create-pmos 0.18.1 → 0.19.0

package/README.md

@@ -333,6 +333,36 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.19.0
+
+**A long document scrolls its own panel, and starting a session asks what is already running.** Run
+`npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **Opening a long document no longer scrolls the whole window.** Scrolling a document in the right
+  panel moved the entire interface — the top bar slid away, the status bar rose from below — while
+  the panel's own scrollbar never engaged. Every panel now scrolls inside itself and the app frame
+  never moves. (If you are curious: the shell's middle row was written `1fr`, which is
+  `minmax(auto, 1fr)`, so a tall document enlarged the row rather than overflowing it. Every style
+  involved read as correct, which is why it survived review.)
+- **`＋ session` now asks before it starts one, when the checkout is already busy.** It used to
+  start the session and *then* tell you how many others were in there — a count arriving after the
+  decision, naming something you cannot act on. Now you get a chooser first, listing every session
+  in that checkout.
+- **It says what each one is.** Its name, its agent, the same word the sidebar uses (`working` ·
+  `quiet 12m` · `needs you` · `maybe blocked`), the agent's own last words, and who holds the writer
+  claim.
+- **…and what ending it would cost, without over-claiming.** Only `needs you` reads as settled —
+  its turn finished and it is waiting on you. `working` says output is arriving right now. `quiet`
+  and `maybe blocked` say, in as many words, that the workspace *cannot tell* a finished turn from a
+  permission prompt from a stuck tool. A confident "safe to end" that discarded a running turn would
+  be worse than no reading at all.
+- **You can take the running session instead of making another.** `open it` attaches a tab to it and
+  starts nothing. `end it` is there too — the first click arms it and names what it will end, the
+  second does it. `＋ start another session here anyway` is always one click: being told is never
+  being blocked, and no session is ever refused because another is there.
+- **The same detail is written into the new session's scrollback**, so scrolling back tomorrow
+  answers the same question the chooser did.
+
 ## What's new in 0.18.1
 
 **Three fixes to the workspace terminal, all of them about what the window knew about a session.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@9fee84a
+kernel-source: pmos@181425a
 assembled: 2026-07-31
 mode: vendor

package/workspace/README.md

@@ -162,6 +162,24 @@ session in a tree that already has live ones now says so in the pane — naming
 way out (⑂ a new branch in its own folder). It fires on the plain `＋ session` path too, where no
 git operation runs at all: the server already knew, and used to say nothing.
 
+**`＋ session` asks before it starts one.** A count arriving *after* the spawn is a fact you cannot
+act on, and the answer you usually want is not "start another" at all — it is "which of those is the
+one I was already working in?". So clicking `＋ session` into an occupied tree opens a chooser
+first, listing every session in that tree with:
+
+- **what it is** — its name, its agent, the sidebar's own word for its state (`working` ·
+  `quiet 12m` · `needs you` · `maybe blocked`), the agent's last words, and the writer claim;
+- **what ending it would cost** — one sentence per session, worded from the evidence. Only
+  `needs you` reads as settled ("its turn finished and it is waiting on you"). `quiet` and
+  `maybe blocked` say, in as many words, that PMOS *cannot tell* — a confident "safe" that
+  discards a running turn is worse than no reading at all;
+- **`open it`** — attach a tab to that session and start nothing.
+
+`end it` is there too, and is the only destructive control on the surface: two clicks, the first
+arming it. `＋ start another session here anyway` is always one click away — informing you is never
+obstructing you. The same per-session detail is written into the new pane's scrollback, so scrolling
+back tomorrow answers the same question the chooser did.
+
 **The tree is the unit, not the folder you registered.** A repo registered twice — say `~/repo` and
 `~/repo/packages/app`, the ordinary shape for a product repo added by path — is **one** tree, and
 its sessions are told about each other. Two *worktrees* of one repo are **two** trees, and are not
@@ -178,7 +196,9 @@ Be clear about what this buys: **PMOS hosts your agent's terminal, it does not s
 the files.** Nothing here prevents a write, a checkout or a commit, and no spawn is ever refused
 because someone else is in the tree. It makes a shared tree visible; the discipline is still yours.
 (The role rides on `/api/sessions` rows as `tree` / `tree_role` / `tree_peers`; the tab-bar chip is
-not wired yet.)
+not wired yet. `/api/workspaces` publishes each registration's `tree`, which is what lets the
+chooser answer "who is already in there?" *before* anything is started; `/api/tree/peers` returns
+each session described — `shown`, `label`, `doing` and a `risk` — rather than a list of ids.)
 
 A workspace anywhere **inside** a repo knows its branch — a subdirectory (`repo/packages/app`)
 counts, which matters for a product repo added by path. A folder with **no git** simply says so and

package/workspace/lib/tree-share.js

@@ -1,5 +1,7 @@
 'use strict';
-// Who shares a working tree with whom, and who is DECLARED to be driving it.
+// Who shares a working tree with whom, who is DECLARED to be driving it, and — since
+// workspace-session-choice — what each of those sessions is actually DOING and what ending it
+// would cost.
 //
 // The premise, stated once so nothing below has to hedge: PMOS hosts real PTYs and the agent CLI
 // inside one is untouched (D62). There is nothing between an agent and the filesystem, so this
@@ -21,6 +23,23 @@
 //
 // Pure functions over plain rows, on purpose: the server owns the git shell-outs and the session
 // registry, and the rules are the part worth testing without either.
+//
+// ── ONE module, TWO consumers ────────────────────────────────────────────────────────────────
+// This file is now a UMD, for the same reason lib/session-state.js is: the SERVER computes the
+// co-tenancy sentence at spawn, and the BROWSER computes the same descriptions again when the PM
+// clicks `＋ session` into an occupied tree. A second copy of "what does ending this cost?" would
+// be free to drift, and the two surfaces would end up holding different opinions about one
+// session — the exact failure the session-state table was extracted to stop.
+//
+// What this module deliberately does NOT do is name a session's STATE. The vocabulary (working ·
+// quiet · needs you · maybe blocked · exited) belongs to lib/session-state.js and arrives here
+// already worded, on the row, as `shown` + `label`. Re-deriving a word here would be that second
+// copy in a new costume.
+(function (root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  else root.PMOSTreeShare = api;
+})(typeof self !== 'undefined' ? self : this, function () {
 
 /** Live = a session the PM could still be driving. `exited` is a corpse and collides with nobody. */
 function isLive(s) { return !!s && s.state !== 'exited'; }
@@ -73,18 +92,138 @@ function nameList(rows, cap = 3) {
   return `${names.slice(0, cap).join(', ')} and ${names.length - cap} more`;
 }
 
+/** The same list, each pane carrying the word beside it — `label` when the caller supplied one. */
+function statedList(rows, cap = 3) {
+  const parts = (rows || []).map((s) => (s && s.label ? `“${s.name}” (${s.label})` : `“${s.name}”`));
+  if (parts.length <= cap) return parts.join(', ');
+  return `${parts.slice(0, cap).join(', ')} and ${parts.length - cap} more`;
+}
+
+/** A terse age, in the voice the sidebar already uses. `null` in, `null` out — never "0s". */
+function ago(ms) {
+  if (ms == null || !Number.isFinite(ms) || ms < 0) return null;
+  if (ms < 60000) return `${Math.max(1, Math.round(ms / 1000))}s`;
+  if (ms < 3600000) return `${Math.round(ms / 60000)}m`;
+  return `${Math.round(ms / 360000) / 10}h`;
+}
+
+/**
+ * WHAT ENDING THIS SESSION WOULD COST — read only from what the workspace can actually observe.
+ *
+ * The PM's question, asked in as many words, is "is it safe to end?". The honest answer has three
+ * shapes and only one of them is a yes, so the levels are named for the EVIDENCE rather than for a
+ * recommendation:
+ *
+ *   'in-flight' — bytes are arriving right now. Ending it cuts a turn that is running. Not safe,
+ *                 and this one PMOS is sure of.
+ *   'settled'   — the turn finished and the session is waiting on the human (`needs`). This is the
+ *                 only state where "nothing is in flight" is CORROBORATED — session-state reaches
+ *                 `needs` only from a transcript with no unresolved tool call, over a quiet clock.
+ *   'unknown'   — quiet, or a tool call open with nothing moving. The workspace cannot tell a
+ *                 finished turn from a permission prompt from a hung tool, and this is the state it
+ *                 must not launder into a yes. Saying "probably idle" is the whole point: an
+ *                 over-confident "safe" here is the watermelon this repo has a word for.
+ *   'gone'      — already exited; there is nothing left to end.
+ *
+ * `shown` is the presented state from lib/session-state.js. An unrecognised value falls to
+ * 'unknown', because a state this module has never heard of is precisely not a state it may
+ * declare safe.
+ */
+function endRisk(shown, quietMs) {
+  const age = ago(quietMs);
+  if (shown === 'exited') {
+    return { level: 'gone', why: 'already exited — there is nothing left to end' };
+  }
+  if (shown === 'working') {
+    return { level: 'in-flight', why: 'output is arriving right now — ending it cuts a turn that is still running' };
+  }
+  if (shown === 'needs') {
+    return {
+      level: 'settled',
+      why: 'its turn finished and it is waiting on you — ending it costs the scrollback, not work in flight',
+    };
+  }
+  if (shown === 'blocked') {
+    return {
+      level: 'unknown',
+      why: `a tool call has been open${age ? ` ${age}` : ''} with nothing moving — PMOS cannot tell a permission prompt from a stuck tool, so ending it may or may not discard work`,
+    };
+  }
+  return {
+    level: 'unknown',
+    why: `nothing has moved${age ? ` for ${age}` : ''}, and PMOS cannot see whether the turn finished — read this as “probably idle”, not “safe”`,
+  };
+}
+
+/**
+ * One co-tenant, described for a human who is deciding between joining it and starting another.
+ *
+ * Everything here is either copied off the row or derived by `endRisk`; nothing is invented. In
+ * particular `doing` is the agent's own last words as the sidebar already shows them, and it stays
+ * null when the workspace could not read them rather than becoming a cheerful placeholder.
+ */
+function describeTenant(row, writerId) {
+  const s = row || {};
+  const shown = s.shown || (s.state === 'exited' ? 'exited' : 'working');
+  return {
+    id: s.id || null,
+    ws: s.ws || null,
+    name: s.name || '(unnamed)',
+    agent: s.agent || null,
+    shown,
+    label: s.label || shown,
+    doing: s.doing || null,
+    branch: s.branch || null,
+    writer: !!(writerId && s.id === writerId),
+    risk: endRisk(shown, s.quietMs),
+  };
+}
+
+/**
+ * The whole answer to "you are about to start a session in a tree that is already busy".
+ *
+ * Returned as DATA rather than as a paragraph, because the two consumers need different shapes of
+ * it: the server writes a sentence into the pane's scrollback, and the browser draws a chooser with
+ * a button per peer. Both read the same `peers`, so a peer the chooser offers and a peer the pane
+ * line names can never be different sets.
+ */
+function coTenancyReport(mates, opts) {
+  const o = opts || {};
+  const peers = (mates || []).map((m) => describeTenant(m, o.writerId));
+  const n = peers.length;
+  return {
+    tree: o.tree || null,
+    branch: o.branch || null,
+    peers,
+    headline: n
+      ? `${n} session${n === 1 ? '' : 's'} already running in this working tree`
+      : 'nothing else is running in this working tree',
+    // Stated once, here, so every surface that renders this report carries the same limit.
+    shared: 'you share one branch, one index and one set of files with '
+      + (n === 1 ? 'it' : 'them'),
+    advisory: 'Claims are advisory: PMOS hosts your agent’s terminal, it does not sit between it and the files.',
+    escape: 'To work in parallel for real, start the session on a new branch with its own folder (⑂).',
+  };
+}
+
 /**
  * The sentence a session gets when it starts in a tree somebody is already working in.
  *
- * It names the panes (a bare count tells the PM nothing they can act on), states the ONE fact that
- * makes this matter — a shared branch, index and file set — and names the way out that already
- * exists, because a warning with no alternative is just a nag. Returns null when there is nobody
- * there, so the caller never has to test for emptiness.
+ * It names the panes AND what each of them is doing — a name alone tells the PM which pane, but not
+ * whether walking over to it is a good idea. `label` is the sidebar's own word for the session
+ * (working · quiet 12m · needs you · maybe blocked), passed in rather than re-derived, so this
+ * sentence and the sidebar cannot disagree. Rows with no label degrade to bare names rather than
+ * inventing a state.
+ *
+ * It states the ONE fact that makes this matter — a shared branch, index and file set — and names
+ * the way out that already exists, because a warning with no alternative is just a nag. Returns
+ * null when there is nobody there, so the caller never has to test for emptiness.
  */
 function coTenancyNotice(mates, opts) {
   const rows = mates || [];
   if (!rows.length) return null;
   const n = rows.length;
+  const rep = coTenancyReport(rows, opts);
   const role = opts && opts.role === 'writer' ? 'writer' : 'reader';
   const held = opts && opts.writerName;
   const who = role === 'writer'
@@ -94,23 +233,40 @@ function coTenancyNotice(mates, opts) {
     : held
       ? `“${held}” holds the writer claim`
       : 'no session holds the writer claim';
-  return `${n} session${n === 1 ? '' : 's'} already running in this working tree (${nameList(rows)}) — `
-    + `you share one branch, one index and one set of files with ${n === 1 ? 'it' : 'them'}. ${who}. `
-    + 'Claims are advisory: PMOS hosts your agent’s terminal, it does not sit between it and the '
-    + 'files. To work in parallel for real, start the session on a new branch with its own folder (⑂).';
+  return `${rep.headline} (${statedList(rows)}) — ${rep.shared}. ${who}. `
+    + `${rep.advisory} ${rep.escape} `
+    + `To join ${n === 1 ? 'it' : 'one of them'} instead of starting another, open it from ＋ session — `
+    + 'the chooser says what each one is doing and what ending it would cost.';
 }
 
 /**
  * The same fact, written into the pane's own scrollback at spawn.
  *
  * The notice frame is a transient line in whichever client was listening; this one is part of the
- * session's record, so re-opening the tab tomorrow still shows what it was told. Dim, one line,
- * and it never claims anything was prevented.
+ * session's record, so re-opening the tab tomorrow still shows what it was told. Dim, and it never
+ * claims anything was prevented.
+ *
+ * It is no longer ONE line. The sentence is followed by a row per peer carrying that peer's state
+ * and what ending it would cost — the same `peers` the chooser draws, in the same order, because
+ * the PM who scrolls back to this tomorrow is asking the identical question they asked at the
+ * chooser and deserves the identical answer. Bounded at four rows so a twelve-session tree cannot
+ * push the shell's first prompt off the screen; the sentence above already says the true count.
  */
+const ADVISORY_ROWS = 4;
 function paneAdvisory(mates, opts) {
   const line = coTenancyNotice(mates, opts);
   if (!line) return null;
-  return `\x1b[38;5;244m⑂ ${line}\x1b[0m\r\n`;
+  const rep = coTenancyReport(mates, opts);
+  const shown = rep.peers.slice(0, ADVISORY_ROWS);
+  const rows = shown.map((p) => {
+    const who = `${p.name}${p.writer ? ' (writer)' : ''}`;
+    const doing = p.doing ? ` · ${p.doing}` : '';
+    return `\x1b[38;5;244m   · ${who} — ${p.label}${doing}; ${p.risk.why}\x1b[0m\r\n`;
+  });
+  const more = rep.peers.length > shown.length
+    ? [`\x1b[38;5;244m   · …and ${rep.peers.length - shown.length} more, listed in ＋ session\x1b[0m\r\n`]
+    : [];
+  return `\x1b[38;5;244m⑂ ${line}\x1b[0m\r\n` + rows.join('') + more.join('');
 }
 
 /**
@@ -126,4 +282,6 @@ function joinNotices(...parts) {
   return kept.length ? kept.join(' · ') : null;
 }
 
-module.exports = { isLive, coTenants, writerOf, roleOf, coTenancyNotice, paneAdvisory, joinNotices, nameList };
+return { isLive, coTenants, writerOf, roleOf, coTenancyNotice, paneAdvisory, joinNotices,
+  nameList, statedList, ago, endRisk, describeTenant, coTenancyReport, ADVISORY_ROWS };
+});

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.18.1",
+      "version": "0.19.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/index.html

@@ -29,6 +29,12 @@
      holding different opinions about one session. Loaded before the module graph so a panel can
      bind from window.PMOSSessionState rather than re-typing a word. -->
 <script src="/lib/session-state.js"></script>
+<!-- ONE module, TWO consumers, again (workspace-session-choice). Who shares a working tree, and
+     what ending one of those sessions would cost, is computed by the SERVER when it writes the
+     advisory into a new pane's scrollback and by the BROWSER when it draws the ＋ session chooser.
+     Both read this file, so the sentence in the terminal and the sentence in the chooser cannot
+     drift apart. Classic script (a UMD setting window.PMOSTreeShare), like the two above. -->
+<script src="/lib/tree-share.js"></script>
 <!-- The phone's navigation reducer. DOM-free, loaded as a classic script (it is a UMD that sets
      window.PMOSMobileNav) and required by test.js, so the whole screen domain is walkable in node
      rather than only in a browser. pm/mobile.js reads it from the global; the module graph does not

package/workspace/public/pm/app.js

@@ -83,9 +83,35 @@ function runningCount() {
 
 /* ── the shell, built once ─────────────────────────────────────────────────────────────────── */
 
+/* ── Why every track and every column here is `minmax(0, …)` / `min-height:0` ─────────────────
+ *
+ * The shell is 100vh and nothing in it is supposed to scroll the PAGE — a panel scrolls, the app
+ * never does. That held right up until a long document was opened in panel 4, and then the whole
+ * user interface scrolled: the top bar slid away, the status bar came up from below, and the doc
+ * pane's own `overflow-y:auto` never engaged.
+ *
+ * The cause is one CSS default, in two guises, and it is worth naming precisely because it is
+ * invisible in a style string that looks correct:
+ *
+ *   • `grid-template-rows: 44px 1fr 26px` — `1fr` is shorthand for `minmax(auto, 1fr)`, and that
+ *     `auto` MINIMUM is the item's min-content height. A tall document therefore does not overflow
+ *     the middle row; it ENLARGES it, past the 100vh the row was supposed to be trapped inside.
+ *   • a grid item / flex item with `min-height: auto` cannot shrink below its content either, so
+ *     even a correctly-sized track hands the overflow straight through to the next box down.
+ *
+ * Overflow that is `visible` still contributes to the SCROLLABLE overflow region of every ancestor
+ * that does not clip it, all the way up to the viewport — which is exactly the reported symptom:
+ * the page scrolls, not the pane. So the fix is the whole chain, not one box. Each ancestor between
+ * the viewport and a scrolling pane declares a zero minimum, and the root clips as the backstop so
+ * a future panel that forgets cannot reach the page again.
+ *
+ * The design prototype had this right (`grid-template-rows:44px minmax(0,1fr) 28px`, see
+ * prototype/workspace-layout-variants/*.html); the port dropped the `minmax(0, …)` and read
+ * identically until something tall was rendered into it.
+ */
 const root = el('div', {
   'data-pm-theme': state.theme,
-  style: 'display:grid;grid-template-rows:44px 1fr 26px;height:100vh;background:var(--background);color:var(--foreground);font-family:var(--sans);font-size:13px;line-height:1.5',
+  style: 'display:grid;grid-template-rows:44px minmax(0,1fr) 26px;height:100vh;overflow:hidden;background:var(--background);color:var(--foreground);font-family:var(--sans);font-size:13px;line-height:1.5',
 });
 
 const themeBtn = el('button', {
@@ -113,7 +139,14 @@ const statusBar = el('div', {
   el('span', { style: 'margin-left:auto' }, 'sessions survive detach · ⌘K search · Esc closes tab'),
 );
 
-const bodyGrid = el('div', { style: 'display:grid;grid-template-columns:' + gridCols() + ';min-height:0' });
+/* The body grid's own geometry, in one place so the initial build and every repaint below cannot
+ * disagree. The implicit ROW is stated explicitly as `minmax(0,1fr)` for the same reason the root's
+ * middle track is: an auto row is floored at its items' min-content height, and one tall panel
+ * would push the grid taller than the box it was given. */
+const BODY_GRID_STYLE = () =>
+  'display:grid;grid-template-columns:' + gridCols() + ';grid-template-rows:minmax(0,1fr);min-height:0;overflow:hidden';
+
+const bodyGrid = el('div', { style: BODY_GRID_STYLE() });
 
 /** The collapsed 36px strip: a full-height button with a rotated vertical-rl label. */
 function makeRail(flag) {
@@ -131,10 +164,14 @@ const rail1 = makeRail('col1');
 const rail2 = makeRail('col2');
 rail0.label.textContent = 'repositories ⟩';
 
-const hostRepos = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;min-width:0' });
-const hostInits = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);overflow-y:auto;min-width:0' });
-const hostDetail = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);overflow-y:auto;min-width:0;display:flex;flex-direction:column' });
-const hostTabs = el('div', { style: 'background:var(--term-bg);display:flex;flex-direction:column;min-width:0' });
+/* `min-height:0` on all four: a grid item's automatic minimum is its content, so a panel taller
+ * than the viewport would otherwise stretch the row it sits in rather than scroll inside it. The
+ * two that already carry `overflow-y:auto` get it for free under the spec — stated anyway, because
+ * "this one is safe because of a rule elsewhere in the same line" is how the next edit breaks it. */
+const hostRepos = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;min-width:0;min-height:0;overflow-y:auto' });
+const hostInits = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);overflow-y:auto;min-width:0;min-height:0' });
+const hostDetail = el('div', { style: 'background:var(--sidebar);border-right:1px solid var(--border);overflow-y:auto;min-width:0;min-height:0;display:flex;flex-direction:column' });
+const hostTabs = el('div', { style: 'background:var(--term-bg);display:flex;flex-direction:column;min-width:0;min-height:0;overflow:hidden' });
 
 setChildren(root, [topBar, bodyGrid, statusBar]);
 
@@ -172,7 +209,7 @@ function render() {
   rail1.label.textContent = modeTitle() + ' ⟩';
   rail2.label.textContent = detailTitle() + ' ⟩';
 
-  bodyGrid.setAttribute('style', 'display:grid;grid-template-columns:' + gridCols() + ';min-height:0');
+  bodyGrid.setAttribute('style', BODY_GRID_STYLE());
 
   // On a phone there are no rails to collapse into and no second column to fold away: the four
   // hosts all stay mounted, one is DISPLAYED (pm/mobile.css picks it from `data-mpanel`), and the

package/workspace/public/pm/data.js

@@ -277,9 +277,13 @@ function evalFor(ladderSteps) {
 
 /** A live session, in the shape panel 2 and panel 4 read. `shown` is the server's own derived state. */
 function sessionRow(s) {
-  const label = s.shown === 'quiet' && Number.isFinite(s.quietMs)
+  // `s.label` is the SERVER's rendering of the presented state — one join (lib/session-state's
+  // `label`), one clock, one sentence. This used to be re-derived here from `shown` + `quietMs`,
+  // which is how the sidebar and the pane could describe one session with two different words. The
+  // local derivation survives only as a fallback for a server that predates the field.
+  const label = s.label || (s.shown === 'quiet' && Number.isFinite(s.quietMs)
     ? 'quiet ' + Math.max(1, Math.round(s.quietMs / 60000)) + 'm'
-    : (s.shown === 'needs' ? 'needs you' : s.shown);
+    : (s.shown === 'needs' ? 'needs you' : s.shown));
   return { name: s.name, st: s.shown, label, profile: s.profile_id || null, id: s.id };
 }
 
@@ -441,10 +445,34 @@ function groupsFromSpine(spine) {
 const products = new Map();   // product name → {name, ws, root, count, board, records}
 let productOrder = [];
 
+/* workspace id → the working-tree top it sits in (null for a folder with no git).
+ *
+ * This exists so panel 4 can answer "who else is already in the tree I am about to start a session
+ * in?" BEFORE it starts one. The session rows carry `tree` too, but only for trees that already
+ * have a session — which is one session too late for a chooser that runs on the FIRST click. The
+ * server derives this (`git rev-parse --show-toplevel`, via `repoIdentity`) and publishes it on
+ * /api/workspaces; it is read here and never re-derived. */
+const wsTree = new Map();
+
+/** The working tree a workspace id sits in, or null — for a folder with no git, or an unknown id. */
+export function treeOfWorkspace(id) {
+  return (id && wsTree.get(id)) || null;
+}
+
+/** The branch that tree is on, or null. Shown beside the tree so a chooser names what is shared. */
+const wsBranch = new Map();
+export function branchOfWorkspace(id) {
+  return (id && wsBranch.get(id)) || null;
+}
+
 /** Group registered working trees into products: several worktrees of one repo share a `repo_key`. */
 function foldWorkspaces(rows) {
   const byRepo = new Map();
   for (const w of rows || []) {
+    // Recorded per REGISTERED id, before the fold — folding is by repository, and the whole point
+    // of the tree key is that two registered ids can share one tree while a repo's two worktrees do
+    // not. Reading it off the folded row would lose exactly that distinction.
+    if (w && w.id) { wsTree.set(w.id, w.tree || null); wsBranch.set(w.id, w.branch || null); }
     const key = w.repo_key || w.root;
     if (!byRepo.has(key)) {
       byRepo.set(key, {

package/workspace/public/pm/panel-tabs.js

@@ -173,14 +173,68 @@ function nextSessionName() {
   return { n: max + 1, name: 'agent ' + (max + 1) };
 }
 
+/* ── who is already in the tree this session would land in ───────────────────────────────────
+ *
+ * The workspace used to answer this AFTER the fact: it started the session, then wrote "2 sessions
+ * already running in this working tree" into the new pane. That sentence is true and arrives one
+ * step too late — the PM has already made the thing they might not have wanted, and the sentence
+ * names a count they cannot act on. Worse, the answer they usually want is not "start another"
+ * at all; it is "which of those is the one I was already working in?".
+ *
+ * So the same facts are computed BEFORE the spawn, from data the page already holds:
+ *   • the tree the new session would land in — data.js publishes it per registered workspace id
+ *     (`/api/workspaces` → `tree`), which is available even when that tree has no session yet;
+ *   • the live sessions in it — `state.sessions`, each row carrying the server's own `tree`,
+ *     `tree_role`, presented state and rendered label;
+ *   • what ending each one would cost — lib/tree-share's `endRisk`, the same module the server uses
+ *     for the pane advisory, so the two readings are one reading.
+ *
+ * Nothing is derived twice and nothing is guessed. When any input is missing — fixture mode, no
+ * workspace selected, a folder with no git, the shared module not loaded — this answers "nobody",
+ * and `＋ session` behaves exactly as it always did. A chooser that appears on a bad guess would be
+ * worse than no chooser.
+ */
+function treePeersNow() {
+  if (FIXTURE) return null;
+  const TS = typeof window !== 'undefined' ? window.PMOSTreeShare : null;
+  if (!TS) return null;
+  const ws = state.wsId || null;
+  const tree = ws && dataMod && typeof dataMod.treeOfWorkspace === 'function'
+    ? dataMod.treeOfWorkspace(ws) : null;
+  if (!tree) return null;                       // no git, or nothing selected — no index to share
+  const rows = Array.isArray(state.sessions) ? state.sessions : [];
+  // The map coTenants() keys on. Built from each row's OWN `tree`, which the server derived — the
+  // client never runs git and must not pretend to. The target workspace is added explicitly so a
+  // tree whose only registration has no session yet still resolves.
+  const treeOfWs = new Map([[ws, tree]]);
+  for (const r of rows) if (r && r.ws && !treeOfWs.has(r.ws)) treeOfWs.set(r.ws, r.tree || null);
+  const mates = TS.coTenants(rows, treeOfWs, tree, null);
+  if (!mates.length) return null;
+  // The declared writer, read off the row the server already marked rather than recomputed.
+  const held = rows.find((r) => r && r.tree === tree && r.tree_role === 'writer');
+  return {
+    tree,
+    branch: (dataMod && typeof dataMod.branchOfWorkspace === 'function' && dataMod.branchOfWorkspace(ws)) || null,
+    peers: mates.map((m) => TS.describeTenant(m, held ? held.id : null)),
+  };
+}
+
 /**
  * `＋ session` (line 2087): file a new session against the selected initiative and open its tab.
  * The session lands in `extraSess` — the prototype's own list of sessions started in this window —
  * and the terminal tab is opened in the callback, i.e. after the render that added it.
+ *
+ * `opts.force` skips the chooser. It is what the chooser's own "start another session here anyway"
+ * calls, so the guard is asked exactly once per click and a PM who has already answered the
+ * question is never asked it twice.
  */
-export function newSession(slug) {
+export function newSession(slug, opts) {
   const target = slug || selSlug();
   if (!target) return;
+  if (!(opts && opts.force)) {
+    const found = treePeersNow();
+    if (found) { setState({ startPrompt: { slug: target, ...found }, endConfirm: null }); return; }
+  }
   const { n, name } = nextSessionName();
   /* `spawn` is carried on the session and thence onto the tab: it is an INSTRUCTION to start a PTY,
    * and it is the only thing that authorises one. Without it the terminal resolves by name, which
@@ -188,6 +242,8 @@ export function newSession(slug) {
   const sess = { name, st: 'working', label: 'working', profile: state.newSessProfile, spawn: true };
   setState((s) => ({
     startN: n + 1,
+    startPrompt: null,
+    endConfirm: null,
     extraSess: { ...s.extraSess, [target]: [...(s.extraSess[target] || []), sess] },
   }), () => openTermTab(target, sess));
   if (!FIXTURE && dataMod && typeof dataMod.startSession === 'function') {
@@ -195,6 +251,25 @@ export function newSession(slug) {
   }
 }
 
+/** Join a session that is already running instead of starting one: open its tab, start nothing. */
+export function joinSession(slug, peer) {
+  if (!peer) return;
+  setState({ startPrompt: null, endConfirm: null }, () => openTermTab(slug, {
+    name: peer.name, st: peer.shown, profile: peer.profile || null,
+    /* The SERVER's id, and NO `spawn`. Both halves matter and they are the exact difference
+     * between joining and starting: `id` is the join, so the tab attaches to precisely the PTY the
+     * PM pointed at rather than matching by a name that repeats across repositories; the absent
+     * `spawn` is what withholds authorisation to create one. A peer described by
+     * treeShare.describeTenant always carries its id, so this is never a name-match in practice. */
+    id: peer.id || null,
+  }));
+}
+
+/** Dismiss the chooser without starting or joining anything. */
+export function dismissStartPrompt() {
+  setState({ startPrompt: null, endConfirm: null });
+}
+
 /** `⫽ split` / `⫽ unsplit` (lines 2088–2092). */
 export function toggleSplit() {
   setState((s) => {
@@ -226,7 +301,7 @@ const emptyState = el('div', {
   style: 'flex:1;display:grid;place-items:center;color:oklch(0.55 0.02 213);font-size:12.5px;padding:20px;text-align:center',
 }, "nothing open — click a task's output or an artifact, or ＋ session above");
 
-const panesRow = el('div', { style: 'flex:1;display:flex;min-height:0' });
+const panesRow = el('div', { style: 'flex:1;display:flex;min-height:0;min-width:0;overflow:hidden' });
 
 /* ── the scratchpad (lines 983–991) ──────────────────────────────────────────────────────────
  * One textarea, created once. Its text is written back as a CHILD TEXT NODE as well as a value,
@@ -432,9 +507,117 @@ function copyActive() {
   setTimeout(() => setState({ copied: false }), 1200);
 }
 
+/* ── the ＋ session chooser ──────────────────────────────────────────────────────────────────
+ *
+ * Shown INSTEAD of a spawn when the working tree already has live sessions. It answers, in this
+ * order, the three questions the old one-line notice left the PM holding:
+ *
+ *   what is running?      — every peer named, with the sidebar's own word for its state, the
+ *                           agent's last words, and the writer claim where one is held.
+ *   is it safe to end?    — one sentence per peer from lib/tree-share's `endRisk`, worded from the
+ *                           EVIDENCE. Only `needs you` gets a plain "nothing is in flight"; quiet
+ *                           and maybe-blocked say, in as many words, that the workspace cannot
+ *                           tell — because a confident "safe" that discards a running turn is
+ *                           exactly the false confidence this repo calls a watermelon.
+ *   can I just use it?    — `open it`, which attaches a tab to that session and starts NOTHING.
+ *
+ * `end it` is the one destructive control on this surface and it is two clicks: the first arms it
+ * and the button says what will happen, the second sends it. Nothing else here can lose work.
+ *
+ * Rebuilt on each render, deliberately: it holds no PTY and no caret, so there is nothing for a
+ * persistent node to protect, and a chooser rebuilt from state cannot show a session that has
+ * since exited.
+ */
+const RISK_COLOR = {
+  'in-flight': 'var(--warning)',
+  settled: 'var(--success)',
+  unknown: 'var(--muted-foreground)',
+  gone: 'var(--muted-foreground)',
+};
+const CH_BTN = 'flex:none;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;'
+  + 'background:oklch(1 0 0 / 6%);border:1px solid oklch(1 0 0 / 12%);color:oklch(0.85 0.01 214);white-space:nowrap';
+
+function peerRow(prompt, p) {
+  const armed = state.endConfirm === p.id;
+  return el('div', {
+    style: 'display:flex;gap:10px;align-items:flex-start;padding:8px 10px;border:1px solid oklch(1 0 0 / 10%);background:oklch(1 0 0 / 3%)',
+  },
+    el('span', { style: 'flex:none;font-size:9px;line-height:18px;color:' + RISK_COLOR[p.risk.level] }, '●'),
+    el('div', { style: 'flex:1;min-width:0;display:flex;flex-direction:column;gap:2px' },
+      el('div', { style: 'display:flex;gap:8px;align-items:baseline;flex-wrap:wrap' },
+        el('span', { style: 'font-family:var(--mono);font-size:11.5px;color:oklch(0.95 0.01 214)' }, iv(p.name)),
+        el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.72 0.014 214)' }, iv(p.label)),
+        p.agent ? el('span', { style: 'font-family:var(--mono);font-size:10px;color:oklch(0.55 0.02 213)' }, iv(p.agent)) : null,
+        p.writer ? el('span', {
+          style: 'font-family:var(--mono);font-size:9.5px;color:var(--brand);border:1px solid oklch(1 0 0 / 12%);padding:1px 5px',
+        }, 'writer') : null,
+      ),
+      // The agent's own last words, when the workspace could read them. Absent rather than
+      // substituted: a placeholder here would be a claim about a session nobody read.
+      p.doing ? el('div', {
+        style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.62 0.02 213);overflow:hidden;text-overflow:ellipsis;white-space:nowrap',
+      }, iv(p.doing)) : null,
+      el('div', { style: 'font-size:11px;color:' + RISK_COLOR[p.risk.level] + ';line-height:1.45' }, iv(p.risk.why)),
+    ),
+    el('div', { style: 'flex:none;display:flex;gap:6px;align-items:center' },
+      el('button', {
+        onClick: () => joinSession(prompt.slug, p),
+        style: CH_BTN + ';color:var(--brand)', hover: CHIP_HOVER,
+      }, 'open it'),
+      el('button', {
+        onClick: () => {
+          if (!armed) { setState({ endConfirm: p.id }); return; }
+          if (termMod && typeof termMod.killSession === 'function') termMod.killSession(p.id);
+          setState({ endConfirm: null });
+        },
+        style: CH_BTN + (armed ? ';color:var(--destructive);border-color:var(--destructive)' : ''),
+        hover: CHIP_HOVER,
+      }, iv(armed ? 'end “' + p.name + '” — click again' : 'end it')),
+    ),
+  );
+}
+
+function startPromptBlock() {
+  const prompt = state.startPrompt;
+  if (!prompt) return null;
+  const peers = prompt.peers || [];
+  const n = peers.length;
+  return el('div', {
+    style: 'flex:none;max-height:52vh;overflow-y:auto;display:flex;flex-direction:column;gap:8px;'
+      + 'padding:12px 14px;border-bottom:1px solid oklch(1 0 0 / 10%);background:oklch(0.11 0.004 228.8)',
+  },
+    el('div', { style: 'display:flex;gap:8px;align-items:baseline;flex-wrap:wrap' },
+      el('span', { style: 'font-size:12.5px;color:oklch(0.95 0.01 214)' },
+        iv('⑂ ' + n + ' session' + (n === 1 ? '' : 's') + ' already running in this working tree')),
+      el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.55 0.02 213);overflow-wrap:anywhere' },
+        iv(prompt.tree + (prompt.branch ? ' · ' + prompt.branch : ''))),
+    ),
+    el('div', { style: 'font-size:11.5px;color:oklch(0.72 0.014 214);line-height:1.5' },
+      iv('You would share one branch, one index and one set of files with '
+        + (n === 1 ? 'it' : 'them') + '. Open one instead, end one, or start another anyway.')),
+    peers.map((p) => peerRow(prompt, p)),
+    el('div', { style: 'display:flex;gap:6px;flex-wrap:wrap;padding-top:2px' },
+      el('button', {
+        onClick: () => newSession(prompt.slug, { force: true }),
+        style: CH_BTN, hover: CHIP_HOVER,
+      }, '＋ start another session here anyway'),
+      el('button', { onClick: () => dismissStartPrompt(), style: CH_BTN, hover: CHIP_HOVER }, 'cancel'),
+    ),
+    // The limit, where the PM meets the feature — never only in a comment. PMOS hosts the terminal;
+    // it does not sit between an agent and the files, and no button above changes that.
+    el('div', { style: 'font-size:10.5px;color:oklch(0.52 0.02 213);line-height:1.5' },
+      'Nothing here is enforced: PMOS hosts your agent’s terminal, it does not sit between it and '
+      + 'the files. To work in parallel for real, start on a new branch with its own folder (⑂).'),
+  );
+}
+
 /* ── pane hosts ────────────────────────────────────────────────────────────────────────────── */
 
-const PANE_STYLE = 'flex:1;min-width:0;display:flex;flex-direction:column;border-right:1px solid oklch(1 0 0 / 10%)';
+/* `min-height:0` is load-bearing, not tidiness. A pane is a flex COLUMN whose body declares
+ * `flex:1;overflow-y:auto` — and a flex item's automatic minimum is its content, so without this
+ * the pane grows to fit a long document instead of letting the document scroll inside it, and the
+ * growth escapes upward until the whole page scrolls. See the chain documented in pm/app.js. */
+const PANE_STYLE = 'flex:1;min-width:0;min-height:0;display:flex;flex-direction:column;border-right:1px solid oklch(1 0 0 / 10%)';
 const paneHosts = new Map();          // tab id -> the pane element, kept for the tab's whole life
 
 function paneFor(tab) {
@@ -618,7 +801,12 @@ export function renderTabs(host) {
 
   setChildren(host, [
     tabBar,
-    visTabs.length === 0 ? emptyState : null,
+    // Above the panes and below the tab bar: the chooser is about the click that was just made in
+    // that bar, and putting it here leaves every open pane — and every live PTY — exactly where it
+    // was. Replacing the panes with it would re-parent a terminal, which is the quiet regression
+    // the persistent pane hosts exist to prevent.
+    startPromptBlock(),
+    visTabs.length === 0 && !state.startPrompt ? emptyState : null,
     panesRow,
     state.scratchOpen ? scratchBlock : null,
     bottomBar,

package/workspace/public/pm/state.js

@@ -38,6 +38,12 @@ function initial() {
     tabs: [], active: null, splitId: null,
     initLinks: {}, artLinks: {}, artSyncOpen: {}, artSyncState: {},
     extraSess: {}, termHist: {}, startN: 1, docEdits: {}, docModes: {},
+    /* `＋ session` into a working tree that already has sessions in it opens a CHOOSER instead of
+     * spawning (workspace-session-choice): `{slug, tree, branch, peers}` while it is open, null
+     * otherwise. `endConfirm` is the id of the one peer whose `end it` has been armed — a
+     * second click ends it, and anything else disarms. Neither is persisted: a chooser that
+     * reappeared on reload would be a question about a moment that has passed. */
+    startPrompt: null, endConfirm: null,
     col0: true, col1: true, col2: true, scratchOpen: false, scratchText: '', copied: false,
     flowsMap: null, schedList: null, agentList: null, memory: null,
     savedDocs: {}, scratchCopied: false,

package/workspace/public/pm/tab-doc.js

@@ -148,7 +148,7 @@ function viewBody(text) {
   const fm = [];
   doc.fm.forEach((fp) => { fm.push(el('span', { style: FM_K }, iv(fp.k)), el('span', { style: FM_V }, iv(fp.v))); });
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);color:var(--foreground);padding:20px 24px 60px;font-size:14px;line-height:1.65',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);color:var(--foreground);padding:20px 24px 60px;font-size:14px;line-height:1.65',
   },
     el('div', { style: 'max-width:72ch' },
       el('div', {
@@ -171,7 +171,7 @@ function viewBody(text) {
 
 function rawBody(text) {
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
   }, text.split('\n').map((l) => {
     const ln = FX.rawLine(l);
     return el('div', {
@@ -183,7 +183,7 @@ function rawBody(text) {
 function diffBody(raw, text, dirty) {
   const rows = dirty ? FX.diffLines(raw, text) : [FX.NO_DIFF_ROW];
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);padding:14px 0;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);padding:14px 0;font-family:var(--mono);font-size:12px;line-height:1.7',
   }, rows.map((dr) => el('div', {
     style: 'color:' + dr.c + ';background:' + dr.bg + ';padding:0 16px;white-space:pre-wrap;overflow-wrap:anywhere;min-height:1.2em',
   }, iv(dr.t))));
@@ -197,7 +197,7 @@ function editBox(tab) {
   let ta = boxes.get(tab.id);
   if (ta) return ta;
   ta = el('textarea', {
-    style: 'flex:1;background:var(--background);color:var(--foreground);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;background:var(--background);color:var(--foreground);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
     onInput: (e) => {
       const v = e.target.value;
       saveErr.delete(tab.path);
@@ -253,7 +253,7 @@ export function mountDoc(host, tab) {
   const dirtyColor = err ? 'var(--destructive)' : (dirty ? 'var(--warning)' : 'var(--muted-foreground)');
 
   const modeBar = el('div', {
-    style: 'display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
+    style: 'flex:none;display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
   },
     modeBtns, saveBtn, revertBtn,
     el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:' + dirtyColor }, iv(dirtyLabel)),

package/workspace/public/pm/tab-task.js

@@ -52,7 +52,7 @@ export function mountTask(host, tab) {
       'no artifact yet — produced when the agent runs this task');
 
   const body = el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);color:var(--foreground);padding:22px 26px 60px;font-size:14px;line-height:1.65',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);color:var(--foreground);padding:22px 26px 60px;font-size:14px;line-height:1.65',
   },
     el('div', { style: 'max-width:76ch' },
       el('div', { style: 'display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:5px' },

package/workspace/public/pm/tab-term.js

@@ -446,7 +446,7 @@ if (typeof window !== 'undefined') {
 
 /* ── fixture pane ──────────────────────────────────────────────────────────────────────────── */
 
-const SCROLL_STYLE = 'flex:1;overflow-y:auto;padding:14px 16px;font-family:var(--mono);font-size:12.5px;line-height:1.65;color:#c4ccce';
+const SCROLL_STYLE = 'flex:1;min-height:0;overflow-y:auto;padding:14px 16px;font-family:var(--mono);font-size:12.5px;line-height:1.65;color:#c4ccce';
 const LINE_STYLE = (c) => 'color:' + c + ';white-space:pre-wrap;overflow-wrap:anywhere';
 const PROMPT_ROW_STYLE = 'display:flex;gap:8px;align-items:baseline';
 const PROMPT_STYLE = 'color:#47cf79;flex:none';
@@ -639,6 +639,22 @@ export function sendToTerm(tab, data) {
   return send({ t: 'input', id: rec.sessionId, data });
 }
 
+/**
+ * End a running session, by id — the `＋ session` chooser's one destructive action.
+ *
+ * The wire message already existed (`t:'kill'`); what did not exist anywhere in the four-panel
+ * surface was a way to reach it, which is why "is it safe to end this?" had no answer the PM could
+ * act on. This is a bare send: the CONFIRMATION lives in the chooser, next to the reading of what
+ * ending it would cost, because that is the only place the PM is looking at both at once.
+ *
+ * Returns false when the socket is not up, so a caller can say "not sent" rather than imply a kill
+ * that never left the page.
+ */
+export function killSession(id) {
+  if (FIXTURE || !id) return false;
+  return send({ t: 'kill', id });
+}
+
 /**
  * The SERVER's session id this tab is bound to, or null. The scratchpad reads it: a pad belongs to
  * the session, and the session's identity is this id — not the tab id (which survives a session

package/workspace/server.js

@@ -369,6 +369,36 @@ function treeForWs(wsIdent) {
 function treeTenants(tree, excludeId) {
   return treeShare.coTenants([...sessions.values()], treeOfWsMap(), tree, excludeId);
 }
+/**
+ * A registry row, described for a human deciding whether to JOIN it rather than start another
+ * (workspace-session-choice). "2 sessions already running" names a fact the PM cannot act on; what
+ * they need is which one, what it is doing, and what ending it would cost.
+ *
+ * Every field is one the sidebar already publishes — the joined presented state, the quiet clock,
+ * the sidebar's own word for it, and the agent's last words. Nothing new is derived here and no
+ * word is re-invented: `sessionState` owns the vocabulary and `treeShare.endRisk` owns the
+ * consequence, and this function only joins them onto one row.
+ */
+function describePeer(s, now) {
+  const d = harness.deriveState(s.state, s.lastOutputAt, now || Date.now());
+  const hx = transcriptHarness(s);
+  const shown = sessionState.presented(d.state, hx && hx.turn);
+  const oc = hx && hx.openCall;
+  const call = oc && oc.verb
+    ? { verb: oc.verb, ageMs: oc.sinceTs ? Math.max(0, (now || Date.now()) - Date.parse(oc.sinceTs)) : null }
+    : null;
+  return {
+    id: s.id, ws: s.ws, name: s.name, agent: s.agent, state: s.state, shown,
+    quietMs: d.quietMs,
+    label: sessionState.label(shown, { quietMs: d.quietMs, call, fmtDur: treeShare.ago }),
+    doing: (harnessOf(s) || {}).lastWords || null,
+  };
+}
+/** The same set as `treeTenants`, each row described. The order is the registry's, unchanged. */
+function treePeersDescribed(tree, excludeId) {
+  const now = Date.now();
+  return treeTenants(tree, excludeId).map((s) => describePeer(s, now));
+}
 function treeWriter(tree) {
   return treeShare.writerOf(treeClaims, treeOfWsMap(), [...sessions.values()], tree);
 }
@@ -382,12 +412,16 @@ function announceTree(s) {
   const tree = treeForWs(s.ws);
   s.tree = tree || null;
   if (!tree) return [];
-  const mates = treeTenants(tree, s.id);
+  // DESCRIBED rows, not bare registry objects: the pane line now carries what each co-tenant is
+  // doing and what ending it would cost, and it must read from the same join the sidebar does.
+  const mates = treePeersDescribed(tree, s.id);
   const holder = treeWriter(tree);
   if (!holder) treeClaims.set(tree, s.id);           // vacant → this session declares itself
   if (!mates.length) return [];                      // alone in the tree: nothing to say
   const held = holder ? (sessions.get(holder) || {}).name : null;
-  const line = treeShare.paneAdvisory(mates, { role: holder ? 'reader' : 'writer', writerName: held });
+  const line = treeShare.paneAdvisory(mates, {
+    role: holder ? 'reader' : 'writer', writerName: held, writerId: holder || s.id, tree,
+  });
   if (line) appendBuf(s, line);
   return mates;
 }
@@ -396,7 +430,9 @@ function treeNoticeFor(s, mates) {
   if (!mates || !mates.length) return null;
   const holder = treeWriter(s.tree);
   const held = holder && holder !== s.id ? (sessions.get(holder) || {}).name : null;
-  return treeShare.coTenancyNotice(mates, { role: holder === s.id ? 'writer' : 'reader', writerName: held });
+  return treeShare.coTenancyNotice(mates, {
+    role: holder === s.id ? 'writer' : 'reader', writerName: held, writerId: holder, tree: s.tree,
+  });
 }
 function wsList() {
   return [...workspaces.values()].map((w) => {
@@ -410,6 +446,12 @@ function wsList() {
       // the client renders the first quietly and the second as a fault (R1/R2).
       repo_key: rid.key, repo_name: rid.name, branch: rid.branch,
       branch_error: rid.branchError, branch_code: rid.branchCode,
+      // The COLLISION UNIT (workspace-session-concurrency), published so a client can answer "who
+      // else is in the tree I am about to start in?" BEFORE it starts anything. Without it the
+      // browser could only find co-tenants via a session that already exists there, which is
+      // exactly one session too late for a chooser. Null for a folder with no git — no index to
+      // collide over, so no group.
+      tree: rid.tree || null,
       // Where the tree came from, and the ONE label the repository list can honestly put on a row.
       // `remote` is the raw origin URL (null when there is none) so a caller can derive a richer
       // answer without guessing; `kind` is the surface's own two-value vocabulary — a repository
@@ -1559,6 +1601,17 @@ function sessionList() {
       // `failed` does not exist (no observable for it). The client re-derives this from the SAME
       // module — see /lib/session-state.js below — so the two can never hold different opinions.
       shown: sessionState.presented(d.state, hx && hx.turn), quietMs: d.quietMs,
+      // The rendered word for that state — computed HERE rather than in each client, because it is
+      // the same join (`sessionState.label`) with the same clock, and a client re-deriving it was
+      // already producing a second, slightly different sentence for one session.
+      label: sessionState.label(sessionState.presented(d.state, hx && hx.turn), {
+        quietMs: d.quietMs,
+        call: hx && hx.openCall && hx.openCall.verb
+          ? { verb: hx.openCall.verb,
+            ageMs: hx.openCall.sinceTs ? Math.max(0, now - Date.parse(hx.openCall.sinceTs)) : null }
+          : null,
+        fmtDur: treeShare.ago,
+      }),
       lastOutputAt: s.lastOutputAt || null,
       lastWords: h.lastWords,
       // the harness proper — structured record, not rendered bytes. Resolved ONCE above and
@@ -2115,7 +2168,7 @@ function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate,
   // Both facts travel: `notice` is a single string on the wire and a branch notice and a co-tenancy
   // notice can both be true of one spawn. joinNotices keeps them both rather than letting the
   // second evict the first exactly when the PM most needs both.
-  const shared = treeNoticeFor(s, treeTenants(s.tree, s.id));
+  const shared = treeNoticeFor(s, treePeersDescribed(s.tree, s.id));
   return { ok: true, session: s, notice: treeShare.joinNotices(notice, shared) };
 }
 
@@ -3091,6 +3144,7 @@ async function handleRequest(req, res) {
   if (p === '/lib/layout.js') return serveFile(res, path.join(__dirname, 'lib', 'layout.js'));
   if (p === '/lib/mobile-nav.js') return serveFile(res, path.join(__dirname, 'lib', 'mobile-nav.js'));
   if (p === '/lib/session-state.js') return serveFile(res, path.join(__dirname, 'lib', 'session-state.js'));
+  if (p === '/lib/tree-share.js') return serveFile(res, path.join(__dirname, 'lib', 'tree-share.js'));
   // The editor computes its live diff with the SAME module the server saves through, so what the PM
   // sees while typing and what gets written cannot disagree. NB: /lib/ is an explicit allowlist, not
   // a directory route — a <script src> for a file missing from this list 404s silently, and the
@@ -3630,9 +3684,13 @@ async function handleRequest(req, res) {
         note: 'this workspace is not inside a git working tree — there is no shared index to collide over' });
     }
     const writer = treeWriter(tree);
-    const rows = treeTenants(tree, null).map((s) => ({
-      id: s.id, name: s.name, ws: s.ws, agent: s.agent, state: s.state,
+    // Described, not merely listed (workspace-session-choice): a caller deciding between joining a
+    // running session and starting another needs the state, the word for it, what the agent is
+    // doing and what ending it would cost — the same four facts the chooser and the pane line show.
+    const rows = treePeersDescribed(tree, null).map((s) => ({
+      ...s,
       role: treeShare.roleOf(s.id, tree, writer),
+      risk: treeShare.endRisk(s.shown, s.quietMs),
     }));
     return json(res, { ok: true, tree, writer, sessions: rows, advisory: true,
       note: writer
@@ -4406,6 +4464,10 @@ module.exports = { server, spawnSession, removeSession, renameSession, sessions,
   // (one repo registered twice is one tree; two worktrees of one repo are two) without driving
   // every case through a spawn.
   treeForWs, treeTenants, treeWriter, treeClaims,
+  // …and the DESCRIBED form, exported for the same reason: "what is that session doing and what
+  // would ending it cost?" is the half of co-tenancy the PM actually acts on, so the suite asserts
+  // it directly rather than reading it back out of a rendered sentence.
+  describePeer, treePeersDescribed,
   // exported so the suite can assert the D08 invariant end-to-end: the harness parsers consume
   // scrubbed text, so a secret printed into scrollback must not survive into a rendered value.
   scrub, harnessOf,