_plan, "review_plan": run_review_plan,
+    "create_worktree": run_create_worktree,
+    "remove_worktree": run_remove_worktree,
+    "keep_worktree": run_keep_worktree,
+}
+
+
+# ── Context ──
+
+MEMORY_DIR = WORKDIR / ".memory"
+MEMORY_INDEX = MEMORY_DIR / "MEMORY.md"
+
+
+def update_context(context: dict, messages: list) -> dict:
+    memories = ""
+    if MEMORY_INDEX.exists():
+        memories = MEMORY_INDEX.read_text()[:2000]
+    return {"memories": memories}
+
+
+# ── Agent Loop ──
+
+def agent_loop(messages: list, context: dict):
+    system = get_system_prompt(context)
+    while True:
+        try:
+            response = client.messages.create(
+                model=MODEL, system=system, messages=messages,
+                tools=TOOLS, max_tokens=8000)
+        except Exception as e:
+            messages.append({"role": "assistant", "content": [
+                {"type": "text", "text": f"[Error] {type(e).__name__}: {e}"}]})
+            return
+
+        messages.append({"role": "assistant", "content": response.content})
+        if response.stop_reason != "tool_use":
+            return
+
+        results = []
+        for block in response.content:
+            if block.type != "tool_use":
+                continue
+            print(f"\033[36m> {block.name}\033[0m")
+            handler = TOOL_HANDLERS.get(block.name)
+            output = handler(**block.input) if handler else "Unknown"
+            print(str(output)[:300])
+            results.append({"type": "tool_result",
+                            "tool_use_id": block.id, "content": output})
+        messages.append({"role": "user", "content": results})
+        context = update_context(context, messages)
+        system = get_system_prompt(context)
+
+
+if __name__ == "__main__":
+    print("s18: worktree isolation")
+    print("Enter a question, press Enter to send. Type q to quit.\n")
+    history = []
+    context = {"memories": ""}
+    while True:
+        try:
+            query = input("\033[36ms18 >> \033[0m")
+        except (EOFError, KeyboardInterrupt):
+            break
+        if query.strip().lower() in ("q", "exit", ""):
+            break
+        history.append({"role": "user", "content": query})
+        agent_loop(history, context)
+        context = update_context(context, history)
+        for block in history[-1]["content"]:
+            if getattr(block, "type", None) == "text":
+                print(block.text)
+
+        # Consume lead inbox: route protocol + inject into history
+        inbox = consume_lead_inbox(route_protocol=True)
+        if inbox:
+            inbox_text = "\n".join(
+                f"From {m['from']} [{m.get('type', 'message')}]: "
+                f"{m['content'][:200]}" for m in inbox)
+            history.append({"role": "user",
+                            "content": f"[Inbox]\n{inbox_text}"})
+        print()

s18_worktree_isolation/images/worktree-overview.en.svg

@@ -0,0 +1,103 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 450" font-family="system-ui, -apple-system, sans-serif">
+  <defs>
+    <linearGradient id="header" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#1e3a5f"/><stop offset="100%" stop-color="#b45309"/>
+    </linearGradient>
+    <marker id="arrow" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#555"/>
+    </marker>
+    <marker id="arrow-amber" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#b45309"/>
+    </marker>
+    <marker id="arrow-green" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#16a34a"/>
+    </marker>
+  </defs>
+
+  <rect width="760" height="450" fill="#fafbfc" rx="8"/>
+
+  <!-- Title -->
+  <rect x="0" y="0" width="760" height="44" fill="url(#header)" rx="8"/>
+  <rect x="0" y="36" width="760" height="8" fill="url(#header)"/>
+  <text x="380" y="28" fill="#fff" font-size="15" font-weight="700" text-anchor="middle">Worktree Isolation — Git Worktree + Task-Directory Binding + Event Log</text>
+
+  <!-- Legend -->
+  <rect x="40" y="56" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="58" y="66" fill="#2563eb" font-size="10" font-weight="600">s17 Preserved</text>
+  <rect x="160" y="56" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="178" y="66" fill="#b45309" font-size="10" font-weight="600">s18 New</text>
+
+  <!-- ===== Row 1: Lead Loop (s17 preserved) ===== -->
+  <rect x="20" y="90" width="70" height="40" rx="8" fill="#eef2ff" stroke="#4f46e5" stroke-width="1.5"/>
+  <text x="55" y="114" fill="#4f46e5" font-size="8" font-weight="600" text-anchor="middle">turn</text>
+
+  <line x1="90" y1="110" x2="104" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="107" y="90" width="70" height="40" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="142" y="114" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">messages</text>
+
+  <line x1="177" y1="110" x2="191" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="194" y="86" width="80" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="234" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">prompt</text>
+
+  <line x1="274" y1="110" x2="288" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="291" y="86" width="70" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="326" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">LLM</text>
+
+  <line x1="361" y1="110" x2="375" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="378" y="76" width="356" height="70" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="556" y="94" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">TOOL DISPATCH (s17 + s18)</text>
+  <text x="394" y="110" fill="#2563eb" font-size="8">bash · read · write · task(4) · send · inbox</text>
+  <text x="394" y="123" fill="#7c3aed" font-size="8" font-weight="700">request_shutdown · request_plan · review_plan</text>
+  <text x="394" y="136" fill="#b45309" font-size="8" font-weight="700">★ create_worktree · remove_worktree · keep_worktree</text>
+
+  <!-- Loop back -->
+  <path d="M 734 110 L 748 110 L 748 150 L 55 150 L 55 130" fill="none" stroke="#94a3b8" stroke-width="1" marker-end="url(#arrow)" stroke-dasharray="5,4"/>
+
+  <!-- ===== Row 2: Worktree Topology (s18 new) ===== -->
+  <rect x="30" y="172" width="700" height="215" rx="8" fill="#fffbeb" stroke="#b45309" stroke-width="2"/>
+  <text x="380" y="194" fill="#78350f" font-size="11" font-weight="700" text-anchor="middle">Worktree Isolation (s18 new: each task gets its own directory + branch)</text>
+
+  <!-- Main repo box -->
+  <rect x="230" y="208" width="300" height="36" rx="6" fill="#fff" stroke="#b45309" stroke-width="1.5"/>
+  <text x="380" y="231" fill="#78350f" font-size="10" font-weight="600" text-anchor="middle">Main repo (.tasks/ + .worktrees/ + .mailboxes/)</text>
+
+  <!-- Arrow: Main repo → Worktree 1 (Alice) -->
+  <line x1="310" y1="244" x2="178" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="200" y="262" fill="#b45309" font-size="7" font-weight="600" transform="rotate(-12 200 262)">create + bind</text>
+
+  <!-- Arrow: Main repo → Worktree 2 (Bob) -->
+  <line x1="450" y1="244" x2="582" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="530" y="252" fill="#b45309" font-size="7" font-weight="600" transform="rotate(12 530 252)">create + bind</text>
+
+  <!-- Worktree 1: Alice -->
+  <rect x="50" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="177" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Alice: .worktrees/auth/</text>
+  <text x="65" y="310" fill="#374151" font-size="8">branch: wt/auth-refactor</text>
+  <text x="65" y="324" fill="#374151" font-size="8">Task: Refactor auth module</text>
+  <text x="65" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ Isolated, no impact on Bob or main repo</text>
+
+  <!-- Worktree 2: Bob -->
+  <rect x="455" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="582" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Bob: .worktrees/ui/</text>
+  <text x="470" y="310" fill="#374151" font-size="8">branch: wt/ui-login</text>
+  <text x="470" y="324" fill="#374151" font-size="8">Task: Refactor UI login page</text>
+  <text x="470" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ Isolated, no impact on Alice or main repo</text>
+
+  <!-- Event log + Lifecycle -->
+  <rect x="50" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="205" y="376" fill="#92400e" font-size="8" text-anchor="middle">Event log: .worktrees/events.jsonl → create / remove / keep</text>
+
+  <rect x="400" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="555" y="376" fill="#92400e" font-size="8" text-anchor="middle">Cleanup: keep (preserve branch for review) / remove (delete + mark done)</text>
+
+  <!-- ===== Row 3: Bottom notes ===== -->
+  <rect x="30" y="400" width="700" height="42" rx="6" fill="#f8fafc" stroke="#e2e8f0" stroke-width="1"/>
+  <rect x="50" y="412" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="70" y="422" fill="#475569" font-size="10">s17: idle_poll + auto_claim + protocols + WORK/IDLE lifecycle</text>
+  <rect x="50" y="426" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="70" y="436" fill="#475569" font-size="10">s18: create_worktree + bind_task + remove/keep + events.jsonl (Lead 14→17)</text>
+</svg>

s18_worktree_isolation/images/worktree-overview.ja.svg

@@ -0,0 +1,103 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 450" font-family="system-ui, -apple-system, sans-serif">
+  <defs>
+    <linearGradient id="header" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#1e3a5f"/><stop offset="100%" stop-color="#b45309"/>
+    </linearGradient>
+    <marker id="arrow" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#555"/>
+    </marker>
+    <marker id="arrow-amber" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#b45309"/>
+    </marker>
+    <marker id="arrow-green" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#16a34a"/>
+    </marker>
+  </defs>
+
+  <rect width="760" height="450" fill="#fafbfc" rx="8"/>
+
+  <!-- Title -->
+  <rect x="0" y="0" width="760" height="44" fill="url(#header)" rx="8"/>
+  <rect x="0" y="36" width="760" height="8" fill="url(#header)"/>
+  <text x="380" y="28" fill="#fff" font-size="14" font-weight="700" text-anchor="middle">Worktree Isolation — Git Worktree + タスク・ディレクトリ紐付け + イベントログ</text>
+
+  <!-- Legend -->
+  <rect x="40" y="56" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="58" y="66" fill="#2563eb" font-size="10" font-weight="600">s17 保持</text>
+  <rect x="130" y="56" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="148" y="66" fill="#b45309" font-size="10" font-weight="600">s18 新規</text>
+
+  <!-- ===== Row 1: Lead Loop ===== -->
+  <rect x="20" y="90" width="70" height="40" rx="8" fill="#eef2ff" stroke="#4f46e5" stroke-width="1.5"/>
+  <text x="55" y="114" fill="#4f46e5" font-size="8" font-weight="600" text-anchor="middle">turn</text>
+
+  <line x1="90" y1="110" x2="104" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="107" y="90" width="70" height="40" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="142" y="114" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">messages</text>
+
+  <line x1="177" y1="110" x2="191" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="194" y="86" width="80" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="234" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">prompt</text>
+
+  <line x1="274" y1="110" x2="288" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="291" y="86" width="70" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="326" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">LLM</text>
+
+  <line x1="361" y1="110" x2="375" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="378" y="76" width="356" height="70" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="556" y="94" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">TOOL DISPATCH（s17 + s18）</text>
+  <text x="394" y="110" fill="#2563eb" font-size="8">bash · read · write · task(4) · send · inbox</text>
+  <text x="394" y="123" fill="#7c3aed" font-size="8" font-weight="700">request_shutdown · request_plan · review_plan</text>
+  <text x="394" y="136" fill="#b45309" font-size="8" font-weight="700">★ create_worktree · remove_worktree · keep_worktree</text>
+
+  <!-- Loop back -->
+  <path d="M 734 110 L 748 110 L 748 150 L 55 150 L 55 130" fill="none" stroke="#94a3b8" stroke-width="1" marker-end="url(#arrow)" stroke-dasharray="5,4"/>
+
+  <!-- ===== Row 2: Worktree Topology ===== -->
+  <rect x="30" y="172" width="700" height="215" rx="8" fill="#fffbeb" stroke="#b45309" stroke-width="2"/>
+  <text x="380" y="194" fill="#78350f" font-size="11" font-weight="700" text-anchor="middle">Worktree 隔離（s18 新規：各タスクに独立ディレクトリ + 独立ブランチ）</text>
+
+  <!-- Main repo box -->
+  <rect x="230" y="208" width="300" height="36" rx="6" fill="#fff" stroke="#b45309" stroke-width="1.5"/>
+  <text x="380" y="231" fill="#78350f" font-size="10" font-weight="600" text-anchor="middle">メインリポジトリ（.tasks/ + .worktrees/ + .mailboxes/）</text>
+
+  <!-- Arrow: Main repo → Worktree 1 (Alice) -->
+  <line x1="310" y1="244" x2="178" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="200" y="262" fill="#b45309" font-size="7" font-weight="600" transform="rotate(-12 200 262)">create + bind</text>
+
+  <!-- Arrow: Main repo → Worktree 2 (Bob) -->
+  <line x1="450" y1="244" x2="582" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="530" y="252" fill="#b45309" font-size="7" font-weight="600" transform="rotate(12 530 252)">create + bind</text>
+
+  <!-- Worktree 1: Alice -->
+  <rect x="50" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="177" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Alice: .worktrees/auth/</text>
+  <text x="65" y="310" fill="#374151" font-size="8">branch: wt/auth-refactor</text>
+  <text x="65" y="324" fill="#374151" font-size="8">Task: 認証モジュールのリファクタリング</text>
+  <text x="65" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ 隔離、Bob とメインリポジトリに影響なし</text>
+
+  <!-- Worktree 2: Bob -->
+  <rect x="455" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="582" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Bob: .worktrees/ui/</text>
+  <text x="470" y="310" fill="#374151" font-size="8">branch: wt/ui-login</text>
+  <text x="470" y="324" fill="#374151" font-size="8">Task: UI ログインページのリファクタリング</text>
+  <text x="470" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ 隔離、Alice とメインリポジトリに影響なし</text>
+
+  <!-- Event log + Lifecycle -->
+  <rect x="50" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="205" y="376" fill="#92400e" font-size="8" text-anchor="middle">イベントログ: .worktrees/events.jsonl → create / remove / keep</text>
+
+  <rect x="400" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="555" y="376" fill="#92400e" font-size="8" text-anchor="middle">片付け: keep（ブランチ保持 review）/ remove（削除+完了マーク）</text>
+
+  <!-- ===== Row 3: Bottom notes ===== -->
+  <rect x="30" y="400" width="700" height="42" rx="6" fill="#f8fafc" stroke="#e2e8f0" stroke-width="1"/>
+  <rect x="50" y="412" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="70" y="422" fill="#475569" font-size="10">s17: idle_poll + auto_claim + protocols + WORK/IDLE ライフサイクル</text>
+  <rect x="50" y="426" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="70" y="436" fill="#475569" font-size="10">s18: create_worktree + bind_task + remove/keep + events.jsonl（Lead 14→17）</text>
+</svg>

s18_worktree_isolation/images/worktree-overview.svg

@@ -0,0 +1,103 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 450" font-family="system-ui, -apple-system, sans-serif">
+  <defs>
+    <linearGradient id="header" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#1e3a5f"/><stop offset="100%" stop-color="#b45309"/>
+    </linearGradient>
+    <marker id="arrow" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#555"/>
+    </marker>
+    <marker id="arrow-amber" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#b45309"/>
+    </marker>
+    <marker id="arrow-green" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#16a34a"/>
+    </marker>
+  </defs>
+
+  <rect width="760" height="450" fill="#fafbfc" rx="8"/>
+
+  <!-- Title -->
+  <rect x="0" y="0" width="760" height="44" fill="url(#header)" rx="8"/>
+  <rect x="0" y="36" width="760" height="8" fill="url(#header)"/>
+  <text x="380" y="28" fill="#fff" font-size="15" font-weight="700" text-anchor="middle">Worktree Isolation — Git Worktree + 任务-目录绑定 + 事件日志</text>
+
+  <!-- Legend -->
+  <rect x="40" y="56" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="58" y="66" fill="#2563eb" font-size="10" font-weight="600">s17 保留</text>
+  <rect x="140" y="56" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="158" y="66" fill="#b45309" font-size="10" font-weight="600">s18 新增</text>
+
+  <!-- ===== Row 1: Lead Loop (s17 preserved) ===== -->
+  <rect x="20" y="90" width="70" height="40" rx="8" fill="#eef2ff" stroke="#4f46e5" stroke-width="1.5"/>
+  <text x="55" y="114" fill="#4f46e5" font-size="8" font-weight="600" text-anchor="middle">turn</text>
+
+  <line x1="90" y1="110" x2="104" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="107" y="90" width="70" height="40" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="142" y="114" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">messages</text>
+
+  <line x1="177" y1="110" x2="191" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="194" y="86" width="80" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="234" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">prompt</text>
+
+  <line x1="274" y1="110" x2="288" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="291" y="86" width="70" height="48" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="326" y="114" fill="#1e3a5f" font-size="9" font-weight="600" text-anchor="middle">LLM</text>
+
+  <line x1="361" y1="110" x2="375" y2="110" stroke="#555" stroke-width="1.5" marker-end="url(#arrow)"/>
+
+  <rect x="378" y="76" width="356" height="70" rx="8" fill="#f0f4ff" stroke="#2563eb" stroke-width="1.5"/>
+  <text x="556" y="94" fill="#1e3a5f" font-size="10" font-weight="600" text-anchor="middle">TOOL DISPATCH (s17 + s18)</text>
+  <text x="394" y="110" fill="#2563eb" font-size="8">bash · read · write · task(4) · send · inbox</text>
+  <text x="394" y="123" fill="#7c3aed" font-size="8" font-weight="700">request_shutdown · request_plan · review_plan</text>
+  <text x="394" y="136" fill="#b45309" font-size="8" font-weight="700">★ create_worktree · remove_worktree · keep_worktree</text>
+
+  <!-- Loop back -->
+  <path d="M 734 110 L 748 110 L 748 150 L 55 150 L 55 130" fill="none" stroke="#94a3b8" stroke-width="1" marker-end="url(#arrow)" stroke-dasharray="5,4"/>
+
+  <!-- ===== Row 2: Worktree Topology (s18 new) ===== -->
+  <rect x="30" y="172" width="700" height="215" rx="8" fill="#fffbeb" stroke="#b45309" stroke-width="2"/>
+  <text x="380" y="194" fill="#78350f" font-size="11" font-weight="700" text-anchor="middle">Worktree 隔离（s18 新增：每个任务独立目录 + 独立分支）</text>
+
+  <!-- Main repo box -->
+  <rect x="230" y="208" width="300" height="36" rx="6" fill="#fff" stroke="#b45309" stroke-width="1.5"/>
+  <text x="380" y="231" fill="#78350f" font-size="10" font-weight="600" text-anchor="middle">主仓库 (.tasks/ + .worktrees/ + .mailboxes/)</text>
+
+  <!-- Arrow: Main repo → Worktree 1 (Alice) -->
+  <line x1="310" y1="244" x2="178" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="200" y="262" fill="#b45309" font-size="7" font-weight="600" transform="rotate(-12 200 262)">create + bind</text>
+
+  <!-- Arrow: Main repo → Worktree 2 (Bob) -->
+  <line x1="450" y1="244" x2="582" y2="272" stroke="#b45309" stroke-width="1.5" marker-end="url(#arrow-amber)"/>
+  <text x="530" y="252" fill="#b45309" font-size="7" font-weight="600" transform="rotate(12 530 252)">create + bind</text>
+
+  <!-- Worktree 1: Alice -->
+  <rect x="50" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="177" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Alice: .worktrees/auth/</text>
+  <text x="65" y="310" fill="#374151" font-size="8">branch: wt/auth-refactor</text>
+  <text x="65" y="324" fill="#374151" font-size="8">Task: 重构认证模块</text>
+  <text x="65" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ 隔离，不影响 Bob 和主仓库</text>
+
+  <!-- Worktree 2: Bob -->
+  <rect x="455" y="275" width="255" height="78" rx="6" fill="#fff" stroke="#16a34a" stroke-width="1.5"/>
+  <text x="582" y="294" fill="#166534" font-size="10" font-weight="700" text-anchor="middle">Bob: .worktrees/ui/</text>
+  <text x="470" y="310" fill="#374151" font-size="8">branch: wt/ui-login</text>
+  <text x="470" y="324" fill="#374151" font-size="8">Task: 重构 UI 登录页</text>
+  <text x="470" y="344" fill="#16a34a" font-size="8" font-weight="600">✓ 隔离，不影响 Alice 和主仓库</text>
+
+  <!-- Event log + Lifecycle -->
+  <rect x="50" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="205" y="376" fill="#92400e" font-size="8" text-anchor="middle">事件日志: .worktrees/events.jsonl → create / remove / keep</text>
+
+  <rect x="400" y="362" width="310" height="20" rx="4" fill="#fef3c7" stroke="#d97706" stroke-width="1"/>
+  <text x="555" y="376" fill="#92400e" font-size="8" text-anchor="middle">收尾: keep (保留分支 review) / remove (删除+标记完成)</text>
+
+  <!-- ===== Row 3: Bottom notes ===== -->
+  <rect x="30" y="400" width="700" height="42" rx="6" fill="#f8fafc" stroke="#e2e8f0" stroke-width="1"/>
+  <rect x="50" y="412" width="12" height="10" rx="2" fill="#f0f4ff" stroke="#2563eb" stroke-width="1"/>
+  <text x="70" y="422" fill="#475569" font-size="10">s17: idle_poll + auto_claim + protocols + WORK/IDLE lifecycle</text>
+  <rect x="50" y="426" width="12" height="10" rx="2" fill="#fffbeb" stroke="#b45309" stroke-width="1"/>
+  <text x="70" y="436" fill="#475569" font-size="10">s18: create_worktree + bind_task + remove/keep + events.jsonl (Lead 14→17)</text>
+</svg>