create-pmos 0.18.0 → 0.19.0

package/README.md

@@ -333,6 +333,63 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.19.0
+
+**A long document scrolls its own panel, and starting a session asks what is already running.** Run
+`npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **Opening a long document no longer scrolls the whole window.** Scrolling a document in the right
+  panel moved the entire interface — the top bar slid away, the status bar rose from below — while
+  the panel's own scrollbar never engaged. Every panel now scrolls inside itself and the app frame
+  never moves. (If you are curious: the shell's middle row was written `1fr`, which is
+  `minmax(auto, 1fr)`, so a tall document enlarged the row rather than overflowing it. Every style
+  involved read as correct, which is why it survived review.)
+- **`＋ session` now asks before it starts one, when the checkout is already busy.** It used to
+  start the session and *then* tell you how many others were in there — a count arriving after the
+  decision, naming something you cannot act on. Now you get a chooser first, listing every session
+  in that checkout.
+- **It says what each one is.** Its name, its agent, the same word the sidebar uses (`working` ·
+  `quiet 12m` · `needs you` · `maybe blocked`), the agent's own last words, and who holds the writer
+  claim.
+- **…and what ending it would cost, without over-claiming.** Only `needs you` reads as settled —
+  its turn finished and it is waiting on you. `working` says output is arriving right now. `quiet`
+  and `maybe blocked` say, in as many words, that the workspace *cannot tell* a finished turn from a
+  permission prompt from a stuck tool. A confident "safe to end" that discarded a running turn would
+  be worse than no reading at all.
+- **You can take the running session instead of making another.** `open it` attaches a tab to it and
+  starts nothing. `end it` is there too — the first click arms it and names what it will end, the
+  second does it. `＋ start another session here anyway` is always one click: being told is never
+  being blocked, and no session is ever refused because another is there.
+- **The same detail is written into the new session's scrollback**, so scrolling back tomorrow
+  answers the same question the chooser did.
+
+## What's new in 0.18.1
+
+**Three fixes to the workspace terminal, all of them about what the window knew about a session.**
+Run `npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **Your terminal now uses its whole width.** Nothing ever told the shell how wide the browser
+  was. A session starts at 80 columns; the server stated its own size on attach rather than
+  adopting yours, and the browser only spoke up when a resize *changed* its grid — which happened
+  once, while the connection was still opening and there was no session to tell. So the process on
+  the other end kept wrapping at 80 columns inside a window three times that wide, and a
+  full-screen agent CLI painted into a box that was not there.
+- **The window stops rebuilding itself while you type.** It repainted every panel every four
+  seconds whether or not anything had changed — on a project with a hundred-odd initiatives that is
+  a real stall, on a timer, next to a terminal you are typing into. It now repaints when something
+  it shows actually moves. Separately, the server rewrote every session's scrollback file to disk
+  every five seconds, synchronously, whether or not a byte had changed; it now writes only what
+  moved.
+- **The scratchpad belongs to a session again.** It had become one shared buffer for the whole
+  page, so every terminal — in every repository — showed and overwrote the same text, and none of
+  it outlived the tab. Each session has its own pad again, saved on your machine, and it comes back
+  with the session.
+- **Reopening the workspace brings your sessions back.** Open tabs are remembered and re-attach to
+  the exact session they were on, named on the tab so you can tell which one it is. Previously they
+  were forgotten on reload and had to be re-found by hand — and the re-finding matched on a session
+  *name*, which is not unique between repositories, so a tab in one project could silently attach
+  to a shell running in another. `＋ session` also always starts a new session now, instead of
+  sometimes adopting one that was already running.
 ## What's new in 0.18.0
 
 **Several sessions in one folder now say so.** Run `npx create-pmos@latest workspace`; the version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@83f52ff
+kernel-source: pmos@181425a
 assembled: 2026-07-31
 mode: vendor

package/payload/scripts/metrics.py

@@ -49,11 +49,18 @@ def review_gate_pass(verdict, score):
 
 def leading_frontmatter(path):
     """The LEADING frontmatter block only — body text cannot fake a declaration. Mirror of
-    workspace/lib/file-mode-parse.js parseLeadingFrontmatter (agreement enforced by the fixture test)."""
+    workspace/lib/file-mode-parse.js parseLeadingFrontmatter (agreement enforced by the fixture test).
+
+    The value group is `(.*?)`, NOT `(.+?)`. A key written bare (`prd_path:` with nothing after it)
+    is legal YAML for a null value; under `.+?` the line does not match, so it reads as the first
+    body line, the loop breaks, and every key below it is dropped. Agreement with the JS parser was
+    never sufficient to catch this — both carried the same wrong regex, so the fixture compared two
+    identical mistakes and passed. See kit/fixtures/state/initiatives/epsilon-empty-value.md.
+    """
     fm = {}
     with open(path, encoding="utf-8") as fh:
         for line in fh:
-            m = re.match(r"^([a-z_]+):\s*(.+?)\s*$", line.rstrip("\n"))
+            m = re.match(r"^([a-z_]+):\s*(.*?)\s*$", line.rstrip("\n"))
             if m:
                 fm.setdefault(m.group(1), m.group(2))
             elif line.strip() and not line.startswith("---"):

package/workspace/README.md

@@ -162,6 +162,24 @@ session in a tree that already has live ones now says so in the pane — naming
 way out (⑂ a new branch in its own folder). It fires on the plain `＋ session` path too, where no
 git operation runs at all: the server already knew, and used to say nothing.
 
+**`＋ session` asks before it starts one.** A count arriving *after* the spawn is a fact you cannot
+act on, and the answer you usually want is not "start another" at all — it is "which of those is the
+one I was already working in?". So clicking `＋ session` into an occupied tree opens a chooser
+first, listing every session in that tree with:
+
+- **what it is** — its name, its agent, the sidebar's own word for its state (`working` ·
+  `quiet 12m` · `needs you` · `maybe blocked`), the agent's last words, and the writer claim;
+- **what ending it would cost** — one sentence per session, worded from the evidence. Only
+  `needs you` reads as settled ("its turn finished and it is waiting on you"). `quiet` and
+  `maybe blocked` say, in as many words, that PMOS *cannot tell* — a confident "safe" that
+  discards a running turn is worse than no reading at all;
+- **`open it`** — attach a tab to that session and start nothing.
+
+`end it` is there too, and is the only destructive control on the surface: two clicks, the first
+arming it. `＋ start another session here anyway` is always one click away — informing you is never
+obstructing you. The same per-session detail is written into the new pane's scrollback, so scrolling
+back tomorrow answers the same question the chooser did.
+
 **The tree is the unit, not the folder you registered.** A repo registered twice — say `~/repo` and
 `~/repo/packages/app`, the ordinary shape for a product repo added by path — is **one** tree, and
 its sessions are told about each other. Two *worktrees* of one repo are **two** trees, and are not
@@ -178,7 +196,9 @@ Be clear about what this buys: **PMOS hosts your agent's terminal, it does not s
 the files.** Nothing here prevents a write, a checkout or a commit, and no spawn is ever refused
 because someone else is in the tree. It makes a shared tree visible; the discipline is still yours.
 (The role rides on `/api/sessions` rows as `tree` / `tree_role` / `tree_peers`; the tab-bar chip is
-not wired yet.)
+not wired yet. `/api/workspaces` publishes each registration's `tree`, which is what lets the
+chooser answer "who is already in there?" *before* anything is started; `/api/tree/peers` returns
+each session described — `shown`, `label`, `doing` and a `risk` — rather than a list of ids.)
 
 A workspace anywhere **inside** a repo knows its branch — a subdirectory (`repo/packages/app`)
 counts, which matters for a product repo added by path. A folder with **no git** simply says so and

package/workspace/lib/file-mode-parse.js

@@ -14,10 +14,21 @@ const reviewGate = require('./review-gate');
 // The LEADING YAML-ish frontmatter block ONLY — body text must never be able to fake a declaration.
 // Mirrors metrics.py exactly: `key: value` lines (first value wins), `---` fences and blank lines are
 // skipped, and the FIRST non-frontmatter, non-fence, non-blank line ends the block.
+//
+// The value group is `(.*?)`, NOT `(.+?)`. A key written bare — `prd_path:` with nothing after it —
+// is legal YAML for a null value, and 30 of the 136 records in planning/initiatives/ are written
+// that way. Under `.+?` such a line does not match, so it is treated as the first body line, the
+// loop BREAKS, and every key below it is silently dropped: parent_kr, outcome_metric, the lot. The
+// spine then rendered those initiatives as "unanchored — rejected work under D59".
+//
+// This is not a hypothetical. metrics.py carried the identical regex and kit/fixtures/test_parsers.py
+// existed to prove the two agreed — which they did, on being wrong, for as long as the fixture only
+// ever compared them to each other. scripts/workflow-state.js:105 was the one correct parser and was
+// compared against nothing. The fixture now asserts VALUES; see epsilon-empty-value.md.
 function parseLeadingFrontmatter(text) {
   const fm = {};
   for (const line of String(text == null ? '' : text).split('\n')) {
-    const m = line.match(/^([a-z_]+):\s*(.+?)\s*$/);
+    const m = line.match(/^([a-z_]+):\s*(.*?)\s*$/);
     if (m) { if (!(m[1] in fm)) fm[m[1]] = m[2]; continue; }
     if (line.trim() && !line.startsWith('---')) break;
   }

package/workspace/lib/start-policy.js

@@ -0,0 +1,118 @@
+/* workspace-repo-first · the start-work policy (PRD R1 · R3)
+ * ──────────────────────────────────────────────────────────────────────────────────────────────
+ * ONE declared rule for where a session starts, replacing a decision the server used to make per
+ * call from invisible state.
+ *
+ * What it replaced, and why that had to go. `spawnWithBranch` chose isolation with
+ *
+ *     if (isolate === undefined || isolate === null) isolate = liveSessionCount(w.id) > 0;
+ *
+ * — so the SAME click created a worktree or moved the shared checkout depending on whether some
+ * other session happened to be alive at that moment. A PM cannot hold that rule in their head,
+ * cannot predict it, and cannot see it in the UI before pressing the button. It is not a policy;
+ * it is a coin flip with a plausible-looking reason.
+ *
+ * The rule this module states instead:
+ *
+ *   no initiative chosen  → the repository's MAIN working tree, on whatever branch it is on.
+ *                           No git operation at all. Nothing moves, no folder appears.
+ *   an initiative chosen  → that initiative's own worktree on `initiative/<id>`, created if absent
+ *                           and REUSED if present. The main tree is never moved off its branch.
+ *
+ * The PM's framing, which this encodes: keep the main checkout on main, and let work live in
+ * worktrees rather than accumulating branches in the shared tree.
+ *
+ * Two consequences worth stating because they are easy to get wrong:
+ *
+ *   * If the MAIN tree already happens to be on `initiative/<id>`, the answer is the main tree —
+ *     not a second folder for a branch that is already checked out. git allows one working tree
+ *     per branch, so building a worktree here would fail, and failing is the better outcome only
+ *     if the alternative were wrong. It isn't: the PM asked to work on that initiative and the
+ *     repository is already there.
+ *   * `create` is derived from whether the branch EXISTS, never assumed. `addWorktree(root, b,
+ *     {create:true})` errors when the branch is already there, and `{create:false}` errors when it
+ *     is not. Guessing produces a failed git operation, and a failed git operation is the one thing
+ *     the rubric's veto forbids being followed by a spawned session.
+ *
+ * PURE ON PURPOSE. Everything it needs arrives as plain data, so the whole policy — including the
+ * paths that touch git — is exercisable in node with no repository, no socket and no PTY. The
+ * predecessor's hard floor ("a failed git operation must never start a session in the wrong
+ * directory") is inherited by this initiative, and a floor whose only proof is a manual click is
+ * not a floor.
+ */
+
+const BRANCH_PREFIX = 'initiative/';
+
+// The branch an initiative's work belongs on. One definition, so the client's preview and the
+// server's git call cannot disagree about what the PM is about to get.
+function branchForInitiative(id) {
+  const s = String(id == null ? '' : id).trim();
+  return s ? BRANCH_PREFIX + s : null;
+}
+
+// The repository's MAIN working tree among the registered ones. `repo_key` IS the main worktree's
+// directory (repoIdentity resolves it from `git worktree list`, which names the main tree first),
+// so the main tree is the one whose root equals the key. A repo where only LINKED worktrees are
+// registered has no main tree on screen; the first registered tree stands in, which is the same
+// fallback surfaceProducts already makes for the same reason.
+function mainTreeOf(trees) {
+  const list = (trees || []).filter(Boolean);
+  if (!list.length) return null;
+  return list.find((t) => t.repo_key && t.root && String(t.root) === String(t.repo_key)) || list[0];
+}
+
+/* Resolve one "start work here" request to a plan.
+ *
+ * trees      — the registered workspaces of ONE repository: { id, root, repo_key, branch }
+ * initiative — an initiative id, or null/'' for "just give me a terminal"
+ * branches   — branch names known to the repo (branchInfo().branches), or null when unread
+ *
+ * Returns { ok, plan, wsId, branch, createBranch, isolate, why } — or { ok:false, error } when
+ * there is nothing to act on. `wsId` is the workspace the session is spawned against; `branch`
+ * non-null means a git operation is required first, and `isolate` says which kind.
+ */
+function resolveStart({ initiative, trees, branches } = {}) {
+  const list = (trees || []).filter(Boolean);
+  if (!list.length) return { ok: false, error: 'no working tree is registered for this repository' };
+  const main = mainTreeOf(list);
+  if (!main) return { ok: false, error: 'no working tree is registered for this repository' };
+
+  const id = String(initiative == null ? '' : initiative).trim();
+  if (!id) {
+    return {
+      ok: true, plan: 'main-tree', wsId: main.id, branch: null, createBranch: false, isolate: false,
+      why: `runs in ${main.name || 'the main working tree'}${main.branch ? ` on ${main.branch}` : ''} — no branch is checked out and nothing else moves`,
+    };
+  }
+
+  const branch = branchForInitiative(id);
+  if (!branch) return { ok: false, error: 'an initiative id is required to derive a branch' };
+
+  // Already checked out in a LINKED worktree → go there. No git operation; the folder exists.
+  const existing = list.find((t) => t.id !== main.id && t.branch === branch);
+  if (existing) {
+    return {
+      ok: true, plan: 'reuse-worktree', wsId: existing.id, branch: null, createBranch: false, isolate: false,
+      why: `${id} already has its own folder — this reuses it, and creates nothing`,
+    };
+  }
+  // The MAIN tree is already on it. Use it rather than attempting a worktree git would refuse.
+  if (main.branch === branch) {
+    return {
+      ok: true, plan: 'main-tree-on-branch', wsId: main.id, branch: null, createBranch: false, isolate: false,
+      why: `this repository is already on ${branch} — the session runs here, and no second folder is made`,
+    };
+  }
+  // Otherwise: a new worktree, off the main tree, which stays exactly where it is.
+  // `create` is DERIVED. A null `branches` means the branch list was never read — assuming the
+  // branch is new would make `git worktree add -b` fail on every existing branch, so the honest
+  // default is to treat it as existing and let git's own error surface if it is not.
+  const known = Array.isArray(branches) ? branches : null;
+  const createBranch = known ? !known.includes(branch) : false;
+  return {
+    ok: true, plan: 'new-worktree', wsId: main.id, branch, createBranch, isolate: true,
+    why: `${branch} gets its own folder — ${main.name || 'the main working tree'} stays on ${main.branch || 'its branch'} and every running session stays put`,
+  };
+}
+
+module.exports = { resolveStart, branchForInitiative, mainTreeOf, BRANCH_PREFIX };

package/workspace/lib/tree-share.js

@@ -1,5 +1,7 @@
 'use strict';
-// Who shares a working tree with whom, and who is DECLARED to be driving it.
+// Who shares a working tree with whom, who is DECLARED to be driving it, and — since
+// workspace-session-choice — what each of those sessions is actually DOING and what ending it
+// would cost.
 //
 // The premise, stated once so nothing below has to hedge: PMOS hosts real PTYs and the agent CLI
 // inside one is untouched (D62). There is nothing between an agent and the filesystem, so this
@@ -21,6 +23,23 @@
 //
 // Pure functions over plain rows, on purpose: the server owns the git shell-outs and the session
 // registry, and the rules are the part worth testing without either.
+//
+// ── ONE module, TWO consumers ────────────────────────────────────────────────────────────────
+// This file is now a UMD, for the same reason lib/session-state.js is: the SERVER computes the
+// co-tenancy sentence at spawn, and the BROWSER computes the same descriptions again when the PM
+// clicks `＋ session` into an occupied tree. A second copy of "what does ending this cost?" would
+// be free to drift, and the two surfaces would end up holding different opinions about one
+// session — the exact failure the session-state table was extracted to stop.
+//
+// What this module deliberately does NOT do is name a session's STATE. The vocabulary (working ·
+// quiet · needs you · maybe blocked · exited) belongs to lib/session-state.js and arrives here
+// already worded, on the row, as `shown` + `label`. Re-deriving a word here would be that second
+// copy in a new costume.
+(function (root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  else root.PMOSTreeShare = api;
+})(typeof self !== 'undefined' ? self : this, function () {
 
 /** Live = a session the PM could still be driving. `exited` is a corpse and collides with nobody. */
 function isLive(s) { return !!s && s.state !== 'exited'; }
@@ -73,18 +92,138 @@ function nameList(rows, cap = 3) {
   return `${names.slice(0, cap).join(', ')} and ${names.length - cap} more`;
 }
 
+/** The same list, each pane carrying the word beside it — `label` when the caller supplied one. */
+function statedList(rows, cap = 3) {
+  const parts = (rows || []).map((s) => (s && s.label ? `“${s.name}” (${s.label})` : `“${s.name}”`));
+  if (parts.length <= cap) return parts.join(', ');
+  return `${parts.slice(0, cap).join(', ')} and ${parts.length - cap} more`;
+}
+
+/** A terse age, in the voice the sidebar already uses. `null` in, `null` out — never "0s". */
+function ago(ms) {
+  if (ms == null || !Number.isFinite(ms) || ms < 0) return null;
+  if (ms < 60000) return `${Math.max(1, Math.round(ms / 1000))}s`;
+  if (ms < 3600000) return `${Math.round(ms / 60000)}m`;
+  return `${Math.round(ms / 360000) / 10}h`;
+}
+
+/**
+ * WHAT ENDING THIS SESSION WOULD COST — read only from what the workspace can actually observe.
+ *
+ * The PM's question, asked in as many words, is "is it safe to end?". The honest answer has three
+ * shapes and only one of them is a yes, so the levels are named for the EVIDENCE rather than for a
+ * recommendation:
+ *
+ *   'in-flight' — bytes are arriving right now. Ending it cuts a turn that is running. Not safe,
+ *                 and this one PMOS is sure of.
+ *   'settled'   — the turn finished and the session is waiting on the human (`needs`). This is the
+ *                 only state where "nothing is in flight" is CORROBORATED — session-state reaches
+ *                 `needs` only from a transcript with no unresolved tool call, over a quiet clock.
+ *   'unknown'   — quiet, or a tool call open with nothing moving. The workspace cannot tell a
+ *                 finished turn from a permission prompt from a hung tool, and this is the state it
+ *                 must not launder into a yes. Saying "probably idle" is the whole point: an
+ *                 over-confident "safe" here is the watermelon this repo has a word for.
+ *   'gone'      — already exited; there is nothing left to end.
+ *
+ * `shown` is the presented state from lib/session-state.js. An unrecognised value falls to
+ * 'unknown', because a state this module has never heard of is precisely not a state it may
+ * declare safe.
+ */
+function endRisk(shown, quietMs) {
+  const age = ago(quietMs);
+  if (shown === 'exited') {
+    return { level: 'gone', why: 'already exited — there is nothing left to end' };
+  }
+  if (shown === 'working') {
+    return { level: 'in-flight', why: 'output is arriving right now — ending it cuts a turn that is still running' };
+  }
+  if (shown === 'needs') {
+    return {
+      level: 'settled',
+      why: 'its turn finished and it is waiting on you — ending it costs the scrollback, not work in flight',
+    };
+  }
+  if (shown === 'blocked') {
+    return {
+      level: 'unknown',
+      why: `a tool call has been open${age ? ` ${age}` : ''} with nothing moving — PMOS cannot tell a permission prompt from a stuck tool, so ending it may or may not discard work`,
+    };
+  }
+  return {
+    level: 'unknown',
+    why: `nothing has moved${age ? ` for ${age}` : ''}, and PMOS cannot see whether the turn finished — read this as “probably idle”, not “safe”`,
+  };
+}
+
+/**
+ * One co-tenant, described for a human who is deciding between joining it and starting another.
+ *
+ * Everything here is either copied off the row or derived by `endRisk`; nothing is invented. In
+ * particular `doing` is the agent's own last words as the sidebar already shows them, and it stays
+ * null when the workspace could not read them rather than becoming a cheerful placeholder.
+ */
+function describeTenant(row, writerId) {
+  const s = row || {};
+  const shown = s.shown || (s.state === 'exited' ? 'exited' : 'working');
+  return {
+    id: s.id || null,
+    ws: s.ws || null,
+    name: s.name || '(unnamed)',
+    agent: s.agent || null,
+    shown,
+    label: s.label || shown,
+    doing: s.doing || null,
+    branch: s.branch || null,
+    writer: !!(writerId && s.id === writerId),
+    risk: endRisk(shown, s.quietMs),
+  };
+}
+
+/**
+ * The whole answer to "you are about to start a session in a tree that is already busy".
+ *
+ * Returned as DATA rather than as a paragraph, because the two consumers need different shapes of
+ * it: the server writes a sentence into the pane's scrollback, and the browser draws a chooser with
+ * a button per peer. Both read the same `peers`, so a peer the chooser offers and a peer the pane
+ * line names can never be different sets.
+ */
+function coTenancyReport(mates, opts) {
+  const o = opts || {};
+  const peers = (mates || []).map((m) => describeTenant(m, o.writerId));
+  const n = peers.length;
+  return {
+    tree: o.tree || null,
+    branch: o.branch || null,
+    peers,
+    headline: n
+      ? `${n} session${n === 1 ? '' : 's'} already running in this working tree`
+      : 'nothing else is running in this working tree',
+    // Stated once, here, so every surface that renders this report carries the same limit.
+    shared: 'you share one branch, one index and one set of files with '
+      + (n === 1 ? 'it' : 'them'),
+    advisory: 'Claims are advisory: PMOS hosts your agent’s terminal, it does not sit between it and the files.',
+    escape: 'To work in parallel for real, start the session on a new branch with its own folder (⑂).',
+  };
+}
+
 /**
  * The sentence a session gets when it starts in a tree somebody is already working in.
  *
- * It names the panes (a bare count tells the PM nothing they can act on), states the ONE fact that
- * makes this matter — a shared branch, index and file set — and names the way out that already
- * exists, because a warning with no alternative is just a nag. Returns null when there is nobody
- * there, so the caller never has to test for emptiness.
+ * It names the panes AND what each of them is doing — a name alone tells the PM which pane, but not
+ * whether walking over to it is a good idea. `label` is the sidebar's own word for the session
+ * (working · quiet 12m · needs you · maybe blocked), passed in rather than re-derived, so this
+ * sentence and the sidebar cannot disagree. Rows with no label degrade to bare names rather than
+ * inventing a state.
+ *
+ * It states the ONE fact that makes this matter — a shared branch, index and file set — and names
+ * the way out that already exists, because a warning with no alternative is just a nag. Returns
+ * null when there is nobody there, so the caller never has to test for emptiness.
  */
 function coTenancyNotice(mates, opts) {
   const rows = mates || [];
   if (!rows.length) return null;
   const n = rows.length;
+  const rep = coTenancyReport(rows, opts);
   const role = opts && opts.role === 'writer' ? 'writer' : 'reader';
   const held = opts && opts.writerName;
   const who = role === 'writer'
@@ -94,23 +233,40 @@ function coTenancyNotice(mates, opts) {
     : held
       ? `“${held}” holds the writer claim`
       : 'no session holds the writer claim';
-  return `${n} session${n === 1 ? '' : 's'} already running in this working tree (${nameList(rows)}) — `
-    + `you share one branch, one index and one set of files with ${n === 1 ? 'it' : 'them'}. ${who}. `
-    + 'Claims are advisory: PMOS hosts your agent’s terminal, it does not sit between it and the '
-    + 'files. To work in parallel for real, start the session on a new branch with its own folder (⑂).';
+  return `${rep.headline} (${statedList(rows)}) — ${rep.shared}. ${who}. `
+    + `${rep.advisory} ${rep.escape} `
+    + `To join ${n === 1 ? 'it' : 'one of them'} instead of starting another, open it from ＋ session — `
+    + 'the chooser says what each one is doing and what ending it would cost.';
 }
 
 /**
  * The same fact, written into the pane's own scrollback at spawn.
  *
  * The notice frame is a transient line in whichever client was listening; this one is part of the
- * session's record, so re-opening the tab tomorrow still shows what it was told. Dim, one line,
- * and it never claims anything was prevented.
+ * session's record, so re-opening the tab tomorrow still shows what it was told. Dim, and it never
+ * claims anything was prevented.
+ *
+ * It is no longer ONE line. The sentence is followed by a row per peer carrying that peer's state
+ * and what ending it would cost — the same `peers` the chooser draws, in the same order, because
+ * the PM who scrolls back to this tomorrow is asking the identical question they asked at the
+ * chooser and deserves the identical answer. Bounded at four rows so a twelve-session tree cannot
+ * push the shell's first prompt off the screen; the sentence above already says the true count.
  */
+const ADVISORY_ROWS = 4;
 function paneAdvisory(mates, opts) {
   const line = coTenancyNotice(mates, opts);
   if (!line) return null;
-  return `\x1b[38;5;244m⑂ ${line}\x1b[0m\r\n`;
+  const rep = coTenancyReport(mates, opts);
+  const shown = rep.peers.slice(0, ADVISORY_ROWS);
+  const rows = shown.map((p) => {
+    const who = `${p.name}${p.writer ? ' (writer)' : ''}`;
+    const doing = p.doing ? ` · ${p.doing}` : '';
+    return `\x1b[38;5;244m   · ${who} — ${p.label}${doing}; ${p.risk.why}\x1b[0m\r\n`;
+  });
+  const more = rep.peers.length > shown.length
+    ? [`\x1b[38;5;244m   · …and ${rep.peers.length - shown.length} more, listed in ＋ session\x1b[0m\r\n`]
+    : [];
+  return `\x1b[38;5;244m⑂ ${line}\x1b[0m\r\n` + rows.join('') + more.join('');
 }
 
 /**
@@ -126,4 +282,6 @@ function joinNotices(...parts) {
   return kept.length ? kept.join(' · ') : null;
 }
 
-module.exports = { isLive, coTenants, writerOf, roleOf, coTenancyNotice, paneAdvisory, joinNotices, nameList };
+return { isLive, coTenants, writerOf, roleOf, coTenancyNotice, paneAdvisory, joinNotices,
+  nameList, statedList, ago, endRisk, describeTenant, coTenancyReport, ADVISORY_ROWS };
+});

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.18.0",
+      "version": "0.19.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
@@ -10,7 +10,7 @@
   "scripts": {
     "start": "node server.js",
     "test": "node test.js && npm run test:modules",
-    "test:modules": "node focus.test.js && node handoff.test.js && node repo-scan.test.js && node profiles.test.js && node no-network.test.js && node fixture-parity.test.mjs",
+    "test:modules": "node focus.test.js && node handoff.test.js && node repo-scan.test.js && node profiles.test.js && node no-network.test.js && node fixture-parity.test.mjs && node start-policy.test.js",
     "test:ui": "node ui-test.js",
     "test:parity": "node design-parity.js --states",
     "test:all": "npm test && npm run test:panels && npm run test:ui && npm run test:parity && npm run test:offline",

package/workspace/public/index.html

@@ -29,6 +29,12 @@
      holding different opinions about one session. Loaded before the module graph so a panel can
      bind from window.PMOSSessionState rather than re-typing a word. -->
 <script src="/lib/session-state.js"></script>
+<!-- ONE module, TWO consumers, again (workspace-session-choice). Who shares a working tree, and
+     what ending one of those sessions would cost, is computed by the SERVER when it writes the
+     advisory into a new pane's scrollback and by the BROWSER when it draws the ＋ session chooser.
+     Both read this file, so the sentence in the terminal and the sentence in the chooser cannot
+     drift apart. Classic script (a UMD setting window.PMOSTreeShare), like the two above. -->
+<script src="/lib/tree-share.js"></script>
 <!-- The phone's navigation reducer. DOM-free, loaded as a classic script (it is a UMD that sets
      window.PMOSMobileNav) and required by test.js, so the whole screen domain is walkable in node
      rather than only in a browser. pm/mobile.js reads it from the global; the module graph does not