create-pmos 0.33.0 → 0.36.0

package/workspace/public/pm/data.js

@@ -706,6 +706,101 @@ function currentProductName() {
   return productOrder[0] || null;
 }
 
+/* ── the Focus queue ─────────────────────────────────────────────────────────────────────────
+ * `/api/console?name=focus` is cross-product (the server accepts and ignores `ws`) and it runs the
+ * board and ladder derivations for every registered workspace — a cold derive the boot path
+ * deliberately avoids (see `lightRecord`). So it is fetched LAZILY, on entry to focus mode, never
+ * at load.
+ *
+ * The server's view (lib/focus.js buildFocus) is `{queue, handoffs, delegated, upkeep, badge, …}`;
+ * modes.js renders the fixture rows' shape `{first, waiting, syn, saw}`. The reshape happens here
+ * — one adapter, not a second renderer — and a failed read is published as `{readError}`, which
+ * the mode renders as a failed read, never as "a successful read of nothing".
+ */
+
+/** One focus row in the shape the mode's queue renderer reads. The `read:` label is the caller's
+ * to add (lib/focus.js R4) — the server's string is the content after it. */
+function focusRow(r) {
+  return {
+    n: r.rank == null ? '' : String(r.rank),
+    slug: r.subject || '',
+    // `productName` is the board's own key (the repo name data.js registered), which is what
+    // `jump` needs; `product` is the server's repo-key path and matches no board.
+    prod2: r.productName || '',
+    why: r.why || '',
+    read: r.read ? 'read: ' + r.read : '',
+  };
+}
+
+/** The server's focus view, reshaped to what focusList renders. Every row is the payload's — no
+ * fixture constant is reachable from here. */
+function focusFrom(view) {
+  const h = view.handoffs || {};
+  const d = view.delegated || {};
+  const u = view.upkeep || {};
+
+  const syn = [];
+  for (const s of d.running || []) {
+    syn.push({
+      t: (s.name || s.id) + ' · ' + (s.word || s.shown) + (s.productName ? ' — ' + s.productName : ''),
+      hasBtn: false,
+    });
+  }
+  /* `starts` are the engine's own delegate OFFERS. They render as rows, not buttons: this surface
+   * has no runner that can feed `initialInput` into a spawn, and a ▶ button PMOS cannot honour is
+   * worse than no button (the server's own starts_note rule). */
+  for (const s of d.starts || []) {
+    syn.push({ t: (s.initiative || '') + ' — ' + (s.action || s.skill || ''), hasBtn: false });
+  }
+
+  const saw = [];
+  if (u.memory && u.memory.heading) {
+    saw.push({ t: u.memory.heading + ' — ' + (u.memory.body || u.memory.state || '') });
+  }
+  const bud = u.budgets || {};
+  if (bud.state === 'error') {
+    saw.push({ t: 'health budgets — read failed: ' + (bud.error || 'no reason given') });
+  }
+  for (const r of bud.rows || []) {
+    saw.push({
+      t: r.id + ' — cap ' + (r.cap || 'not declared') + ' · ' + (r.total || 0)
+        + ' anchored initiative' + (r.total === 1 ? '' : 's'),
+    });
+  }
+  // The server's caveat travels with the counts it qualifies: without it the totals above read as
+  // the cap test, which is exactly the claim the view refuses to make.
+  if ((bud.rows || []).length && bud.caveat) saw.push({ t: bud.caveat });
+
+  return {
+    first: (view.queue || []).map(focusRow),
+    waiting: (h.items || []).map(focusRow),
+    // The handoffs body for a tracker that is NOT CONNECTED — a different sentence from an empty
+    // list, rendered by the mode in place of the calm empty line.
+    waitingNote: (h.items || []).length ? null : (h.body || null),
+    syn,
+    saw,
+  };
+}
+
+let focusInFlight = false;
+
+async function loadFocus() {
+  if (FIXTURE || focusInFlight) return;
+  focusInFlight = true;
+  // The in-flight read is STATED. With nothing published yet, the mode would otherwise render its
+  // calm empty line — a claim of a successful read of nothing while the read is still out. A
+  // usable earlier payload stays on screen for the refresh instead.
+  if (!state.focus || state.focus.readError) setState({ focus: { reading: true } });
+  try {
+    const view = await getJson('/api/console', { name: 'focus' });
+    setState({
+      focus: view && view.ok !== false
+        ? focusFrom(view)
+        : { readError: (view && view.error) || 'the focus queue could not be read' },
+    });
+  } finally { focusInFlight = false; }
+}
+
 /* ── sessions ───────────────────────────────────────────────────────────────────────────────
  * Polled rather than pushed. The WebSocket that carries `sessions` frames belongs to panel 4's
  * terminal module, which owns the attach/input protocol; opening a SECOND socket here to read a
@@ -1214,7 +1309,7 @@ export function runningCount(s) {
  * newly selected initiative, and a repaint when it lands.
  */
 if (!FIXTURE) {
-  let lastSel = null, lastProduct = null;
+  let lastSel = null, lastProduct = null, lastMode = null;
   subscribe(() => {
     if (state.product !== lastProduct) {
       lastProduct = state.product;
@@ -1222,6 +1317,12 @@ if (!FIXTURE) {
       if (p && p.ws && state.wsId !== p.ws) setState({ wsId: p.ws });
       if (p && !p.board) loadInitiatives(state.product);
     }
+    // The focus view is fetched on ENTRY to focus mode, and re-fetched on every re-entry — the
+    // queue is a statement about now, and the mode switch is the moment the PM asks for it.
+    if (state.mode !== lastMode) {
+      lastMode = state.mode;
+      if (state.mode === 'focus') loadFocus();
+    }
     const sel = state.sel;
     if (sel && sel !== lastSel) {
       lastSel = sel;

package/workspace/public/pm/modes.js

@@ -47,6 +47,7 @@ import { el, setChildren } from './dom.js';
 import { state, setState, FIXTURE } from './state.js';
 import * as FX from './fixture.js';
 import { openDoc, openTerm } from './panel-initiatives.js';
+import { boardOf, records, currentProduct } from './board-read.js';
 
 /* ── the prototype's small helpers ─────────────────────────────────────────────────────────── */
 
@@ -127,23 +128,7 @@ const knowMap = () => ({ ...(state.know || seedOr(() => FX.KNOW, {})), ...(state
 const profileList = () => state.profiles || seedOr(() => FX.PROFILES, []);
 const intgList = () => state.intgs || seedOr(() => FX.INTG, []);
 
-/* ── the board, read the way panels 2 and 3 read it ────────────────────────────────────────── */
-
-const boardOf = () =>
-  (state.board && typeof state.board === 'object' ? state.board : (FIXTURE ? FX.ALLGROUPS : {}));
-
-function records() {
-  const base = state.records && typeof state.records === 'object'
-    ? state.records
-    : (FIXTURE ? FX.DATA : {});
-  return { ...base, ...state.userInits };
-}
-
-function currentProduct() {
-  if (state.product) return state.product;
-  const keys = Object.keys(boardOf());
-  return keys.length ? keys[0] : 'workspace';
-}
+/* ── the board, read the way panels 2 and 3 read it (board-read.js — one derivation) ───────── */
 
 /** The initiative a mode acts on when it starts a session (line 1397). */
 function selectedSlug() {
@@ -207,12 +192,12 @@ function focusList() {
   });
   /* The queue is a JUDGEMENT about what is blocked on the PM, so it is never invented here. In
    * fixture mode it is the prototype's four ranked items; in real mode it is whatever the data
-   * layer published on `state.focus` ({first, waiting, syn}); with neither, each section renders
-   * its label and one honest empty line. */
+   * layer published on `state.focus` (loadFocus's adapted `/api/console?name=focus` view —
+   * {first, waiting, syn, saw}, or {readError} for a failed read); with neither, each section
+   * renders its label and one honest empty line. */
   const F = state.focus || (FIXTURE
     ? { first: FX.FOCUS_FIRST, waiting: FX.FOCUS_WAITING, syn: FX.FOCUS_SYN }
     : { first: [], waiting: [], syn: [] });
-  const live = FIXTURE || !!state.focus;
   const first = (F.first || []).map(fRow);
   const waiting = (F.waiting || []).map(fRow);
   const MEM = memoryOf();
@@ -220,14 +205,20 @@ function focusList() {
   const syn = (F.syn || []).map((f) => ({
     ...f,
     on: () => {
-      if (f.action === 'delegate-billing-stories') {
+      /* The delegate spawn is the FIXTURE's own seed session. A real-mode row never carries this
+       * action (data.js renders the server's `starts` without a button — a button would claim a
+       * spawn this surface has no runner for), so the gate is stated, not assumed. */
+      if (FIXTURE && f.action === 'delegate-billing-stories') {
         const d = FX.DELEGATE_SESSION;
         startSession(d.slug, { ...d.sess });
       }
     },
   }));
 
-  const saw = live ? FX.focusSaw(MEM).map((f) => ({
+  /* Upkeep is data-driven like the other sections: the fixture seed renders ONLY in fixture mode;
+   * in real mode the rows are the server's own upkeep view, adapted by data.js. Seed rows behind a
+   * published `state.focus` were "the beautiful shell" waiting to activate. */
+  const saw = (FIXTURE ? FX.focusSaw(MEM) : (F.saw || [])).map((f) => ({
     ...f,
     on: () => {
       if (f.action === 'mode:memory') { setState({ mode: 'memory' }); return; }
@@ -236,7 +227,7 @@ function focusList() {
         jump(prod2, slug);
       }
     },
-  })) : [];
+  }));
 
   const board = boardOf();
   const ends = productTuples().map(([id]) => {
@@ -244,6 +235,21 @@ function focusList() {
     return g0 ? { prod: id, obj: g0.gid + ' · ' + g0.gname } : null;
   }).filter(Boolean);
 
+  /* A failed read renders as a failed read, and an in-flight one says so — never "a successful
+   * read of nothing" for either. Used by the four sections the focus payload feeds; the objectives
+   * section derives from the board and keeps its own empty line. */
+  const emptyOr = () => {
+    if (F.readError) {
+      return el('div', { style: 'padding:5px 14px 6px;font-size:11px;color:var(--destructive)' },
+        iv('read failed — ' + F.readError));
+    }
+    if (F.reading) {
+      return el('div', { style: 'padding:5px 14px 6px;font-size:11px;color:var(--muted-foreground);font-style:italic' },
+        'reading the focus queue…');
+    }
+    return emptyLine();
+  };
+
   const out = [];
   out.push(el('div', { style: 'padding:8px 14px 4px;font-size:11.5px;color:var(--muted-foreground);line-height:1.5' },
     'This list holds only items where ',
@@ -270,7 +276,7 @@ function focusList() {
       el('span', { style: 'display:block;font-size:11px;margin-top:1px' }, iv(ff.why)),
       el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(ff.read))));
   }
-  if (!first.length) out.push(emptyLine());
+  if (!first.length) out.push(emptyOr());
 
   out.push(el('div', { style: LABEL9 }, 'handoffs · waiting on other teams'));
   for (const fw of waiting) {
@@ -281,7 +287,15 @@ function focusList() {
       el('span', { style: 'display:block;font-size:11px;color:var(--muted-foreground);margin-top:1px' }, iv(fw.why)),
       el('span', { style: 'display:block;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(fw.read))));
   }
-  if (!waiting.length) out.push(emptyLine());
+  /* `waitingNote` is the server's own sentence for a tracker that is NOT CONNECTED — a different
+   * fact from a successful read that found nothing, so it gets the server's words, not the calm
+   * empty line. */
+  if (!waiting.length) {
+    out.push(F.waitingNote
+      ? el('div', { style: 'padding:5px 14px 6px;font-size:11px;color:var(--muted-foreground);font-style:italic' },
+          iv(F.waitingNote))
+      : emptyOr());
+  }
 
   out.push(el('div', { style: LABEL9 }, 'delegated · agents in parallel'));
   for (const fy of syn) {
@@ -292,7 +306,7 @@ function focusList() {
         style: 'flex:none;font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:26px;background:var(--brand);color:oklch(0.987 0.002 197.1);font-weight:500',
       }, iv(fy.btn))));
   }
-  if (!syn.length) out.push(emptyLine());
+  if (!syn.length) out.push(emptyOr());
 
   out.push(el('div', { style: LABEL9 }, 'upkeep · keep the system sharp'));
   for (const fs2 of saw) {
@@ -302,7 +316,7 @@ function focusList() {
       hover: ROW_HOVER,
     }, el('span', { style: 'display:block;font-size:11.5px;color:var(--muted-foreground);line-height:1.45' }, iv(fs2.t))));
   }
-  if (!saw.length) out.push(emptyLine());
+  if (!saw.length) out.push(emptyOr());
   return out;
 }
 
@@ -668,12 +682,20 @@ function schedBody(det) {
       onWhen: (e) => save({ ...t, when: e.target.value }),
       onRunCmd: (e) => save({ ...t, runCmd: e.target.value }),
       onScope: (e) => save({ ...t, scope: e.target.value }),
+      /* The green "ok — ran … 0 failures" line is the FIXTURE's seed log. In real mode nothing
+       * executes on this press — no runner is wired to this surface — so writing it there would be
+       * a fabricated execution success (the watermelon the honesty contract forbids). The real-mode
+       * line says exactly what happened: nothing. */
       onRun: () => save({
         ...t,
-        log: [{
+        log: [FIXTURE ? {
           ts: '12:41 today',
           t: t.runCmd ? 'ok — ran `' + t.runCmd + '` manually, 0 failures' : 'nothing ran — no command defined yet',
           c: t.runCmd ? 'var(--success)' : 'var(--warning)',
+        } : {
+          ts: '—',
+          t: 'nothing ran — no runner is wired to this surface yet',
+          c: 'var(--warning)',
         }, ...(t.log || [])],
       }),
       onToggle: () => save({ ...t, enabled: !t.enabled }),

package/workspace/public/pm/panel-detail.js

@@ -54,6 +54,7 @@ import { state, setState, FIXTURE } from './state.js';
 import * as FX from './fixture.js';
 import { openDoc, openTab, openTerm, fileNewModel } from './panel-initiatives.js';
 import { addProductBody } from './panel-repos.js';
+import { boardOf, records, currentProduct } from './board-read.js';
 
 /* ── the prototype's small helpers ─────────────────────────────────────────────────────────── */
 
@@ -102,23 +103,7 @@ function declare(fn, payload) {
   if (typeof write === 'function') { try { write(payload); } catch { /* the UI still shows it */ } }
 }
 
-/* ── the board, read the same way panel 2 reads it ─────────────────────────────────────────── */
-
-const boardOf = () =>
-  (state.board && typeof state.board === 'object' ? state.board : (FIXTURE ? FX.ALLGROUPS : {}));
-
-function records() {
-  const base = state.records && typeof state.records === 'object'
-    ? state.records
-    : (FIXTURE ? FX.DATA : {});
-  return { ...base, ...state.userInits };
-}
-
-function currentProduct() {
-  if (state.product) return state.product;
-  const keys = Object.keys(boardOf());
-  return keys.length ? keys[0] : 'workspace';
-}
+/* ── the board, read the same way panel 2 reads it (board-read.js — one derivation) ────────── */
 
 function baseGroups(product) {
   const board = boardOf();

package/workspace/public/pm/panel-initiatives.js

@@ -70,6 +70,7 @@
 import { el, setChildren } from './dom.js';
 import { state, setState, FIXTURE } from './state.js';
 import * as FX from './fixture.js';
+import { boardOf, records, currentProduct } from './board-read.js';
 
 /* ── the prototype's small helpers, verbatim in behaviour ──────────────────────────────────── */
 
@@ -82,20 +83,8 @@ const selRow = (on) => ({
   bl: on ? 'var(--brand)' : 'transparent',
 });
 
-/* The seed board is reachable ONLY in fixture mode. In normal mode an unpublished board is an
- * EMPTY board — the prototype's own copy for a repository with nothing filed — never the seed data.
- * "The beautiful shell" in the PRD's failure-mode list is exactly this: fixture rows rendering in
- * the real app, so the diff looks clean while nothing is connected. */
-const seedBoard = () => (FIXTURE ? FX.ALLGROUPS : {});
-const seedRecords = () => (FIXTURE ? FX.DATA : {});
-const boardOf = () => (state.board && typeof state.board === 'object' ? state.board : seedBoard());
-
-/** The repository whose board is showing (line 1395). */
-function currentProduct() {
-  if (state.product) return state.product;
-  const keys = Object.keys(boardOf());
-  return keys.length ? keys[0] : 'workspace';
-}
+/* `boardOf` / `records` / `currentProduct` live in board-read.js — one derivation, four readers.
+ * The seed-board honesty rule ("the beautiful shell") is stated and enforced there. */
 
 /** The Objective/KR groups a repository starts from, before user-filed additions. */
 function baseGroups(product) {
@@ -106,12 +95,6 @@ function baseGroups(product) {
   return FIXTURE && !state.board ? (FX.ALLGROUPS[product] || FX.ALLGROUPS.workspace) : [];
 }
 
-/** Every initiative record: the board's own records, with user-filed ones layered on (line 1392). */
-function records() {
-  const base = state.records && typeof state.records === 'object' ? state.records : seedRecords();
-  return { ...base, ...state.userInits };
-}
-
 /** GROUPS (lines 1425–1430) — user groups appended, user KRs and user initiatives folded in. */
 function groupsFor(product) {
   const extraGroups = (state.userGroups && state.userGroups[product]) || [];

package/workspace/public/pm/panel-newsess.js

@@ -97,6 +97,9 @@ export function openNewSession(slug, seed) {
     newSessAgent: s.agent || 'shell',
     newSessBranch: '', newSessBranchNew: '', newSessBranchMode: false,
     newSessIsolate: null, newSessError: null, newSessBusy: false,
+    // Cleared so a form opened on a DIFFERENT repository never shows the previous repo's branch
+    // list while its own read is out — "reading the repository…" is true; a stale list is not.
+    newSessBranches: null,
     // Cleared on the way IN as well as on the way out: a form that opened still showing the profile
     // a previous, abandoned question had chosen would be proposing an answer nobody gave.
     preflightProfile: s.profile === undefined ? null : s.profile,
@@ -135,9 +138,17 @@ function proposeName(slug) {
 
 /* Fired when the form opens, and again when the server says a branch moved. Both reads are
  * independent and each writes only its own key, so a repository with no git still gets its profile
- * chips and a machine with no profile directory still gets its branch picker. */
+ * chips and a machine with no profile directory still gets its branch picker.
+ *
+ * `readsFor` records WHICH open the reads were actually issued for. The lazy data.js import above
+ * can land after the form opened — refreshReads then returned early and nothing ever retried, so
+ * the form sat on "reading the repository…" for ever. The render path re-issues the reads once per
+ * open (newSessionBlock); the token is what stops it re-fetching on every repaint. */
+let readsFor = null;
+
 function refreshReads() {
   if (FIXTURE || !dataMod) return;
+  readsFor = state.newSess;
   const ws = state.wsId || null;
   if (typeof dataMod.loadBranches === 'function') {
     dataMod.loadBranches(ws).then((r) => setState({ newSessBranches: r || null })).catch(() => {});
@@ -451,6 +462,8 @@ async function onStart() {
 /** The pre-flight block, or null when it is closed. Called from panel-tabs.js's render. */
 export function newSessionBlock() {
   if (!state.newSess) return null;
+  // The reads this open still owes — issued here when data.js resolved after openNewSession ran.
+  if (!FIXTURE && dataMod && readsFor !== state.newSess) refreshReads();
   absorbBranchBroadcast();
   const slug = state.newSess.slug;
   const busy = !!state.newSessBusy;

package/workspace/public/pm/panel-tabs.js

@@ -33,6 +33,7 @@ import { openTab, openTerm as openTermTab, openDoc as openDocTab } from './panel
 import { mountDoc, disposeDoc, docText } from './tab-doc.js';
 import { mountTask } from './tab-task.js';
 import { newSessionBlock, openNewSession } from './panel-newsess.js';
+import { boardOf, currentProduct } from './board-read.js';
 
 /* tab-term.js is loaded LAZILY and on purpose: it is another module's file, a static import of a
  * file that is not on disk yet takes the whole panel down with it, and an empty terminal pane is a
@@ -45,16 +46,7 @@ import('./tab-term.js')
 /** `{{ expr }}` — one interpolated value in its own span, the way the prototype's runtime emits it. */
 const iv = (v) => el('span', null, v === null || v === undefined ? '' : String(v));
 
-/* ── the board, read exactly the way panels 2 and 3 read it ─────────────────────────────────── */
-
-const boardOf = () =>
-  (state.board && typeof state.board === 'object' ? state.board : (FIXTURE ? FX.ALLGROUPS : {}));
-
-function currentProduct() {
-  if (state.product) return state.product;
-  const keys = Object.keys(boardOf());
-  return keys.length ? keys[0] : 'workspace';
-}
+/* ── the board, read exactly the way panels 2 and 3 read it (board-read.js) ─────────────────── */
 
 /** The selected initiative (prototype line 1397) — the slug `＋ session` starts a session on. */
 function selSlug() {
@@ -85,7 +77,11 @@ function visibleTabs() {
   const map = slugProductOf();
   return (state.tabs || []).filter((t) => {
     const sp = map[t.slug] !== undefined ? map[t.slug] : t.repo;
-    return sp === undefined || sp === product;
+    /* `== null` on purpose: an unattributed-session tab carries `slug: null, repo: null`
+     * (panel-initiatives openTerm), and a strict undefined check excluded it from EVERY
+     * repository's bar — an open, PTY-attached tab with no visible chip and no close button. A
+     * tab on no board is visible everywhere, whichever null-ish shape says so. */
+    return sp == null || sp === product;
   });
 }
 
@@ -645,6 +641,8 @@ const CH_BTN = 'flex:none;font-family:var(--mono);font-size:10.5px;padding:4px 1
 
 function peerRow(prompt, p) {
   const armed = state.endConfirm === p.id;
+  const refusal = state.endRefusal && state.endRefusal.id === p.id ? state.endRefusal.why : null;
+  const asked = state.endAsked === p.id;
   return el('div', {
     style: 'display:flex;gap:10px;align-items:flex-start;padding:8px 10px;border:1px solid oklch(1 0 0 / 10%);background:oklch(1 0 0 / 3%)',
   },
@@ -664,6 +662,17 @@ function peerRow(prompt, p) {
         style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.62 0.02 213);overflow:hidden;text-overflow:ellipsis;white-space:nowrap',
       }, iv(p.doing)) : null,
       el('div', { style: 'font-size:11px;color:' + RISK_COLOR[p.risk.level] + ';line-height:1.45' }, iv(p.risk.why)),
+      /* WHY THE END DID NOT HAPPEN, in the row the PM was looking at. A refusal recorded in state
+       * and rendered nowhere would be the same silence in a new place — the whole defect here was a
+       * failure that looked like a success. */
+      refusal ? el('div', {
+        style: 'font-size:11px;color:var(--destructive);line-height:1.45',
+      }, iv('not ended — ' + refusal)) : null,
+      /* And the honest reading of a SENT end: asked, not done. The row leaves this list when the
+       * server stops reporting the session, and that is the confirmation. */
+      asked ? el('div', {
+        style: 'font-size:11px;color:oklch(0.62 0.02 213);line-height:1.45',
+      }, iv('asked it to end — this row disappears when the session actually stops')) : null,
     ),
     el('div', { style: 'flex:none;display:flex;gap:6px;align-items:center' },
       el('button', {
@@ -672,9 +681,39 @@ function peerRow(prompt, p) {
       }, 'open it'),
       el('button', {
         onClick: () => {
-          if (!armed) { setState({ endConfirm: p.id }); return; }
-          if (termMod && typeof termMod.killSession === 'function') termMod.killSession(p.id);
-          setState({ endConfirm: null });
+          if (!armed) { setState({ endConfirm: p.id, endRefusal: null }); return; }
+          /* THE ANSWER IS READ, NOT DISCARDED. This was an unconditional `setState({endConfirm:null})`
+           * after a call whose return value was thrown away, so three separate paths — no module, a
+           * `FIXTURE || !id` refusal, and a closed socket — disarmed the button on a request that
+           * never left the page. The third is the one an ordinary PM meets: in a fresh window with
+           * no terminal tab the chooser is populated over HTTP while this socket has never opened.
+           *
+           * The decision itself is in lib/tree-share so the BLOCKING suite can assert it; a rule
+           * that lived here would only ever be tested by the browser suites, which CI runs under
+           * `continue-on-error: true` — they report and never block. */
+          const TS = typeof window !== 'undefined' ? window.PMOSTreeShare : null;
+          const hasModule = !!(termMod && typeof termMod.killSession === 'function');
+          const at = TS && typeof TS.endAttempt === 'function'
+            ? TS.endAttempt({
+              id: p.id,
+              hasModule,
+              socketOpen: !!(termMod && typeof termMod.socketOpen === 'function' && termMod.socketOpen()),
+              fixture: FIXTURE,
+            })
+            /* The module that decides is the same module that built this row, so it cannot be
+             * missing here. If it ever is, refuse — a destructive control has no safe default. */
+            : { send: false, why: 'the workspace could not decide whether this could be sent, so it was not' };
+          if (!at.send) {
+            /* STAYS ARMED. Re-arming is the only signal the PM has that nothing happened, so a
+             * refusal must not clear `endConfirm` — the disarm was itself the false report. */
+            setState({ endRefusal: { id: p.id, why: at.why } });
+            return;
+          }
+          termMod.killSession(p.id);
+          /* `asked`, never `ended`. All this page knows is that a frame was written to a socket;
+           * whether the session died is the server's to report, and the row leaving the list is
+           * what says so. */
+          setState({ endConfirm: null, endRefusal: null, endAsked: p.id });
         },
         style: CH_BTN + (armed ? ';color:var(--destructive);border-color:var(--destructive)' : ''),
         hover: CHIP_HOVER,

package/workspace/public/pm/tab-term.js

@@ -256,9 +256,15 @@ export function requestSpawn(opts) {
     };
     SOCK.spawnQueue.push(req);
     /* Armed BEFORE the flush, and armed whether or not the message goes out now: a request waiting
-     * for a socket that never opens must end in a sentence, not in a form that spins for ever. */
+     * for a socket that never opens must end in a sentence, not in a form that spins for ever.
+     *
+     * Only an UNSENT ask leaves the queue here — the server never heard it, so no answer is coming.
+     * A SENT one keeps its slot, settled: the queue's ORDER is the correlation, and removing a slot
+     * the server will still answer (spawnWithBranch can legitimately outlive this timer on a large
+     * repo) would hand its late `created` to the next request in line — a different click's PTY.
+     * The `created` handler detaches the session a dead slot's answer names. */
     req.timer = setTimeout(() => {
-      SOCK.spawnQueue = SOCK.spawnQueue.filter((x) => x !== req);
+      if (!req.sent) SOCK.spawnQueue = SOCK.spawnQueue.filter((x) => x !== req);
       settleAsk(req, {
         ok: false,
         error: req.sent
@@ -369,6 +375,11 @@ function handle(m) {
     const req = takeSent(true);
     if (!req) return;
     if (req.kind === 'ask') {
+      // A slot the timeout already settled has no caller left: the form reported the failure and
+      // moved on, so the session this answer names is unowned — detach it rather than leak a
+      // running PTY nobody asked for. Consuming the slot (above) is what keeps the NEXT answer
+      // correlated with the next request.
+      if (req.settled) { send({ t: 'detach', id: m.id }); return; }
       // Nobody is on screen waiting for this. Hand the caller the id and whatever non-fatal truth
       // arrived just before it; the caller opens the tab, and the tab carries the id so bind()
       // ATTACHES rather than starting a second session for the same click.
@@ -925,6 +936,23 @@ export function killSession(id) {
   return send({ t: 'kill', id });
 }
 
+/**
+ * Is the terminal socket open right now?
+ *
+ * Exported so a caller can decide BEFORE acting rather than discover afterwards. `killSession`
+ * already returned `false` on a closed socket and its own docstring said a caller should use that
+ * to say "not sent" — the chooser discarded it, and a destructive control disarmed on a request
+ * that never left the page. The pre-flight is what lets the chooser refuse and SAY WHY, and the
+ * reason has to be distinguishable from "the module is not loaded", which the return value alone
+ * cannot express.
+ *
+ * The readiness constant is `1` (`OPEN`) and nothing else: `CONNECTING` is not open, and a frame
+ * written to a `CLOSING` socket is a frame nobody receives.
+ */
+export function socketOpen() {
+  return !!(SOCK.ws && SOCK.ws.readyState === 1);
+}
+
 /**
  * Write a status line into a tab's terminal, by tab id — for a caller that holds a fact about a
  * session but not the pane showing it.