@cspeach/cli 1.1.30 → 1.1.31

package/dist/lane/app-chain.js

@@ -64,12 +64,14 @@ export function cleanSpecToken(raw) {
 const NOT_STARTED = 'The app flow did not start.';
 /**
  * Resolve the /abap-app spec token to a stable path (forward slashes):
- * cwd-relative inside cwd, absolute for a spec in the workspace folder outside
- * cwd. The token is looked up with resolveAtTokenAsync — the same lookup the
- * @-attachment expansion uses — so the pinned spec and the analysed spec are
- * the same file. Refused, with one plain line, when the message names no
- * file, the name is ambiguous, the file leaves cwd and the workspace folder
- * (also through a link), sits in a protected place, or does not exist. The
+ * relative to the folder you started in; absolute only for a spec in the
+ * working `.cspeach` folder when that sits outside it (a team seat's work
+ * folder). 2026-10-08: a configured workspace_folder is ignored. The token is looked up
+ * with resolveAtTokenAsync — the same lookup the @-attachment expansion uses —
+ * so the pinned spec and the analysed spec are the same file. Refused, with
+ * one plain line, when the message names no file, the name is ambiguous, the
+ * file is outside this folder (also through a link), sits in a protected
+ * place, or does not exist. The
  * stored value is what app_lane_resolve's `sameFile` compares, and that check
  * (like readSpecText) uses the same containment (lane/roots.ts).
  */
@@ -80,7 +82,7 @@ export async function resolveAppSpec(cwd, message) {
     if (tok === '')
         return { ok: false, line: `Name the spec file with @, for example: /abap-app @specs/my-app.docx\n${NOT_STARTED}` };
     const shown = cardLine(tok);
-    const outside = { ok: false, line: `The spec file must be inside this folder or the workspace folder: ${shown}. ${NOT_STARTED}` };
+    const outside = { ok: false, line: `The spec file must be inside this folder: ${shown}. ${NOT_STARTED}` };
     const missing = { ok: false, line: `Spec file not found: ${shown}. ${NOT_STARTED}` };
     if (tok.includes('\0'))
         return outside;

package/dist/lane/chain-token.js

@@ -9,16 +9,18 @@
 //   optional `-N` collision suffix saveProject adds);
 // - the path has no `"` and no control character (it rides in a command);
 // - the real file exists inside realpath(cwd) or realpath(workspace folder),
-//   so a link out of the save root is refused.
+//   so a link out of the save root is refused;
+// - Task 14: a path in the CLI home is accepted ONLY in the read-only seat
+//   shape (`<seat>/work/<id>/.cspeach/<name>.cspeach.json`, isSeatReadOnlyFile)
+//   — the seat is reached deliberately, never by absence of a guard.
 // Round trip: parseFromFlag reads `@"…"` / `@\S+`; resolveAtTokenAsync takes a
 // path with a separator or an absolute path verbatim; coerceDocFromFlagToAttachment
 // leaves `.cspeach.json` alone.
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
-import { assertRealPathContained } from '../tools/_filesystem-shared.js';
-import { workspaceFolderFor } from './roots.js';
-/** `<slug>-spec-gap-<4 hex>-v<N>[-<n>].cspeach.json` — titleSlug is `[a-z0-9-]`, possibly empty. */
-export const SPEC_GAP_NAME_RE = /^[a-z0-9-]*-spec-gap-[0-9a-f]{4}-v\d+(?:-\d+)?\.cspeach\.json$/;
+import { assertRealPathContained, isCliHomePath, isSeatReadOnlyFile } from '../tools/_filesystem-shared.js';
+import { workspaceFolderFor, SPEC_GAP_NAME_RE } from './roots.js';
+export { SPEC_GAP_NAME_RE };
 // eslint-disable-next-line no-control-regex
 const UNSAFE = /["\u0000-\u001f\u007f-\u009f]/;
 /** A segment after whitespace (or at the start) that begins with `--`. */
@@ -47,6 +49,8 @@ export async function chainFromToken(cwd, savedPath) {
     const ws = await workspaceFolderFor(cwd).catch(() => undefined);
     if (!(await containedIn(abs, root)) && !(await containedIn(abs, ws)))
         return undefined;
+    if (isCliHomePath(abs) && !isSeatReadOnlyFile(abs))
+        return undefined;
     const rel = path.relative(root, abs);
     let p = rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel) ? rel.split(path.sep).join('/') : abs;
     if (!path.isAbsolute(p) && !p.includes('/'))

package/dist/lane/roots.js

@@ -1,23 +1,25 @@
 // App lane routing — final fix wave I3. The ONE root the lane decision folder
 // hangs off, and the spec containment rule, shared by every caller:
 //
-// - laneRootFor(cwd): the folder that contains the workspace `.cspeach` —
-//   the git root (or cwd) for the default workspace, the configured
-//   `workspace_folder` itself otherwise (R17; never the CLI home). The lane write, every pinned read
-//   and the relative `from.lane.path` (`.cspeach/lane/<id>.json`) all use it,
-//   so a lane written from a repo subfolder is found by a resume from the
-//   repo root (plans already resolve through the workspace folder).
+// - laneRootFor(cwd): the folder that holds the working `.cspeach` — the
+//   folder you start in, or the seat work root (`<CSPEACH_HOME>/work/<id>`)
+//   for a team folder, or ~/CSPeach when you start in the home folder
+//   (2026-10-08: no git walk, workspace_folder ignored; never the CLI home).
+//   The lane write, every pinned read and the relative `from.lane.path`
+//   (`.cspeach/lane/<id>.json`) all use it.
 // - containSpecPath(cwd, p): a spec is accepted inside cwd OR the workspace
 //   folder, string-contained AND realpath-contained (no link escapes), and
 //   refused when ANY of those roots (or the lane root) would denylist it.
-import { promises as fs } from 'node:fs';
+import { promises as fs, realpathSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { resolveWorkspacePathFor } from '../projects/workspace.js';
-import { loadConfig } from '../config/loader.js';
-import { cspeachRoot } from '../config/paths.js';
-import { isDenylistedPath, PathOutsideRootError } from '../tools/_filesystem-shared.js';
-/** The workspace folder for this cwd (config override > git root > cwd), absolute. */
+import { resolveProjectFolderSync, SAFE_PROJECT_ID } from '../projects/project-folder.js';
+import { cspeachRoot, defaultCspeachRoot } from '../config/paths.js';
+import { isDenylistedPath, isSeatReadOnlyFile, PathOutsideRootError } from '../tools/_filesystem-shared.js';
+/** `<slug>-spec-gap-<4 hex>-v<N>[-<n>].cspeach.json` — titleSlug is `[a-z0-9-]`, possibly empty. */
+export const SPEC_GAP_NAME_RE = /^[a-z0-9-]*-spec-gap-[0-9a-f]{4}-v\d+(?:-\d+)?\.cspeach\.json$/;
+/** The workspace folder (the working `.cspeach`) for this cwd, absolute. */
 export async function workspaceFolderFor(cwd) {
     try {
         return path.resolve(await resolveWorkspacePathFor(cwd));
@@ -28,48 +30,96 @@ export async function workspaceFolderFor(cwd) {
 }
 /**
  * The folder whose `.cspeach/lane/` (and `.cspeach/conventions.toml`, R18)
- * belong to this project.
- * - R17: a configured `workspace_folder` is the root ITSELF
- *   (`<workspace_folder>/.cspeach/lane`), never its parent — so `~/CSPeach`
- *   never puts lane files in the CLI home `~/.cspeach`.
- * - Default workspace (`<git-root or cwd>/.cspeach`): the git root (or cwd).
+ * belong to this project: the working root for this start folder.
  */
 export async function laneRootFor(cwd) {
-    let configured;
-    try {
-        configured = (await loadConfig()).workspace_folder?.trim() || undefined;
-    }
-    catch {
-        configured = undefined;
-    }
-    if (configured)
-        return workspaceFolderFor(cwd);
-    return path.dirname(await workspaceFolderFor(cwd));
+    return resolveProjectFolderSync(cwd).workRoot;
 }
 /**
- * R17 — refuse a lane root whose `.cspeach` is the CLI home (`~/.cspeach`,
- * config + credentials): no lane or conventions file is ever written there.
+ * R17 — why a lane root (or a plan's pin root) may not be used, or null when
+ * it may. Refused: the home folder; a root whose `.cspeach` is a CLI home;
+ * the CLI home itself or anything under it — with ONE exception: a team
+ * seat's private working root `<cspeachRoot()>/work/<project id>`, exactly.
+ *
+ * Task 14 — compared on REAL paths of the nearest existing ancestor (a root
+ * that does not exist yet, spelled through a link or an 8.3 name, cannot
+ * slip past); BOTH homes are guarded (`cspeachRoot()` and `~/.cspeach`);
+ * the hard refusals run BEFORE the work-root allow; a path whose real form
+ * cannot be known is refused. The message names the seat folder.
  */
-export async function assertNotCliHome(root) {
-    // Final residual 2 — compare REAL paths, so a junction / symlink to home
-    // (or to ~/.cspeach) cannot slip past a string compare. `.cspeach` may not
-    // exist yet: then the root itself must not be the home folder.
-    const key = async (p) => {
-        const r = await realOr(p);
-        return process.platform === 'win32' ? r.toLowerCase() : r;
-    };
-    const [dot, cliHome, rootReal, home] = await Promise.all([
-        key(path.join(root, '.cspeach')), key(cspeachRoot()), key(root), key(os.homedir()),
-    ]);
-    if (dot === cliHome || rootReal === home) {
-        throw new Error('the lane folder would be inside the cspeach home folder (~/.cspeach). Set workspace_folder to a project folder.');
+export function cliHomeRefusal(root) {
+    const seats = [cspeachRoot(), defaultCspeachRoot()].filter((s, i, a) => a.indexOf(s) === i);
+    const msg = (seat) => `the lane folder would be inside the cspeach home folder (${seat}). Start CSPeach in your project folder.`;
+    const rootReal = caseKey(realForm(root));
+    const dot = caseKey(realForm(path.join(root, '.cspeach')));
+    const home = caseKey(realForm(os.homedir()));
+    if (rootReal === null || dot === null || home === null)
+        return msg(seats[0]);
+    // Hard refusals first: the home folder, or a `.cspeach` that is a CLI home.
+    if (rootReal === home)
+        return msg(defaultCspeachRoot());
+    const seatKeys = seats.map((s) => [s, caseKey(realForm(s))]);
+    for (const [s, k] of seatKeys) {
+        if (k === null || dot === k)
+            return msg(s);
+    }
+    // 2026-10-08 — a team member's private working root, exactly
+    // <cspeachRoot()>/work/<id> (never under ~/.cspeach when CSPEACH_HOME moved it).
+    // Its `.cspeach` must be its own (not a link elsewhere in the seat).
+    const chosen = seatKeys[0][1];
+    const rel = path.relative(chosen, rootReal);
+    const parts = rel.split(path.sep);
+    if (!path.isAbsolute(rel) && parts.length === 2 && parts[0] === 'work' && SAFE_PROJECT_ID.test(parts[1])) {
+        return dot === caseKey(path.join(rootReal, '.cspeach')) ? null : msg(seats[0]);
+    }
+    // Anything else in a CLI home — the root, or a `.cspeach` that links into one.
+    for (const [s, k] of seatKeys) {
+        if (rootReal === k || inside(rootReal, k) || inside(dot, k))
+            return msg(s);
     }
+    return null;
+}
+/** Throws when `root` may not be a lane root (see cliHomeRefusal). */
+export async function assertNotCliHome(root) {
+    const refusal = cliHomeRefusal(root);
+    if (refusal)
+        throw new Error(refusal);
 }
 const inside = (p, root) => {
     const rel = path.relative(root, p);
     return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
 };
 const realOr = async (p) => fs.realpath(p).catch(() => path.resolve(p));
+/**
+ * Task 14 — the real form of a folder that may not exist yet: the nearest
+ * EXISTING ancestor realpath'd (links followed, 8.3 names expanded), the
+ * missing tail re-attached. Null — the caller refuses — on any lookup error
+ * other than "does not exist", or (win32) a missing segment with '~' (a
+ * possible 8.3 name we cannot decode).
+ */
+function realForm(p) {
+    let cur = path.resolve(p);
+    const tail = [];
+    for (;;) {
+        try {
+            const r = realpathSync.native(cur);
+            return tail.length ? path.join(r, ...tail) : r;
+        }
+        catch (e) {
+            if (e?.code !== 'ENOENT')
+                return null;
+            const parent = path.dirname(cur);
+            if (parent === cur)
+                return null;
+            const name = path.basename(cur);
+            if (process.platform === 'win32' && name.includes('~'))
+                return null;
+            tail.unshift(name);
+            cur = parent;
+        }
+    }
+}
+const caseKey = (p) => (p === null ? null : process.platform === 'win32' ? p.toLowerCase() : p);
 export class SpecProtectedError extends Error {
     constructor(specPath) {
         super(`spec file is in a protected location and cannot be read: ${specPath}`);
@@ -95,6 +145,12 @@ export async function containSpecPath(cwd, specPath) {
     const realRoots = await Promise.all(roots.map(realOr));
     if (!realRoots.some((r) => inside(real, r)))
         throw new PathOutsideRootError(specPath, cwd);
+    // Ruling 14 (Task 14) — the one explicit opening into the seat: a spec-gap
+    // ENVELOPE saved directly in <seat>/work/<id>/.cspeach, read-only (the
+    // read-only seat shape, judged on the spelled and the real path). Anything
+    // else in the seat (a raw .md, other envelopes, lane files) stays refused.
+    if (SPEC_GAP_NAME_RE.test(path.basename(real)) && isSeatReadOnlyFile(abs) && isSeatReadOnlyFile(real))
+        return { abs, real };
     const guards = [...realRoots, await realOr(await laneRootFor(cwd))];
     for (const r of guards) {
         if (inside(real, r) && isDenylistedPath(real, r).blocked)

package/dist/one-shot.js

@@ -69,12 +69,14 @@ import './tools/project/convention_get.js';
 import './tools/project/cca_merge.js';
 import './tools/project/upgrade_merge_progress.js';
 import './tools/project/team_findings.js';
+import './tools/project/team_estate.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
 import './tools/subagent/schedule_draft_create.js';
 import './tools/subagent/agent_run.js';
 import './tools/subagent/read_agent.js';
+import { folderTag } from './session/project-match.js';
 export async function runOneShot(prompt, opts) {
     applyColorMode(); // NO_COLOR (piece 2 §1.2)
     const cfg = await loadConfig();
@@ -192,8 +194,25 @@ export async function runOneShot(prompt, opts) {
         }
         adt = new AdtClient(conn);
     }
-    const session = newSession(makeSessionId(), alias, null, resolveModelRole('session_default', cfg));
+    const session = newSession(makeSessionId(), alias, null, resolveModelRole('session_default', cfg), folderTag(process.cwd()));
     await saveSession(session);
+    // Guided clean-core journey (Task 3) — one-shot is headless: a journey
+    // sentence prints its next step and queues nothing; no model call. Only a
+    // START sentence (or the explicit /abap-clean-core start form): a bare
+    // "continue" / "carry on" keeps its old meaning here (final fix wave).
+    {
+        const { parseJourneyStart } = await import('./journey/trigger.js');
+        const journey = parseJourneyStart(prompt);
+        if (journey) {
+            const { runJourneyEntry } = await import('./repl/journey-entry.js');
+            await runJourneyEntry(journey, {
+                session, cwd: process.cwd(), adt, sapAlias: alias, standalone, headless: true,
+                emit: (line) => writeStdout(line + '\n'),
+                signal: new AbortController().signal,
+            });
+            return 0;
+        }
+    }
     const parsed = parseShortcut(prompt);
     const body = parsed.prompt;
     let skill;

package/dist/projects/clean-core-confirm.js

@@ -1,3 +1,5 @@
+import { shown, shownUpTo } from '../register/atc-file.js';
+import { STEPS, stepOf } from '../journey/clean-core.js';
 const WORD = {
     keep: 'keep', exception: 'accepted exception', fix: 'fix', rebuild: 'rebuild beside the core', retire: 'retire',
 };
@@ -34,3 +36,157 @@ export async function confirmCleanCoreRows(ex, a) {
         items: ex.items.map((i) => ({ ...i, status: byId.get(i.id) ? 'confirmed' : 'declined' })),
     };
 }
+export const KEEP_QUESTION = 'Why keep it?';
+/** "Yes to the remaining n shown" is offered once this many rows are answered. */
+const OFFER_REST_AFTER = 3;
+const MAX_KEEP_REASON = 300;
+/** A long reason wraps onto at most this many rows of the card. */
+export const FACT_ROWS = 5;
+const keyOf = (r) => `${r.objectType.trim().toUpperCase()}|${r.objectName.trim().toUpperCase()}`;
+/** The person's reason as one plain line: escapes, control characters and line breaks go; at most 300 characters. */
+export function cleanKeepReason(raw) {
+    // Cut by code point, so an emoji at the edge is never split in half.
+    return Array.from(shownUpTo(raw ?? '', Number.POSITIVE_INFINITY)).slice(0, MAX_KEEP_REASON).join('').trim();
+}
+/** The proposal in words, without the reason (the reason is a fact line on the card). */
+function proposalWords(r) {
+    return rowWords({ ...r, reason: '' });
+}
+export async function decideCleanCoreRows(ex, j) {
+    const all = ex.content.adjudications;
+    const rows = all.map((r) => ({ ...r, confirmed: false }));
+    const tally = { total: all.length, yes: [], kept: [], skipped: [], cancelled: false };
+    const footnote = `Step ${stepOf('DECIDE')} of ${STEPS}`;
+    let answered = 0;
+    rowLoop: for (let i = 0; i < rows.length; i++) {
+        const r = rows[i];
+        const type = shown(r.objectType);
+        const name = shown(r.objectName);
+        const left = rows.length - i;
+        const why = shownUpTo(r.reason ?? '', MAX_KEEP_REASON);
+        let canKeep = true;
+        let settled = false;
+        for (let tries = 0; tries < 20 && !settled; tries++) {
+            const offerRest = answered >= OFFER_REST_AFTER && left >= 2;
+            const res = await j.card({
+                id: 'journey-row',
+                tag: 'QUESTION',
+                title: `Record ${type} ${name}: ${proposalWords({ ...r, objectType: type, objectName: name })}?`,
+                facts: [...(why ? [`Why: ${why}`] : []), `Row ${i + 1} of ${rows.length}.`],
+                choices: [
+                    { value: 'yes', label: 'Yes' },
+                    ...(canKeep ? [{ value: 'keep', label: 'Keep as is' }] : []),
+                    { value: 'skip', label: 'Skip' },
+                    ...(offerRest ? [{ value: 'all', label: `Yes to the remaining ${left} shown` }] : []),
+                ],
+                initial: 0,
+                aliases: { y: 'yes', ...(canKeep ? { k: 'keep' } : {}), s: 'skip', ...(offerRest ? { a: 'all' } : {}) },
+                footnote,
+                // The reason is the point of the card: it wraps, never cut to one row.
+                wrapFacts: FACT_ROWS,
+            });
+            if (res.cancelled || res.value === null) {
+                tally.cancelled = true;
+                break rowLoop;
+            }
+            if (res.value === 'all' && offerRest) {
+                for (let k = i; k < rows.length; k++) {
+                    rows[k] = { ...rows[k], confirmed: true };
+                    tally.yes.push(keyOf(rows[k]));
+                }
+                break rowLoop;
+            }
+            if (res.value === 'yes') {
+                rows[i] = { ...r, confirmed: true };
+                tally.yes.push(keyOf(r));
+                settled = true;
+                continue;
+            }
+            if (res.value === 'skip') {
+                tally.skipped.push(keyOf(r));
+                j.skip([keyOf(r)]);
+                settled = true;
+                continue;
+            }
+            if (res.value === 'keep' && canKeep) {
+                if (!r.level) {
+                    j.log(`No level is known for ${type} ${name}, so it cannot be kept as is. Choose Yes or Skip.`);
+                    canKeep = false;
+                    continue;
+                }
+                let said;
+                try {
+                    said = await j.ask(KEEP_QUESTION);
+                }
+                catch {
+                    tally.cancelled = true;
+                    break rowLoop;
+                }
+                const reason = cleanKeepReason(said);
+                if (!reason) {
+                    j.log(`A keep needs a reason. Nothing was recorded for ${type} ${name} yet.`);
+                    continue;
+                }
+                rows[i] = { ...r, disposition: 'exception', targetLevel: null, reason, confirmed: true };
+                tally.kept.push({ key: keyOf(r), type: r.objectType.toUpperCase(), name: r.objectName.toUpperCase(), level: r.level });
+                settled = true;
+            }
+        }
+        // Asked over and over with no usable answer: a Skip, never "answered" with nothing recorded.
+        if (!settled) {
+            j.log('No reason given — skipped for now.');
+            tally.skipped.push(keyOf(r));
+            j.skip([keyOf(r)]);
+        }
+        answered += 1;
+    }
+    const byId = new Map(rows.map((r) => [r.id, r.confirmed]));
+    return {
+        extract: {
+            ...ex,
+            content: { ...ex.content, adjudications: rows },
+            items: ex.items.map((it) => ({ ...it, status: byId.get(it.id) ? 'confirmed' : 'declined' })),
+        },
+        tally,
+    };
+}
+/**
+ * The lines after the rows are written: one per kept row, then the count
+ * ("4 of 5 rows recorded; 1 kept by decision; 0 skipped."). "Recorded" counts
+ * the rows recorded as proposed; a row the project refused is not counted.
+ */
+export function journeyRowLines(t, refused) {
+    const out = new Set(refused.map((k) => k.trim().toUpperCase()));
+    const kept = t.kept.filter((k) => !out.has(k.key));
+    const yes = t.yes.filter((k) => !out.has(k.toUpperCase())).length;
+    return [
+        ...kept.map((k) => `✓ Recorded: ${shown(k.type)} ${shown(k.name)} — kept at ${k.level}, reason recorded.`),
+        `${yes} of ${t.total} rows recorded; ${kept.length} kept by decision; ${t.skipped.length} skipped.`,
+    ];
+}
+/**
+ * The working-list line inside a journey: the person keeps "your list", never
+ * a file name, a team word or a command to type (Task 7). Null: nothing to say.
+ */
+export function journeyListLine(kind) {
+    if (kind === 'updated')
+        return 'Your list is updated.';
+    if (kind === 'held')
+        return 'Your list is open in another program, so it was not updated. Close it; your next decision updates it.';
+    if (kind === 'unreadable')
+        return 'Your list could not be updated: the folder could not be read right now.';
+    return null;
+}
+/** Inside a journey, on a laptop with no project open here (the triage is saved; nothing recorded). */
+export const JOURNEY_NOT_IN_PROJECT_LINE = 'Not recorded: no record is kept in this folder yet.';
+/** Page objects the triage did not answer, in one line: up to five named, then how many more. */
+export function leftOutLine(keys) {
+    const named = keys.slice(0, 5).map((k) => {
+        const [type = '', name = ''] = k.split('|');
+        return `${shown(type)} ${shown(name)}`.trim();
+    });
+    const more = keys.length - named.length;
+    const one = keys.length === 1;
+    return `${keys.length.toLocaleString('en-US')} ${one ? 'object' : 'objects'} on this page ${one ? 'was' : 'were'} not in the triage: `
+        + `${named.join(', ')}${more > 0 ? ` (and ${more.toLocaleString('en-US')} more)` : ''}. Left for later — say carry on to look at them again.`;
+}

package/dist/projects/detail-path.js

@@ -63,10 +63,10 @@ function realOrNull(p) {
 /**
  * The real path of the first candidate that exists, is a regular file, stays
  * inside `<base>/<first two segments of rel>/` after links are followed, and
- * is not denylisted relative to `cwd`. null otherwise.
+ * is not denylisted relative to its own deny root (default `cwd`). null otherwise.
  */
 function firstContained(cands, cwd) {
-    for (const { base, rel, keep } of cands) {
+    for (const { base, rel, keep, denyRoot } of cands) {
         const realBase = realOrNull(path.resolve(base));
         const real = realOrNull(path.join(path.resolve(base), ...rel.split('/')));
         if (!realBase || !real)
@@ -76,7 +76,7 @@ function firstContained(cands, cwd) {
         const inner = path.relative(folder, real);
         if (inner === '' || inner.startsWith('..') || path.isAbsolute(inner))
             continue;
-        if (isDenylistedPath(real, cwd).blocked)
+        if (isDenylistedPath(real, denyRoot ?? cwd).blocked)
             continue;
         try {
             if (!statSync(real).isFile())
@@ -109,7 +109,12 @@ export async function resolveDetailFile(detailPath, domain, cwd) {
     const segs = rel.split('/');
     if (segs[0].toLowerCase() === '.cspeach') {
         try {
-            cands.push({ base: await workspaceFolderFor(cwd), rel: segs.slice(1).join('/'), keep: 1 });
+            // Judged against the folder that holds the workspace `.cspeach` — the
+            // seat work root for a team folder (Task 14 fix round 1), so the seat
+            // opening applies there and a team folder on another drive or share
+            // cannot make the path look foreign; the start folder for a solo folder.
+            const ws = await workspaceFolderFor(cwd);
+            cands.push({ base: ws, rel: segs.slice(1).join('/'), keep: 1, denyRoot: path.dirname(ws) });
         }
         catch { /* no workspace — project root only */ }
     }

package/dist/projects/extract-clean-core.js

@@ -48,6 +48,9 @@ export function extractCleanCoreDecision(markdown) {
                 throw new Error(`${id}: a row needs an object type and a name`);
             if (disposition === 'exception' && !reason)
                 throw new Error(`${id}: an accepted exception needs a reason`);
+            // Spec 2026-10-06 §7: a retire is a candidate the lead confirms; it never travels without what was checked.
+            if (disposition === 'retire' && !reason)
+                throw new Error(`${id}: a retire needs a reason: say what was checked`);
             const moves = disposition === 'fix' || disposition === 'rebuild';
             rows.push({
                 id, objectType: type.toUpperCase(), objectName: name.toUpperCase(), level: letter(level, id), disposition,

package/dist/projects/migration.js

@@ -1,115 +1,14 @@
 /**
- * One-time workspace-default migration prompt.
+ * One-time `.abapforge/` → `.cspeach/` output-namespace migration offer.
  *
- * Why this exists: until 2026-05-07 the default workspace was `~/CSPeach/`
- * — a single global folder per user. As of 2026-05-08 the default is
- * project-rooted (`<git-root>/.cspeach/`), so a consultant working on
- * customer A and customer B no longer has both customers' artefacts
- * piling into one folder.
- *
- * For users with files already in `~/CSPeach/`, the switch needs to ask
- * once: keep the old global, move into the new project, or leave both
- * alone. The answer is recorded in `config.migration_prompted`; the
- * prompt fires exactly once.
- *
- * Three branches:
- *   - "move":         renameSync every artefact from ~/CSPeach/ into the
- *                     resolved project workspace. Old folder cleaned.
- *   - "keep_global":  set workspace_folder = '~/CSPeach', preserving the
- *                     pre-2026-05-08 behaviour for users who liked it.
- *   - "leave":        do nothing — old folder stays as-is, new artefacts
- *                     go to the project workspace. User can manually
- *                     copy whatever they want later.
- *
- * The prompt is interactive (via the supplied async prompt callback);
- * one-shot mode skips it entirely (caller passes a no-op).
+ * The old first-run workspace prompt (2026-05-08, which could pin
+ * `workspace_folder`) was removed 2026-10-08: files now save in the folder
+ * you start in. See workspace-retire.ts for the offer that retires the key.
  */
 import { existsSync, mkdirSync, readdirSync, renameSync, rmdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import os from 'node:os';
 import { loadConfig, saveConfig } from '../config/loader.js';
-import { defaultWorkspaceFor } from './workspace.js';
 import { OUTPUT_ROOT, LEGACY_ROOT } from './output-paths.js';
-/**
- * Run the migration prompt if and only if it hasn't run before AND
- * there's actually something to migrate. No-op otherwise. Always sets
- * `migration_prompted: true` after running so the next invocation
- * skips this whole module.
- */
-export async function maybePromptWorkspaceMigration(deps) {
-    const cfg = await loadConfig();
-    if (cfg.migration_prompted === true)
-        return;
-    // If user already pinned workspace_folder, they've already chosen —
-    // mark prompted, skip the dialog. The pin survives.
-    if (cfg.workspace_folder !== undefined && cfg.workspace_folder.trim().length > 0) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    const oldWorkspace = join(os.homedir(), 'CSPeach');
-    if (!existsSync(oldWorkspace)) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    let oldFiles;
-    try {
-        oldFiles = readdirSync(oldWorkspace).filter((f) => f.endsWith('.cspeach.json') || f.endsWith('.txt') || f.endsWith('.md'));
-    }
-    catch {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    if (oldFiles.length === 0) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    const newWorkspace = defaultWorkspaceFor(process.cwd());
-    let choice;
-    try {
-        choice = await deps.prompt({
-            fileCount: oldFiles.length,
-            oldWorkspace,
-            newWorkspace,
-        });
-    }
-    catch {
-        // User Ctrl+C'd the prompt — leave migration_prompted unset so the
-        // dialog re-fires next session. Better than silently committing to
-        // a default they never saw.
-        return;
-    }
-    if (choice === 'move') {
-        try {
-            mkdirSync(newWorkspace, { recursive: true });
-            for (const f of oldFiles) {
-                const src = join(oldWorkspace, f);
-                const dst = join(newWorkspace, f);
-                if (existsSync(dst)) {
-                    deps.log(`(skipping ${f} — already exists in new workspace)`);
-                    continue;
-                }
-                renameSync(src, dst);
-            }
-            deps.log(`Moved ${oldFiles.length} file(s) → ${newWorkspace}`);
-        }
-        catch (err) {
-            deps.log(`Migration failed: ${err.message}. Old folder left untouched.`);
-        }
-    }
-    else if (choice === 'keep_global') {
-        await saveConfig({
-            ...cfg,
-            workspace_folder: oldWorkspace,
-            migration_prompted: true,
-        });
-        deps.log(`Workspace pinned to ${oldWorkspace}.`);
-        return; // saveConfig already done
-    }
-    else {
-        deps.log(`Leaving ${oldWorkspace} alone. New artefacts go to ${newWorkspace}.`);
-    }
-    await saveConfig({ ...cfg, migration_prompted: true });
-}
 /**
  * Recursively move every entry under `srcDir` into `dstDir`, MERGING into
  * existing directories rather than clobbering them. Files that already exist