create-pmos 0.27.0 → 0.28.0

package/README.md

@@ -333,6 +333,32 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.28.0
+
+**`search everything…` now searches every file in the folder, and any file it finds opens in a tab.**
+Run `npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **The box searched three lists, and the folder was not one of them.** It matched initiative slugs,
+  paths *declared on* an initiative record, and session names — so a file PMOS had never been told
+  about could not be found by typing its exact name. Worse, the miss read *"nothing matches — a
+  successful read of nothing"*, which is the phrase for *we looked and there was nothing there*,
+  printed after a search that never opened the folder.
+- **Type any part of a name or a path.** Every file under the workspace root now matches, at any
+  depth, whether or not any record mentions it — `README.md`, a script, a CSV you dropped in
+  yesterday. `node_modules/`, `dist/`, `.git/` and the other junk directories are skipped, exactly as
+  the folder lens already skips them, so search and the file tree agree about what is in there.
+- **Type a phrase that is *inside* a file.** Text files are searched by content too, and the result
+  names the file **and the line**, so you can see the match before you open anything.
+- **Click a result and it opens in a document tab** — the same reader you already use, with `view` ·
+  `raw` · `edit` · `diff`. A file the reader cannot show (an image, a binary) is still listed, greyed,
+  and says so, instead of opening a tab onto a failure.
+- **It works in every mode.** The search box was rendered in all seven and did something in exactly
+  one — including doing nothing in the library lens, the one screen that lists files.
+- **It tells you what it did not look at.** The walk is bounded so a huge folder can never hang the
+  box, and any bound that actually bit is stated in the heading. `11 of 1424 searched` is a
+  different sentence from `BOUNDED — files beyond the walk limit were not looked at`, and you get
+  whichever one is true. Nothing leaves your machine, as ever.
+
 ## What's new in 0.26.0
 
 **Your sessions now know which initiative they belong to — whatever branch you are on — and each

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Scaffold the PMOS portable kit \u2014 run the PMOS product-management workflow (initiative \u2192 lane-fit spec \u2192 contract \u2192 build \u2192 three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@86ae610
-assembled: 2026-08-02
+kernel-source: pmos@d333cd5
+assembled: 2026-08-04
 mode: vendor

package/workspace/README.md

@@ -156,6 +156,28 @@ tokens, JWTs, `Authorization:` values, api keys): scrollback holds whatever the
 so D08's never-log-headers discipline applies to what this hands back. Matching runs against
 the *scrubbed* text, so the endpoint cannot be used to grep a secret out.
 
+## `search everything…` searches the folder (the file lens)
+The search box shipped matching three derived lists — initiative slugs, paths **declared on** an
+initiative record, and session names — so a file PMOS had never been told about could not be found
+by typing its exact name, and the miss printed *"nothing matches — a successful read of nothing"*
+after a search that had never opened the folder.
+
+`GET /api/search/files?q=…&ws=…&limit=…` is the folder corpus: every file under the workspace root,
+matched by **path** and by **content**, with the matching line and its number. Clicking a hit opens
+it in the ordinary document tab. It is a **different corpus** from `/api/search` above — that one is
+scrollback, this one is disk — and they are deliberately separate endpoints, because their hits
+share no field and one payload would have to lie about what it looked at.
+
+Three guarantees. The walk uses the **folder lens's own rules** (`node_modules`, `dist`, `.git` and
+the rest skipped, dotted names excluded), so search and the file tree can never disagree about what
+is in the folder. There is **no path parameter** — the query is a needle, not a location — and the
+walk starts at the root and never follows a symlink out of it, so nothing becomes reachable that
+`/api/doc` would refuse; `openable` on each hit reports whether the reader can actually show it.
+And it is **bounded, out loud**: `truncated` means files were never looked at, `content_truncated`
+means every file was named but not every body was read, `scanned`/`content_scanned` give the counts.
+Two caps, two flags — merged into one, the serious flag would light on any repository with a lock
+file in it, which is the same as retiring it.
+
 ## Branches: a new one doesn't move the others
 
 Starting a session, the branch control is **optional** — the default is "stay on current" and it

package/workspace/lib/drive-guard.js

@@ -1,5 +1,6 @@
 'use strict';
-/* drive-guard — the driver's ONLY write path (pmos-autonomous-drive-build, R9).
+/* drive-guard — the driver's ONLY write path (pmos-autonomous-drive-build, R9;
+ * hardened from a denylist to an allowlist by `guard-and-ledger-hardening`, 2026-08-04).
  *
  * THE PROBLEM THIS EXISTS FOR, stated plainly because it is easy to under-rate:
  * nothing in PMOS checks an identity. `/api/gate` sets `pm: true` unconditionally
@@ -20,10 +21,44 @@
  * that throws, and the tests ATTEMPT each forbidden write and assert the throw. A rule the driver
  * is trusted to follow is exactly what leg A showed cannot be trusted.
  *
- * SCOPE, honestly. This binds the DRIVER, not the repo: a human, another agent, or a careless
- * `fs.writeFileSync` elsewhere is unaffected. It is a seatbelt on one vehicle, not a law of
+ * ── WHY THIS IS NOW AN ALLOWLIST ────────────────────────────────────────────────────────────────
+ * The first version was a denylist, and its suite DID attempt each forbidden write and assert the
+ * throw — six attempts, six assertions, exactly as the paragraph above claims. It still shipped
+ * SEVEN bypasses, each measured by an independent pass
+ * (planning/explainers/work-item-entity-surface-explainer.md) by running it against this module:
+ *
+ *   1. `PM_approved` nested 11 deep      — recursion capped at `depth > 8`
+ *   2. `PM_approved: "true"` or `: 1`    — strict `v === true`
+ *   3. the payload JSON.stringify'd      — the `"` defeated /PM_approved\s*[:=]\s*true/
+ *   4. `status: 'PROMOTE'` / `'KILL'`    — the regex required -D / -ED
+ *   5. `payload.frontmatter.status`      — the structured status check was top-level only
+ *   6. `assertWritable({})`              — FAILED OPEN: no file, no payload, no text → returned true
+ *   7. `parent_kr`, an evals verdict,
+ *      `DECISIONS.md`                    — never named at all
+ *
+ * Plus a FALSE POSITIVE the other way: a legitimate initiative record was refused because its
+ * `status:` prose contained the word "promoted".
+ *
+ * The suite probed THE LIST. Nothing probed THE SHAPE OF THE LIST — and a denylist's shape is
+ * "everything somebody thought of". So:
+ *
+ *   - sinks are ALLOWLISTED, closing (7) as a class rather than as three strings;
+ *   - the content guard reads the SERIALIZED request, closing (1), (2) and (3) together — depth,
+ *     type-looseness and stringification all vanish when you look at the text the write would
+ *     actually produce;
+ *   - an unreadable request THROWS, closing (6), the worst of the seven;
+ *   - the disposition match is widened (4), recurses (5), and is anchored to the status value's
+ *     LEADING TOKEN, so a real disposition is refused and prose that merely says "promoted" is not.
+ *
+ * SCOPE, honestly, and unchanged: this binds the DRIVER, not the repo. A human, another agent, or a
+ * careless `fs.writeFileSync` elsewhere is unaffected. It is a seatbelt on one vehicle, not a law of
  * physics — and that limit is the argument for making O5's boolean falsifiable at the engine, which
  * is a separate initiative this one does not pretend to have done.
+ *
+ * AND THE LIMIT WORTH SAYING OUT LOUD: **nothing imports this module** — only workspace/test.js.
+ * The live acceptance writer at `POST /api/gate` appends directly and never calls it. This hardening
+ * makes the boundary correct; it does not make it load-bearing. Its whole value is that when
+ * something does adopt it, it will not adopt seven bypasses with it.
  */
 
 const path = require('path');
@@ -36,53 +71,150 @@ class ForbiddenWrite extends Error {
   }
 }
 
-/** Ledgers that record a human decision. The driver may never append to these. */
-const FORBIDDEN_FILES = Object.freeze(['acceptances.jsonl']);
+/**
+ * The sinks the driver's own free-zone policy sanctions (pmos-autonomous-drive, round 2): research,
+ * routing, the surface explainer, a disposable prototype, and DRAFT specs. Anything not here is
+ * refused — including every ledger, decision log and record nobody thought to enumerate.
+ *
+ * Directory prefixes rather than basenames, because these artifact classes name their files per
+ * initiative. `planning/evals/` admits a draft rubric and NOT `evals.jsonl`, which lives in
+ * `planning/runs/` and is refused with a reason below.
+ */
+const ALLOWED_DIR_PREFIXES = Object.freeze([
+  'planning/prd/',
+  'planning/evals/',
+  'planning/explainers/',
+  'planning/research/',
+  'planning/briefs/',
+  'prototype/',
+]);
+
+/**
+ * Machine ledgers the driver legitimately appends to: its own run record, the verification it owes,
+ * the work-items it declares, and the friction it hits.
+ *
+ * These are BASENAMES rather than a `planning/runs/` prefix, deliberately. Allowing the directory
+ * would admit `acceptances.jsonl`, `evals.jsonl` and `outcome_checks.jsonl` by default, and would
+ * admit the FOURTH ledger somebody adds next year without anyone deciding to — which is exactly the
+ * class-failure this rewrite exists to close. A new ledger is refused until it is named here.
+ *
+ * `agent-runs.jsonl` is on this list even though it carries `pre_run_contract`: the driver logging
+ * its own run is the free zone working as designed, and a fabricated `PM_approved` INSIDE that write
+ * is caught by the content guard below, not by refusing the file.
+ */
+const ALLOWED_BASENAMES = Object.freeze([
+  'agent-runs.jsonl',
+  'verify-queue.jsonl',
+  'work-items.jsonl',
+  'discoveries.md',
+]);
+
+/** Named explicitly so the refusal says WHY, rather than "not on the allowlist". Each of these
+ *  would otherwise be caught by the allowlist anyway — the value here is the message. */
+const HUMAN_DECISION_SINKS = Object.freeze({
+  'acceptances.jsonl': 'the Acceptance Gate is the PM\'s and non-delegable (D12)',
+  'evals.jsonl': 'a Review-Gate verdict on the driver\'s own work is self-grading — the driver may not record one (D40)',
+  'outcome_checks.jsonl': 'whether the bet paid off is the PM\'s judgement (D57)',
+  'DECISIONS.md': 'an architectural decision is the PM\'s (D45)',
+  'pm-decisions.md': 'the PM\'s decision journal is the PM\'s',
+});
+
+/** Disposition tokens (D60), widened to the bare verbs bypass 4 slipped through, and anchored so a
+ *  status VALUE that begins with one is a disposition while prose mentioning one is not. */
+/* Explicit groups, not a trailing `?` on the last letter. The first attempt at this widening wrote
+ * `KILLED?`, which is "KILLE" plus an optional "D" and therefore does NOT match the bare `KILL` —
+ * reintroducing bypass 4 while appearing to fix it. Caught only because every bypass is attempted
+ * individually, which is the whole argument for the suite below. */
+const DISPOSITION_RE = /^\s*"?\s*(PROMOTE(D)?|ITERATE(D)?|KILL(ED)?)\b/i;
 
-/** Disposition tokens (D60). Case-insensitive; a status carrying one is a PM act. */
-const DISPOSITION_RE = /\b(PROMOTED|ITERATE[D]?|KILLED)\b/i;
+/** Truthy-tolerant: an approval the PM never gave is what is being refused; its JSON type is not the
+ *  point. Closes bypass 2. */
+const TRUTHY = new Set([true, 1, 'true', 'TRUE', 'True', 'yes', 'YES', '1']);
 
-/** True when `value` contains a truthy PM_approved anywhere in its object graph. */
-function carriesApproval(value, depth = 0) {
-  if (depth > 8 || value === null || typeof value !== 'object') return false;
+const isObj = (v) => !!v && typeof v === 'object';
+
+/** True when `value` carries a truthy PM_approved anywhere. No depth cap (bypass 1); cycle-safe. */
+function carriesApproval(value, seen) {
+  const s = seen || new Set();
+  if (!isObj(value) || s.has(value)) return false;
+  s.add(value);
+  for (const [k, v] of Object.entries(value)) {
+    if (k === 'PM_approved' && TRUTHY.has(v)) return true;
+    if (carriesApproval(v, s)) return true;
+  }
+  return false;
+}
+
+/** True when a `status`/`disposition` key ANYWHERE carries a leading disposition token (bypass 5). */
+function carriesDisposition(value, seen) {
+  const s = seen || new Set();
+  if (!isObj(value) || s.has(value)) return false;
+  s.add(value);
   for (const [k, v] of Object.entries(value)) {
-    if (k === 'PM_approved' && v === true) return true;
-    if (k === 'pre_run_contract' && v && typeof v === 'object' && v.PM_approved === true) return true;
-    if (carriesApproval(v, depth + 1)) return true;
+    if ((k === 'status' || k === 'disposition') && typeof v === 'string' && DISPOSITION_RE.test(v)) return true;
+    if (carriesDisposition(v, s)) return true;
   }
   return false;
 }
 
+function onAllowlist(file) {
+  const norm = String(file).replace(/\\/g, '/').replace(/^\.\//, '');
+  if (norm.includes('..')) return false;                 // no traversal out of an allowed directory
+  if (ALLOWED_BASENAMES.includes(path.basename(norm))) return true;
+  return ALLOWED_DIR_PREFIXES.some((p) => norm.startsWith(p));
+}
+
 /**
  * The chokepoint. Every driver write goes through here or does not happen.
  * @param {{file:string, payload?:any, text?:string}} req
  * @throws {ForbiddenWrite}
  */
 function assertWritable(req) {
-  const file = (req && req.file) || '';
-  const base = path.basename(file);
+  // (6) FAIL CLOSED. The predecessor returned `true` here, which is the worst of the seven: a
+  // request this function cannot understand is precisely the one it must not wave through.
+  if (!isObj(req) || Array.isArray(req)) {
+    throw new ForbiddenWrite('an unreadable request', 'a write request must be an object — refused (fail-closed)');
+  }
+  if (typeof req.file !== 'string' || !req.file.trim()) {
+    throw new ForbiddenWrite('a request with no target', 'a write request must name its `file` — refused (fail-closed)');
+  }
 
-  if (FORBIDDEN_FILES.includes(base)) {
-    throw new ForbiddenWrite('an acceptance', 'the Acceptance Gate is the PM\'s and non-delegable (D12)');
+  const why = HUMAN_DECISION_SINKS[path.basename(req.file)];
+  if (why) throw new ForbiddenWrite(path.basename(req.file), why);
+
+  // (7) closed as a CLASS: anything not sanctioned is refused, named or not.
+  if (!onAllowlist(req.file)) {
+    throw new ForbiddenWrite(req.file,
+      `not on the driver's allowlist — it may write ${ALLOWED_DIR_PREFIXES.join(', ')} or ${ALLOWED_BASENAMES.join(', ')}`);
   }
-  if (req && req.payload !== undefined && carriesApproval(req.payload)) {
-    throw new ForbiddenWrite('pre_run_contract.PM_approved',
-      'the contract is the PM\'s to approve before any build (D16, AGENTS.md §4)');
+
+  // (1)(2)(3) closed together by one look at the text the write would actually produce. A
+  // stringified payload, a "true", and an 11-deep nesting are all plainly visible here.
+  let serialized;
+  try {
+    serialized = JSON.stringify({ p: req.payload === undefined ? null : req.payload, t: req.text || '' });
+  } catch {
+    throw new ForbiddenWrite('an unserialisable payload',
+      'a payload that cannot be inspected cannot be permitted — refused (fail-closed)');
   }
-  if (req && typeof req.text === 'string' && /PM_approved\s*[:=]\s*true/i.test(req.text)) {
+  if (/PM_approved\W{0,4}(true|1|yes)/i.test(serialized) || carriesApproval(req.payload)) {
     throw new ForbiddenWrite('pre_run_contract.PM_approved',
-      'the contract is the PM\'s to approve before any build (D16) — caught in raw text');
+      'the contract is the PM\'s to approve before any build (D16, AGENTS.md §4)');
   }
 
-  // A disposition is a PM act (D60) wherever it lands: the record's `status:` is where it is
-  // conventionally written, so both the structured and the raw-text shapes are refused.
-  const status = req && req.payload && typeof req.payload === 'object' ? req.payload.status : null;
-  if (typeof status === 'string' && DISPOSITION_RE.test(status)) {
+  // (4)(5) and the false positive: matched on a status VALUE's leading token, structured or raw, so
+  // `status: "PROMOTED by PM wawan"` is refused and `status: "derived from the promoted prototype"`
+  // is not. Prose that mentions a disposition is not a disposition.
+  if (carriesDisposition(req.payload)) {
     throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
   }
-  if (req && typeof req.text === 'string' && /^status:.*$/im.test(req.text)
-      && DISPOSITION_RE.test(req.text.match(/^status:.*$/im)[0])) {
-    throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
+  if (typeof req.text === 'string') {
+    for (const line of req.text.split('\n')) {
+      const m = /^\s*(?:status|disposition)\s*:\s*(.*)$/i.exec(line);
+      if (m && DISPOSITION_RE.test(m[1])) {
+        throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
+      }
+    }
   }
   return true;
 }
@@ -95,4 +227,7 @@ function guardedWriter(write) {
   };
 }
 
-module.exports = { assertWritable, guardedWriter, carriesApproval, ForbiddenWrite, FORBIDDEN_FILES };
+module.exports = {
+  assertWritable, guardedWriter, carriesApproval, carriesDisposition, ForbiddenWrite,
+  ALLOWED_DIR_PREFIXES, ALLOWED_BASENAMES, HUMAN_DECISION_SINKS, DISPOSITION_RE,
+};

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.26.0",
+      "version": "0.28.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/data.js

@@ -1093,6 +1093,23 @@ export async function readDoc(path) {
   return res.text();
 }
 
+/**
+ * panel-initiatives.js — `searchFiles(q, limit)`. Every file under THIS workspace's root whose path
+ * or contents match, from the one endpoint that walks the folder. Bounded on the server, and the
+ * bound comes back in the payload (`truncated`, `scanned`) rather than being silently applied — a
+ * capped list rendered as a complete one is the defect the search box already had.
+ *
+ * FIXTURE mode resolves to an empty, untruncated result WITHOUT fetching: rule 1 of this file is
+ * that a fixture render is provably not a real read wearing a costume, and `no-network.test.js`
+ * checks that claim at source level.
+ */
+export async function searchFiles(query, limit) {
+  const q = String(query == null ? '' : query).trim();
+  if (FIXTURE || !q) return { ok: true, q, hits: [], truncated: false, scanned: 0 };
+  const p = products.get(currentProductName());
+  return getJson('/api/search/files', { ws: state.wsId || (p ? p.ws : ''), q, limit });
+}
+
 /**
  * tab-doc.js — `saveDoc({ws, path, base, text})`. Refuse-on-stale: the server compares `base`
  * against the file on disk and REFUSES rather than overwriting a file that changed underneath.

package/workspace/public/pm/panel-initiatives.js

@@ -285,7 +285,13 @@ export function openTerm(slug, sess) {
 export function openDoc(slug, path, role) {
   openTab({
     id: 'doc:' + path, kind: 'doc', title: path.split('/').pop(), slug,
-    repo: slugProduct()[slug], path, role: role || 'DOC',
+    /* A file opened from the FOLDER search belongs to no initiative, so `slugProduct()` has no
+     * answer for it — and `panel-tabs.visibleTabs` shows a tab whose repo is `undefined` in EVERY
+     * repository, which would hang this workspace's file in another one's tab strip and read its
+     * path against that root. The repository it was opened FROM is the true answer, and it is used
+     * only where there is no slug: every existing call site keeps its exact previous value. */
+    repo: slug ? slugProduct()[slug] : currentProduct(),
+    path, role: role || 'DOC',
   });
 }
 
@@ -495,6 +501,147 @@ function hitNode(ht) {
   );
 }
 
+/* ── "files in this folder" — the half of `search everything…` that was missing ────────────────
+ *
+ * `searchHits` above is the board's search: initiative slugs, paths DECLARED on a record, session
+ * names. A file the board was never told about is in none of those lists, so it could not be found
+ * by typing its exact name — and the miss printed "nothing matches — a successful read of nothing",
+ * which is this repo's phrase for *we looked and there was nothing*, after a search that had never
+ * opened the folder. This block is the folder half, from /api/search.
+ *
+ * ── Three constraints the shape below is a response to ──────────────────────────────────────
+ *
+ * 1. THE SEARCH IS ASYNCHRONOUS AND THE RENDER IS NOT. `state.q` changes on every keystroke and
+ *    every change repaints this panel, so a result has to arrive by a route that survives a
+ *    re-render: a cache keyed by the QUERY, a fetch kicked off during render, and `setState({})` on
+ *    arrival. It is exactly `tab-doc.js`'s `requestDoc` pattern, for the same reason.
+ * 2. ONE WORD IS ONE SEARCH, NOT SIX. A 140 ms debounce collapses the keystrokes of a word, and
+ *    only the LATEST query is ever in flight — an earlier reply landing late must not repaint the
+ *    panel with results for a query the PM has already typed past.
+ * 3. A BOUNDED ANSWER SAYS SO. `truncated` travels from the walk to the payload to this heading. A
+ *    capped list drawn as a complete one is the same lie with a longer walk behind it.
+ *
+ * A hit is labelled `file · <kind>`, never `artifact · <role>`: a file no initiative declares has no
+ * role, and inventing one would file a claim nobody made. A file the reader cannot show (an image,
+ * an inert binary) is LISTED and greyed rather than hidden — found-but-not-openable is a true
+ * answer, and it beats a tab that opens onto a failure the surface could have predicted.
+ */
+
+const fileCache = new Map();     // q -> { hits, truncated, scanned, error }
+let fileWanted = null;           // the query the PM has actually typed — the only reply that may land
+let fileTimer = null;
+let dataMod;                     // undefined = not tried · null = unavailable · module = ready
+
+function dataModule() {
+  if (dataMod !== undefined) return dataMod;
+  dataMod = null;
+  import('./data.js').then((m) => { dataMod = m; setState({}); }).catch(() => { dataMod = null; });
+  return null;
+}
+
+function requestFiles(q) {
+  fileWanted = q;
+  if (fileTimer) clearTimeout(fileTimer);
+  fileTimer = setTimeout(() => {
+    fileTimer = null;
+    const mod = dataModule();
+    if (!mod || typeof mod.searchFiles !== 'function') return;
+    const asked = q;
+    Promise.resolve(mod.searchFiles(asked)).then(
+      (r) => {
+        if (fileWanted !== asked) return;                      // the PM has typed past this query
+        fileCache.set(asked, (r && r.ok === false)
+          ? { hits: [], truncated: false, contentTruncated: false, scanned: 0, contentScanned: 0, error: r.error || 'the folder could not be searched' }
+          : {
+            hits: (r && r.hits) || [], truncated: !!(r && r.truncated),
+            contentTruncated: !!(r && r.content_truncated),
+            scanned: (r && r.scanned) || 0, contentScanned: (r && r.content_scanned) || 0, error: null,
+          });
+        if (fileCache.size > 40) fileCache.delete(fileCache.keys().next().value);
+        setState({});
+      },
+      (e) => {
+        if (fileWanted !== asked) return;
+        fileCache.set(asked, { hits: [], truncated: false, contentTruncated: false, scanned: 0, contentScanned: 0, error: (e && e.message) || String(e) });
+        setState({});
+      },
+    );
+  }, 140);
+}
+
+/** The result for `q`, or null while nothing has come back yet. Kicks the fetch off on a miss. */
+function fileResults(q) {
+  if (!q || FIXTURE) return null;
+  if (fileCache.has(q)) return fileCache.get(q);
+  requestFiles(q);
+  return null;
+}
+
+const fileLabel = (h) => 'file · ' + (h.kind || 'file') + (h.match === 'content' ? ' · line ' + h.line : '');
+
+function fileHitNode(h) {
+  const where = h.dir ? h.dir + '/' : '';
+  const sub = h.match === 'content' ? h.snippet : (where + h.name);
+  if (!h.openable) {
+    return el('div', {
+      style: 'display:block;width:100%;padding:6px 12px;min-height:40px;opacity:.55',
+      title: h.path + '\nfound, but this workspace\'s reader cannot show a ' + h.kind + ' file — nothing was opened.',
+    },
+      el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(fileLabel(h) + ' · not openable')),
+      el('span', { style: 'display:block;font-family:var(--mono);font-size:11px;color:var(--muted-foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(h.path)),
+    );
+  }
+  return el('button', {
+    onClick: () => openDoc(null, h.path, 'FILE'),
+    style: 'display:block;width:100%;padding:6px 12px;min-height:40px;text-align:left',
+    hover: 'background:var(--accent)',
+    title: h.path,
+  },
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--info)' }, iv(fileLabel(h))),
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:11px;color:var(--foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(h.name)),
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(sub)),
+  );
+}
+
+/**
+ * The whole block, or null when there is nothing to say. Rendered in EVERY mode — the box says
+ * `search everything…` in all seven of them, and modes.js reads `state.q` in none.
+ */
+export function fileHitsBlock(q) {
+  if (!q || FIXTURE) return null;
+  const r = fileResults(q);
+  const head = (text, tone) => el('div', {
+    style: 'padding:4px 12px 4px;font-family:var(--mono);font-size:10px;letter-spacing:.12em;'
+      + 'text-transform:uppercase;color:' + (tone || 'var(--muted-foreground)') + ';border-bottom:1px solid var(--border)',
+  }, iv(text));
+
+  if (!r) return el('div', { 'data-pm-files': '' }, head('files in this folder · searching…'));
+  if (r.error) {
+    return el('div', { 'data-pm-files': '' }, head('files in this folder · not searched', 'var(--destructive)'),
+      el('div', { style: 'padding:6px 12px;font-size:11px;color:var(--muted-foreground)' }, iv(r.error)));
+  }
+  /* WHAT THE WALK DID NOT DO, in the heading, in the caller's own words. Two flags, never merged:
+   * `truncated` means files were never looked at AT ALL — the one that changes what a PM should
+   * conclude from an empty list. `contentTruncated` means every file was NAMED and some bodies
+   * were not read, which is the ordinary state of any repository holding a lock file. Folding the
+   * second into the first would light the serious flag permanently and thereby retire it. */
+  const bound = r.truncated
+    ? ' · BOUNDED — files beyond the walk limit were not looked at'
+    : (r.contentTruncated ? ' · all ' + r.scanned + ' names searched; ' + r.contentScanned + ' bodies read' : '');
+
+  if (!r.hits.length) {
+    // The board's own phrase is used ONLY when it is true — when the walk really did reach
+    // everything. A cut-short walk found nothing *of what it looked at*, which is a different claim.
+    return el('div', { 'data-pm-files': '' },
+      head('files in this folder · ' + (r.truncated
+        ? 'no match in the ' + r.scanned + ' files searched — the walk was BOUNDED, more were not looked at'
+        : 'no file matches — a successful read of nothing' + (r.contentTruncated ? bound : ''))));
+  }
+  const kids = [head('files in this folder · ' + r.hits.length + ' of ' + r.scanned + ' searched' + bound)];
+  for (const h of r.hits) kids.push(fileHitNode(h));
+  return el('div', { 'data-pm-files': '' }, kids);
+}
+
 /* ── the file-new form's view model (prototype `nw`, lines 1620–1687) ──────────────────────────
  * The form itself renders in PANEL 3 (`detail.kind === 'new'`), which panel-detail.js owns — but
  * every field it edits and every record it files belongs to this board, so the model is derived
@@ -610,7 +757,10 @@ export function renderInitiatives(host) {
   if (searchInput.value !== state.q) searchInput.value = state.q;
 
   if (mode !== 'product') {
-    setChildren(host, [header, searchBox]);
+    // The folder results render HERE TOO. The box says `search everything…` in all seven modes and
+    // modes.js reads `state.q` in none of them, so until now typing in six of them did nothing at
+    // all — including in the library/folder lens, the one surface that actually lists files.
+    setChildren(host, [header, searchBox, fileHitsBlock(state.q || '')]);
     const modes = modesModule();
     if (modes && typeof modes.renderMode === 'function') {
       try { modes.renderMode(host, null, mode); } catch (e) { console.error('[pm] renderMode failed:', e); }
@@ -692,7 +842,15 @@ export function renderInitiatives(host) {
       'matches elsewhere'));
     for (const ht of hits) kids.push(hitNode(ht));
   }
-  if (total === 0 && hits.length === 0) {
+  // THE FOLDER. Below the board's own hits, because a record the PM filed outranks a file that
+  // merely matched — and it is the block that makes the box's name true.
+  const files = fileHitsBlock(q);
+  if (files) kids.push(files);
+  // The prototype's line, unchanged and shown under the same condition it always was — plus the
+  // folder. It claims nothing matched ANYWHERE, so a file hit has to suppress it or it is a lie
+  // rendered directly above its own counter-example.
+  const fileRes = fileResults(q);
+  if (total === 0 && hits.length === 0 && !(fileRes && fileRes.hits.length)) {
     kids.push(el('div', { style: 'padding:10px 14px;font-size:12px;color:var(--muted-foreground);font-style:italic' },
       'nothing matches — a successful read of nothing'));
   }

package/workspace/server.js

@@ -782,6 +782,153 @@ function looseDocs(root) {
   }
   return out;
 }
+/* ── SEARCH: the corpus `search everything…` is finally allowed to be ─────────────────────────
+ *
+ * The box shipped searching three DERIVED lists — initiative slugs, paths declared on an initiative
+ * record, and session names — so a file the board was never told about could not be found by typing
+ * its exact name. Worse, a miss rendered "nothing matches — a successful read of nothing", this
+ * repo's phrase for *we looked and there was nothing*, after a search that never opened the folder.
+ *
+ * Four rules hold this honest, and each one is asserted in the suite:
+ *
+ *  1. THE WALK IS THE FOLDER LENS'S WALK. Same `SKIP_DIRS`, same dotted-name exclusion, so search
+ *     and the lens can never disagree about what exists in this folder. A third answer to "what is
+ *     in here" would be worse than the missing feature.
+ *  2. NOTHING NEW IS REACHABLE. Every emitted path is `path.relative(root, …)` from a walk that
+ *     STARTS at the root and only descends through `e.isDirectory()`. `readdirSync(…,
+ *     {withFileTypes:true})` reports a symlink as `isSymbolicLink()` — neither a file nor a
+ *     directory — so a link pointing out of the workspace is never followed and never emitted.
+ *     There is no user-supplied path parameter here at all: the query is a needle, not a location.
+ *  3. IT IS BOUNDED, AND THE BOUND IS IN THE PAYLOAD. A capped list rendered as a complete one is
+ *     the same lie the box already told, with a longer walk behind it — so every cap reports
+ *     itself, and it must be FALSE when nothing was cut. The suite asserts both directions,
+ *     because a flag that is always true is not a flag.
+ *
+ *     TWO caps, TWO flags, deliberately not one. `truncated` means *files you searched for were
+ *     never looked at* (the walk budget, the depth, or the result limit). `content_truncated`
+ *     means *every file was named, but not every body was read* — which is the ordinary state of
+ *     any repository carrying a lock file, and collapsing it into `truncated` would light the
+ *     serious flag permanently and thereby retire it.
+ *  4. `kind` IS preview-kind's ANSWER, NOT A SECOND OPINION. The same classifier the read endpoints
+ *     and the tree flag already use decides whether the reader can show a hit, so search can say
+ *     "found, but not openable" instead of handing the PM a tab that prints a failure.
+ */
+const SEARCH_MAX_FILES = 20000;          // walk budget — a giant repo (or a Drive mount) never hangs the box
+const SEARCH_MAX_DEPTH = 12;             // deeper than the lens's 6: search renders no tree, so depth is cheap
+const SEARCH_CONTENT_FILES = 4000;       // how many readable files get their BODIES scanned
+const SEARCH_CONTENT_BYTES = 256 * 1024; // per file; a bigger one is path-matched only, never read whole
+const SEARCH_LIMIT_DEFAULT = 40;
+const SEARCH_LIMIT_MAX = 200;
+const SEARCH_INDEX_TTL_MS = 4000;        // one word of typing costs one walk, not one per keystroke
+const SEARCH_SNIPPET = 160;
+const SEARCH_OPENABLE = new Set(['markdown', 'text', 'html']);   // what /api/doc will serve
+const searchIndexCache = new Map();      // root -> { at, files, truncated, scanned }
+
+/** Every file under `root`, flat and repo-relative, cached for SEARCH_INDEX_TTL_MS. */
+function searchIndex(root) {
+  const now = Date.now();
+  const hit = searchIndexCache.get(root);
+  if (hit && now - hit.at < SEARCH_INDEX_TTL_MS) return hit;
+  const files = [];
+  let truncated = false;
+  (function walk(dir, rel, depth) {
+    if (truncated) return;
+    let ents = [];
+    try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      if (e.name.startsWith('.') || SKIP_DIRS.has(e.name)) continue;
+      const full = path.join(dir, e.name);
+      const r = rel ? rel + '/' + e.name : e.name;
+      if (e.isDirectory()) {
+        // Depth is a bound like any other: reaching it means files below were NOT looked at.
+        if (depth < SEARCH_MAX_DEPTH) walk(full, r, depth + 1);
+        else truncated = true;
+      } else if (e.isFile()) {
+        if (files.length >= SEARCH_MAX_FILES) { truncated = true; return; }
+        files.push({ path: r, name: e.name, dir: rel, kind: preview.previewKind(e.name) });
+      }
+    }
+  })(root, '', 0);
+  const entry = { at: now, files, truncated, scanned: files.length };
+  searchIndexCache.set(root, entry);
+  return entry;
+}
+
+/** One matched line, trimmed and centred on the needle, so a minified file cannot flood the row. */
+function searchSnippet(line, at) {
+  const s = String(line || '').replace(/\t/g, '  ');
+  if (s.length <= SEARCH_SNIPPET) return s.trim();
+  const start = Math.max(0, at - Math.floor(SEARCH_SNIPPET / 3));
+  return (start > 0 ? '…' : '') + s.slice(start, start + SEARCH_SNIPPET).trim()
+    + (start + SEARCH_SNIPPET < s.length ? '…' : '');
+}
+
+/**
+ * Search one workspace. Path matches first (they are what the PM typed a name for), then content
+ * matches over the readable text files that did not already match by path.
+ * `{ ok, q, hits, truncated, content_truncated, scanned, content_scanned, limit }` — never throws,
+ * never 404s: an empty `hits` with `truncated:false` IS the honest "looked, found nothing".
+ */
+function searchWorkspace(root, query, limit) {
+  const q = String(query == null ? '' : query).trim();
+  const cap = Math.max(1, Math.min(SEARCH_LIMIT_MAX, parseInt(limit, 10) || SEARCH_LIMIT_DEFAULT));
+  if (!q) {
+    return { ok: true, q: '', hits: [], truncated: false, content_truncated: false,
+      scanned: 0, content_scanned: 0, limit: cap };
+  }
+  const needle = q.toLowerCase();
+  const idx = searchIndex(root);
+  const hits = [];
+  const seen = new Set();
+  let overflow = false;                       // more matched than `cap` — a REAL cut, not a coincidence
+
+  for (const f of idx.files) {
+    if (!f.path.toLowerCase().includes(needle)) continue;
+    seen.add(f.path);
+    if (hits.length >= cap) { overflow = true; break; }
+    hits.push({ ...f, match: 'path', line: null, snippet: null, openable: SEARCH_OPENABLE.has(f.kind) });
+  }
+
+  let read = 0;
+  let contentCut = false;
+  if (!overflow) {
+    for (const f of idx.files) {
+      if (seen.has(f.path) || !SEARCH_OPENABLE.has(f.kind)) continue;
+      if (read >= SEARCH_CONTENT_FILES) { contentCut = true; break; }
+      const full = path.join(root, f.path);
+      let st;
+      try { st = fs.statSync(full); } catch { continue; }
+      if (!st.isFile()) continue;
+      if (st.size > SEARCH_CONTENT_BYTES) { contentCut = true; continue; }
+      read += 1;
+      let text;
+      try { text = fs.readFileSync(full, 'utf8'); } catch { continue; }
+      if (text.indexOf(String.fromCharCode(0)) !== -1) continue;    // binary masquerading as text — never scanned
+      const at = text.toLowerCase().indexOf(needle);
+      if (at === -1) continue;
+      if (hits.length >= cap) { overflow = true; break; }
+      const before = text.slice(0, at);
+      const lineNo = before.split('\n').length;
+      const lineStart = before.lastIndexOf('\n') + 1;
+      const lineEnd = text.indexOf('\n', at);
+      hits.push({
+        ...f, match: 'content', line: lineNo,
+        snippet: searchSnippet(text.slice(lineStart, lineEnd === -1 ? text.length : lineEnd), at - lineStart),
+        openable: true,
+      });
+    }
+  }
+
+  return {
+    ok: true, q, hits, limit: cap,
+    // "files you searched for were never looked at" — the serious one.
+    truncated: idx.truncated || overflow,
+    // "every file was named; not every body was read" — the ordinary one.
+    content_truncated: contentCut,
+    scanned: idx.scanned, content_scanned: read,
+  };
+}
+
 // Serve a TEXTUAL document — markdown (incl. .skill), plain-text/config source, or HTML source —
 // per-workspace-guarded. Images are NOT served here (they stream through /api/asset); anything
 // non-textual returns null so the reader shows it inert. A NUL byte ⇒ binary masquerading as text
@@ -1136,10 +1283,32 @@ function deriveState(ev) {
 // state dir is why this surface reported 0 accepted against 23 real acceptance rows — the same
 // "one field, several readers, none agreeing" defect the anchor resolver was built to end.
 function acceptanceFilesFor(w) {
+  return ledgerFilesFor(w, 'acceptances.jsonl');
+}
+// The general form of the comment above, because the defect it describes was never specific to
+// acceptances. `deriveNeeds` read evals.jsonl, acceptances.jsonl AND outcome_checks.jsonl from the
+// state dir alone, so the supervision surface under-reported everything pmos-self records in
+// planning/runs/ — the same "one field, several readers, none agreeing" shape, three ledgers wide.
+// One helper with three call sites, so the fourth ledger added later cannot reintroduce it.
+function ledgerFilesFor(w, basename) {
   const out = [];
   const d = stateDirFor(w);
-  if (d) out.push(path.join(d, 'acceptances.jsonl'));
-  if (w && w.root) out.push(path.join(w.root, 'planning', 'runs', 'acceptances.jsonl'));
+  if (d) out.push(path.join(d, basename));
+  if (w && w.root) out.push(path.join(w.root, 'planning', 'runs', basename));
+  return out;
+}
+// readJsonl over BOTH ledger locations, deduped by nothing: callers fold, and a row present in both
+// is the same row recorded twice, which every existing fold already tolerates.
+function readLedger(w, basename) {
+  const out = [];
+  for (const f of ledgerFilesFor(w, basename)) {
+    let text = '';
+    try { text = fs.readFileSync(f, 'utf8'); } catch { continue; }
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
+      try { out.push(JSON.parse(line)); } catch { /* a torn line is reported by the checkers, not here */ }
+    }
+  }
   return out;
 }
 function readAcceptances(w) {
@@ -2794,18 +2963,20 @@ function deriveNeeds(w) {
   if (!dir) return [];
   const needs = [];
   const settled = new Set();
-  for (const a of readJsonl(dir, 'acceptances.jsonl')) if (a.run_id) settled.add(a.run_id);
-  for (const e of readJsonl(dir, 'evals.jsonl')) {
+  for (const a of readLedger(w, 'acceptances.jsonl')) if (a.run_id) settled.add(a.run_id);
+  for (const e of readLedger(w, 'evals.jsonl')) {
     if (!e.run_id || settled.has(e.run_id)) continue;
     const verdict = e.verdict ? String(e.verdict) : 'no verdict';
     needs.push({
       run_id: e.run_id, initiative_id: e.initiative_id || null, kind: 'accept', derived: true,
       question: `Acceptance Gate open — evaluator says ${verdict}${e.score != null ? ` (${e.score})` : ''}`,
-      doc: e.rubric_path || null,
+      // `rubric` is the deprecated alias every one of the 26 legacy rows uses; scripts/record-eval.js
+      // requires `rubric_path` going forward. Read both, write only the new one.
+      doc: e.rubric_path || e.rubric || null,
     });
   }
   const disposed = new Set();
-  for (const c of readJsonl(dir, 'outcome_checks.jsonl')) if (c.initiative_id) disposed.add(c.initiative_id);
+  for (const c of readLedger(w, 'outcome_checks.jsonl')) if (c.initiative_id) disposed.add(c.initiative_id);
   const today = nowISO().slice(0, 10);
   let files = [];
   try { files = fs.readdirSync(path.join(dir, 'initiatives')).filter((f) => f.endsWith('.md')).sort(); } catch {}
@@ -4309,6 +4480,25 @@ async function handleRequest(req, res) {
     });
     return json(res, built, built.ok ? 200 : 400);
   }
+  // ── TWO CORPORA, TWO ENDPOINTS, ONE BOX ────────────────────────────────────────────────────
+  // `/api/search` is EPISODIC — what a past session printed. `/api/search/files` is the FOLDER —
+  // what is on disk under this workspace's root. They are deliberately not merged: the hit shapes
+  // share no field (`{session, line, after}` vs `{path, kind, match, openable}`), the scrollback
+  // search scrubs secrets out of text an agent typed, and the file search reports a walk bound.
+  // Collapsing them into one payload would mean one of the two lying about what it looked at.
+  if (p === '/api/search/files') {
+    // `search everything…`, finally over everything: every file under THIS workspace's root, by
+    // path and by content. There is no path parameter — the query is a needle, not a location — so
+    // this adds no reachable path; `openable` reports whether /api/doc (or /api/asset) could show a
+    // hit. `truncated` + `scanned` are the contract that keeps a bounded answer from reading as a
+    // complete one, which is the defect this endpoint exists to end rather than to relocate.
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) {
+      return json(res, { ok: false, error: 'no workspace to search', q: url.searchParams.get('q') || '',
+        hits: [], truncated: false, scanned: 0, content_scanned: 0, limit: SEARCH_LIMIT_DEFAULT });
+    }
+    return json(res, { ws: w.id, ...searchWorkspace(w.root, url.searchParams.get('q'), url.searchParams.get('limit')) });
+  }
   if (p === '/api/search') {
     // Episodic recall over this workspace's own past sessions. Localhost only, like everything
     // else here — an agent running in a pane can curl it to check what an earlier run tried.