@galda/cli 0.10.27 → 0.10.30

package/app/index.html

@@ -654,6 +654,18 @@
   .delmodal{width:380px}
   .delpreview{border:1px solid var(--hair2);border-radius:10px;padding:10px 12px;background:var(--paper);
     color:var(--ink);font-size:12.5px;line-height:1.5;max-height:120px;overflow:auto;word-break:break-word}
+  /* moment ③ New-project paywall dialog (H22). Same narrow .modal as .delmodal,
+     but a one-action layout (Masa 2026-07-17 確定 __dlg(2)): Upgrade full-width,
+     "Not now" a quiet underlined link centered below it. */
+  .flimdlg{width:380px}
+  .flimdlg .fd-lb{font:600 9px/1 var(--mono);letter-spacing:.11em;text-transform:uppercase;color:var(--danger);margin-bottom:8px}
+  .flimdlg h3{margin:0 0 8px;font-size:15px;letter-spacing:-.01em;color:var(--ink);text-wrap:balance}
+  .flimdlg p{margin:0;font-size:12.5px;color:var(--ink2);line-height:1.65}
+  .flimdlg .fd-row{display:flex;flex-direction:column-reverse;gap:10px;align-items:stretch;margin-top:16px}
+  .flimdlg .fd-cta{width:100%;height:34px}
+  .flimdlg .fd-no{border:0;background:0;height:auto;padding:0;color:var(--ink3);font:500 12px/1 var(--ui);
+    text-decoration:underline;text-underline-offset:2px;align-self:center;cursor:pointer}
+  .flimdlg .fd-no:hover{color:var(--ink2)}
   .howto{margin-top:14px;border:1px solid var(--hair);border-radius:10px;padding:10px 14px;background:var(--paper)}
   .howto b{font-size:12px;color:var(--ink)}
   .howto ol{margin:6px 0 0;padding-left:18px;font-size:11.5px;color:var(--ink2);line-height:1.8}
@@ -1095,8 +1107,11 @@
      the layout starts at the three cards. Frame = 14px all around (flagship .app{inset:14px}).
      Dev escape hatch: ?dev=1 (or localStorage devbar=1) adds body.devbar to show the bar. */
   body[data-layout="flagship"]:not(.devbar) .top{display:none}
-  body[data-layout="flagship"] #fsRoot{flex:1;min-height:0;display:flex;gap:12px;padding:14px;position:relative;
-    --fscenterw:760px} /* position:relative so .railgrip (a direct child, kept outside .fsrail's
+  body[data-layout="flagship"] #fsRoot{flex:1;min-width:0;min-height:0;display:flex;gap:12px;padding:14px;position:relative;
+    --fscenterw:760px} /* min-width:0 (Masa 2026-07-16): rail/lane are flex-shrink:0 (fixed basis), so without
+    this #fsRoot's own automatic min-width == their full combined width, and #fsRoot refuses to shrink
+    below that even though .fscenter (flex:1;min-width:0) is perfectly able to — the whole page overflowed
+    horizontally once the lane got wide instead of .fscenter just getting narrow. position:relative so .railgrip (a direct child, kept outside .fsrail's
     overflow:hidden — see below) can be placed via left:calc(var(--railw)...) and never get clipped.
     single source of truth for the reading column — .fsstream (feed) and
     .compwrap (composer) both read this var so they can never drift apart (fix: composer was
@@ -1219,7 +1234,7 @@
     color:color-mix(in srgb,var(--ink) 24%,transparent);cursor:pointer;
     display:grid;place-items:center;position:absolute;z-index:2;font:inherit}
   #fsRoot .railtg:hover,#fsRoot .lanetg:hover{background:transparent;color:color-mix(in srgb,var(--ink) 85%,transparent)}
-  #fsRoot .railtg{top:8px;right:6px}
+  #fsRoot .railtg{top:12px;right:6px} /* 28px button centers its glyph — lowered ~4px onto the Galda logo's visual baseline (Masa via CDO artifact 2026-07-16, not yet in flagship.html) */
   #fsRoot.railfold .railtg{right:50%;margin-right:-14px} /* centred in the folded 44px rail — the arrow, not rotation, signals the opening direction (v45 §4) */
   #fsRoot.railfold .fsrail{flex-basis:44px;padding:44px 7px 14px} /* top pad 44px — project dots clear the toggle (v45 §2) */
   #fsRoot.railfold .fsrail .lb,#fsRoot.railfold .fsproj span,#fsRoot.railfold .fsproj .num,#fsRoot.railfold .fsprojadd .pa-label{display:none}
@@ -1365,6 +1380,11 @@
      outright, its original home) — float it just above the input, matching the
      legacy layout's "just above the composer" placement (CDO判定 2026-07-16). */
   #fsRoot .compwrap>.errbar{position:absolute;left:50%;bottom:calc(100% + 10px);transform:translateX(-50%)}
+  /* Free-limit banner (H22) spans the composer, not a centered content-width pill
+     like a plain showErr toast: the width rule is scoped to .billing so ordinary
+     errors stay centered pills. left/right:0 stretches it to .compwrap's own box
+     (= composer width), and .bx-ask is display:flex so it fills that. */
+  #fsRoot .compwrap>.errbar.billing{left:0;right:0;transform:none}
   #fsRoot.lanefold{--fscenterw:1020px} /* folded space flows to the center (§1.5-7) — one var flip keeps feed+composer in lockstep */
   /* adopted composer (#composerWrap moves in — same node, same handlers, focus fix intact) */
   body[data-layout="flagship"] #composerWrap{padding:0;border-top:0;max-width:none;width:auto;margin:0}
@@ -1390,10 +1410,11 @@
      flagship-only 34px override that used to live here is gone, it was redundant
      with (and masked that) the base .send circle was still 32px elsewhere. */
   /* ---- right lane: Review (top, §1.5-4) + To Do timeline ---- */
-  #fsRoot .fslane{flex:0 0 var(--lanew,372px);display:flex;flex-direction:column;padding:36px 18px 14px;position:relative;
+  #fsRoot .fslane{flex:0 0 var(--lanew,372px);min-width:0;display:flex;flex-direction:column;padding:36px 18px 14px;position:relative;
     transition:flex-basis .28s cubic-bezier(.4,0,.2,1),padding .28s}
   #fsRoot .fslane.noanim{transition:none}
-  #fsRoot .lanetg{top:9px;left:10px} /* 畳みトグル: 左上・帯 (§6.5 確定 tgpos1 — lane padding-top 36px = the band strip) */
+  #fsRoot .lanetg{top:12px;left:10px} /* 畳みトグル: 左上・帯 (§6.5 確定 tgpos1 — lane padding-top 36px = the band strip).
+    top:12 (was 9) matches .railtg's Galda-baseline lower (Masa via CDO artifact 2026-07-16, not yet in flagship.html). */
   #fsRoot.lanefold .lanetg{left:50%;margin-left:-14px} /* no rotation (v45 §4) */
   #fsRoot.lanefold .fslane{flex-basis:44px;padding:18px 7px}
   #fsRoot.lanefold .fslane>*:not(.lanetg){display:none}
@@ -1403,6 +1424,79 @@
   #fsRoot .lanebody{display:flex;flex-direction:column;min-height:0;flex:1;overflow-y:auto;overflow-x:hidden;scrollbar-width:none}
   #fsRoot .lanebody::-webkit-scrollbar{display:none}
   #fsRevSec:not(:empty){margin-bottom:12px}
+
+  /* ---- To Do: List/Board view toggle, in the To Do header — same spot both modes (Masa 2026-07-16) ---- */
+  /* List/Board toggle: a FIXED overlay beside the fold icon, in BOTH modes — matching the
+     Artifact's .labseg.inlane exactly (2026-07-17: it's never inline in the To Do header row
+     in the Artifact, always an absolute sibling of .lanetg; a prior commit put it inside
+     #fsTodoHd's flow instead, which pushed it onto its own row below the fold icon whenever
+     the header text above it wrapped/existed — "まだなおってない" screenshot). .lanetg is
+     top:12/left:10/width:28 (center y=26) → this sits at the same 8px gap the Artifact uses
+     after its own fold icon, vertically centered on that same 26px line. */
+  #fsRoot .fstvseg{position:absolute;top:16px;left:42px;z-index:6;display:inline-flex;gap:2px} /* top/left measured directly off the Artifact's own
+    .labseg.inlane (2026-07-17: opened it locally, getBoundingClientRect()) — centers on .lanetg exactly like the fold icon,
+    left:42 = .lanetg's right edge (10+28=38) + a measured 4px gap (an earlier pass guessed 46/8px without measuring the gap itself). */
+  /* Board mode: the "To Do N" title is redundant once a To Do COLUMN exists among the board's
+     own columns — hide it; the toggle+fold are unaffected since they no longer live inside it
+     (Masa 2026-07-16: 看板の時は上のTo Doを消してよい — the column keeps the name). */
+  #fsRoot .fslane.boardmode #fsTodoHd{margin-bottom:0}
+  #fsRoot .fslane.boardmode #fsTodoHd .fstdlabel{display:none}
+  /* toggle tone matches the CDO Artifact's .labseg button exactly (2026-07-17 checked against
+     the Artifact directly, not a guess): ink3 @ opacity .75 at rest, hover/on = filled
+     background + full ink + opacity 1. This is a DIFFERENT convention from the fold buttons
+     (which are glyph-only, no fill) — the segmented toggle is its own component and the
+     Artifact deliberately fills a background for the selected state; a prior commit "fixed"
+     this to match the fold buttons' no-fill rule, which was the wrong reference. */
+  #fsRoot .fstvb{width:22px;height:20px;padding:0;display:grid;place-items:center;border:0;background:transparent;color:var(--ink3);cursor:pointer;border-radius:6px;opacity:.75;font:inherit} /* 22x20/radius:6 — was 20x18/radius:5, an unmeasured guess ("小さい") */
+  #fsRoot .fstvb:hover{background:var(--hover);color:var(--ink);opacity:1}
+  #fsRoot .fstvb.on{background:var(--hover);color:var(--ink);opacity:1}
+  #fsRoot .fstvb:focus:not(:focus-visible){outline:none}
+  #fsRoot .fstvb svg{width:13px;height:13px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round} /* was 12px, guessed */
+  #fsRoot .fstvb svg rect{fill:none}
+
+  /* ---- kanban board: fills the SAME lane slot the To Do list uses (var(--lanew-board), independent
+     from the list's own var(--lanew)) — swapping List⇄Board never resizes the lane or the chat.
+     5+ columns don't fit the lane width, so it scrolls horizontally in place instead of growing. ---- */
+  #fsRoot .fslane.boardmode{flex-basis:var(--lanew-board,372px)}
+  #fsRoot .fslane.boardmode #fsTodoSec .tl,#fsRoot .fslane.boardmode #fsTodoSec .doneline,#fsRoot .fslane.boardmode #fsTodoSec #fsDonelist{display:none}
+  #fsBoard{display:none;gap:14px;flex:1 1 auto;min-width:0;min-height:0;overflow-x:auto;overflow-y:hidden;padding:0 0 4px 0;margin-top:26px;align-items:flex-start;line-height:1.5} /* 26px measured directly off the Artifact's #labBoard (was 8px — guessed, never checked).
+    line-height:1.5 — the Artifact's <body> sets this globally and every board text element inherits it (measured: .labcolnm computes to 18.75px = 12.5×1.5);
+    this app's <body> doesn't set a global line-height, so the same elements were rendering at the browser's "normal" default instead — same
+    container-box position (measured identical, 63px both), but the glyph sits differently inside that box. Scoped here, not on <body>, to avoid
+    a global typography change. */
+  #fsRoot .fslane.boardmode #fsBoard{display:flex}
+  #fsBoard::-webkit-scrollbar{height:8px}#fsBoard::-webkit-scrollbar-thumb{background:var(--hair);border-radius:6px}
+  .fsbcol{flex:0 0 200px;max-height:100%;display:flex;flex-direction:column;min-height:0}
+  .fsbcolhd{display:flex;align-items:center;gap:8px;padding:1px 4px 9px;flex:0 0 auto}
+  .fsbdot{width:7px;height:7px;border-radius:50%;background:var(--stg,var(--ink3));flex:0 0 auto;box-shadow:0 0 0 3px color-mix(in srgb,var(--stg,#fff) 14%,transparent)}
+  .fsbcolnm{font-size:12.5px;font-weight:600;color:var(--ink);letter-spacing:-.01em}
+  .fsbcnt{font-family:var(--mono);font-size:10px;color:var(--ink3);font-variant-numeric:tabular-nums;background:var(--surf);border-radius:5px;padding:1px 6px}
+  .fsbbody{flex:1;min-height:12px;overflow-y:auto;padding:1px 2px 6px;display:flex;flex-direction:column;gap:5px}
+  .fsbbody::-webkit-scrollbar{width:7px}.fsbbody::-webkit-scrollbar-thumb{background:var(--hair);border-radius:6px}
+  .fsbrow{padding:7px 9px;border-radius:8px;background:color-mix(in srgb,var(--ink) 5%,transparent);box-shadow:0 0 0 1px var(--hair);font-size:12.4px;display:flex;align-items:center;gap:6px}
+  .fsbrow .st{width:13px;height:13px;border-radius:50%;border:1.5px solid var(--hair2);flex:0 0 13px}
+  .fsbrow .st.run{border-color:var(--green);background:radial-gradient(circle,rgba(var(--green-rgb),.4),transparent 70%)}
+  .fsbrow .st.run.bad{border-color:var(--danger);background:radial-gradient(circle,rgba(var(--danger-rgb),.42),transparent 70%)}
+  .fsbrow .st.run.int{border-color:var(--amber);background:radial-gradient(circle,rgba(var(--amber-rgb),.4),transparent 70%)}
+  .fsbrow .st.ok{border-color:transparent;background:rgba(var(--green-rgb),.12);position:relative}
+  .fsbrow .st.ok::after{content:"✓";position:absolute;inset:0;display:grid;place-items:center;font-size:8px;color:var(--green)}
+  .fsbrow .st.rev{border-color:var(--blue);background:radial-gradient(circle,color-mix(in srgb,var(--blue) 42%,transparent),transparent 70%)}
+  .fsbrow .tt{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .fsbempty{color:var(--ink3);font-size:11px;padding:4px 2px}
+
+  /* ---- chat ⇄ lane panel swap: grab anywhere in the top ~40px of either panel, drop lands
+     EXACTLY on the side the dashed guide showed. Rail is not part of this (Masa 2026-07-16). ---- */
+  #fsRoot .fscenter{order:1}
+  #fsRoot .fslane{order:2}
+  #fsRoot.swapmid .fscenter{order:2}
+  #fsRoot.swapmid .fslane{order:1}
+  #fsRoot .panelgrip{position:absolute;top:10px;right:10px;width:24px;height:24px;display:grid;place-items:center;border:0;background:transparent;color:var(--ink3);opacity:.4;cursor:grab;border-radius:6px;z-index:5;transition:opacity .12s,background .12s} /* right:10 on BOTH .fscenter and .fslane, measured directly off the Artifact (2026-07-17) — it uses the same uniform 10/10 for both grips, no special-cased offset for #fsBandBtn (which is Cinema-theme-only and the Artifact doesn't dodge it either); a prior right:44px guess for .fscenter was the actual bug ("6点が左にずれてる") */
+  #fsRoot .panelgrip:hover{opacity:1;background:var(--hover)}
+  #fsRoot .panelgrip svg{width:14px;height:14px;fill:currentColor}
+  #fsRoot .panel-over{outline:2px dashed color-mix(in srgb,var(--ink) 22%,transparent);outline-offset:-2px;border-radius:14px}
+  #fsRoot .fscenter.top-armed,#fsRoot .fslane.top-armed{cursor:grab}
+  #fsRoot .fscenter.top-armed:active,#fsRoot .fslane.top-armed:active{cursor:grabbing}
+  #panelDropLine{position:absolute;width:0;display:none;border-left:2px dashed var(--ink2);z-index:20;pointer-events:none;border-radius:2px}
   #fsRoot .lhd{display:flex;align-items:baseline;gap:8px;margin-bottom:12px}
   #fsRoot .lhd .hd{font-size:13.5px;letter-spacing:-.02em}
   #fsRoot .lhd .num{font-size:10px;color:var(--ink3)}
@@ -2103,19 +2197,33 @@
     body[data-layout="flagship"] .gearpop{left:10px!important;right:10px!important;top:64px!important;
       width:auto!important;max-width:none;max-height:calc(100dvh - 88px)}
   }
-  /* Billing UI (H16) — self-serve plan. Tokens only; red is a line/label, never
-     a fill (DESIGN-RULES §5.6). CTA reverses ink/panel per theme; on the two
-     translucent-panel themes (banff, glass) the label is pinned opaque so it
-     doesn't wash out. */
-  .bx-cta{height:29px;display:inline-flex;align-items:center;justify-content:center;gap:4px;padding:0 13px;border-radius:8px;background:var(--ink);color:var(--panel);font:550 11.5px/1 var(--ui);border:0;cursor:pointer}
+  /* Billing UI (H16/H22) — self-serve plan. Tokens only; red is a line/label,
+     never a fill (DESIGN-RULES §5.6), and it is --danger (the app's real token —
+     there is no --red here). The CTA text is --invink (defined per theme, always
+     readable on --ink) so it needs no per-theme opaque pin. */
+  .bx-cta{height:29px;display:inline-flex;align-items:center;justify-content:center;gap:4px;padding:0 13px;border-radius:8px;background:var(--ink);color:var(--invink);font:550 11.5px/1 var(--ui);border:0;cursor:pointer}
   .bx-cta:hover{opacity:.9}
-  .bx-pm{font-family:var(--mono);font-size:10.5px;opacity:.82;margin-left:2px}
-  body[data-theme="banff"] .bx-cta,body[data-theme="glass"] .bx-cta{color:#101014}
+  /* Masa 2026-07-17: tapping Upgrade jumps straight to Stripe's own page — no
+     transition reads as "did that even do anything?". A spinner in the button
+     itself (not a separate overlay) confirms the tap landed during the request
+     round-trip, right up until the redirect actually happens. Reuses the
+     existing @keyframes spin (line ~130) rather than inventing a new one. */
+  .bx-cta.loading{cursor:default;opacity:.85}
+  .bx-spin{display:none}
+  .bx-cta.loading .bx-spin{display:inline-block;width:11px;height:11px;border-radius:50%;border:1.5px solid rgba(255,255,255,.4);border-top-color:#fff;animation:spin .7s linear infinite;margin-right:1px}
+  body[data-theme="banff"] .bx-cta.loading .bx-spin,body[data-theme="glass"] .bx-cta.loading .bx-spin{border-color:rgba(16,16,20,.35);border-top-color:#101014}
+  /* Price = figure only, currency small (DESIGN-RULES §5.5 / flagship .fl-pm):
+     the $ is set to 74% of the figure and optically raised so its top meets the
+     digits' cap line (§5.5 グリフで揃える), not sunk to the baseline. No /mo on
+     the button — the number is the message. This is the ONE place a price is
+     styled; every screen inherits it via fmtPrice(). */
+  .bx-pm{font-family:var(--mono);font-size:10.5px;opacity:.82;margin-left:2px;font-variant-numeric:tabular-nums}
+  .bx-pm .cur{margin-right:.5px;font-size:.74em;vertical-align:.12em}
   /* ① free-limit prompt — rendered in #errbar with .billing neutralizing its error fill */
   .errbar.billing{background:transparent!important;backdrop-filter:none!important;box-shadow:none!important;border:0!important;padding:0!important}
-  .bx-ask{border:1px solid var(--hair);border-left:2px solid var(--red);border-radius:11px;padding:10px 13px;display:flex;align-items:center;gap:14px;background:var(--panel)}
+  .bx-ask{border:1px solid var(--hair);border-left:2px solid var(--danger);border-radius:11px;padding:10px 13px;display:flex;align-items:center;gap:14px;background:var(--panel)}
   .bx-qt{flex:1;text-align:left}
-  .bx-lb{font:600 9px/1 var(--mono);letter-spacing:.11em;text-transform:uppercase;color:var(--red)}
+  .bx-lb{font:600 9px/1 var(--mono);letter-spacing:.11em;text-transform:uppercase;color:var(--danger)}
   .bx-q{font-size:13px;color:var(--ink);margin-top:4px}
   .bx-act{flex:none}
   /* neutral ask (not a limit/error — e.g. the sign-in nudge): same card, --blue
@@ -2123,6 +2231,13 @@
      (§7決定ログ「AI確認：色は青系」) rather than inventing a new color. */
   .bx-ask.info{border-left-color:var(--blue)}
   .bx-ask.info .bx-lb{color:var(--blue)}
+  /* free-tier pending counter in the To Do header (H22): mono figure, dim slash,
+     --danger at the cap. Built only on the free plan (see renderFsTodo), so it
+     needs no display toggle here — it simply replaces the lane-total .num. */
+  .fcount{font-family:var(--mono);font-size:11px;font-variant-numeric:tabular-nums;color:var(--ink3)}
+  .fcount .fc-l{opacity:.62}
+  .fcount.cap{color:var(--danger)}
+  .fcount.cap .fc-l{opacity:.75}
   /* ② post-checkout return bar */
   .bx-cobar{box-shadow:inset 0 0 0 1px var(--hair2);border-radius:11px;padding:10px 13px;display:flex;align-items:center;gap:10px;font-size:12.5px;margin:0 auto 12px;width:100%;max-width:var(--fscenterw,760px)}
   .bx-cobar[hidden]{display:none}
@@ -2295,6 +2410,7 @@
          overflow:hidden (Masa 2026-07-16). -->
     <div class="railgrip" id="fsRgrip" title="Drag to resize"></div>
     <div class="fscard fscenter">
+      <button class="panelgrip" draggable="true" title="Drag to swap chat ⇄ lane"><svg viewBox="0 0 24 24"><circle cx="9" cy="6" r="1.6"/><circle cx="15" cy="6" r="1.6"/><circle cx="9" cy="12" r="1.6"/><circle cx="15" cy="12" r="1.6"/><circle cx="9" cy="18" r="1.6"/><circle cx="15" cy="18" r="1.6"/></svg></button>
       <div id="fsBand"></div>
       <button id="fsBandBtn" title="Change the band image"><svg viewBox="0 0 24 24"><rect x="3" y="5" width="18" height="14" rx="2"/><path d="M3 15l5-4 4 3 4-5 5 6"/></svg></button>
       <div id="fsBandPop"><div class="bandgrid">
@@ -2329,11 +2445,17 @@
     </div>
     <div class="fsdim" id="fsLaneDim"></div>
     <div class="fscard fslane" id="fsLane">
+      <button class="panelgrip" draggable="true" title="Drag to swap chat ⇄ lane"><svg viewBox="0 0 24 24"><circle cx="9" cy="6" r="1.6"/><circle cx="15" cy="6" r="1.6"/><circle cx="9" cy="12" r="1.6"/><circle cx="15" cy="12" r="1.6"/><circle cx="9" cy="18" r="1.6"/><circle cx="15" cy="18" r="1.6"/></svg></button>
       <button class="lanetg" id="fsLaneTg" title="Fold the lane"></button><!-- panel icon filled by tgUpdate (v45 §4) -->
+      <span class="fstvseg" id="fsTvSeg"><!-- List/Board toggle — fixed beside the fold icon in BOTH modes, matching the Artifact (not inline in the To Do header) -->
+        <button class="fstvb" data-fstv="list" title="List"><svg viewBox="0 0 24 24"><path d="M4 6h16M4 12h16M4 18h10"/></svg></button>
+        <button class="fstvb" data-fstv="board" title="Board"><svg viewBox="0 0 24 24"><rect x="3" y="4" width="5" height="16" rx="1"/><rect x="10" y="4" width="5" height="16" rx="1"/><rect x="17" y="4" width="4" height="16" rx="1"/></svg></button>
+      </span>
       <div class="lanegrip" id="fsGrip" title="Drag to resize"></div>
       <div class="lanebody">
         <div id="fsRevSec"></div>
         <div id="fsTodoSec"></div>
+        <div id="fsBoard"></div>
       </div>
     </div>
   </div>
@@ -2510,6 +2632,21 @@
     </div>
   </div>
 </div>
+<!-- moment ③: the New-project paywall dialog (H22). Reuses the .overlay dim+blur +
+     narrow .modal of the delete confirm (the product's one dimmed dialog family),
+     with a one-action layout: Upgrade full-width, "Not now" a quiet link under it.
+     Title/body/price are filled per language at open (openProjectLimitDialog). -->
+<div class="overlay" id="flimProjOverlay">
+  <div class="modal flimdlg">
+    <div class="fd-lb">Free limit</div>
+    <h3 id="flimProjTitle"></h3>
+    <p id="flimProjBody"></p>
+    <div class="fd-row">
+      <button class="bx-cta fd-cta" id="flimProjUpgrade"><span class="bx-spin"></span>Upgrade</button>
+      <button class="fd-no" id="flimProjNo">Not now</button>
+    </div>
+  </div>
+</div>
 <script>
 // Auth key lives in localStorage (the ?key= from the first visit) so auth
 // never depends on cookies — Chrome drops session cookies when the server
@@ -4912,6 +5049,7 @@ const fsUI = {
   band: Number(localStorage.getItem('fsBand') ?? 0),   // theme-6 band choice
   revMore: false,                                      // "+N more" fold on the review list (§1.5-8)
   todoFold: false, doneOpen: false, todoMore: false,
+  todoView: localStorage.getItem('fsTodoView') === 'board' ? 'board' : 'list', // To Do: list (default) / kanban board (Masa 2026-07-16)
   logOpen: new Set(), logFocus: null,                  // "View log" targets
   repsOpen: new Set(),                                 // reply-group folds
 };
@@ -5198,6 +5336,10 @@ function toggleGoalDetail(goalId){
   if (state.goalDetailOpen === goalId && overlay.classList.contains('show')) closeGoalDetail();
   else openGoalDetail(goalId);
 }
+function syncFsTvSeg(){
+  const seg = $('fsTvSeg'); if (!seg) return;
+  for (const b of seg.querySelectorAll('[data-fstv]')) b.classList.toggle('on', b.dataset.fstv === fsUI.todoView);
+}
 function renderFsLane(){
   if (state.layout !== 'flagship') return;
   const lane = $('fsLane'); if (!lane) return;
@@ -5205,7 +5347,86 @@ function renderFsLane(){
   // bug as the qreplyrow "vanishes mid-type" fix.
   const ae = document.activeElement;
   if (ae && lane.contains(ae) && ['INPUT', 'TEXTAREA'].includes(ae.tagName)) return;
+  lane.classList.toggle('boardmode', fsUI.todoView === 'board');
+  syncFsTvSeg();
   renderFsReview(); renderFsTodo();
+  if (fsUI.todoView === 'board') renderFsBoard();
+}
+// Which board column a GOAL belongs in. Follows goalChip()'s rule so the board and
+// the status chips can never drift; the two columns the chips have no word for
+// (Later / Needs you) are spelled out here. Pure: goal in, column key out.
+function fsBoardBucket(goal){
+  const s = goal?.status;
+  if (s === 'pending') return 'later';                          // shelved by the composer's "Later"
+  if (s === 'needsInput') return 'needs';                       // a clarifying question is waiting on the user
+  if (s === 'review') return 'review';
+  if (s === 'done' || s === 'reverted') return 'done';          // both terminal; REVERTED is not "in flight"
+  if (s === 'stacked' || s === 'sending') return 'todo';
+  if (s === 'running' && !goal.startedAt) return 'todo';        // goalChip: planned, nothing started yet
+  return 'doing';                                               // planning/running/retesting/blocked/failed — still in flight
+}
+// Kanban board — GOAL-level: one card per goal, never per task.
+//
+// A card is one thing the user asked for, and its #NN names that one thing exactly
+// once (Masa 2026-07-17). Tasks are the AI's decomposition of a single request —
+// the user didn't write them, doesn't review them one by one (proof and the PR are
+// per goal), and never says "#14" about one. They are the inside of a card, not
+// cards. The board used to lay out one card per TASK while #NN kept naming the
+// GOAL, so a goal split into three tasks put three cards reading "#13" in three
+// different columns.
+//
+// No drag-to-change-status: each status transition is its own gated server endpoint
+// (approve/dismiss/reverify/activate/…), there's no generic "set status" call to hook a
+// drag onto, so v1 is a visual overview only. Review already has its own rich section
+// above (proof thumbnails, PR links, approve/dismiss) — the board doesn't duplicate it.
+function renderFsBoard(){
+  const el = $('fsBoard'); if (!el) return;
+  const { pgoals, list, running } = fsBucketTodo();
+  const tt = (s, n) => esc(String(s ?? '').replace(/\s+/g, ' ').slice(0, n ?? 60));
+  const goalNo = new Map();
+  for (const g of pgoals) { const n = goalReviewNumber({ goal: g, tasks: list }); if (n != null) goalNo.set(g.id, n); }
+  const noSpan = (goalId) => { const n = goalId != null ? goalNo.get(goalId) : null; return n != null ? `<span class="gno" data-n="${n}">#${n}</span>` : ''; };
+  const card = (stCls, goalId, title, extra) =>
+    `<div class="fsbrow"><span class="st ${stCls}"></span>${noSpan(goalId)}<span class="tt">${tt(title)}</span>${extra ?? ''}</div>`;
+  const col = (name, stg, count, html) =>
+    `<section class="fsbcol" style="--stg:${stg}"><div class="fsbcolhd"><span class="fsbdot"></span><span class="fsbcolnm">${name}</span><span class="fsbcnt">${count}</span></div><div class="fsbbody">${html || '<div class="fsbempty">—</div>'}</div></section>`;
+  // The status dot keeps the meaning it had on task cards, read off the goal instead.
+  // Everything in Doing that isn't healthily in flight reads as an error, the way
+  // goalChip() calls them all FAIL — 'partial' (ran, but some tasks failed) included,
+  // or a half-failed goal would sit in Doing wearing a healthy green dot.
+  const dotFor = (g) => g.status === 'needsInput' ? 'run int'
+    : g.status === 'review' ? 'rev'
+    : (g.status === 'done' || g.status === 'reverted') ? 'ok'
+    : fsBoardBucket(g) !== 'doing' ? ''
+    : ['stacked', 'sending', 'planning', 'running', 'retesting'].includes(g.status) ? 'run'
+    : 'run bad'; // blocked / failed / partial / interrupted
+  // % is the RUNNING TASK's progress — the same number the old task cards showed, now
+  // carried by the goal it belongs to. What a card should really say about a goal split
+  // into several tasks (n/m done? the step's name? proof?) is a design question, and it
+  // is deliberately not invented here.
+  const pctFor = (g) => {
+    const t = running.find((r) => r.goalId === g.id);
+    return t ? `<span class="pct num">${progressFor(t)}%</span>` : '';
+  };
+  // The label is the goal's OWN request text, not plan[0] — showing the plan here just
+  // repeats the first task's title, which renderTasks() already learned the hard way
+  // (Masa: "このグレー文字ってなに?").
+  const goalCard = (g) => card(dotFor(g), g.id, g.text || g.plan?.[0], pctFor(g));
+  const no = (g) => goalNo.get(g.id) ?? Infinity;
+  const bucket = { todo: [], doing: [], needs: [], review: [], done: [], later: [] };
+  for (const g of pgoals) bucket[fsBoardBucket(g)].push(g);
+  for (const k of Object.keys(bucket)) bucket[k].sort((a, b) => k === 'done' ? no(b) - no(a) : no(a) - no(b));
+  // To Do / Doing / Needs you / Review / Done / Later — the original design's columns
+  // (Masa 2026-07-16). "Needs you" = a clarifying question is waiting on the user —
+  // distinct from "blocked" (an error needing retry/archive, which stays in Doing, the
+  // same grouping the List view already uses). Later (backlog) sits LAST, not before Done.
+  el.innerHTML =
+      col('To Do', 'var(--ink3)', bucket.todo.length, bucket.todo.map(goalCard).join(''))
+    + col('Doing', 'var(--green)', bucket.doing.length, bucket.doing.map(goalCard).join(''))
+    + (bucket.needs.length ? col('Needs you', 'var(--blue)', bucket.needs.length, bucket.needs.map(goalCard).join('')) : '')
+    + col('Review', 'var(--blue)', bucket.review.length, bucket.review.map(goalCard).join(''))
+    + col('Done', 'var(--green)', bucket.done.length, bucket.done.slice(0, 40).map(goalCard).join(''))
+    + col('Later', 'var(--ink3)', bucket.later.length, bucket.later.map(goalCard).join(''));
 }
 // Review (top of the lane, §1.5-4). Counts are DETERMINISTIC (§1.5-9): computed
 // from state via buildReviewDigest — no LLM, no donut, no badges.
@@ -5325,26 +5546,36 @@ function renderFsReview(){
       headers: { 'content-type': 'application/json' }, body: JSON.stringify({ text: '' }) });
     if (r && r.ok) await refresh(); else showErr('Dismiss failed.'); };
 }
-// To Do (below Review): Doing rows with bar + mono %, Next up in queue order,
-// error as a small in-row colour element (§1.5-8), quiet Done fold.
-function renderFsTodo(){
-  const el = $('fsTodoSec'); if (!el) return;
+// Shared To Do bucketing (list rows AND the kanban board read the same groups —
+// single source of truth, see renderFsBoard below). Pure of the DOM: state in, groups out.
+function fsBucketTodo(){
   const pgoals = state.goals.filter((g) => g.projectId === state.active);
   const list = state.tasks.filter((t) => t.projectId === state.active);
   const order = state.queueOrder[state.active] ?? [];
   const byQueue = (a, b) => { const ia = order.indexOf(a.id), ib = order.indexOf(b.id); return (ia < 0 ? 1e9 : ia) - (ib < 0 ? 1e9 : ib) || a.num - b.num; };
-  const running = list.filter((t) => t.status === 'running');
-  const failed = list.filter((t) => ['failed', 'interrupted'].includes(t.status));
-  const blocked = pgoals.filter((g) => g.status === 'blocked');
-  const queued = list.filter((t) => t.status === 'queued' && !t.reply).sort(byQueue);
-  const doneAll = list.filter((t) => ['done', 'skipped'].includes(t.status)).sort((a, b) => b.num - a.num);
+  return {
+    pgoals, list,
+    running: list.filter((t) => t.status === 'running'),
+    failed: list.filter((t) => ['failed', 'interrupted'].includes(t.status)),
+    blocked: pgoals.filter((g) => g.status === 'blocked'),
+    needsInput: pgoals.filter((g) => g.status === 'needsInput'), // a clarifying question is waiting on the user (board's "Needs you")
+    reviewGoals: pgoals.filter((g) => g.status === 'review'),
+    queued: list.filter((t) => t.status === 'queued' && !t.reply).sort(byQueue),
+    doneAll: list.filter((t) => ['done', 'skipped'].includes(t.status)).sort((a, b) => b.num - a.num),
+    later: pgoals.filter((g) => g.status === 'pending'),
+  };
+}
+// To Do (below Review): Doing rows with bar + mono %, Next up in queue order,
+// error as a small in-row colour element (§1.5-8), quiet Done fold.
+function renderFsTodo(){
+  const el = $('fsTodoSec'); if (!el) return;
+  const { pgoals, list, running, failed, blocked, queued, doneAll, later } = fsBucketTodo();
   const tt = (s, n) => esc(String(s ?? '').replace(/\s+/g, ' ').slice(0, n ?? 70));
   // LATER = deliberately shelved goals (composer "Later" send → server status 'pending';
   // PRD §8.2 top gap — they were invisible in flagship). Staged disclosure: the cap
   // renders only when they exist. Same endpoints as the old layout's data-pstart/pdel:
   // Start = POST /api/goals/:id/activate, Delete = DELETE /api/goals/:id (confirm).
   // No mono # — pending goals are never planned, so they carry no task number yet.
-  const later = pgoals.filter((g) => g.status === 'pending');
   const laterRows = later.map((g) => `<div class="trow up dim"><span class="st"></span><span class="tt">${tt(g.text, 70)}</span>
     <span class="acts"><button class="ab txt" data-fspstart="${g.id}" title="Queue it now">Start</button><button class="ab txt" data-fspdel="${g.id}" title="Delete">Delete</button></span></div>`).join('');
   // reference numbers (HANDOFF-v45 §11): a #NN prefix on every To Do / Review item's name.
@@ -5401,7 +5632,18 @@ function renderFsTodo(){
   // specifically, since that suffix describes the Next-up sublist's own sort, not the
   // lane total.
   const todoTotal = running.length + failed.length + blocked.length + queued.length + later.length;
-  el.innerHTML = `<div class="lhd sechd" id="fsTodoHd"><span class="hd">To Do</span><span class="num">${todoTotal}${queued.length ? ' · next-up order' : ''}</span><span class="fold">▾</span></div>
+  // Free-tier pending counter (H22): on the free plan the header shows the wall
+  // — pending goals out of the 5-slot cap — reddening at the cap and gone once
+  // paid. Reads the SAME numbers the gate enforces (state.billing, never a local
+  // recompute) so the header and the wall can't drift. usage.pending already
+  // excludes review server-side (#128).
+  const _bill = state.billing || {};
+  const _fp = _bill.usage?.pending, _fl = _bill.limits?.pending;
+  const _showFc = _bill.plan !== 'paid' && Number.isFinite(_fp) && Number.isFinite(_fl);
+  const _todoNum = _showFc
+    ? `<span class="fcount fstdlabel${_fp >= _fl ? ' cap' : ''}">${_fp}<span class="fc-l">/${_fl}</span></span>`
+    : `<span class="num fstdlabel">${todoTotal}${queued.length ? ' · next-up order' : ''}</span>`;
+  el.innerHTML = `<div class="lhd sechd" id="fsTodoHd"><span class="hd fstdlabel">To Do</span>${_todoNum}<span class="fold fstdlabel">▾</span></div>
     <div class="tl">
       ${doingRows ? `<span class="tlcap" style="padding-top:0">Doing</span>${doingRows}` : ''}
       ${upRows ? `<span class="tlcap"${doingRows ? '' : ' style="padding-top:0"'}>Next up</span>${upRows}` : ''}
@@ -5524,6 +5766,9 @@ async function createProject(){
   try {
     const r = await fetch(withKey('/api/projects'), { method: 'POST', headers: { 'content-type': 'application/json' },
       body: JSON.stringify({ baseProjectId: state.active, name: 'New project' }) });
+    // Free tier allows one project (moment ③): the server 402s the second. Raise
+    // the centered upgrade dialog instead of the generic "failed." toast.
+    if (r.status === 402) { openProjectLimitDialog(); return; }
     if (!r.ok) throw new Error();
     const body = await r.json();
     state.projects = body.projects ?? [...state.projects, body.project].filter(Boolean);
@@ -5531,8 +5776,22 @@ async function createProject(){
     document.body.classList.remove('projectsopen');
     render();
   } catch { showErr('New project failed.'); }
-  if (add) add.disabled = false;
-}
+  finally { if (add) add.disabled = false; } // the 402 early-return must not leave +New dead
+}
+// moment ③ paywall dialog — filled per language from BILLING_COPY, Upgrade shows
+// the one price format (small $, no /mo), "Not now" just closes.
+function openProjectLimitDialog(){
+  const c = BILLING_COPY[billingLang()];
+  $('flimProjTitle').textContent = c.projTitle;
+  $('flimProjBody').textContent = c.projBody;
+  $('flimProjNo').textContent = c.notNow;
+  const up = $('flimProjUpgrade');
+  up.disabled = false; up.classList.remove('loading');
+  up.innerHTML = `<span class="bx-spin"></span>Upgrade${priceTag(state.billing?.price)}`;
+  up.onclick = () => startCheckout(up);
+  $('flimProjOverlay').classList.add('show');
+}
+function closeProjectLimitDialog(){ $('flimProjOverlay').classList.remove('show'); }
 async function deleteProject(p){
   if (!p) return;
   if (!(await confirmDelete({
@@ -5720,6 +5979,16 @@ function renderClawdHero(){
   };
   $('fsRailTg').onclick = () => { root.classList.toggle('railfold'); tgUpdate(); fsGearAlignX(); }; // §1.5-7: fold
   $('fsLaneTg').onclick = () => { root.classList.toggle('lanefold'); tgUpdate(); };
+  // List/Board toggle — wired once (static, unlike the row it used to live inside which
+  // rebuilds on every renderFsTodo()); syncFsTvSeg() paints .on and is called from renderFsLane.
+  for (const b of $('fsTvSeg').querySelectorAll('[data-fstv]')) b.onclick = (e) => {
+    e.stopPropagation();
+    fsUI.todoView = b.dataset.fstv; localStorage.setItem('fsTodoView', fsUI.todoView);
+    $('fsLane').classList.toggle('boardmode', fsUI.todoView === 'board');
+    syncFsTvSeg();
+    if (fsUI.todoView === 'board') renderFsBoard();
+  };
+  syncFsTvSeg();
   tgUpdate();
   $('fsMoreBtn').onclick = (e) => { e.stopPropagation(); $('fsMoreMenu').classList.toggle('open'); };
   document.addEventListener('click', (e) => { if (!e.target.closest('#fsRoot .lbrow')) $('fsMoreMenu').classList.remove('open'); });
@@ -5770,17 +6039,43 @@ function renderClawdHero(){
   if (restoreLane && canRestoreFlagshipWidths(restoreRail ? savedRail : defaultRailW, saved)) {
     root.style.setProperty('--lanew', `${saved}px`);
   }
-  let sx = 0, sw = 0, drag = false;
-  grip.addEventListener('mousedown', (e) => { drag = true; sx = e.clientX; sw = lane.getBoundingClientRect().width; lane.classList.add('noanim'); e.preventDefault(); });
+  // Board view keeps its OWN width (--lanew-board), independent from the List width
+  // (--lanew) — both start at the same 372px default, each persists once resized
+  // (Masa 2026-07-16: 看板とToDoの横幅は最初同じ・それぞれ保持). List stays capped at
+  // 540 (a To Do list doesn't need more); Board can grow with the window, same
+  // "no flat ceiling" treatment as the rail above (Masa 2026-07-16: もっと広げたい) —
+  // but its live max reserves the rail's CURRENT width (not a flat guess), same
+  // protection railMax() gives center: a wide-open board must not crush the rail's
+  // own content (Masa 2026-07-16: 狭くした時にバグる — rail at its 72px floor overlaps
+  // its own logo/project row; reserving rail's real width keeps it out of that floor).
+  // Board is the star of this view — chat only needs to stay usable, not "comfortably
+  // readable" (that 640px figure is for List/chat-first use). 320px LOOKED right but was
+  // measured wrong: the composer's own button row (.crow — app/model/effort selects + send)
+  // needs ~342px just for its content, and .fscenter's padding adds ~44px more — below ~430
+  // those chips get clipped off the edge of the composer card (Masa 2026-07-16 repro:
+  // dragged the board grip wide on a 1280px-wide window, "Medium"+send were cut off).
+  // 440 is the smallest value that doesn't clip on a real laptop width.
+  const minCenterWBoard = 440;
+  const boardMax = () => Math.max(280, window.innerWidth - 28 - 24
+    - (document.querySelector('#fsRoot .fsrail')?.getBoundingClientRect().width || defaultRailW) - minCenterWBoard);
+  const savedBoard = Number(localStorage.getItem('fsLaneWBoard'));
+  if (savedBoard >= 280 && savedBoard <= boardMax()) root.style.setProperty('--lanew-board', `${savedBoard}px`);
+  let sx = 0, sw = 0, drag = false, boarding = false;
+  grip.addEventListener('mousedown', (e) => {
+    drag = true; sx = e.clientX; boarding = lane.classList.contains('boardmode');
+    sw = lane.getBoundingClientRect().width; lane.classList.add('noanim'); e.preventDefault();
+  });
   document.addEventListener('mousemove', (e) => {
     if (!drag) return;
-    const w = Math.max(280, Math.min(540, sw + (sx - e.clientX)));
-    root.style.setProperty('--lanew', `${w}px`);
+    const max = boarding ? boardMax() : 540;
+    const w = Math.max(280, Math.min(max, sw + (sx - e.clientX)));
+    root.style.setProperty(boarding ? '--lanew-board' : '--lanew', `${w}px`);
   });
   document.addEventListener('mouseup', () => {
     if (!drag) return;
     drag = false; lane.classList.remove('noanim');
-    localStorage.setItem('fsLaneW', String(parseInt(root.style.getPropertyValue('--lanew')) || 372));
+    if (boarding) localStorage.setItem('fsLaneWBoard', String(parseInt(root.style.getPropertyValue('--lanew-board')) || 372));
+    else localStorage.setItem('fsLaneW', String(parseInt(root.style.getPropertyValue('--lanew')) || 372));
   });
   // rail width drag: 72px – railMax() (freely widens, only bounded by keeping the center column
   // readable), persisted (flagship .railgrip port, v36 JS; grip hides when folded)
@@ -5801,6 +6096,52 @@ function renderClawdHero(){
     localStorage.setItem('fsRailW', String(parseInt(root.style.getPropertyValue('--railw')) || 168)); // H19: default floor 168
     if ($('gearPop').classList.contains('open')) custPlace(); // panel sits beside the rail — track the new edge
   });
+  // chat ⇄ lane panel swap — grab anywhere in the top ~40px of either panel (not just the
+  // grip icon), drop lands EXACTLY on the side the dashed guide showed (never a blind
+  // toggle, which could disagree with what was shown). Rail is fixed, not part of this
+  // (Masa 2026-07-16).
+  (() => {
+    const center = root.querySelector('.fscenter');
+    if (!center || !lane) return;
+    const TOPZONE = 40;
+    const sideFor = (target, x) => { const r = target.getBoundingClientRect(); return x < r.left + r.width / 2 ? 'left' : 'right'; };
+    const dropLine = document.createElement('div'); dropLine.id = 'panelDropLine'; root.appendChild(dropLine);
+    const showDropLine = (target, side) => {
+      const r = target.getBoundingClientRect(), ar = root.getBoundingClientRect();
+      const edgeX = side === 'left' ? r.left : r.right;
+      dropLine.style.left = `${edgeX - ar.left}px`; dropLine.style.top = `${r.top - ar.top}px`;
+      dropLine.style.height = `${r.height}px`; dropLine.style.display = 'block';
+    };
+    const hideDropLine = () => { dropLine.style.display = 'none'; };
+    document.addEventListener('dragend', hideDropLine);
+    const armTop = (panel, name) => {
+      panel.addEventListener('mousedown', (e) => { const r = panel.getBoundingClientRect(); if (e.clientY - r.top <= TOPZONE) panel.setAttribute('draggable', 'true'); });
+      panel.addEventListener('mousemove', (e) => { const r = panel.getBoundingClientRect(); panel.classList.toggle('top-armed', e.clientY - r.top <= TOPZONE); });
+      panel.addEventListener('mouseleave', () => panel.classList.remove('top-armed'));
+      panel.addEventListener('dragstart', (e) => {
+        if (panel.getAttribute('draggable') !== 'true') return;
+        e.dataTransfer.effectAllowed = 'move'; e.dataTransfer.setData('application/x-panel-swap', name);
+      });
+      const disarm = () => { panel.removeAttribute('draggable'); panel.classList.remove('top-armed'); };
+      panel.addEventListener('dragend', disarm); panel.addEventListener('mouseup', disarm);
+    };
+    armTop(center, 'center'); armTop(lane, 'lane');
+    for (const p of [center, lane]) {
+      p.addEventListener('dragover', (e) => {
+        if (!e.dataTransfer.types.includes('application/x-panel-swap')) return;
+        e.preventDefault(); p.classList.add('panel-over'); showDropLine(p, sideFor(p, e.clientX));
+      });
+      p.addEventListener('dragleave', () => { p.classList.remove('panel-over'); hideDropLine(); });
+      p.addEventListener('drop', (e) => {
+        if (!e.dataTransfer.types.includes('application/x-panel-swap')) return;
+        e.preventDefault(); p.classList.remove('panel-over'); hideDropLine();
+        const dragged = e.dataTransfer.getData('application/x-panel-swap');
+        const side = sideFor(p, e.clientX);
+        const wantLeft = side === 'left' ? dragged : (dragged === 'center' ? 'lane' : 'center');
+        root.classList.toggle('swapmid', wantLeft === 'lane');
+      });
+    }
+  })();
   // theme-6 band picker (visual thumbnails, §6.5 T6)
   $('fsBandBtn').onclick = (e) => { e.stopPropagation(); $('fsBandPop').classList.toggle('open'); };
   document.addEventListener('click', (e) => { if (!e.target.closest('#fsBandPop') && !e.target.closest('#fsBandBtn')) $('fsBandPop').classList.remove('open'); });
@@ -5853,39 +6194,86 @@ function upsert(arr, item){ const i = arr.findIndex((x) => x.id === item.id); if
 
 let errTimer = null;
 let authDown = false; // true while the worker-auth banner is up → keep auto-hide timers from clearing it
+// true while the free-tier paywall is up. Unlike a transient error, "you are
+// over the free limit" doesn't resolve itself — it persists until the user
+// upgrades or usage drops, so it must not auto-hide on a fixed timer (Masa
+// 2026-07-17: a 20s auto-hide + a 15s retry that background-tab throttling can
+// stretch to ~once/minute meant the banner could vanish for long stretches
+// with the outbox still silently stuck "Unsent" and no visible explanation —
+// exactly the "queue fills up, nothing happens" report). Mirrors authDown's
+// existing guard pattern; cleared only in postOutboxItem once a send actually
+// succeeds, which is the one signal that's actually true evidence the block
+// lifted (an upgrade, or the count dropping).
+let billingBlockedActive = false;
+function clearBillingBlocked(){
+  if (!billingBlockedActive) return;
+  billingBlockedActive = false;
+  const bar = $('errbar');
+  bar.classList.remove('billing');
+  bar.style.display = 'none';
+  bar.innerHTML = '';
+}
 function showErr(msg){
   const bar = $('errbar');
   bar.classList.remove('billing'); // shed the paywall styling if it was last used for that
+  billingBlockedActive = false;
   bar.textContent = msg; bar.style.display = 'block';
   clearTimeout(errTimer);
   errTimer = setTimeout(() => { if (authDown) return; bar.style.display = 'none'; }, 6000);
 }
 
-// Minimal placeholder for the free-tier paywall pending CDO design
-// (handoff-billing-ui-request.md §①) — reuses the existing #errbar rather
-// than inventing new chrome; the polished version can replace showBillingBlocked's
-// body without touching the postOutboxItem call site below.
-const BLOCKED_REASON_TEXT = {
-  'pending-goal-limit': 'Free plan limit reached — 5 pending To Dos.',
-  'cumulative-goal-limit': 'Free plan limit reached — 19 To Dos total.',
-  'project-limit': 'Free plan limit reached — 1 project.',
+// Free-limit copy (H22, Masa 2026-07-17 確定 · ja+en). The sentence is content,
+// so it follows the user's language; the mono label and buttons stay English
+// 汎用名 (DOING / FAILED / Retry). <b> is intentional (rendered as innerHTML from
+// this fixed internal constant, never user input) — the figure is the message.
+const BILLING_COPY = {
+  ja: {
+    'pending-goal-limit': '無料プランでは一度に登録できるタスクは <b>5個</b> までです。Proプランでは無制限に登録できます。',
+    'cumulative-goal-limit': '無料プランの <b>20/20</b> タスクをすべて使いました。',
+    projTitle: 'プロジェクトは1つまでです',
+    projBody: '無料プランに含まれるプロジェクトは1つです。アップグレードすると、プロジェクトを無制限に作れます。',
+    notNow: 'Not now',
+  },
+  en: {
+    'pending-goal-limit': 'The free plan holds <b>5 tasks</b> at a time. Pro holds as many as you want.',
+    'cumulative-goal-limit': "You've used all <b>20/20</b> free tasks.",
+    projTitle: 'Free includes one project',
+    projBody: 'Your free plan includes one project. Upgrade to create as many as you need.',
+    notNow: 'Not now',
+  },
 };
+// Which language the paywall speaks. Mirrors foldLangFor's path (the project's
+// review-language override wins; otherwise match the language the user is
+// actually writing in — the latest goal in the active project — else default en)
+// so the wall reads in the same language as everything else in the project.
+function billingLang(){
+  const l = reviewLangFor(state.active);
+  if (l === 'ja' || l === 'en') return l;
+  const recent = (state.goals || []).filter((g) => g.projectId === state.active).slice(-1)[0];
+  if (recent && /[぀-ヿ㐀-鿿]/.test(recent.text || '')) return 'ja';
+  return document.documentElement.lang === 'ja' ? 'ja' : 'en';
+}
+// The free-limit banner (moments ① pending-goal-limit / ② cumulative-goal-limit):
+// a bordered card in #errbar, --danger as a 2px left rule only (no fill, §5.6),
+// with an Upgrade CTA that opens Stripe Checkout. project-limit is NOT a banner —
+// it is the centered dialog raised from createProject (moment ③). The .billing
+// class strips #errbar's own error fill so the card stands alone.
 function showBillingBlocked(blocked){
   const bar = $('errbar');
-  const text = BLOCKED_REASON_TEXT[blocked?.reason] || 'Free plan limit reached.';
-  const pl = fmtPrice(state.billing?.price);
-  // ① the free-limit prompt (design H16): a bordered card, red as a 2px left
-  // rule only (no fill), with an Upgrade CTA that opens Stripe Checkout. The
-  // .billing class strips #errbar's own error fill so the card stands alone.
+  const c = BILLING_COPY[billingLang()];
+  const q = c[blocked?.reason] || c['pending-goal-limit'];
   bar.classList.add('billing');
   bar.innerHTML = `<div class="bx-ask"><div class="bx-qt"><div class="bx-lb">Free limit</div>`
-    + `<div class="bx-q">${esc(text)} Upgrade to keep going?</div></div>`
-    + `<div class="bx-act"><button class="bx-cta" id="bxUpgrade">Upgrade${pl ? `<span class="bx-pm">${esc(pl)}</span>` : ''}</button></div></div>`;
+    + `<div class="bx-q">${q}</div></div>`
+    + `<div class="bx-act"><button class="bx-cta" id="bxUpgrade"><span class="bx-spin"></span>Upgrade${priceTag(state.billing?.price)}</button></div></div>`;
   bar.style.display = 'block';
   const btn = bar.querySelector('#bxUpgrade');
-  if (btn) btn.onclick = () => startCheckout();
+  if (btn) btn.onclick = () => startCheckout(btn);
+  // No auto-hide: the condition persists until the user acts, so a fixed timer
+  // would just recreate the bug this fixes. clearTimeout only cancels any showErr
+  // 6s timer that happened to be mid-flight on this same shared bar.
   clearTimeout(errTimer);
-  errTimer = setTimeout(() => { if (authDown) return; bar.style.display = 'none'; bar.classList.remove('billing'); }, 20000);
+  billingBlockedActive = true;
 }
 
 // Worker sign-in banner. The server preflights `claude` at boot (/api/state.auth
@@ -5937,27 +6325,45 @@ function showSignInNudge(){
   errTimer = setTimeout(() => { bar.style.display = 'none'; bar.classList.remove('billing'); }, 20000);
 }
 
-// "$12/mo" from the Stripe-owned price (state.billing.price), never hardcoded.
-// Returns '' when the price isn't known yet so the CTA just reads "Upgrade".
+// The Stripe-owned price (state.billing.price), never hardcoded. Split into the
+// currency mark + the figure so the ONE price format (§5.5 / .bx-pm) can render
+// the mark smaller and optically raised. No interval — /mo is dropped on the
+// button (the number is the message). Returns null when the price isn't known
+// yet so the CTA just reads "Upgrade".
 function fmtPrice(p){
-  if (!p || p.amount == null) return '';
+  if (!p || p.amount == null) return null;
   const n = p.amount / 100;
   const amt = Number.isInteger(n) ? String(n) : n.toFixed(2);
   const cur = String(p.currency || 'usd').toLowerCase() === 'usd' ? '$' : (String(p.currency).toUpperCase() + ' ');
-  const iv = p.interval ? '/' + ({ month: 'mo', year: 'yr', week: 'wk', day: 'day' }[p.interval] || p.interval) : '';
-  return `${cur}${amt}${iv}`;
+  return { cur, amt };
+}
+// Render a price into the single styled price span (small currency mark, no /mo).
+// '' when the price is unknown so callers can concatenate it unconditionally.
+function priceTag(p){
+  const f = fmtPrice(p);
+  return f ? `<span class="bx-pm"><span class="cur">${esc(f.cur)}</span>${esc(f.amt)}</span>` : '';
 }
 
 // Upgrade → Stripe Checkout (via the engine proxy, same-origin). On return the
 // browser lands back with ?checkout=success|cancel (handled at load).
-async function startCheckout(){
+// btn (optional): the button that triggered this, so it can show a spinner
+// for the round trip to /api/checkout — jumping straight to Stripe's own page
+// with zero feedback reads as "did that even do anything?" (Masa 2026-07-17).
+// Left spinning through the r.ok/d.url success path on purpose: the page is
+// about to navigate away to Stripe, so there is nothing to reset back to.
+async function startCheckout(btn){
+  if (btn) { btn.disabled = true; btn.classList.add('loading'); }
   try {
     const r = await fetch(withKey('/api/checkout'), { method: 'POST', headers: { 'content-type': 'application/json' },
       body: JSON.stringify({ successUrl: location.origin + location.pathname + '?checkout=success', cancelUrl: location.origin + location.pathname + '?checkout=cancel' }) });
     const d = await r.json().catch(() => ({}));
-    if (r.ok && d.url) location.href = d.url;
-    else showErr(d.error || 'Could not start checkout.');
-  } catch { showErr('Could not start checkout — check your connection.'); }
+    if (r.ok && d.url) { location.href = d.url; return; }
+    if (btn) { btn.disabled = false; btn.classList.remove('loading'); }
+    showErr(d.error || 'Could not start checkout.');
+  } catch {
+    if (btn) { btn.disabled = false; btn.classList.remove('loading'); }
+    showErr('Could not start checkout — check your connection.');
+  }
 }
 
 // Manage billing → Stripe Customer Portal (paying users; engine proxy).
@@ -6329,6 +6735,10 @@ async function postOutboxItem(item){
       return;
     }
     if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    // A send just succeeded, which is the one signal that's actually true
+    // evidence the free-tier block lifted (upgrade, or usage dropping below
+    // the limit) — clear the persistent paywall banner if it was still up.
+    clearBillingBlocked();
     const goal = await r.json();
     if (goal.kind === 'chat') {
       // Conversation-first (SLICE 2 + Pattern A H23): a chat/help/settings turn,
@@ -7299,6 +7709,10 @@ $('delCancelBtn').onclick = () => closeDeleteConfirm(false);
 $('delConfirmBtn').onclick = () => closeDeleteConfirm(true);
 $('deleteConfirmOverlay').addEventListener('click', (e) => { if (e.target === $('deleteConfirmOverlay')) closeDeleteConfirm(_delDismissValue); });
 document.addEventListener('keydown', (e) => { if (e.key === 'Escape' && $('deleteConfirmOverlay').classList.contains('show')) closeDeleteConfirm(_delDismissValue); });
+// moment ③ dialog dismissal: "Not now" link, backdrop click, and Escape all close it.
+$('flimProjNo').onclick = () => closeProjectLimitDialog();
+$('flimProjOverlay').addEventListener('click', (e) => { if (e.target === $('flimProjOverlay')) closeProjectLimitDialog(); });
+document.addEventListener('keydown', (e) => { if (e.key === 'Escape' && $('flimProjOverlay').classList.contains('show')) closeProjectLimitDialog(); });
 $('input').addEventListener('keydown', (e) => {
   // Palette navigation takes priority while it is open (Claude-Code keys).
   if (state.palette && !e.isComposing) {
@@ -7997,24 +8411,25 @@ function gearSetHTML(){
   // so the polished version can drop in without touching the wiring below.
   // ③ PLAN card: identity (Sign in with Google / Signed in as X) + plan status.
   // Free → usage vs limits + Upgrade; Paid → green dot + Manage (Stripe Portal).
-  const pl = fmtPrice(bill.price);
   const u = bill.usage || {}, lim = bill.limits || {};
-  let billingRow;
-  if (!bill.licensed) {
-    billingRow = `<div class="srow"><div class="sl">Account<span class="sd">Sign in with Google to unlock the full plan — the free tier works without it</span></div>
+  // Account row: signed in (email + Log out) vs anonymous (Sign in with Google).
+  const acct = bill.licensed
+    ? `<div class="srow"><div class="sl">Account<span class="sd">Signed in with Google · ${esc(bill.email)}</span></div><button class="optchip" data-gsignout="1">Log out</button></div>`
+    : `<div class="srow"><div class="sl">Account<span class="sd">Sign in with Google to sync your usage across devices — the free tier works without it</span></div>
         <button class="optchip" data-gsignin="1">Sign in with Google</button></div>
        <div class="srow dis" id="licKeyMsg" style="display:none"></div>`;
-  } else if (bill.plan === 'paid') {
-    billingRow = `<div class="srow"><div class="sl">Account<span class="sd">Signed in with Google · ${esc(bill.email)}</span></div><button class="optchip" data-gsignout="1">Log out</button></div>
-       <div class="srow"><div class="sl">Plan</div><span class="bx-pdot"><i></i>Paid</span></div>
-       <div class="srow"><div class="sl">Billing<span class="sd">manage or cancel in Stripe</span></div><button class="bx-cchip" data-gportal="1">Manage</button></div>`;
-  } else {
-    billingRow = `<div class="srow"><div class="sl">Account<span class="sd">Signed in with Google · ${esc(bill.email)}</span></div><button class="optchip" data-gsignout="1">Log out</button></div>
-       <div class="srow"><div class="sl">Plan</div><span class="bx-sval">Free</span></div>
+  // The free-tier usage + Upgrade shows on the free plan whether or not the user
+  // has signed in — it mirrors the To Do header counter (H22), which is visible
+  // to anonymous free users too. Sign-in is an extra (sync across devices), not a
+  // gate to see your own usage or upgrade.
+  const freeUsage = `<div class="srow"><div class="sl">Plan</div><span class="bx-sval">Free</span></div>
        <div class="srow"><div class="sl">To Dos<span class="sd">pending, this install</span></div><span class="bx-sval bx-num">${u.pending ?? 0} / ${lim.pending ?? 5}</span></div>
-       <div class="srow"><div class="sl">Lifetime</div><span class="bx-sval bx-num">${u.cumulative ?? 0} / ${lim.cumulative ?? 19}</span></div>
-       <button class="bx-cta bx-up-set" data-gupgrade="1">Upgrade${pl ? `<span class="bx-pm">${esc(pl)}</span>` : ''}</button>`;
-  }
+       <div class="srow"><div class="sl">Lifetime</div><span class="bx-sval bx-num">${u.cumulative ?? 0} / ${lim.cumulative ?? 20}</span></div>
+       <button class="bx-cta bx-up-set" data-gupgrade="1"><span class="bx-spin"></span>Upgrade${priceTag(bill.price)}</button>`;
+  const billingRow = bill.plan === 'paid'
+    ? acct + `<div class="srow"><div class="sl">Plan</div><span class="bx-pdot"><i></i>Paid</span></div>
+       <div class="srow"><div class="sl">Billing<span class="sd">manage or cancel in Stripe</span></div><button class="bx-cchip" data-gportal="1">Manage</button></div>`
+    : acct + freeUsage;
   return `
   <div class="srow"><div class="sl">Language<span class="sd">Review checklist language for this project</span></div>
     <button class="optchip${lang === 'auto' ? ' on' : ''}" data-gslang="auto">Auto</button>
@@ -8063,7 +8478,7 @@ function buildGearPop(){
       signBtn.disabled = false;
     };
     const upBtn = pop.querySelector('[data-gupgrade]');
-    if (upBtn) upBtn.onclick = () => startCheckout();
+    if (upBtn) upBtn.onclick = () => startCheckout(upBtn);
     const portalBtn = pop.querySelector('[data-gportal]');
     if (portalBtn) portalBtn.onclick = () => openBillingPortal();
     const signOutBtn = pop.querySelector('[data-gsignout]');

package/engine/lib.mjs

@@ -2775,8 +2775,11 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 
 // ---- billing entitlement gate (public self-serve launch, docs/BILLING-LAUNCH-PLAN.md) --
 // Mirrors workers/billing-api/src/entitlement.mjs's FREE_TIER_LIMITS/
-// checkFreeTierLimit/resolveEntitlement exactly (Masa decision 2026-07-12:
-// 5 pending goals, 19 lifetime goals, 1 project, $16/mo unlocks all three).
+// checkFreeTierLimit/resolveEntitlement exactly (Masa: 5 queued to-dos,
+// 20 total tasks, 1 project — matching galda.app's own words. Updated
+// 2026-07-17: lifetime cap 19→20 so the wall says the same number the sales
+// page promises ("20 total tasks"); it used to block the 20th create, one short
+// of the promise. Pro unlocks all three; price is Stripe-derived, not in code.)
 // Deliberately duplicated rather than imported: engine/ and workers/billing-api/
 // are independently deployed (a user's Mac vs Cloudflare) and independently
 // tested — sharing a module across that boundary would couple two things
@@ -2784,10 +2787,21 @@ export function nextResumeDelay(attempt, { baseMs = 5 * 60 * 1000, maxMs = 60 *
 // hand; both have their own test coverage against the same free-tier numbers.
 export const FREE_TIER_LIMITS = Object.freeze({
   maxPendingGoals: 5,
-  maxCumulativeGoals: 19,
+  maxCumulativeGoals: 20,
   maxProjects: 1,
 });
 
+// The statuses that occupy a "queued to-do" slot (the 5-slot wall). Narrower
+// than "every open goal" on purpose: a goal in `review` has finished its work
+// and is waiting on a human — that's not a to-do in flight, and galda.app sells
+// the slot as "queued to-dos", so review must not eat one (Masa 2026-07-17,
+// "5枠は実行待ちだけ"). Kept as its own named list rather than filtering an
+// "all open" constant so the intent is legible where it's read.
+export const QUEUED_GOAL_STATUSES = Object.freeze([
+  'stacked', 'sending', 'pending', 'planning', 'needsInput',
+  'running', 'partial', 'failed', 'interrupted', 'blocked', 'retesting',
+]);
+
 export function checkFreeTierLimit(usage) {
   const pendingCount = Number(usage?.pendingCount) || 0;
   const cumulativeCount = Number(usage?.cumulativeCount) || 0;

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -177,6 +177,19 @@ const entitlementCache = new Map(); // billing email -> { isPaying, checkedAt }
 // it survives restarts.
 const licenseFile = join(DATA_DIR, 'license.token');
 let licenseState = { email: null, isPaying: false, verifiedAt: 0 }; // in-memory cache of the last successful verify (isPaying is the token's snapshot; the live gate re-checks)
+// Test-only seam: override the license-verify public key via env so tests can
+// sign tokens the running server actually accepts (the baked LICENSE_PUBLIC_JWK
+// has no committed private half, so the licensed-but-lapsed path is otherwise
+// untestable — see docs/HANDOFF-A2C-WORKERS-DEV-CLEANUP.md item 6). Unset in
+// prod → verifyLicenseToken falls back to the baked key. This is NOT a payment
+// bypass: forging an identity here only picks WHO the email is; whether they're
+// paying is still the live remote billing-api (fetchIsPaying). An env escape
+// hatch already exists on the gate (MANAGER_ENTITLEMENT_BYPASS=1) — same spirit.
+const LICENSE_PUBKEY_OVERRIDE = (() => {
+  const raw = process.env.MANAGER_LICENSE_PUBKEY;
+  if (!raw) return undefined;
+  try { return JSON.parse(raw); } catch { return undefined; }
+})();
 
 // Analytics identity (A+): once signed in, scope usage events to the ACCOUNT
 // (the billing Worker hashes this email → the same account_id the accounts table
@@ -210,7 +223,7 @@ async function loadLicenseFromDisk() {
   if (!existsSync(licenseFile)) return;
   const token = readFileSync(licenseFile, 'utf8').trim();
   if (!token) return;
-  const result = await verifyLicenseToken({ token });
+  const result = await verifyLicenseToken({ token, publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (result.valid) licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
 }
 loadLicenseFromDisk();
@@ -219,7 +232,7 @@ loadLicenseFromDisk();
 // token to disk that doesn't actually verify, so a bad paste can't silently
 // wedge the app into "licensed but broken".
 async function activateLicense(token) {
-  const result = await verifyLicenseToken({ token: String(token ?? '') });
+  const result = await verifyLicenseToken({ token: String(token ?? ''), publicJwk: LICENSE_PUBKEY_OVERRIDE });
   if (!result.valid) return { ok: false, error: `invalid license: ${result.reason}` };
   writeFileSync(licenseFile, String(token));
   licenseState = { email: result.payload.email, isPaying: Boolean(result.payload.isPaying), verifiedAt: Date.now() };
@@ -250,26 +263,32 @@ function signinResultPage(outcome) {
     `</script></body>`;
 }
 
-// "Currently occupying capacity" for the free-tier pending-goal cap — every
-// status short of a genuinely finished/dismissed one. Deliberately broad for
-// the same reason RATE_LIMIT_RE above is broad: undercounting here would let
-// someone quietly exceed the cap via an odd status, which costs more than
-// occasionally counting a goal that's nearly done.
-const OPEN_GOAL_STATUSES = ['stacked', 'sending', 'pending', 'planning', 'needsInput', 'running', 'partial', 'failed', 'interrupted', 'blocked', 'review', 'retesting'];
-
-// NOTE(billing, needs a product decision): `projectCount` is left at 0 —
-// projects are shared/global in this codebase today (see the "Projects ...
-// stay shared for everyone" comment above goalVisibleTo in lib.mjs), not
-// per-identity, so a per-user "max 1 project" cap has nothing correct to
-// gate yet (an unpaid user's 2nd project would affect every other user, not
-// just them). checkFreeTierLimit already supports projectCount > 1 the
-// moment that's resolved — see docs/BILLING-LAUNCH-PLAN.md.
+// The 5-slot "queued to-dos" cap counts QUEUED_GOAL_STATUSES (from lib.mjs) —
+// every open status EXCEPT `review`. A goal in review has finished its work and
+// is waiting on a human, so it isn't a to-do in flight, and galda.app sells the
+// slot as "queued to-dos" (Masa 2026-07-17, "5枠は実行待ちだけ"). Still broad
+// otherwise, for the same reason RATE_LIMIT_RE is: undercounting would let
+// someone quietly exceed the cap via an odd status. The list lives in lib.mjs
+// so the wall's meaning is defined next to checkFreeTierLimit and unit-tested.
+
+// `projectCount` is install-wide, not per-identity: projects are shared/global
+// in this codebase (see the "Projects ... stay shared for everyone" comment
+// above goalVisibleTo in lib.mjs) while only goals are partitioned by owner.
+// That asymmetry used to leave this at 0 pending a product decision (a per-user
+// "max 1 project" cap would have let one user's 2nd project block everyone
+// else's). Resolved 2026-07-17 (Masa): the shipping product is local-first —
+// app.galda.app reaches each user's OWN engine over the relay, so one install
+// is one user, and the license this gate consults (licenseState.email) is
+// already install-wide too. Counting every project on the install is therefore
+// the same scope billing already runs at. The stale caveat only applies to the
+// legacy Cloudflare Access multi-user mode, where several identities share one
+// install AND one license — there, a shared cap is already the status quo.
 function computeFreeTierUsage(identity) {
   const owned = goals.filter((g) => (g.owner ?? 'owner') === identity);
   return {
-    pendingCount: owned.filter((g) => OPEN_GOAL_STATUSES.includes(g.status)).length,
+    pendingCount: owned.filter((g) => QUEUED_GOAL_STATUSES.includes(g.status)).length,
     cumulativeCount: owned.length,
-    projectCount: 0,
+    projectCount: projects.length,
   };
 }
 
@@ -362,15 +381,25 @@ async function getBillingPrice() {
 // every installation (~/.claude/plans/toasty-rolling-marshmallow.md).
 // A personal/dev instance that wants to skip billing entirely should opt in
 // explicitly via MANAGER_ENTITLEMENT_BYPASS=1, not ride the 'owner' string.
-async function requireEntitlementGate(identity) {
+async function requireEntitlementGate(identity, intent = 'goal') {
   if (process.env.MANAGER_ENTITLEMENT_BYPASS === '1') return { allowed: true, blocked: null };
-  // Count the goal being created (existing + 1): computeFreeTierUsage counts
-  // only goals already on file and this gate runs *before* the new one is
+  // Count the thing being created (existing + 1): computeFreeTierUsage counts
+  // only what's already on file and this gate runs *before* the new one is
   // added, so "5 pending / 19 lifetime max" must block the 6th / 20th create,
   // not the 7th / 21st. (checkFreeTierLimit keeps its `> limit` semantics; we
   // feed it the post-create count. Display in /api/state stays the raw count.)
+  //
+  // Only the dimension the caller is actually spending gets its real count;
+  // the others are zeroed. checkFreeTierLimit weighs all three at once and
+  // mirrors billing-api byte-for-byte, so it must not learn about intents —
+  // the caller narrows the question instead. Without this, an install already
+  // holding 2 projects (created before the project cap was enforced) would
+  // trip 'project-limit' on every *goal* create and lose a feature it had:
+  // caps are enforced at the moment you spend, never retroactively.
   const existing = computeFreeTierUsage(identity);
-  const usage = { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1 };
+  const usage = intent === 'project'
+    ? { pendingCount: 0, cumulativeCount: 0, projectCount: existing.projectCount + 1 }
+    : { ...existing, pendingCount: existing.pendingCount + 1, cumulativeCount: existing.cumulativeCount + 1, projectCount: 0 };
   if (!checkFreeTierLimit(usage).blocked) return { allowed: true, blocked: null };
   const billingEmail = licenseState.email;
   if (!billingEmail) { const r = resolveEntitlement({ isOwner: false, isPaying: false, usage }); noteFreeExhausted(r); return r; }
@@ -3027,9 +3056,15 @@ const server = createServer(async (req, res) => {
   if (url.pathname === '/api/projects' && req.method === 'POST') {
     let body = '';
     req.on('data', (d) => { body += d; });
-    req.on('end', () => {
+    req.on('end', async () => {
       try {
         const input = JSON.parse(body || '{}');
+        // Billing (docs/BILLING-LAUNCH-PLAN.md §2/§5): a 2nd project is paid.
+        // Same 402 shape as POST /api/tasks so the client has one branch to
+        // handle. Gated here, on create, and nowhere else: projects that
+        // already exist keep working on the free tier.
+        const gate = await requireEntitlementGate(identityFor(req), 'project');
+        if (!gate.allowed) return json(res, 402, { error: 'free-tier limit reached', blocked: gate.blocked });
         const base = projects.find((p) => p.id === input.baseProjectId) ?? projects[0];
         const nameBase = String(input.name ?? 'New project').trim().slice(0, 80) || 'New project';
         let name = nameBase, n = 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.27",
+  "version": "0.10.30",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {