@jossuealcala/madre 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -4,6 +4,18 @@ Todas las versiones publicadas de `@jossuealcala/madre`. Fechas en ISO.
 
 Una versión se cierra cuando está en npm: hasta entonces su sección se llama **Sin publicar** y puede crecer. Cada versión publicada tiene exactamente una etiqueta `vX.Y.Z`, una release en GitHub y una sección aquí; el parche puede llegar a dos dígitos (`0.2.10`) antes de subir el menor. Ver `docs/ROADMAP.md` para el criterio de qué sube cada número.
 
+## 0.3.2 · 2026-09-19
+
+### Modos y permisos, una sola lógica
+- `#2 CREATE` ya no encierra al agente en `.pulse/out/`: crea archivos y carpetas nuevos donde corresponda en el proyecto, según sus convenciones, con `.pulse/out/<turno>/` como borrador. MADRE fotografía el proyecto antes del turno; lo que apareció se conserva y se muestra como artefacto, y todo archivo previo modificado, renombrado o borrado se restaura y se avisa (`create.reverted`). Las CLIs reciben sus herramientas de escritura sobre el proyecto (Claude Code y OpenCode solo escriben si también pueden editar, verificado con los CLIs reales); la garantía de "solo añadir" la da la restauración de MADRE al terminar.
+- Un orquestador puede pedir el modo de cada paso de su plan: `@codex #2: …`, `@claude #3: …`. MADRE lo acota al modo del mensaje del humano y al `MAX MODE` del agente. Bajo `#3` la palabra del orquestador basta: un paso `#2` recibe su lease de proyecto y un paso `#3` toma CONTROL para su turno, con checkpoint propio. Bajo `#1` un paso `#2` sigue pasando por la escalación.
+- CONNECTIONS se reduce a dos controles por agente, `MAX MODE` y `DEFAULT MODE` (`#1` o `#2`), más dos habilidades, imágenes y web. Los interruptores `CREATE FILES` y `ALWAYS · STANDING LEASE` desaparecen; las configuraciones viejas (`write: false`, `alwaysCreate`) se siguen leyendo como `MAX MODE #1` y `DEFAULT MODE #2`.
+- Los checkpoints funcionan en proyectos sin git: MADRE usa un repositorio sombra propio fuera del proyecto, así `#2` y `#3` tienen la misma reversibilidad en cualquier carpeta.
+
+### Permisos que sí se cumplen
+- OpenCode nunca había podido escribir en CREATE ni en CONTROL: sus reglas de permiso se comparan con rutas relativas al proyecto, no absolutas, y crear un archivo es la herramienta `write`, distinta de `edit`. Verificado contra opencode 1.18.4 con proyectos reales, con y sin espacios en la ruta. Ahora CREATE permite `write` y `edit` solo dentro de la carpeta del turno, y CONTROL permite todo el proyecto menos `.git/`, `.pulse/`, `.madre/`, los `.env` y `.claude/settings.local.json`.
+- El checkpoint de CONTROL fotografía también los repositorios git anidados dentro del proyecto (un monorepo de sitios, cada uno con su `.git`): antes un cambio dentro de uno de ellos era invisible, la sala decía "no cambió nada" y UNDO no lo deshacía. Ahora la lista de cambios, las zonas prohibidas y UNDO cubren cada repositorio, con rutas relativas al proyecto. La fotografía se toma con `ls-files` y no con `add`, así un repo anidado sin commits ya no la rompe.
+
 ## 0.3.1 · 2026-09-19
 
 ### Canal de liberación: la sala avisa cuando hay versión nueva

package/README.md

@@ -85,16 +85,18 @@ Cada mensaje sale con un modo. Tu modo es el techo de cualquier plan que ese men
 |---|---|---|
 | `#0` | **GHOST** | Fuera del registro. No se escribe en el ledger, nadie lo recuerda, desaparece al recargar. Los tokens sí cuentan. |
 | `#1` | **EXCHANGE** | Leer el proyecto y coordinar. El predeterminado. |
-| `#2` | **CREATE** | Crear archivos e imágenes, solo dentro de `<proyecto>/.pulse/out/<fecha>-<id>/`. |
+| `#2` | **CREATE** | Añadir archivos y carpetas nuevos donde corresponda en el proyecto. Lo que ya existía no cambia: si un agente lo toca, MADRE lo restaura al terminar y lo dice. |
 | `#3` | **CONTROL** | Editar el proyecto real sin aprobación por acción. Un titular por sala, checkpoint git antes, lista de cambios y `UNDO` después. |
 
-**CREATE por dentro.** MADRE crea la carpeta del turno y pasa cada CLI a escritura acotada a ella: Codex con `--sandbox workspace-write` sobre la carpeta, Claude con `Write`/`Edit` permitidos solo ahí, Gemini con reglas de política, OpenCode con permisos `edit` por patrón. Al terminar compara la carpeta y registra lo aparecido como `artifacts.created`; los archivos se muestran bajo la respuesta.
+**CREATE por dentro.** El agente decide dónde va lo nuevo según las convenciones del proyecto, y crea carpetas si hace falta; `.pulse/out/<turno>/` queda como borrador para lo que no tiene sitio. MADRE toma un checkpoint antes del turno y, al terminar, conserva lo que apareció, lo muestra bajo la respuesta como artefactos, y restaura cualquier archivo previo que se haya modificado, renombrado o borrado, avisando en la sala. Las CLIs reciben sus herramientas de escritura sobre el proyecto y la instrucción de no tocar lo existente; la garantía la da la restauración de MADRE al terminar, no la regla previa.
 
 **CONTROL por dentro.** Antes del turno, un commit real bajo `refs/madre/checkpoints/` que no toca tu rama, tu índice ni tu stash. Durante el turno, `.git/`, `.pulse/`, `.madre/`, los `.env` y `.claude/settings.local.json` quedan en solo lectura a nivel de sistema de archivos y recuperan sus permisos al terminar. Después, la lista de archivos añadidos, modificados y borrados, y `UNDO` restaura el checkpoint. Armar `#3` pide la designación del proyecto.
 
 **Escalación.** Si un plan en `#1` llega a un paso que pide crear algo, la sala se detiene y pregunta: `GRANT ONCE · GRANT FOR PLAN · DENY`, con cronómetro de tres minutos. Solo el humano concede; un permiso escrito por un agente dentro de la conversación no cuenta.
 
-**Techo por agente.** En `⚙ CONNECTIONS` cada agente tiene un `MAX MODE` y sus alcances: crear archivos, generar imágenes, web. `ALWAYS · STANDING LEASE` da a un agente una carpeta de creación en cada turno sin pedirla.
+**Modo por paso.** Un orquestador puede pedir el modo de cada paso: `@codex #2: crea la página`, `@claude #3: arregla el router`. MADRE lo acota al modo de tu mensaje y al `MAX MODE` de ese agente. Con tu mensaje en `#3`, la palabra del orquestador basta; con tu mensaje en `#1`, un paso `#2` pasa por la escalación.
+
+**Dos controles por agente.** En `⚙ CONNECTIONS` cada agente tiene `MAX MODE`, hasta dónde puede llegar un mensaje dirigido a él, y `DEFAULT MODE`, dónde empieza: `#1` solo lectura hasta que armes CREATE, o `#2` para que cada turno pueda añadir archivos sin pedirlo. Aparte, dos habilidades: generar imágenes y web.
 
 ---
 
@@ -168,7 +170,7 @@ El botón de la barra abre la pantalla de diagnóstico. Escribe un síntoma, un
 
 | Sección | Qué hace |
 |---|---|
-| `⚙ CONNECTIONS` | Sesión, versión y ruta de cada CLI; `SIGN IN` y `RECHECK`; `MAX MODE` y alcances; timeouts, presupuesto, delegación, modelo de OpenCode; MEMORY y PRIVACY |
+| `⚙ CONNECTIONS` | Sesión, versión y ruta de cada CLI; `SIGN IN` y `RECHECK`; `MAX MODE`, `DEFAULT MODE` y habilidades; timeouts, presupuesto, delegación, modelo de OpenCode; MEMORY y PRIVACY |
 | `◉ NOSTROMO` | El mapa de la memoria |
 | `SENTINEL` | Fallos que ninguna condición explica y caídas del proceso, con rutas, usuarios, correos y claves eliminados. Cada reporte tiene `REPORT ON GITHUB ↗` para leerlo antes de publicarlo; `AUTO-REPORT`, apagado por defecto, envía los nuevos al colector del proyecto |
 | `RELEASE CHANNEL` | Una consulta a npm al día. Si hay versión nueva, una alerta en la barra y aquí el comando exacto para cómo corre tu copia. MADRE nunca se actualiza sola |
@@ -198,7 +200,7 @@ Cada módulo es un archivo en `src/modules/` declarado con `defineModule`. Cómo
 - **Nada por sí solo.** MADRE no tiene nube, cuenta ni backend. No guarda credenciales.
 - **Lo que un agente lee, viaja a su proveedor.** Codex a OpenAI, Claude Code a Anthropic, Gemini CLI a Google, OpenCode a quien tenga configurado. Aplican su cuenta, sus límites y sus términos. `@madre` y el archivista con Ollama no salen de la máquina.
 - **Dos envíos propios, ambos bajo tu interruptor.** El sentinel, apagado por defecto, envía reportes redactados al colector del proyecto. El canal de liberación, encendido por defecto, pregunta a npm por la última versión: viaja el nombre del paquete, nada más, la misma petición que hace `npx`. `PULSE_UPDATE_CHECK=0` lo apaga.
-- **Escritura.** En `#1` nadie escribe. En `#2` solo dentro de `.pulse/out/`. En `#3` todo el proyecto salvo las zonas prohibidas, con checkpoint y `UNDO`.
+- **Escritura.** En `#1` nadie escribe. En `#2` solo se añade: lo que existía se restaura al terminar el turno. En `#3` todo el proyecto salvo las zonas prohibidas, con checkpoint y `UNDO`. En un proyecto sin git, MADRE guarda sus fotografías en un repositorio sombra fuera del proyecto.
 - **Memoria.** Todo lo dicho fuera de GHOST queda en `~/.pulse/rooms/<sala>/` y vuelve a los prompts de todos los agentes de esa sala. GHOST es la salida para lo que no debe recordarse; PRIVACY, para los nombres que nunca deben aparecer.
 
 ---

package/docs/INTERNALS.md

@@ -62,9 +62,15 @@ Cada agente corre como proceso en su propio grupo, con un home aislado que solo
 
 Los alcances de imagen de Claude, Gemini y OpenCode se cumplen con **Image Studio**: el servidor MCP `src/mcp/image-server.mjs`, adjunto solo dentro de un lease con el alcance encendido, que genera con la API de imágenes de Gemini y guarda el archivo en la carpeta del turno.
 
+## CREATE por dentro
+
+Un turno en `#2` toma la misma fotografía que CONTROL, sin asiento: varios turnos `#2` pueden correr a la vez. Al terminar, `diff` contra la fotografía: los archivos añadidos se conservan y se registran como `artifacts.created` con su ruta en el proyecto; los modificados, renombrados o borrados se restauran desde la fotografía y se anuncian en `create.reverted`. Las zonas prohibidas se restauran igual que en CONTROL. Cada CLI recibe sus herramientas de escritura sobre el proyecto: Claude Code niega `Write` si `Edit` no está permitido en la misma ruta y OpenCode deja sin herramienta de escritura si `edit` está denegado (ambos verificados con el CLI real), así que en `#2` van juntas y la garantía de "solo añadir" es la restauración posterior, no la regla previa. Gemini recibe solo `write_file`. El `scratchDir` bajo `.pulse/out/` sigue existiendo para lo que no tiene sitio y para Image Studio.
+
+En un plan, el modo de cada paso es el mínimo entre lo que pidió el orquestador (`@agente #n:`), el techo del plan (el modo del mensaje humano) y el `MAX MODE` del agente. Bajo techo `#3`, un paso `#2` recibe un lease de proyecto emitido a nombre del orquestador y un paso `#3` toma CONTROL con su propio checkpoint, uno a la vez. Bajo techo `#1`, un paso `#2` pasa por la escalación al humano.
+
 ## CONTROL por dentro
 
-Antes del turno, MADRE fotografía el proyecto como un commit real bajo `refs/madre/checkpoints/` con un índice temporal: incluye archivos sin seguimiento, respeta `.gitignore`, no toca tu rama, tu índice ni tu stash, y funciona en repositorios sin commits. Mientras dura el turno, `.env*`, `.pulse/`, `.madre/` y `.claude/settings.local.json` quedan en solo lectura a nivel de sistema de archivos y recuperan sus permisos al terminar. Después, `git diff` contra el checkpoint da la lista de cambios; cualquier escritura en una zona prohibida que hubiera pasado se revierte desde el checkpoint y se nombra. `UNDO` restaura el checkpoint completo.
+Antes del turno, MADRE fotografía el proyecto como un commit real bajo `refs/madre/checkpoints/` con un índice temporal (en un proyecto sin git, en un repositorio sombra bajo el directorio temporal del sistema, con el proyecto como árbol de trabajo): incluye archivos sin seguimiento, respeta `.gitignore`, no toca tu rama, tu índice ni tu stash, y funciona en repositorios sin commits. Mientras dura el turno, `.env*`, `.pulse/`, `.madre/` y `.claude/settings.local.json` quedan en solo lectura a nivel de sistema de archivos y recuperan sus permisos al terminar. Después, `git diff` contra el checkpoint da la lista de cambios; cualquier escritura en una zona prohibida que hubiera pasado se revierte desde el checkpoint y se nombra. `UNDO` restaura el checkpoint completo.
 
 ## Recuperación operativa
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jossuealcala/madre",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "MADRE · one local room where the AI coding agents already on your machine (Codex, Claude Code, Gemini CLI, OpenCode) work on a project together, with a shared memory every one of them recalls and a local @madre that speaks for it. Read-only by default, per-message permission modes up to a checkpointed CONTROL. Nothing leaves your machine on its own.",
   "keywords": [
     "ai-agents",

package/public/app.js

@@ -33,14 +33,14 @@ const els = {
 // Built-in commands live in the composer; module commands come from the
 // server (/api/commands) and run there, read-only, as fact cards.
 const CLIENT_COMMANDS = [
-  { name: 'create', title: 'CREATE', usage: '/create <what to make>', summary: 'Arm the creation lease for this message: the agent may create files inside .pulse/out/.', available: true, client: true },
+  { name: 'create', title: 'CREATE', usage: '/create <what to make>', summary: 'Arm CREATE for this message: the agent may add new files to the project where they belong.', available: true, client: true },
   { name: 'image', title: 'Image', usage: '/image <what to draw>', summary: 'Ask for an image: arms CREATE with the image scope and routes to an agent that can generate images.', available: true, client: true },
   { name: 'stopall', title: 'STOP ALL', usage: '/stopall', summary: 'Master brake: halt every plan and turn in flight. Never reaches an agent.', available: true, client: true },
 ];
 
 const PLACEHOLDERS = {
   plain: 'Type here, human. Ask the room…',
-  create: 'Creation lease on: what to create and how it should look. It lands in .pulse/out/',
+  create: 'CREATE on: what to make. New files land where they belong in the project; nothing existing changes.',
   order: 'Priority one. Terse transmissions; the original stays in the record.',
   ghost: 'Off the record. Ask anything; nothing is saved, nobody else will remember it.',
   control: 'Control armed. Say what to change in the project; every action runs without asking.',
@@ -55,7 +55,7 @@ const MAX_ROWS = 3;
 const MODES = {
   0: { key: 'ghost', label: 'GHOST', hint: 'Off the record. Nothing is saved; gone on reload.' },
   1: { key: 'exchange', label: 'EXCHANGE', hint: 'Read the project and talk to the room. Writes nothing.' },
-  2: { key: 'create', label: 'CREATE', hint: 'Write new files, only inside this turn\'s .pulse/out/.' },
+  2: { key: 'create', label: 'CREATE', hint: 'Add new files where they belong in the project. Existing files stay untouched.' },
   3: { key: 'control', label: 'CONTROL', hint: 'Edit the project itself, no approval per action. Override required.' },
 };
 
@@ -1426,6 +1426,18 @@ function renderLeaseRefused(event) {
 
 /* ---------- CONTROL: the project itself, between two checkpoints ---------- */
 
+// create · @codex · 2 existing files put back: CREATE only adds (README.md, src/index.astro)
+function renderCreateReverted(event) {
+  const { agent, existing = [], forbidden = [] } = event.payload;
+  const node = el('div', 'system memory warn');
+  node.style.setProperty('--agent', agentColor(agent));
+  node.append('create · ', el('b', 'who', `@${agent}`));
+  if (existing.length) node.append(` · ${existing.length} existing file${existing.length === 1 ? '' : 's'} put back, CREATE only adds: ${existing.slice(0, 4).join(', ')}${existing.length > 4 ? '…' : ''}`);
+  if (forbidden.length) node.append(` · ${forbidden.length} write${forbidden.length === 1 ? '' : 's'} into forbidden zones reverted`);
+  node.append(' · need to change existing files? ask again in #3 CONTROL');
+  return node;
+}
+
 function renderControlStarted(event) {
   const { agent, commit, message } = event.payload;
   const node = el('div', 'system control');
@@ -1552,7 +1564,7 @@ function renderModeRequest(event) {
       for (const other of actions.querySelectorAll('button')) other.disabled = false;
     }
   };
-  const once = el('button', 'grant', 'GRANT ONCE'); once.type = 'button'; once.title = `@${agent} creates files for this step only, inside its own .pulse/out/ directory.`;
+  const once = el('button', 'grant', 'GRANT ONCE'); once.type = 'button'; once.title = `@${agent} may add files to the project for this step only.`;
   const plan = el('button', 'grant plan', 'GRANT FOR PLAN'); plan.type = 'button'; plan.title = 'Every remaining writable step of this plan shares one lease directory.';
   const deny = el('button', 'deny', 'DENY'); deny.type = 'button'; deny.title = `@${agent} answers read-only and says what it would have created.`;
   once.addEventListener('click', () => decide('once', once));
@@ -1594,12 +1606,19 @@ function renderLease(event) {
   const { agent, outDir, scopes = [], unavailable = [], standing = false, escalated = null } = event.payload;
   const node = el('div', 'system lease');
   node.style.setProperty('--agent', agentColor(agent));
-  node.append(el('b', null, standing ? 'standing lease · ' : escalated ? `lease granted on request${escalated === 'plan' ? ' · whole plan' : ''} · ` : 'creation lease · '));
-  node.append(`@${agent} may ${scopes.map((scope) => CAP_LABELS[scope] ?? scope).join(', ') || 'create files'}${unavailable.length ? ` (cannot ${unavailable.join(', ')})` : ''} in `);
-  const link = el('a', 'file-link', outDir);
-  link.href = '#';
-  link.addEventListener('click', (ev) => { ev.preventDefault(); });
-  node.append(link);
+  const { delegated = false, scratchDir = null, grantedBy = null } = event.payload;
+  node.append(el('b', null, standing ? 'default #2 · ' : escalated ? `#2 granted on request${escalated === 'plan' ? ' · whole plan' : ''} · ` : delegated ? `#2 by @${grantedBy} · ` : 'create · '));
+  node.append(`@${agent} may ${scopes.map((scope) => CAP_LABELS[scope] ?? scope).join(', ') || 'create files'}${unavailable.length ? ` (cannot ${unavailable.join(', ')})` : ''} `);
+  if (outDir === '.' || !outDir) {
+    node.append('anywhere in the project · existing files stay untouched');
+    if (scratchDir) { node.append(' · scratch '); const link = el('a', 'file-link', scratchDir); link.href = '#'; link.addEventListener('click', (ev) => { ev.preventDefault(); }); node.append(link); }
+  } else {
+    node.append('in ');
+    const link = el('a', 'file-link', outDir);
+    link.href = '#';
+    link.addEventListener('click', (ev) => { ev.preventDefault(); });
+    node.append(link);
+  }
   state.lastSender = null;
   return node;
 }
@@ -1861,6 +1880,7 @@ function renderEventNode(event) {
     case 'lease.missing': node = renderLeaseMissing(event); break;
     case 'mode.requested': node = renderModeRequest(event); break;
     case 'control.started': node = renderControlStarted(event); break;
+    case 'create.reverted': node = renderCreateReverted(event); break;
     case 'control.changed': node = renderControlChanged(event); if (!replaying) ripleyMaybeReload((event.payload.files ?? []).map((file) => file.path)); break;
     case 'control.reverted': node = renderControlReverted(event); break;
     case 'mode.granted':
@@ -2351,8 +2371,8 @@ function renderCreateScopes() {
   const standing = Boolean(scopes?.write?.always);
   els.createToggle.classList.toggle('standing', standing);
   els.createToggle.title = standing
-    ? `Standing lease: every turn of @${id} may create files inside .pulse/out/ (set in CONNECTIONS). Arming CREATE is not needed.`
-    : 'Creation lease: let the agent create files for this request, only inside .pulse/out/';
+    ? `@${id} starts in #2 (DEFAULT MODE in CONNECTIONS): every turn may add files to the project. Arming CREATE is not needed.`
+    : 'CREATE: let the agent add new files to the project for this request; existing files stay untouched';
   box.hidden = !state.create || !scopes;
   if (box.hidden) return;
   box.replaceChildren();
@@ -3298,7 +3318,8 @@ function connectionCard(agent) {
   card.append(meta);
   const scopes = el('div', 'scopes');
   const agentScopes = settingsUI.data.settings.capabilities?.[agent.id]?.scopes ?? {};
-  for (const [key, labelText] of [['write', 'CREATE FILES'], ['imageGen', 'GENERATE IMAGES'], ['web', 'WEB ACCESS']]) {
+  // Two abilities per agent: images and web. Writing is not an ability, it is the ceiling below.
+  for (const [key, labelText] of [['imageGen', 'GENERATE IMAGES'], ['web', 'WEB ACCESS']]) {
     const scope = agentScopes[key] ?? { capable: false, enabled: false, wired: false };
     const line = el('label', `scope${!scope.capable || !scope.wired ? ' unavailable' : ''}`);
     const box = el('input'); box.type = 'checkbox'; box.checked = Boolean(scope.enabled); box.disabled = !scope.capable || !scope.wired;
@@ -3332,30 +3353,6 @@ function connectionCard(agent) {
       line.append(assist);
     }
     scopes.append(line);
-    if (key === 'write' && scope.capable) {
-      const always = el('label', `scope sub${scope.enabled ? '' : ' unavailable'}`);
-      const alwaysBox = el('input'); alwaysBox.type = 'checkbox'; alwaysBox.checked = Boolean(scope.always); alwaysBox.disabled = !scope.enabled;
-      alwaysBox.dataset.agent = agent.id; alwaysBox.dataset.scope = 'alwaysCreate'; alwaysBox.className = 'scope-input';
-      alwaysBox.addEventListener('change', async () => {
-        alwaysBox.disabled = true;
-        try {
-          const response = await fetch('/api/settings', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ scopes: { [agent.id]: { alwaysCreate: alwaysBox.checked } } }) });
-          const result = await response.json().catch(() => ({}));
-          if (!response.ok) throw new Error(result.error ?? `HTTP ${response.status}`);
-          if (result.settings?.capabilities) { state.capabilities = result.settings.capabilities; settingsUI.data.settings.capabilities = result.settings.capabilities; renderCreateScopes(); }
-          toast(`MU/TH/UR › @${agent.id} ${alwaysBox.checked ? 'now holds a standing lease: every turn may create files in .pulse/out/, including plan steps.' : 'creates files only when you arm CREATE.'}`);
-        } catch (error) {
-          alwaysBox.checked = !alwaysBox.checked;
-          toast(`Scope was not saved: ${error.message}`);
-        } finally {
-          alwaysBox.disabled = !scope.enabled;
-        }
-      });
-      always.append(alwaysBox, 'ALWAYS · STANDING LEASE');
-      always.append(el('span', 'why', scope.always ? 'every turn and plan step may create files' : 'only when CREATE is armed'));
-      always.title = 'Skip arming CREATE: this agent gets a fresh .pulse/out/ directory on every turn, also when another agent delegates to it.';
-      scopes.append(always);
-    }
   }
   // The ceiling: how far the composer may take this agent.
   const ceiling = el('div', 'ceiling');
@@ -3381,6 +3378,29 @@ function connectionCard(agent) {
   ceiling.append(seg);
   ceiling.append(el('span', 'why', `${MODES[currentCap].label} · ${MODES[currentCap].hint}`));
   scopes.append(ceiling);
+  // The start: where a message to this agent begins. #2 means every turn may create files without arming CREATE.
+  const start = el('div', 'ceiling');
+  start.append(el('span', 'k', 'DEFAULT MODE'));
+  const startSeg = el('div', 'seg');
+  const currentStart = agentScopes.defaultMode ?? 1;
+  for (const n of [1, 2]) {
+    const button = el('button', `seg-option o${n}${currentStart === n ? ' current' : ''}`, `#${n}`);
+    button.type = 'button';
+    button.title = n === 2 ? 'Every message to this agent starts in CREATE: new files where they belong, existing files untouched. Plan steps to it too.' : 'Messages start read-only; arm CREATE when you want files.';
+    button.disabled = n > currentCap;
+    button.addEventListener('click', async () => {
+      if (n === currentStart) return;
+      for (const other of startSeg.children) other.disabled = true;
+      try {
+        await saveSettingNow({ scopes: { [agent.id]: { defaultMode: n } } }, n === 2 ? `@${agent.id} starts in #2 CREATE: every turn may add files to the project.` : `@${agent.id} starts read-only; arm CREATE when you want files.`);
+        await loadSettings();
+      } catch (error) { toast(`Default mode was not saved: ${error.message}`); for (const other of startSeg.children) other.disabled = false; }
+    });
+    startSeg.append(button);
+  }
+  start.append(startSeg);
+  start.append(el('span', 'why', currentStart === 2 ? 'every turn may create files, plan steps too' : 'read-only until you arm CREATE'));
+  scopes.append(start);
   card.append(scopes);
 
   const row = el('div', 'row');

package/public/troubleshooting.js

@@ -301,7 +301,7 @@ export const CONDITIONS = [
     severity: 'informational',
     title: 'Permission modes: #0 GHOST · #1 EXCHANGE · #2 CREATE · #3 CONTROL',
     match: /mode|ghost|exchange|control|override|designation|max mode|#[0-3]\b/i,
-    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE is the creation lease: files and images inside .pulse/out/. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies.',
+    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE lets the agent add new files and folders anywhere in the project, where they belong; whatever existed before is put back after the turn and the room says so. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies.',
     remedy: 'Pick the mode in the chip, or type #0..#3 in the message. Raise an agent\'s MAX MODE in ⚙ CONNECTIONS. CONTROL asks for the project designation (the folder name) in the override before arming.',
     fixes: same(['# chip: TO @codex  #1 EXCHANGE ▾  → choose', '@codex #2 create the poster', '# ⚙ CONNECTIONS → agent card → MAX MODE']),
   },
@@ -310,9 +310,9 @@ export const CONDITIONS = [
     severity: 'informational',
     title: 'Creating files: who grants the permission',
     match: /no CREATE lease|lease-missing|read-only and do not modify|permiso de escritura|solo lectura/i,
-    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from a standing lease, a per-agent switch that gives every turn of that agent a fresh .pulse/out/ directory, including plan steps.',
-    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to create files: ⚙ CONNECTIONS → its card → CREATE FILES → ALWAYS · STANDING LEASE. Files still land only inside .pulse/out/.',
-    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → ALWAYS · STANDING LEASE']),
+    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from DEFAULT MODE #2 in ⚙ CONNECTIONS, which starts every message to that agent in CREATE.',
+    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to add files: ⚙ CONNECTIONS → its card → DEFAULT MODE → #2. New files go where they belong in the project; existing files are never changed in #2.',
+    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → DEFAULT MODE → #2']),
   },
   {
     id: 'scope-write',

package/src/adapters/claude.mjs

@@ -26,6 +26,9 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
   const allowed = [
     'Read', 'Glob', 'Grep',
     // Claude Code reads `/path` as relative to the project and `//path` as an absolute path.
+    // Claude Code grants Write only when Edit is allowed on the same paths (verified with the real
+    // CLI: a lone Write rule is denied under dontAsk), so both come together; in CREATE the room
+    // restores existing files after the turn.
     ...(lease ? [`Write(//${lease.outDir}/**)`, `Edit(//${lease.outDir}/**)`] : []),
     ...(scopes?.web ? ['WebFetch', 'WebSearch'] : []),
     ...mcpTools,
@@ -44,7 +47,7 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
     '--tools', tools.join(','),
     ...(lease || scopes?.web || anyMcp ? ['--allowedTools', allowed.join(',')] : []),
     // CONTROL: the whole project is writable except MADRE's forbidden zones.
-    ...(lease?.control ? ['--disallowedTools', ['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
+    ...(lease?.control || lease?.create ? ['--disallowedTools', ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
     // --safe-mode disables every MCP server, ours included. With a MADRE server
     // attached we drop it and instead load no setting sources at all: no user
     // hooks, plugins or MCP servers, only the project's CLAUDE.md and ours.

package/src/adapters/gemini.mjs

@@ -27,19 +27,22 @@ export const geminiCredentialFiles = ['oauth_creds.json', 'google_accounts.json'
 // whose file_path argument starts with the lease directory. Plan mode would
 // block every write regardless of policy, so a lease uses approval "default":
 // headless Gemini cannot prompt, so anything the policy does not allow fails.
-export function geminiLeasePolicy(outDir, { control = false } = {}) {
+export function geminiLeasePolicy(outDir, { control = false, create = false } = {}) {
   const escaped = outDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const forbidden = control ? `
+  // The whole project is the lease in #2 and #3: MADRE's zones stay out of reach.
+  const forbidden = control || create ? `
 [[rule]]
 toolName = ["write_file", "replace", "edit", "run_shell_command"]
-argsPattern = '${escaped}/(\\.git|\\.pulse|\\.env)'
+argsPattern = '${escaped}/(\\.git|\\.pulse|\\.madre|\\.env|\\.claude/settings\\.local\\.json)'
 decision = "deny"
 priority = 1100
 interactive = false
 ` : '';
+  // CREATE (#2) adds files: write_file only; CONTROL (#3) also replaces and edits.
+  const tools = create ? '["write_file"]' : '["write_file", "replace", "edit"]';
   return `${geminiReadonlyPolicy}
 [[rule]]
-toolName = ["write_file", "replace", "edit"]
+toolName = ${tools}
 argsPattern = '"file_path"\\s*:\\s*"${escaped}/'
 decision = "allow"
 priority = 1000
@@ -56,7 +59,7 @@ interactive = false
 `;
 
 export function geminiPolicy({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}`;
+  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}`;
 }
 
 export function geminiMemoryPolicy(memoryServer) {

package/src/adapters/opencode.mjs

@@ -34,19 +34,36 @@ export function buildOpenCodeArgs({ projectRoot, prompt, model = process.env.PUL
   ];
 }
 
-export function leaseConfig(outDir, { control = false } = {}) {
-  const forbidden = control ? Object.fromEntries(['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].map((glob) => [`${outDir}/${glob}`, 'deny'])) : {};
+// OpenCode matches permission patterns against paths relative to `--dir`, last matching rule
+// wins, and creating a file is the `write` tool while changing one is `edit`: both need a rule.
+// Verified against opencode 1.18.4: absolute patterns never match, so the lease is named by
+// its directory relative to the project.
+export const FORBIDDEN_GLOBS = ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'];
+export function writeRules(relativeDir, { control = false, create = false } = {}) {
+  if (control || create) return { '*': 'allow', ...Object.fromEntries(FORBIDDEN_GLOBS.map((glob) => [glob, 'deny'])) };
+  const dir = String(relativeDir ?? '.').replace(/^\.\/+/, '').replace(/\/+$/, '');
+  return { '*': 'deny', [dir && dir !== '.' ? `${dir}/**` : '**']: 'allow' };
+}
+
+export function leaseConfig(outDir, { control = false, create = false, relativeDir = null } = {}) {
+  const rules = writeRules(relativeDir ?? outDir, { control, create });
+  // OpenCode gates its `write` tool behind the `edit` permission as well (denying edit leaves "no
+  // file-writing tool"), so CREATE allows both and the room restores existing files afterwards.
+  const editRules = rules;
   return {
     ...readonlyConfig,
     agent: {
       'pulse-readonly': {
         ...readonlyConfig.agent['pulse-readonly'],
         prompt: control
-          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse and .env files. Do not run commands, browse the web, or launch subagents.'
-          : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
+          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse, .madre and .env files. Do not run commands, browse the web, or launch subagents.'
+          : create
+            ? 'Answer the user directly. You may create new files and folders anywhere in this project where they belong; do not modify or delete existing files. Do not run commands, browse the web, or launch subagents.'
+            : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
         permission: {
           ...readonlyConfig.agent['pulse-readonly'].permission,
-          edit: { '*': 'deny', [`${outDir}/**`]: 'allow', ...forbidden },
+          edit: editRules,
+          write: rules,
         },
       },
     },
@@ -54,7 +71,7 @@ export function leaseConfig(outDir, { control = false } = {}) {
 }
 
 export function openCodeConfig({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control) }) : readonlyConfig;
+  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), relativeDir: lease.relativeDir ?? null }) : readonlyConfig;
   if (scopes?.web) {
     config = {
       ...config,

package/src/capabilities.mjs

@@ -108,14 +108,16 @@ export function resolveScopes(agentId, configured = {}) {
     const wanted = configured[scope] ?? (scope !== 'web');
     scopes[scope] = { capable, enabled: capable && wanted, wired: true };
   }
-  // A standing lease: every turn of this agent may create files inside
-  // .pulse/out/ without the human arming CREATE each time. Opt-in per agent.
-  scopes.write.always = Boolean(configured.alwaysCreate) && scopes.write.enabled;
-  // The ceiling: how far the composer may take this agent. Writing needs the
-  // CLI to be able to write; CONTROL is capped at 2 until phase C wires it.
-  const wanted = normalizeMode(configured.maxMode, scopes.write.enabled ? 2 : 1);
-  scopes.maxMode = Math.min(wanted, scopes.write.capable ? 3 : 1);
-  scopes.defaultMode = scopes.write.always && scopes.maxMode >= 2 ? 2 : 1;
+  // One ceiling per agent: MAX MODE. Writing follows from it: an agent capped at #1 never
+  // writes, one allowed to #2 or #3 does. A `write: false` from an older config reads as #1.
+  const capableMax = scopes.write.capable ? 3 : 1;
+  const legacyCap = configured.write === false ? 1 : 3;
+  scopes.maxMode = Math.min(normalizeMode(configured.maxMode, scopes.write.capable ? 2 : 1), legacyCap, capableMax);
+  scopes.write.enabled = scopes.write.capable && scopes.maxMode >= 2;
+  // One start per agent: DEFAULT MODE, #1 or #2, never above the ceiling. An older
+  // `alwaysCreate` reads as #2. `write.always` keeps its name for the room's code.
+  scopes.defaultMode = Math.min(normalizeMode(configured.defaultMode, configured.alwaysCreate ? 2 : 1), 2, Math.max(1, scopes.maxMode));
+  scopes.write.always = scopes.defaultMode >= 2 && scopes.write.enabled;
   return scopes;
 }
 

package/src/checkpoint.mjs

@@ -1,7 +1,8 @@
 import { execFile } from 'node:child_process';
-import { access, mkdtemp, rm, unlink } from 'node:fs/promises';
+import { access, mkdir, mkdtemp, readdir, rm, unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve, sep } from 'node:path';
+import { createHash } from 'node:crypto';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -25,50 +26,143 @@ export const FORBIDDEN = [
 ];
 export const isForbidden = (path) => FORBIDDEN.some((pattern) => pattern.test(path));
 
-async function git(root, args, { env = {} } = {}) {
-  const { stdout } = await execFileAsync('git', ['-c', 'core.quotepath=off', ...args], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 16 * 1024 * 1024 });
-  return stdout;
-}
-
 export async function isGitRepo(root) {
   return access(join(root, '.git')).then(() => true, () => false);
 }
 
+// A project that is not a git repository still gets photographs: MADRE keeps a shadow
+// repository of its own outside the project (one per project path) and runs git with the
+// project as work tree. Nothing appears inside the project; UNDO and diffs work the same.
+const shadows = new Map();
+async function shadowFor(root) {
+  const canonical = resolve(root);
+  if (!shadows.has(canonical)) {
+    const dir = join(tmpdir(), 'madre-shadow', createHash('sha1').update(canonical).digest('hex').slice(0, 16));
+    await mkdir(dir, { recursive: true });
+    const isRepo = await access(join(dir, 'HEAD')).then(() => true, () => false);
+    if (!isRepo) await execFileAsync('git', ['init', '-q', '--bare', dir]);
+    shadows.set(canonical, dir);
+  }
+  return shadows.get(canonical);
+}
+async function gitArgs(root) {
+  if (await isGitRepo(root)) return [];
+  return ['--git-dir', await shadowFor(root), '--work-tree', root];
+}
+
+async function git(root, args, { env = {} } = {}) {
+  const { stdout } = await execFileAsync('git', ['-c', 'core.quotepath=off', ...(await gitArgs(root)), ...args], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 16 * 1024 * 1024 });
+  return stdout;
+}
+
 // A tree object of the working tree as it is right now: tracked and untracked
 // files, ignored ones left out. Built in a temporary index.
-export async function worktreeTree(root) {
+export async function worktreeTree(root, { exclude = [] } = {}) {
   const dir = await mkdtemp(join(tmpdir(), 'madre-index-'));
   const index = join(dir, 'index');
   try {
     const env = { GIT_INDEX_FILE: index };
+    const extra = await gitArgs(root);
     await git(root, ['read-tree', '--empty'], { env });
-    await git(root, ['add', '-A', '--', '.'], { env });
+    // Every file of the working tree that git would not ignore, listed against the empty
+    // index. Nested repositories come back as `dir/` entries and are left out: they are
+    // photographed on their own, and `git add` would refuse one without commits anyway.
+    const listed = await git(root, ['ls-files', '-z', '--others', '--exclude-standard', '--', '.'], { env });
+    const skip = new Set(exclude.map((path) => path.replace(/\/$/, '')));
+    // Lock folders (MADRE's own `*.lock/`) come and go between the listing and the indexing.
+    const files = listed.split('\0').filter((path) => path && !path.endsWith('/') && !/(^|\/)[^/]+\.lock\//.test(path) && ![...skip].some((dir) => path === dir || path.startsWith(`${dir}/`)));
+    if (files.length) {
+      // --remove: a file that vanished since the listing is dropped instead of aborting the photograph.
+      const index_ = (list) => new Promise((resolvePromise, reject) => {
+        const child = execFile('git', ['-c', 'core.quotepath=off', ...extra, 'update-index', '--add', '--remove', '-z', '--stdin'], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 64 * 1024 * 1024 }, (error) => (error ? reject(error) : resolvePromise()));
+        child.stdin.end(list.join('\0') + '\0');
+      });
+      try { await index_(files); } catch {
+        // Something still raced us: photograph what exists right now.
+        const alive = [];
+        for (const path of files) if (await access(join(root, path)).then(() => true, () => false)) alive.push(path);
+        if (alive.length) await index_(alive);
+      }
+    }
     return (await git(root, ['write-tree'], { env })).trim();
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 }
 
-export async function createCheckpoint(root, { id, label = 'MADRE checkpoint' } = {}) {
-  const tree = await worktreeTree(root);
+// Repositories nested inside the project (a monorepo of sites, each with its own .git). The
+// outer git sees them as a single entry and never notices what changes inside, so each one
+// gets its own photograph. Ignored folders are skipped; depth is capped.
+const NESTED_SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.pulse', '.madre', 'vendor']);
+export async function nestedRepos(root, { maxDepth = 3 } = {}) {
+  const found = [];
+  const walk = async (dir, rel, depth) => {
+    let entries = [];
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || NESTED_SKIP.has(entry.name)) continue;
+      const path = join(dir, entry.name);
+      const relPath = rel ? `${rel}/${entry.name}` : entry.name;
+      if (await isGitRepo(path)) { found.push(relPath); continue; }   // a repo's own nested repos are its business
+      if (depth + 1 < maxDepth) await walk(path, relPath, depth + 1);
+    }
+  };
+  await walk(root, '', 0);
+  return found.sort();
+}
+
+async function checkpointOne(root, { id, label, exclude = [] }) {
+  const tree = await worktreeTree(root, { exclude });
   const head = (await git(root, ['rev-parse', '--verify', '-q', 'HEAD']).catch(() => '')).trim() || null;
   const commit = (await git(root, ['commit-tree', tree, ...(head ? ['-p', head] : []), '-m', `${label} ${id}`], { env: { GIT_AUTHOR_NAME: 'MADRE', GIT_AUTHOR_EMAIL: 'madre@localhost', GIT_COMMITTER_NAME: 'MADRE', GIT_COMMITTER_EMAIL: 'madre@localhost' } })).trim();
   await git(root, ['update-ref', `${CHECKPOINT_REF}/${id}`, commit]);
-  return { id, commit, tree, head, createdAt: new Date().toISOString() };
+  return { commit, tree, head };
+}
+
+export async function createCheckpoint(root, { id, label = 'MADRE checkpoint' } = {}) {
+  const dirs = await nestedRepos(root);
+  const outer = await checkpointOne(root, { id, label, exclude: dirs });
+  const nested = [];
+  for (const dir of dirs) {
+    try { nested.push({ dir, ...(await checkpointOne(join(root, dir), { id, label })) }); } catch { /* a broken nested repo is left alone */ }
+  }
+  return { id, ...outer, nested, exclude: dirs, createdAt: new Date().toISOString() };
 }
 
 // What changed since the checkpoint: name-status per file and git's --stat.
-export async function diffCheckpoint(root, checkpoint) {
-  const after = await worktreeTree(root);
-  if (after === checkpoint.tree) return { afterTree: after, files: [], stat: '', forbidden: [] };
-  const nameStatus = await git(root, ['diff', '--name-status', '-M', checkpoint.tree, after]);
+async function diffOne(root, before, prefix = '', exclude = []) {
+  const after = await worktreeTree(root, { exclude });
+  if (after === before.tree) return { files: [], stat: '' };
+  const nameStatus = await git(root, ['diff', '--name-status', '-M', before.tree, after]);
   const files = nameStatus.split('\n').filter(Boolean).map((line) => {
     const [status, ...rest] = line.split('\t');
-    const path = rest.at(-1);
-    return { status: status[0], path, from: status[0] === 'R' ? rest[0] : undefined };
+    const path = prefix + rest.at(-1);
+    return { status: status[0], path, from: status[0] === 'R' ? prefix + rest[0] : undefined };
   });
-  const stat = (await git(root, ['diff', '--stat=100', checkpoint.tree, after])).trim();
-  return { afterTree: after, files, stat, forbidden: files.filter((file) => isForbidden(file.path)).map((file) => file.path) };
+  const stat = (await git(root, ['diff', '--stat=100', before.tree, after])).trim();
+  return { files, stat: prefix && stat ? stat.split('\n').map((line) => (line.startsWith(' ') ? ` ${prefix}${line.trimStart()}` : line)).join('\n') : stat };
+}
+
+// What changed since the checkpoint, in the project and in every nested repository, paths
+// relative to the project. Forbidden zones are judged on the path inside each repository too.
+export async function diffCheckpoint(root, checkpoint) {
+  const outer = await diffOne(root, checkpoint, '', checkpoint.exclude ?? []);
+  const parts = [outer];
+  for (const part of checkpoint.nested ?? []) {
+    try { parts.push(await diffOne(join(root, part.dir), part, `${part.dir}/`)); } catch { /* left alone */ }
+  }
+  const files = parts.flatMap((part) => part.files);
+  const stat = parts.map((part) => part.stat).filter(Boolean).join('\n');
+  const forbiddenIn = (path) => isForbidden(path) || (checkpoint.nested ?? []).some((part) => path.startsWith(`${part.dir}/`) && isForbidden(path.slice(part.dir.length + 1)));
+  return { afterTree: outer.afterTree ?? null, files, stat, forbidden: files.filter((file) => forbiddenIn(file.path)).map((file) => file.path) };
+}
+
+// Which repository a project-relative path belongs to, and the path inside it.
+function repoFor(root, checkpoint, path) {
+  for (const part of checkpoint.nested ?? []) {
+    if (path.startsWith(`${part.dir}/`)) return { dir: join(root, part.dir), commit: part.commit, inner: path.slice(part.dir.length + 1) };
+  }
+  return { dir: root, commit: checkpoint.commit, inner: path };
 }
 
 // Put the working tree back to the checkpoint: files added since are removed,
@@ -83,18 +177,20 @@ export async function restoreCheckpoint(root, checkpoint, { paths = null } = {})
   for (const file of chosen) {
     const absolute = resolve(root, file.path);
     if (!absolute.startsWith(canonicalRoot + sep)) continue;
+    const repo = repoFor(root, checkpoint, file.path);
     if (file.status === 'A') {
       await unlink(absolute).catch(() => {});
       removed.push(file.path);
     } else {
       if (file.status === 'R' && file.from) {
         await unlink(absolute).catch(() => {});
-        await git(root, ['restore', '--source', checkpoint.commit, '--worktree', '--', file.from]);
+        const origin = repoFor(root, checkpoint, file.from);
+        await git(origin.dir, ['restore', '--source', origin.commit, '--worktree', '--', origin.inner]);
         restored.push(file.from);
         removed.push(file.path);
         continue;
       }
-      await git(root, ['restore', '--source', checkpoint.commit, '--worktree', '--', file.path]);
+      await git(repo.dir, ['restore', '--source', repo.commit, '--worktree', '--', repo.inner]);
       restored.push(file.path);
     }
   }
@@ -103,4 +199,5 @@ export async function restoreCheckpoint(root, checkpoint, { paths = null } = {})
 
 export async function dropCheckpoint(root, checkpoint) {
   await git(root, ['update-ref', '-d', `${CHECKPOINT_REF}/${checkpoint.id}`]).catch(() => {});
+  for (const part of checkpoint.nested ?? []) await git(join(root, part.dir), ['update-ref', '-d', `${CHECKPOINT_REF}/${checkpoint.id}`]).catch(() => {});
 }

package/src/directives.mjs

@@ -21,6 +21,7 @@ export const DELEGATION_HELP = (self, others, maxSteps) => [
   `@${others[0] ?? 'codex'}: <question for that agent>`,
   `@${self}: <what you will do with their answers, optional closing turn for you>`,
   '```',
+  'A step may name the mode it needs, "@codex #2: create the page" or "@claude #3: fix the router"; MADRE caps it at your own mode and at that agent\'s MAX MODE. Without a number a step inherits the plan\'s mode.',
   `MADRE runs the steps in order (at most ${maxSteps}), shows every answer in the room, then hands you the closing turn if you asked for one.`,
   'The plan block must be the very last thing in your reply: nothing after it, not even a closing sentence. Say everything else before it.',
   'Address each agent once. Do not delegate what you can answer yourself.',
@@ -45,10 +46,12 @@ export function parseDirectives(text, { self, available = [], maxSteps = 4 } = {
     for (const raw of block[1].split('\n')) {
       const line = raw.trim();
       if (!line || line.startsWith('#')) continue;
-      const match = line.match(/^[-*]?\s*@([a-z0-9_-]+)\s*[:：]\s*(.+)$/i);
-      if (!match) { ignored.push({ line, reason: 'not a step (expected "@agent: text")' }); continue; }
+      // "@agent: text" or "@agent #2: text": the mode is a request, capped by the plan's ceiling and the agent's MAX MODE.
+      const match = line.match(/^[-*]?\s*@([a-z0-9_-]+)\s*(?:#([0-3]))?\s*[:：]\s*(.+)$/i);
+      if (!match) { ignored.push({ line, reason: 'not a step (expected "@agent: text" or "@agent #2: text")' }); continue; }
       const agent = match[1].toLowerCase();
-      const instruction = match[2].trim();
+      const instruction = match[3].trim();
+      const mode = match[2] === undefined ? null : Number(match[2]);
       if (agent === self) {
         if (closing) { ignored.push({ line, reason: 'only one closing step for the orchestrator' }); continue; }
         closing = instruction;
@@ -58,7 +61,7 @@ export function parseDirectives(text, { self, available = [], maxSteps = 4 } = {
       if (seen.has(agent)) { ignored.push({ line, reason: `@${agent} already has a step` }); continue; }
       if (steps.length >= maxSteps) { ignored.push({ line, reason: `plan is capped at ${maxSteps} steps` }); continue; }
       seen.add(agent);
-      steps.push({ agent, text: instruction });
+      steps.push({ agent, text: instruction, ...(mode === null ? {} : { mode }) });
     }
   }
   return { steps, closing, ignored };

package/src/lease.mjs

@@ -63,19 +63,24 @@ export function diffSnapshots(before, after, { relativeDir }) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 
-export function leaseInstructions({ outDir, agentId, scopes = { write: true, imageGen: agentId === 'codex' }, capable = null, imageStudio = null, control = false }) {
+export function leaseInstructions({ outDir, agentId, scopes = { write: true, imageGen: agentId === 'codex' }, capable = null, imageStudio = null, control = false, create = false, scratchDir = null }) {
   const canImage = Boolean(scopes.imageGen);
   const couldImage = capable ? Boolean(capable.imageGen?.capable) : canImage;
+  const scratch = scratchDir ? `${outDir}/${scratchDir}` : null;
   return [
     control
       ? `CONTROL (#3): the human put you in command of this project at ${outDir}. You may read, create and modify its files without asking, one change at a time, minimal and reversible. MADRE took a checkpoint before this turn; everything you change is listed to the human afterwards and can be undone in one click.`
-      : `CREATION LEASE: the human allows you to create files for this request, only inside ${outDir}.`,
+      : create
+        ? `CREATE (#2): the human allows you to create new files and folders anywhere in this project, at ${outDir}, where they belong by the project's own conventions (a page next to the other pages, a component with the components, a document with the documents). Create folders when the structure calls for it.${scratch ? ` If something has no natural place, put it in the scratch folder ${scratch}.` : ''}`
+        : `CREATION LEASE: the human allows you to create files for this request, only inside ${outDir}.`,
     control
-      ? 'Never touch .git, .pulse, .env files or credentials: writes there are denied and reverted. Do not run destructive commands. Do not delegate this power: other agents you involve work read-only.'
-      : 'Write every file you produce there (images, code, documents); paths elsewhere are denied.',
-    control ? 'End with a short list of the files you changed and why.' : 'Reading the project stays allowed. Do not modify project files.',
-    imageStudio ? `You can generate images with the MCP tool ${imageStudio.tool} (server ${imageStudio.name}): pass a detailed prompt and a file_name; it saves the PNG into the lease directory and returns the path.`
-      : canImage ? 'You can generate images; save them into the lease directory with a descriptive file name.'
+      ? 'Never touch .git, .pulse, .madre, .env files or credentials: writes there are denied and reverted. Do not run destructive commands. Do not delegate this power: other agents you involve work read-only unless a step of yours names a mode.'
+      : create
+        ? 'Do not modify, overwrite, rename or delete files that already exist: MADRE restores them after your turn and tells the human. If a change to an existing file is truly needed, say so and stop; the human can grant #3 CONTROL. Never touch .git, .pulse, .madre, .env files or credentials.'
+        : 'Write every file you produce there (images, code, documents); paths elsewhere are denied.',
+    control ? 'End with a short list of the files you changed and why.' : create ? 'End with a short list of the files you created, with their paths, and why there.' : 'Reading the project stays allowed. Do not modify project files.',
+    imageStudio ? `You can generate images with the MCP tool ${imageStudio.tool} (server ${imageStudio.name}): pass a detailed prompt and a file_name; it saves the PNG${scratch ? ` into ${scratch}` : ' into the lease directory'} and returns the path.`
+      : canImage ? `You can generate images; save them${create ? ' where images live in this project, or in the scratch folder,' : ' into the lease directory'} with a descriptive file name.`
       : couldImage ? 'Image generation is switched off for this request; if asked for an image, say so and do not attempt it.'
         : 'You cannot generate images from this CLI; if asked for one, say so plainly instead of attempting it.',
     'List the files you created (or "none") before any plan block; nothing may follow a plan block.',

package/src/room/control.mjs

@@ -20,32 +20,44 @@ export class ControlDesk {
 
   // Takes the checkpoint and seats the agent. Returns the run, the lease that
   // makes the whole project writable, and what the room should announce.
-  async begin({ agent, messageId, enabledScopes }) {
-    const checkpoint = await createCheckpoint(this.#projectRoot, { id: `${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)}-${messageId.slice(0, 8)}`, label: `MADRE control @${agent.id}` });
+  // mode 3 (CONTROL) seats one holder for the whole project; mode 2 (CREATE) takes the same
+  // photograph without a seat: the project is writable for new files, and settle() puts back
+  // whatever existed before. Several #2 turns may run at once.
+  async begin({ agent, messageId, enabledScopes, mode = 3 }) {
+    const checkpoint = await createCheckpoint(this.#projectRoot, { id: `${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)}-${messageId.slice(0, 8)}`, label: `MADRE ${mode === 3 ? 'control' : 'create'} @${agent.id}` });
     checkpoint.agent = agent.id;
     this.#checkpoints.set(checkpoint.id, checkpoint);
     // Prevention first: .env files and MADRE's folders are read-only for the length of the turn.
     const guard = await guardForbidden(this.#projectRoot);
-    const run = { agent: agent.id, messageId, checkpoint, since: new Date().toISOString(), guard };
-    this.#holder = run;
-    const lease = { leaseId: checkpoint.id, outDir: this.#projectRoot, relativeDir: '.', scopes: { ...enabledScopes, write: true }, control: true, checkpoint };
+    const run = { agent: agent.id, messageId, checkpoint, since: new Date().toISOString(), guard, mode };
+    if (mode === 3) this.#holder = run;
+    const lease = { leaseId: checkpoint.id, outDir: this.#projectRoot, relativeDir: '.', scopes: { ...enabledScopes, write: true }, control: mode === 3, create: mode === 2, checkpoint };
+    if (mode !== 3) return { run, lease, announcement: null };
     const guarded = guard.locked.length ? ` ${guard.locked.length} forbidden path${guard.locked.length === 1 ? '' : 's'} locked read-only for the turn (${guard.locked.slice(0, 4).join(', ')}${guard.locked.length > 4 ? ', …' : ''}).` : '';
     const announcement = { checkpointId: checkpoint.id, commit: checkpoint.commit, head: checkpoint.head, agent: agent.id, messageId, guarded: guard.locked, message: `@${agent.id} holds CONTROL of the project. Checkpoint ${checkpoint.commit.slice(0, 7)} taken; UNDO will be one click.${guarded}` };
     return { run, lease, announcement };
   }
 
-  // What really changed, with forbidden zones already restored.
+  // What really changed, with forbidden zones already restored. In a #2 turn every change to
+  // a file that existed before (modified, deleted, renamed) is restored too: CREATE adds, only.
   async settle(run) {
     const diff = await diffCheckpoint(this.#projectRoot, run.checkpoint);
+    const additive = run.mode === 2;
+    const toRevert = new Set(diff.forbidden);
+    if (additive) for (const file of diff.files) if (file.status !== 'A') toRevert.add(file.path);
     let reverted = [];
-    if (diff.forbidden.length) {
-      const restored = await restoreCheckpoint(this.#projectRoot, run.checkpoint, { paths: diff.forbidden });
+    if (toRevert.size) {
+      const restored = await restoreCheckpoint(this.#projectRoot, run.checkpoint, { paths: [...toRevert] });
       reverted = [...restored.restored, ...restored.removed];
     }
-    const changes = { checkpointId: run.checkpoint.id, agent: run.agent, messageId: run.messageId, files: diff.files.filter((file) => !diff.forbidden.includes(file.path)), stat: diff.stat, forbiddenReverted: reverted };
+    const kept = diff.files.filter((file) => !toRevert.has(file.path));
+    const changes = { checkpointId: run.checkpoint.id, agent: run.agent, messageId: run.messageId, mode: run.mode ?? 3, files: kept, stat: diff.stat, forbiddenReverted: diff.forbidden.length ? reverted.filter((path) => diff.forbidden.includes(path)) : [], existingReverted: additive ? reverted.filter((path) => !diff.forbidden.includes(path)) : [] };
     const count = changes.files.length;
-    const note = reverted.length ? ` ${reverted.length} write(s) into forbidden zones were reverted.` : '';
-    changes.message = `${count ? `@${run.agent} changed ${count} file(s) in the project.` : `@${run.agent} changed nothing in the project.`}${note}`;
+    const notes = [
+      changes.forbiddenReverted.length ? `${changes.forbiddenReverted.length} write(s) into forbidden zones were reverted.` : null,
+      changes.existingReverted.length ? `${changes.existingReverted.length} change(s) to existing files were put back: CREATE only adds.` : null,
+    ].filter(Boolean).join(' ');
+    changes.message = `${count ? `@${run.agent} ${additive ? 'created' : 'changed'} ${count} file(s) in the project.` : `@${run.agent} ${additive ? 'created' : 'changed'} nothing in the project.`}${notes ? ` ${notes}` : ''}`;
     return changes;
   }
 

package/src/room/prompt.mjs

@@ -26,7 +26,7 @@ export function buildPrompt({
     'You are answering inside a MADRE project room shared by a human and several AI agents.',
     `You are @${agent.id}.`,
     `Permission mode for this turn: #${mode} ${MODES[mode]?.label ?? ''}.${mode === 0 ? ' This exchange is off the record: it is not written to the room transcript, no other agent will see it, and nothing you say here can be referred to later. Do not coordinate with other agents.' : mode === 2 ? ' You may create files, only inside the lease directory described below.' : ' Read-only: you may read the project and coordinate, not create or modify files.'}`,
-    lease ? 'Inspect the project as needed; the only writable place is the creation lease directory below.' : `Inspect the project only as needed. Operate read-only and do not modify files.${scopes?.web ? '' : ' Do not access the web.'}`,
+    lease ? (lease.control ? 'Inspect the project as needed; you hold it for this turn, as described below.' : lease.create ? 'Inspect the project as needed; you may add new files to it as described below, never change existing ones.' : 'Inspect the project as needed; the only writable place is the creation lease directory below.') : `Inspect the project only as needed. Operate read-only and do not modify files.${scopes?.web ? '' : ' Do not access the web.'}`,
     'Answer directly and concisely. Clearly distinguish facts from inference.',
     madreModel && agent.id !== 'madre'
       ? `@madre is in the room${madreModel.startsWith('madre-') ? ` running this project's own trained model (${madreModel})` : ` (local, ${madreModel})`}: it answers from the whole archive with citations and costs no tokens. For "what did we decide", "did we ever discuss" or "where did we leave" questions, ask it or delegate the recall step to it instead of searching yourself.`
@@ -50,7 +50,7 @@ export function buildPrompt({
       : null,
     mayDelegate ? DELEGATION_HELP(agent.id, others, maxPlanSteps) : null,
     mayDelegate ? `Abilities right now (route each step to an agent that can do it):\n${[agent.id, ...others].map((id) => abilityLine(id, scopesFor(id))).join('\n')}` : null,
-    lease ? leaseInstructions({ outDir: lease.outDir, agentId: agent.id, scopes: lease.scopes, capable: scopesFor(agent.id), imageStudio, control: Boolean(lease.control) }) : null,
+    lease ? leaseInstructions({ outDir: lease.outDir, agentId: agent.id, scopes: lease.scopes, capable: scopesFor(agent.id), imageStudio, control: Boolean(lease.control), create: Boolean(lease.create), scratchDir: lease.scratchDir ?? null }) : null,
     !lease?.control && controlHolder && controlHolder !== agent.id ? `Heads-up: @${controlHolder} currently holds CONTROL and may be changing project files while you work; cite the state you actually read.` : null,
     escalation ? `The human was asked to allow file creation for this step and ${escalation === 'timeout' ? 'did not answer in time' : escalation === 'stopped' ? 'stopped the plan' : 'declined'}. Answer read-only: say plainly what you would have created and what it would contain, without creating it.` : null,
     scopes?.web ? 'WEB ACCESS: the human enabled web search and fetch for you; use them when the question needs current or external information, and cite the sources you used.' : null,

package/src/room.mjs

@@ -21,6 +21,9 @@ import { parseDirectives } from './directives.mjs';
 import { isValidModelName } from './models.mjs';
 import { MODES, SCOPES, SCOPE_LABELS, capabilitySummary, normalizeMode, resolveScopes } from './capabilities.mjs';
 import { createLease, diffSnapshots, snapshot } from './lease.mjs';
+import { stat as statFile } from 'node:fs/promises';
+import { basename as baseName, join as joinPath } from 'node:path';
+import { contentTypeFor } from './files.mjs';
 import { imageStudioFor } from './image-studio.mjs';
 import { CAPABILITIES, imageModuleState } from './capabilities.mjs';
 import { resolveReferences } from './files.mjs';
@@ -193,8 +196,7 @@ export class Room {
     }
     const scopes = this.scopesFor(step.agent);
     const enabled = Object.fromEntries(SCOPES.map((scope) => [scope, scopes[scope].enabled && scopes[scope].wired]));
-    const lease = await createLease({ projectRoot: this.#projectRoot, leaseId: randomUUID() });
-    lease.messageId = parentMessageId;
+    const lease = await this.#projectLease({ leaseId: randomUUID(), messageId: parentMessageId });
     lease.scopes = decision.decision === 'plan' ? Object.fromEntries(SCOPES.map((scope) => [scope, true])) : enabled;
     await this.#emit('lease.granted', {
       escalated: decision.decision,
@@ -202,6 +204,7 @@ export class Room {
       messageId: parentMessageId,
       agent: step.agent,
       outDir: lease.relativeDir,
+      scratchDir: lease.scratchDir,
       scopes: SCOPES.filter((scope) => enabled[scope]),
       unavailable: SCOPES.filter((scope) => !scopes[scope].capable).map((scope) => SCOPE_LABELS[scope]),
       planId,
@@ -574,10 +577,9 @@ export class Room {
           message: `@${parsed.target} will answer read-only: ${scopes.write.capable ? 'file creation is switched off for it (enable it in CONNECTIONS)' : 'its CLI cannot create files'}${unavailable.length ? `; it cannot ${unavailable.join(' or ')}` : ''}.${alternatives.length ? ` For creation ask ${alternatives.join(' or ')}.` : ''}`,
         });
       } else {
-        lease = await createLease({ projectRoot: this.#projectRoot, leaseId: randomUUID() });
-        lease.messageId = messageId;
+        lease = await this.#projectLease({ leaseId: randomUUID(), messageId });
         // CREATE authorizes the plan to use each delegate's enabled creation
-        // scopes; a standing write lease authorizes files only.
+        // scopes; a default-#2 lease authorizes files only.
         lease.scopeCeiling = { write: true, imageGen: !standing, web: true };
         lease.scopes = Object.fromEntries(SCOPES.map((scope) => [scope, enabled.includes(scope) && (!standing || scope === 'write')]));
         await this.#emit('lease.granted', {
@@ -586,6 +588,7 @@ export class Room {
           messageId,
           agent: parsed.target,
           outDir: lease.relativeDir,
+          scratchDir: lease.scratchDir,
           grantedBy: 'you',
           scopes: standing ? ['write'] : enabled,
           unavailable,
@@ -609,6 +612,25 @@ export class Room {
     await this.#track(this.#dispatch({ messageId, targetId: parsed.target, text: text2, requester: 'you', depth: 0, allowDelegation: allowDelegation && !ghost, model: chosenModel, attachments: files, references, lease, ashCode: ashActive, mode: ghost ? 0 : control ? 3 : (lease ? 2 : 1) }));
   }
 
+  // A #2 lease: the project itself is where new files go, and MADRE keeps a scratch folder
+  // under .pulse/out/ for what has no natural place. Each turn under it takes a checkpoint
+  // and puts back whatever existed before, so CREATE only ever adds.
+  async #projectLease({ leaseId, messageId }) {
+    const scratch = await createLease({ projectRoot: this.#projectRoot, leaseId });
+    return { leaseId, messageId, outDir: this.#projectRoot, relativeDir: '.', scratchDir: scratch.relativeDir, create: true };
+  }
+
+  // Artifacts from a #2 turn: the files the checkpoint saw appear, as the room shows them.
+  async #artifactsFrom(files) {
+    const out = [];
+    for (const file of files) {
+      if (file.status !== 'A') continue;
+      const info = await statFile(joinPath(this.#projectRoot, file.path)).catch(() => null);
+      out.push({ name: baseName(file.path), path: file.path, size: info?.size ?? 0, contentType: contentTypeFor(file.path), status: 'created' });
+    }
+    return out.sort((a, b) => a.path.localeCompare(b.path));
+  }
+
   // Agents that can receive a delegated step from `self`.
   delegatesFor(self) {
     return this.#agents.filter((agent) => agent.ready && agent.id !== self).map((agent) => agent.id);
@@ -714,7 +736,7 @@ export class Room {
     // The orchestrator's turn is over before its plan starts, so it is never
     // counted as in flight while the others work.
     if (outcome?.directives?.steps.length) {
-      await this.#runPlan({ orchestrator: agent.id, parentMessageId: outcome.responseMessageId, directives: outcome.directives, lease, ashCode });
+      await this.#runPlan({ orchestrator: agent.id, parentMessageId: outcome.responseMessageId, directives: outcome.directives, lease, ashCode, mode });
     }
     return outcome?.responseMessageId ?? null;
   }
@@ -745,13 +767,19 @@ export class Room {
     const turnScopes = { web: enabled.web, imageGen: enabled.imageGen };
     let lease = null;
     let controlRun = null;
-    if (mode === 3 && requester === 'you' && depth === 0) {
+    let createRun = null;
+    if (mode === 3 && (requester === 'you' || planId) && depth <= 1 && agentScopes.maxMode >= 3 && enabled.write) {
       // CONTROL: the project itself is the writable root, and a checkpoint
-      // taken now makes every change of this turn reversible.
-      const seat = await this.#controlDesk.begin({ agent, messageId, enabledScopes: enabled });
-      controlRun = seat.run;
-      lease = seat.lease;
-      await this.#emit('control.started', seat.announcement);
+      // taken now makes every change of this turn reversible. A plan step gets
+      // it when the orchestrator, itself in #3, named #3 for that step.
+      if (this.#controlDesk.holder) {
+        await this.#alert('control-busy', `@${this.#controlDesk.holder.agent} still holds CONTROL; @${agent.id} answers read-only this turn.`, `control-busy:${agent.id}`);
+      } else {
+        const seat = await this.#controlDesk.begin({ agent, messageId, enabledScopes: enabled });
+        controlRun = seat.run;
+        lease = seat.lease;
+        await this.#emit('control.started', seat.announcement);
+      }
     } else if (sharedLease) {
       lease = enabled.write ? {
         ...sharedLease,
@@ -760,8 +788,7 @@ export class Room {
     } else if (agentScopes.write.always && enabled.write && requester !== 'you' && requester !== 'mother') {
       // Standing lease for a delegate: the human opted this agent into
       // creating files on every turn, so a plan step gets its own directory.
-      lease = await createLease({ projectRoot: this.#projectRoot, leaseId: randomUUID() });
-      lease.messageId = messageId;
+      lease = await this.#projectLease({ leaseId: randomUUID(), messageId });
       lease.scopeCeiling = { write: true, imageGen: false, web: true };
       lease.scopes = { ...enabled, imageGen: false };
       await this.#emit('lease.granted', {
@@ -770,11 +797,18 @@ export class Room {
         messageId,
         agent: agent.id,
         outDir: lease.relativeDir,
+        scratchDir: lease.scratchDir,
         scopes: ['write'],
         unavailable: SCOPES.filter((scope) => !agentScopes[scope].capable).map((scope) => SCOPE_LABELS[scope]),
         planId,
       });
     }
+    if (lease?.create && !controlRun) {
+      // CREATE: photograph the project now; after the turn only what appeared stays.
+      const seat = await this.#controlDesk.begin({ agent, messageId, enabledScopes: enabled, mode: 2 });
+      createRun = seat.run;
+      lease = { ...lease, checkpoint: seat.run.checkpoint };
+    }
     turnScopes.imageGen = Boolean(lease?.scopes?.imageGen);
     // The step asks for files but nobody granted a lease: say so now, with a
     // way out, instead of letting the agent's refusal be the only signal.
@@ -793,14 +827,14 @@ export class Room {
     const native = Boolean(CAPABILITIES[agent.id]?.imageGen);
     const studio = imageModuleState();
     const imageStudio = lease?.scopes?.imageGen && enabled.imageGen && !native && studio.enabled
-      ? imageStudioFor({ enabled: true, model: studio.model, outDir: lease.outDir })
+      ? imageStudioFor({ enabled: true, model: studio.model, outDir: lease.scratchDir ? joinPath(this.#projectRoot, lease.scratchDir) : lease.outDir })
       : null;
     // The turn's effective mode: #0 for ghosts, #3 in control, #2 only while it holds a lease.
     const turnMode = mode === 0 ? 0 : controlRun ? 3 : lease ? 2 : 1;
     try {
       const invoke = this.#invokers[agent.adapter];
       if (!invoke) throw new Error(`${agent.label} does not have a supported MADRE adapter.`);
-      const before = lease && !lease.control ? await snapshot(lease.outDir) : null;
+      const before = lease && !lease.control && !lease.create ? await snapshot(lease.outDir) : null;
       const responseMessageId = randomUUID();
       const notesBefore = this.#memory ? this.#memory.maxMemoryId() : 0;
       const others = this.delegatesFor(agent.id);
@@ -828,7 +862,9 @@ export class Room {
       // the archivist or any other agent can see it. The reply says how many, not which.
       const guarded = this.#privacy?.redact(result.text ?? '') ?? { text: result.text, hits: 0 };
       if (guarded.hits) result.text = guarded.text;
-      const artifacts = lease && !lease.control ? diffSnapshots(before, await snapshot(lease.outDir), { relativeDir: lease.relativeDir }) : [];
+      // CREATE: what appeared stays and is shown; what existed before is put back and said.
+      const createChanges = createRun ? await this.#controlDesk.settle(createRun) : null;
+      const artifacts = createChanges ? await this.#artifactsFrom(createChanges.files) : lease && !lease.control ? diffSnapshots(before, await snapshot(lease.outDir), { relativeDir: lease.relativeDir }) : [];
       // CONTROL: what really changed in the project, forbidden zones reverted on the spot.
       const controlChanges = controlRun ? await this.#controlDesk.settle(controlRun) : null;
       const directives = mayDelegate
@@ -866,6 +902,9 @@ export class Room {
       if (artifacts.length) {
         await this.#emit('artifacts.created', { leaseId: lease.leaseId, messageId, responseMessageId, agent: agent.id, outDir: lease.relativeDir, files: artifacts });
       }
+      if (createChanges && (createChanges.existingReverted.length || createChanges.forbiddenReverted.length)) {
+        await this.#emit('create.reverted', { checkpointId: createChanges.checkpointId, agent: agent.id, messageId, responseMessageId, existing: createChanges.existingReverted, forbidden: createChanges.forbiddenReverted, message: createChanges.message });
+      }
       // What the agent saved through memory_note during this turn, for the bubble's hint.
       if (this.#memory && turnMode !== 0) {
         const noted = this.#memory.notesSince(notesBefore, { agent: agent.id });
@@ -884,24 +923,32 @@ export class Room {
     } finally {
       // Release CONTROL whichever way the turn ended; the checkpoint stays for UNDO.
       await this.#controlDesk.release(controlRun);
+      await this.#controlDesk.release(createRun);
     }
   }
 
-  async #runPlan({ orchestrator, parentMessageId, directives, lease = null, ashCode = false }) {
+  async #runPlan({ orchestrator, parentMessageId, directives, lease = null, ashCode = false, mode = 1 }) {
     const planId = randomUUID();
-    // The plan runs at the human's mode: #2 only while a lease exists, and a
-    // step's agent gets #2 only if its own scopes allow writing.
-    const stepMode = (agentId) => (lease && this.scopesFor(agentId).write.enabled ? 2 : 1);
+    // The plan's ceiling is the human's mode: #3 when the orchestrator held CONTROL, #2 while a
+    // lease exists, #1 otherwise. A step may ask for a mode ("@codex #2: …"); it gets the lowest
+    // of what it asked, the ceiling and its own MAX MODE. Without a number it inherits the plan.
+    const ceiling = mode >= 3 ? 3 : lease ? 2 : 1;
+    const stepMode = (step) => {
+      const scopes = this.scopesFor(step.agent);
+      const asked = normalizeMode(step.mode, lease ? 2 : 1);
+      const granted = Math.min(asked, ceiling, scopes.maxMode);
+      return granted >= 2 && !scopes.write.enabled ? 1 : granted;
+    };
     const plan = { planId, orchestrator, steps: directives.steps, closing: directives.closing, step: 0, stopped: null, startedAt: Date.now() };
     this.#plans.set(planId, plan);
     await this.#emit('plan.created', {
       planId,
       orchestrator,
       parentMessageId,
-      steps: directives.steps.map((step) => ({ ...step, mode: stepMode(step.agent) })),
+      steps: directives.steps.map((step) => ({ ...step, mode: stepMode(step) })),
       closing: directives.closing,
       ignored: directives.ignored,
-      mode: lease ? 2 : 1,
+      mode: ceiling,
       leaseId: lease?.leaseId ?? null,
     });
     try {
@@ -917,7 +964,16 @@ export class Room {
         let stepLease = lease;
         let escalation = null;
         const stepScopes = this.scopesFor(step.agent);
-        if (!lease && !stepScopes.write.always && looksLikeCreation(step.text) && stepScopes.maxMode >= 2 && stepScopes.write.enabled) {
+        const wanted = stepMode(step);
+        // Under a #3 ceiling the orchestrator's word is enough: a #2 step gets its project lease,
+        // a #3 step gets CONTROL for its turn. Under #1 a creation step still asks the human.
+        if (ceiling === 3 && !stepLease && wanted === 2) {
+          stepLease = await this.#projectLease({ leaseId: randomUUID(), messageId });
+          stepLease.scopeCeiling = { write: true, imageGen: true, web: true };
+          stepLease.scopes = Object.fromEntries(SCOPES.map((scope) => [scope, stepScopes[scope].enabled && stepScopes[scope].wired]));
+          await this.#emit('lease.granted', { delegated: true, leaseId: stepLease.leaseId, messageId, agent: step.agent, outDir: '.', scratchDir: stepLease.scratchDir, grantedBy: orchestrator, scopes: SCOPES.filter((scope) => stepLease.scopes[scope]), unavailable: [], planId });
+        }
+        if (ceiling < 3 && !lease && !stepScopes.write.always && (wanted >= 2 || looksLikeCreation(step.text)) && stepScopes.maxMode >= 2 && stepScopes.write.enabled) {
           const outcome = await this.#askForMode({ planId, plan, step, index, totalSteps: directives.steps.length + (directives.closing ? 1 : 0), orchestrator, parentMessageId, mode: 2 });
           if (outcome.scope === 'plan') lease = outcome.lease;
           if (outcome.scope) stepLease = outcome.lease; else escalation = outcome.reason;
@@ -933,12 +989,12 @@ export class Room {
           ashCode: ashCode ? { active: true, applied: abbreviated.applied, reason: abbreviated.reason, language: abbreviated.language, originalChars: abbreviated.originalChars, encodedChars: abbreviated.encodedChars } : undefined,
           status: 'delegated',
           planId,
-          mode: stepLease && stepScopes.write.enabled ? 2 : 1,
+          mode: wanted === 3 ? 3 : stepLease && stepScopes.write.enabled ? 2 : 1,
           escalation: escalation ?? undefined,
           step: index + 1,
           totalSteps: directives.steps.length + (directives.closing ? 1 : 0),
         });
-        await this.#dispatch({ messageId, targetId: step.agent, text: stepText, requester: orchestrator, depth: 1, planId, allowDelegation: false, lease: stepLease, ashCode, mode: stepLease && stepScopes.write.enabled ? 2 : 1, escalation });
+        await this.#dispatch({ messageId, targetId: step.agent, text: stepText, requester: orchestrator, depth: 1, planId, allowDelegation: false, lease: wanted === 3 ? null : stepLease, ashCode, mode: wanted === 3 ? 3 : stepLease && stepScopes.write.enabled ? 2 : 1, escalation });
       }
       if (!plan.stopped && directives.closing) {
         plan.step = directives.steps.length + 1;

package/src/server.mjs

@@ -323,7 +323,9 @@ export async function createPulseServer({
         if (!agents.some((agent) => agent.id === agentId) || !scopes || typeof scopes !== 'object') continue;
         config.scopes[agentId] = { ...(current[agentId] ?? {}) };
         for (const scope of ['write', 'imageGen', 'web', 'alwaysCreate']) if (typeof scopes[scope] === 'boolean') config.scopes[agentId][scope] = scopes[scope];
-        if (Number.isInteger(Number(scopes.maxMode)) && Number(scopes.maxMode) >= 0 && Number(scopes.maxMode) <= 3) config.scopes[agentId].maxMode = Number(scopes.maxMode);
+        // MAX MODE and DEFAULT MODE are the two controls; setting them retires the older flags they replace.
+        if (Number.isInteger(Number(scopes.maxMode)) && Number(scopes.maxMode) >= 0 && Number(scopes.maxMode) <= 3) { config.scopes[agentId].maxMode = Number(scopes.maxMode); delete config.scopes[agentId].write; }
+        if (Number.isInteger(Number(scopes.defaultMode)) && Number(scopes.defaultMode) >= 1 && Number(scopes.defaultMode) <= 2) { config.scopes[agentId].defaultMode = Number(scopes.defaultMode); delete config.scopes[agentId].alwaysCreate; }
       }
       room.setScopes(config.scopes);
     }