create-pmos 0.250.0 → 0.251.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.250.0",
+  "version": "0.251.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@3bddf04
-assembled: 2026-10-15
+kernel-source: pmos@0657606
+assembled: 2026-10-16
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-15T10:01:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-16T03:26:16Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-15T10:01:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-16T03:26:16Z"}
 status: stable
 ---
 

package/payload/scripts/workflow-state.js

@@ -716,6 +716,9 @@ function computeWorkflowDerived(id, opts) {
       }
       return best;
     }
+    // A caller that never reads `last_activity` (the facts reader) says so, and the subprocess is not started: one per
+    // initiative was 9.5 of the 12 seconds a cold facts read took on this repository.
+    if (opts && opts.skipLastActivity) return null;
     const out = git(root, ['log', '-1', '--format=%ct', '--', ...paths]);
     const t = out && parseInt(out.trim(), 10);
     return Number.isFinite(t) ? t : null;

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-15T10:01:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-16T03:26:16Z"}
 status: stable
 ---
 

package/payload/state/log.md

@@ -2,6 +2,6 @@
 
 Newest first, ISO dates.
 
-## 2026-10-15
+## 2026-10-16
 
 - Adopted OKF v0.2 (D73).

package/workspace/lib/engine/signals/facts.js

@@ -92,7 +92,7 @@ function readRepoFacts(root, opts) {
   const inis = [];
   for (const id of ws.listInitiatives(base)) {
     let w;
-    try { w = ws.computeWorkflow(id, range ? { root: base, range } : { root: base }); } catch { continue; }
+    try { w = ws.computeWorkflow(id, range ? { root: base, range, skipLastActivity: true } : { root: base, skipLastActivity: true }); } catch { continue; }
     if (!w || !w.ok) continue;
     const fm = readFrontmatter(path.join(base, w.record || `planning/initiatives/${id}.md`));
     inis.push({

package/workspace/lib/engine/workflow-state.js

@@ -716,6 +716,9 @@ function computeWorkflowDerived(id, opts) {
       }
       return best;
     }
+    // A caller that never reads `last_activity` (the facts reader) says so, and the subprocess is not started: one per
+    // initiative was 9.5 of the 12 seconds a cold facts read took on this repository.
+    if (opts && opts.skipLastActivity) return null;
     const out = git(root, ['log', '-1', '--format=%ct', '--', ...paths]);
     const t = out && parseInt(out.trim(), 10);
     return Number.isFinite(t) ? t : null;

package/workspace/lib/vendor/scripts/workflow-state.js

@@ -716,6 +716,9 @@ function computeWorkflowDerived(id, opts) {
       }
       return best;
     }
+    // A caller that never reads `last_activity` (the facts reader) says so, and the subprocess is not started: one per
+    // initiative was 9.5 of the 12 seconds a cold facts read took on this repository.
+    if (opts && opts.skipLastActivity) return null;
     const out = git(root, ['log', '-1', '--format=%ct', '--', ...paths]);
     const t = out && parseInt(out.trim(), 10);
     return Number.isFinite(t) ? t : null;

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.250.0",
+  "version": "0.251.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.250.0",
+      "version": "0.251.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.250.0",
+  "version": "0.251.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/server.js

@@ -5873,13 +5873,30 @@ const TYPES = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; ch
 const zlib = require('zlib');
 const GZIP_MIN_BYTES = 1024;
 const GZIP_TYPES = /^(?:text\/|application\/(?:json|javascript|manifest\+json)|image\/svg\+xml)/;
-const wantsGzip = (res) => { const q = res && res.req; return !!(q && q.headers && /\bgzip\b/i.test(String(q.headers['accept-encoding'] || ''))); };
+// Whether this client takes a gzip body: a `gzip` (or `*`) coding in Accept-Encoding whose q-value is not 0. `gzip;q=0` is a
+// refusal. PMOS_NO_COMPRESS=1 turns compression off, so a proxy or client that mishandles it can be ruled out in one restart.
+const NO_COMPRESS = process.env.PMOS_NO_COMPRESS === '1';
+function wantsGzip(res) {
+  if (NO_COMPRESS) return false;
+  const q = res && res.req;
+  const h = q && q.headers && q.headers['accept-encoding'];
+  if (!h) return false;
+  for (const part of String(h).split(',')) {
+    const [coding, ...params] = part.trim().toLowerCase().split(';');
+    if (coding !== 'gzip') continue;
+    const qv = params.map((x) => x.trim()).find((x) => x.startsWith('q='));
+    return !(qv && Number(qv.slice(2)) === 0);
+  }
+  return false;
+}
 const fileMemo = new Map();     // file -> { sig, buf, etag, gz }
 const FILE_MEMO_MAX = 400;
 function serveFile(res, file, type, noCache) {
   fs.stat(file, (serr, st) => {
     if (serr || !st.isFile()) { res.writeHead(404); res.end('not found'); return; }
-    const sig = `${st.size}:${st.mtimeMs}`;
+    // size, mtime, change time and inode: a package install stamps every file with one fixed mtime, so size and mtime alone
+    // would keep serving the old bytes after a same-size edit.
+    const sig = `${st.size}:${st.mtimeMs}:${st.ctimeMs}:${st.ino}`;
     const send = (m) => {
       const ctype = type || TYPES[path.extname(file)] || 'application/octet-stream';
       const headers = { 'Content-Type': ctype, 'ETag': m.etag };
@@ -5902,7 +5919,7 @@ function serveFile(res, file, type, noCache) {
     if (hit && hit.sig === sig) return send(hit);
     fs.readFile(file, (err, buf) => {
       if (err) { res.writeHead(404); res.end('not found'); return; }
-      const m = { sig, buf, etag: `W/"${st.size.toString(16)}-${Math.floor(st.mtimeMs).toString(16)}"`, gz: null };
+      const m = { sig, buf, etag: `"${require('crypto').createHash('sha1').update(buf).digest('hex').slice(0, 20)}"`, gz: null };
       const ctype = type || TYPES[path.extname(file)] || '';
       const finish = () => { if (fileMemo.size >= FILE_MEMO_MAX) fileMemo.clear(); fileMemo.set(file, m); send(m); };
       if (buf.length >= GZIP_MIN_BYTES && GZIP_TYPES.test(ctype)) zlib.gzip(buf, (e, gz) => { if (!e) m.gz = gz; finish(); });
@@ -6021,6 +6038,7 @@ function json(res, obj, code = 200) {
   if (body.length >= GZIP_MIN_BYTES && wantsGzip(res)) {
     // Async, so a 1 MB library answer costs the loop nothing beyond the stringify (workspace-event-loop-lag).
     return zlib.gzip(body, (e, gz) => {
+      if (res.headersSent || res.writableEnded || res.destroyed) return;   // the handler or the client got there first
       if (e) { res.writeHead(code, { 'Content-Type': 'application/json' }); res.end(body); return; }
       res.writeHead(code, { 'Content-Type': 'application/json', 'Content-Encoding': 'gzip', 'Vary': 'Accept-Encoding', 'Content-Length': gz.length });
       res.end(gz);