@coopcli/specplan 5.5.6 → 2026.817.1

package/dist/cli/index.js

@@ -1,14 +1,317 @@
 #!/usr/bin/env node
 
 // server/cli.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname5, extname, join as join7, normalize as normalize2, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync as readdirSync5 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname8, extname, join as join14, normalize as normalize2, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs as parseArgs2 } from "node:util";
 import { serve } from "@hono/node-server";
 import Anthropic from "@anthropic-ai/sdk";
 
+// ../agent-harness/src/model-auth.ts
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var ModelAuthError = class extends Error {
+};
+var API_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+function hasAntAuthProfile(home) {
+  try {
+    return readdirSync(join(home, ".config", "anthropic", "credentials")).some(
+      (f) => f.endsWith(".json")
+    );
+  } catch {
+    return false;
+  }
+}
+function resolveModelCredential(opts = {}) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir();
+  const useApi = Boolean(opts.useApi) || Boolean(env.COOP_USE_API);
+  const hasApiKey = Boolean(env.ANTHROPIC_API_KEY);
+  const hasAntAuth = Boolean(env.ANTHROPIC_AUTH_TOKEN) || hasAntAuthProfile(home);
+  const hasSubscription = existsSync(join(home, ".claude", ".credentials.json"));
+  if (useApi) {
+    if (hasApiKey || hasAntAuth) return apiResult(env, hasApiKey ? "api-key" : "ant-auth");
+    throw new ModelAuthError(
+      "--api / COOP_USE_API is set but no API credential was found. Set ANTHROPIC_API_KEY=sk-ant-\u2026 or run `ant auth login`."
+    );
+  }
+  if (hasSubscription) {
+    const subprocessEnv = { ...env };
+    for (const k of API_ENV_KEYS) delete subprocessEnv[k];
+    return {
+      path: "subscription",
+      billsApiCredits: false,
+      notice: "Model auth: Max/Pro subscription login \u2014 billing your subscription.",
+      subprocessEnv
+    };
+  }
+  if (hasApiKey) return apiResult(env, "api-key");
+  if (hasAntAuth) return apiResult(env, "ant-auth");
+  throw new ModelAuthError(
+    "No Anthropic model credential found. Either:\n  \u2022 log in your own Claude Code for subscription billing:  claude login\n  \u2022 or use API credits:  export ANTHROPIC_API_KEY=sk-ant-\u2026   (or: ant auth login)"
+  );
+}
+function apiResult(env, path) {
+  return {
+    path,
+    billsApiCredits: true,
+    notice: `Model auth: ${path === "api-key" ? "ANTHROPIC_API_KEY" : "ant auth OAuth token"} \u2014 billing API credits, NOT your Max subscription.`,
+    subprocessEnv: { ...env }
+  };
+}
+
+// ../agent-harness/src/claude.ts
+function makeGate(profile) {
+  return async (toolName, input) => {
+    if (!profile.allowedTools.includes(toolName)) {
+      return {
+        behavior: "deny",
+        message: `Tool "${toolName}" is not in the headless allowlist for agent "${profile.identity}".`
+      };
+    }
+    if (toolName === "Bash") {
+      const command = typeof input["command"] === "string" ? input["command"] : "";
+      for (const pattern of profile.blockedBashPatterns) {
+        if (pattern.test(command)) {
+          return {
+            behavior: "deny",
+            message: `Bash command blocked by headless profile pattern ${String(pattern)} for agent "${profile.identity}".`
+          };
+        }
+      }
+    }
+    if (profile.gatedTools.includes(toolName) && !profile.allowGated) {
+      return {
+        behavior: "deny",
+        message: `Tool "${toolName}" is a gated side-effect tool and this profile does not allow gated tools (allowGated: false).`
+      };
+    }
+    return { behavior: "allow", updatedInput: input };
+  };
+}
+function destructiveBashHook(profile) {
+  return {
+    matcher: "Bash",
+    hooks: [
+      async (input) => {
+        if (input.hook_event_name !== "PreToolUse") return { continue: true };
+        const ti = input.tool_input;
+        const command = typeof ti === "object" && ti !== null ? String(ti.command ?? "") : "";
+        for (const pattern of profile.blockedBashPatterns) {
+          if (pattern.test(command)) {
+            return {
+              continue: true,
+              hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: `Destructive command blocked by headless profile (${String(pattern)}) for agent "${profile.identity}".`
+              }
+            };
+          }
+        }
+        return { continue: true };
+      }
+    ]
+  };
+}
+function* mapMessage(message, expectStructuredOutput) {
+  switch (message.type) {
+    case "system": {
+      if (message.subtype === "init") {
+        yield {
+          type: "start",
+          sessionId: message.session_id,
+          ...message.apiKeySource !== void 0 ? { apiKeySource: message.apiKeySource } : {}
+        };
+      }
+      return;
+    }
+    case "assistant": {
+      const assistant = message;
+      for (const block of assistant.message.content) {
+        if (block.type === "text") {
+          yield { type: "text", text: block.text };
+        } else if (block.type === "thinking") {
+          yield { type: "thinking", text: block.thinking };
+        } else if (block.type === "tool_use") {
+          yield { type: "tool_use", id: block.id, name: block.name, input: block.input };
+        }
+      }
+      return;
+    }
+    case "user": {
+      const user = message;
+      const content = user.message.content;
+      if (typeof content === "string") return;
+      for (const block of content) {
+        if (block.type === "tool_result") {
+          yield {
+            type: "tool_result",
+            id: block.tool_use_id,
+            isError: block.is_error ?? false,
+            content: block.content
+          };
+        }
+      }
+      return;
+    }
+    case "result": {
+      if (message.subtype === "success") {
+        const missingStructured = expectStructuredOutput && message.structured_output === void 0;
+        yield {
+          type: "result",
+          text: message.result,
+          costUsd: message.total_cost_usd,
+          isError: message.is_error || missingStructured,
+          ...message.structured_output !== void 0 ? { structuredOutput: message.structured_output } : {}
+        };
+      } else {
+        yield {
+          type: "result",
+          text: message.errors.join("\n"),
+          costUsd: message.total_cost_usd,
+          isError: true
+        };
+      }
+      return;
+    }
+    default:
+      return;
+  }
+}
+function buildOptions(input, resolved) {
+  const profile = input.profile;
+  const options = {
+    cwd: input.cwd,
+    // CRITICAL: an EXPLICIT settingSources: [] loads NOTHING. (The SDK's own
+    // default — when the option is omitted — loads ALL sources; we always
+    // pass the profile's list so inheritance is an explicit choice, and the
+    // profile's sources are what yield LifeOS inheritance.)
+    settingSources: profile.settingSources,
+    // Never 'bypassPermissions' / 'acceptEdits' — PermissionProfile's type
+    // only admits 'default' | 'plan' | 'dontAsk'.
+    permissionMode: profile.permissionMode,
+    allowedTools: profile.allowedTools,
+    canUseTool: makeGate(profile),
+    // Containment: destructive-Bash denial must survive a bare allowlisted
+    // `Bash` (allow rules short-circuit canUseTool), so it is enforced by a
+    // PreToolUse hook, which the SDK evaluates before allow rules.
+    hooks: { PreToolUse: [destructiveBashHook(profile)] },
+    // Options.env REPLACES the subprocess environment (no merge). The
+    // resolver hands back the FULL inherited env (HOME/PATH preserved) with
+    // ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN stripped on the subscription
+    // path, so the subprocess cannot prefer an API key over the login.
+    env: resolved.subprocessEnv
+  };
+  if (profile.disallowedTools) {
+    options.disallowedTools = profile.disallowedTools;
+  }
+  if (profile.mcpServers) {
+    options.mcpServers = profile.mcpServers;
+  }
+  if (profile.strictMcp !== void 0) {
+    options.strictMcpConfig = profile.strictMcp;
+  }
+  if (input.outputSchema) {
+    options.outputFormat = { type: "json_schema", schema: input.outputSchema };
+  }
+  return options;
+}
+function verifyBilling(resolved, apiKeySource, notify) {
+  if (apiKeySource === void 0) return;
+  const billedViaApiKey = apiKeySource !== "none";
+  if (resolved.path === "subscription" && billedViaApiKey) {
+    notify(
+      `Warning: the subscription path was selected but the run authenticated from an API-key source ('${apiKeySource}') \u2014 this run bills API credits, not your subscription.`
+    );
+  } else if (resolved.path !== "subscription" && !billedViaApiKey) {
+    notify(
+      `Warning: the ${resolved.path} (API credits) path was selected but the run authenticated as first-party (no API key) \u2014 this run bills the subscription.`
+    );
+  }
+}
+var SDK_UNAVAILABLE_MESSAGE = "Claude Agent SDK not available \u2014 reinstall the CLI (do not use --omit=optional). Global install is required for the agent path; pnpm dlx/npx re-download the ~268 MB native binary.";
+function isSdkAbsence(error) {
+  const code = error?.code;
+  if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return true;
+  const message = error instanceof Error ? error.message : String(error);
+  return /Native CLI binary.*not found/i.test(message);
+}
+async function loadSdkQuery(loader) {
+  try {
+    const mod = await (loader ?? (() => import("@anthropic-ai/claude-agent-sdk")))();
+    return mod.query;
+  } catch (error) {
+    if (isSdkAbsence(error)) throw new Error(SDK_UNAVAILABLE_MESSAGE, { cause: error });
+    throw error;
+  }
+}
+function createClaudeHarness(deps) {
+  return {
+    id: "claude",
+    async *run(input) {
+      const resolved = resolveModelCredential({
+        env: deps?.env,
+        home: deps?.home,
+        useApi: input.useApi
+      });
+      const notify = input.onNotice ?? ((message) => console.error(message));
+      notify(resolved.notice);
+      const queryFn = deps?.queryFn ?? await loadSdkQuery(deps?.sdkLoader);
+      const expectStructuredOutput = input.outputSchema !== void 0;
+      try {
+        const stream = queryFn({ prompt: input.prompt, options: buildOptions(input, resolved) });
+        for await (const message of stream) {
+          if (message.type === "system" && message.subtype === "init") {
+            verifyBilling(resolved, message.apiKeySource, notify);
+          }
+          yield* mapMessage(message, expectStructuredOutput);
+        }
+      } catch (error) {
+        if (isSdkAbsence(error)) throw new Error(SDK_UNAVAILABLE_MESSAGE, { cause: error });
+        throw error;
+      }
+    }
+  };
+}
+
+// ../agent-harness/src/profiles.ts
+var SIDE_EFFECT_GATED_TOOLS = ["SendMessage", "Send", "Deploy", "Publish"];
+var BLOCKED_BASH_PATTERNS = [
+  /\bgit\s+push\b/,
+  /\bwrangler\s+deploy\b/,
+  /\brm\s+-rf\b/,
+  /\bnpm\s+publish\b/
+];
+function blockedBashPatterns() {
+  return [...BLOCKED_BASH_PATTERNS];
+}
+function defaultHeadlessProfile(identity) {
+  return {
+    allowedTools: ["Read", "Grep", "Glob", "WebFetch"],
+    gatedTools: [...SIDE_EFFECT_GATED_TOOLS],
+    allowGated: false,
+    blockedBashPatterns: blockedBashPatterns(),
+    permissionMode: "default",
+    settingSources: [],
+    identity
+  };
+}
+function readMostlyProfile(identity) {
+  return {
+    allowedTools: ["Read", "Grep", "Glob", "WebFetch", "WebSearch"],
+    gatedTools: [...SIDE_EFFECT_GATED_TOOLS],
+    allowGated: false,
+    blockedBashPatterns: blockedBashPatterns(),
+    permissionMode: "default",
+    settingSources: [],
+    identity
+  };
+}
+
 // src/lib/schema.ts
 import { z } from "zod";
 var GENERATION_MODELS = [
@@ -18,14 +321,24 @@ var GENERATION_MODELS = [
 ];
 var DEFAULT_MODEL = "claude-opus-4-8";
 var GenerationModel = z.enum(GENERATION_MODELS);
-var NodeType = z.enum(["spec", "user_story"]);
-var SpecNode = z.object({
+var NodeType = z.enum(["capability", "proposal", "user_story"]);
+var CapabilityNode = z.object({
+  /** The capability directory basename (`specs/<cap>/`). */
+  id: z.string(),
+  type: z.literal("capability"),
+  title: z.string(),
+  /** Sibling ordering hint — display/tie-break only, never affects edges. */
+  order: z.number(),
+  /** Repo-relative `specs/<cap>/spec.md` for the read projection. */
+  specPath: z.string().optional()
+});
+var ProposalNode = z.object({
   /** Server-minted `spec-<ulid>` (lowercase). */
   id: z.string(),
-  type: z.literal("spec"),
+  type: z.literal("proposal"),
   title: z.string(),
   /**
-   * Author's description/prompt for the spec — steering context for
+   * Author's description/prompt for the proposal — steering context for
    * generation. May contain `@` file references, which expand at
    * generation time like any other input.
    */
@@ -41,8 +354,12 @@ var StoryNode = z.object({
   text: z.string(),
   order: z.number()
 });
-var PlanNode = z.discriminatedUnion("type", [SpecNode, StoryNode]);
-var EdgeType = z.enum(["dependency", "containment"]);
+var PlanNode = z.discriminatedUnion("type", [
+  CapabilityNode,
+  ProposalNode,
+  StoryNode
+]);
+var EdgeType = z.enum(["stacked", "containment", "targets"]);
 var PlanEdge = z.object({
   from: z.string(),
   to: z.string(),
@@ -53,20 +370,8 @@ var Plan = z.object({
   nodes: z.array(PlanNode),
   edges: z.array(PlanEdge)
 });
-var SPEC_STATUSES = ["draft", "active", "done", "deferred"];
+var SPEC_STATUSES = ["draft", "in-progress"];
 var SpecStatus = z.enum(SPEC_STATUSES);
-var SpecMeta = z.object({
-  specId: z.string(),
-  userStories: z.array(z.string()),
-  dependencies: z.array(z.string()),
-  /** Lifecycle status; absent = draft. */
-  status: SpecStatus.optional(),
-  generation: z.object({
-    /** sha256 of the last generated body files — detects hand edits. */
-    lastGeneratedBodyHash: z.string(),
-    lastGeneratedAt: z.string()
-  }).optional()
-});
 var ChatRole = z.enum(["user", "assistant", "summary"]);
 var ChatMessage = z.object({
   role: ChatRole,
@@ -84,7 +389,14 @@ var ChatRequest = z.object({
   message: z.string().min(1),
   /** Conversation history preceding `message`, oldest first. */
   conversation: z.array(ChatMessage).default([]),
-  model: GenerationModel.optional()
+  model: GenerationModel.optional(),
+  /**
+   * Chat runtime (agent-harness change, phase 2). `structural` (default) is
+   * the non-destructive ≤8-round tool loop that mutates the PlanStore DAG.
+   * `power` runs the read-mostly full-tool agent harness BESIDE it — plan
+   * mutations still flow only through the structural tools.
+   */
+  mode: z.enum(["structural", "power"]).default("structural")
 });
 var UnresolvedRefInfo = z.object({ ref: z.string(), reason: z.string() });
 var ChatReply = z.object({
@@ -130,7 +442,7 @@ var GenerateResponse = z.object({
   /** Change-dir-relative paths written by this generation. */
   changedFiles: z.array(z.string())
 });
-var NodePosition = z.object({ x: z.number(), y: z.number() });
+var NodePosition = z.object({ y: z.number() });
 var SpecState = z.object({
   /** Body files (proposal/design/tasks/specs) exist in the change dir. */
   hasSpec: z.boolean(),
@@ -139,22 +451,61 @@ var SpecState = z.object({
    * generated by specplan) — regeneration will be metadata-only.
    */
   handEdited: z.boolean(),
-  /** Lifecycle status from the per-spec metadata file (absent = draft). */
-  status: SpecStatus
+  /** Working state from the per-spec metadata file (absent = draft). */
+  status: SpecStatus,
+  /** Approved/fold axis (own axis, distinct from `status`); absent = not-approved. */
+  approved: z.boolean().optional(),
+  /** Build flag (user-set); absent = not-implemented. */
+  implemented: z.boolean().optional(),
+  /**
+   * Read-only delta-completion projection of the change's `tasks.md`
+   * checkboxes (`- [ ]` / `- [x]`). Absent when the change has no `tasks.md`
+   * (or it carries no checkboxes). NEVER authored or persisted from the card —
+   * the ledger + `tasks.md` are the single source of truth.
+   */
+  tasks: z.object({ done: z.number(), total: z.number() }).optional(),
+  /**
+   * Read-only lifecycle status projected from the repo `SPECS.md` ledger row
+   * for this change (e.g. `draft` / `approved` / `implemented`). Absent when
+   * the ledger has no row for the change (or no `SPECS.md` exists). Display
+   * only — no writer.
+   */
+  ledgerStatus: z.string().optional()
 });
 var SetStatusRequest = z.object({
   specId: z.string(),
   status: SpecStatus
 });
+var SetImplementedRequest = z.object({
+  specId: z.string(),
+  implemented: z.boolean()
+});
+var ApplyRequest = z.object({
+  specId: z.string().min(1),
+  confirmHandEdit: z.boolean().optional()
+});
 var SessionSnapshot = z.object({
   /** Display name of the plan root (the openspec directory). */
   rootName: z.string(),
   model: GenerationModel.optional(),
   plan: Plan,
-  /** Canvas layout per node id (UI sidecar state, not plan data). */
-  positions: z.record(z.string(), NodePosition),
   /** Per-spec-node on-disk change state, keyed by spec id. */
   specStates: z.record(z.string(), SpecState),
+  /**
+   * Collapsed hyphen-prefix group keys over the capability root lane (UI
+   * sidecar state, view-only — never plan data). ABSENT means the plan has
+   * never persisted a collapse state: the UI applies the first-load default
+   * (collapsed to the first hyphen segment). Present-but-empty means the
+   * user expanded everything, and that is remembered.
+   */
+  collapsedGroups: z.array(z.string()).optional(),
+  /**
+   * "Hide specs with no scheduled items" toggle (UI sidecar state, view-only —
+   * never plan data). Absent = the default (show every row). Hiding is a pure
+   * view filter — it drops the empty rows' edges and re-packs the rest without
+   * touching plan nodes/edges.
+   */
+  hideEmptySpecs: z.boolean().optional(),
   /** Persisted assistant chat, oldest first. */
   chat: z.array(ChatMessage).optional()
 });
@@ -162,11 +513,22 @@ var SpecArtifacts = z.object({
   specId: z.string(),
   handEdited: z.boolean(),
   /** Change-dir-relative body files in canonical order. */
-  files: z.array(z.object({ path: z.string(), content: z.string() }))
+  files: z.array(z.object({ path: z.string(), content: z.string() })),
+  /**
+   * Raw `diagram.excalidraw` JSON when the change dir carries one — for the
+   * read-only excalidraw preview in the viewer dialog. Its OWN field on
+   * purpose: the diagram is deliberately NOT a body file (not in
+   * listBodyFiles/bodyHash/files[]), so its presence never flips the
+   * hand-edit gate.
+   */
+  diagram: z.string().optional()
 });
 var SessionSave = z.object({
   model: GenerationModel.optional(),
-  positions: z.record(z.string(), NodePosition).optional()
+  /** Collapsed group keys (view-only grouping state, remembered per plan). */
+  collapsedGroups: z.array(z.string()).optional(),
+  /** "Hide specs with no scheduled items" toggle (view-only). */
+  hideEmptySpecs: z.boolean().optional()
 });
 var CreateSpecRequest = z.object({
   title: z.string().min(1),
@@ -176,6 +538,7 @@ var CreateSpecRequest = z.object({
 var CreateStoryRequest = z.object({ text: z.string().min(1) });
 var LinkRequest = z.object({ from: z.string(), to: z.string() });
 var ReorderRequest = z.object({ nodeId: z.string(), order: z.number() });
+var ArrangeRequest = z.object({ order: z.array(z.string()) });
 var PromptSave = z.object({
   system: z.string().min(1).nullable()
 });
@@ -188,8 +551,19 @@ var PromptInfo = z.object({
   custom: z.boolean()
 });
 
-// server/app.ts
-import { Hono } from "hono";
+// server/apply.ts
+import { execFile as execFile2 } from "node:child_process";
+import { dirname as dirname5, join as join7, resolve as resolve3 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+
+// server/generate.ts
+import { execFile } from "node:child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname4, join as join6, resolve as resolve2 } from "node:path";
+import { promisify } from "node:util";
+import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";
+import { z as z3 } from "zod";
 
 // src/lib/dag.ts
 function storyError(text) {
@@ -215,13 +589,13 @@ function storyError(text) {
 var DagError = class extends Error {
 };
 function label(node) {
-  const name = node.type === "spec" ? node.title : node.text;
+  const name = node.type === "user_story" ? node.text : node.title;
   return `${node.id} ("${name.length > 40 ? `${name.slice(0, 40)}\u2026` : name}")`;
 }
 function dependencyAdjacency(edges) {
   const adj = /* @__PURE__ */ new Map();
   for (const e of edges) {
-    if (e.type !== "dependency") continue;
+    if (e.type !== "stacked") continue;
     const next = adj.get(e.from) ?? [];
     next.push(e.to);
     adj.set(e.from, next);
@@ -251,32 +625,45 @@ function deriveEdge(plan, from, to) {
   if (!toNode) throw new DagError(`unknown node: ${to}`);
   if (fromNode.type === "user_story") {
     throw new DagError(
-      `user stories carry no edges of their own \u2014 ${label(fromNode)} cannot be a link source; link from a spec instead`
+      `user stories carry no edges of their own \u2014 ${label(fromNode)} cannot be a link source; link from a proposal instead`
+    );
+  }
+  if (toNode.type === "capability") {
+    throw new DagError(
+      `capabilities are read-only roots \u2014 ${label(toNode)} cannot be a link target`
     );
   }
   if (from === to) throw new DagError(`cannot link ${label(fromNode)} to itself`);
   if (plan.edges.some((e) => e.from === from && e.to === to)) {
     throw new DagError(`link already exists: ${from} -> ${to}`);
   }
+  if (fromNode.type === "capability") {
+    if (toNode.type === "user_story") {
+      throw new DagError(
+        `capabilities contain no user stories \u2014 ${label(fromNode)} may only target a proposal`
+      );
+    }
+    return { from, to, type: "targets" };
+  }
   if (toNode.type === "user_story") return { from, to, type: "containment" };
   const path = dependencyPath(plan.edges, to, from);
   if (path) {
     const cycle = [from, ...path].map((id) => nodes.get(id)).filter((n) => n !== void 0);
-    throw new DagError(`dependency cycle: ${cycle.map((n) => label(n)).join(" -> ")}`);
+    throw new DagError(`stacked cycle: ${cycle.map((n) => label(n)).join(" -> ")}`);
   }
-  return { from, to, type: "dependency" };
+  return { from, to, type: "stacked" };
 }
 function containedStories(plan, specId) {
   return plan.edges.filter((e) => e.type === "containment" && e.from === specId).map((e) => e.to);
 }
 function specDependencies(plan, specId) {
-  return plan.edges.filter((e) => e.type === "dependency" && e.from === specId).map((e) => e.to);
+  return plan.edges.filter((e) => e.type === "stacked" && e.from === specId).map((e) => e.to);
 }
 function backlog(plan) {
   const linked = new Set(plan.edges.flatMap((e) => [e.from, e.to]));
   const free = plan.nodes.filter((n) => !linked.has(n.id));
   return {
-    specs: sortSiblings(free.filter((n) => n.type === "spec")),
+    specs: sortSiblings(free.filter((n) => n.type === "proposal")),
     stories: sortSiblings(free.filter((n) => n.type === "user_story"))
   };
 }
@@ -305,7 +692,19 @@ function planErrors(plan) {
       errors.push(`user story ${e.from} carries an edge of its own (${e.from} -> ${e.to})`);
       continue;
     }
-    const expected = toNode.type === "user_story" ? "containment" : "dependency";
+    if (toNode.type === "capability") {
+      errors.push(
+        `capability ${e.to} is a read-only root and cannot be a link target (${e.from} -> ${e.to})`
+      );
+      continue;
+    }
+    if (fromNode.type === "capability" && toNode.type === "user_story") {
+      errors.push(
+        `capability ${e.from} contains no user stories \u2014 it may only target a proposal (${e.from} -> ${e.to})`
+      );
+      continue;
+    }
+    const expected = fromNode.type === "capability" ? "targets" : toNode.type === "user_story" ? "containment" : "stacked";
     if (e.type !== expected) {
       errors.push(`edge ${e.from} -> ${e.to} must be type "${expected}", found "${e.type}"`);
     }
@@ -314,28 +713,20 @@ function planErrors(plan) {
     seenEdges.add(key);
   }
   const depEdges = plan.edges.filter(
-    (e) => e.type === "dependency" && byId.has(e.from) && byId.has(e.to)
+    (e) => e.type === "stacked" && byId.has(e.from) && byId.has(e.to)
   );
   for (const e of depEdges) {
     const path = dependencyPath(depEdges, e.to, e.from);
     if (path) {
-      errors.push(`dependency cycle: ${[e.from, ...path].join(" -> ")}`);
+      errors.push(`stacked cycle: ${[e.from, ...path].join(" -> ")}`);
       break;
     }
   }
   return errors;
 }
 
-// server/generate.ts
-import { execFile } from "node:child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
-import { promisify } from "node:util";
-import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";
-
 // server/atomic.ts
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 function writeAtomicFile(target, content) {
   mkdirSync(dirname(target), { recursive: true });
@@ -344,9 +735,389 @@ function writeAtomicFile(target, content) {
   renameSync(tmp, target);
 }
 function readIfExists(target) {
-  return existsSync(target) ? readFileSync(target, "utf8") : void 0;
+  return existsSync2(target) ? readFileSync(target, "utf8") : void 0;
+}
+
+// server/journal.ts
+import { join as join4 } from "node:path";
+
+// ../shared/src/openspec-change-meta.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync4, readdirSync as readdirSync2, realpathSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { Document, parseDocument } from "yaml";
+import { z as z2 } from "zod";
+
+// ../shared/src/fs-atomic.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+function writeAtomicFile2(target, content) {
+  mkdirSync2(dirname2(target), { recursive: true });
+  const tmp = `${target}.tmp`;
+  writeFileSync2(tmp, content, "utf8");
+  renameSync2(tmp, target);
+}
+function readIfExists2(target) {
+  return existsSync3(target) ? readFileSync2(target, "utf8") : void 0;
+}
+
+// ../shared/src/openspec-change-meta.ts
+var CHANGE_META_FILE = "specplan.yaml";
+var nodeChangeMetaFs = {
+  readIfExists(path) {
+    return readIfExists2(path);
+  },
+  writeAtomicFile(path, content) {
+    writeAtomicFile2(path, content);
+  },
+  exists(path) {
+    return existsSync4(path);
+  },
+  readdir(path) {
+    if (!existsSync4(path)) return [];
+    return readdirSync2(path, { withFileTypes: true }).map((entry) => ({
+      name: entry.name,
+      directory: entry.isDirectory()
+    }));
+  },
+  realpath(path) {
+    return realpathSync(path);
+  }
+};
+var sha256 = (s) => createHash("sha256").update(s).digest("hex");
+function listBodyFiles(changeDir, fsx = nodeChangeMetaFs) {
+  const files = [];
+  for (const name of ["proposal.md", "design.md", "tasks.md"]) {
+    if (fsx.exists(join2(changeDir, name))) files.push(name);
+  }
+  const specsDir = join2(changeDir, "specs");
+  for (const entry of fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
+    const rel = join2("specs", entry.name, "spec.md");
+    if (entry.directory && fsx.exists(join2(changeDir, rel))) files.push(rel);
+  }
+  return files;
+}
+function bodyHash(changeDir, fsx = nodeChangeMetaFs) {
+  const files = listBodyFiles(changeDir, fsx);
+  if (files.length === 0) return null;
+  const parts = files.map(
+    (rel) => `${rel}
+${sha256(fsx.readIfExists(join2(changeDir, rel)) ?? "")}`
+  );
+  return `sha256:${sha256(parts.join("\n"))}`;
+}
+var SPEC_STATUSES2 = ["draft", "in-progress"];
+var SpecStatus2 = z2.enum(SPEC_STATUSES2);
+var LEGACY_STATUS_COERCION = {
+  active: "in-progress",
+  done: "in-progress",
+  deferred: "draft"
+};
+var StoredSpecStatus = z2.enum([...SPEC_STATUSES2, "active", "done", "deferred"]).transform(
+  (s) => s in LEGACY_STATUS_COERCION ? LEGACY_STATUS_COERCION[s] : s
+);
+var SpecMetaSchema = z2.object({
+  specId: z2.string(),
+  userStories: z2.array(z2.string()),
+  dependencies: z2.array(z2.string()),
+  /** Working state (retired values coerce on read); absent = draft. */
+  status: StoredSpecStatus.optional(),
+  /**
+   * Approved axis (formerly `applied`) — fold-driven, SEPARATE from the
+   * working status above. True when the proposal's delta has been folded
+   * into specs/ and archived (apply-first: the fold happens at approval).
+   * Absent = not-approved.
+   */
+  approved: z2.boolean().optional(),
+  /**
+   * Legacy spelling of the fold axis (pre-rename metadata files). Read-only
+   * compatibility: readers treat `applied: true` as `approved: true`; no
+   * writer ever sets this field again.
+   */
+  applied: z2.boolean().optional(),
+  /**
+   * Build flag — user-set, independent of the fold: true once the code has
+   * been built to match the approved diff. Absent = not-implemented.
+   */
+  implemented: z2.boolean().optional(),
+  /**
+   * Minimal implementation-task record written on fold (specplan-timeline-apply
+   * "Implementation task record on fold"): the creation time and a reference to
+   * the archived change's own id/path (from which the delta artifact is
+   * materialized on demand). Deliberately carries NO status and NO dispatch
+   * state — task execution/dispatch is a separate, not-yet-defined concern. A
+   * field addition to this sidecar, not a redefinition of its format.
+   */
+  task: z2.object({
+    createdAt: z2.string(),
+    source: z2.string()
+  }).optional(),
+  generation: z2.object({
+    /** sha256 of the last generated body files — detects hand edits. */
+    lastGeneratedBodyHash: z2.string(),
+    lastGeneratedAt: z2.string()
+  }).optional()
+});
+function writeChangeMeta(fsx, changeDir, meta) {
+  const path = join2(changeDir, CHANGE_META_FILE);
+  const raw = fsx.readIfExists(path);
+  const doc = raw === void 0 ? new Document({
+    specId: meta.specId,
+    userStories: meta.userStories ?? [],
+    dependencies: meta.dependencies ?? [],
+    status: meta.status ?? "draft"
+  }) : parseDocument(raw);
+  if (meta.approved !== void 0) doc.setIn(["approved"], meta.approved);
+  if (meta.implemented !== void 0) doc.setIn(["implemented"], meta.implemented);
+  if (meta.task !== void 0) {
+    doc.setIn(["task", "createdAt"], meta.task.createdAt);
+    doc.setIn(["task", "source"], meta.task.source);
+  }
+  if (meta.generation !== void 0) {
+    doc.setIn(["generation", "lastGeneratedBodyHash"], meta.generation.lastGeneratedBodyHash);
+    doc.setIn(["generation", "lastGeneratedAt"], meta.generation.lastGeneratedAt);
+  }
+  fsx.writeAtomicFile(path, doc.toString());
+}
+
+// server/spec-state.ts
+import { dirname as dirname3, join as join3 } from "node:path";
+
+// server/fs-node.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync } from "node:fs";
+var nodeSyncFs = {
+  readIfExists(path) {
+    return readIfExists(path);
+  },
+  writeAtomicFile(path, content) {
+    writeAtomicFile(path, content);
+  },
+  removeFile(path) {
+    rmSync(path, { force: true });
+  },
+  removeDir(path) {
+    rmSync(path, { force: true, recursive: true });
+  },
+  exists(path) {
+    return existsSync5(path);
+  },
+  mkdirp(path) {
+    mkdirSync3(path, { recursive: true });
+  },
+  readdir(path) {
+    if (!existsSync5(path)) return [];
+    return readdirSync3(path, { withFileTypes: true }).map((entry) => ({
+      name: entry.name,
+      directory: entry.isDirectory()
+    }));
+  }
+};
+
+// server/spec-state.ts
+function parseTaskProgress(md) {
+  const items = md.match(/^[ \t]*[-*] \[[ xX]\]/gm) ?? [];
+  if (items.length === 0) return null;
+  const done = items.filter((m) => /\[[xX]\]/.test(m)).length;
+  return { done, total: items.length };
+}
+function readTaskProgress(changeDir, fsx = nodeSyncFs) {
+  const md = fsx.readIfExists(join3(changeDir, "tasks.md"));
+  return md === void 0 ? null : parseTaskProgress(md);
+}
+function parseLedgerStatus(md, specId) {
+  const cellsOf3 = (line) => line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+  let statusIdx = 2;
+  for (const line of md.split(/\r?\n/)) {
+    if (!line.trim().startsWith("|")) continue;
+    const cells = cellsOf3(line);
+    if (cells.every((c) => /^:?-+:?$/.test(c))) continue;
+    const lower = cells.map((c) => c.toLowerCase());
+    if (lower.includes("status") && lower.includes("change")) {
+      statusIdx = lower.indexOf("status");
+      continue;
+    }
+    const first = cells[0] ?? "";
+    if (first.includes(specId)) {
+      const status = cells[statusIdx];
+      if (status) return status;
+    }
+  }
+  return void 0;
+}
+function readLedgerStatus(store, specId) {
+  const md = store.fsx.readIfExists(join3(store.dir, "..", "SPECS.md"));
+  return md === void 0 ? void 0 : parseLedgerStatus(md, specId);
+}
+function specState(store, specId) {
+  const changeDir = dirname3(store.specMetaPath(specId));
+  const currentHash = bodyHash(changeDir, store.fsx);
+  let meta = null;
+  try {
+    meta = store.readSpecMeta(specId);
+  } catch {
+  }
+  const status = meta?.status ?? "draft";
+  const tasks = readTaskProgress(changeDir, store.fsx);
+  const ledgerStatus = readLedgerStatus(store, specId);
+  const projections = {
+    ...tasks ? { tasks } : {},
+    ...ledgerStatus !== void 0 ? { ledgerStatus } : {}
+  };
+  const axes = {
+    ...meta?.approved === true || meta?.applied === true ? { approved: true } : {},
+    ...meta?.implemented === true ? { implemented: true } : {}
+  };
+  if (currentHash === null)
+    return { hasSpec: false, handEdited: false, status, ...axes, ...projections };
+  return {
+    hasSpec: true,
+    handEdited: meta?.generation?.lastGeneratedBodyHash !== currentHash,
+    status,
+    ...axes,
+    ...projections
+  };
+}
+function readDiagram(store, specId) {
+  const changeDir = dirname3(store.specMetaPath(specId));
+  return store.fsx.readIfExists(join3(changeDir, "diagram.excalidraw"));
+}
+function readBodyFiles(store, specId) {
+  const changeDir = dirname3(store.specMetaPath(specId));
+  return listBodyFiles(changeDir, store.fsx).map((rel) => ({ path: rel, content: store.fsx.readIfExists(join3(changeDir, rel)) })).filter((f) => f.content !== void 0);
 }
 
+// server/journal.ts
+var JOURNAL_FILE = "specplan-journal.ndjson";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var PlanJournal = class {
+  constructor(fsx, dir) {
+    this.fsx = fsx;
+    this.dir = dir;
+  }
+  fsx;
+  dir;
+  get path() {
+    return join4(this.dir, JOURNAL_FILE);
+  }
+  /**
+   * The complete (parseable) journal lines as raw strings, in order. A line
+   * that fails to parse — only ever the final line, from a torn write — is
+   * skipped, so the reader always sees whole entries and an append heals the
+   * file. Prior lines are kept as their exact bytes (no re-serialization).
+   */
+  completeLines() {
+    const raw = this.fsx.readIfExists(this.path);
+    if (raw === void 0 || raw === "") return [];
+    const complete = [];
+    for (const line of raw.split("\n")) {
+      if (line.length === 0) continue;
+      try {
+        JSON.parse(line);
+        complete.push(line);
+      } catch {
+      }
+    }
+    return complete;
+  }
+  /** Every complete entry, in append order. Tolerates a torn final line. */
+  read() {
+    return this.completeLines().map((l) => JSON.parse(l));
+  }
+  /**
+   * Append exactly one entry, atomically. Read-modify-write: the prior complete
+   * lines are preserved verbatim, any torn final line is dropped (healed), the
+   * new entry is serialized to one line, and the whole file is rewritten
+   * atomically. `at` defaults to the current ISO timestamp.
+   */
+  append(entry) {
+    const record = { ...entry, at: entry.at ?? (/* @__PURE__ */ new Date()).toISOString() };
+    const lines = this.completeLines();
+    lines.push(JSON.stringify(record));
+    this.fsx.writeAtomicFile(this.path, `${lines.join("\n")}
+`);
+  }
+  /**
+   * Compare the journal's most recent recorded state for each target against
+   * that target's ACTUAL current on-disk state, and report every divergence.
+   * READ-ONLY — it never rewrites the journal, the plan, or the ledger.
+   *
+   * Per target that appears in the journal:
+   *  - if an apply entry recorded `approved: true`: the change must be archived
+   *    (a `changes/archive/*-<id>/` dir must exist), its `changes/<id>/` dir must
+   *    be gone, and its SPECS.md ledger row (when a ledger exists) must read
+   *    approved — each miss is a report;
+   *  - if NO apply was journaled but the change IS archived on disk, a manual
+   *    `openspec archive` ran out-of-band — a report.
+   */
+  reconcile(store) {
+    const byTarget = /* @__PURE__ */ new Map();
+    for (const entry of this.read()) {
+      if (typeof entry.targetId !== "string" || entry.targetId.length === 0) continue;
+      const list = byTarget.get(entry.targetId) ?? [];
+      list.push(entry);
+      byTarget.set(entry.targetId, list);
+    }
+    const reports = [];
+    const ledgerMd = store.fsx.readIfExists(join4(store.dir, "..", "SPECS.md"));
+    for (const [targetId, entries] of byTarget) {
+      const lastApply = [...entries].reverse().find((e) => e.action === "apply");
+      const journaledApproved = lastApply?.approved === true;
+      const archivedDir = this.locateArchived(store, targetId);
+      if (journaledApproved) {
+        if (!archivedDir) {
+          reports.push({
+            targetId,
+            expected: "archived under changes/archive/",
+            actual: "no archived directory found",
+            detail: `journal records approved: true for ${targetId} but no changes/archive/*-${targetId}/ directory exists`
+          });
+        }
+        const activeDir = join4(store.dir, "changes", targetId);
+        if (store.fsx.exists(activeDir) && listBodyFiles(activeDir, store.fsx).length > 0) {
+          reports.push({
+            targetId,
+            expected: "change directory removed (archived)",
+            actual: `changes/${targetId}/ still present`,
+            detail: `journal records approved: true for ${targetId} but its change directory still exists under changes/, unarchived`
+          });
+        }
+        if (ledgerMd !== void 0) {
+          const status = parseLedgerStatus(ledgerMd, targetId);
+          if (status === void 0 || !/^(archived|approved)\b/i.test(status)) {
+            reports.push({
+              targetId,
+              expected: "SPECS.md row status archived",
+              actual: status === void 0 ? "no SPECS.md row" : `SPECS.md row status "${status}"`,
+              detail: `journal records approved: true for ${targetId} but its SPECS.md ledger row ${status === void 0 ? "is missing" : `reads "${status}"`}`
+            });
+          }
+        }
+      } else if (archivedDir) {
+        reports.push({
+          targetId,
+          expected: "not archived (no apply recorded in journal)",
+          actual: `archived on disk at ${archivedDir}`,
+          detail: `${targetId} is archived on disk but the journal has no apply entry \u2014 a manual \`openspec archive\` likely ran outside the app`
+        });
+      }
+    }
+    return reports;
+  }
+  /**
+   * The `changes/archive/YYYY-MM-DD-<targetId>/` directory (newest if several),
+   * relative to the openspec root, or null when none exists.
+   */
+  locateArchived(store, targetId) {
+    const archiveDir = join4(store.dir, "changes", "archive");
+    const re = new RegExp(`^\\d{4}-\\d{2}-\\d{2}-${escapeRegExp(targetId)}$`);
+    const names = store.fsx.readdir(archiveDir).filter((e) => e.directory && re.test(e.name)).map((e) => e.name).sort();
+    const newest = names[names.length - 1];
+    return newest ? join4("changes", "archive", newest) : null;
+  }
+};
+
 // server/model.ts
 var FABLE_BETAS = ["server-side-fallback-2026-06-01"];
 var FABLE_FALLBACKS = [{ model: "claude-opus-4-8" }];
@@ -373,8 +1144,8 @@ function toolUsesOf(msg) {
 }
 
 // server/references.ts
-import { readFileSync as readFileSync2, readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { readFileSync as readFileSync3, readdirSync as readdirSync4, realpathSync as realpathSync2, statSync } from "node:fs";
+import { basename, isAbsolute, join as join5, normalize, relative, resolve, sep } from "node:path";
 var REF_FILE_BYTE_LIMIT = 64 * 1024;
 var REF_TOTAL_BYTE_LIMIT = 256 * 1024;
 var REF_DIR_FILE_LIMIT = 50;
@@ -400,14 +1171,14 @@ function collectEntries(root) {
     if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
       if (SEARCH_IGNORE.has(entry.name) || entry.isSymbolicLink()) continue;
-      const full = join(dir, entry.name);
+      const full = join5(dir, entry.name);
       if (entry.isDirectory()) {
         dirs.push(relative(root, full));
         walk(full);
@@ -429,7 +1200,7 @@ function searchFiles(root, query, limit = FILE_SEARCH_LIMIT) {
   if (root === void 0) return [];
   let rootReal;
   try {
-    rootReal = realpathSync(resolve(root));
+    rootReal = realpathSync2(resolve(root));
   } catch {
     return [];
   }
@@ -450,7 +1221,7 @@ function searchFiles(root, query, limit = FILE_SEARCH_LIMIT) {
   ).slice(0, limit).map(({ p }) => p);
 }
 function readClamped(target) {
-  const raw = readFileSync2(target);
+  const raw = readFileSync3(target);
   if (raw.byteLength <= REF_FILE_BYTE_LIMIT) {
     return { content: raw.toString("utf8"), truncated: false };
   }
@@ -468,7 +1239,7 @@ function expandReferences(text, root) {
   let rootReal = null;
   if (root !== void 0) {
     try {
-      rootReal = realpathSync(resolve(root));
+      rootReal = realpathSync2(resolve(root));
     } catch {
       rootReal = null;
     }
@@ -494,7 +1265,7 @@ function expandReferences(text, root) {
         if (included >= REF_DIR_FILE_LIMIT || totalBytes >= REF_TOTAL_BYTE_LIMIT) break;
         let body;
         try {
-          body = readClamped(join(rootReal, relPath));
+          body = readClamped(join5(rootReal, relPath));
         } catch {
           continue;
         }
@@ -534,14 +1305,14 @@ function resolveOne(rootReal, ref) {
   if (stats?.isDirectory()) {
     let real;
     try {
-      real = realpathSync(direct);
+      real = realpathSync2(direct);
     } catch {
       return { reason: "not readable" };
     }
     if (real !== rootReal && !insideRoot(rootReal, real)) {
       return { reason: "resolves outside the working directory" };
     }
-    const dirFiles = collectFiles(direct).map((p) => relative(rootReal, join(direct, p))).sort((a, b) => {
+    const dirFiles = collectFiles(direct).map((p) => relative(rootReal, join5(direct, p))).sort((a, b) => {
       const depth = a.split(sep).length - b.split(sep).length;
       return depth !== 0 ? depth : a.localeCompare(b);
     });
@@ -551,7 +1322,7 @@ function resolveOne(rootReal, ref) {
   if (stats?.isFile()) {
     let real;
     try {
-      real = realpathSync(direct);
+      real = realpathSync2(direct);
     } catch {
       return { reason: "not readable" };
     }
@@ -567,7 +1338,7 @@ function resolveOne(rootReal, ref) {
   if (matches.length === 0) return { reason: "not found" };
   const best = matches[0];
   try {
-    const body = readClamped(join(rootReal, best));
+    const body = readClamped(join5(rootReal, best));
     return {
       path: best,
       ...body,
@@ -603,78 +1374,6 @@ ${note}${r.content}
   return parts.join("\n\n");
 }
 
-// server/spec-state.ts
-import { createHash } from "node:crypto";
-import { dirname as dirname2, join as join2 } from "node:path";
-
-// server/fs-node.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2 } from "node:fs";
-var nodeSyncFs = {
-  readIfExists(path) {
-    return readIfExists(path);
-  },
-  writeAtomicFile(path, content) {
-    writeAtomicFile(path, content);
-  },
-  exists(path) {
-    return existsSync2(path);
-  },
-  mkdirp(path) {
-    mkdirSync2(path, { recursive: true });
-  },
-  readdir(path) {
-    if (!existsSync2(path)) return [];
-    return readdirSync2(path, { withFileTypes: true }).map((entry) => ({
-      name: entry.name,
-      directory: entry.isDirectory()
-    }));
-  }
-};
-
-// server/spec-state.ts
-var sha256 = (s) => createHash("sha256").update(s).digest("hex");
-function listBodyFiles(changeDir, fsx = nodeSyncFs) {
-  const files = [];
-  for (const name of ["proposal.md", "design.md", "tasks.md"]) {
-    if (fsx.exists(join2(changeDir, name))) files.push(name);
-  }
-  const specsDir = join2(changeDir, "specs");
-  for (const entry of fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
-    const rel = join2("specs", entry.name, "spec.md");
-    if (entry.directory && fsx.exists(join2(changeDir, rel))) files.push(rel);
-  }
-  return files;
-}
-function bodyHash(changeDir, fsx = nodeSyncFs) {
-  const files = listBodyFiles(changeDir, fsx);
-  if (files.length === 0) return null;
-  const parts = files.map(
-    (rel) => `${rel}
-${sha256(fsx.readIfExists(join2(changeDir, rel)) ?? "")}`
-  );
-  return `sha256:${sha256(parts.join("\n"))}`;
-}
-function specState(store, specId) {
-  const changeDir = dirname2(store.specMetaPath(specId));
-  const currentHash = bodyHash(changeDir, store.fsx);
-  let meta = null;
-  try {
-    meta = store.readSpecMeta(specId);
-  } catch {
-  }
-  const status = meta?.status ?? "draft";
-  if (currentHash === null) return { hasSpec: false, handEdited: false, status };
-  return {
-    hasSpec: true,
-    handEdited: meta?.generation?.lastGeneratedBodyHash !== currentHash,
-    status
-  };
-}
-function readBodyFiles(store, specId) {
-  const changeDir = dirname2(store.specMetaPath(specId));
-  return listBodyFiles(changeDir, store.fsx).map((rel) => ({ path: rel, content: store.fsx.readIfExists(join2(changeDir, rel)) })).filter((f) => f.content !== void 0);
-}
-
 // server/generate.ts
 var SYSTEM = `You are a principal software architect and specification writer.
 Given one planned spec card from a project roadmap \u2014 its title, the user stories it
@@ -713,16 +1412,16 @@ var GenerationFailed = class extends Error {
 };
 function resolveOpenspecBin() {
   const require2 = createRequire(import.meta.url);
-  let dir = dirname3(require2.resolve("@fission-ai/openspec"));
+  let dir = dirname4(require2.resolve("@fission-ai/openspec"));
   for (; ; ) {
-    const pkgPath = join3(dir, "package.json");
-    if (existsSync3(pkgPath)) {
-      const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const pkgPath = join6(dir, "package.json");
+    if (existsSync6(pkgPath)) {
+      const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
       if (pkg.name === "@fission-ai/openspec" && pkg.bin) {
-        return join3(dir, typeof pkg.bin === "string" ? pkg.bin : pkg.bin.openspec ?? "");
+        return join6(dir, typeof pkg.bin === "string" ? pkg.bin : pkg.bin.openspec ?? "");
       }
     }
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) throw new Error("could not locate the @fission-ai/openspec bin");
     dir = parent;
   }
@@ -733,7 +1432,7 @@ async function runOpenspecValidate(specId, rootDir) {
     const { stdout, stderr } = await promisify(execFile)(
       process.execPath,
       [bin, "validate", specId, "--strict"],
-      { cwd: dirname3(resolve2(rootDir)) }
+      { cwd: dirname4(resolve2(rootDir)) }
     );
     return { ok: true, output: `${stdout}${stderr}`.trim() };
   } catch (err) {
@@ -762,7 +1461,7 @@ Produce the OpenSpec change proposal for exactly this spec as structured output.
 Use exactly "${spec.id}" as the changeName.`;
 }
 function renderBaseline(changeDir) {
-  const sections = listBodyFiles(changeDir).map((rel) => ({ rel, content: readIfExists(join3(changeDir, rel)) })).filter((f) => f.content !== void 0).map((f) => `--- ${f.rel} ---
+  const sections = listBodyFiles(changeDir).map((rel) => ({ rel, content: readIfExists(join6(changeDir, rel)) })).filter((f) => f.content !== void 0).map((f) => `--- ${f.rel} ---
 ${f.content}`);
   if (sections.length === 0) return "";
   return `
@@ -777,25 +1476,32 @@ function writeBundle(changeDir, bundle) {
     "design.md": bundle.design,
     "tasks.md": bundle.tasks
   };
-  for (const s of bundle.specs) files[join3("specs", s.capability, "spec.md")] = s.spec;
+  for (const s of bundle.specs) files[join6("specs", s.capability, "spec.md")] = s.spec;
   const written = [];
   for (const [rel, content] of Object.entries(files)) {
-    if (readIfExists(join3(changeDir, rel)) === content) continue;
-    writeAtomicFile(join3(changeDir, rel), content);
+    if (readIfExists(join6(changeDir, rel)) === content) continue;
+    writeAtomicFile(join6(changeDir, rel), content);
     written.push(rel);
   }
   return written;
 }
+var SPEC_BUNDLE_SCHEMA = z3.toJSONSchema(SpecBundle, { target: "draft-7" });
 async function generateForSpec(deps, specId, model = DEFAULT_MODEL) {
   const { store } = deps;
   const plan = store.load();
   const node = plan.nodes.find((n) => n.id === specId);
-  if (!node || node.type !== "spec") {
+  if (!node || node.type !== "proposal") {
     throw new GenerationFailed(`unknown spec: ${specId}`, 400);
   }
+  if (specState(store, specId).approved) {
+    throw new GenerationFailed(
+      `${specId} is approved: its OpenSpec delta has already been folded into specs/ and archived. Generation is refused \u2014 it would recreate an already-archived change id under changes/. Create a new proposal instead.`,
+      409
+    );
+  }
   const stories = storyNodes(plan, specId);
   const depSpecs = depNodes(plan, specId);
-  const changeDir = dirname3(store.specMetaPath(specId));
+  const changeDir = dirname4(store.specMetaPath(specId));
   store.writeSpecMeta(
     specId,
     stories.map((s) => s.id),
@@ -805,6 +1511,7 @@ async function generateForSpec(deps, specId, model = DEFAULT_MODEL) {
   if (currentHash !== null) {
     const recorded = store.readSpecMeta(specId)?.generation?.lastGeneratedBodyHash;
     if (recorded !== currentHash) {
+      journalGenerate(store, specId, "metadata-only");
       return { specId, mode: "metadata-only", changedFiles: ["specplan.yaml"] };
     }
   }
@@ -824,22 +1531,59 @@ async function generateForSpec(deps, specId, model = DEFAULT_MODEL) {
 Referenced files (resolved from @-references in the input):
 
 ${refContext}` : "");
-  const msg = await parseWithModelGate(deps.anthropic, {
-    model,
-    max_tokens: 16e3,
-    // non-streaming stays under the SDK HTTP timeout
-    system,
-    messages: [{ role: "user", content: prompt }],
-    output_config: { format: zodOutputFormat(SpecBundle) }
-    // No temperature/top_p or thinking config — both 400 on modern models.
-  });
-  if (msg.stop_reason === "refusal") {
-    throw new GenerationFailed(`the model refused this generation`, 422);
-  }
-  if (!msg.parsed_output) {
-    throw new GenerationFailed("model returned no structured output", 502);
+  let output;
+  if (deps.harness) {
+    const profile = defaultHeadlessProfile("specplan-generate");
+    let structured;
+    let resultText = "";
+    let resultError = false;
+    for await (const ev of deps.harness.run({
+      prompt: `${system}
+
+${prompt}`,
+      cwd: deps.refRoot ?? process.cwd(),
+      session: specId,
+      profile,
+      outputSchema: SPEC_BUNDLE_SCHEMA
+    })) {
+      if (ev.type === "result") {
+        structured = ev.structuredOutput;
+        resultText = ev.text;
+        resultError = ev.isError;
+      }
+    }
+    if (structured === void 0) {
+      throw new GenerationFailed(
+        resultError ? resultText || "the agent run failed" : "model returned no structured output",
+        502
+      );
+    }
+    const parsed = SpecBundle.safeParse(structured);
+    if (!parsed.success) {
+      throw new GenerationFailed(
+        `model returned structured output that does not match the SpecBundle schema: ${parsed.error.message}`,
+        502
+      );
+    }
+    output = parsed.data;
+  } else {
+    const msg = await parseWithModelGate(deps.anthropic, {
+      model,
+      max_tokens: 16e3,
+      // non-streaming stays under the SDK HTTP timeout
+      system,
+      messages: [{ role: "user", content: prompt }],
+      output_config: { format: zodOutputFormat(SpecBundle) }
+      // No temperature/top_p or thinking config — both 400 on modern models.
+    });
+    if (msg.stop_reason === "refusal") {
+      throw new GenerationFailed(`the model refused this generation`, 422);
+    }
+    if (!msg.parsed_output) {
+      throw new GenerationFailed("model returned no structured output", 502);
+    }
+    output = SpecBundle.parse(msg.parsed_output);
   }
-  const output = SpecBundle.parse(msg.parsed_output);
   const bundle = { ...output, changeName: specId };
   const changedFiles = writeBundle(changeDir, bundle);
   store.writeGeneration(specId, bodyHash(changeDir) ?? "", (/* @__PURE__ */ new Date()).toISOString());
@@ -851,23 +1595,214 @@ ${verdict.output}`,
       422
     );
   }
+  journalGenerate(store, specId, "generated");
   return { specId, mode: "generated", changedFiles };
 }
+function journalGenerate(store, specId, mode) {
+  new PlanJournal(store.fsx, store.dir).append({
+    action: "generate",
+    targetId: specId,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    mode
+  });
+}
 function storyNodes(plan, specId) {
   const byId = new Map(plan.nodes.map((n) => [n.id, n]));
   return containedStories(plan, specId).map((id) => byId.get(id)).filter((n) => n?.type === "user_story");
 }
 function depNodes(plan, specId) {
   const byId = new Map(plan.nodes.map((n) => [n.id, n]));
-  return specDependencies(plan, specId).map((id) => byId.get(id)).filter((n) => n?.type === "spec");
+  return specDependencies(plan, specId).map((id) => byId.get(id)).filter((n) => n?.type === "proposal");
 }
 
+// server/apply.ts
+import { materializeDeltaArtifact } from "@coopcli/shared/materialize-delta";
+var ApplyFailed = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+async function runOpenspecArchive(specId, rootDir) {
+  const bin = resolveOpenspecBin();
+  try {
+    const { stdout, stderr } = await promisify2(execFile2)(
+      process.execPath,
+      [bin, "archive", specId, "--yes"],
+      { cwd: dirname5(resolve3(rootDir)) }
+    );
+    return { ok: true, output: `${stdout}${stderr}`.trim() };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      output: `${e.stdout ?? ""}${e.stderr ?? ""}`.trim() || (e.message ?? String(err))
+    };
+  }
+}
+async function applyForSpec(deps, specId, opts = {}) {
+  const { store } = deps;
+  const runValidate = deps.runValidate ?? runOpenspecValidate;
+  const runArchive = deps.runArchive ?? runOpenspecArchive;
+  const node = store.load().nodes.find((n) => n.id === specId);
+  if (!node || node.type !== "proposal") {
+    throw new ApplyFailed(`unknown spec: ${specId}`, 400);
+  }
+  const state = specState(store, specId);
+  if (state.approved === true) {
+    throw new ApplyFailed(
+      `${specId} is already approved (folded and archived) \u2014 apply is a one-way transition`,
+      409
+    );
+  }
+  const verdict = await runValidate(specId, store.dir);
+  if (!verdict.ok) {
+    throw new ApplyFailed(
+      `\`openspec validate ${specId} --strict\` failed:
+${verdict.output}`,
+      422
+    );
+  }
+  if (state.handEdited && !opts.confirmHandEdit) {
+    throw new ApplyFailed(
+      `${specId}'s body was hand-edited since it was last generated \u2014 re-run with --confirm-hand-edit to fold it anyway`,
+      409
+    );
+  }
+  const fingerprint = bodyHash(dirname5(store.specMetaPath(specId)), store.fsx);
+  const archived = await runArchive(specId, store.dir);
+  if (!archived.ok) {
+    throw new ApplyFailed(`\`openspec archive ${specId}\` failed:
+${archived.output}`, 502);
+  }
+  const archivedRelDir = locateArchivedDir(store, specId);
+  if (!archivedRelDir) {
+    throw new ApplyFailed(
+      `\`openspec archive ${specId}\` reported success but its archived directory could not be located under changes/archive/`,
+      502
+    );
+  }
+  store.markApplied(specId, archivedRelDir, {
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source: archivedRelDir
+  });
+  const newCapabilities = store.adoptExistingCapabilities().map((n) => n.id);
+  const ledgerRow = maintainLedgerRow(store, specId, archivedRelDir);
+  new PlanJournal(store.fsx, store.dir).append({
+    action: "apply",
+    targetId: specId,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    approved: true,
+    fingerprint
+  });
+  return { specId, approved: true, archivedTo: archivedRelDir, newCapabilities, ledgerRow };
+}
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function locateArchivedDir(store, specId) {
+  const archiveDir = join7(store.dir, "changes", "archive");
+  const re = new RegExp(`^\\d{4}-\\d{2}-\\d{2}-${escapeRegExp2(specId)}$`);
+  const names = store.fsx.readdir(archiveDir).filter((e) => e.directory && re.test(e.name)).map((e) => e.name).sort();
+  const newest = names[names.length - 1];
+  return newest ? join7("changes", "archive", newest) : null;
+}
+var ARCHIVED_LEDGER_STATUS = "archived";
+function cellsOf(line) {
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+}
+function replaceStatusCell(rawLine, statusIdx, next) {
+  const parts = rawLine.split("|");
+  const idx = statusIdx + 1;
+  const seg = parts[idx];
+  if (seg === void 0) return rawLine;
+  const leading = seg.match(/^\s*/)?.[0] ?? " ";
+  const trailing = seg.match(/\s*$/)?.[0] ?? " ";
+  parts[idx] = `${leading}${next}${trailing}`;
+  return parts.join("|");
+}
+function deriveDomains(store, archivedRelDir) {
+  const specsDir = join7(store.dir, archivedRelDir, "specs");
+  const caps = store.fsx.readdir(specsDir).filter((e) => e.directory).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+  return caps.length > 0 ? caps.join(", ") : "(unknown)";
+}
+function activeTableInsertIndex(lines) {
+  let sawActive = false;
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (/^##\s+active changes/i.test(trimmed)) {
+      sawActive = true;
+      continue;
+    }
+    if (!sawActive) continue;
+    if (trimmed.startsWith("|")) {
+      const cells = cellsOf(lines[i]);
+      if (cells.every((c) => /^:?-+:?$/.test(c))) return i + 1;
+    }
+  }
+  return null;
+}
+function freshLedger(row) {
+  return `# Spec Ledger
+
+## Active changes
+
+| Change | Domains | Status | Notes |
+|---|---|---|---|
+${row}
+`;
+}
+function maintainLedgerRow(store, specId, archivedRelDir) {
+  const ledgerPath = join7(store.dir, "..", "SPECS.md");
+  const md = store.fsx.readIfExists(ledgerPath);
+  const archivedBase = archivedRelDir.split("/").pop() ?? archivedRelDir;
+  const token = `\`${specId}\``;
+  if (md !== void 0) {
+    const lines = md.split("\n");
+    let statusIdx = 2;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line.trim().startsWith("|")) continue;
+      const cells = cellsOf(line);
+      if (cells.every((c) => /^:?-+:?$/.test(c))) continue;
+      const lower = cells.map((c) => c.toLowerCase());
+      if (lower.includes("status") && lower.includes("change")) {
+        statusIdx = lower.indexOf("status");
+        continue;
+      }
+      if ((cells[0] ?? "").includes(token)) {
+        lines[i] = replaceStatusCell(line, statusIdx, ARCHIVED_LEDGER_STATUS);
+        store.fsx.writeAtomicFile(ledgerPath, lines.join("\n"));
+        return "updated";
+      }
+    }
+    const row2 = `| ${token} (archived \`${archivedBase}\`) | ${deriveDomains(store, archivedRelDir)} | ${ARCHIVED_LEDGER_STATUS} | (auto-created by specplan apply) |`;
+    const insertAt = activeTableInsertIndex(lines);
+    if (insertAt !== null) {
+      lines.splice(insertAt, 0, row2);
+      store.fsx.writeAtomicFile(ledgerPath, lines.join("\n"));
+      return "created";
+    }
+    store.fsx.writeAtomicFile(ledgerPath, `${md.replace(/\n*$/, "")}
+
+${freshLedger(row2)}`);
+    return "created";
+  }
+  const row = `| ${token} (archived \`${archivedBase}\`) | ${deriveDomains(store, archivedRelDir)} | ${ARCHIVED_LEDGER_STATUS} | (auto-created by specplan apply) |`;
+  store.fsx.writeAtomicFile(ledgerPath, freshLedger(row));
+  return "created";
+}
+
+// server/app.ts
+import { Hono } from "hono";
+
 // server/plan-routes.ts
-import { basename as basename3 } from "node:path";
+import { basename as basename3, join as join9 } from "node:path";
 
 // server/store.ts
-import { basename as basename2, join as join4, resolve as resolve3 } from "node:path";
-import { Document, parseDocument } from "yaml";
+import { basename as basename2, join as join8, resolve as resolve4 } from "node:path";
+import { Document as Document2, isMap, isScalar, isSeq, parseDocument as parseDocument2 } from "yaml";
 
 // server/ulid.ts
 var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -929,30 +1864,132 @@ var PlanFileError = class extends Error {
 };
 var ROOT_FILE = "specplan.yaml";
 var META_FILE = "specplan.yaml";
+var CURRENT_PLAN_VERSION = 3;
 var PlanStore = class {
   /** Resolved openspec root directory. */
   dir;
   /** IO substrate — real disk by default, in-memory for the cloud target. */
   fsx;
   constructor(dir, fsx = nodeSyncFs) {
-    this.dir = resolve3(dir);
+    this.dir = resolve4(dir);
     this.fsx = fsx;
     this.fsx.mkdirp(this.dir);
   }
-  // ── Root file ────────────────────────────────────────────────────────────
-  rootPath() {
-    return join4(this.dir, ROOT_FILE);
+  // ── Root file ────────────────────────────────────────────────────────────
+  rootPath() {
+    return join8(this.dir, ROOT_FILE);
+  }
+  loadDoc() {
+    const raw = this.fsx.readIfExists(this.rootPath());
+    if (raw === void 0) {
+      return new Document2({ version: CURRENT_PLAN_VERSION, nodes: [], edges: [] });
+    }
+    const doc = parseDocument2(raw);
+    const fault = doc.errors[0];
+    if (fault) throw new PlanFileError(`${ROOT_FILE}: ${fault.message}`);
+    if (doc.getIn(["nodes"]) === void 0) doc.setIn(["nodes"], doc.createNode([]));
+    if (doc.getIn(["edges"]) === void 0) doc.setIn(["edges"], doc.createNode([]));
+    this.migrate(doc);
+    return doc;
+  }
+  /**
+   * The ordered forward-migration chain: `migrations[n]` transforms a
+   * document that is AT version n into the version-`n+1` SHAPE (the runner
+   * stamps the version after each step). Steps operate on the yaml Document —
+   * never a `toJS()` projection — so hand-written comments survive
+   * byte-for-byte, and each runs only while the file is below
+   * `CURRENT_PLAN_VERSION`, so re-reading a migrated file is a no-op. The
+   * whole run is persisted in ONE atomic write (see `migrate`).
+   */
+  migrations = {
+    // v1 → v2: the split node model (see migrateV1toV2).
+    1: (doc) => this.migrateV1toV2(doc),
+    // v2 → v3 (positions-drop): free pixel positions are no longer
+    // persisted in the plan file — a card's durable placement is its grid
+    // slot (spec-row membership + `order`), and any residual sidecar pixel
+    // positions are ignored on read + stripped at the workspace boundary.
+    // Nothing in specplan.yaml changes; this step is a pure version stamp.
+    2: () => {
+    }
+  };
+  /**
+   * Run the forward-migration chain in place, then persist once. The declared
+   * version is read from the doc (a hand skeleton without one is treated as
+   * v1). A version ABOVE `CURRENT_PLAN_VERSION` is refused BEFORE any write —
+   * an older build must never silently downgrade or corrupt a plan a newer
+   * build authored. A version AT current is a no-op (the file is not
+   * rewritten). Otherwise each `v → v+1` step runs in sequence, the version
+   * is stamped after each, and the result is written in a single atomic save
+   * so a throw mid-chain can never leave a half-migrated file behind.
+   */
+  migrate(doc) {
+    const declared = doc.getIn(["version"]);
+    let version = typeof declared === "number" ? declared : 1;
+    if (version > CURRENT_PLAN_VERSION) {
+      throw new PlanFileError(
+        `${ROOT_FILE}: plan file is version ${version}, but this specplan understands version ${CURRENT_PLAN_VERSION} at most \u2014 upgrade specplan; the file was not modified`
+      );
+    }
+    if (version === CURRENT_PLAN_VERSION) return;
+    while (version < CURRENT_PLAN_VERSION) {
+      this.migrations[version]?.(doc);
+      version += 1;
+      doc.setIn(["version"], version);
+    }
+    this.save(doc);
+  }
+  /**
+   * The v1 → v2 forward step (split node model). Operates on the yaml
+   * Document — never a `toJS()` projection — so hand-written comments survive
+   * byte-for-byte. Per node: `type: spec` → `type: proposal` with every other
+   * field untouched; a proposal whose `specFile` sits under `changes/archive/`
+   * is stamped `approved: true` in its metadata file (fold-driven axis — an
+   * archived change IS a folded/approved one). Per edge: `type: dependency` →
+   * `type: stacked` (the ratified vocabulary rename; endpoints never move).
+   * `user_story` nodes and all edge endpoints are untouched. The chain owns
+   * the version stamp; this step performs only the v1→v2 content substitutions.
+   */
+  migrateV1toV2(doc) {
+    const nodes = doc.getIn(["nodes"]);
+    if (isSeq(nodes)) {
+      for (const node of nodes.items) {
+        if (!isMap(node)) continue;
+        const type = node.get("type", true);
+        if (!isScalar(type) || type.value !== "spec") continue;
+        type.value = "proposal";
+        const specFile = node.get("specFile");
+        if (typeof specFile === "string" && specFile.includes("changes/archive/")) {
+          this.stampApprovedAt(String(node.get("id") ?? ""), specFile);
+        }
+      }
+    }
+    const edges = doc.getIn(["edges"]);
+    if (isSeq(edges)) {
+      for (const edge of edges.items) {
+        if (!isMap(edge)) continue;
+        const type = edge.get("type", true);
+        if (isScalar(type) && type.value === "dependency") type.value = "stacked";
+      }
+    }
   }
-  loadDoc() {
-    const raw = this.fsx.readIfExists(this.rootPath());
-    if (raw === void 0) return new Document({ version: 1, nodes: [], edges: [] });
-    const doc = parseDocument(raw);
-    const fault = doc.errors[0];
-    if (fault) throw new PlanFileError(`${ROOT_FILE}: ${fault.message}`);
-    if (doc.getIn(["version"]) === void 0) doc.setIn(["version"], 1);
-    if (doc.getIn(["nodes"]) === void 0) doc.setIn(["nodes"], doc.createNode([]));
-    if (doc.getIn(["edges"]) === void 0) doc.setIn(["edges"], doc.createNode([]));
-    return doc;
+  /**
+   * Migration helper: stamp `approved: true` in the metadata file the node's
+   * `specFile` names (archived changes live under changes/archive/, NOT at
+   * specMetaPath). Preserves comments by editing the existing document;
+   * creates a minimal one when absent; never rewrites an unparseable file.
+   */
+  stampApprovedAt(specId, specFile) {
+    const prefix = `${basename2(this.dir)}/`;
+    const rel = specFile.startsWith(prefix) ? specFile.slice(prefix.length) : specFile;
+    try {
+      const path = join8(this.dir, rel);
+      const raw = this.fsx.readIfExists(path);
+      const doc = raw === void 0 ? new Document2({ specId, userStories: [], dependencies: [] }) : parseDocument2(raw);
+      if (doc.errors.length > 0) return;
+      doc.setIn(["approved"], true);
+      this.fsx.writeAtomicFile(path, doc.toString());
+    } catch {
+    }
   }
   planOf(doc) {
     const parsed = Plan.safeParse(doc.toJS());
@@ -981,7 +2018,7 @@ var PlanStore = class {
     return orders.length === 0 ? 0 : Math.max(...orders) + 1;
   }
   // ── Mutations (canvas routes and chat tools share these) ─────────────────
-  createSpec(title, description) {
+  createProposal(title, description) {
     const trimmed = title.trim();
     if (!trimmed) throw new DagError("spec title must not be empty");
     const doc = this.loadDoc();
@@ -989,11 +2026,11 @@ var PlanStore = class {
     const id = this.mintId("spec", new Set(plan.nodes.map((n) => n.id)));
     const node = {
       id,
-      type: "spec",
+      type: "proposal",
       title: trimmed,
       ...description?.trim() ? { description: description.trim() } : {},
       specFile: `${basename2(this.dir)}/changes/${id}/${META_FILE}`,
-      order: this.nextOrder(plan, "spec")
+      order: this.nextOrder(plan, "proposal")
     };
     doc.addIn(["nodes"], node);
     this.save(doc);
@@ -1004,7 +2041,7 @@ var PlanStore = class {
   initSpecMeta(specId) {
     this.fsx.writeAtomicFile(
       this.specMetaPath(specId),
-      new Document({
+      new Document2({
         specId,
         userStories: [],
         dependencies: [],
@@ -1029,15 +2066,20 @@ var PlanStore = class {
     this.save(doc);
     return node;
   }
-  /** Add an edge; the type is derived (spec→spec dependency, spec→story containment). */
+  /**
+   * Add an edge; the type is derived (proposal→proposal stacked,
+   * proposal→story containment, capability→proposal targets).
+   */
   link(from, to) {
     const doc = this.loadDoc();
     const plan = this.planOf(doc);
     const edge = deriveEdge(plan, from, to);
     doc.addIn(["edges"], edge);
     this.save(doc);
-    const next = { ...plan, edges: [...plan.edges, edge] };
-    this.writeSpecMeta(from, containedStories(next, from), specDependencies(next, from));
+    if (plan.nodes.find((n) => n.id === from)?.type === "proposal") {
+      const next = { ...plan, edges: [...plan.edges, edge] };
+      this.writeSpecMeta(from, containedStories(next, from), specDependencies(next, from));
+    }
     return edge;
   }
   /**
@@ -1053,10 +2095,50 @@ var PlanStore = class {
     if (!edge) throw new DagError(`no link exists: ${from} -> ${to}`);
     doc.deleteIn(["edges", idx]);
     this.save(doc);
-    const next = { ...plan, edges: plan.edges.filter((_, i) => i !== idx) };
-    this.writeSpecMeta(from, containedStories(next, from), specDependencies(next, from));
+    if (plan.nodes.find((n) => n.id === from)?.type === "proposal") {
+      const next = { ...plan, edges: plan.edges.filter((_, i) => i !== idx) };
+      this.writeSpecMeta(from, containedStories(next, from), specDependencies(next, from));
+    }
     return edge;
   }
+  /**
+   * Drop a proposal node and every edge touching it — the counterpart to
+   * `adoptExistingChanges`, which adds a node for every change directory and
+   * (until this existed) never removed one.
+   *
+   * Deleting a change without this leaves a node whose `specFile` points at a
+   * directory that is gone: a dangling reference on the canvas, which is the
+   * SAME failure as the stale roadmap row this change exists to fix. Observed
+   * live — deleting a scratch change left its node behind in `specplan.yaml`.
+   *
+   * Returns false when no such node exists, which is not an error: a change can
+   * be deleted before the plan ever adopted it.
+   */
+  removeProposal(nodeId) {
+    const doc = this.loadDoc();
+    const plan = this.planOf(doc);
+    const idx = plan.nodes.findIndex((n) => n.id === nodeId);
+    if (idx < 0) return false;
+    const doomed = plan.edges.map((edge, i) => ({ edge, i })).filter(({ edge }) => edge.from === nodeId || edge.to === nodeId).map(({ i }) => i).reverse();
+    for (const i of doomed) doc.deleteIn(["edges", i]);
+    doc.deleteIn(["nodes", idx]);
+    this.save(doc);
+    const next = {
+      ...plan,
+      nodes: plan.nodes.filter((_, i) => i !== idx),
+      edges: plan.edges.filter((e) => e.from !== nodeId && e.to !== nodeId)
+    };
+    for (const source of new Set(
+      plan.edges.filter((e) => e.to === nodeId).map((e) => e.from)
+    )) {
+      if (next.nodes.find((n) => n.id === source)?.type !== "proposal") continue;
+      try {
+        this.writeSpecMeta(source, containedStories(next, source), specDependencies(next, source));
+      } catch {
+      }
+    }
+    return true;
+  }
   /** Update one node's sibling `order` hint. Never touches edges. */
   reorder(nodeId, order) {
     const doc = this.loadDoc();
@@ -1068,22 +2150,42 @@ var PlanStore = class {
     this.save(doc);
     return { ...node, order };
   }
+  /**
+   * Reflow a whole row (snap-grid drag-to-place): assign each node in
+   * `orderedIds` its column rank as the new `order`, in ONE atomic write — the
+   * insert-and-reflow of a drop must never be N separate `reorder` calls.
+   * Surgical `setIn` per node so hand-written comments survive. Never touches
+   * edges. Rejects an unknown id BEFORE any write (the file is left untouched).
+   */
+  arrangeRow(orderedIds) {
+    const doc = this.loadDoc();
+    const plan = this.planOf(doc);
+    const indexById = new Map(plan.nodes.map((n, i) => [n.id, i]));
+    for (const id of orderedIds) {
+      if (!indexById.has(id)) throw new DagError(`unknown node: ${id}`);
+    }
+    orderedIds.forEach((id, order) => {
+      doc.setIn(["nodes", indexById.get(id), "order"], order);
+    });
+    this.save(doc);
+    return orderedIds.map((id, order) => ({ ...plan.nodes[indexById.get(id)], order }));
+  }
   /**
    * Adopt pre-existing OpenSpec change directories (layered-storage:
    * "Landing existing changes on the canvas"): every directory under
    * <root>/changes/ — except `archive` — that is not yet a node becomes a
-   * spec node whose id IS the change-dir basename (the D5 rule), with its
-   * per-spec metadata file initialized when missing. Idempotent; runs on
-   * every session load so a change dir created mid-session lands on the
+   * proposal node whose id IS the change-dir basename (the D5 rule), with
+   * its per-spec metadata file initialized when missing. Idempotent; runs
+   * on every session load so a change dir created mid-session lands on the
    * next refresh. Never touches a change's body files.
    */
   adoptExistingChanges() {
-    const changesDir = join4(this.dir, "changes");
+    const changesDir = join8(this.dir, "changes");
     if (!this.fsx.exists(changesDir)) return [];
     const doc = this.loadDoc();
     const plan = this.planOf(doc);
     const known = new Set(plan.nodes.map((n) => n.id));
-    let order = this.nextOrder(plan, "spec");
+    let order = this.nextOrder(plan, "proposal");
     const adopted = [];
     for (const entry of this.fsx.readdir(changesDir).sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.directory || entry.name === "archive" || entry.name.startsWith(".")) {
@@ -1092,7 +2194,7 @@ var PlanStore = class {
       if (known.has(entry.name)) continue;
       const node = {
         id: entry.name,
-        type: "spec",
+        type: "proposal",
         title: entry.name,
         specFile: `${basename2(this.dir)}/changes/${entry.name}/${META_FILE}`,
         order: order++
@@ -1110,17 +2212,113 @@ var PlanStore = class {
     }
     return adopted;
   }
+  /**
+   * Adopt current-truth capability directories as read-only capability
+   * roots (sibling of adoptExistingChanges): every directory under
+   * <root>/specs/ that is not yet a node becomes a `capability` node whose
+   * id IS the capability-dir basename. Additive and idempotent — a
+   * capability already present is skipped — and it NEVER writes under
+   * specs/ (capabilities are projected, not authored: no metadata file, no
+   * spec.md rewrite, ever).
+   */
+  adoptExistingCapabilities() {
+    const specsDir = join8(this.dir, "specs");
+    if (!this.fsx.exists(specsDir)) return [];
+    const doc = this.loadDoc();
+    const plan = this.planOf(doc);
+    const known = new Set(plan.nodes.map((n) => n.id));
+    let order = this.nextOrder(plan, "capability");
+    const adopted = [];
+    for (const entry of this.fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!entry.directory || entry.name.startsWith(".")) continue;
+      if (known.has(entry.name)) continue;
+      const node = {
+        id: entry.name,
+        type: "capability",
+        title: entry.name,
+        order: order++,
+        specPath: `${basename2(this.dir)}/specs/${entry.name}/spec.md`
+      };
+      doc.addIn(["nodes"], node);
+      adopted.push(node);
+    }
+    if (adopted.length === 0) return [];
+    this.save(doc);
+    return adopted;
+  }
   // ── Per-spec metadata files ──────────────────────────────────────────────
+  /**
+   * The proposal node's `specFile` (undefined for a non-proposal / unknown id).
+   * Read defensively — a corrupt root never propagates out of a path lookup.
+   */
+  specFileOf(specId) {
+    try {
+      const node = this.load().nodes.find((n) => n.id === specId);
+      return node?.type === "proposal" ? node.specFile : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * The metadata-file path for a spec's change. Normally
+   * `changes/<specId>/specplan.yaml`, BUT once a proposal is folded/archived
+   * its node's `specFile` points under `changes/archive/YYYY-MM-DD-<id>/`
+   * (markApplied / the v1→v2 migration): this follows that pointer so every
+   * reader (`specState`, `readSpecMeta`, the body/diagram viewers) and the
+   * state writers land on the ARCHIVED sidecar — never resurrecting a stray
+   * `changes/<specId>/` dir for an already-archived change.
+   */
   specMetaPath(specId) {
-    return join4(this.dir, "changes", specId, META_FILE);
+    const specFile = this.specFileOf(specId);
+    if (specFile?.includes("changes/archive/")) {
+      const prefix = `${basename2(this.dir)}/`;
+      const rel = specFile.startsWith(prefix) ? specFile.slice(prefix.length) : specFile;
+      return join8(this.dir, rel);
+    }
+    return join8(this.dir, "changes", specId, META_FILE);
+  }
+  /**
+   * Record a completed fold (specplan-timeline-apply, after `openspec archive`
+   * has already moved the change dir). In ONE pass: (a) repoint the proposal
+   * node's `specFile` in the root doc to the archived sidecar (surgical
+   * `setIn`, comment-preserving), and (b) write `approved: true` + the minimal
+   * implementation-task record into the sidecar AT THE ARCHIVED path (via the
+   * shared comment-preserving writer). Deliberately NOT `setApproved`: that
+   * writer targets `changes/<specId>/specplan.yaml`, which the archive just
+   * moved — calling it would recreate a stray active change dir (the exact
+   * resurrection hazard the v1→v2 `stampApprovedAt` precedent avoids).
+   *
+   * `archivedRelDir` is the archive directory relative to the openspec root,
+   * e.g. `changes/archive/2026-07-27-<specId>`.
+   */
+  markApplied(specId, archivedRelDir, task) {
+    const newSpecFile = `${basename2(this.dir)}/${archivedRelDir}/${META_FILE}`;
+    const doc = this.loadDoc();
+    const nodes = doc.getIn(["nodes"]);
+    if (isSeq(nodes)) {
+      for (let i = 0; i < nodes.items.length; i++) {
+        const node = nodes.items[i];
+        if (!isMap(node)) continue;
+        if (String(node.get("id") ?? "") === specId) {
+          doc.setIn(["nodes", i, "specFile"], newSpecFile);
+          break;
+        }
+      }
+    }
+    this.save(doc);
+    writeChangeMeta(this.fsx, join8(this.dir, archivedRelDir), {
+      specId,
+      approved: true,
+      task
+    });
   }
   readSpecMeta(specId) {
     const raw = this.fsx.readIfExists(this.specMetaPath(specId));
     if (raw === void 0) return null;
-    const doc = parseDocument(raw);
+    const doc = parseDocument2(raw);
     const fault = doc.errors[0];
     if (fault) throw new PlanFileError(`changes/${specId}/${META_FILE}: ${fault.message}`);
-    const parsed = SpecMeta.safeParse(doc.toJS());
+    const parsed = SpecMetaSchema.safeParse(doc.toJS());
     if (!parsed.success) {
       const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
       throw new PlanFileError(`changes/${specId}/${META_FILE}: ${issues}`);
@@ -1128,37 +2326,75 @@ var PlanStore = class {
     return parsed.data;
   }
   /**
-   * Write a spec's metadata file, preserving everything this write does not
-   * own (comments, the generation block) by editing the existing document.
+   * Write a proposal's metadata file, preserving everything this write does
+   * not own (comments, the generation block, status, approved, implemented) by editing
+   * the existing document. Proposal-only by contract — capability nodes
+   * have no metadata file and callers must never route one here.
    */
   writeSpecMeta(specId, userStories, dependencies) {
     const path = this.specMetaPath(specId);
     const raw = this.fsx.readIfExists(path);
-    const doc = raw === void 0 ? new Document({}) : parseDocument(raw);
+    const doc = raw === void 0 ? new Document2({}) : parseDocument2(raw);
     doc.setIn(["specId"], specId);
     doc.setIn(["userStories"], userStories);
     doc.setIn(["dependencies"], dependencies);
     this.fsx.writeAtomicFile(path, doc.toString());
   }
   /**
-   * Set a spec's lifecycle status (draft | active | done | deferred) in its
-   * per-spec metadata file. User-owned, free transitions; everything else
-   * in the file (stories, dependencies, generation, comments) is preserved.
+   * Set a proposal's WORKING state (draft | in-progress) in its per-spec
+   * metadata file. User-owned; everything else in the file (stories,
+   * dependencies, generation, comments — and the separate `approved` and
+   * `implemented` axes) is preserved: the working-state writer NEVER sets
+   * `approved`. Proposal-only: a capability has no metadata file.
    */
   setStatus(specId, status) {
     const node = this.load().nodes.find((n) => n.id === specId);
-    if (!node || node.type !== "spec") throw new DagError(`unknown spec: ${specId}`);
+    if (!node || node.type !== "proposal") throw new DagError(`unknown spec: ${specId}`);
     const path = this.specMetaPath(specId);
     const raw = this.fsx.readIfExists(path);
-    const doc = raw === void 0 ? new Document({ specId, userStories: [], dependencies: [] }) : parseDocument(raw);
+    const doc = raw === void 0 ? new Document2({ specId, userStories: [], dependencies: [] }) : parseDocument2(raw);
     doc.setIn(["status"], status);
     this.fsx.writeAtomicFile(path, doc.toString());
   }
+  /**
+   * Set a proposal's approved/fold state (formerly `setApplied`) — its OWN
+   * axis, deliberately distinct from `setStatus` (the working states) and
+   * `setImplemented` (the build flag). Setting one never touches the others.
+   * Fold/migration-only by contract: under apply-first, `approved` flips
+   * when a delta is folded into specs/ and archived — never from a chip.
+   * Proposal-only: a capability has no metadata file. (The apply *action*
+   * that runs the fold belongs to specplan-timeline-apply; this is just the
+   * state writer.)
+   */
+  setApproved(specId, approved) {
+    const node = this.load().nodes.find((n) => n.id === specId);
+    if (!node || node.type !== "proposal") throw new DagError(`unknown spec: ${specId}`);
+    const path = this.specMetaPath(specId);
+    const raw = this.fsx.readIfExists(path);
+    const doc = raw === void 0 ? new Document2({ specId, userStories: [], dependencies: [] }) : parseDocument2(raw);
+    doc.setIn(["approved"], approved);
+    this.fsx.writeAtomicFile(path, doc.toString());
+  }
+  /**
+   * Set a proposal's build flag (`implemented`) — user-set, independent of
+   * the fold: true once the code has been built to match the approved diff.
+   * Never touches `status` or `approved`. Proposal-only: a capability has
+   * no metadata file.
+   */
+  setImplemented(specId, implemented) {
+    const node = this.load().nodes.find((n) => n.id === specId);
+    if (!node || node.type !== "proposal") throw new DagError(`unknown spec: ${specId}`);
+    const path = this.specMetaPath(specId);
+    const raw = this.fsx.readIfExists(path);
+    const doc = raw === void 0 ? new Document2({ specId, userStories: [], dependencies: [] }) : parseDocument2(raw);
+    doc.setIn(["implemented"], implemented);
+    this.fsx.writeAtomicFile(path, doc.toString());
+  }
   /** Record a generation result in the spec's metadata file. */
   writeGeneration(specId, lastGeneratedBodyHash, lastGeneratedAt) {
     const path = this.specMetaPath(specId);
     const raw = this.fsx.readIfExists(path);
-    const doc = raw === void 0 ? new Document({ specId }) : parseDocument(raw);
+    const doc = raw === void 0 ? new Document2({ specId }) : parseDocument2(raw);
     doc.setIn(["generation", "lastGeneratedBodyHash"], lastGeneratedBodyHash);
     doc.setIn(["generation", "lastGeneratedAt"], lastGeneratedAt);
     this.fsx.writeAtomicFile(path, doc.toString());
@@ -1171,20 +2407,28 @@ function planErrorResponse(c, err) {
   if (err instanceof PlanFileError) return c.json({ error: err.message }, 500);
   throw err;
 }
-function registerPlanRoutes(app, store, workspace) {
+function registerPlanRoutes(app, store, workspace, opts = {}) {
+  const journal = new PlanJournal(store.fsx, store.dir);
   app.get("/api/session", (c) => {
     try {
       store.adoptExistingChanges();
+      store.adoptExistingCapabilities();
       const plan = store.load();
       const specStates = Object.fromEntries(
-        plan.nodes.filter((n) => n.type === "spec").map((n) => [n.id, specState(store, n.id)])
+        plan.nodes.filter((n) => n.type === "proposal").map((n) => [n.id, specState(store, n.id)])
       );
+      const collapsedGroups = workspace.readCollapsedGroups();
+      const hideEmptySpecs = workspace.readHideEmptySpecs();
       return c.json({
         rootName: basename3(workspace.dir),
         model: GENERATION_MODELS.find((m) => m === workspace.readModel()),
         plan,
-        positions: workspace.readPositions(),
         specStates,
+        // Absent (never saved) → the UI applies the first-load default
+        // collapse; present (even empty) → the remembered per-plan state.
+        ...collapsedGroups !== void 0 ? { collapsedGroups } : {},
+        // Absent → the default (show every row); present → the remembered toggle.
+        ...hideEmptySpecs !== void 0 ? { hideEmptySpecs } : {},
         chat: workspace.readChat()
       });
     } catch (err) {
@@ -1205,10 +2449,9 @@ function registerPlanRoutes(app, store, workspace) {
       return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
     }
     try {
-      return c.json(
-        { node: store.createSpec(parsed.data.title, parsed.data.description) },
-        201
-      );
+      const node = store.createProposal(parsed.data.title, parsed.data.description);
+      journal.append({ action: "create_spec", targetId: node.id, at: (/* @__PURE__ */ new Date()).toISOString() });
+      return c.json({ node }, 201);
     } catch (err) {
       return planErrorResponse(c, err);
     }
@@ -1219,7 +2462,9 @@ function registerPlanRoutes(app, store, workspace) {
       return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
     }
     try {
-      return c.json({ node: store.createStory(parsed.data.text) }, 201);
+      const node = store.createStory(parsed.data.text);
+      journal.append({ action: "create_story", targetId: node.id, at: (/* @__PURE__ */ new Date()).toISOString() });
+      return c.json({ node }, 201);
     } catch (err) {
       return planErrorResponse(c, err);
     }
@@ -1230,7 +2475,14 @@ function registerPlanRoutes(app, store, workspace) {
       return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
     }
     try {
-      return c.json({ edge: store.link(parsed.data.from, parsed.data.to) }, 201);
+      const edge = store.link(parsed.data.from, parsed.data.to);
+      journal.append({
+        action: "link",
+        targetId: parsed.data.from,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        to: parsed.data.to
+      });
+      return c.json({ edge }, 201);
     } catch (err) {
       return planErrorResponse(c, err);
     }
@@ -1239,18 +2491,33 @@ function registerPlanRoutes(app, store, workspace) {
     const specId = c.req.param("specId");
     try {
       const node = store.load().nodes.find((n) => n.id === specId);
-      if (!node || node.type !== "spec") {
+      if (!node || node.type !== "proposal") {
         return c.json({ error: `unknown spec: ${specId}` }, 404);
       }
+      const diagram = readDiagram(store, specId);
       return c.json({
         specId,
         handEdited: specState(store, specId).handEdited,
-        files: readBodyFiles(store, specId)
+        files: readBodyFiles(store, specId),
+        ...diagram !== void 0 ? { diagram } : {}
       });
     } catch (err) {
       return planErrorResponse(c, err);
     }
   });
+  app.get("/api/capability/:id", (c) => {
+    const id = c.req.param("id");
+    try {
+      const node = store.load().nodes.find((n) => n.id === id);
+      if (!node || node.type !== "capability") {
+        return c.json({ error: `unknown capability: ${id}` }, 404);
+      }
+      const content = store.fsx.readIfExists(join9(store.dir, "specs", id, "spec.md")) ?? "";
+      return c.json({ id, content });
+    } catch (err) {
+      return planErrorResponse(c, err);
+    }
+  });
   app.post("/api/plan/status", async (c) => {
     const parsed = SetStatusRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
@@ -1258,11 +2525,61 @@ function registerPlanRoutes(app, store, workspace) {
     }
     try {
       store.setStatus(parsed.data.specId, parsed.data.status);
+      journal.append({
+        action: "status",
+        targetId: parsed.data.specId,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        status: parsed.data.status
+      });
       return c.json({ specId: parsed.data.specId, status: parsed.data.status });
     } catch (err) {
       return planErrorResponse(c, err);
     }
   });
+  app.post("/api/plan/apply", async (c) => {
+    if (!opts.apply) {
+      return c.json({ error: "apply is not available on this deployment target yet" }, 501);
+    }
+    const parsed = ApplyRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
+    }
+    try {
+      const result = await opts.apply(parsed.data.specId, parsed.data.confirmHandEdit ?? false);
+      return c.json(result);
+    } catch (err) {
+      const status = err.status;
+      if (typeof status === "number") {
+        return c.json({ error: err.message }, status);
+      }
+      return planErrorResponse(c, err);
+    }
+  });
+  app.post("/api/plan/implemented", async (c) => {
+    const parsed = SetImplementedRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
+    }
+    try {
+      store.setImplemented(parsed.data.specId, parsed.data.implemented);
+      journal.append({
+        action: "implemented",
+        targetId: parsed.data.specId,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        implemented: parsed.data.implemented
+      });
+      return c.json({ specId: parsed.data.specId, implemented: parsed.data.implemented });
+    } catch (err) {
+      return planErrorResponse(c, err);
+    }
+  });
+  app.get("/api/plan/reconcile", (c) => {
+    try {
+      return c.json({ report: journal.reconcile(store) });
+    } catch (err) {
+      return planErrorResponse(c, err);
+    }
+  });
   app.post("/api/plan/unlink", async (c) => {
     const parsed = LinkRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
@@ -1285,15 +2602,285 @@ function registerPlanRoutes(app, store, workspace) {
       return planErrorResponse(c, err);
     }
   });
+  app.post("/api/plan/arrange", async (c) => {
+    const parsed = ArrangeRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
+    }
+    try {
+      return c.json({ nodes: store.arrangeRow(parsed.data.order) });
+    } catch (err) {
+      return planErrorResponse(c, err);
+    }
+  });
+}
+
+// server/app.ts
+import { dirname as dirname6, join as join11 } from "node:path";
+
+// server/gallery.ts
+import { join as join10 } from "node:path";
+var SNIPPET_LIMIT = 180;
+var REQUIRED_PROPOSAL_SECTIONS = [
+  { title: "Why", level: 2 },
+  { title: "What Changes", level: 2 },
+  { title: "System context", level: 3 },
+  { title: "Containers", level: 3 },
+  { title: "Components", level: 3 },
+  { title: "Impact", level: 2 }
+];
+function titleOf(proposal, id) {
+  const heading = /^#[ \t]+(.+)$/m.exec(proposal ?? "");
+  const text = heading?.[1]?.trim();
+  return text === void 0 || text === "" ? id : text;
+}
+function snippetOf(proposal, limit = SNIPPET_LIMIT) {
+  if (!proposal) return "";
+  const why = /^##[ \t]+Why[ \t]*$/m.exec(proposal);
+  if (!why) return "";
+  const after = proposal.slice(why.index + why[0].length);
+  const untilNextHeading = after.split(/^#{1,6}[ \t]/m)[0] ?? "";
+  const paragraph = untilNextHeading.split(/\n\s*\n/).map((p) => p.trim()).find((p) => p !== "");
+  if (paragraph === void 0) return "";
+  const flat = paragraph.replace(/\s+/g, " ").trim();
+  return truncateOnWord(flat, limit);
+}
+function truncateOnWord(text, limit) {
+  if (text.length <= limit) return text;
+  const clipped = text.slice(0, limit);
+  const lastSpace = clipped.lastIndexOf(" ");
+  return `${(lastSpace > 0 ? clipped.slice(0, lastSpace) : clipped).trimEnd()}\u2026`;
+}
+function taskCounts(tasks) {
+  if (!tasks) return { done: 0, total: 0 };
+  const items = tasks.match(/^[ \t]*-[ \t]+\[[ xX]\]/gm) ?? [];
+  const done = items.filter((i) => /\[[xX]\]/.test(i)).length;
+  return { done, total: items.length };
+}
+function proposalState(proposal) {
+  if (!proposal || proposal.trim() === "") return "absent";
+  let filled = 0;
+  for (const section of REQUIRED_PROPOSAL_SECTIONS) {
+    const hashes = "#".repeat(section.level);
+    const heading = new RegExp(`^${hashes}[ \\t]+${section.title}[ \\t]*$`, "m").exec(proposal);
+    if (!heading) continue;
+    const after = proposal.slice(heading.index + heading[0].length);
+    const body = (after.split(/^#{1,6}[ \t]/m)[0] ?? "").trim();
+    if (body !== "") filled += 1;
+  }
+  if (filled === 0) return "absent";
+  return filled === REQUIRED_PROPOSAL_SECTIONS.length ? "complete" : "partial";
+}
+function designState(design) {
+  if (!design || design.trim() === "") return "absent";
+  return /^##[ \t]+\S/m.test(design) ? "complete" : "absent";
+}
+var DATE_PREFIX = /^\d{4}-\d{2}-\d{2}-/;
+function archivedIds(deps) {
+  const dir = join10(deps.root, "changes", "archive");
+  if (!deps.fsx.exists(dir)) return /* @__PURE__ */ new Set();
+  const ids = /* @__PURE__ */ new Set();
+  for (const entry of deps.fsx.readdir(dir)) {
+    if (!entry.directory || entry.name.startsWith(".")) continue;
+    ids.add(entry.name.replace(DATE_PREFIX, ""));
+    ids.add(entry.name);
+  }
+  return ids;
+}
+function listChanges(deps) {
+  const changesDir = join10(deps.root, "changes");
+  if (!deps.fsx.exists(changesDir)) return [];
+  const cards = [];
+  for (const entry of deps.fsx.readdir(changesDir).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.directory || entry.name === "archive" || entry.name.startsWith(".")) continue;
+    cards.push(readChange(deps, changesDir, entry.name));
+  }
+  return cards;
+}
+function readChange(deps, changesDir, id) {
+  const dir = join10(changesDir, id);
+  const proposal = deps.fsx.readIfExists(join10(dir, "proposal.md"));
+  const design = deps.fsx.readIfExists(join10(dir, "design.md"));
+  const tasks = deps.fsx.readIfExists(join10(dir, "tasks.md"));
+  const specsDir = join10(dir, "specs");
+  const capabilities = deps.fsx.exists(specsDir) ? deps.fsx.readdir(specsDir).filter((e) => e.directory && deps.fsx.exists(join10(specsDir, e.name, "spec.md"))).map((e) => e.name).sort() : [];
+  const counts = taskCounts(tasks);
+  const states = {
+    proposal: proposalState(proposal),
+    design: designState(design),
+    // Deltas have no middle state either.
+    deltas: capabilities.length > 0 ? "complete" : "absent",
+    tasks: counts.total === 0 ? "absent" : counts.done === counts.total ? "complete" : "partial"
+  };
+  return {
+    id,
+    title: titleOf(proposal, id),
+    snippet: snippetOf(proposal),
+    capabilities,
+    ...states,
+    tasksDone: counts.done,
+    tasksTotal: counts.total,
+    tasksOpen: counts.total - counts.done,
+    // Derived from the four states rather than re-read, so "empty" cannot disagree with
+    // the indicators sitting next to it on the same card.
+    empty: Object.values(states).every((state) => state === "absent")
+  };
+}
+function deleteChange(deps, id) {
+  const name = id.trim();
+  if (name === "") return { outcome: "refused", reason: "no change was named" };
+  if (name === "archive") {
+    return { outcome: "refused", reason: "the archive is not a change and cannot be deleted" };
+  }
+  if (name.startsWith(".") || /[/\\]/.test(name) || name.split(".").includes("..")) {
+    return { outcome: "refused", reason: `\`${name}\` is not a change directory name` };
+  }
+  const dir = join10(deps.root, "changes", name);
+  if (!deps.fsx.exists(dir)) {
+    return { outcome: "refused", reason: `\`${name}\` has no directory under openspec/changes/` };
+  }
+  deps.fsx.removeDir(dir);
+  return { outcome: "deleted" };
+}
+function readChangePreview(deps, id) {
+  const dir = join10(deps.root, "changes", id);
+  if (!deps.fsx.exists(dir)) return null;
+  const documents = ["proposal.md", "design.md", "tasks.md"].map((path) => ({
+    path,
+    content: deps.fsx.readIfExists(join10(dir, path)) ?? null
+  }));
+  const specsDir = join10(dir, "specs");
+  if (deps.fsx.exists(specsDir)) {
+    for (const entry of deps.fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!entry.directory) continue;
+      const path = `specs/${entry.name}/spec.md`;
+      const content = deps.fsx.readIfExists(join10(specsDir, entry.name, "spec.md"));
+      if (content !== void 0) documents.push({ path, content });
+    }
+  }
+  return {
+    id,
+    title: titleOf(deps.fsx.readIfExists(join10(dir, "proposal.md")), id),
+    // The real id, never a placeholder: a command the reader has to edit is one they
+    // will mistype.
+    command: `specsketch ${id}`,
+    documents
+  };
+}
+
+// server/roadmap.ts
+var ROW_ID = /^\|[^|]*\|\s*`([a-z0-9][a-z0-9-]*)`\s*\|/;
+function readOrder(roadmap) {
+  const rows = [];
+  roadmap.split("\n").forEach((text, line) => {
+    const match = ROW_ID.exec(text);
+    if (match?.[1]) rows.push({ id: match[1], line, text });
+  });
+  return { rows, order: rows.map((r) => r.id) };
+}
+function reorder(roadmap, id, beforeId) {
+  const lines = roadmap.split("\n");
+  const { rows } = readOrder(roadmap);
+  const moving = rows.find((r) => r.id === id);
+  if (!moving) return { outcome: "refused", reason: `\`${id}\` has no row in the roadmap` };
+  if (beforeId !== null && !rows.some((r) => r.id === beforeId)) {
+    return { outcome: "refused", reason: `\`${beforeId}\` has no row in the roadmap` };
+  }
+  if (id === beforeId) {
+    return { outcome: "refused", reason: "a change cannot be moved before itself" };
+  }
+  const row = lines[moving.line];
+  lines.splice(moving.line, 1);
+  let insertAt;
+  if (beforeId === null) {
+    const remaining = readOrder(lines.join("\n")).rows;
+    const last = remaining[remaining.length - 1];
+    insertAt = last === void 0 ? lines.length : last.line + 1;
+  } else {
+    const target = readOrder(lines.join("\n")).rows.find((r) => r.id === beforeId);
+    if (!target) return { outcome: "refused", reason: `\`${beforeId}\` vanished while reordering` };
+    insertAt = target.line;
+  }
+  lines.splice(insertAt, 0, row);
+  const content = lines.join("\n");
+  const before = roadmap.split("\n");
+  const withoutMoved = (all) => {
+    const copy = [...all];
+    const at = copy.indexOf(row);
+    if (at >= 0) copy.splice(at, 1);
+    return copy;
+  };
+  const kept = withoutMoved(before);
+  const now = withoutMoved(lines);
+  if (kept.length !== now.length || kept.some((line, i) => line !== now[i])) {
+    return {
+      outcome: "refused",
+      reason: "the reorder would have changed a line it did not move"
+    };
+  }
+  return { outcome: "reordered", content };
+}
+function cellsOf2(line) {
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|");
+}
+function isSeparator(line) {
+  return line.trim().startsWith("|") && cellsOf2(line).every((c) => /^\s*:?-+:?\s*$/.test(c));
+}
+function governingHeader(lines, index) {
+  for (let i = Math.min(index, lines.length) - 1; i >= 1; i -= 1) {
+    if (!isSeparator(lines[i])) continue;
+    return (lines[i - 1] ?? "").trim().startsWith("|") ? i - 1 : null;
+  }
+  return null;
+}
+function addRow(roadmap, id) {
+  const lines = roadmap.split("\n");
+  const { rows } = readOrder(roadmap);
+  if (rows.some((r) => r.id === id)) {
+    return { outcome: "refused", reason: `\`${id}\` already has a roadmap row` };
+  }
+  const firstSeparator = lines.findIndex(isSeparator);
+  const insertAt = rows.length > 0 ? rows[rows.length - 1].line + 1 : firstSeparator + 1;
+  const headerAt = governingHeader(lines, insertAt);
+  if (headerAt === null) {
+    return { outcome: "refused", reason: "the roadmap carries no table to append a row to" };
+  }
+  const header = cellsOf2(lines[headerAt]).map((c) => c.trim());
+  const rowsHere = rows.filter((r) => governingHeader(lines, r.line) === headerAt);
+  const idColumn = rowsHere.length > 0 ? cellsOf2(rowsHere[0].text).findIndex((c) => /^\s*`[^`]+`\s*$/.test(c)) : header.findIndex((h) => /change[- ]?id|^id$/i.test(h));
+  if (idColumn < 0) {
+    return { outcome: "refused", reason: "the roadmap table declares no change-id column" };
+  }
+  const cells = header.map(() => "");
+  cells[idColumn] = `\`${id}\``;
+  if (/^#$/.test(header[0] ?? "") && idColumn !== 0) {
+    const written = rows.map((r) => Number.parseInt((cellsOf2(r.text)[0] ?? "").trim(), 10)).filter((n) => Number.isFinite(n));
+    cells[0] = String(written.length > 0 ? Math.max(...written) + 1 : rows.length + 1);
+  }
+  const row = `| ${cells.join(" | ")} |`;
+  lines.splice(insertAt, 0, row);
+  const content = lines.join("\n");
+  const before = roadmap.split("\n");
+  const after = lines.filter((_, i) => i !== insertAt);
+  if (before.length !== after.length || before.some((line, i) => line !== after[i])) {
+    return { outcome: "refused", reason: "the append would have changed a line it did not add" };
+  }
+  if (cellsOf2(row).length !== header.length) {
+    return {
+      outcome: "refused",
+      reason: `the appended row would carry ${cellsOf2(row).length} cells in a ${header.length}-column table`
+    };
+  }
+  return { outcome: "reordered", content };
 }
 
 // server/tools.ts
-import { z as z2 } from "zod";
-var CreateSpecInput = z2.object({ title: z2.string().min(1) });
-var CreateStoryInput = z2.object({ text: z2.string().min(1) });
-var LinkDependencyInput = z2.object({ fromSpecId: z2.string(), toSpecId: z2.string() });
-var ContainStoryInput = z2.object({ specId: z2.string(), storyId: z2.string() });
-var ReorderInput = z2.object({ nodeId: z2.string(), order: z2.number() });
+import { z as z4 } from "zod";
+var CreateSpecInput = z4.object({ title: z4.string().min(1) });
+var CreateStoryInput = z4.object({ text: z4.string().min(1) });
+var LinkDependencyInput = z4.object({ fromSpecId: z4.string(), toSpecId: z4.string() });
+var ContainStoryInput = z4.object({ specId: z4.string(), storyId: z4.string() });
+var ReorderInput = z4.object({ nodeId: z4.string(), order: z4.number() });
 var CHAT_TOOLS = [
   {
     name: "create_spec",
@@ -1367,7 +2954,7 @@ function executeToolCall(store, name, input) {
   switch (name) {
     case "create_spec": {
       const { title } = parseInput(CreateSpecInput, input, name);
-      const node = store.createSpec(title);
+      const node = store.createProposal(title);
       return { tool: name, summary: `created spec ${node.id} "${node.title}"` };
     }
     case "create_user_story": {
@@ -1378,9 +2965,9 @@ function executeToolCall(store, name, input) {
     case "link_dependency": {
       const { fromSpecId, toSpecId } = parseInput(LinkDependencyInput, input, name);
       for (const id of [fromSpecId, toSpecId]) {
-        if (nodeType(store, id) !== "spec") {
+        if (nodeType(store, id) !== "proposal") {
           throw new DagError(
-            `link_dependency links specs only \u2014 ${id} is a user story (use contain_story)`
+            `link_dependency links specs only \u2014 ${id} is not a spec (use contain_story for user stories)`
           );
         }
       }
@@ -1389,7 +2976,7 @@ function executeToolCall(store, name, input) {
     }
     case "contain_story": {
       const { specId, storyId } = parseInput(ContainStoryInput, input, name);
-      if (nodeType(store, specId) !== "spec") {
+      if (nodeType(store, specId) !== "proposal") {
         throw new DagError(`contain_story: ${specId} is not a spec`);
       }
       if (nodeType(store, storyId) !== "user_story") {
@@ -1424,6 +3011,13 @@ You CANNOT delete, remove, or rename anything \u2014 no such tool exists, by des
 to delete or remove an item, explain that SpecPlan's assistant is non-destructive (the
 user can edit specplan.yaml by hand) and make NO tool calls.
 
+You also CANNOT approve, close, or apply a proposal. Applying folds a proposal's delta into
+specs/ and archives it \u2014 a consuming, largely-irreversible lifecycle transition, the same
+category the no-delete rule protects \u2014 so there is deliberately no chat tool for it. Apply
+is a canvas-only, user-gated control (the Apply/Close button) or the headless
+"specplan apply" CLI verb. If asked to approve, close, or apply a proposal, explain this in
+plain text and make NO tool calls.
+
 Ground answers in the current plan below. "=== @<path> ===" blocks are real file contents
 resolved from @-references; they are authoritative over your assumptions. Answers render
 as plain text in a narrow side pane: be concise, short paragraphs or simple "- " lists,
@@ -1435,7 +3029,7 @@ function renderPlanContext(plan, statuses) {
   );
   const lines = ["Current plan:"];
   for (const node of plan.nodes) {
-    if (node.type !== "spec") continue;
+    if (node.type !== "proposal") continue;
     lines.push(
       `- spec ${node.id} "${node.title}" (order ${node.order}, status ${statuses?.[node.id] ?? "draft"})`
     );
@@ -1447,7 +3041,7 @@ function renderPlanContext(plan, statuses) {
   }
   const free = backlog(plan);
   const backlogLines = [
-    ...free.specs.map((n) => `- ${n.id} (spec): ${n.type === "spec" ? n.title : ""}`),
+    ...free.specs.map((n) => `- ${n.id} (spec): ${n.type === "proposal" ? n.title : ""}`),
     ...free.stories.map((n) => `- ${n.id} (story): ${n.type === "user_story" ? n.text : ""}`)
   ];
   lines.push("", "Backlog (not yet linked into the plan):");
@@ -1470,10 +3064,82 @@ function anthropicErrorResponse(c, err, kind) {
   }
   return c.json({ error: kind, detail: message }, 502);
 }
+function renderToolUseSummary(name, input) {
+  try {
+    const json = JSON.stringify(input);
+    return json && json !== "{}" && json !== "null" ? `${name} ${json}` : name;
+  } catch {
+    return name;
+  }
+}
 function createApp(anthropic, workspace, store, options) {
   const refRoot = options === void 0 ? process.cwd() : options.refRoot;
+  const harness = options?.harness;
+  const powerProfile = readMostlyProfile("specplan-assistant");
   const app = new Hono();
   app.get("/api/health", (c) => c.json({ ok: true }));
+  if (store) {
+    const roadmapPath = () => {
+      const beside = join11(dirname6(store.dir), "roadmap.md");
+      return store.fsx.exists(beside) ? beside : join11(store.dir, "roadmap.md");
+    };
+    app.get("/api/gallery", (c) => {
+      const cards = listChanges({ fsx: store.fsx, root: store.dir });
+      const roadmap = store.fsx.readIfExists(roadmapPath());
+      const order = roadmap === void 0 ? [] : readOrder(roadmap).order;
+      const rank = new Map(order.map((id, i) => [id, i]));
+      const roadmapped = cards.filter((card) => rank.has(card.id)).sort((a, b) => rank.get(a.id) - rank.get(b.id));
+      const backlog2 = cards.filter((card) => !rank.has(card.id));
+      const present = new Set(cards.map((card) => card.id));
+      const archive = archivedIds({ fsx: store.fsx, root: store.dir });
+      const absent = order.filter((id) => !present.has(id));
+      const archived = absent.filter((id) => archive.has(id));
+      const missing = absent.filter((id) => !archive.has(id));
+      return c.json({
+        roadmap: roadmapped,
+        backlog: backlog2,
+        archived,
+        missing,
+        hasRoadmap: roadmap !== void 0
+      });
+    });
+    app.get("/api/gallery/:id", (c) => {
+      const preview = readChangePreview({ fsx: store.fsx, root: store.dir }, c.req.param("id"));
+      if (preview === null) return c.json({ error: "no-such-change" }, 404);
+      return c.json(preview);
+    });
+    app.post("/api/gallery/roadmap", async (c) => {
+      const body = await c.req.json();
+      const path = roadmapPath();
+      const roadmap = store.fsx.readIfExists(path);
+      if (roadmap === void 0) {
+        return c.json({ outcome: "refused", reason: "no roadmap.md to add to" }, 409);
+      }
+      const result = addRow(roadmap, body.id ?? "");
+      if (result.outcome !== "reordered") return c.json(result, 409);
+      store.fsx.writeAtomicFile(path, result.content);
+      return c.json({ outcome: "added" });
+    });
+    app.delete("/api/gallery/:id", (c) => {
+      const id = c.req.param("id");
+      const result = deleteChange({ fsx: store.fsx, root: store.dir }, id);
+      if (result.outcome !== "deleted") return c.json(result, 409);
+      store.removeProposal(id);
+      return c.json(result);
+    });
+    app.post("/api/gallery/reorder", async (c) => {
+      const body = await c.req.json();
+      const path = roadmapPath();
+      const roadmap = store.fsx.readIfExists(path);
+      if (roadmap === void 0) {
+        return c.json({ outcome: "refused", reason: "no roadmap.md to reorder" }, 409);
+      }
+      const result = reorder(roadmap, body.id ?? "", body.before ?? null);
+      if (result.outcome !== "reordered") return c.json(result, 409);
+      store.fsx.writeAtomicFile(path, result.content);
+      return c.json({ outcome: "reordered" });
+    });
+  }
   app.get(
     "/api/config",
     (c) => c.json({
@@ -1483,7 +3149,9 @@ function createApp(anthropic, workspace, store, options) {
     })
   );
   if (workspace && store) {
-    registerPlanRoutes(app, store, workspace);
+    registerPlanRoutes(app, store, workspace, {
+      apply: (specId, confirmHandEdit) => applyForSpec({ store }, specId, { confirmHandEdit })
+    });
     app.post("/api/generate", async (c) => {
       const parsed = GenerateRequest.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
@@ -1495,6 +3163,9 @@ function createApp(anthropic, workspace, store, options) {
           {
             anthropic,
             store,
+            // Present → harness structured generation (subscription-first);
+            // absent → the raw @anthropic-ai/sdk path (API credits).
+            harness,
             systemPrompt: workspace.readSystemPrompt(),
             refRoot
           },
@@ -1514,9 +3185,76 @@ function createApp(anthropic, workspace, store, options) {
       if (!parsed.success) {
         return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
       }
-      const { message, conversation, model = DEFAULT_MODEL } = parsed.data;
+      const { message, conversation, model = DEFAULT_MODEL, mode } = parsed.data;
       const refs = expandReferences(message, refRoot);
       const refContext = renderReferenceContext(refs);
+      if (mode === "power") {
+        if (!harness) {
+          return c.json(
+            { error: "power-mode-unavailable", detail: "no agent harness configured for this server" },
+            500
+          );
+        }
+        const chatPlan2 = store.load();
+        const statuses2 = Object.fromEntries(
+          chatPlan2.nodes.filter((n) => n.type === "proposal").map((n) => [n.id, specState(store, n.id).status])
+        );
+        const history = conversation.map((m) => `[${m.role === "user" ? "user" : "assistant"}]
+${m.text}`).join("\n\n");
+        const prompt = `${CHAT_SYSTEM}
+
+${renderPlanContext(chatPlan2, statuses2)}` + (history ? `
+
+Conversation so far:
+
+${history}` : "") + `
+
+[user]
+${message}` + (refContext ? `
+
+Referenced files (resolved from @-references in the message):
+
+${refContext}` : "");
+        let answer = "";
+        let resultText = "";
+        let resultError = false;
+        const executed2 = [];
+        try {
+          for await (const ev of harness.run({
+            prompt,
+            cwd: refRoot ?? process.cwd(),
+            session: "specplan-assistant",
+            profile: powerProfile
+          })) {
+            if (ev.type === "text") answer += ev.text;
+            else if (ev.type === "tool_use") {
+              executed2.push({ tool: ev.name, summary: renderToolUseSummary(ev.name, ev.input) });
+            } else if (ev.type === "result") {
+              resultText = ev.text;
+              resultError = ev.isError;
+            }
+          }
+        } catch (err) {
+          return anthropicErrorResponse(c, err, "chat-failed");
+        }
+        const text2 = answer.trim() || resultText.trim();
+        if (!text2) {
+          return resultError ? c.json({ error: "chat-failed", detail: resultText || "the agent run failed" }, 502) : c.json({ error: "model returned no text" }, 502);
+        }
+        const reply2 = { role: "assistant", text: text2, at: (/* @__PURE__ */ new Date()).toISOString() };
+        workspace.writeChat([
+          ...conversation,
+          { role: "user", text: message, at: reply2.at },
+          reply2
+        ]);
+        return c.json({
+          reply: reply2,
+          toolCalls: executed2,
+          plan: store.load(),
+          resolvedRefs: refs.resolved.map((r) => r.path),
+          unresolvedRefs: refs.unresolved
+        });
+      }
       const messages = [
         ...conversation.map((m) => ({
           role: m.role === "user" ? "user" : "assistant",
@@ -1533,7 +3271,7 @@ ${refContext}` : "")
       ];
       const chatPlan = store.load();
       const statuses = Object.fromEntries(
-        chatPlan.nodes.filter((n) => n.type === "spec").map((n) => [n.id, specState(store, n.id).status])
+        chatPlan.nodes.filter((n) => n.type === "proposal").map((n) => [n.id, specState(store, n.id).status])
       );
       const system = `${CHAT_SYSTEM}
 
@@ -1624,14 +3362,14 @@ import { parseArgs } from "node:util";
 
 // ../shared/src/cli-config.ts
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { homedir, hostname } from "node:os";
-import { join as join5, dirname as dirname4 } from "node:path";
+import { homedir as homedir2, hostname } from "node:os";
+import { join as join12, dirname as dirname7 } from "node:path";
 
 // ../shared/src/schemas.ts
-import { z as z3 } from "zod";
-var planTierSchema = z3.enum(["hobby", "squad", "org"]);
-var jurisdictionSchema = z3.enum(["eu", "fedramp"]);
-var locationHintSchema = z3.enum([
+import { z as z5 } from "zod";
+var planTierSchema = z5.enum(["hobby", "squad", "org"]);
+var jurisdictionSchema = z5.enum(["eu", "fedramp"]);
+var locationHintSchema = z5.enum([
   "wnam",
   "enam",
   "weur",
@@ -1642,135 +3380,135 @@ var locationHintSchema = z3.enum([
   "me",
   "sam"
 ]);
-var sessionNameSchema = z3.string().min(1).max(63).regex(
+var sessionNameSchema = z5.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Session name must be lowercase alphanumeric with hyphens, starting with a letter or digit"
 );
-var teamNameSchema = z3.string().min(1).max(63).regex(
+var teamNameSchema = z5.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Team name must be lowercase alphanumeric with hyphens"
 );
-var messageKindSchema = z3.enum(["text", "context", "request", "system"]);
-var messageContentSchema = z3.object({
+var messageKindSchema = z5.enum(["text", "context", "request", "system"]);
+var messageContentSchema = z5.object({
   kind: messageKindSchema,
   // No .max() here: the 10 000-char body limit is business logic owned by the
   // SessionActor (MAX_BODY_BYTES), which rejects with 413 MESSAGE_TOO_LARGE on
   // both REST and WS. A schema cap would pre-empt it as a generic 400.
-  body: z3.string().min(1),
+  body: z5.string().min(1),
   // Two-arg z.record: identical semantics in zod 3, required form in zod 4
   // (specsketch bundles this file against zod 4 — keep every construct dual-safe).
-  metadata: z3.record(z3.string(), z3.unknown()).optional()
+  metadata: z5.record(z5.string(), z5.unknown()).optional()
 });
-var createTeamInputSchema = z3.object({
+var createTeamInputSchema = z5.object({
   name: teamNameSchema
 });
-var createSessionInputSchema = z3.object({
+var createSessionInputSchema = z5.object({
   name: sessionNameSchema,
-  teamId: z3.string().optional(),
+  teamId: z5.string().optional(),
   jurisdiction: jurisdictionSchema.optional(),
   locationHint: locationHintSchema.optional()
 });
-var sendMessageInputSchema = z3.object({
+var sendMessageInputSchema = z5.object({
   content: messageContentSchema
 });
-var inviteInputSchema = z3.object({
-  email: z3.string().email(),
-  role: z3.enum(["admin", "member"]).default("member")
+var inviteInputSchema = z5.object({
+  email: z5.string().email(),
+  role: z5.enum(["admin", "member"]).default("member")
 });
-var joinTeamInputSchema = z3.object({
-  inviteCode: z3.string().min(1)
+var joinTeamInputSchema = z5.object({
+  inviteCode: z5.string().min(1)
 });
-var markReadInputSchema = z3.object({
-  notificationIds: z3.array(z3.string().min(1))
+var markReadInputSchema = z5.object({
+  notificationIds: z5.array(z5.string().min(1))
 });
-var pollQuerySchema = z3.object({
-  since: z3.string().optional(),
-  limit: z3.coerce.number().int().min(1).max(100).default(50),
-  session: z3.string().optional()
+var pollQuerySchema = z5.object({
+  since: z5.string().optional(),
+  limit: z5.coerce.number().int().min(1).max(100).default(50),
+  session: z5.string().optional()
 });
-var messagesQuerySchema = z3.object({
-  cursor: z3.string().optional(),
-  limit: z3.coerce.number().int().min(1).max(100).default(50)
+var messagesQuerySchema = z5.object({
+  cursor: z5.string().optional(),
+  limit: z5.coerce.number().int().min(1).max(100).default(50)
 });
-var teamTypeSchema = z3.enum(["personal", "shared"]);
-var teamRoleSchema = z3.enum(["owner", "admin", "member"]);
-var accessPermissionSchema = z3.enum(["read", "write", "admin"]);
-var accessGrantInputSchema = z3.object({
-  userId: z3.string().min(1),
+var teamTypeSchema = z5.enum(["personal", "shared"]);
+var teamRoleSchema = z5.enum(["owner", "admin", "member"]);
+var accessPermissionSchema = z5.enum(["read", "write", "admin"]);
+var accessGrantInputSchema = z5.object({
+  userId: z5.string().min(1),
   sessionName: sessionNameSchema.nullable().default(null),
   // null = general
   permission: accessPermissionSchema
 });
-var machineIdSchema = z3.string().min(1).max(63).regex(
+var machineIdSchema = z5.string().min(1).max(63).regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "Machine ID must be lowercase alphanumeric with hyphens, starting with a letter or digit"
 );
-var clerkProfileInputSchema = z3.object({
-  email: z3.string().email().nullable(),
-  displayName: z3.string().min(1).max(100),
-  avatarUrl: z3.string().url().nullable(),
-  provider: z3.string().min(1).max(50),
-  providerUserId: z3.string().min(1).max(100)
+var clerkProfileInputSchema = z5.object({
+  email: z5.string().email().nullable(),
+  displayName: z5.string().min(1).max(100),
+  avatarUrl: z5.string().url().nullable(),
+  provider: z5.string().min(1).max(50),
+  providerUserId: z5.string().min(1).max(100)
 });
-var sessionEnrollmentSchema = z3.object({
-  sessionId: z3.string(),
-  team: z3.string(),
-  teamName: z3.string().optional(),
-  key: z3.string().startsWith("api_"),
-  enrolledAt: z3.string().datetime(),
-  apiUrl: z3.string().url().optional(),
-  machineId: z3.string().optional()
+var sessionEnrollmentSchema = z5.object({
+  sessionId: z5.string(),
+  team: z5.string(),
+  teamName: z5.string().optional(),
+  key: z5.string().startsWith("api_"),
+  enrolledAt: z5.string().datetime(),
+  apiUrl: z5.string().url().optional(),
+  machineId: z5.string().optional()
 });
-var authConfigSchema = z3.object({
-  key: z3.string().startsWith("api_"),
-  userId: z3.string().min(1),
-  displayName: z3.string().nullable().optional().default(null),
-  email: z3.string().email().nullable(),
-  machineId: z3.string().nullable(),
-  authenticatedAt: z3.string().datetime()
+var authConfigSchema = z5.object({
+  key: z5.string().startsWith("api_"),
+  userId: z5.string().min(1),
+  displayName: z5.string().nullable().optional().default(null),
+  email: z5.string().email().nullable(),
+  machineId: z5.string().nullable(),
+  authenticatedAt: z5.string().datetime()
 });
 var configBaseFields = {
-  apiUrl: z3.string().url(),
-  machineId: z3.string().nullable(),
-  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
-  defaults: z3.object({
-    team: z3.string().nullable(),
-    session: z3.string().nullable()
+  apiUrl: z5.string().url(),
+  machineId: z5.string().nullable(),
+  sessions: z5.record(z5.string(), sessionEnrollmentSchema),
+  defaults: z5.object({
+    team: z5.string().nullable(),
+    session: z5.string().nullable()
   }),
-  poll: z3.object({
-    lastPollAt: z3.string().datetime().nullable()
+  poll: z5.object({
+    lastPollAt: z5.string().datetime().nullable()
   })
 };
-var coopConfigV1Schema = z3.object({
-  version: z3.literal(1),
+var coopConfigV1Schema = z5.object({
+  version: z5.literal(1),
   ...configBaseFields
 });
-var coopConfigV2Schema = z3.object({
-  version: z3.literal(2),
+var coopConfigV2Schema = z5.object({
+  version: z5.literal(2),
   ...configBaseFields,
   auth: authConfigSchema.optional()
 });
-var profileNameSchema = z3.string().regex(
+var profileNameSchema = z5.string().regex(
   /^[a-z0-9][a-z0-9_-]{0,63}$/,
   "Profile name must be lowercase alphanumeric with dashes/underscores, max 64 chars"
 );
-var coopProfileSchema = z3.object({
-  apiUrl: z3.string().url(),
+var coopProfileSchema = z5.object({
+  apiUrl: z5.string().url(),
   auth: authConfigSchema.optional(),
-  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
-  defaults: z3.object({
-    team: z3.string().nullable(),
-    session: z3.string().nullable()
+  sessions: z5.record(z5.string(), sessionEnrollmentSchema),
+  defaults: z5.object({
+    team: z5.string().nullable(),
+    session: z5.string().nullable()
   }),
-  poll: z3.object({
-    lastPollAt: z3.string().datetime().nullable()
+  poll: z5.object({
+    lastPollAt: z5.string().datetime().nullable()
   })
 });
-var coopConfigV3ObjectSchema = z3.object({
-  version: z3.literal(3),
-  machineId: z3.string().nullable(),
-  defaultProfile: z3.string(),
-  profiles: z3.record(profileNameSchema, coopProfileSchema)
+var coopConfigV3ObjectSchema = z5.object({
+  version: z5.literal(3),
+  machineId: z5.string().nullable(),
+  defaultProfile: z5.string(),
+  profiles: z5.record(profileNameSchema, coopProfileSchema)
 });
 function requireDefaultProfilePointer(config, ctx) {
   if (!(config.defaultProfile in config.profiles)) {
@@ -1784,7 +3522,7 @@ function requireDefaultProfilePointer(config, ctx) {
 var coopConfigV3Schema = coopConfigV3ObjectSchema.superRefine(
   requireDefaultProfilePointer
 );
-var coopConfigSchema = z3.discriminatedUnion("version", [
+var coopConfigSchema = z5.discriminatedUnion("version", [
   coopConfigV1Schema,
   coopConfigV2Schema,
   coopConfigV3ObjectSchema
@@ -1793,20 +3531,39 @@ var coopConfigSchema = z3.discriminatedUnion("version", [
     requireDefaultProfilePointer(config, ctx);
   }
 });
-var hookStdinSchema = z3.object({
-  session_id: z3.string().optional(),
-  cwd: z3.string().optional(),
-  hook_event_name: z3.string().optional()
+var hookStdinSchema = z5.object({
+  session_id: z5.string().optional(),
+  cwd: z5.string().optional(),
+  hook_event_name: z5.string().optional()
 }).passthrough();
-var wsClientMessageSchema = z3.discriminatedUnion("type", [
-  z3.object({ type: z3.literal("message"), content: messageContentSchema }),
-  z3.object({ type: z3.literal("presence_request") }),
-  z3.object({ type: z3.literal("ping") })
+var wsClientMessageSchema = z5.discriminatedUnion("type", [
+  z5.object({ type: z5.literal("message"), content: messageContentSchema }),
+  z5.object({ type: z5.literal("ack"), data: z5.object({ messageId: z5.string() }) }),
+  z5.object({ type: z5.literal("presence_request") }),
+  z5.object({ type: z5.literal("ping") })
 ]);
+var workKindSchema = z5.enum(["implement", "generate"]);
+var workCompletionStatusSchema = z5.enum(["succeeded", "failed"]);
+var poolJoinInputSchema = z5.object({}).passthrough();
+var poolCheckInInputSchema = z5.object({}).passthrough();
+var poolCompleteInputSchema = z5.object({
+  workId: z5.string().min(1),
+  status: workCompletionStatusSchema,
+  resultRef: z5.string().max(512),
+  assignmentSeq: z5.number().int().nonnegative()
+});
+var poolEnqueueInputSchema = z5.object({
+  kind: workKindSchema,
+  source: z5.string().min(1),
+  dedupKey: z5.string().min(1).max(512).optional()
+});
+var poolCancelInputSchema = z5.object({
+  workId: z5.string().min(1)
+});
 
 // ../shared/src/cli-config.ts
-var DEFAULT_CONFIG_DIR = join5(homedir(), ".coopcli");
-var DEFAULT_CONFIG_PATH = join5(DEFAULT_CONFIG_DIR, "config.json");
+var DEFAULT_CONFIG_DIR = join12(homedir2(), ".coopcli");
+var DEFAULT_CONFIG_PATH = join12(DEFAULT_CONFIG_DIR, "config.json");
 var PROD_API_URL = "https://api.coopcli.com";
 function emptyProfile(apiUrl) {
   return {
@@ -1852,7 +3609,7 @@ var ConfigStore = class {
   configDir;
   constructor(configPath) {
     this.configPath = configPath ?? DEFAULT_CONFIG_PATH;
-    this.configDir = dirname4(this.configPath);
+    this.configDir = dirname7(this.configPath);
   }
   /**
    * Select the profile this store operates on for the rest of the process
@@ -2143,8 +3900,8 @@ function resolveDisplayName(name, email, userId) {
 async function openBrowser(url) {
   const escaped = url.replace(/"/g, '\\"');
   const cmd = process.platform === "darwin" ? `open "${escaped}"` : process.platform === "win32" ? `start "" "${escaped}"` : `xdg-open "${escaped}"`;
-  return new Promise((resolve6) => {
-    exec(cmd, () => resolve6());
+  return new Promise((resolve7) => {
+    exec(cmd, () => resolve7());
   });
 }
 var PAGE_STYLE = "body{background:#0f0f0f;color:#e8e8e8;font-family:system-ui;display:flex;justify-content:center;padding-top:4rem}";
@@ -2229,14 +3986,15 @@ function deriveApiUrl(webUrl) {
 async function login(input, deps) {
   const state = randomBytes(16).toString("hex");
   const machineId = input.machine ?? hostname2();
+  const log = deps.log ?? ((message) => void process.stderr.write(message));
   const server = await startLocalhostServer({ expectedState: state, loginCommand: input.loginCommand });
   try {
     const webUrl = input.webUrl ?? "https://coopcli.com";
     const authUrl = `${webUrl}/cli-auth?port=${server.port}&state=${state}&machine=${encodeURIComponent(machineId)}`;
-    process.stderr.write(`Opening browser for authentication...
+    log(`Opening browser for authentication...
 `);
     await deps.openBrowser(authUrl);
-    process.stderr.write(`Waiting for callback on port ${server.port}...
+    log(`Waiting for callback on port ${server.port}...
 `);
     const params = await server.waitForCallback();
     const displayName = resolveDisplayName(params.displayName, params.email, params.userId);
@@ -2253,7 +4011,7 @@ async function login(input, deps) {
     });
     const config = await deps.config.load();
     if (params.apiUrl && config.apiUrl && params.apiUrl !== config.apiUrl) {
-      process.stderr.write(
+      log(
         `
 Backend mismatch: you authenticated against ${params.apiUrl}
   but your config points to ${config.apiUrl}
@@ -2333,7 +4091,7 @@ function collectTreeErrors(rootDir) {
   const errors = planErrors(plan);
   const nodeIds = new Set(plan.nodes.map((n) => n.id));
   for (const node of plan.nodes) {
-    if (node.type !== "spec") continue;
+    if (node.type !== "proposal") continue;
     let meta;
     try {
       meta = store.readSpecMeta(node.id);
@@ -2371,7 +4129,7 @@ function validateCommand(rootDir, log = console.log, logError = console.error) {
 }
 
 // server/workspace.ts
-import { join as join6, resolve as resolve4 } from "node:path";
+import { join as join13, resolve as resolve5 } from "node:path";
 var SIDECAR_FILE = "specplan-ui.json";
 var PlanWorkspace = class {
   /** Resolved openspec root directory. */
@@ -2379,13 +4137,13 @@ var PlanWorkspace = class {
   /** IO substrate — real disk by default, in-memory for the cloud target. */
   fsx;
   constructor(dir, fsx = nodeSyncFs) {
-    this.dir = resolve4(dir);
+    this.dir = resolve5(dir);
     this.fsx = fsx;
     this.fsx.mkdirp(this.dir);
   }
   // ── Sidecar ──────────────────────────────────────────────────────────────
   readSidecar() {
-    const raw = this.fsx.readIfExists(join6(this.dir, SIDECAR_FILE));
+    const raw = this.fsx.readIfExists(join13(this.dir, SIDECAR_FILE));
     if (!raw) return {};
     try {
       return JSON.parse(raw);
@@ -2397,22 +4155,34 @@ var PlanWorkspace = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const current = this.readSidecar();
     const next = update(current);
+    delete next.positions;
     next.createdAt ??= now;
     next.updatedAt = now;
-    this.fsx.writeAtomicFile(join6(this.dir, SIDECAR_FILE), JSON.stringify(next, null, 2));
+    this.fsx.writeAtomicFile(join13(this.dir, SIDECAR_FILE), JSON.stringify(next, null, 2));
   }
   readModel() {
     return this.readSidecar().model;
   }
-  readPositions() {
-    return this.readSidecar().positions ?? {};
+  /**
+   * Collapsed group keys, or undefined when the plan has never saved a
+   * collapse state (the UI then applies the first-load default).
+   */
+  readCollapsedGroups() {
+    const stored = this.readSidecar().collapsedGroups;
+    return Array.isArray(stored) ? stored.filter((k) => typeof k === "string") : void 0;
+  }
+  /** The persisted hide-empty toggle, or undefined when never saved. */
+  readHideEmptySpecs() {
+    const stored = this.readSidecar().hideEmptySpecs;
+    return typeof stored === "boolean" ? stored : void 0;
   }
-  /** One sidecar write for the debounced UI autosave (model + positions). */
+  /** One sidecar write for the debounced UI autosave (model + grouping + toggles). */
   writeUiState(state) {
     this.updateSidecar((s) => ({
       ...s,
       ...state.model !== void 0 ? { model: state.model } : {},
-      ...state.positions !== void 0 ? { positions: state.positions } : {}
+      ...state.collapsedGroups !== void 0 ? { collapsedGroups: state.collapsedGroups } : {},
+      ...state.hideEmptySpecs !== void 0 ? { hideEmptySpecs: state.hideEmptySpecs } : {}
     }));
   }
   // ── Assistant chat ───────────────────────────────────────────────────────
@@ -2436,8 +4206,11 @@ var PlanWorkspace = class {
 };
 
 // server/cli.ts
+var CLI_VERSION = true ? "2026.08.17.1" : "dev";
 var USAGE = `Usage: specplan [rootDir] [--port <n>]
+       specplan --version
        specplan generate <specId> [rootDir]
+       specplan apply <proposalId> [rootDir] [--confirm-hand-edit]
        specplan validate [rootDir]
        specplan login [--profile <name>] [--web-url <url>]
 
@@ -2454,6 +4227,10 @@ server moves to the next available port and prints the actual URL.
 generate <specId> runs OpenSpec generation for one spec card headlessly;
 exits non-zero when the output fails \`openspec validate --strict\`.
 
+apply <proposalId> folds a proposal's delta into openspec/specs/ and archives
+it (delegating to \`openspec archive\`); exits non-zero on any gate failure.
+Pass --confirm-hand-edit to fold a body edited since it was last generated.
+
 validate checks the plan files (schema, acyclicity, containment, story
 formula, id references) and exits non-zero with named errors.
 
@@ -2463,6 +4240,65 @@ var UsageError = class extends Error {
 };
 var DEFAULT_ROOT_DIR = "./openspec";
 var DEFAULT_PORT = 8789;
+function buildGenerateContext(rootDir) {
+  const workspace = new PlanWorkspace(rootDir);
+  const store = new PlanStore(rootDir);
+  const model = GENERATION_MODELS.find((m) => m === workspace.readModel()) ?? DEFAULT_MODEL;
+  return {
+    deps: {
+      anthropic: new Anthropic(),
+      store,
+      systemPrompt: workspace.readSystemPrompt(),
+      refRoot: process.cwd(),
+      harness: createClaudeHarness()
+    },
+    model
+  };
+}
+function parseApplyArgs(args) {
+  let confirmHandEdit = false;
+  const positionals = [];
+  for (const tok of args) {
+    if (tok === "--confirm-hand-edit") {
+      confirmHandEdit = true;
+      continue;
+    }
+    if (tok.startsWith("-")) throw new UsageError(`unknown option: ${tok}`);
+    positionals.push(tok);
+  }
+  const [proposalId, rootDir = DEFAULT_ROOT_DIR, ...rest] = positionals;
+  if (!proposalId) throw new UsageError("apply requires a proposal id");
+  if (rest.length > 0) {
+    throw new UsageError("apply takes a proposal id and at most one root directory");
+  }
+  return { proposalId, rootDir, confirmHandEdit };
+}
+async function runApply(args, io = console, applyImpl = applyForSpec) {
+  let parsed;
+  try {
+    parsed = parseApplyArgs(args);
+  } catch (err) {
+    io.error(
+      `specplan: ${err instanceof Error ? err.message : String(err)}
+
+${USAGE}`
+    );
+    return 1;
+  }
+  const store = new PlanStore(parsed.rootDir);
+  try {
+    const result = await applyImpl({ store }, parsed.proposalId, {
+      confirmHandEdit: parsed.confirmHandEdit
+    });
+    io.log(`specplan: applied ${result.specId} \u2014 folded and archived to ${result.archivedTo}`);
+    for (const cap of result.newCapabilities) io.log(`  new capability: ${cap}`);
+    io.log(`  SPECS.md row ${result.ledgerRow}`);
+    return 0;
+  } catch (err) {
+    io.error(`specplan: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+}
 function parseCliArgs(argv) {
   let parsed;
   try {
@@ -2507,25 +4343,25 @@ var MIME = {
   ".woff": "font/woff"
 };
 function resolveClientDir(moduleUrl) {
-  const here = dirname5(fileURLToPath(moduleUrl));
+  const here = dirname8(fileURLToPath(moduleUrl));
   const candidates = [
-    join7(here, "..", "client"),
+    join14(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join7(here, "..", "dist", "client")
+    join14(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync4(join7(dir, "index.html"))) return dir;
+    if (existsSync7(join14(dir, "index.html"))) return dir;
   }
   return null;
 }
 function staticResponse(clientDir, pathname) {
   const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
-  const target = resolve5(clientDir, rel === "" ? "index.html" : rel);
-  if (!target.startsWith(resolve5(clientDir))) return null;
-  const file = existsSync4(target) && extname(target) ? target : join7(clientDir, "index.html");
-  if (!existsSync4(file)) return null;
-  return new Response(readFileSync4(file), {
+  const target = resolve6(clientDir, rel === "" ? "index.html" : rel);
+  if (!target.startsWith(resolve6(clientDir))) return null;
+  const file = existsSync7(target) && extname(target) ? target : join14(clientDir, "index.html");
+  if (!existsSync7(file)) return null;
+  return new Response(readFileSync5(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
   });
 }
@@ -2537,12 +4373,12 @@ but chat and "Generate OpenSpec" need one of:
   \u2022 or the Anthropic CLI's login profile (no key handling needed):
       brew install anthropics/tap/ant   # macOS
       ant auth login`;
-function detectCredentialSource(env = process.env, home = homedir2()) {
+function detectCredentialSource(env = process.env, home = homedir3()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join7(home, ".config", "anthropic", "credentials");
-    if (readdirSync3(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
+    const dir = join14(home, ".config", "anthropic", "credentials");
+    if (readdirSync5(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }
   return null;
@@ -2556,6 +4392,10 @@ function preflight(log = console.log) {
   }
 }
 async function main(argv) {
+  if (argv[0] === "--version") {
+    console.log(CLI_VERSION);
+    return;
+  }
   preflight();
   if (argv[0] === "login") {
     let loginArgs;
@@ -2595,20 +4435,9 @@ ${USAGE}`);
 ${USAGE}`);
       process.exit(1);
     }
-    const workspace2 = new PlanWorkspace(rootDir);
-    const store2 = new PlanStore(rootDir);
-    const model = GENERATION_MODELS.find((m) => m === workspace2.readModel()) ?? DEFAULT_MODEL;
+    const { deps, model } = buildGenerateContext(rootDir);
     try {
-      const result = await generateForSpec(
-        {
-          anthropic: new Anthropic(),
-          store: store2,
-          systemPrompt: workspace2.readSystemPrompt(),
-          refRoot: process.cwd()
-        },
-        specId,
-        model
-      );
+      const result = await generateForSpec(deps, specId, model);
       if (result.mode === "metadata-only") {
         console.log(
           `specplan: ${specId} body is hand-edited \u2014 updated metadata only (changes/${specId}/specplan.yaml)`
@@ -2625,6 +4454,9 @@ ${USAGE}`);
     }
     return;
   }
+  if (argv[0] === "apply") {
+    process.exit(await runApply(argv.slice(1)));
+  }
   let args;
   try {
     args = parseCliArgs(argv);
@@ -2641,7 +4473,10 @@ ${USAGE}` : err);
   }
   const workspace = new PlanWorkspace(args.rootDir);
   const store = new PlanStore(args.rootDir);
-  const app = createApp(new Anthropic(), workspace, store);
+  const app = createApp(new Anthropic(), workspace, store, {
+    refRoot: process.cwd(),
+    harness: createClaudeHarness()
+  });
   app.get("*", (c) => {
     const res = staticResponse(clientDir, new URL(c.req.url).pathname);
     return res ?? c.notFound();