create-pmos 0.26.0 → 0.27.0

package/workspace/public/pm/data.js

@@ -795,6 +795,11 @@ function schedulePoll() {
 export async function loadRepos() {
   if (FIXTURE) return [];
   const out = await getJson('/api/workspaces');
+  // The server's one answer to "is the runtime state settled?", published straight onto state so
+  // panel 1 can say so. Under an unmigrated conflict the lists below are short by everything the
+  // per-user state directory does not hold, and a list that is short without saying so is the
+  // silent failure this key exists to end. `{ok:true}` publishes too — the banner reads `ok`.
+  const health = out && out.state_health ? out.state_health : null;
   const rows = foldWorkspaces(out && out.workspaces);
   productOrder = rows.map((r) => r.name);
   for (const r of rows) products.set(r.name, Object.assign(products.get(r.name) || {}, r));
@@ -808,6 +813,7 @@ export async function loadRepos() {
   // actually on screen. A restored selection from the PM's last session always wins.
   const sel = state.sel || (p ? firstSlugOf(p.name) : null);
   setState({
+    stateHealth: health,
     wsId: p ? p.ws : null,
     // NOT initialised to a value here. What is resolvable is the server's derivation from the PM's
     // agent profiles, it arrives with the first `/api/initiative` payload, and seeding a `[]` in the
@@ -942,6 +948,63 @@ export async function listFolder(dir) {
   return getJson('/api/fs/list', dir ? { path: dir } : null);
 }
 
+/* ── what the session pre-flight asks the server ───────────────────────────────────────────────
+ * Four read-only endpoints that have been served all along with no client reading them. They are
+ * the questions the retired composer asked before a session started, and losing the client half is
+ * what left `＋ session` spawning on defaults nobody chose.
+ *
+ * Every one declines in FIXTURE mode, and that is load-bearing rather than tidy: the fixture render
+ * must make no network call at all — it is what lets no-network.test.js and the design comparator
+ * trust a fixture run. The form degrades to "no repository was read" and the fixture's own profile
+ * list, which is a true statement about fixture mode rather than a blank.
+ */
+
+/**
+ * Every branch of a workspace's repository, plus which one is current and which are already
+ * checked out in another working tree. Returns the server's `gitInfo.branchInfo` verbatim, so a
+ * non-repo answers `{ok:false, code, error}` and NEVER a fabricated branch — the difference
+ * between "this folder has no git" and "git failed" is the picker's to show, so it must survive
+ * the trip.
+ */
+export async function loadBranches(ws) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode reads no repository' };
+  if (!ws) return { ok: false, error: 'no repository selected' };
+  return getJson('/api/git/branches', { ws });
+}
+
+/**
+ * The Claude profile descriptors, as `{ok, absent, dir, profiles, broken, prefs, error}`.
+ *
+ * All six fields matter to the caller and none may be flattened here: `absent` ("the directory does
+ * not exist") is a different sentence from a successful read that found none; `broken` names a
+ * descriptor that must be shown and NOT offered, while every good one beside it is still offered;
+ * and `prefs` is what preselects a chip, replacing a hardcoded 'claude-work' that named a file this
+ * client had never opened.
+ *
+ * `env` values are absent by construction on the server side (profileWire) — D08's discipline
+ * covers anything the browser receives, and an overlay is where a credential lives.
+ */
+export async function loadProfiles() {
+  if (FIXTURE) return { ok: false, error: 'fixture mode reads no profiles' };
+  return getJson('/api/profiles');
+}
+
+/** Remember the profile this agent should preselect next time. The server refuses a preference for
+ * a descriptor it cannot read, so a stored id always resolves to a chip that is on screen. */
+export async function preferProfile(agent, profile) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode remembers nothing' };
+  return postJson('/api/profiles/prefer', { agent, profile });
+}
+
+/** Every working tree of this workspace's repo. The pre-flight reads it for ONE purpose: a branch
+ * checked out elsewhere is a branch git will refuse, and the PM should read that in the picker
+ * rather than as an error after the click. */
+export async function loadWorktrees(ws) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode reads no repository' };
+  if (!ws) return { ok: false, error: 'no repository selected' };
+  return getJson('/api/git/worktrees', { ws });
+}
+
 /**
  * panel-tabs.js — `startSession(slug, sess)`. Deliberately NOT a spawn.
  *

package/workspace/public/pm/panel-initiatives.js

@@ -264,7 +264,14 @@ export function openTerm(slug, sess) {
   const key = slug ? 'term:' + slug + ':' + sess.name : 'term:sess:' + ((sess && sess.id) || sess.name);
   openTab({
     id: key, kind: 'term', title: sess.name, slug: slug || null,
-    repo: slug ? slugProduct()[slug] : null, sess: sess.name, state: sess.st, profile: sess.profile || 'claude-work',
+    /* `profile` is the session's OWN, or null — never the literal 'claude-work'. It used to default
+     * to that string, which was a claim about a descriptor this client had never read: nothing in
+     * data.js reads /api/profiles, so the name was invented here and then filed on the session. It
+     * also became load-bearing the moment the tab's profile started travelling to the server on a
+     * spawn, because `resolveProfileForSpawn` REFUSES a profile it cannot find — a fabricated
+     * default would have turned "no profile chosen" into "session refused". Every display reader
+     * (fixture.js:853, modes.js:658/808) already supplies its own fallback for null. */
+    repo: slug ? slugProduct()[slug] : null, sess: sess.name, state: sess.st, profile: sess.profile || null,
     /* The SERVER's session id, when the row that was clicked carries one. This is the exact join:
      * with it, the terminal attaches to precisely the PTY the PM pointed at, and a reload attaches
      * to the same one again. Without it the tab falls back to matching by NAME, and names repeat

package/workspace/public/pm/panel-newsess.js

@@ -0,0 +1,507 @@
+/* pm/panel-newsess.js — the session pre-flight: the questions asked BEFORE a PTY exists.
+ *
+ * ── What this is, and what it is not ────────────────────────────────────────────────────────
+ * It is NOT a resurrection of `app.js`'s composer. That file's imperative `$()`/`innerHTML` style
+ * is retired; this is `el()`/`setState()` and design tokens like every other four-panel module.
+ * What is ported is the composer's INTENT — the five questions it asked and, more importantly, the
+ * three places it told the truth about what it could not read.
+ *
+ * It is also NOT the primary way to start a session. `workspace-repo-first`'s accepted PRD is
+ * explicit: one click is primary and the composer is *"demoted, not deleted"*. `＋ session` keeps
+ * its one-click behaviour and its co-tenancy chooser; this is the `⋯ options` path beside it, for
+ * the cases the one-click rule does not cover — a branch off a tag, a colleague's branch, an
+ * existing worktree, a specific profile for this session only.
+ *
+ * ── Why it renders in panel 4 and not panel 3 ───────────────────────────────────────────────
+ * It occupies the same slot as `startPromptBlock` (panel-tabs.js): above the panes, below the tab
+ * bar. Two reasons, and the second is the load-bearing one:
+ *   1. It is about the click that was just made in that bar, so it belongs beside it.
+ *   2. Every open pane hosts a live xterm, and a terminal that is re-parented by an unrelated
+ *      render silently loses its grid. Rendering here leaves every pane exactly where it was;
+ *      taking over the panes row would move them.
+ *
+ * ── The one property everything else exists to serve ────────────────────────────────────────
+ * A REFUSAL STARTS NOTHING AND SHOWS NOTHING. `onStart` awaits `requestSpawn`, and only a resolved
+ * `{ok:true}` writes an `extraSess` row or opens a tab. On `{ok:false}` the form stays open with
+ * the server's own sentence in it — no tab, no pane, no xterm, no row. The defect this replaces
+ * did the opposite: the click built the tab, the pane's own render asked for the PTY, and the
+ * refusal was written as a dimmed line INSIDE a terminal belonging to a session that was never
+ * started.
+ */
+
+import { el } from './dom.js';
+import { state, setState, FIXTURE } from './state.js';
+import * as FX from './fixture.js';
+import { openTerm as openTermTab } from './panel-initiatives.js';
+
+/* Both are another module's file, loaded lazily for the reason panel-tabs.js gives: a static import
+ * of a file that fails to load takes this whole module down with it, and a panel that cannot draw
+ * is a worse failure than a form that cannot start a session yet. */
+let dataMod = null;
+import('./data.js').then((m) => { dataMod = m; setState({}); }).catch(() => { dataMod = null; });
+let termMod = null;
+import('./tab-term.js').then((m) => { termMod = m; }).catch(() => { termMod = null; });
+
+/** One interpolated value in its own span — the convention every panel module renders values with. */
+const iv = (v) => el('span', null, v === null || v === undefined ? '' : String(v));
+
+/* ── styles: design tokens only, no raw hex (workspace-ci's token-hygiene check) ────────────── */
+
+const WRAP = 'flex:none;max-height:56vh;overflow-y:auto;display:flex;flex-direction:column;gap:9px;'
+  + 'padding:12px 14px;border-bottom:1px solid var(--border);background:var(--card)';
+const TITLE = 'font-size:12.5px;color:var(--foreground)';
+const SUB = 'font-size:11.5px;color:var(--muted-foreground);line-height:1.5';
+const LABEL = 'font-family:var(--mono);font-size:9.5px;letter-spacing:.12em;text-transform:uppercase;'
+  + 'color:var(--muted-foreground)';
+const ROW = 'display:flex;gap:6px;align-items:center;flex-wrap:wrap';
+const INPUT = 'font-family:var(--mono);font-size:11.5px;padding:5px 8px;min-height:30px;'
+  + 'background:var(--secondary);border:1px solid var(--input);color:var(--foreground);min-width:200px';
+const CHIP = 'font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:26px;'
+  + 'background:var(--secondary);border:1px solid var(--border);color:var(--foreground)';
+const CHIP_ON = 'font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:26px;'
+  + 'background:var(--accent);border:1px solid var(--ring);color:var(--foreground)';
+const CHIP_DEAD = 'font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:26px;'
+  + 'background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground);opacity:.55';
+const CHIP_BAD = 'font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:26px;'
+  + 'background:var(--secondary);border:1px solid var(--destructive);color:var(--destructive);opacity:.75';
+const HOVER = 'border-color:var(--ring)';
+/* `--brand` is the token layer's one accent; there is no `--primary` in tokens.css and inventing a
+ * name would be a token that resolves to nothing in both themes. */
+const PRIMARY = 'font-family:var(--mono);font-size:11px;padding:6px 14px;min-height:32px;'
+  + 'background:var(--brand-wash);border:1px solid var(--brand);color:var(--foreground)';
+const PRIMARY_OFF = 'font-family:var(--mono);font-size:11px;padding:6px 14px;min-height:32px;'
+  + 'background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground)';
+const ERR = 'font-size:11.5px;line-height:1.5;color:var(--destructive);'
+  + 'border:1px solid var(--destructive);padding:7px 9px;overflow-wrap:anywhere';
+const WARN = 'font-size:11px;line-height:1.5;color:var(--warning);overflow-wrap:anywhere';
+const MUTED_MONO = 'font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);overflow-wrap:anywhere';
+
+/* ── open / close ──────────────────────────────────────────────────────────────────────────── */
+
+/**
+ * Open the pre-flight for `slug`. NOTHING is started and nothing is written to `extraSess` — that
+ * is the entire difference from `newSession()`, which files the row and opens the tab up front.
+ *
+ * The name is seeded rather than imposed: `<slug> <n>` beats `agent <n>` because the tab bar shows
+ * it and "agent 3" says nothing about which of three initiatives it is on. `n` counts past every
+ * name the window can see, the same way `nextSessionName` does, so re-opening the form after a
+ * reload does not propose a name that is already taken.
+ */
+export function openNewSession(slug, seed) {
+  if (!slug) return;
+  const s = seed || {};
+  setState({
+    newSess: { slug },
+    startPrompt: null, endConfirm: null,
+    newSessName: s.name || proposeName(slug),
+    newSessAgent: s.agent || 'shell',
+    newSessBranch: '', newSessBranchNew: '', newSessBranchMode: false,
+    newSessIsolate: null, newSessError: null, newSessBusy: false,
+    // Cleared on the way IN as well as on the way out: a form that opened still showing the profile
+    // a previous, abandoned question had chosen would be proposing an answer nobody gave.
+    preflightProfile: s.profile === undefined ? null : s.profile,
+  });
+  refreshReads();
+}
+
+/**
+ * Close it, discarding what was typed. A cancelled question leaves no residue — and `preflightProfile`
+ * is part of "no residue", not an exception to it.
+ *
+ * It used to survive the close, in a slot `＋ session` also read, so a profile picked here and then
+ * cancelled was filed onto the next one-click start and sent to the server as a spawn instruction.
+ * The server refuses a descriptor it cannot resolve, so the click opened a terminal and wrote a
+ * refusal into it for a session that was never started. Clearing it here is half the repair; the
+ * other half is that `＋ session` no longer reads this at all (panel-tabs.js).
+ */
+export function closeNewSession() {
+  setState({ newSess: null, newSessError: null, newSessBusy: false, preflightProfile: null });
+}
+
+export const isNewSessionOpen = () => !!state.newSess;
+
+/** The next free `<slug> <n>`, counted against every name this window can see. */
+function proposeName(slug) {
+  const re = new RegExp('^' + slug.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ' (\\d+)$');
+  let max = 0;
+  const bump = (name) => { const m = re.exec(String(name || '')); if (m) max = Math.max(max, Number(m[1])); };
+  for (const x of (state.sessions || [])) bump(x && x.name);
+  for (const k in (state.extraSess || {})) for (const x of (state.extraSess[k] || [])) bump(x && x.name);
+  for (const t of (state.tabs || [])) if (t && t.kind === 'term') bump(t.sess);
+  return slug + ' ' + (max + 1);
+}
+
+/* ── the two server reads ──────────────────────────────────────────────────────────────────── */
+
+/* Fired when the form opens, and again when the server says a branch moved. Both reads are
+ * independent and each writes only its own key, so a repository with no git still gets its profile
+ * chips and a machine with no profile directory still gets its branch picker. */
+function refreshReads() {
+  if (FIXTURE || !dataMod) return;
+  const ws = state.wsId || null;
+  if (typeof dataMod.loadBranches === 'function') {
+    dataMod.loadBranches(ws).then((r) => setState({ newSessBranches: r || null })).catch(() => {});
+  }
+  if (typeof dataMod.loadProfiles === 'function') {
+    dataMod.loadProfiles().then((r) => {
+      setState({ profiles: r || null });
+      // Preselect from the server's remembered preference — never from a hardcoded name. A
+      // preference naming a descriptor that no longer reads preselects NOTHING rather than
+      // substituting another, which is the same rule the server applies to the preference itself.
+      const pref = r && r.prefs ? r.prefs[state.newSessAgent] : null;
+      const live = (r && Array.isArray(r.profiles) ? r.profiles : []).map((p) => p && p.id);
+      if (pref && live.includes(pref) && !state.preflightProfile) setState({ preflightProfile: pref });
+    }).catch(() => {});
+  }
+}
+
+/* The `{t:'branch'}` broadcast lands in `state.branchInfo` (tab-term.js). When it names the
+ * workspace this form is asking about, the picker's own read is stale and is taken again — this is
+ * what stopped the retired composer's picker going stale after a checkout made in a terminal. */
+let lastBranchAt = 0;
+function absorbBranchBroadcast() {
+  const b = state.branchInfo;
+  if (!b || !state.newSess) return;
+  if (b.at === lastBranchAt) return;
+  lastBranchAt = b.at;
+  if (b.ws && state.wsId && b.ws !== state.wsId) return;
+  // The broadcast carries a full branchInfo payload, so it is usable directly; the re-read is for
+  // the fields a broadcast may not carry (worktree occupancy).
+  setState({ newSessBranches: { ok: true, ...b } });
+  refreshReads();
+}
+
+/* ── the branch picker ─────────────────────────────────────────────────────────────────────── */
+
+/**
+ * The picker, or an honest line saying why there is none. Three outcomes, and they are three
+ * different sentences on purpose — a folder with no git is not the same event as git failing, and
+ * neither is the same as "the read has not come back yet".
+ */
+function branchSection() {
+  const info = state.newSessBranches;
+  const out = [];
+  out.push(el('div', { style: LABEL }, 'branch'));
+
+  if (FIXTURE) {
+    out.push(el('div', { style: SUB }, 'fixture mode reads no repository — a session started here applies no branch'));
+    return out;
+  }
+  if (!info) {
+    out.push(el('div', { style: SUB }, 'reading the repository…'));
+    return out;
+  }
+  if (info.ok === false) {
+    /* `code` distinguishes the two. A folder that is not a repository is a normal, calm fact and
+     * the control is simply absent. A git error is NOT calm: it is said in warn colour with git's
+     * own words, because "no branch control" would otherwise read as "no git here" and the PM would
+     * never learn their repository is unreadable. */
+    const notRepo = info.code === 'not-a-repo' || /not a git repository/i.test(info.error || '');
+    out.push(notRepo
+      ? el('div', { style: SUB }, 'this repository is not a git working tree — a session starts here with no branch applied')
+      : el('div', { style: WARN }, iv('the branch list could not be read — ' + (info.error || 'git gave no reason'))));
+    return out;
+  }
+
+  const current = info.branch || null;
+  const branches = Array.isArray(info.branches) ? info.branches : [];
+  /* A branch checked out in ANOTHER working tree is a branch git will refuse to check out here.
+   * Offering it and letting the server say no would be technically honest and practically rude:
+   * the PM would meet the refusal after the click. It is shown, named with where it is, and
+   * disabled. */
+  const elsewhere = new Map();
+  for (const w of (Array.isArray(info.worktrees) ? info.worktrees : [])) {
+    if (!w || !w.branch || w.branch === current) continue;
+    if (!elsewhere.has(w.branch)) elsewhere.set(w.branch, w.dir || 'another working tree');
+  }
+
+  const pick = (v) => setState({ newSessBranch: v, newSessBranchMode: false, newSessError: null });
+  const chips = [
+    // ALWAYS first and ALWAYS the default: starting a session must never require a git decision.
+    el('button', {
+      onClick: () => pick(''),
+      style: state.newSessBranch === '' && !state.newSessBranchMode ? CHIP_ON : CHIP, hover: HOVER,
+    }, iv('stay on current' + (current ? ' (' + current + ')' : ''))),
+  ];
+  for (const b of branches) {
+    if (b === current) continue;
+    const taken = elsewhere.get(b);
+    chips.push(taken
+      ? el('button', {
+          disabled: true, title: 'git will not check this out twice — it is already in ' + taken,
+          style: CHIP_DEAD,
+        }, iv(b + ' — in ' + shortPath(taken)))
+      : el('button', {
+          onClick: () => pick(b),
+          style: state.newSessBranch === b && !state.newSessBranchMode ? CHIP_ON : CHIP, hover: HOVER,
+        }, iv(b)));
+  }
+  chips.push(el('button', {
+    onClick: () => setState({ newSessBranchMode: true, newSessBranch: '', newSessError: null }),
+    style: state.newSessBranchMode ? CHIP_ON : CHIP, hover: HOVER,
+  }, '+ new branch…'));
+
+  out.push(el('div', { style: ROW }, chips));
+
+  if (state.newSessBranchMode) {
+    out.push(el('div', { style: ROW },
+      el('input', {
+        value: state.newSessBranchNew, placeholder: 'initiative/my-branch', style: INPUT,
+        // Written straight onto the state object WITHOUT a render: a repaint between keystrokes
+        // rebuilds the input and takes the caret with it. Same contract as panel-detail's newField.
+        onInput: (e) => { state.newSessBranchNew = e.target.value; },
+        onChange: () => setState({}),
+      }),
+    ));
+  }
+
+  // Isolation is only a question once a branch is actually being changed. Asked about a session
+  // that is staying put, it would be a checkbox with no meaning.
+  if (state.newSessBranchMode || state.newSessBranch) {
+    const on = isolateNow();
+    out.push(el('div', { style: ROW },
+      el('button', {
+        onClick: () => setState({ newSessIsolate: !on }),
+        style: on ? CHIP_ON : CHIP, hover: HOVER,
+      }, iv((on ? '☑' : '☐') + ' its own folder (worktree)')),
+      el('span', { style: SUB }, iv(on
+        ? 'the branch is checked out in a new folder — sessions already running are untouched'
+        : 'this repository is switched to that branch — every session already in it moves too')),
+    ));
+  }
+  return out;
+}
+
+const shortPath = (p) => { const s = String(p || ''); const i = s.lastIndexOf('/'); return i < 0 ? s : s.slice(i + 1); };
+
+/** What the isolate checkbox currently reads — the PM's choice if they made one, else the server's
+ * own rule (protect other sessions when there are other sessions to protect), computed here so the
+ * box shows what will actually be sent rather than an unchecked default that means something else. */
+function isolateNow() {
+  if (state.newSessIsolate !== null && state.newSessIsolate !== undefined) return state.newSessIsolate;
+  const ws = state.wsId;
+  const live = (state.sessions || []).filter((s) => s && s.ws === ws && s.state !== 'exited');
+  return live.length > 0;
+}
+
+/* ── the profile chips ─────────────────────────────────────────────────────────────────────── */
+
+/**
+ * Ported from `renderProfileChips` (app.js:1655) for its three honesty branches, which are the
+ * whole reason this is not just a list:
+ *   · a FAILED read offers only `no profile`, and says why in the server's own words;
+ *   · a BROKEN descriptor is named, marked, and NOT offered — while every good chip beside it
+ *     still is, because one bad file must not turn the surface into a stated absence;
+ *   · `absent` ("the directory does not exist") reads differently from a read that found none.
+ */
+function profileSection() {
+  const out = [el('div', { style: LABEL }, 'profile')];
+  const p = state.profiles;
+
+  const chipFor = (id, label) => el('button', {
+    onClick: () => setState({ preflightProfile: id, newSessError: null }),
+    style: state.preflightProfile === id ? CHIP_ON : CHIP, hover: HOVER,
+  }, iv(label || id));
+
+  // `no profile` is a REAL choice, not the absence of one: it is sent as `profile: null`, which the
+  // server distinguishes from a client that forgot the field.
+  const none = chipFor(null, 'no profile');
+
+  if (FIXTURE) {
+    const list = (FX.PROFILES || []).map((x) => x && x.id).filter(Boolean);
+    out.push(el('div', { style: ROW }, none, list.map((id) => chipFor(id))));
+    return out;
+  }
+  if (!p) { out.push(el('div', { style: SUB }, 'reading the profile descriptors…')); return out; }
+
+  if (p.ok === false || p.error) {
+    out.push(el('div', { style: ROW }, none));
+    out.push(el('div', { style: WARN },
+      iv('the profile descriptors could not be read — ' + (p.error || 'no reason given')
+        + '. Only “no profile” is offered; PMOS will not name a descriptor it did not read.')));
+    return out;
+  }
+
+  const good = Array.isArray(p.profiles) ? p.profiles : [];
+  const broken = Array.isArray(p.broken) ? p.broken : [];
+  out.push(el('div', { style: ROW },
+    none,
+    good.map((x) => chipFor(x.id, x.id)),
+    // Shown and withheld in the same breath. An unusable descriptor that simply vanished would
+    // leave the PM wondering where their profile went.
+    broken.map((b) => el('button', { disabled: true, style: CHIP_BAD, title: b.error },
+      iv((b.file || '?').replace(/\.json$/, '') + ' — unusable'))),
+  ));
+
+  if (p.absent) {
+    out.push(el('div', { style: SUB }, iv('no profile directory at ' + (p.dir || '?')
+      + ' — nothing was read, so nothing is offered but “no profile”')));
+  } else if (!good.length && !broken.length) {
+    out.push(el('div', { style: SUB }, iv((p.dir || 'the profile directory') + ' was read and holds no descriptors')));
+  }
+  if (broken.length) {
+    out.push(el('div', { style: WARN },
+      iv(broken.length + ' descriptor' + (broken.length === 1 ? '' : 's') + ' could not be parsed and '
+        + (broken.length === 1 ? 'is' : 'are') + ' not offered: '
+        + broken.map((b) => b.file + ' (' + b.error + ')').join(' · '))));
+  }
+  return out;
+}
+
+/* ── starting ──────────────────────────────────────────────────────────────────────────────── */
+
+/**
+ * THE INVERSION. Ask first; open only on an answer that said yes.
+ *
+ * Every early exit and every failure path here leaves the surface exactly as it found it. There is
+ * deliberately no `finally` that opens a tab, no `catch` that assumes success, and no best-effort
+ * write to `extraSess` before the await — the previous implementation's `try { … } catch {}` around
+ * the real start, with the tab already open, is the shape being removed.
+ */
+async function onStart() {
+  if (state.newSessBusy) return;                 // one request per press; the button also disables
+  const open = state.newSess;
+  if (!open) return;
+  const slug = open.slug;
+  const name = String(state.newSessName || '').trim() || proposeName(slug);
+  const createBranch = !!state.newSessBranchMode;
+  const branch = createBranch ? String(state.newSessBranchNew || '').trim() : (state.newSessBranch || null);
+
+  if (createBranch && !branch) {
+    setState({ newSessError: 'name the new branch, or choose “stay on current”' });
+    return;
+  }
+
+  /* FIXTURE MODE FILES THE ROW AND OPENS THE TAB WITH NO REQUEST AT ALL.
+   *
+   * That is not a shortcut around R1, it is R1's premise: in fixture mode there is no server, so
+   * "did the server accept?" is not a question that exists to be answered honestly. The offline
+   * demo path must make no network call — it is what lets no-network.test.js and the design
+   * comparator trust a fixture run — and a form that could never complete there would be a dead
+   * control in the only mode the comparator ever sees. The refusal contract is a REAL-MODE
+   * contract and is asserted in real mode (pm-term-test.js).
+   */
+  if (FIXTURE) {
+    const sess = { name, st: 'working', label: 'working', profile: state.preflightProfile || null,
+      branch: branch || null };
+    setState((s) => ({
+      // The question is over, so its answer is discarded with it — see closeNewSession.
+      newSess: null, newSessBusy: false, newSessError: null, preflightProfile: null,
+      extraSess: { ...s.extraSess, [slug]: [...(s.extraSess[slug] || []), sess] },
+    }), () => openTermTab(slug, sess));
+    return;
+  }
+
+  if (!termMod || typeof termMod.requestSpawn !== 'function') {
+    setState({ newSessError: 'the terminal module has not loaded — nothing was started' });
+    return;
+  }
+
+  setState({ newSessBusy: true, newSessError: null });
+  const res = await termMod.requestSpawn({
+    name,
+    agent: state.newSessAgent || 'shell',
+    ws: state.wsId || null,
+    branch: branch || null,
+    createBranch,
+    // Sent explicitly, ALWAYS, and only when a branch is in play — the server defaults an omitted
+    // value from liveSessionCount, and its own comment asks the client to state what the PM saw.
+    isolate: branch ? isolateNow() : null,
+    profile: state.preflightProfile === undefined ? null : state.preflightProfile,
+  });
+
+  if (!res || !res.ok) {
+    /* THE REFUSAL PATH. The form stays open, the server's sentence is shown in it, and NOTHING was
+     * created: no tab, no pane, no xterm, no extraSess row. This is the assertion the rubric makes
+     * a veto. */
+    setState({ newSessBusy: false, newSessError: (res && res.error) || 'the workspace server refused, without saying why' });
+    return;
+  }
+
+  /* Accepted. Only now does anything appear. The session record carries the SERVER's id, so the tab
+   * opened from it attaches to precisely this PTY — `bind()` returns at its first line and never
+   * reaches the fallback spawn, so one press cannot produce two sessions. */
+  const sess = {
+    name, st: 'working', label: 'working',
+    profile: state.preflightProfile || null,
+    branch: branch || null,
+    id: res.id,
+  };
+  setState((s) => ({
+    // `sess` above already carries the profile; the slot is cleared with the question it answered,
+    // so the next `＋ session` cannot inherit it. See closeNewSession.
+    newSess: null, newSessBusy: false, newSessError: null, preflightProfile: null,
+    extraSess: { ...s.extraSess, [slug]: [...(s.extraSess[slug] || []), sess] },
+  }), () => {
+    openTermTab(slug, sess);
+    // The server's non-fatal truth about what it just did — a worktree's path, "not a git
+    // repository, so no branch was applied". It travelled with the acceptance and is written into
+    // the pane it is about, rather than being dropped because the request succeeded.
+    if (res.notice && termMod && typeof termMod.noteOnTab === 'function') {
+      termMod.noteOnTab('term:' + slug + ':' + name, 'pmos: ' + res.notice);
+    }
+  });
+  if (dataMod && typeof dataMod.startSession === 'function') {
+    try { dataMod.startSession(slug, sess); } catch { /* the poll is a refresh, not the start */ }
+  }
+}
+
+/* ── render ────────────────────────────────────────────────────────────────────────────────── */
+
+/** The pre-flight block, or null when it is closed. Called from panel-tabs.js's render. */
+export function newSessionBlock() {
+  if (!state.newSess) return null;
+  absorbBranchBroadcast();
+  const slug = state.newSess.slug;
+  const busy = !!state.newSessBusy;
+
+  return el('div', { style: WRAP },
+    el('div', { style: 'display:flex;gap:8px;align-items:baseline;flex-wrap:wrap' },
+      el('span', { style: TITLE }, 'start a session — more options'),
+      el('span', { style: MUTED_MONO }, iv(slug)),
+    ),
+    el('div', { style: SUB },
+      'What this session runs, and where. ＋ session does all of this in one click on the rule; '
+      + 'this is for the times the rule is not what you want.'),
+
+    el('div', { style: LABEL }, 'name'),
+    el('div', { style: ROW },
+      el('input', {
+        value: state.newSessName, placeholder: slug + ' 1', style: INPUT, disabled: busy,
+        onInput: (e) => { state.newSessName = e.target.value; },
+        onChange: () => setState({}),
+      }),
+    ),
+
+    el('div', { style: LABEL }, 'agent'),
+    el('div', { style: ROW },
+      ['shell', 'claude'].map((a) => el('button', {
+        onClick: () => setState({ newSessAgent: a, newSessError: null }),
+        style: state.newSessAgent === a ? CHIP_ON : CHIP, hover: HOVER,
+      }, iv(a))),
+      el('span', { style: SUB }, 'a CLI that is not on PATH is refused by the server, and says so'),
+    ),
+
+    branchSection(),
+    profileSection(),
+
+    // The refusal, where the question was asked. It is rendered ABOVE the button so the PM reads it
+    // before pressing again, and it survives until something changes.
+    state.newSessError ? el('div', { style: ERR }, iv(state.newSessError)) : null,
+
+    el('div', { style: 'display:flex;gap:6px;align-items:center;flex-wrap:wrap;padding-top:2px' },
+      el('button', {
+        onClick: () => { if (!busy) onStart(); },
+        disabled: busy, style: busy ? PRIMARY_OFF : PRIMARY, hover: busy ? null : HOVER,
+      }, busy ? 'starting…' : 'start session'),
+      el('button', { onClick: () => closeNewSession(), style: CHIP, hover: HOVER, disabled: busy }, 'cancel'),
+    ),
+
+    el('div', { style: SUB },
+      'Nothing appears until the server says it started. If it refuses — an unreadable profile, a '
+      + 'branch git will not check out — you will read the reason here and no session, tab or '
+      + 'terminal will have been created.'),
+  );
+}
+
+export default newSessionBlock;

package/workspace/public/pm/panel-repos.js

@@ -245,6 +245,36 @@ export function onAddProduct() { setDetail({ kind: 'addprod' }); }
  * Fill panel 1. `host` IS the prototype's open-panel container (app.js owns its style), so this
  * appends the panel's three parts as direct children and never wraps them.
  */
+/* ── AN UNSETTLED STATE ROOT, ON SCREEN ──────────────────────────────────────────────────────
+ * `state_health` arrives on /api/workspaces (and on /api/skills, /api/schedules and every
+ * /api/console payload). When it is `{ok:false}` the workspace could not move the PM's runtime
+ * state out of the checkout, and anything the per-user directory does not hold would otherwise
+ * render as a confident empty list — which is how the PM came to see zero skills and zero
+ * schedules while forty-five scheduled runs stopped firing.
+ *
+ * IT BRANCHES ON `ok`, NEVER ON `kind`. The server discriminates the reason — `unmigrated` (two
+ * populated directories), `failed` (the filesystem refused the move, with the errno and the cause
+ * in words), `unreadable` (one of the two directories could not be listed, so whether it holds
+ * state is unknown), `unusable-root` (the state root could not be created at all), `unknown` (an
+ * outcome that build did not recognise) — and puts the whole explanation in `error`. Reading only
+ * `ok` and `error` here is what makes a kind added later visible on this surface with no client
+ * change, which is the failure mode that produced this banner's second round: a `kind` the client
+ * had never heard of drawing nothing at all. Two kinds have since been added with no edit here,
+ * and state-isolation's F14/U19 assert each of them on a real screen.
+ *
+ * So it is drawn here, at the top of panel 1, in `--destructive`, on every paint until it is
+ * resolved. It is deliberately NOT dismissible: the condition is still true after the click.
+ * Nothing renders when the state is settled — including in fixture mode, which has no data layer
+ * and therefore never sets the key, so the comparator sees the prototype's markup unchanged. */
+function stateHealthBanner() {
+  const h = state.stateHealth;
+  if (!h || h.ok !== false) return null;
+  return el('div', {
+    'data-state-health': String(h.kind || 'unknown'),
+    style: 'padding:9px 14px;border-bottom:1px solid var(--border);font-size:11px;line-height:1.5;color:var(--destructive)',
+  }, ip(h.error || 'the workspace runtime state is not settled — it could not be moved out of the checkout'));
+}
+
 export function renderRepos(host) {
   const tuples = repoTuples();
   const product = activeProduct(tuples);
@@ -262,6 +292,7 @@ export function renderRepos(host) {
   );
 
   const scroll = el('div', { style: 'flex:1;overflow-y:auto;min-height:0' },
+    stateHealthBanner(),
     tuples.map((t) => repoButton(t, product)),
     el('button', {
       onClick: onAddProduct,