create-pmos 0.27.0 → 0.29.0

package/workspace/public/pm/panel-initiatives.js

@@ -285,7 +285,13 @@ export function openTerm(slug, sess) {
 export function openDoc(slug, path, role) {
   openTab({
     id: 'doc:' + path, kind: 'doc', title: path.split('/').pop(), slug,
-    repo: slugProduct()[slug], path, role: role || 'DOC',
+    /* A file opened from the FOLDER search belongs to no initiative, so `slugProduct()` has no
+     * answer for it — and `panel-tabs.visibleTabs` shows a tab whose repo is `undefined` in EVERY
+     * repository, which would hang this workspace's file in another one's tab strip and read its
+     * path against that root. The repository it was opened FROM is the true answer, and it is used
+     * only where there is no slug: every existing call site keeps its exact previous value. */
+    repo: slug ? slugProduct()[slug] : currentProduct(),
+    path, role: role || 'DOC',
   });
 }
 
@@ -495,6 +501,147 @@ function hitNode(ht) {
   );
 }
 
+/* ── "files in this folder" — the half of `search everything…` that was missing ────────────────
+ *
+ * `searchHits` above is the board's search: initiative slugs, paths DECLARED on a record, session
+ * names. A file the board was never told about is in none of those lists, so it could not be found
+ * by typing its exact name — and the miss printed "nothing matches — a successful read of nothing",
+ * which is this repo's phrase for *we looked and there was nothing*, after a search that had never
+ * opened the folder. This block is the folder half, from /api/search.
+ *
+ * ── Three constraints the shape below is a response to ──────────────────────────────────────
+ *
+ * 1. THE SEARCH IS ASYNCHRONOUS AND THE RENDER IS NOT. `state.q` changes on every keystroke and
+ *    every change repaints this panel, so a result has to arrive by a route that survives a
+ *    re-render: a cache keyed by the QUERY, a fetch kicked off during render, and `setState({})` on
+ *    arrival. It is exactly `tab-doc.js`'s `requestDoc` pattern, for the same reason.
+ * 2. ONE WORD IS ONE SEARCH, NOT SIX. A 140 ms debounce collapses the keystrokes of a word, and
+ *    only the LATEST query is ever in flight — an earlier reply landing late must not repaint the
+ *    panel with results for a query the PM has already typed past.
+ * 3. A BOUNDED ANSWER SAYS SO. `truncated` travels from the walk to the payload to this heading. A
+ *    capped list drawn as a complete one is the same lie with a longer walk behind it.
+ *
+ * A hit is labelled `file · <kind>`, never `artifact · <role>`: a file no initiative declares has no
+ * role, and inventing one would file a claim nobody made. A file the reader cannot show (an image,
+ * an inert binary) is LISTED and greyed rather than hidden — found-but-not-openable is a true
+ * answer, and it beats a tab that opens onto a failure the surface could have predicted.
+ */
+
+const fileCache = new Map();     // q -> { hits, truncated, scanned, error }
+let fileWanted = null;           // the query the PM has actually typed — the only reply that may land
+let fileTimer = null;
+let dataMod;                     // undefined = not tried · null = unavailable · module = ready
+
+function dataModule() {
+  if (dataMod !== undefined) return dataMod;
+  dataMod = null;
+  import('./data.js').then((m) => { dataMod = m; setState({}); }).catch(() => { dataMod = null; });
+  return null;
+}
+
+function requestFiles(q) {
+  fileWanted = q;
+  if (fileTimer) clearTimeout(fileTimer);
+  fileTimer = setTimeout(() => {
+    fileTimer = null;
+    const mod = dataModule();
+    if (!mod || typeof mod.searchFiles !== 'function') return;
+    const asked = q;
+    Promise.resolve(mod.searchFiles(asked)).then(
+      (r) => {
+        if (fileWanted !== asked) return;                      // the PM has typed past this query
+        fileCache.set(asked, (r && r.ok === false)
+          ? { hits: [], truncated: false, contentTruncated: false, scanned: 0, contentScanned: 0, error: r.error || 'the folder could not be searched' }
+          : {
+            hits: (r && r.hits) || [], truncated: !!(r && r.truncated),
+            contentTruncated: !!(r && r.content_truncated),
+            scanned: (r && r.scanned) || 0, contentScanned: (r && r.content_scanned) || 0, error: null,
+          });
+        if (fileCache.size > 40) fileCache.delete(fileCache.keys().next().value);
+        setState({});
+      },
+      (e) => {
+        if (fileWanted !== asked) return;
+        fileCache.set(asked, { hits: [], truncated: false, contentTruncated: false, scanned: 0, contentScanned: 0, error: (e && e.message) || String(e) });
+        setState({});
+      },
+    );
+  }, 140);
+}
+
+/** The result for `q`, or null while nothing has come back yet. Kicks the fetch off on a miss. */
+function fileResults(q) {
+  if (!q || FIXTURE) return null;
+  if (fileCache.has(q)) return fileCache.get(q);
+  requestFiles(q);
+  return null;
+}
+
+const fileLabel = (h) => 'file · ' + (h.kind || 'file') + (h.match === 'content' ? ' · line ' + h.line : '');
+
+function fileHitNode(h) {
+  const where = h.dir ? h.dir + '/' : '';
+  const sub = h.match === 'content' ? h.snippet : (where + h.name);
+  if (!h.openable) {
+    return el('div', {
+      style: 'display:block;width:100%;padding:6px 12px;min-height:40px;opacity:.55',
+      title: h.path + '\nfound, but this workspace\'s reader cannot show a ' + h.kind + ' file — nothing was opened.',
+    },
+      el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(fileLabel(h) + ' · not openable')),
+      el('span', { style: 'display:block;font-family:var(--mono);font-size:11px;color:var(--muted-foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(h.path)),
+    );
+  }
+  return el('button', {
+    onClick: () => openDoc(null, h.path, 'FILE'),
+    style: 'display:block;width:100%;padding:6px 12px;min-height:40px;text-align:left',
+    hover: 'background:var(--accent)',
+    title: h.path,
+  },
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--info)' }, iv(fileLabel(h))),
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:11px;color:var(--foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(h.name)),
+    el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(sub)),
+  );
+}
+
+/**
+ * The whole block, or null when there is nothing to say. Rendered in EVERY mode — the box says
+ * `search everything…` in all seven of them, and modes.js reads `state.q` in none.
+ */
+export function fileHitsBlock(q) {
+  if (!q || FIXTURE) return null;
+  const r = fileResults(q);
+  const head = (text, tone) => el('div', {
+    style: 'padding:4px 12px 4px;font-family:var(--mono);font-size:10px;letter-spacing:.12em;'
+      + 'text-transform:uppercase;color:' + (tone || 'var(--muted-foreground)') + ';border-bottom:1px solid var(--border)',
+  }, iv(text));
+
+  if (!r) return el('div', { 'data-pm-files': '' }, head('files in this folder · searching…'));
+  if (r.error) {
+    return el('div', { 'data-pm-files': '' }, head('files in this folder · not searched', 'var(--destructive)'),
+      el('div', { style: 'padding:6px 12px;font-size:11px;color:var(--muted-foreground)' }, iv(r.error)));
+  }
+  /* WHAT THE WALK DID NOT DO, in the heading, in the caller's own words. Two flags, never merged:
+   * `truncated` means files were never looked at AT ALL — the one that changes what a PM should
+   * conclude from an empty list. `contentTruncated` means every file was NAMED and some bodies
+   * were not read, which is the ordinary state of any repository holding a lock file. Folding the
+   * second into the first would light the serious flag permanently and thereby retire it. */
+  const bound = r.truncated
+    ? ' · BOUNDED — files beyond the walk limit were not looked at'
+    : (r.contentTruncated ? ' · all ' + r.scanned + ' names searched; ' + r.contentScanned + ' bodies read' : '');
+
+  if (!r.hits.length) {
+    // The board's own phrase is used ONLY when it is true — when the walk really did reach
+    // everything. A cut-short walk found nothing *of what it looked at*, which is a different claim.
+    return el('div', { 'data-pm-files': '' },
+      head('files in this folder · ' + (r.truncated
+        ? 'no match in the ' + r.scanned + ' files searched — the walk was BOUNDED, more were not looked at'
+        : 'no file matches — a successful read of nothing' + (r.contentTruncated ? bound : ''))));
+  }
+  const kids = [head('files in this folder · ' + r.hits.length + ' of ' + r.scanned + ' searched' + bound)];
+  for (const h of r.hits) kids.push(fileHitNode(h));
+  return el('div', { 'data-pm-files': '' }, kids);
+}
+
 /* ── the file-new form's view model (prototype `nw`, lines 1620–1687) ──────────────────────────
  * The form itself renders in PANEL 3 (`detail.kind === 'new'`), which panel-detail.js owns — but
  * every field it edits and every record it files belongs to this board, so the model is derived
@@ -610,7 +757,10 @@ export function renderInitiatives(host) {
   if (searchInput.value !== state.q) searchInput.value = state.q;
 
   if (mode !== 'product') {
-    setChildren(host, [header, searchBox]);
+    // The folder results render HERE TOO. The box says `search everything…` in all seven modes and
+    // modes.js reads `state.q` in none of them, so until now typing in six of them did nothing at
+    // all — including in the library/folder lens, the one surface that actually lists files.
+    setChildren(host, [header, searchBox, fileHitsBlock(state.q || '')]);
     const modes = modesModule();
     if (modes && typeof modes.renderMode === 'function') {
       try { modes.renderMode(host, null, mode); } catch (e) { console.error('[pm] renderMode failed:', e); }
@@ -692,7 +842,15 @@ export function renderInitiatives(host) {
       'matches elsewhere'));
     for (const ht of hits) kids.push(hitNode(ht));
   }
-  if (total === 0 && hits.length === 0) {
+  // THE FOLDER. Below the board's own hits, because a record the PM filed outranks a file that
+  // merely matched — and it is the block that makes the box's name true.
+  const files = fileHitsBlock(q);
+  if (files) kids.push(files);
+  // The prototype's line, unchanged and shown under the same condition it always was — plus the
+  // folder. It claims nothing matched ANYWHERE, so a file hit has to suppress it or it is a lie
+  // rendered directly above its own counter-example.
+  const fileRes = fileResults(q);
+  if (total === 0 && hits.length === 0 && !(fileRes && fileRes.hits.length)) {
     kids.push(el('div', { style: 'padding:10px 14px;font-size:12px;color:var(--muted-foreground);font-style:italic' },
       'nothing matches — a successful read of nothing'));
   }

package/workspace/server.js

@@ -782,6 +782,203 @@ function looseDocs(root) {
   }
   return out;
 }
+/* ── SEARCH: the corpus `search everything…` is finally allowed to be ─────────────────────────
+ *
+ * The box shipped searching three DERIVED lists — initiative slugs, paths declared on an initiative
+ * record, and session names — so a file the board was never told about could not be found by typing
+ * its exact name. Worse, a miss rendered "nothing matches — a successful read of nothing", this
+ * repo's phrase for *we looked and there was nothing*, after a search that never opened the folder.
+ *
+ * Four rules hold this honest, and each one is asserted in the suite:
+ *
+ *  1. THE WALK IS THE FOLDER LENS'S WALK. Same `SKIP_DIRS`, same dotted-name exclusion, so search
+ *     and the lens can never disagree about what exists in this folder. A third answer to "what is
+ *     in here" would be worse than the missing feature.
+ *  2. NOTHING NEW IS REACHABLE. Every emitted path is `path.relative(root, …)` from a walk that
+ *     STARTS at the root and only descends through `e.isDirectory()`. `readdirSync(…,
+ *     {withFileTypes:true})` reports a symlink as `isSymbolicLink()` — neither a file nor a
+ *     directory — so a link pointing out of the workspace is never followed and never emitted.
+ *     There is no user-supplied path parameter here at all: the query is a needle, not a location.
+ *  3. IT IS BOUNDED, AND THE BOUND IS IN THE PAYLOAD. A capped list rendered as a complete one is
+ *     the same lie the box already told, with a longer walk behind it — so every cap reports
+ *     itself, and it must be FALSE when nothing was cut. The suite asserts both directions,
+ *     because a flag that is always true is not a flag.
+ *
+ *     TWO caps, TWO flags, deliberately not one. `truncated` means *files you searched for were
+ *     never looked at* (the walk budget, the depth, or the result limit). `content_truncated`
+ *     means *every file was named, but not every body was read* — which is the ordinary state of
+ *     any repository carrying a lock file, and collapsing it into `truncated` would light the
+ *     serious flag permanently and thereby retire it.
+ *  4. `kind` IS preview-kind's ANSWER, NOT A SECOND OPINION. The same classifier the read endpoints
+ *     and the tree flag already use decides whether the reader can show a hit, so search can say
+ *     "found, but not openable" instead of handing the PM a tab that prints a failure.
+ */
+const SEARCH_MAX_FILES = 20000;          // walk budget — a giant repo (or a Drive mount) never hangs the box
+const SEARCH_MAX_DEPTH = 12;             // deeper than the lens's 6: search renders no tree, so depth is cheap
+const SEARCH_CONTENT_FILES = 4000;       // how many readable files get their BODIES scanned
+const SEARCH_CONTENT_BYTES = 256 * 1024; // per file; a bigger one is path-matched only, never read whole
+const SEARCH_LIMIT_DEFAULT = 40;
+const SEARCH_LIMIT_MAX = 200;
+const SEARCH_INDEX_TTL_MS = 4000;        // one word of typing costs one walk, not one per keystroke
+const SEARCH_SNIPPET = 160;
+const SEARCH_OPENABLE = new Set(['markdown', 'text', 'html']);   // what /api/doc will serve
+const searchIndexCache = new Map();      // root -> { at, files, truncated, scanned }
+
+/** Every file under `root`, flat and repo-relative, cached for SEARCH_INDEX_TTL_MS. */
+function searchIndex(root) {
+  const now = Date.now();
+  const hit = searchIndexCache.get(root);
+  if (hit && now - hit.at < SEARCH_INDEX_TTL_MS) return hit;
+  const files = [];
+  let depthCut = false;    // some branch was too deep — a LOCAL fact
+  let budgetCut = false;   // the file budget ran out — a GLOBAL stop
+  /* Two truncation causes, two flags, and only ONE of them stops the walk.
+   *
+   * They used to share `truncated`, and the guard at the top of `walk` read it — so the first branch
+   * that hit SEARCH_MAX_DEPTH aborted every not-yet-visited subdirectory in the whole tree. Measured
+   * by an independent evaluator on 2026-08-04: 51 files at depth <= 1, `scanned: 50`, an entire
+   * in-bound sibling directory lost because an unrelated deep branch tripped the cap first — and
+   * which sibling survived depended on readdir order.
+   *
+   * Depth is a bound on ONE path. The file budget is a bound on the WHOLE walk. Only the second is
+   * a reason to stop walking. */
+  (function walk(dir, rel, depth) {
+    if (budgetCut) return;
+    let ents = [];
+    try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      if (e.name.startsWith('.') || SKIP_DIRS.has(e.name)) continue;
+      const full = path.join(dir, e.name);
+      const r = rel ? rel + '/' + e.name : e.name;
+      if (e.isDirectory()) {
+        // Depth is a bound like any other: reaching it means files below were NOT looked at —
+        // but only BELOW HERE. Siblings elsewhere in the tree are still in bounds.
+        if (depth < SEARCH_MAX_DEPTH) walk(full, r, depth + 1);
+        else depthCut = true;
+      } else if (e.isFile()) {
+        if (files.length >= SEARCH_MAX_FILES) { budgetCut = true; return; }
+        files.push({ path: r, name: e.name, dir: rel, kind: preview.previewKind(e.name) });
+      }
+    }
+  })(root, '', 0);
+  const entry = { at: now, files, truncated: depthCut || budgetCut, scanned: files.length };
+  searchIndexCache.set(root, entry);
+  return entry;
+}
+
+/** One matched line, trimmed and centred on the needle, so a minified file cannot flood the row. */
+function searchSnippet(line, at) {
+  const s = String(line || '').replace(/\t/g, '  ');
+  if (s.length <= SEARCH_SNIPPET) return s.trim();
+  const start = Math.max(0, at - Math.floor(SEARCH_SNIPPET / 3));
+  return (start > 0 ? '…' : '') + s.slice(start, start + SEARCH_SNIPPET).trim()
+    + (start + SEARCH_SNIPPET < s.length ? '…' : '');
+}
+
+/**
+ * Search one workspace. Path matches first (they are what the PM typed a name for), then content
+ * matches over the readable text files that did not already match by path.
+ * `{ ok, q, hits, truncated, content_truncated, scanned, content_scanned, limit }` — never throws,
+ * never 404s: an empty `hits` with `truncated:false` IS the honest "looked, found nothing".
+ */
+function searchWorkspace(root, query, limit) {
+  const q = String(query == null ? '' : query).trim();
+  const cap = Math.max(1, Math.min(SEARCH_LIMIT_MAX, parseInt(limit, 10) || SEARCH_LIMIT_DEFAULT));
+  if (!q) {
+    return { ok: true, q: '', hits: [], truncated: false, content_truncated: false,
+      scanned: 0, content_scanned: 0, limit: cap };
+  }
+  const needle = q.toLowerCase();
+  const idx = searchIndex(root);
+  const hits = [];
+  const seen = new Set();
+  let overflow = false;                       // more matched than `cap` — a REAL cut, not a coincidence
+
+  /* `openable` means ONE thing: /api/doc will serve this. So it asks /api/doc's own reader rather
+   * than re-deciding from the extension.
+   *
+   * It used to be `SEARCH_OPENABLE.has(f.kind)` — extension only — while `readTextDoc` applies a
+   * SECOND refusal the search never replicated: a NUL byte anywhere in the file. A `.txt` holding
+   * binary therefore rendered as a clickable hit that opened a tab printing a read failure, which
+   * is the PRD's own constraint 6 violated ("the result says so rather than letting the PM click
+   * into a predictable failure"). An independent evaluator reproduced it on 2026-08-04:
+   *
+   *     hit masquerade.txt  kind=text openable=true  ->  /api/doc status=404
+   *
+   * Two notions of "servable" that can disagree is the defect; one definition, consulted, is the
+   * fix. Bounded by `cap` (<= 200 hits), and only for path matches — a content match already read
+   * the body and proved it NUL-free. */
+  const servable = (rel) => {
+    try {
+      /* SIZE-BOUNDED. `readTextDoc` has no size limit, so consulting it for every path hit read up
+       * to `cap` (200) WHOLE files on the server's only thread — measured by an independent verifier
+       * at 285 ms for 200 × 1 MB, and 5.7 s plus a 600 MB read for one oversized file. The comment
+       * twelve lines above SEARCH_CONTENT_BYTES says a bigger file is "path-matched only, never read
+       * whole"; the fix quietly broke that. A file past the content budget reports NOT openable —
+       * the honest answer is "we did not look", and the safe rendering of that is a hit the PM
+       * cannot click into an unknown. */
+      const st = fs.statSync(path.join(root, rel));
+      if (!st.isFile() || st.size > SEARCH_CONTENT_BYTES) return false;
+      return readTextDoc(root, rel) !== null;
+    } catch { return false; }
+  };
+
+  for (const f of idx.files) {
+    if (!f.path.toLowerCase().includes(needle)) continue;
+    seen.add(f.path);
+    if (hits.length >= cap) { overflow = true; break; }
+    hits.push({ ...f, match: 'path', line: null, snippet: null,
+      openable: SEARCH_OPENABLE.has(f.kind) && servable(f.path) });
+  }
+
+  let read = 0;
+  let contentCut = false;
+  /* When path matches overflow the cap, the ENTIRE content pass is skipped — so every body in the
+   * workspace went unread. `content_truncated` reported `false` alongside `content_scanned: 0`,
+   * contradicting the flag's own documented meaning ("every file was named, but not every body was
+   * read"). Masked by `truncated: true`, so the PM was warned — but a flag that disagrees with
+   * reality is the failure the two-flag split exists to prevent. */
+  if (overflow) contentCut = true;
+  if (!overflow) {
+    for (const f of idx.files) {
+      if (seen.has(f.path) || !SEARCH_OPENABLE.has(f.kind)) continue;
+      if (read >= SEARCH_CONTENT_FILES) { contentCut = true; break; }
+      const full = path.join(root, f.path);
+      let st;
+      try { st = fs.statSync(full); } catch { continue; }
+      if (!st.isFile()) continue;
+      if (st.size > SEARCH_CONTENT_BYTES) { contentCut = true; continue; }
+      read += 1;
+      let text;
+      try { text = fs.readFileSync(full, 'utf8'); } catch { continue; }
+      if (text.indexOf(String.fromCharCode(0)) !== -1) continue;    // binary masquerading as text — never scanned
+      const at = text.toLowerCase().indexOf(needle);
+      if (at === -1) continue;
+      // The cap biting HERE also leaves bodies unread — the sibling branch of the same defect, and
+      // the half the first fix missed.
+      if (hits.length >= cap) { overflow = true; contentCut = true; break; }
+      const before = text.slice(0, at);
+      const lineNo = before.split('\n').length;
+      const lineStart = before.lastIndexOf('\n') + 1;
+      const lineEnd = text.indexOf('\n', at);
+      hits.push({
+        ...f, match: 'content', line: lineNo,
+        snippet: searchSnippet(text.slice(lineStart, lineEnd === -1 ? text.length : lineEnd), at - lineStart),
+        openable: true,
+      });
+    }
+  }
+
+  return {
+    ok: true, q, hits, limit: cap,
+    // "files you searched for were never looked at" — the serious one.
+    truncated: idx.truncated || overflow,
+    // "every file was named; not every body was read" — the ordinary one.
+    content_truncated: contentCut,
+    scanned: idx.scanned, content_scanned: read,
+  };
+}
+
 // Serve a TEXTUAL document — markdown (incl. .skill), plain-text/config source, or HTML source —
 // per-workspace-guarded. Images are NOT served here (they stream through /api/asset); anything
 // non-textual returns null so the reader shows it inert. A NUL byte ⇒ binary masquerading as text
@@ -1136,10 +1333,32 @@ function deriveState(ev) {
 // state dir is why this surface reported 0 accepted against 23 real acceptance rows — the same
 // "one field, several readers, none agreeing" defect the anchor resolver was built to end.
 function acceptanceFilesFor(w) {
+  return ledgerFilesFor(w, 'acceptances.jsonl');
+}
+// The general form of the comment above, because the defect it describes was never specific to
+// acceptances. `deriveNeeds` read evals.jsonl, acceptances.jsonl AND outcome_checks.jsonl from the
+// state dir alone, so the supervision surface under-reported everything pmos-self records in
+// planning/runs/ — the same "one field, several readers, none agreeing" shape, three ledgers wide.
+// One helper with three call sites, so the fourth ledger added later cannot reintroduce it.
+function ledgerFilesFor(w, basename) {
   const out = [];
   const d = stateDirFor(w);
-  if (d) out.push(path.join(d, 'acceptances.jsonl'));
-  if (w && w.root) out.push(path.join(w.root, 'planning', 'runs', 'acceptances.jsonl'));
+  if (d) out.push(path.join(d, basename));
+  if (w && w.root) out.push(path.join(w.root, 'planning', 'runs', basename));
+  return out;
+}
+// readJsonl over BOTH ledger locations, deduped by nothing: callers fold, and a row present in both
+// is the same row recorded twice, which every existing fold already tolerates.
+function readLedger(w, basename) {
+  const out = [];
+  for (const f of ledgerFilesFor(w, basename)) {
+    let text = '';
+    try { text = fs.readFileSync(f, 'utf8'); } catch { continue; }
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
+      try { out.push(JSON.parse(line)); } catch { /* a torn line is reported by the checkers, not here */ }
+    }
+  }
   return out;
 }
 function readAcceptances(w) {
@@ -2794,18 +3013,20 @@ function deriveNeeds(w) {
   if (!dir) return [];
   const needs = [];
   const settled = new Set();
-  for (const a of readJsonl(dir, 'acceptances.jsonl')) if (a.run_id) settled.add(a.run_id);
-  for (const e of readJsonl(dir, 'evals.jsonl')) {
+  for (const a of readLedger(w, 'acceptances.jsonl')) if (a.run_id) settled.add(a.run_id);
+  for (const e of readLedger(w, 'evals.jsonl')) {
     if (!e.run_id || settled.has(e.run_id)) continue;
     const verdict = e.verdict ? String(e.verdict) : 'no verdict';
     needs.push({
       run_id: e.run_id, initiative_id: e.initiative_id || null, kind: 'accept', derived: true,
       question: `Acceptance Gate open — evaluator says ${verdict}${e.score != null ? ` (${e.score})` : ''}`,
-      doc: e.rubric_path || null,
+      // `rubric` is the deprecated alias every one of the 26 legacy rows uses; scripts/record-eval.js
+      // requires `rubric_path` going forward. Read both, write only the new one.
+      doc: e.rubric_path || e.rubric || null,
     });
   }
   const disposed = new Set();
-  for (const c of readJsonl(dir, 'outcome_checks.jsonl')) if (c.initiative_id) disposed.add(c.initiative_id);
+  for (const c of readLedger(w, 'outcome_checks.jsonl')) if (c.initiative_id) disposed.add(c.initiative_id);
   const today = nowISO().slice(0, 10);
   let files = [];
   try { files = fs.readdirSync(path.join(dir, 'initiatives')).filter((f) => f.endsWith('.md')).sort(); } catch {}
@@ -4309,6 +4530,25 @@ async function handleRequest(req, res) {
     });
     return json(res, built, built.ok ? 200 : 400);
   }
+  // ── TWO CORPORA, TWO ENDPOINTS, ONE BOX ────────────────────────────────────────────────────
+  // `/api/search` is EPISODIC — what a past session printed. `/api/search/files` is the FOLDER —
+  // what is on disk under this workspace's root. They are deliberately not merged: the hit shapes
+  // share no field (`{session, line, after}` vs `{path, kind, match, openable}`), the scrollback
+  // search scrubs secrets out of text an agent typed, and the file search reports a walk bound.
+  // Collapsing them into one payload would mean one of the two lying about what it looked at.
+  if (p === '/api/search/files') {
+    // `search everything…`, finally over everything: every file under THIS workspace's root, by
+    // path and by content. There is no path parameter — the query is a needle, not a location — so
+    // this adds no reachable path; `openable` reports whether /api/doc (or /api/asset) could show a
+    // hit. `truncated` + `scanned` are the contract that keeps a bounded answer from reading as a
+    // complete one, which is the defect this endpoint exists to end rather than to relocate.
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) {
+      return json(res, { ok: false, error: 'no workspace to search', q: url.searchParams.get('q') || '',
+        hits: [], truncated: false, scanned: 0, content_scanned: 0, limit: SEARCH_LIMIT_DEFAULT });
+    }
+    return json(res, { ws: w.id, ...searchWorkspace(w.root, url.searchParams.get('q'), url.searchParams.get('limit')) });
+  }
   if (p === '/api/search') {
     // Episodic recall over this workspace's own past sessions. Localhost only, like everything
     // else here — an agent running in a pane can curl it to check what an earlier run tried.