@worca/app 1.2.0-rc.3 → 1.3.0-rc.2

package/ui/server.mjs

@@ -21,19 +21,20 @@ import { preflightNode } from '../src/core/preflight-node.mjs';
 import { createOrchestratorFor } from '../src/core/engine-select.mjs';
 import {
   listPipelines, readPipeline, listAllPipelines, readPipelineByKey,
-  enrichPipelinesPr, reconcileStaleRunning, readPipelineForResume, persistPrState,
+  enrichPipelinesPr, reconcileStaleRunning, readPipelineForResume, persistPrState, readPrState,
   readRunLogText, readRunArtifactText, countPipelines, runRootSweepLookups, legacySweepLookups, slugify,
-  listArtifacts, lookupPipelineRow, findPipelineRowById, resolveIndexedArtifact, resolveIndexedArtifactForRow,
+  listArtifacts, listRunArtifacts, lookupPipelineRow, findPipelineRowById, readPipelineStateById, resolveIndexedArtifact, resolveIndexedArtifactForRow,
   readPromptFile,
 } from '../src/core/artifacts.mjs';
 import { DIFF_PATCH_FILE } from '../src/core/results.mjs';
 import { protectedSectionKeys } from '../src/core/diff-anchor.mjs';
 import {
-  addDiffComment, listDiffComments, getDiffComment, setDiffCommentResolved,
+  addDiffComment, addDiffCommentReply, listDiffComments, getDiffComment, setDiffCommentResolved,
   deleteDiffComment, unresolvedCounts, onDiffCommentsChanged, stampSentRunId,
   peekPendingCardComments, clearPendingCardComments, DiffCommentError, DC_ID_RE,
 } from '../src/core/diff-comments.mjs';
 import { listProjects, addProject, removeProject, normalizeProjectPath, countProjects, worcaHome } from '../src/core/projects.mjs';
+import { renderIndexHtml, INDEX_THEME_ANCHOR } from '../src/core/index-html.mjs';
 import {
   getWorcaRoot, setWorcaRoot, setProjectsRoot, defaultRoot,
   rawProjectsRoot, defaultProjectsRoot, runRootMode,
@@ -44,6 +45,8 @@ import {
   debugSpawnEnabled as storedDebugSpawnEnabled, effectiveDebugSpawn, setDebugSpawnEnabled, assertDebugSpawnInput, SETTINGS_POST_KEYS,
   titleModel as storedTitleModel, setTitleModel, assertTitleModelInput,
   hideBuiltinModels, setHideBuiltinModels, assertHideBuiltinModelsInput,
+  theme as storedTheme, setTheme, assertThemeInput,
+  autoWorkflowModel as storedAutoWorkflowModel, setAutoWorkflowModel, assertAutoWorkflowModelInput,
 } from '../src/core/settings.mjs';
 import { describeTitleModel } from '../src/core/title.mjs';
 import {
@@ -84,13 +87,20 @@ import { attachRunFollower } from '../src/core/ask/follow.mjs';
 import { mockEnabled, MOCK_WRITER_ROLES } from '../src/core/claude-runner.mjs';
 import { budgetStatus, readCostCapOverride, setCostCapOverride } from '../src/core/cost-budget.mjs';
 import { getStats } from '../src/core/stats.mjs';
+import {
+  enableTeamMetrics, setRecordMyRuns, flushSlug, flushAll, flushProject, scheduleFlush, discoverProject,
+  discoverAll, scanMembers, routeWorkspaceMembers, projectMetricsStatus, startTeamMetricsBackground,
+  metricsEvents, slugDirName, autoMetricsHome,
+} from '../src/core/metrics/sync.mjs';
+import { readScope, listScopes, parseScopeParam, aggregate, resolveRange, GROUP_BYS, PROJECT_KEY_RE as TM_PROJECT_KEY_RE } from '../src/core/metrics/read.mjs';
 import { pickFolderNative } from '../src/core/folder-dialog.mjs';
 import { listFolders } from '../src/core/fs-browse.mjs';
 import {
   readConfig, setStep, addCustomModel, removeCustomModel, listModels,
   PREDEFINED_MODELS, agentSteps, EFFORTS, catalogHasModel,
-  readRunConfig, setNodeModel, setFeedbackCycles, setWireCycles, setActiveWorkflow, resetWorkflowConfig,
+  readRunConfig, setNodeModel, setFeedbackCycles, setWireCycles, setActiveWorkflow, setHumanInLoop, resetWorkflowConfig,
   globalModelRefs, removeGlobalModelAndRefs, promoteCustomModel, costUnreliableModelIds,
+  readPrRemotePrefs, setPrRemotePrefs,
 } from '../src/core/config.mjs';
 import { listGlobalModels, addGlobalModel, updateGlobalModel } from '../src/core/settings.mjs';
 import { modelEnvRef, maskModelEnvValue, SUBAGENT_MODEL_VALUES, subagentModelIssue } from '../src/core/model-env.mjs';
@@ -105,9 +115,15 @@ import {
   writeGuardrailSet, deleteGuardrailSet, isBuiltinGuardrailSetId,
 } from '../src/core/guardrail-store.mjs';
 import {
-  GRAPH_DEFAULT_WORKFLOW, listWorkflows, deleteWorkflow, isSafeWorkflowId,
-  setWorkflowNodeDefaults, workflowNodeDefaults, assertRunnableWorkflow, writeGraphWorkflow,
+  GRAPH_DEFAULT_WORKFLOW, AUTO_WORKFLOW_ID, GRAPH_MEMORY_DEFRAG_WORKFLOW, MEMORY_DEFRAG_WORKFLOW_ID, listWorkflows, deleteWorkflow, isSafeWorkflowId,
+  setWorkflowNodeDefaults, workflowNodeDefaults, assertRunnableWorkflow, writeGraphWorkflow, readWorkflow,
 } from '../src/core/workflows.mjs';
+import { mintAutoWorkflowId, sanitizeProposalAnswer } from '../src/core/auto/proposal.mjs';
+import {
+  revalidateWorkflowProposal, applyTunables, workflowEventPrompt, workflowNoticeText,
+} from '../src/core/ask/workflow-deps.mjs';
+import { applyMetricsChange } from '../src/core/ask/metrics-deps.mjs';
+import { metricsEventPrompt, metricsNoticeText } from '../src/core/ask/metrics-proposal.mjs';
 import { registryPortsFn } from '../src/core/graph/registry-ports.mjs';
 import { sweepV1Runs, V1_RUN_RETIRED } from '../src/core/db.mjs';
 import { exportWorkflow, exportWorkflowPlugin, ON_CONFLICT_MODES, RESOLUTION_CHOICES } from '../src/core/workflow-export.mjs';
@@ -118,7 +134,7 @@ import { loadAgentRegistry } from '../src/core/agent-registry.mjs';
 import {
   listLocalBranches, currentBranch, isValidSourceRef, sweepRunRoots, sweepLegacyWorktreesAll,
 } from '../src/core/worktree.mjs';
-import { hasGh, pushBranch, createPr, prMergeable } from '../src/core/git-info.mjs';
+import { hasGh, pushBranch, createPr, createIssue, prMergeable, listRemotes, sameRepo } from '../src/core/git-info.mjs';
 import { archivePipeline, discardRetainedWorktrees } from '../src/core/pipeline-delete.mjs';
 import {
   listWorkspaces, readWorkspace, createWorkspace,
@@ -126,7 +142,15 @@ import {
 } from '../src/core/workspaces.mjs';
 import { listWorkspacePipelines, readWorkspacePipeline } from '../src/core/artifacts.mjs';
 import { generateOverview } from '../src/core/overview-agent.mjs';
-import { projectKey } from '../src/core/store.mjs';
+import { projectKey, PROJECT_KEY_RE } from '../src/core/store.mjs';
+import { validateMemoryScope, withStoreLock } from '../src/core/memory-sync.mjs';
+import {
+  memoryRoot, GLOBAL_SCOPE, projectScope, scopeKey, isValidMemoryName, MEMORY_NAME_HELP, memoryScopeReport,
+  readMemory, writeMemory, removeMemory, listSnapshots, restoreSnapshot,
+} from '../src/core/memory-store.mjs';
+import { memoryCaps } from '../src/core/settings.mjs';
+import { onboardingPrefs, setOnboardingPrefs } from '../src/core/settings.mjs';
+import { onboardingStatus } from '../src/core/onboarding.mjs';   // a THIRD settings import line (the two blocks above are unrelated readers)
 import { createWorkspaceScan } from '../src/core/workspace-scan.mjs';
 import { createAgentGen } from '../src/core/agent-gen.mjs';
 import { listAgents, readAgent, createAgent, updateAgent, deleteAgent, AGENT_KEY_RE } from '../src/core/agent-store.mjs';
@@ -158,6 +182,12 @@ import { readPluginsLock, pluginCurrentDir } from '../src/core/plugins-lock.mjs'
 import { normalizeManifest, validatePluginDir, PLUGIN_NAME_RE as MANIFEST_PLUGIN_NAME_RE } from '../src/core/plugin-manifest.mjs';
 import { listTaskSources, retryWriteback } from '../src/core/sources.mjs';
 import { callSource, PluginOpError } from '../src/core/plugin-shim.mjs';
+import { resolveAutoModel, AUTO_MODEL_ENV } from '../src/core/auto/model.mjs';
+import {
+  buildRunReport, buildIssueUrl, reportFilename, renderIssueBodyFull, issueTitle,
+  repoSlugFromBugsUrl, BUGS_URL,
+} from '../src/core/run-report.mjs';
+import { REPORT_REASON_IDS } from '../src/shared/report-reasons.mjs';
 import { HLJS_GRAMMAR_IDS } from './public/hljs-loader.mjs';
 
 // ── node:sqlite runtime guard + warning filter ──────────────────────────────────
@@ -183,7 +213,27 @@ const PUBLIC_DIR = path.join(__dirname, 'public');
 const AGENTS_DIR = path.join(PROJECT_ROOT, 'agents');
 const SKILLS_DIR = path.join(PROJECT_ROOT, 'skills');
 const require = createRequire(import.meta.url);
-const PKG_VERSION = require('../package.json').version;
+const PKG = require('../package.json');
+const PKG_VERSION = PKG.version;
+// Settings ▸ About identity, fixed at module load. repository.url is normalised
+// from npm's git forms (git+https, ssh://git@, git://, scp-style git@host:path)
+// to a browsable https URL; releaseUrl points at the tag the release workflow
+// publishes from (.github/workflows/release-npm-app.yml: worca-app-v<version>).
+const repoWebUrl = (raw) => String(raw || '')
+  .replace(/^git\+/, '')
+  .replace(/^ssh:\/\/git@/, 'https://')
+  .replace(/^git:\/\//, 'https://')
+  .replace(/^git@([^:/]+):/, 'https://$1/')
+  .replace(/\.git$/, '');
+const APP_REPO_URL = repoWebUrl(PKG.repository && PKG.repository.url);
+const APP_INFO = Object.freeze({
+  version: PKG_VERSION || '',
+  repoUrl: APP_REPO_URL,
+  releaseUrl: APP_REPO_URL && PKG_VERSION ? `${APP_REPO_URL}/releases/tag/worca-app-v${PKG_VERSION}` : '',
+  // package.json bugs.url, via run-report.mjs so the Settings links and the
+  // prefilled issue URL can never disagree. Falls back to <repo>/issues.
+  bugsUrl: BUGS_URL || (APP_REPO_URL ? `${APP_REPO_URL}/issues` : ''),
+});
 const HLJS_LANGUAGE_FILE_RE = /^[a-z0-9][a-z0-9-]{0,63}\.min\.js$/;
 // Primaries plus the sub-language grammars their instances register
 // (hljs-loader.mjs); a shipped but unmapped grammar stays a plain 404.
@@ -439,6 +489,8 @@ function emitChanged(type, action) {
   broadcast({ type, action: action || null });
 }
 
+metricsEvents.on('changed', (e) => emitChanged('team-metrics-changed', e && e.action ? e.action : null));
+
 // Every comment mutation in THIS process (the REST routes below) pokes the open
 // Diff tabs. A poke carries ids only — no payload, so it is idempotent and has no
 // ordering concerns; the client refetches and repaints its CARDS, never the diff.
@@ -491,6 +543,44 @@ function resolvePending(entry, { id = null, reason = 'resolved' } = {}) {
   return true;
 }
 
+/** Statuses under which an entry no longer drives its pipeline (the resumeRun double-resume guard's list, :1713). */
+const SETTLED_RUN = new Set(['done', 'stopped', 'error', 'paused', 'interrupted']);
+/** A runs-Map PIPELINE entry by its UUID or by its 8-hex History id (scans / agentgens never match). */
+function liveRunEntry(id) {
+  if (typeof id !== 'string' || !id) return null;
+  const isRun = (r) => r && r.orch && (r.kind === 'run' || r.kind === 'workspace-run' || r.kind == null);
+  const direct = runs.get(id);
+  if (isRun(direct)) return direct;
+  // D23: resumeRun evicts only the paused/interrupted lineage; a same-pipeline entry left done/stopped/error sits
+  // EARLIER in Map order — the entry still driving the pipeline wins, else the newest (last inserted).
+  let best = null;
+  for (const r of runs.values()) {
+    if (!isRun(r) || r.pipelineId !== id) continue;
+    if (!best || !SETTLED_RUN.has(String(r.status || '')) || SETTLED_RUN.has(String(best.status || ''))) best = r;
+  }
+  return best;
+}
+
+/** 'global' | 'projects/<key>' — the store scope key a defragment run works on (memory-store.mjs scopeKey). */
+function memoryScopeKey(memoryScope, projectDir) {
+  return memoryScope === 'global' ? 'global' : `projects/${projectKey(projectDir)}`;
+}
+/** The live (i.e. not SETTLED_RUN) defragment run on that scope key, or null. A paused defrag is
+ *  NOT live — resumeRun refuses to resume it while another one runs.
+ *  Amendment B20: "one live defragment run per scope" is enforced by THIS server process over ITS
+ *  runs Map. A CLI-started defragment, or a second `worca ui` process on the same home, is not
+ *  registered here; such a collision resolves like any two runs today — last sync wins and the
+ *  loser's store copy is in `.history` (spec §5 concurrency). A DB-level check is impossible: the
+ *  pipelines row carries no memoryScope. */
+function liveDefragRun(scopeKeyStr) {
+  for (const e of runs.values()) {
+    if ((e.kind || 'run') !== 'run' || !e.orch?.memoryScope) continue;
+    if (SETTLED_RUN.has(String(e.status || ''))) continue;
+    if (memoryScopeKey(e.orch.memoryScope, e.projectDir) === scopeKeyStr) return e;
+  }
+  return null;
+}
+
 function summarizeRuns() {
   return [...runs.values()].map((r) => ({
     runId: r.id,
@@ -591,6 +681,14 @@ function wireRun(entry) {
         // ...and WHAT went wrong for an error-pause, reset alongside it.
         entry.pauseDetail = (payload && payload.detail) || null;
         resolvePending(entry, { reason: entry.status });
+        // B29: ANY run that mounted memory may have synced into its scopes (P1 syncs the mount back
+        // at the run end on done, error, stopped and paused alike) — poke every mounted scope so open
+        // Memory views refetch. Never gated on `entry.status`: it is mirrored from the earlier `state`
+        // frame and already reads 'done' BEFORE _buildResults()/_stampDefrag() have run, while THIS
+        // event fires after both (so a defragment frame always follows its stamp).
+        if (orch.memory?.dirs?.length) {
+          for (const d of orch.memory.dirs) emitMemoryChanged(scopeKey(d.scope));
+        }
         if (payload?.reason === 'cost_pipeline' || payload?.reason === 'cost_total') {
           emitChanged('budget-changed');
         }
@@ -848,6 +946,32 @@ app.use('/src/shared', (_req, res) => {
   res.status(404).type('text/plain').send('Not found');
 });
 
+// The shell is rendered, not static: the stored theme mode goes into
+// <html data-theme> so the first paint is already dark or light (dark-mode
+// design §5.2). Read per request (100 KB, local) so an index.html edit is live
+// without a restart, exactly like static serving was. no-store: a theme change
+// must never be served from the browser cache.
+const INDEX_FILE = path.join(PUBLIC_DIR, 'index.html');
+if (!fs.readFileSync(INDEX_FILE, 'utf8').includes(INDEX_THEME_ANCHOR)) {
+  throw new Error(`ui/public/index.html lost its theme anchor ${INDEX_THEME_ANCHOR}`);
+}
+function sendIndex(res) {
+  let html;
+  try { html = renderIndexHtml(fs.readFileSync(INDEX_FILE, 'utf8'), storedTheme()); }
+  catch (err) { return res.status(500).json({ error: err && err.message ? err.message : 'shell unavailable' }); }
+  res.set('Content-Type', 'text/html; charset=utf-8');
+  res.set('Cache-Control', 'no-store');
+  res.set('X-Content-Type-Options', 'nosniff');
+  return res.send(html);
+}
+// `/index` (express.static's `extensions:['html']`) and `/Index.html` on a case-insensitive
+// file system would otherwise reach the raw file: route every spelling here.
+app.use((req, res, next) => {
+  if (req.method !== 'GET') return next();
+  if (req.path === '/' || /^\/index(\.html)?$/i.test(req.path)) return sendIndex(res);
+  return next();
+});
+
 app.use(express.static(PUBLIC_DIR, { extensions: ['html'] }));
 
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
@@ -1034,7 +1158,7 @@ function attachAskFollower(orch, { threadId, runId, cardId }) {
         if (linkPatch.pipelineId && row && row.commentIds.length) {
           try { stampSentRunId(row.commentIds, linkPatch.pipelineId); } catch { /* best effort */ }
         }
-        if (patch.cardFailed) {
+        if (patch.cardFailed && cardId) {
           flipCard(threadId, cardId, { state: 'failed', error: patch.cardFailed });
         }
         broadcast({
@@ -1062,13 +1186,82 @@ function attachAskFollower(orch, { threadId, runId, cardId }) {
   set.add(follower);
 }
 
+/** An undetached follower for this (thread, runId) already exists — the proposal launch attached it, or an earlier track_run. */
+function askFollowerAttached(threadId, runId) {
+  const set = askFollowers.get(threadId);
+  return !!set && [...set].some((f) => f.runId === runId && !f.detached);
+}
+
+/**
+ * track_run's parent-side half (the MCP child only resolves — src/core/ask/tools.mjs is write-free by contract):
+ * resolve the run (live entry by UUID or 8-hex, else the pipelines table — the user-pinned scope first, like
+ * resolveRow), link it to the thread ONCE per pipeline (D5: a run with no live UUID keys the row by its pipeline
+ * id until a live run takes it over; the dedupe is application-level — the PK is (thread, run_id) and linkRun
+ * throws on a collision), attach a follower to a live run ONCE per runId (D6), and hand back the progress card's
+ * identity. Never throws; a failure is a model-readable {ok:false, error}.
+ */
+function askTrackRun(threadId, input, pin) {
+  const raw = input && typeof input.id === 'string' ? input.id.trim() : '';
+  if (!raw) return { ok: false, error: 'id is required' };
+  let entry = liveRunEntry(raw);
+  let state = null;
+  if (entry) {
+    if (!entry.pipelineId) return { ok: false, error: 'the run has no pipeline id yet — try again in a moment' };
+    state = readPipelineStateById(entry.pipelineId);
+  } else {
+    const scopeKey = typeof input.projectKey === 'string' && input.projectKey ? input.projectKey
+      : typeof input.workspaceId === 'string' && input.workspaceId ? `workspaces/${input.workspaceId}`
+        : pin && pin.projectKey ? pin.projectKey : pin && pin.workspaceId ? `workspaces/${pin.workspaceId}` : null;
+    const row = (scopeKey ? lookupPipelineRow(scopeKey, raw) : null) || findPipelineRowById(raw);
+    if (!row) return { ok: false, error: 'run not found' };
+    // The row lookups canonicalise (lower case, the `…-<8hex>` dir-name form); the runs-Map scan compares verbatim.
+    // Re-ask with the canonical id so an uppercase or dir-name id still finds the live lineage.
+    entry = liveRunEntry(row.id) || null;
+    state = readPipelineStateById(row.id);
+  }
+  if (!state) return { ok: false, error: 'run not found' };
+  const pipelineId = state.id;
+  const isWs = !!((entry && entry.workspaceId) || state.target === 'workspace');
+  const workspaceId = isWs ? ((entry && entry.workspaceId) || state.workspaceId || null) : null;
+  const projKey = isWs ? null : ((entry && entry.projectDir) ? projectKey(entry.projectDir) : (state.projectKey || null));
+  const label = isWs
+    ? (state.workspaceName || (Array.isArray(state.projects) ? state.projects.map((p) => p.projectName).filter(Boolean).join(' · ') : '') || '')
+    : String((entry && entry.projectDir) || state.projectDir || '').split(/[\\/]/).filter(Boolean).pop() || (projKey || '');
+  const title = (entry && entry.title) || state.title || pipelineId;
+  const status = (entry && entry.status) || state.status || null;
+  const liveRunId = entry ? entry.id : null;
+  // ONE row per (thread, pipeline): by the live UUID first (a proposal launch whose block threw after askLinkRun leaves a
+  // uuid row with pipeline_id NULL that no follower fills — adopt it), then by pipeline id. UUID-first also means the
+  // patch below never moves a run_id onto a key that already exists (the (thread_id, run_id) PK would throw).
+  const links = askListRunLinks(threadId);
+  const existing = (liveRunId ? links.find((l) => l.runId === liveRunId) : null) || links.find((l) => l.pipelineId === pipelineId) || null;
+  try {
+    if (!existing) askLinkRun(threadId, { runId: liveRunId || pipelineId, pipelineId, status });
+    else {
+      const patch = { status };
+      if (!existing.pipelineId) patch.pipelineId = pipelineId;
+      if (liveRunId && existing.runId !== liveRunId) patch.runId = liveRunId;
+      askUpdateRunLink(threadId, existing.runId, patch);
+    }
+  } catch (err) {
+    return { ok: false, error: `could not link the run: ${err && err.message ? err.message : String(err)}` };
+  }
+  // Only a run that still drives its pipeline gets a follower: attachRunFollower subscribes unconditionally
+  // (follow.mjs:111) and a settled orchestrator never emits again, so it would sit in askFollowers for the life
+  // of the thread — and pin a paused lineage's dead orchestrator once resumeRun evicts the entry.
+  if (entry && !SETTLED_RUN.has(String(entry.status || '')) && !askFollowerAttached(threadId, entry.id)) {
+    attachAskFollower(entry.orch, { threadId, runId: entry.id, cardId: null });
+  }
+  return { ok: true, card: { type: 'progress', pipelineId, runId: liveRunId, projectKey: projKey, workspaceId, title, label, status } };
+}
+
 // ---------------------------------------------------------------------------
 // POST /api/run  -> start a new orchestration run
 // body (single-project): { projectDir, prompt?, promptMarkdown?, title?, mock? }
 // body (workspace):      { workspaceId, prompt?, ... } — mutually exclusive with
 //                        projectDir (§2.6). Single-project behavior is byte-identical.
 // ---------------------------------------------------------------------------
-app.post('/api/run', async (req, res) => {
+const startRunHandler = async (req, res) => {
   try {
     const body = req.body || {};
 
@@ -1169,6 +1362,21 @@ app.post('/api/run', async (req, res) => {
       return badRequest(res, err && err.message ? err.message : String(err));
     }
 
+    // Auto workflow (spec D19): project targets only in v1. Before the workspace lookup,
+    // so an Auto request for ANY workspace id answers 400, never 404.
+    if (workflowId === AUTO_WORKFLOW_ID && hasWorkspace) {
+      return badRequest(res, 'Auto workflow is not available for workspace targets yet');
+    }
+    // Agent memory (§7.3): the defragment run option — ONE gate for every entry point (the CLI
+    // and Ask's proposal validator call the same helper). Before the target lookup, like Auto.
+    if (body.memoryScope != null && typeof body.memoryScope !== 'string') return badRequest(res, 'memoryScope must be "global" or "project"');
+    const memoryScope = typeof body.memoryScope === 'string' && body.memoryScope.trim() ? body.memoryScope.trim() : null;
+    const scopeReason = validateMemoryScope({ workflowId, memoryScope, isWorkspace: !!hasWorkspace });
+    if (scopeReason) return badRequest(res, scopeReason);
+    // Human in the loop (spec D15): the body wins, else the project's stored
+    // switch, else on. Resolved per target below (it needs the project dir).
+    const bodyHumanInLoop = typeof body.humanInLoop === 'boolean' ? body.humanInLoop : null;
+
     // Optional guardrailsId selects the named guardrail set that IS this run's
     // policy (applied uniformly to every member — guardrails are per-run only).
     // Absent/blank/null normalizes to 'permissive' — the empty policy,
@@ -1314,6 +1522,13 @@ app.post('/api/run', async (req, res) => {
 
       const fileProblem = await promptFileProblem(effectiveSource, projectDir);
       if (fileProblem) return badRequest(res, fileProblem);
+      // One live defragment run per scope (§7.3, amendment B20: this server process only).
+      if (memoryScope) {
+        const live = liveDefragRun(memoryScopeKey(memoryScope, projectDir));
+        if (live) return res.status(409).json({ error: 'a defragment run for this memory scope is already live', runId: live.id });
+      }
+
+      const humanInLoop = bodyHumanInLoop ?? ((await readRunConfig(projectDir)).humanInLoop !== false);
 
       orch = await createOrchestratorFor({
         projectDir,
@@ -1326,6 +1541,8 @@ app.post('/api/run', async (req, res) => {
         template: workflowRow,
         guardrailsId,
         branch,
+        humanInLoop,
+        ...(memoryScope ? { memoryScope } : {}),
         claude: { permissionMode: 'acceptEdits', mock },
       });
 
@@ -1402,7 +1619,8 @@ app.post('/api/run', async (req, res) => {
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
-});
+};
+app.post('/api/run', startRunHandler);
 
 // ---------------------------------------------------------------------------
 // Chat connectivity (chat-connectivity-design.md): persistent channel workers
@@ -1679,7 +1897,15 @@ async function resumeRun(pipelineId, { ignoreCostCap = false, mock = false } = {
     if (!projectDir) throw new ResumeError(400, { error: 'project for this pipeline is not onboarded on this machine' });
   }
 
-  const effMock = mock || isTruthy(process.env.WORCA_MOCK ?? process.env.ORCH_MOCK);
+  // A paused defragment run is not live; another one on the same scope may have started since.
+  // Resuming the first would sync its stale mount over the second's work (spec §5 concurrency).
+  const rpScope = saved.resumePoint?.memoryScope || null;
+  if (rpScope && !workspace) {
+    const live = liveDefragRun(memoryScopeKey(rpScope, projectDir));
+    if (live) throw new ResumeError(409, { error: 'a defragment run for this memory scope is already live', runId: live.id });
+  }
+
+  const effMock = mock ||isTruthy(process.env.WORCA_MOCK ?? process.env.ORCH_MOCK);
   const runId = randomUUID();
   const orch = await createOrchestratorFor({
     projectDir,
@@ -1849,6 +2075,19 @@ app.get('/api/runs/:id/artifact', async (req, res) => {
   }
 });
 
+app.get('/api/runs/:id/artifacts', async (req, res) => {
+  try {
+    const row = findPipelineRowById(req.params.id);
+    if (!row) return res.status(404).json({ error: 'pipeline not found' });
+    // Cap the row set (each row costs a synchronous statSync for its byte size, on
+    // the event loop) at the same ceiling the ask tool uses.
+    const artifacts = await listRunArtifacts(row.id, { limit: ASK_LIMITS.artifactsListMaxLimit });
+    res.json({ runId: row.id, artifacts });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // Shared query-scope resolver for the retained-work routes (recovery-patch GET +
 // discard POST). Returns null after writing the error response itself. The older
 // DELETE /api/runs/:id route keeps its inline copy DELIBERATELY (it shadows the
@@ -1949,6 +2188,24 @@ app.get('/api/history', async (_req, res) => {
 // machine-wide history just to update a badge. Running is derived client-side from the
 // in-memory runs map (live via WS), so it is not included here. Synchronous: the three
 // helpers are sync getDb().prepare(...).get() calls.
+// ---------------------------------------------------------------------------
+// Getting started (docs/getting-started.md). GET is the derived checklist —
+// eight ticks computed from the store + PATH, never stored — plus the two flags.
+// POST writes ONLY those flags ({hidden?, welcomeSeen?}; booleans; unknown keys
+// 400) and answers with the same full payload, so one round trip repaints.
+// ---------------------------------------------------------------------------
+app.get('/api/onboarding', async (_req, res) => {
+  try { res.json(await onboardingStatus()); }
+  catch (err) { res.status(500).json({ error: err && err.message ? err.message : String(err) }); }
+});
+app.post('/api/onboarding', async (req, res) => {
+  try { await setOnboardingPrefs(req.body || {}); }
+  catch (err) { return badRequest(res, err && err.message ? err.message : String(err)); }
+  emitChanged('onboarding-changed');
+  try { res.json(await onboardingStatus()); }
+  catch (err) { res.status(500).json({ error: err && err.message ? err.message : String(err), ...onboardingPrefs() }); }
+});
+
 app.get('/api/counts', (_req, res) => {
   try {
     res.json({
@@ -1975,6 +2232,154 @@ app.get('/api/stats', (req, res) => {
   }
 });
 
+// ---- Team metrics (team-metrics-design.md §4.6–§4.10) ----------------------------------
+function metricsErrorStatus(code) {
+  switch (code) {
+    case 'BAD_REQUEST': case 'NO_ORIGIN': return 400;
+    case 'DELEGATE_INVALID': return 409;                 // a configuration state, not a malformed request
+    case 'NOT_FOUND': case 'NOT_ENABLED': return 404;
+    case 'PUSH_REJECTED': case 'FETCH_FAILED': case 'REMOTE_UNREACHABLE': case 'PUSH_RETRIES_EXHAUSTED': return 502;
+    case 'LOCK_TIMEOUT': return 503;
+    default: return 500;
+  }
+}
+function sendMetricsError(res, err) {
+  const code = (err && err.code) || 'INTERNAL';
+  res.status(metricsErrorStatus(code)).json({
+    error: err && err.message ? err.message : String(err), code,
+    ...(err && err.stderr ? { stderr: err.stderr } : {}),
+    ...(err && err.hint ? { hint: err.hint } : {}),
+  });
+}
+async function tmProject(req, res) {
+  if (!TM_PROJECT_KEY_RE.test(req.params.key)) { badRequest(res, 'invalid project key'); return null; }
+  const p = (await listProjects()).find((x) => x.key === req.params.key);
+  if (!p) { res.status(404).json({ error: 'project not found', code: 'NOT_FOUND' }); return null; }
+  return p;
+}
+
+app.get('/api/team-metrics/scopes', async (req, res) => {
+  try { res.json(await listScopes({ discover: req.query.discover === '1' })); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
+app.get('/api/team-metrics', async (req, res) => {
+  const scope = parseScopeParam(req.query.scope);
+  if (!scope) return badRequest(res, 'scope must be project:<projectKey> or workspace:<workspaceId>');
+  const range = typeof req.query.range === 'string' && req.query.range ? req.query.range : 'this-month';
+  const groupBy = typeof req.query.groupBy === 'string' && req.query.groupBy ? req.query.groupBy : 'workflow';
+  const from = typeof req.query.from === 'string' ? req.query.from : null;
+  const to = typeof req.query.to === 'string' ? req.query.to : null;
+  try {
+    resolveRange(range, { from, to });                       // 400 before touching git
+    if (!GROUP_BYS.includes(groupBy)) throw new RangeError(`unknown groupBy "${groupBy}"`);
+  } catch (err) { return badRequest(res, err.message); }
+  try {
+    // defer=1 (the page): serve the worktree now and run a due fetch afterwards; the fetch's
+    // `changed` event tells the page to reload. Other clients (Ask tools, CLI, tests) keep the
+    // inline fetch and get fresh data in one round trip.
+    const read = await readScope(scope, { refresh: req.query.refresh === '1', defer: req.query.defer === '1' });
+    // Flush trigger: page open (§4.5). reason:'page-open' backs off for 60 s after a failed flush,
+    // so a failing push cannot loop through flush-failed → WS → page reload → GET → flush.
+    for (const s of read.sync) if (s.pending > 0) scheduleFlush(s.slug, { reason: 'page-open' });
+    res.json({
+      scope: read.scope,
+      records: read.records,
+      // The page re-aggregates client-side (§4.9 "one fetch serves the session") and asks with
+      // aggregate=0: at 12k records the unused aggregate added ~3.9 MB to a ~9.9 MB response.
+      // Other clients (and the API tests) still get it by default.
+      aggregate: req.query.aggregate === '0' ? null : aggregate(read.records, { range, from, to, groupBy }),
+      stats: read.stats,
+      sync: read.sync,
+      refresh: read.refresh,
+      fetchError: read.fetchError,
+    });
+  } catch (err) { sendMetricsError(res, err); }
+});
+
+// "Push now" / "Retry": body { slug } flushes one outbox, { scope } flushes that scope's sinks,
+// an empty body flushes every outbox on this machine (same as `worca metrics push`).
+app.post('/api/team-metrics/flush', async (req, res) => {
+  const body = req.body || {};
+  try {
+    let results;
+    if (typeof body.slug === 'string' && body.slug) {
+      // slugDirName throws BAD_REQUEST inside flushSlug, which would answer 200 with ok:false.
+      try { slugDirName(body.slug); } catch { return badRequest(res, 'invalid slug'); }
+      results = [await flushSlug(body.slug)];
+    }
+    else if (typeof body.scope === 'string' && body.scope) {
+      const scope = parseScopeParam(body.scope);
+      if (!scope) return badRequest(res, 'invalid scope');
+      if (scope.kind === 'project') {
+        const p = (await listProjects()).find((x) => x.key === scope.id);
+        if (!p) return res.status(404).json({ error: 'project not found', code: 'NOT_FOUND' });
+        results = [await flushProject(p.path)];
+      } else {
+        const sinks = (await readScope(scope)).sinks;
+        results = [];
+        for (const slug of sinks) results.push(await flushSlug(slug));
+      }
+    } else results = await flushAll();
+    res.json({ results });
+  } catch (err) { sendMetricsError(res, err); }
+});
+
+// Empty state "Check now" (§4.10): force discovery everywhere.
+app.post('/api/team-metrics/discover', async (_req, res) => {
+  try { await discoverAll({ force: true }); res.json(await listScopes()); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
+app.get('/api/projects/:key/team-metrics', async (req, res) => {
+  const p = await tmProject(req, res); if (!p) return;
+  try { res.json({ status: await projectMetricsStatus(p, { discover: req.query.discover === '1' }) }); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
+app.patch('/api/projects/:key/team-metrics', async (req, res) => {
+  const p = await tmProject(req, res); if (!p) return;
+  const body = req.body || {};
+  if (typeof body.record !== 'boolean') return badRequest(res, 'record must be a boolean');
+  try { setRecordMyRuns(p.path, body.record); res.json({ status: await projectMetricsStatus(p) }); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
+app.post('/api/projects/:key/team-metrics/enable', async (req, res) => {
+  const p = await tmProject(req, res); if (!p) return;
+  const body = req.body || {};
+  const mode = body.mode === 'delegate' ? 'delegate' : body.mode === 'here' || body.mode == null ? 'here' : null;
+  if (!mode) return badRequest(res, 'mode must be "here" or "delegate"');
+  if (mode === 'here' && body.attribution != null && body.attribution !== 'git-user' && body.attribution !== 'none') {
+    return badRequest(res, 'attribution must be "git-user" or "none"');
+  }
+  try {
+    const result = await enableTeamMetrics(p.path, { mode, attribution: body.attribution || 'git-user', delegateTo: body.delegateTo || null, change: body.change === true });
+    res.json({ ...result, status: await projectMetricsStatus(p) });
+  } catch (err) { sendMetricsError(res, err); }
+});
+
+// Wizard step (§4.8). No POST /api/workspaces/:id route exists, so nothing shadows this path.
+app.post('/api/workspaces/metrics-scan', async (req, res) => {
+  const paths = req.body && Array.isArray(req.body.projectPaths) ? req.body.projectPaths.filter((p) => typeof p === 'string' && p) : null;
+  if (!paths || !paths.length) return badRequest(res, 'projectPaths must be a non-empty array of paths');
+  if (paths.length > 50) return badRequest(res, 'at most 50 projectPaths');
+  const normalized = paths.map((p) => resolveProjectDir(p)).filter(Boolean);
+  // Same checks as POST /api/workspaces/scan (:~2948): never discover (and write a config row for) a junk path.
+  for (const p of normalized) {
+    if (!fs.existsSync(p)) return badRequest(res, `member path is missing: ${p}`);
+    if (!isGitRepo(p)) return badRequest(res, `member is not a git repository: ${p}`);
+  }
+  try { res.json(await scanMembers(normalized)); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
+app.post('/api/workspaces/:id/metrics-route', async (req, res) => {
+  if (!WORKSPACE_KEY_RE.test(req.params.id)) return res.status(404).json({ error: 'workspace not found', code: 'NOT_FOUND' });
+  try { res.json(await routeWorkspaceMembers(req.params.id)); }
+  catch (err) { sendMetricsError(res, err); }
+});
+
 // ---------------------------------------------------------------------------
 // POST /api/history/pr  -> enrich the skeleton with live PR state, pushed back
 // over the WS as batched `history-pr` events (reuses broadcast(), the same
@@ -2130,7 +2535,27 @@ function commentsPatch(req, res, storeKey, id, cid) {
     const raw = (req.body || {}).resolved;
     if (typeof raw !== 'boolean') return badRequest(res, 'resolved must be a boolean');
     res.json({ comment: setDiffCommentResolved(cid, raw) });
-  } catch (err) { commentsFail(res, err); }
+  } catch (err) {
+    // A reply id: the store refuses (D2) and the browser shows the reason inline.
+    if (err instanceof DiffCommentError) return badRequest(res, err.message);
+    commentsFail(res, err);
+  }
+}
+
+/** Reply inside a thread. The parent must belong to THIS run (commentOfRun); the
+ *  store enforces one level, the body cap and the author. No patch gate: a reply
+ *  anchors to nothing new, so there is no anchor to re-resolve and no patch to read
+ *  it from. (Not an archived-run affordance — archiving deletes a run's comments,
+ *  src/core/pipeline-delete.mjs.) */
+function commentsReply(req, res, storeKey, id, cid) {
+  try {
+    if (!commentOfRun(res, storeKey, id, cid)) return;
+    const comment = addDiffCommentReply({ parentId: cid, body: (req.body || {}).body, author: 'user' });
+    res.status(201).json({ comment });
+  } catch (err) {
+    if (err instanceof DiffCommentError) return badRequest(res, err.message);
+    commentsFail(res, err);
+  }
 }
 
 function commentsDelete(res, storeKey, id, cid) {
@@ -2159,6 +2584,11 @@ app.delete('/api/history/:key/:id/comments/:cid', (req, res) => {
   const cid = commentIdParam(res, req.params.cid); if (!cid) return;
   commentsDelete(res, key, req.params.id, cid);
 });
+app.post('/api/history/:key/:id/comments/:cid/replies', (req, res) => {
+  const key = commentsHistoryKey(res, req.params.key); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsReply(req, res, key, req.params.id, cid);
+});
 
 app.get('/api/workspaces/:id/runs/:runId/comments', async (req, res) => {
   const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
@@ -2178,6 +2608,11 @@ app.delete('/api/workspaces/:id/runs/:runId/comments/:cid', (req, res) => {
   const cid = commentIdParam(res, req.params.cid); if (!cid) return;
   commentsDelete(res, key, req.params.runId, cid);
 });
+app.post('/api/workspaces/:id/runs/:runId/comments/:cid/replies', (req, res) => {
+  const key = commentsWorkspaceKey(res, req.params.id); if (!key) return;
+  const cid = commentIdParam(res, req.params.cid); if (!cid) return;
+  commentsReply(req, res, key, req.params.runId, cid);
+});
 
 // Unresolved counts for every run, for the History list pill. Its own endpoint
 // rather than a field on /api/history: that response has a localStorage skeleton
@@ -2311,37 +2746,87 @@ app.post('/api/runs/:id/discard-worktree', async (req, res) => {
 });
 
 // ---------------------------------------------------------------------------
-// POST /api/pr  -> push the pipeline's feature branch (if needed) and open a PR
-// against its source branch via the GitHub CLI. Mergeability is read back only
-// here (never during list rendering). body: { id, projectDir? , projectKey? }
+// PR remotes (fork support). The ship-it dialog picks (1) the remote the feature
+// branch is pushed to and (2) the remote whose repo the PR is opened in — GitHub's
+// "compare across forks". Names are user-defined, so nothing is special-cased
+// beyond fallbacks: the project's remembered choice (when those remotes still
+// exist) -> `upstream` for the base when one exists -> `origin` -> first remote.
 // ---------------------------------------------------------------------------
-app.post('/api/pr', async (req, res) => {
-  const body = req.body || {};
-  const id = typeof body.id === 'string' ? body.id.trim() : '';
-  if (!id) return badRequest(res, 'id is required');
-  if (!(await hasGh())) {
-    return res.status(409).json({ error: 'GitHub CLI (gh) is not available' });
-  }
+function defaultPrRemotes(remotes, remembered) {
+  const names = remotes.map((r) => r.name);
+  const has = (n) => !!n && names.includes(n);
+  const first = names[0] || null;
+  const pushRemote = has(remembered?.pushRemote) ? remembered.pushRemote : (has('origin') ? 'origin' : first);
+  const baseRemote = has(remembered?.baseRemote) ? remembered.baseRemote
+    : (has('upstream') ? 'upstream' : (has('origin') ? 'origin' : first));
+  return { pushRemote, baseRemote };
+}
 
-  // Resolve the pipeline state (by store key, else by project dir).
+// Resolve a pipeline for the PR routes (store key first, else project dir) from a
+// body or a query object. Writes the error response itself and returns null.
+// (/api/pr/mergeable keeps its own copy: its bad-key/not-found cases answer 200
+// UNKNOWN, not 404.)
+async function resolvePrPipeline(src, res) {
+  const id = typeof src.id === 'string' ? src.id.trim() : '';
+  if (!id) { badRequest(res, 'id is required'); return null; }
   let state = null;
   try {
-    if (typeof body.projectKey === 'string' && body.projectKey.trim()) {
-      if (!/^[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$/.test(body.projectKey)) {
-        return res.status(404).json({ error: 'pipeline not found' });
+    if (typeof src.projectKey === 'string' && src.projectKey.trim()) {
+      if (!/^[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$/.test(src.projectKey)) {
+        res.status(404).json({ error: 'pipeline not found' });
+        return null;
       }
-      const data = await readPipelineByKey(body.projectKey, id);
+      const data = await readPipelineByKey(src.projectKey, id);
       state = data && data.state;
     } else {
-      const projectDir = resolveProjectDir(body.projectDir);
-      if (!projectDir) return badRequest(res, 'projectDir or projectKey is required');
+      const projectDir = resolveProjectDir(src.projectDir);
+      if (!projectDir) { badRequest(res, 'projectDir or projectKey is required'); return null; }
       const data = await readPipeline(projectDir, id);
       state = data && data.state;
     }
   } catch (err) {
-    return res.status(500).json({ error: err && err.message ? err.message : String(err) });
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+    return null;
   }
-  if (!state) return res.status(404).json({ error: 'pipeline not found' });
+  if (!state) { res.status(404).json({ error: 'pipeline not found' }); return null; }
+  return { id, state };
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/pr/remotes?id=&projectKey=|projectDir=  -> the project's git remotes for
+// the ship-it dialog plus the defaults POST /api/pr applies when the body names
+// none. Same pipeline resolution as POST /api/pr (the repo dir comes from the
+// pipeline's store_meta, never from the query). gh is not required here.
+// -> { ok, remotes:[{name,fetchUrl,pushUrl,host,owner,repo,slug}],
+//      defaults:{pushRemote,baseRemote}, remembered:{pushRemote,baseRemote}|null }
+// ---------------------------------------------------------------------------
+app.get('/api/pr/remotes', async (req, res) => {
+  const resolved = await resolvePrPipeline(req.query || {}, res);
+  if (!resolved) return;
+  const repoDir = resolved.state.projectDir;          // null when store_meta is missing
+  if (!repoDir) return badRequest(res, 'pipeline has no project directory');
+  const rl = await listRemotes(repoDir);
+  if (!rl.ok) return res.status(500).json({ error: `git remote failed: ${rl.error}` });
+  const remembered = readPrRemotePrefs(repoDir);
+  res.json({ ok: true, remotes: rl.remotes, defaults: defaultPrRemotes(rl.remotes, remembered), remembered });
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/pr  -> push the pipeline's feature branch (if needed) and open a PR
+// against its source branch via the GitHub CLI. Mergeability is read back only
+// here (never during list rendering).
+// body: { id, projectDir?, projectKey?, pushRemote?, baseRemote? } — remote names
+// are validated against the repo's real remote list (never trusted from the body).
+// ---------------------------------------------------------------------------
+app.post('/api/pr', async (req, res) => {
+  const body = req.body || {};
+  if (!(typeof body.id === 'string' && body.id.trim())) return badRequest(res, 'id is required');
+  if (!(await hasGh())) {
+    return res.status(409).json({ error: 'GitHub CLI (gh) is not available' });
+  }
+  const resolved = await resolvePrPipeline(body, res);
+  if (!resolved) return;
+  const { id, state } = resolved;
 
   const repoDir = state.projectDir;
   const feature = state.branch && state.branch.feature;
@@ -2350,12 +2835,49 @@ app.post('/api/pr', async (req, res) => {
     return badRequest(res, 'pipeline has no branch info to open a PR');
   }
 
+  // Remote selection. A named remote must exist; unnamed ones take the dialog's
+  // defaults. With no usable remote list (no remotes, unparseable URLs) the legacy
+  // argv applies: push `origin`, no --repo, bare head. A git failure is only fatal
+  // when the body actually names a remote (otherwise legacy argv, as before).
+  const named = (v) => !(v === undefined || v === null || v === '');
+  const rl = await listRemotes(repoDir);
+  if (!rl.ok && (named(body.pushRemote) || named(body.baseRemote))) {
+    return res.status(500).json({ error: `git remote failed: ${rl.error}` });
+  }
+  const remotes = rl.ok ? rl.remotes : [];
+  const byName = new Map(remotes.map((r) => [r.name, r]));
+  const pick = (field, label) => {
+    const v = body[field];
+    if (!named(v)) return { name: null };
+    if (typeof v !== 'string' || !byName.has(v.trim())) {
+      return { error: `unknown ${label} remote: ${String(v).slice(0, 80)}` };
+    }
+    return { name: v.trim() };
+  };
+  const pushPick = pick('pushRemote', 'push');
+  if (pushPick.error) return badRequest(res, pushPick.error);
+  const basePick = pick('baseRemote', 'base');
+  if (basePick.error) return badRequest(res, basePick.error);
+  const defaults = defaultPrRemotes(remotes, readPrRemotePrefs(repoDir));
+  const pushRemote = pushPick.name || defaults.pushRemote || 'origin';
+  const baseRemote = basePick.name || defaults.baseRemote || 'origin';
+  const pushR = byName.get(pushRemote) || null;
+  const baseR = byName.get(baseRemote) || null;
+  // Always target the chosen base repo explicitly (gh's default-repo guess prefers
+  // a remote named upstream over origin); use the owner:branch head only when the
+  // branch lives in a different repository than the PR (gh matches by head label).
+  const repo = baseR?.slug || null;
+  const crossRepo = !!(pushR?.slug && baseR?.slug && !sameRepo(pushR, baseR));
+  const headOwner = crossRepo ? pushR.owner : null;
+
   // Push (idempotent) -> create PR -> read mergeability. All args are passed as
-  // an argv array (no shell), so branch/source names cannot inject.
-  const pushed = await pushBranch(repoDir, feature);
+  // an argv array (no shell), so branch/remote/source names cannot inject.
+  const pushed = await pushBranch(repoDir, feature, pushRemote);
   if (!pushed.ok) return res.status(500).json({ error: `git push failed: ${pushed.stderr}` });
 
-  const pr = await createPr({ projectDir: repoDir, base: source, head: feature, title: state.title || feature });
+  const pr = await createPr({
+    projectDir: repoDir, base: source, head: feature, title: state.title || feature, repo, headOwner,
+  });
   if (!pr.ok) return res.status(500).json({ error: `gh pr create failed: ${pr.error}` });
 
   // Persist the PR facts we just learned, so History/stats survive a gh outage.
@@ -2364,8 +2886,12 @@ app.post('/api/pr', async (req, res) => {
   if (pipelineIdForPr) {
     persistPrState(pipelineIdForPr, { url: pr.url, number: parsePrNumber(pr.url), state: 'OPEN' });
   }
+  // Remember the choice for this project (only once a PR was actually created).
+  if (remotes.length) {
+    try { await setPrRemotePrefs(repoDir, { pushRemote, baseRemote }); } catch { /* best-effort */ }
+  }
 
-  const mergeable = await prMergeable({ projectDir: repoDir, head: feature });
+  const mergeable = await prMergeable({ projectDir: repoDir, head: feature, repo, headOwner, prUrl: pr.url || null });
   res.json({ ok: true, url: pr.url, mergeable, existed: !!pr.existed });
 });
 
@@ -2404,7 +2930,11 @@ app.post('/api/pr/mergeable', async (req, res) => {
     const feature = state && state.branch && state.branch.feature;
     if (!repoDir || !feature) return res.json({ ok: true, mergeable: 'UNKNOWN' });
 
-    const mergeable = await prMergeable({ projectDir: repoDir, head: feature });
+    // A persisted pr_url is repo-agnostic (a fork PR lives in the base repo, which
+    // need not be gh's default for this checkout); the head selector is only the
+    // fallback for rows that never recorded a PR.
+    const prUrl = readPrState(state.id || id)?.url || null;
+    const mergeable = await prMergeable({ projectDir: repoDir, head: feature, prUrl });
     res.json({ ok: true, mergeable });
   } catch {
     res.json({ ok: true, mergeable: 'UNKNOWN' });   // best-effort: never error the refresh
@@ -2457,6 +2987,9 @@ app.post('/api/projects', async (req, res) => {
   try {
     const projects = await addProject({ name: body.name, path: body.path });
     emitChanged('projects-changed', 'created');
+    discoverProject(normalizeProjectPath(body.path), { force: true })
+      .then(() => emitChanged('team-metrics-changed', 'discovered'))
+      .catch(() => { /* offline or not a git repo: discovery retries hourly */ });
     res.json({ projects });
   } catch (err) {
     // addProject only throws on validation (empty/duplicate/not-a-directory), so
@@ -2478,6 +3011,155 @@ app.delete('/api/projects', async (req, res) => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// /api/memory/* -> worca's agent memory store (agent-memory-design.md §11). Thin
+// handlers over src/core/memory-store.mjs: names are validated BEFORE any fs call,
+// MemoryError codes map to statuses, every write snapshots (the store does it) and
+// broadcasts `memory-changed`. Two route families — `global` and `projects/:key` —
+// share ONE handler set through resolveMemoryScope().
+// ---------------------------------------------------------------------------
+function memoryHttpStatus(err) {
+  const code = err && err.code;
+  if (code === 'ENAME') return 400;
+  if (code === 'ECASE' || code === 'EFULL') return 409;
+  if (code === 'ETOOBIG') return 413;
+  if (code === 'ENOSCOPE') return 404;
+  return 500;
+}
+function memoryError(res, err) {
+  const status = memoryHttpStatus(err);
+  const message = String(err && err.message ? err.message : err).replace(/^memory: /, '');
+  if (status === 500) console.error(`[worca-ui] memory: ${err && err.stack ? err.stack : message}`);
+  return res.status(status).json({ error: status === 500 ? 'memory store error' : message });
+}
+
+/** Thread-less, seq-less frame (B5): an Ask tool, a REST write or a run that mounted memory
+ *  changed a scope; open Memory views refetch. Best effort. Exported through _testing. */
+function emitMemoryChanged(scopeKeyStr) {
+  try { broadcast({ type: 'memory-changed', scope: scopeKeyStr }); return true; } catch { return false; }
+}
+
+/** { scope, key, project } for the global family or a REGISTERED project key; null ⇒ 404.
+ *  `family` is passed by registerMemoryRoutes rather than inferred (I2-#19): express populates
+ *  `req.params.key` only for the `projects/:key` prefix, so `req.params.key === undefined` WOULD
+ *  separate the two registrations — an implicit path-shape coincidence where one named argument
+ *  reads as intent. The two prefixes never collide: every second segment is a literal. */
+async function resolveMemoryScope(req, family) {
+  if (family === 'global') return { scope: GLOBAL_SCOPE, key: 'global', project: null };
+  const key = String(req.params.key || '');
+  if (!PROJECT_KEY_RE.test(key)) return null;           // the shape store.mjs#projectKey produces
+  const p = (await listProjects()).find((x) => x.key === key);
+  if (!p) return null;
+  return { scope: projectScope(key), key: `projects/${key}`, project: { key: p.key, name: p.name, path: p.path } };
+}
+
+/** Start a defragment run through the ONE run handler (§7.3): the wrapper only builds the body.
+ *  startRunHandler reads `req.body` exactly once, at its top, so rewriting it here is sound. */
+async function defragRequest(req, res, { memoryScope, projectKey: key }) {
+  if (!PROJECT_KEY_RE.test(String(key || ''))) return res.status(404).json({ error: 'project not found' });
+  const p = (await listProjects()).find((x) => x.key === key);
+  if (!p) return res.status(404).json({ error: 'project not found' });
+  if (!p.exists) return badRequest(res, `project path is missing: ${p.path}`);   // else startRunHandler would mkdir it
+  req.body = {
+    projectDir: p.path,
+    prompt: memoryScope === 'global' ? 'Defragment global memory.' : `Defragment the memory of project ${p.name}.`,
+    title: memoryScope === 'global' ? 'Memory defragment (global)' : `Memory defragment: ${p.name}`,
+    workflowId: MEMORY_DEFRAG_WORKFLOW_ID,
+    guardrailsId: 'normal',
+    memoryScope,
+    ...(req.body && req.body.mock === true ? { mock: true } : {}),
+  };
+  return startRunHandler(req, res);
+}
+
+function registerMemoryRoutes(prefix, { family }) {
+  const scoped = (handler) => async (req, res) => {
+    try {
+      const ctx = await resolveMemoryScope(req, family);
+      if (!ctx) return res.status(404).json({ error: 'project not found' });
+      return await handler(req, res, ctx);
+    } catch (err) { return memoryError(res, err); }
+  };
+  const named = (req, res) => {
+    const name = String(req.params.name || '');
+    if (!isValidMemoryName(name)) { badRequest(res, `invalid memory name — ${MEMORY_NAME_HELP}`); return null; }
+    return name;
+  };
+  /** B23: while a defragment run is live on this scope, that run's final sync would silently
+   *  overwrite a REST write ("the run's version wins", memory-sync.mjs) — refuse instead. */
+  const defragLocked = (res, key) => {
+    const live = liveDefragRun(key);
+    if (!live) return false;
+    res.status(409).json({ error: 'a defragment run is live on this memory scope — wait for it to finish', runId: live.id });
+    return true;
+  };
+  const onError = (p, err) => console.warn(`[worca-ui] memory: ${p}: ${err && err.message ? err.message : err}`);
+
+  app.get(prefix, scoped(async (_req, res, { scope, key, project }) => {
+    const report = await memoryScopeReport(memoryRoot(), scope, memoryCaps(), { onError });
+    res.json({ scope: key, project, files: report.entries, state: report.state, health: report.health, defragRunId: liveDefragRun(key)?.id || null });
+  }));
+  app.get(`${prefix}/files/:name`, scoped(async (req, res, { scope }) => {
+    const name = named(req, res); if (name === null) return;
+    const f = await readMemory(memoryRoot(), scope, name);
+    if (!f) return res.status(404).json({ error: 'memory file not found' });
+    res.json({ name, text: f.text, meta: f.meta, body: f.body });
+  }));
+  app.put(`${prefix}/files/:name`, scoped(async (req, res, { scope, key }) => {
+    const name = named(req, res); if (name === null) return;
+    const text = req.body && typeof req.body.text === 'string' ? req.body.text : null;
+    if (text === null) return badRequest(res, 'text (string) is required');
+    if (defragLocked(res, key)) return;
+    const r = await withStoreLock(memoryRoot(), () => writeMemory(memoryRoot(), scope, name, text, { source: 'user', caps: memoryCaps() }));
+    emitMemoryChanged(key);
+    res.json({ ok: true, name, created: r.created, bytes: r.bytes });
+  }));
+  app.delete(`${prefix}/files/:name`, scoped(async (req, res, { scope, key }) => {
+    const name = named(req, res); if (name === null) return;
+    if (defragLocked(res, key)) return;
+    const removed = await withStoreLock(memoryRoot(), () => removeMemory(memoryRoot(), scope, name, { source: 'user' }));
+    if (!removed) return res.status(404).json({ error: 'memory file not found' });
+    emitMemoryChanged(key);
+    res.json({ ok: true });
+  }));
+  app.get(`${prefix}/history`, scoped(async (_req, res, { scope }) => {
+    const snapshots = (await listSnapshots(memoryRoot(), scope)).map((s) => ({ id: s.id, files: s.files }));
+    res.json({ snapshots });
+  }));
+  app.post(`${prefix}/history/:id/restore`, scoped(async (req, res, { scope, key }) => {
+    if (defragLocked(res, key)) return;
+    await withStoreLock(memoryRoot(), () => restoreSnapshot(memoryRoot(), scope, String(req.params.id || ''), { source: 'user' }));   // ENAME -> 400, ENOSCOPE -> 404
+    emitMemoryChanged(key);
+    res.json({ ok: true });
+  }));
+  app.post(`${prefix}/defragment`, async (req, res) => {
+    try {
+      if (family === 'projects') return await defragRequest(req, res, { memoryScope: 'project', projectKey: String(req.params.key || '') });
+      const key = req.body && typeof req.body.projectKey === 'string' ? req.body.projectKey.trim() : '';
+      if (!key) return badRequest(res, 'projectKey is required — a global defragment run is hosted by a project');
+      return await defragRequest(req, res, { memoryScope: 'global', projectKey: key });
+    } catch (err) { return memoryError(res, err); }
+  });
+}
+
+// Every scope's health in one read. Fetched ON DEMAND — when the Memory tab or a Projects
+// expander opens, and on a `memory-changed` frame — never on a timer: each call reads and
+// hashes every file of every registered project's scope (I2-#16).
+app.get('/api/memory/health', async (_req, res) => {
+  try {
+    const caps = memoryCaps();
+    const g = await memoryScopeReport(memoryRoot(), GLOBAL_SCOPE, caps);
+    const projects = [];
+    for (const p of await listProjects()) {
+      const r = await memoryScopeReport(memoryRoot(), projectScope(p.key), caps);
+      projects.push({ key: p.key, name: p.name, health: r.health, defragRunId: liveDefragRun(`projects/${p.key}`)?.id || null });
+    }
+    res.json({ global: { health: g.health, defragRunId: liveDefragRun('global')?.id || null }, projects });
+  } catch (err) { return memoryError(res, err); }
+});
+registerMemoryRoutes('/api/memory/global', { family: 'global' });
+registerMemoryRoutes('/api/memory/projects/:key', { family: 'projects' });
+
 // ---------------------------------------------------------------------------
 // Filesystem browsing for the add-project folder selector. Hybrid picker:
 // POST /api/fs/pick-folder opens the native OS dialog (the server runs on the
@@ -2540,9 +3222,13 @@ app.post('/api/workspaces', async (req, res) => {
     : [];
   if (projectPaths.length < 2) return badRequest(res, 'a workspace needs at least 2 member projects');
   try {
-    const workspace = await createWorkspace({ name: body.name, projectPaths, description: body.description });
+    // No explicit home (the create wizard no longer asks): adopt the one member that already
+    // records, if there is exactly one; every other case is "Choose…" on the workspace card.
+    const explicit = typeof body.metricsProject === 'string' && body.metricsProject ? body.metricsProject : null;
+    const metricsProject = explicit ?? await autoMetricsHome(projectPaths);
+    const workspace = await createWorkspace({ name: body.name, projectPaths, description: body.description, metricsProject });
     emitChanged('workspaces-changed', 'created');
-    res.status(201).json({ workspace });
+    res.status(201).json({ workspace, metricsHomeAuto: !explicit && !!metricsProject });
   } catch (err) {
     const status = workspaceErrorStatus(err && err.code);
     return res.status(status).json({ error: err && err.message ? err.message : String(err) });
@@ -2555,14 +3241,21 @@ app.patch('/api/workspaces/:id', async (req, res) => {
   const body = req.body || {};
   // Immutability (defense-in-depth, §2.3): the project set never changes via PATCH.
   if ('projectPaths' in body || 'projectKeys' in body) {
-    return badRequest(res, 'a workspace project set is immutable; PATCH accepts only name/description');
+    return badRequest(res, 'a workspace project set is immutable; PATCH accepts only name/description/metricsProject');
   }
   // Pass through only the editable fields.
   const patch = {};
   if (typeof body.name === 'string') patch.name = body.name;
   if (typeof body.description === 'string') patch.description = body.description;
+  if ('metricsProject' in body) {
+    if (body.metricsProject !== null && typeof body.metricsProject !== 'string') {
+      return badRequest(res, 'metricsProject must be a member project path or null');
+    }
+    patch.metricsProject = body.metricsProject;
+  }
   try {
     const workspace = await updateWorkspace(id, patch);
+    if ('metricsProject' in patch) emitChanged('workspaces-changed', 'metrics-home');
     res.json({ workspace });
   } catch (err) {
     const status = workspaceErrorStatus(err && err.code);
@@ -2777,6 +3470,10 @@ app.get('/api/workspaces/:id/runs/:runId/artifact', async (req, res) => {
 //   projectsRootDefault : what applies when projectsRoot is blank — the env tier
 //                         when exported, else defaultRoot(). The UI placeholder.
 //                         Additive; `default` keeps its `root` meaning.
+//   app                 : { version, repoUrl, releaseUrl } — static identity for
+//                         the About card (APP_INFO, from package.json). GET-only:
+//                         it is not a setting, so POST keeps echoing
+//                         settingsState() + chat unchanged.
 // POST /api/settings -> set either key and return the resulting full state.
 //   Only keys PRESENT in the body are written, so a projectsRoot-only POST can
 //   never reset `root` (and vice versa). An explicitly empty value still resets
@@ -2799,7 +3496,20 @@ const settingsState = () => ({
   titleModel: storedTitleModel(),                         // the STORED id (the select), null = run's model
   titleModelEffective: describeTitleModel(),              // env override / stale id, for the hint line (#422)
   hideBuiltinModels: hideBuiltinModels(),
-});
+  theme: storedTheme(),                                   // system | light | dark (dark-mode design §6)
+});
+
+/** Settings ▸ Auto workflow model: the stored id + what the classifier will actually use
+ *  (env override > stored catalog id > the Sonnet-class default). Async because the
+ *  catalog is. */
+async function autoModelState() {
+  const models = await listModels('');
+  const stored = storedAutoWorkflowModel();
+  const model = resolveAutoModel(models, { setting: stored });
+  const source = process.env[AUTO_MODEL_ENV]?.trim() ? 'env'
+    : (stored && model.toLowerCase() === stored.toLowerCase()) ? 'settings' : 'default';
+  return { autoWorkflowModel: stored, autoWorkflowModelEffective: { model, source } };
+}
 
 // ---------------------------------------------------------------------------
 // Instance lifecycle (`worca ui status|stop|restart`, src/core/ui-instance.mjs)
@@ -2844,8 +3554,8 @@ app.post('/api/shutdown', (req, res) => {
   setImmediate(() => uiControl.onShutdown('request'));
 });
 
-app.get('/api/settings', (_req, res) => {
-  res.json({ ...settingsState(), chat: chatPrefs() });
+app.get('/api/settings', async (_req, res) => {
+  res.json({ ...settingsState(), ...(await autoModelState()), chat: chatPrefs(), app: APP_INFO });
 });
 
 app.get('/api/budget', (_req, res) => {
@@ -2860,6 +3570,9 @@ app.post('/api/settings', async (req, res) => {
   const hasDebugSpawnKey = has('debugSpawnEnabled');
   const hasTitleModelKey = has('titleModel');
   const hasHideBuiltinKey = has('hideBuiltinModels');
+  const hasThemeKey = has('theme');
+  const hasAutoKey = has('autoWorkflowModel');
+  const autoModels = hasAutoKey ? await listModels('') : null;
   // #422: the title model is a SELECT over the catalog, so an id that is not a
   // catalog member is a client bug (or a stale option) — refuse it here rather
   // than store an id resolveModelEnv could never route.
@@ -2892,6 +3605,8 @@ app.post('/api/settings', async (req, res) => {
       }
     }
     if (hasHideBuiltinKey) assertHideBuiltinModelsInput(body.hideBuiltinModels);
+    if (hasThemeKey) assertThemeInput(body.theme);
+    if (hasAutoKey) assertAutoWorkflowModelInput(body.autoWorkflowModel ?? '', autoModels);
     // Root first: it is the one key whose setter can still fail AFTER the asserts
     // above (an unusable path), so every other key's write must come after it or
     // a mixed POST would answer 400 with those keys already applied on disk.
@@ -2912,11 +3627,13 @@ app.post('/api/settings', async (req, res) => {
     if (hasDebugSpawnKey) await setDebugSpawnEnabled(body.debugSpawnEnabled);
     if (hasTitleModelKey) await setTitleModel(titleModelInput);
     if (hasHideBuiltinKey) await setHideBuiltinModels(body.hideBuiltinModels);
+    if (hasThemeKey) await setTheme(body.theme);
+    if (hasAutoKey) await setAutoWorkflowModel(body.autoWorkflowModel ?? '', { models: autoModels });
     if (hasBudgetKey) emitChanged('budget-changed');
     // Other open tabs repaint their Settings cards (a stale tab could otherwise
     // "save" its old checkbox state over this one with no feedback to either).
-    if (hasAskKey || hasDebugSpawnKey || hasTitleModelKey || hasHideBuiltinKey) emitChanged('settings-changed');
-    res.json({ ...settingsState(), chat: chatPrefs() });
+    if (hasAskKey || hasDebugSpawnKey || hasTitleModelKey || hasHideBuiltinKey || hasThemeKey || hasAutoKey) emitChanged('settings-changed');
+    res.json({ ...settingsState(), ...(await autoModelState()), chat: chatPrefs() });
   } catch (err) {
     // The setters throw only on an unusable path -> client error (400).
     return badRequest(res, err && err.message ? err.message : String(err));
@@ -2995,7 +3712,7 @@ app.post('/api/config', async (req, res) => {
 // validates model/effort against the effective catalog exactly like setStep
 // (configurable-models-design.md §4.5) -> 400; setFeedbackCycles still COERCES
 // maxCycles to >= 1 (it never throws).
-// body: { projectDir, workflowId, nodes?:{[id]:{model,effort}}, feedbacks?:{[id]:{maxCycles}}, wires?:{[wireId]:{maxCycles}}, activeWorkflowId? }
+// body: { projectDir, workflowId, nodes?:{[id]:{model,effort}}, feedbacks?:{[id]:{maxCycles}}, wires?:{[wireId]:{maxCycles}}, activeWorkflowId?, humanInLoop? }
 // ---------------------------------------------------------------------------
 app.patch('/api/config', async (req, res) => {
   const body = req.body || {};
@@ -3045,6 +3762,7 @@ app.patch('/api/config', async (req, res) => {
       if (!isSafeWorkflowId(active)) return badRequest(res, 'invalid workflowId');
       await setActiveWorkflow(projectDir, active);
     }
+    if (typeof body.humanInLoop === 'boolean') await setHumanInLoop(projectDir, body.humanInLoop);
     const config = await readRunConfig(projectDir);
     res.json({ config });
   } catch (err) {
@@ -3416,9 +4134,9 @@ app.get('/api/workflows', async (req, res) => {
       const all = await listWorkflows({ includeArchived: true });
       return res.json({ workflows: all.filter((w) => w.archivedAt) });
     }
-    // CONTRACT: [ GRAPH_DEFAULT_WORKFLOW, ...listWorkflows() ]. The built-in is
-    // never a persisted row (listWorkflows filters its id), so it cannot appear twice.
-    res.json({ workflows: [GRAPH_DEFAULT_WORKFLOW, ...(await listWorkflows())] });
+    // CONTRACT: [ GRAPH_DEFAULT_WORKFLOW, GRAPH_MEMORY_DEFRAG_WORKFLOW, ...listWorkflows() ]. The
+    // built-ins are never persisted rows (listWorkflows filters their ids), so none appears twice.
+    res.json({ workflows: [GRAPH_DEFAULT_WORKFLOW, GRAPH_MEMORY_DEFRAG_WORKFLOW, ...(await listWorkflows())] });
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
@@ -3529,6 +4247,7 @@ app.delete('/api/workflows/:id', async (req, res) => {
   const id = req.params.id;
   // The built-in default is not in the user store and must never be deleted.
   if (id === 'wf_default') return badRequest(res, 'the default workflow cannot be deleted');
+  if (id === MEMORY_DEFRAG_WORKFLOW_ID) return badRequest(res, 'the Memory defragment workflow cannot be deleted');
   try {
     const removed = await deleteWorkflow(id); // CONV-1: await
     if (!removed) return res.status(404).json({ error: 'workflow not found' });
@@ -3715,12 +4434,58 @@ const askJobs = new Map();      // threadId -> {turn, messageId, userMessageId,
 const askDeleting = new Set();
 const askFollowers = new Map(); // threadId -> Set<{detach}>
 const ASK_JOB_MAX_BUFFER = 5000; // same arithmetic as MAX_BUFFER: deltas dominate; eviction ⇒ client seq-gap re-sync
+const askDeferred = new Map();  // threadId → Array<() => Promise>: workflow-card event turns that arrived while a turn was running (PD5/PD26), FIFO
+
+/** A `role:'system'` notice row + its broadcast — the shape attachAskFollower posts. */
+function postAskSystemNotice(threadId, text) {
+  try {
+    const m = askAppendMessage(threadId, { role: 'system', text, blocks: [{ kind: 'notice', text }] });
+    broadcast({ type: 'ask-message', threadId, message: m });
+  } catch { /* thread deleted */ }
+}
+
+/**
+ * Start the oldest queued workflow-card event turn (PD26). A starter resolves {ok:false,status,error}
+ * — it never throws — when the reservation fails at START time (403: the turn the user waited on spent
+ * the last of the total cost window, `_complete` writes the ledger BEFORE `_emit('done')`; 429: the
+ * global cap; 409: a typed message won the race). A failed starter posts a system notice and the NEXT
+ * one is tried; a started turn's own settleJob drains the rest. The queue is re-read per iteration: a
+ * starter pushed while `await next()` ran lives in a fresh array (the queue is re-created after the
+ * delete below).
+ */
+async function drainAskDeferred(threadId) {
+  for (;;) {
+    const queue = askDeferred.get(threadId);
+    if (!queue || !queue.length) return;
+    const next = queue.shift();
+    if (!queue.length) askDeferred.delete(threadId);
+    let r = null;
+    try { r = await next(); } catch (e) { r = { ok: false, error: e && e.message ? e.message : String(e) }; }
+    if (r && r.ok) return;                                        // its settleJob continues the chain
+    postAskSystemNotice(threadId, `Ask Worca could not reply to the workflow card: ${(r && r.error) || 'unknown error'}`);
+  }
+}
 
 function askInFlight(threadId) {
   const job = askJobs.get(threadId);
   return job && job.status === 'running' ? job : null;
 }
 
+/** How many live runs this thread still follows: undetached followers (askFollowers is the truth, the way
+ *  askInFlight reads askJobs — ask_run_links.status is written BY the follower and stays `running` across a
+ *  restart that dropped every follower) whose runs-Map entry exists and has not settled. */
+function askTrackingCount(threadId) {
+  const set = askFollowers.get(threadId);
+  if (!set) return 0;
+  let n = 0;
+  for (const f of set) {
+    if (f.detached) continue;
+    const entry = liveRunEntry(f.runId);
+    if (entry && !SETTLED_RUN.has(String(entry.status || ''))) n += 1;
+  }
+  return n;
+}
+
 function askRunningCount() {
   let n = 0;
   for (const job of askJobs.values()) if (job.status === 'running') n += 1;
@@ -3793,7 +4558,10 @@ app.get('/api/ask/threads', (req, res) => {
   try {
     const raw = Number.parseInt(String(req.query.limit ?? ''), 10);
     const limit = Number.isInteger(raw) && raw > 0 ? Math.min(raw, 200) : 50;
-    const threads = askListThreads({ limit }).map((t) => ({ ...t, inFlight: !!askInFlight(t.id) }));
+    const threads = askListThreads({ limit }).map((t) => {
+      const trackingRuns = askTrackingCount(t.id);
+      return { ...t, inFlight: !!askInFlight(t.id), tracking: trackingRuns > 0, trackingRuns };
+    });
     // total = EVERY saved chat (the History popover's meter), not the capped page above.
     res.json({ threads, total: askCountThreads() });
   } catch (err) {
@@ -3884,6 +4652,21 @@ app.get('/api/ask/threads/:id', (req, res) => {
   }
 });
 
+// Ask Worca progress card hydration (plan D9): the run's detail state by pipeline id OR live run id, no store key.
+const ASK_RUN_REF_RE = /^(?:[0-9a-f]{8}|[0-9a-zA-Z-]{9,64})$/;
+app.get('/api/ask/runs/:id', (req, res) => {
+  const id = String(req.params.id || '');
+  if (!ASK_RUN_REF_RE.test(id)) return res.status(400).json({ error: 'invalid run id' });
+  try {
+    const entry = liveRunEntry(id);
+    const state = readPipelineStateById(entry && entry.pipelineId ? entry.pipelineId : id);
+    if (!state) return res.status(404).json({ error: 'run not found' });
+    res.json({ state, live: entry ? { runId: entry.id, status: entry.status } : null });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 app.patch('/api/ask/threads/:id', (req, res) => {
   const id = askIdParam(res, req.params.id, 'thread');
   if (!id) return;
@@ -3929,6 +4712,9 @@ app.patch('/api/ask/threads/:id', (req, res) => {
 // Returns { deleted, worktrees } — worktrees = rows removeThreadWorktrees removed.
 async function deleteAskThreadFully(id) {
   askDeleting.add(id);
+  // Outside the `if (job)` block below: a thread deleted while it had a queued
+  // event turn but no live job entry would otherwise keep its queue forever.
+  askDeferred.delete(id);
   try {
     const stopJob = () => {
       const job = askJobs.get(id);
@@ -4098,6 +4884,12 @@ function askValidateScope(raw) {
   return { ok: true, scope: { pinned: true, [keys[0]]: cv.context[keys[0]] } };
 }
 
+/** The system prompt of ONE Ask turn: the rules and the catalog, byte-stable. Memory is mounted,
+ *  not rendered (native-rules revision) — see createAskTurn's memoryProject. */
+async function askSystemPromptFor(catalog) {
+  return askBuildSystemPrompt(catalog);
+}
+
 /** Resolve the VALIDATED client context into the server-side shape
  *  buildContextHeader consumes (§6.5: server-resolved rows only — never
  *  client-supplied titles or paths). Every lookup is individually guarded:
@@ -4130,6 +4922,18 @@ async function resolveAskContext(threadId, ctx = {}, listedAttachments = [], cur
       }
     }
   } catch { /* absent line */ }
+  // The Team metrics page's selection (validated slugs); only the scope NAME is resolved here.
+  try {
+    if (ctx.tmScope) {
+      const [kind, tmId] = ctx.tmScope.split(':');
+      let name = null;
+      if (kind === 'project') name = (await listProjects()).find((x) => x.key === tmId)?.name ?? null;
+      else if (kind === 'workspace') name = (await readWorkspace(tmId))?.name ?? null;
+      if (name != null) {
+        out.teamMetrics = { kind, id: tmId, name, range: ctx.tmRange || 'this-month', groupBy: ctx.tmGroupBy || null, filter: ctx.tmFilter || null };
+      }
+    }
+  } catch { /* absent line */ }
   try {
     if (ctx.pipelineId) {
       const key = ctx.workspaceId ? `workspaces/${ctx.workspaceId}` : out.project?.key;
@@ -4159,12 +4963,24 @@ async function resolveAskContext(threadId, ctx = {}, listedAttachments = [], cur
     for (const m of askListMessages(threadId)) {
       if (!Array.isArray(m.blocks)) continue;
       for (const b of m.blocks) {
-        if (b && b.kind === 'card') {
-          cards.push({
+        if (!(b && b.kind === 'card')) continue;
+        // P3 (PD25): a workflow card names the workflow it proposes and only owns a
+        // workflowId once the user saved it; a run card keeps its pre-P3 line byte for byte.
+        const wf = !!(b.card && b.card.type === 'workflow');
+        if (wf && b.state === 'building') continue;   // transient (no name yet) — never worth a header line
+        if (b.card && b.card.type === 'metrics') {
+          cards.push({ id: b.id, type: 'metrics', state: b.state, summary: b.card.summary || '' });
+          continue;
+        }
+        cards.push(wf
+          ? {
+            id: b.id, type: 'workflow', state: b.state, name: (b.card && b.card.name) || '',
+            workflowId: b.workflowId || null, targetName: (b.card && b.card.projectName) || '',
+          }
+          : {
             id: b.id, state: b.state, workflowId: b.card && b.card.workflowId,
             targetName: (b.card && (b.card.projectName || b.card.workspaceName)) || '',
           });
-        }
       }
     }
     if (cards.length) out.cards = cards.slice(-ASK_LIMITS.headerCards);
@@ -4189,7 +5005,164 @@ function mockAskCard(ctx = {}, text = '') {
   const target = ctx.workspaceId
     ? { workspaceId: ctx.workspaceId }
     : { projectKey: ctx.projectKey || 'mock-project-00000000' };
-  return { ...target, workflowId: 'wf_default', guardrailsId: 'normal', brief: text.slice(0, 200) || 'Mock run' };
+  return { ...target, workflowId: 'wf_default', guardrailsId: 'normal', brief: text.slice(0, 200) || 'Mock run',
+    note: 'Mock proposal — a fixed shape so the offline card can be exercised.' };
+}
+
+/**
+ * The ONE turn starter (spec §8.4): the typed-message route and the workflow-card event path both land here.
+ * SYNCHRONOUS until the first write — the §6.2.2 guards + the slot reservation run before any await, so two callers
+ * cannot interleave (the route's earlier checks are only the fast-path 4xx). Resolves {ok:false,status,error} for the
+ * 403/409/429 cases the message route maps to HTTP; {ok:true,…} once the turn is running.
+ * @param {{threadId:string, thread:object, ctx:object, model:string, effort:string, text:string,
+ *          files?:Array, synthetic?:{notice:string}|null}} o
+ *   text      what the MODEL gets as the user message: the typed text, or the `[worca event] …` line (synthetic)
+ *   synthetic the user row renders as a notice (never a bubble) and never titles the thread (PD6)
+ */
+async function startAskTurn({ threadId: id, thread, ctx, model, effort, text, files = [], synthetic = null }) {
+  // §6.2.2 ATOMIC re-check + slot reservation. Today every await between the
+  // top 409/429 pair and here resolves in microtasks (validateModelEffort ->
+  // composeCatalog; askBuildCatalog -> three synchronous better-sqlite3
+  // reads), so the route is macrotask-atomic and two POSTs cannot interleave
+  // (empirically instrumented). The reservation is what keeps that true if
+  // any of those readers ever becomes genuinely async: it is synchronous —
+  // check-and-set cannot interleave — and runs BEFORE the first write, so a
+  // loser leaves no rows.
+  if (askDeleting.has(id)) return { ok: false, status: 409, error: 'thread is being deleted' };
+  if (askInFlight(id)) return { ok: false, status: 409, error: 'turn in flight' };
+  const budget = budgetStatus();                                                    // P3: the event path needs the same gate the route head applies
+  if (budget.blocked) return { ok: false, status: 403, error: 'total cost limit reached', budget };
+  if (askRunningCount() >= ASK_LIMITS.turnsGlobal) {
+    return { ok: false, status: 429, error: `at most ${ASK_LIMITS.turnsGlobal} turns may run at once` };
+  }
+  const prev = askJobs.get(id);
+  if (prev && prev.graceTimer) clearTimeout(prev.graceTimer); // atomic replace of a grace entry (§8.3)
+  const job = {
+    turn: null, messageId: null, userMessageId: null, // ids filled once the rows exist;
+    events: [], seq: 0, status: 'running',            // askHello()/GET inFlight skip a null messageId
+    startedAt: new Date().toISOString(), graceTimer: null,
+  };
+  askJobs.set(id, job);
+
+  let asstMsg = null;
+  let turn;
+  let echoAttachments = [];
+  try {
+    // Writes. Store the LAST context + model/effort on the thread (§6.5 tail, D8).
+    // `ctx` (pin-merged) rather than cv.context: the stored row is what restores
+    // the selector on reopen and what the MCP child reads for tool defaulting.
+    askUpdateThread(id, { context: ctx, model, effort });
+    // §7.4 — NOTHING is stamped on the row before the 202: the thread stays
+    // untitled (the header reads "Ask Worca") until the D13 background title
+    // announces itself. titleWasAuto gates that call: a title given at THREAD
+    // CREATION is the user's, and the haiku call must never fire for it
+    // (§17 Q&A 1). deterministicTitle is only the turn's fallback for an
+    // empty haiku result (turn.mjs _kickoffTitle), never written here.
+    const titleWasAuto = thread.title == null;
+    const deterministicTitle = titleWasAuto && !synthetic ? (askSanitizeTitle(text.slice(0, 80)) || 'New chat') : thread.title;
+    // P3: a synthetic row keeps the EVENT as its text (buildRestoredPrompt replays it truthfully) and carries the
+    // human notice as a block the panel renders instead of a bubble.
+    const userMsg = askAppendMessage(id, synthetic
+      ? { role: 'user', text, blocks: [{ kind: 'notice', synthetic: true, text: synthetic.notice }] }
+      : { role: 'user', text });
+    job.userMessageId = userMsg.id;
+    const attRows = files.map((f) => askAddAttachment(id, userMsg.id, { name: f.name, kind: f.kind, mime: f.mime, text: f.text, data: f.data }));
+    // The decoded binary bodies are on disk now. `files` is captured by this
+    // scope's closures (settleJob, the turn listeners, onOutOfTurn) for the whole
+    // turn plus jobGraceMs, so up to 25 MB of dead Buffers would otherwise stay
+    // reachable per running thread.
+    for (const f of files) f.data = null;
+    echoAttachments = attRows.map((a) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime }));
+    if (attRows.length) {
+      // `kind` is the BLOCK kind, so the attachment's own kind rides as attKind
+      // (the UI keys image thumbnails off it, #398).
+      // P3: keep the synthetic notice in front of the attachment blocks (unreachable today — event turns pass no files — but
+      // an unconditional overwrite would silently drop the notice for a future caller).
+      askSetMessageBlocks(userMsg.id, [
+        ...(synthetic ? [{ kind: 'notice', synthetic: true, text: synthetic.notice }] : []),
+        ...attRows.map((a) => ({ kind: 'attachment', id: a.id, name: a.name, bytes: a.bytes, attKind: a.kind, mime: a.mime })),
+      ]);
+    }
+    broadcast({ type: 'ask-message', threadId: id, message: askGetMessage(userMsg.id) }); // echo for other tabs
+    asstMsg = askAppendMessage(id, { role: 'assistant', text: '', status: 'streaming', model, effort });
+    job.messageId = asstMsg.id;
+
+    // Prompt assembly (§6.5) — the route owns it; the turn only spawns. The header context
+    // resolves the project FIRST so the turn can mount its memory (native rules).
+    const catalog = await askBuildCatalog();
+    const withText = attRows.map((a, i) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime, text: files[i].text }));
+    const { inline, listed } = askSelectInlineAttachments(withText);
+    const headerCtx = await resolveAskContext(id, ctx, listed, userMsg.id);
+    const systemPrompt = await askSystemPromptFor(catalog);
+    const header = askBuildContextHeader(headerCtx);
+    const prompt = askBuildTurnPrompt(header, text, inline);
+    const prior = askListMessages(id).filter((m) => m.seq < userMsg.seq);
+    const restoredPrompt = askBuildRestoredPrompt(prior, prompt);
+    const attachmentNames = {};
+    for (const a of askListAttachments(id)) attachmentNames[a.id] = a.name;
+
+    turn = createAskTurn({
+      threadId: id, assistantMessageId: asstMsg.id, userMessageId: userMsg.id,
+      prompt, systemPrompt, restoredPrompt,
+      model, effort,
+      resumeSessionId: thread.sessionId || null,
+      firstTurn: !synthetic && userMsg.seq === 1 && titleWasAuto, // P3: an event never titles the thread (D13 guard kept)
+      firstText: text,
+      deterministicTitle,
+      pinnedScope: askPinnedScope(ctx),             // #397: proposal defaulting + mismatch flag
+      memoryProject: headerCtx.project ? { key: headerCtx.project.key, name: headerCtx.project.name || '' } : null,   // native-rules revision: the turn mounts global + this project through --add-dir
+      mock: mockEnabled({}) ? { card: mockAskCard(ctx, text) } : null, // R-F
+      attachmentNames,
+      deps: {
+        onFrame: stampAskFrames(id, job),
+        onOutOfTurn: (f) => broadcast({ ...f, threadId: id }),
+        onCommentMutation: ({ runId }) => { emitDiffCommentsChanged(runId); },
+        onWorktreeMutation: () => { emitAskWorktrees(id); },
+        // A remember/forget in the MCP child is the same scope change a REST write makes (B29).
+        // The key is parsed out of worca's OWN tool result, never written by the model; shape-check
+        // it anyway before it rides a broadcast (I2-#22).
+        onMemoryMutation: ({ scope }) => {
+          if (scope === 'global' || (typeof scope === 'string' && scope.startsWith('projects/') && PROJECT_KEY_RE.test(scope.slice('projects/'.length)))) emitMemoryChanged(scope);
+        },
+        trackRun: (input, { pin } = {}) => askTrackRun(id, input, pin ?? null),
+      },
+    });
+    job.turn = turn;
+  } catch (err) {
+    // A write/assembly failure must release the reserved slot and never leave
+    // a `streaming` row for the boot sweep to find.
+    if (askJobs.get(id) === job) askJobs.delete(id);
+    if (asstMsg) {
+      try {
+        askFinishMessage(asstMsg.id, {
+          text: '', blocks: [{ kind: 'notice', text: 'failed to start the turn' }],
+          status: 'error', reason: null, usage: null, costUsd: null, durationMs: null,
+        });
+      } catch { /* thread gone */ }
+    }
+    return { ok: false, status: 500, error: err && err.message ? err.message : String(err) };
+  }
+  const settleJob = (status) => {
+    if (askJobs.get(id) !== job) return;
+    job.status = status;
+    job.graceTimer = setTimeout(() => {
+      if (askJobs.get(id) === job) askJobs.delete(id);
+    }, ASK_LIMITS.jobGraceMs);
+    job.graceTimer.unref?.();
+    // P3 (PD5/PD26): the workflow-card events that arrived while this turn ran start now — status is already terminal,
+    // so askInFlight() is null and the starter's own reservation succeeds; the started turn's settleJob continues the chain.
+    Promise.resolve().then(() => drainAskDeferred(id)).catch((e) => console.error(`[worca-ui] deferred ask turn failed: ${e && e.message ? e.message : e}`));
+  };
+  turn.on('done', () => settleJob('done'));
+  turn.on('error', () => settleJob('error'));
+  // Fire-and-forget with a backstop (startAgentGen shape) — run() never throws.
+  Promise.resolve()
+    .then(() => turn.run())
+    .catch((err) => {
+      console.error(`[worca-ui] ask turn crashed: ${err && err.message ? err.message : err}`);
+      settleJob('error');
+    });
+  return { ok: true, job, userMessageId: job.userMessageId, assistantMessageId: job.messageId, attachments: echoAttachments };
 }
 
 app.post('/api/ask/threads/:id/messages', async (req, res) => {
@@ -4270,133 +5243,15 @@ app.post('/api/ask/threads/:id/messages', async (req, res) => {
       }
     }
 
-    // §6.2.2 ATOMIC re-check + slot reservation. Today every await between the
-    // top 409/429 pair and here resolves in microtasks (validateModelEffort ->
-    // composeCatalog; askBuildCatalog -> three synchronous better-sqlite3
-    // reads), so the route is macrotask-atomic and two POSTs cannot interleave
-    // (empirically instrumented). The reservation is what keeps that true if
-    // any of those readers ever becomes genuinely async: it is synchronous —
-    // check-and-set cannot interleave — and runs BEFORE the first write, so a
-    // loser leaves no rows.
-    if (askDeleting.has(id)) return res.status(409).json({ error: 'thread is being deleted' });
-    if (askInFlight(id)) return res.status(409).json({ error: 'turn in flight' });
-    if (askRunningCount() >= ASK_LIMITS.turnsGlobal) {
-      return res.status(429).json({ error: `at most ${ASK_LIMITS.turnsGlobal} turns may run at once` });
-    }
-    const prev = askJobs.get(id);
-    if (prev && prev.graceTimer) clearTimeout(prev.graceTimer); // atomic replace of a grace entry (§8.3)
-    const job = {
-      turn: null, messageId: null, userMessageId: null, // ids filled once the rows exist;
-      events: [], seq: 0, status: 'running',            // askHello()/GET inFlight skip a null messageId
-      startedAt: new Date().toISOString(), graceTimer: null,
-    };
-    askJobs.set(id, job);
-
-    let asstMsg = null;
-    let turn;
-    let echoAttachments = [];
-    try {
-      // Writes. Store the LAST context + model/effort on the thread (§6.5 tail, D8).
-      // `ctx` (pin-merged) rather than cv.context: the stored row is what restores
-      // the selector on reopen and what the MCP child reads for tool defaulting.
-      askUpdateThread(id, { context: ctx, model: mv.model, effort: mv.effort });
-      // §7.4 — NOTHING is stamped on the row before the 202: the thread stays
-      // untitled (the header reads "Ask Worca") until the D13 background title
-      // announces itself. titleWasAuto gates that call: a title given at THREAD
-      // CREATION is the user's, and the haiku call must never fire for it
-      // (§17 Q&A 1). deterministicTitle is only the turn's fallback for an
-      // empty haiku result (turn.mjs _kickoffTitle), never written here.
-      const titleWasAuto = thread.title == null;
-      const deterministicTitle = titleWasAuto ? (askSanitizeTitle(text.slice(0, 80)) || 'New chat') : thread.title;
-      const userMsg = askAppendMessage(id, { role: 'user', text });
-      job.userMessageId = userMsg.id;
-      const attRows = files.map((f) => askAddAttachment(id, userMsg.id, { name: f.name, kind: f.kind, mime: f.mime, text: f.text, data: f.data }));
-      // The decoded binary bodies are on disk now. `files` is captured by this
-      // scope's closures (settleJob, the turn listeners, onOutOfTurn) for the whole
-      // turn plus jobGraceMs, so up to 25 MB of dead Buffers would otherwise stay
-      // reachable per running thread.
-      for (const f of files) f.data = null;
-      echoAttachments = attRows.map((a) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime }));
-      if (attRows.length) {
-        // `kind` is the BLOCK kind, so the attachment's own kind rides as attKind
-        // (the UI keys image thumbnails off it, #398).
-        askSetMessageBlocks(userMsg.id, attRows.map((a) => ({ kind: 'attachment', id: a.id, name: a.name, bytes: a.bytes, attKind: a.kind, mime: a.mime })));
-      }
-      broadcast({ type: 'ask-message', threadId: id, message: askGetMessage(userMsg.id) }); // echo for other tabs
-      asstMsg = askAppendMessage(id, { role: 'assistant', text: '', status: 'streaming', model: mv.model, effort: mv.effort });
-      job.messageId = asstMsg.id;
-
-      // Prompt assembly (§6.5) — the route owns it; the turn only spawns.
-      const catalog = await askBuildCatalog();
-      const systemPrompt = askBuildSystemPrompt(catalog);
-      const withText = attRows.map((a, i) => ({ id: a.id, name: a.name, bytes: a.bytes, kind: a.kind, mime: a.mime, text: files[i].text }));
-      const { inline, listed } = askSelectInlineAttachments(withText);
-      const headerCtx = await resolveAskContext(id, ctx, listed, userMsg.id);
-      const header = askBuildContextHeader(headerCtx);
-      const prompt = askBuildTurnPrompt(header, text, inline);
-      const prior = askListMessages(id).filter((m) => m.seq < userMsg.seq);
-      const restoredPrompt = askBuildRestoredPrompt(prior, prompt);
-      const attachmentNames = {};
-      for (const a of askListAttachments(id)) attachmentNames[a.id] = a.name;
-
-      turn = createAskTurn({
-        threadId: id, assistantMessageId: asstMsg.id, userMessageId: userMsg.id,
-        prompt, systemPrompt, restoredPrompt,
-        model: mv.model, effort: mv.effort,
-        resumeSessionId: thread.sessionId || null,
-        firstTurn: userMsg.seq === 1 && titleWasAuto, // D13 guard: never replace a user-authored title
-        firstText: text,
-        deterministicTitle,
-        pinnedScope: askPinnedScope(ctx),             // #397: proposal defaulting + mismatch flag
-        mock: mockEnabled({}) ? { card: mockAskCard(ctx, text) } : null, // R-F
-        attachmentNames,
-        deps: {
-          onFrame: stampAskFrames(id, job),
-          onOutOfTurn: (f) => broadcast({ ...f, threadId: id }),
-          onCommentMutation: ({ runId }) => { emitDiffCommentsChanged(runId); },
-          onWorktreeMutation: () => { emitAskWorktrees(id); },
-        },
-      });
-      job.turn = turn;
-    } catch (err) {
-      // A write/assembly failure must release the reserved slot and never leave
-      // a `streaming` row for the boot sweep to find.
-      if (askJobs.get(id) === job) askJobs.delete(id);
-      if (asstMsg) {
-        try {
-          askFinishMessage(asstMsg.id, {
-            text: '', blocks: [{ kind: 'notice', text: 'failed to start the turn' }],
-            status: 'error', reason: null, usage: null, costUsd: null, durationMs: null,
-          });
-        } catch { /* thread gone */ }
-      }
-      return res.status(500).json({ error: err && err.message ? err.message : String(err) });
-    }
-    const settleJob = (status) => {
-      if (askJobs.get(id) !== job) return;
-      job.status = status;
-      job.graceTimer = setTimeout(() => {
-        if (askJobs.get(id) === job) askJobs.delete(id);
-      }, ASK_LIMITS.jobGraceMs);
-      job.graceTimer.unref?.();
-    };
-    turn.on('done', () => settleJob('done'));
-    turn.on('error', () => settleJob('error'));
-    // Fire-and-forget with a backstop (startAgentGen shape) — run() never throws.
-    Promise.resolve()
-      .then(() => turn.run())
-      .catch((err) => {
-        console.error(`[worca-ui] ask turn crashed: ${err && err.message ? err.message : err}`);
-        settleJob('error');
-      });
+    const r = await startAskTurn({ threadId: id, thread, ctx, model: mv.model, effort: mv.effort, text, files });
+    if (!r.ok) return res.status(r.status).json({ error: r.error, ...(r.budget ? { budget: r.budget } : {}) });
     // `attachments` carries the store-minted ids so the sender's own echo can key
     // image thumbnails and the thread budget off them (the ask-message broadcast
     // may have raced ahead of this response, or been missed on a brand-new thread).
-    res.status(202).json({ userMessageId: job.userMessageId, assistantMessageId: job.messageId, attachments: echoAttachments });
+    res.status(202).json({ userMessageId: r.userMessageId, assistantMessageId: r.assistantMessageId, attachments: r.attachments });
   } catch (err) {
-    // Only pre-reservation throws land here (`job` is block-scoped to the outer
-    // try and every post-reservation failure returned from the inner catch), so
-    // there is no slot to release.
+    // startAskTurn never throws (it returns {ok:false,…}); only the route's own
+    // pre-checks can land here, so there is no slot to release.
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
 });
@@ -4423,7 +5278,11 @@ function flipCard(threadId, cardId, patch) {
   const block = askUpdateCardBlock(threadId, cardId, patch);
   if (!block) return null;
   const job = askInFlight(threadId);
-  const live = job && job.turn && job.turn.reducer ? job.turn.reducer.updateBlock(cardId, patch) : null;
+  // The store SHALLOW-merges `patch.card` on a workflow card; the reducer's
+  // updateBlock replaces `card` wholesale — hand it the MERGED one (PD23),
+  // else the live frame loses every key this patch did not name.
+  const livePatch = patch && patch.card ? { ...patch, card: block.card } : patch;
+  const live = job && job.turn && job.turn.reducer ? job.turn.reducer.updateBlock(cardId, livePatch) : null;
   if (!live) {
     const found = askFindCard(threadId, cardId);
     if (found) broadcast({ type: 'ask-message', threadId, message: found.message });
@@ -4431,27 +5290,197 @@ function flipCard(threadId, cardId, patch) {
   return block;
 }
 
-// D14 dismiss ("Not now" keeps a stub — the client renders state:'dismissed').
-app.post('/api/ask/threads/:id/cards/:cardId', (req, res) => {
+// Card ids with a Save in flight: the mint + the row write await, so the
+// `state === 'proposed'` check alone would let two Saves both pass and write two rows.
+const askCardBusy = new Set();
+
+/** Save a PROPOSED workflow card: adopt the twin (nothing written) or write a new origin:'auto' row (spec §8.4, PD9). */
+async function saveWorkflowCard(threadId, block, body = {}) {
+  const card = block.card || {};
+  const registry = loadAgentRegistry(AGENTS_DIR);
+  const models = await listModels('');
+  // A non-string `name` would be stringified by cleanText ("[object Object]" as the
+  // workflow name) — only a string counts; anything else falls back to the card's own.
+  const ans = sanitizeProposalAnswer(
+    { decision: 'accept', name: typeof body.name === 'string' ? body.name : undefined, nodes: body.nodes },
+    { proposal: card, models, registry },
+  ) || { name: card.name, nodes: {} };
+  let workflowId; let name; let matched = false; let nodes = card.nodes;
+  // `card.match` is a snapshot from proposal time; a row archived or deleted since
+  // (composer delete) must not be "adopted" as a dangling id — re-check it still
+  // reads (readWorkflow returns null for archived/missing rows; wf_default always reads).
+  if (card.match && card.match.id && (await readWorkflow(card.match.id))) {
+    workflowId = card.match.id; name = card.match.name; matched = true;   // adopt: name/nodes ignored, row untouched
+  } else {
+    const r = await revalidateWorkflowProposal({
+      shape: { ...card.shape, name: ans.name }, projectKey: card.projectKey, models, registry,
+    });
+    if (r.match) { workflowId = r.match.id; name = r.match.name; matched = true; }   // a twin appeared since the proposal
+    else {
+      name = ans.name;
+      workflowId = await mintAutoWorkflowId(name, async (wid) => !!(await readWorkflow(wid, { includeArchived: true })));
+      await writeGraphWorkflow({ ...applyTunables(r.template, ans.nodes), id: workflowId, name, domain: 'coding', origin: 'auto' });
+      nodes = { ...(card.nodes || {}) };
+      for (const [nid, sel] of Object.entries(ans.nodes)) nodes[nid] = { ...(nodes[nid] || {}), ...sel };
+    }
+  }
+  // `adopted` tells the saved card which line to show ("Uses your saved workflow"
+  // vs "Saved as a new workflow, tagged Auto") — card.match is set on BOTH paths.
+  const flipped = flipCard(threadId, block.id, {
+    state: 'saved', workflowId, card: { name, nodes, match: { id: workflowId, name }, adopted: matched },
+  });
+  return { block: flipped, workflowId, name, matched };
+}
+
+/**
+ * The IMMEDIATE twin of drainAskDeferred's failure arm (PD29). The route answers the
+ * flip and `turn:{error,status}` in one 200, but by then the flip frame has already
+ * rebuilt the card element in every tab, so the panel's inline "Ask Worca could not
+ * reply" lands on a detached node and the human sees a saved card and no reply at all.
+ * The system notice row is the only channel that survives the rebuild; the response
+ * keeps `turn.error` for API clients.
+ */
+function failedEventTurn(threadId, turn) {
+  postAskSystemNotice(threadId, `Ask Worca could not reply to the workflow card: ${turn.error || 'unknown error'}`);
+  return turn;
+}
+
+/** Store the synthetic user-row notice and start (or queue) the assistant turn whose prompt is the event (spec §8.4, PD5/PD6/PD26). */
+async function startWorkflowEventTurn(threadId, block, { declined = false, thenRun = false } = {}) {
+  const thread = askGetThread(threadId);
+  if (!thread) return null;
+  const card = block.card || {};
+  const state = declined ? 'declined' : 'saved';
+  const text = workflowEventPrompt({
+    cardId: block.id, state, workflowId: block.workflowId, name: card.name, thenRun, projectKey: card.projectKey || '',
+  });
+  const notice = workflowNoticeText({ state, name: card.name, matched: !declined && card.adopted === true, thenRun });
+  let mv = await validateModelEffort(thread.model, thread.effort);
+  if (!mv.ok) {
+    const d = (await askCatalog({ withSecrets: false })).default;
+    if (!d) return failedEventTurn(threadId, { error: 'no model available', status: 503 });
+    mv = { ok: true, ...d };
+  }
+  const start = () => startAskTurn({
+    threadId, thread: askGetThread(threadId) || thread, ctx: thread.context || {},
+    model: mv.model, effort: mv.effort, text, synthetic: { notice },
+  });
+  if (askInFlight(threadId)) {
+    // PD5/PD26: the flip stands and the reply waits — settleJob drains the queue
+    // when the running turn ends, and a starter that cannot reserve a slot then
+    // posts a system notice rather than vanishing.
+    if (!askDeferred.has(threadId)) askDeferred.set(threadId, []);
+    askDeferred.get(threadId).push(start);
+    return { deferred: true };
+  }
+  const r = await start();
+  if (r.ok) return { assistantMessageId: r.assistantMessageId };
+  return failedEventTurn(threadId, { error: r.error, status: r.status, ...(r.budget ? { budget: r.budget } : {}) });
+}
+
+/** The metrics card's event turn: the synthetic notice row + the "[worca event] metrics card …" prompt (same queueing as workflow cards). */
+async function startMetricsEventTurn(threadId, block) {
+  const thread = askGetThread(threadId);
+  if (!thread) return null;
+  const card = block.card || {};
+  const state = block.state === 'declined' ? 'declined' : block.state === 'failed' ? 'failed' : 'applied';
+  const result = card.result || null;
+  const text = metricsEventPrompt({ cardId: block.id, state, card, result });
+  const notice = metricsNoticeText({ state, card, result });
+  let mv = await validateModelEffort(thread.model, thread.effort);
+  if (!mv.ok) {
+    const d = (await askCatalog({ withSecrets: false })).default;
+    if (!d) return failedEventTurn(threadId, { error: 'no model available', status: 503 });
+    mv = { ok: true, ...d };
+  }
+  const start = () => startAskTurn({
+    threadId, thread: askGetThread(threadId) || thread, ctx: thread.context || {},
+    model: mv.model, effort: mv.effort, text, synthetic: { notice },
+  });
+  if (askInFlight(threadId)) {
+    if (!askDeferred.has(threadId)) askDeferred.set(threadId, []);
+    askDeferred.get(threadId).push(start);
+    return { deferred: true };
+  }
+  const r = await start();
+  if (r.ok) return { assistantMessageId: r.assistantMessageId };
+  return failedEventTurn(threadId, { error: r.error, status: r.status, ...(r.budget ? { budget: r.budget } : {}) });
+}
+
+// D14 dismiss ("Not now" keeps a stub — the client renders state:'dismissed') for a RUN card;
+// the workflow-card state machine (spec §8.4) for a workflow one. The card is looked up BEFORE
+// the body is validated because the legal verb set depends on the card's type.
+app.post('/api/ask/threads/:id/cards/:cardId', async (req, res) => {
   const id = askIdParam(res, req.params.id, 'thread');
   if (!id) return;
   const cardId = askIdParam(res, req.params.cardId, 'card');
   if (!cardId) return;
   try {
     if (!askGetThread(id)) return res.status(404).json({ error: 'thread not found' });
-    if ((req.body || {}).state !== 'dismissed') return badRequest(res, 'state must be "dismissed"');
+    const body = req.body || {};
     const found = askFindCard(id, cardId);
     if (!found) return res.status(404).json({ error: 'card not found' });
-    if (found.block.state !== 'proposed') {
-      return res.status(409).json({ error: `card is ${found.block.state}` });
+    if (found.block.card && found.block.card.type === 'metrics') {
+      // Metrics card (docs/team-metrics.md "Ask Worca"): proposed → applied | failed | declined. The change is
+      // the outward-facing part — a branch on origin, a marker on another repo, this machine's switch, the
+      // workspace's home — so it happens HERE, behind the click, never in the model's tool.
+      if (body.state !== 'applied' && body.state !== 'declined') return badRequest(res, 'state must be "applied" or "declined"');
+      if (found.block.state !== 'proposed') return res.status(409).json({ error: `card is ${found.block.state}` });
+      if (askCardBusy.has(cardId)) return res.status(409).json({ error: 'card is being applied' });
+      if (body.state === 'declined') {
+        const block = flipCard(id, cardId, { state: 'declined' });
+        if (!block) return res.status(409).json({ error: 'card vanished' });
+        const turn = await startMetricsEventTurn(id, block);
+        return res.json({ block, turn });
+      }
+      askCardBusy.add(cardId);
+      let block;
+      try {
+        let result;
+        try { result = await applyMetricsChange(found.block.card); }
+        catch (err) {
+          result = { ok: false, error: err && err.message ? err.message : String(err), code: (err && err.code) || 'ERROR', ...(err && err.hint ? { hint: err.hint } : {}), ...(err && err.stderr ? { stderr: String(err.stderr).slice(0, 2000) } : {}) };
+        }
+        block = flipCard(id, cardId, result.ok ? { state: 'applied', card: { result } } : { state: 'failed', error: result.error, card: { result } });
+      } finally { askCardBusy.delete(cardId); }
+      if (!block) return res.status(409).json({ error: 'card vanished' });
+      const turn = await startMetricsEventTurn(id, block);
+      return res.json({ block, turn });
+    }
+    if (!(found.block.card && found.block.card.type === 'workflow')) {
+      if (body.state !== 'dismissed') return badRequest(res, 'state must be "dismissed"');
+      if (found.block.state !== 'proposed') {
+        return res.status(409).json({ error: `card is ${found.block.state}` });
+      }
+      const block = flipCard(id, cardId, { state: 'dismissed' });
+      // Dismiss is terminal: the card's parked comment ids can never reach a run,
+      // so drop them here exactly as the launch path does at its own success point
+      // (:1155). Own try/catch — comment bookkeeping must never fail the dismiss.
+      try { clearPendingCardComments(cardId); }
+      catch (e) { console.error('[diff-comments] dismiss cleanup failed:', e && e.message ? e.message : e); }
+      return res.json({ block });
+    }
+    // Workflow card state machine (spec §8.4): proposed → saved | declined. A saved card has no
+    // verb — its event turn proposes the run itself (thenRun) or offers one in chat.
+    if (body.state !== 'saved' && body.state !== 'declined') {
+      return badRequest(res, 'state must be "saved" or "declined"');
     }
-    const block = flipCard(id, cardId, { state: 'dismissed' });
-    // Dismiss is terminal: the card's parked comment ids can never reach a run,
-    // so drop them here exactly as the launch path does at its own success point
-    // (:1155). Own try/catch — comment bookkeeping must never fail the dismiss.
-    try { clearPendingCardComments(cardId); }
-    catch (e) { console.error('[diff-comments] dismiss cleanup failed:', e && e.message ? e.message : e); }
-    res.json({ block });
+    if (found.block.state !== 'proposed') return res.status(409).json({ error: `card is ${found.block.state}` });
+    if (askCardBusy.has(cardId)) return res.status(409).json({ error: 'card is being saved' });
+    if (body.state === 'declined') {
+      const block = flipCard(id, cardId, { state: 'declined' });
+      if (!block) return res.status(409).json({ error: 'card vanished' });   // the thread was deleted between the lookup and the flip
+      const turn = await startWorkflowEventTurn(id, block, { declined: true });
+      return res.json({ block, turn });
+    }
+    askCardBusy.add(cardId);
+    let saved;
+    try { saved = await saveWorkflowCard(id, found.block, body); }
+    finally { askCardBusy.delete(cardId); }
+    // flipCard() null — the row (if written) stays, the card is gone with its thread.
+    if (!saved.block) return res.status(409).json({ error: 'card vanished' });
+    const turn = await startWorkflowEventTurn(id, saved.block, { thenRun: !!found.block.card.thenRun });
+    res.json({ block: saved.block, turn });
   } catch (err) {
     res.status(500).json({ error: err && err.message ? err.message : String(err) });
   }
@@ -5247,6 +6276,86 @@ app.post('/api/pipelines/:id/report-result', async (req, res) => {
   }
 });
 
+// POST /api/pipelines/:id/report — the metadata-only run report a user can paste
+// into a GitHub issue. buildRunReport is a pure read-by-id (run-report.mjs) that
+// resolves BOTH project and workspace runs, so this one route covers both families
+// and needs no /api/workspaces twin. POST, not GET: the body carries the reporter's
+// free text and the three opt-in flags, which do not belong in a logged URL.
+// Worca makes NO network call here — it returns a URL the browser opens.
+// Like its report-result neighbour above, a malformed id 404s rather than 400s: a
+// stale bookmark must read as not-found (see resolveRunScope, :2006).
+
+// The repo `gh issue create` targets, from the SAME bugs.url the prefilled link uses
+// (APP_INFO.bugsUrl, which falls back to <repo>/issues). Empty for a non-github.com
+// bugs.url, which makes /report-issue degrade to the browser link.
+const BUGS_SLUG = repoSlugFromBugsUrl(APP_INFO.bugsUrl);
+
+/**
+ * The preamble both report routes share: validate the reason, build the payload.
+ * Returns null after ALREADY answering `res` (400 or 404), so callers just bail.
+ */
+async function reportPayloadOr(res, req) {
+  const body = req.body || {};
+  const reason = typeof body.reason === 'string' ? body.reason.trim() : '';
+  if (!REPORT_REASON_IDS.includes(reason)) {
+    badRequest(res, `reason must be one of: ${REPORT_REASON_IDS.join(', ')}`);
+    return null;
+  }
+  const payload = await buildRunReport(req.params.id, {
+    reason,
+    expectation: typeof body.expectation === 'string' ? body.expectation : '',
+    include: body.include,
+  });
+  if (!payload) {
+    res.status(404).json({ error: 'pipeline not found' });
+    return null;
+  }
+  return payload;
+}
+
+/** The browser fallback: a prefilled issues/new URL plus the download filename. */
+function prefilledIssue(payload) {
+  return { ...buildIssueUrl(payload, { bugsUrl: APP_INFO.bugsUrl }), filename: reportFilename(payload) };
+}
+
+app.post('/api/pipelines/:id/report', async (req, res) => {
+  try {
+    const payload = await reportPayloadOr(res, req);
+    if (!payload) return;
+    res.json({ payload, issue: prefilledIssue(payload) });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
+// POST /api/pipelines/:id/report-issue — the same report, but worca FILES it through
+// `gh issue create` instead of handing the browser a prefilled link. That exists
+// because the link cannot carry the report: a prefilled `body=` dies at ~8 KB encoded
+// and half of all real runs serialize larger than that, so the browser path can only
+// ever ask the reporter to paste the JSON in by hand. A --body-file has no such cap.
+//
+// The payload is REBUILT here from the run id; the client's copy is never accepted.
+// The redaction contract (run-report.mjs) has exactly one enforcement point, and a
+// route that trusted a posted payload would be a second, weaker one.
+//
+// A gh failure is a 200 with ok:false, not a 5xx: the response carries the prefilled
+// link so the modal can degrade to today's copy-and-paste flow in one round trip.
+app.post('/api/pipelines/:id/report-issue', async (req, res) => {
+  try {
+    const payload = await reportPayloadOr(res, req);
+    if (!payload) return;
+    const filed = await createIssue({
+      repo: BUGS_SLUG,
+      title: issueTitle(payload),
+      body: renderIssueBodyFull(payload),
+    });
+    if (filed.ok) return res.json({ ok: true, url: filed.url, labeled: filed.labeled });
+    res.json({ ok: false, kind: filed.kind, error: filed.error, issue: prefilledIssue(payload) });
+  } catch (err) {
+    res.status(500).json({ error: err && err.message ? err.message : String(err) });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // Install logic (mirrors scripts/install.mjs): copy agents/*.md and
 // skills/worca/** into <projectDir>/.claude/...
@@ -5393,9 +6502,7 @@ app.use((req, res, next) => {
   if (req.method !== 'GET') return next();
   if (req.path.startsWith('/api/') || req.path.startsWith('/ws')) return next();
   if (req.path === '/vendor' || req.path.startsWith('/vendor/')) return next();
-  res.sendFile(path.join(PUBLIC_DIR, 'index.html'), (err) => {
-    if (err) next();
-  });
+  sendIndex(res);
 });
 
 // ---------------------------------------------------------------------------
@@ -5601,6 +6708,8 @@ if (isMain) {
     try { channelHost.start(); } catch (err) {
       console.error(`[worca-ui] chat channel host failed to start: ${err && err.message ? err.message : err}`);
     }
+    try { startTeamMetricsBackground({ log: (m) => console.warn(m) }); }
+    catch (err) { console.warn(`[worca-ui] team metrics background: ${err?.message || err}`); }
   });
 }
 
@@ -5610,5 +6719,6 @@ export const _testing = {
   chatActions, chatRouter, channelHost, handleChatInbound, enqueueChatWork,
   chatNotifier, resumeRun, resolveHljsAssets, resolveEsmAsset, askJobs, askFollowers, askDeleting, resolveAskContext, flipCard,
   emitDiffCommentsChanged, emitAskWorktrees, askWorktreesEnvelope, deleteAskThreadFully,
+  askTrackRun, liveRunEntry, liveDefragRun, memoryScopeKey, startRunHandler, emitMemoryChanged, askSystemPromptFor,
   uiControl, bearerMatches,
 };