create-pmos 0.34.0 → 0.36.0

package/workspace/lib/engine/read-jsonl.js

@@ -0,0 +1,53 @@
+'use strict';
+/*
+ * scripts/read-jsonl.js — THE JSONL reader for the scripts/ checkers and the workflow engine.
+ *
+ * Six near-identical readers grew here, with three different torn-line contracts, and the repo's
+ * own comments record the cost twice: a silently-dropped torn line re-opened a verified entry
+ * (check-verify-queue.js) and made an accepted initiative read as never accepted (workflow-state.js).
+ * Each new checker re-decided the torn-line question from scratch and got it wrong at least twice.
+ * One reader, one contract — the strictest one found:
+ *
+ *   - a torn line is DROPPED, never guessed at — a truncated row parsed "as far as it goes" would
+ *     fabricate a record nobody wrote;
+ *   - and it is REPORTED, never swallowed: every defect comes back with its file, 1-based line,
+ *     parse reason and a bounded slice of the text, so the caller can say out loud what it could
+ *     not read. "Assuming someone else counts is how nobody counts."
+ *   - a MISSING (or unreadable) file is its own state, distinguishable from an empty one — the
+ *     cadence checker needs the difference and a gate must not confuse "no ledger" with "no rows".
+ *
+ * Returns { rows, defects, torn, missing }: rows are the parsed objects in file order; defects is
+ * [{ file, line, reason, text }]; torn === defects.length, kept as a count because most callers
+ * only need the number; missing is true when the file could not be read at all (rows/defects empty).
+ *
+ * DELIBERATELY FLAT in scripts/, not scripts/lib/: the kit and the workspace bundle both vendor the
+ * engine's require closure by BASENAME into a flat directory (kit/build-kit.sh, scripts/
+ * vendor-workspace-engine.js), so a `./lib/` require would resolve in the checkout and break in
+ * every vendored copy — the exact incident class the scripts/lib/sink.js re-export note records.
+ * workspace/lib/file-mode-parse.js does NOT delegate here for the mirrored reason: the workspace
+ * bundle ships alone, cannot require across the bundle boundary, and its silent-drop reader is the
+ * locked mirror of kit/scripts/metrics.py (kit/fixtures/test_parsers.py holds that agreement).
+ *
+ * Zero dependencies, stock Node.
+ */
+const fs = require('fs');
+
+function readJsonl(file) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); }
+  catch { return { rows: [], defects: [], torn: 0, missing: true }; }
+  const rows = [];
+  const defects = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (!t) continue;
+    try { rows.push(JSON.parse(t)); }
+    catch (e) {
+      defects.push({ file, line: i + 1, reason: String((e && e.message) || 'not valid JSON').slice(0, 120), text: t.slice(0, 120) });
+    }
+  }
+  return { rows, defects, torn: defects.length, missing: false };
+}
+
+module.exports = { readJsonl };

package/workspace/lib/engine/workflow-state.js

@@ -58,18 +58,43 @@ const delivery = require('./delivery-index');
 // The OKR documents and the budget registry are read once per root, not once per initiative: the
 // board derives ~100 ladders in a single pass and re-reading the same three files each time is the
 // same waste the shared commit-range exists to avoid.
-const _okrCache = new Map();
-const _budCache = new Map();
+//
+// KEYED BY WHAT THE FILES ARE, never by where they live alone. The workspace server requires this
+// module in-process and holds it for days, so a root-only key kept serving the ladder yesterday's
+// anchor index after the PM fixed the OKR document — the OKR panel (which reads fresh) and the
+// anchor rung disagreed about one field until a restart, the exact two-readers defect
+// anchor-resolve was extracted to end. The stamp is mtime+size over the documents and their
+// directories (the directory catches a file added or removed); the stats cost microseconds against
+// the parse they guard. delivery-index keys its cache on the trunk head sha for the same reason.
+// One stated limit: an `okrs/` directory born at a location no prior read has seen is picked up on
+// the next change to a watched path or the next process, not instantly.
+const _okrCache = new Map();      // root -> { stamp, files, index }
+const _budCache = new Map();      // root -> { stamp, value }
+function statStamp(p) {
+  try { const s = fs.statSync(p); return `${s.mtimeMs}:${s.size}`; } catch { return 'absent'; }
+}
+function okrStamp(files) {
+  const dirs = [...new Set(files.map((f) => path.dirname(f)))];
+  return files.concat(dirs).map((p) => `${p}=${statStamp(p)}`).join('|');
+}
 function okrIndexFor(root) {
-  if (!_okrCache.has(root)) _okrCache.set(root, anchors.parseOkrIndex(root));
-  return _okrCache.get(root);
+  const hit = _okrCache.get(root);
+  if (hit && hit.files.length && okrStamp(hit.files) === hit.stamp) return hit.index;
+  const files = anchors.listOkrFiles(root);
+  const entry = { stamp: okrStamp(files), files, index: anchors.parseOkrIndex(root) };
+  _okrCache.set(root, entry);
+  return entry.index;
 }
 function budgetsFor(root, L) {
-  if (!_budCache.has(root)) {
-    try { _budCache.set(root, { ok: true, text: fs.readFileSync(L.budgets, 'utf8'), path: path.relative(root, L.budgets) }); }
-    catch { _budCache.set(root, { ok: false, text: '', path: path.relative(root, L.budgets) }); }
+  const stamp = statStamp(L.budgets);
+  const hit = _budCache.get(root);
+  if (!hit || hit.stamp !== stamp) {
+    let value;
+    try { value = { ok: true, text: fs.readFileSync(L.budgets, 'utf8'), path: path.relative(root, L.budgets) }; }
+    catch { value = { ok: false, text: '', path: path.relative(root, L.budgets) }; }
+    _budCache.set(root, { stamp, value });
   }
-  return _budCache.get(root);
+  return _budCache.get(root).value;
 }
 
 /*
@@ -105,18 +130,31 @@ function isBuildPath(p, lane) {
 }
 
 // ── Frontmatter ────────────────────────────────────────────────────────────────────────────────
-// The LEADING block only — body text must never be able to fake a declaration. Mirrors
-// workspace/lib/file-mode-parse.js and kit/scripts/metrics.py, plus the surrounding-quote strip the
-// bash gate does, so all four readers agree on what a record declared.
+// The LEADING block only — body text must never be able to fake a declaration. The closing ---
+// fence is TERMINAL, never skipped: the fence used to be stepped over, so a key-shaped FIRST body
+// line was absorbed into the block and could fake a declaration at the fence boundary (the one
+// shape the gamma prose-then-keys fixture never exercised). Fenceless files keep parsing from line
+// 1 and stop at the first non-key line — the kit's smoke fixtures carry no fences and must keep
+// parsing. Mirrors workspace/lib/file-mode-parse.js, kit/scripts/metrics.py and the two bash gates'
+// readers — first value wins, one pair of surrounding double quotes stripped — so all the readers
+// agree on what a record declared (kit/fixtures/test_parsers.py + workspace/fixture-parity.test.mjs
+// hold the agreement).
 function parseLeadingFrontmatter(text) {
   const fm = {};
+  let fenceOpen = false;
   for (const line of String(text == null ? '' : text).split('\n')) {
+    if (line.startsWith('---')) {
+      // Only the FIRST ---, before any key, opens the block; every later --- ends it.
+      if (fenceOpen || Object.keys(fm).length) break;
+      fenceOpen = true;
+      continue;
+    }
     const m = line.match(/^([a-z_]+):\s*(.*?)\s*$/);
     if (m) {
       if (!(m[1] in fm)) fm[m[1]] = m[2].replace(/^"(.*)"$/s, '$1');
       continue;
     }
-    if (line.trim() && !line.startsWith('---')) break;
+    if (line.trim()) break;
   }
   return fm;
 }
@@ -136,23 +174,32 @@ function readFrontmatter(file) {
  * changed return type, because every existing call site wants the rows and only the sweep wants the
  * damage. Changing the shape would have made ~six callers handle a case none of them can act on.
  */
+// The implementation lives in scripts/read-jsonl.js now — this contract became the shared one after
+// six hand-rolled readers each re-decided the torn-line question (and two got it wrong). The thin
+// wrapper keeps this file's call sites and the out-of-band defects channel unchanged.
+const jsonl = require('./read-jsonl');
 function readJsonl(file, defects) {
-  let text;
-  try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
-  const out = [];
-  const lines = text.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    const t = lines[i].trim();
-    if (!t) continue;
-    try { out.push(JSON.parse(t)); }
-    catch (e) {
-      // Dropped, never guessed — and now said out loud to anyone who asked to hear it.
-      if (Array.isArray(defects)) {
-        defects.push({ file, line: i + 1, reason: String((e && e.message) || 'not valid JSON').slice(0, 120), text: t.slice(0, 120) });
-      }
-    }
-  }
-  return out;
+  const r = jsonl.readJsonl(file);
+  // Dropped, never guessed — and said out loud to anyone who asked to hear it.
+  if (Array.isArray(defects)) defects.push(...r.defects);
+  return r.rows;
+}
+
+// The ledgers are read once per VERSION OF THE FILE, not once per initiative — the same per-root
+// rule the OKR cache above states, applied to the other four per-root inputs it was skipping. The
+// board filters ~665 KB of parsed rows once per ladder; re-reading and re-parsing the files each
+// time was ~145 MB of work per board. The stamp is mtime+size for the same reason as the OKR
+// cache's: the workspace server holds this module in-process, and a run or acceptance appended
+// between requests must be visible on the next derivation, not after a restart. Callers filter the
+// shared rows and never mutate them.
+const _ledgerCache = new Map();   // absolute path -> { stamp, rows }
+function cachedJsonl(file) {
+  const stamp = statStamp(file);
+  const hit = _ledgerCache.get(file);
+  if (hit && hit.stamp === stamp) return hit.rows;
+  const rows = readJsonl(file);
+  _ledgerCache.set(file, { stamp, rows });
+  return rows;
 }
 
 // ── Repo layout — pmos-self and the kit disagree on where state lives, so detect rather than assume
@@ -308,6 +355,39 @@ function firstAppearance(root, range, rel) {
   return range.index.has(sha) ? range.index.get(sha) : -1;
 }
 
+/*
+ * When was each path last touched, answered from the range's OWN single pass. A `git log -1
+ * --format=%ct -- <paths>` per initiative was one subprocess per board row — ~85% of the board's
+ * runtime spent re-reading history buildRange had already captured (see the single-pass note
+ * above). Built lazily, memoised on the range object, so every ladder on the board shares one map.
+ */
+function touchIndex(range) {
+  if (!range._touch) {
+    const m = new Map();
+    for (let i = 0; i < range.shas.length; i++) {
+      const t = range.dates[i];
+      if (!Number.isFinite(t)) continue;
+      for (const f of (range.changed[i] || [])) {
+        const prev = m.get(f);
+        if (prev === undefined || t > prev) m.set(f, t);
+      }
+    }
+    range._touch = m;
+  }
+  return range._touch;
+}
+
+// The set of paths git tracks, one `ls-files` shared across the board via the range object. Used
+// only where a range is EMPTY — see the note at the chgIdx computation. `null` = git could not
+// answer, which callers must treat as "fall back", never as "nothing is tracked".
+function trackedIn(root, range) {
+  if (range._tracked === undefined) {
+    const out = git(root, ['ls-files', '-z']);
+    range._tracked = out == null ? null : new Set(out.split('\0').filter(Boolean));
+  }
+  return range._tracked;
+}
+
 /*
  * The earliest position in the range at which this initiative's implementation was touched, plus a
  * count. A docs-only PR has no build commits, which makes every "before the build" rule vacuous —
@@ -510,10 +590,38 @@ function computeWorkflow(id, opts) {
   // that is true of everything, which makes the marker noise — so the board passes the GATE's range
   // separately and the marker is answered from that, or dropped when there is no such range.
   const changeRange = (opts && opts.changeRange) || (range.wholeHistory ? null : range);
-  const chgIdx = changeRange ? firstAppearance(root, changeRange, recRel) : null;
+  // A ZERO-COMMIT range contains nothing, so firstAppearance's per-path fallback — a full-history
+  // `git log --diff-filter=A`, once per initiative on any full clone whose base..HEAD is empty
+  // (HEAD level with main) — can only conclude what one shared `ls-files` already says: a tracked
+  // record predates the range (-1), an on-disk-untracked one is uncommitted (Infinity). The gate's
+  // range — non-empty — keeps the fallback, which is what tells "added before the range" from
+  // "never committed" for O1/O2.
+  const emptyChange = !!changeRange && changeRange.ok && changeRange.shas.length === 0;
+  const tracked = emptyChange ? trackedIn(root, changeRange) : null;
+  const chgIdx = !changeRange ? null
+    : tracked ? (tracked.has(recRel) ? -1 : fs.existsSync(recAbs) ? Infinity : null)
+      : firstAppearance(root, changeRange, recRel);
   const inChange = !!changeRange && chgIdx !== -1 && chgIdx !== null && chgIdx !== undefined;
   const lastActivity = (() => {
     const paths = [recRel, fm.prd_path, fm.rubric_path].filter(Boolean);
+    // The board supplies the trunk range, whose single pass already holds every commit's paths and
+    // dates — so the answer is a map lookup, not a subprocess. The trunk alone would demote
+    // branch-fresh work (`git log -1` reads from HEAD, which sees branch-local commits the trunk
+    // range excludes), so the gate's base..HEAD range is overlaid, max date per path. The
+    // subprocess survives only where no whole-history range was supplied — the single-ladder call.
+    // One deliberate difference from the per-path subprocess: a true merge lists no files in the
+    // single pass, so a merge that merely reconciles histories no longer counts as activity on the
+    // paths it carried — the date it stamped was the sync's, not the work's.
+    if (opts && opts.range && range.ok && range.wholeHistory) {
+      const trunk = touchIndex(range);
+      const branch = changeRange && changeRange.ok ? touchIndex(changeRange) : null;
+      let best = null;
+      for (const p of paths) {
+        const t = Math.max(trunk.get(p) || 0, (branch && branch.get(p)) || 0);
+        if (t > 0 && (best === null || t > best)) best = t;
+      }
+      return best;
+    }
     const out = git(root, ['log', '-1', '--format=%ct', '--', ...paths]);
     const t = out && parseInt(out.trim(), 10);
     return Number.isFinite(t) ? t : null;
@@ -589,8 +697,9 @@ function computeWorkflow(id, opts) {
   const build = buildCommits(root, range, effLane, {
     id,
     // Where this initiative's own record first appears in the range — the earliest commit that could
-    // possibly be its build. See the note in buildCommits' attribution loop.
-    recordIdx: firstAppearance(root, range, recRel),
+    // possibly be its build. Already computed above as `recIdx`, from identical arguments.
+    // See the note in buildCommits' attribution loop.
+    recordIdx: recIdx,
     deliveryIndex: opts && opts.deliveryIndex,
     declaredDelivery: fm.delivered_by,
   });
@@ -748,7 +857,7 @@ function computeWorkflow(id, opts) {
     }
   }
 
-  const runs = readJsonl(path.join(L.runsDir, L.runsFile)).filter((r) => r && r.initiative_id === id);
+  const runs = cachedJsonl(path.join(L.runsDir, L.runsFile)).filter((r) => r && r.initiative_id === id);
   const runsRel = path.relative(root, path.join(L.runsDir, L.runsFile));
 
   // ── priors ─ O7: the episodic read is CITED, and the citation is checked ─────────────────────
@@ -874,7 +983,7 @@ function computeWorkflow(id, opts) {
   steps.push(step('quality', 'quality', 'unknown', 'CI decides on the PR — this engine never claims a test result it did not run'));
 
   // ── review ─ the Review Gate's verdict, where the lane has a rubric ──────────────────────────
-  const evals = readJsonl(path.join(L.runsDir, 'evals.jsonl')).filter((e) => e && e.initiative_id === id);
+  const evals = cachedJsonl(path.join(L.runsDir, 'evals.jsonl')).filter((e) => e && e.initiative_id === id);
   {
     /* The rung reads the RUBRIC, not the lane.
      *
@@ -946,7 +1055,7 @@ function computeWorkflow(id, opts) {
   }
 
   // ── accept ─ the human PM, final and non-delegable (D12) ─────────────────────────────────────
-  const accepted = readJsonl(path.join(L.runsDir, 'acceptances.jsonl'))
+  const accepted = cachedJsonl(path.join(L.runsDir, 'acceptances.jsonl'))
     .filter((a) => a && a.initiative_id === id && a.accepted === true);
   {
     const blockers = steps.filter((s) => s.status === 'blocked').map((s) => s.key);
@@ -974,7 +1083,7 @@ function computeWorkflow(id, opts) {
   {
     const metric = String(fm.outcome_metric || '').trim();
     const horizon = String(fm.outcome_horizon || '').trim();
-    const checks = readJsonl(path.join(L.runsDir, 'outcome_checks.jsonl'))
+    const checks = cachedJsonl(path.join(L.runsDir, 'outcome_checks.jsonl'))
       .filter((c) => c && c.initiative_id === id && ['validated', 'refuted', 'inconclusive'].includes(c.disposition));
     const latest = checks.length ? checks[checks.length - 1] : null;
     const today = new Date().toISOString().slice(0, 10);

package/workspace/lib/file-mode-parse.js

@@ -12,8 +12,9 @@ const fs = require('fs');
 const reviewGate = require('./review-gate');
 
 // The LEADING YAML-ish frontmatter block ONLY — body text must never be able to fake a declaration.
-// Mirrors metrics.py exactly: `key: value` lines (first value wins), `---` fences and blank lines are
-// skipped, and the FIRST non-frontmatter, non-fence, non-blank line ends the block.
+// Mirrors metrics.py and scripts/workflow-state.js exactly: `key: value` lines (first value wins,
+// ONE pair of surrounding double quotes stripped), blank lines are skipped, the closing `---` fence
+// is TERMINAL, and in a fenceless file the first non-key line ends the block.
 //
 // The value group is `(.*?)`, NOT `(.+?)`. A key written bare — `prd_path:` with nothing after it —
 // is legal YAML for a null value, and 30 of the 136 records in planning/initiatives/ are written
@@ -25,12 +26,26 @@ const reviewGate = require('./review-gate');
 // existed to prove the two agreed — which they did, on being wrong, for as long as the fixture only
 // ever compared them to each other. scripts/workflow-state.js:105 was the one correct parser and was
 // compared against nothing. The fixture now asserts VALUES; see epsilon-empty-value.md.
+//
+// Two later divergences closed the same way, with fixtures pinning each:
+//   * the closing fence used to be SKIPPED, not terminal, so a key-shaped first body line was
+//     absorbed into the block — a fake the gamma fixture (fakes below a prose line) never caught.
+//     See zeta-fence-fake.md.
+//   * this parser kept surrounding quotes while workflow-state.js stripped them, so the same record
+//     spelled its title two ways in one UI. See eta-quoted-value.md.
 function parseLeadingFrontmatter(text) {
   const fm = {};
+  let fenceOpen = false;
   for (const line of String(text == null ? '' : text).split('\n')) {
+    if (line.startsWith('---')) {
+      // Only the FIRST ---, before any key, opens the block; every later --- ends it.
+      if (fenceOpen || Object.keys(fm).length) break;
+      fenceOpen = true;
+      continue;
+    }
     const m = line.match(/^([a-z_]+):\s*(.*?)\s*$/);
-    if (m) { if (!(m[1] in fm)) fm[m[1]] = m[2]; continue; }
-    if (line.trim() && !line.startsWith('---')) break;
+    if (m) { if (!(m[1] in fm)) fm[m[1]] = m[2].replace(/^"(.*)"$/s, '$1'); continue; }
+    if (line.trim()) break;
   }
   return fm;
 }

package/workspace/lib/tree-share.js

@@ -193,6 +193,73 @@ function describeTenant(row, writerId) {
   };
 }
 
+/* ── `end it`: what a click may and may not claim ──────────────────────────────────────────────
+ *
+ * The chooser's one destructive action used to be a discarded return value:
+ *
+ *     if (termMod && typeof termMod.killSession === 'function') termMod.killSession(p.id);
+ *     setState({ endConfirm: null });
+ *
+ * Three paths reach that `setState` having sent nothing — `termMod` still null from its dynamic
+ * import, `killSession`'s own `FIXTURE || !id` guard, and a socket that is not open. The third is
+ * the one an ordinary PM meets: in a fresh window with no terminal tab, the chooser is populated
+ * over HTTP while the terminal WebSocket has never been opened. The list is correct, the button is
+ * live, the confirm arms, the second click disarms — and the session keeps running.
+ *
+ * WHY THE DECISION LIVES HERE AND NOT IN THE CLICK HANDLER. The handler is browser UI, and this
+ * repo's browser suites CANNOT FAIL A BUILD: workspace-ci.yml runs them, but under
+ * `continue-on-error: true`, staged non-blocking since the day they were first wired up. So a test
+ * written beside the button would run, would report, and would be swallowed — which is worse than
+ * not running, because the summary shows a suite executing. Measured while this was being written:
+ * pm-tabs-test.js is 118/120 ON MAIN and has been, with nothing blocked and nobody told.
+ *
+ * This module is a UMD that `npm test` — the step that DOES gate — already requires, so the
+ * decision is asserted where a regression fails the build rather than merely prints.
+ *
+ * IT TAKES FACTS, NOT OBJECTS. `hasModule` and `socketOpen` are booleans the caller reads off its
+ * own world. A function that reached for `termMod` itself would be untestable for exactly the
+ * reason the button was.
+ */
+
+/** Every reason an end cannot be sent, with the sentence the PM sees. One place, so a new reason is
+ *  a row rather than a new `else` in a click handler. */
+const END_REFUSALS = Object.freeze({
+  'no-id': 'this session has no id, so there is nothing to end',
+  'no-module': 'the terminal is still loading — nothing can be sent yet, so nothing was',
+  'no-socket': 'the terminal connection is not open, so the request was not sent. Open a terminal tab first.',
+  fixture: 'fixture mode — no session is really running, so nothing was ended',
+});
+
+/**
+ * Decide what a click on `end it` may do, and what it may claim afterwards.
+ *
+ * @param {object} env
+ * @param {string|null} env.id          the session to end
+ * @param {boolean} env.hasModule       the terminal module resolved and exposes `killSession`
+ * @param {boolean} env.socketOpen      the terminal WebSocket is open (`readyState === 1`)
+ * @param {boolean} [env.fixture]       fixture mode — nothing is really running
+ * @returns {{send: boolean, code: string|null, why: string|null, claim: string}}
+ *
+ * `claim` is the load-bearing field and the reason this returns an object rather than a boolean.
+ * When `send` is true the honest claim is **`asked`**, never `ended`: all the page can know is that
+ * a frame was written to a socket. Whether the session died is the server's to report, and the row
+ * leaving the list is what says so. A destructive control may not report an outcome it has not
+ * observed — the disarm was being read as that outcome, which is the second half of this defect.
+ *
+ * `disarm` is deliberately NOT a field. A refused end must leave the confirm armed, because
+ * re-arming is the only signal the PM gets that nothing happened; the caller derives that from
+ * `send` and there is no separate flag to set inconsistently.
+ */
+function endAttempt(env) {
+  const e = env || {};
+  const refuse = (code) => ({ send: false, code, why: END_REFUSALS[code], claim: 'nothing' });
+  if (e.fixture) return refuse('fixture');
+  if (typeof e.id !== 'string' || !e.id) return refuse('no-id');
+  if (!e.hasModule) return refuse('no-module');
+  if (!e.socketOpen) return refuse('no-socket');
+  return { send: true, code: null, why: null, claim: 'asked' };
+}
+
 /**
  * The whole answer to "you are about to start a session in a tree that is already busy".
  *
@@ -297,5 +364,6 @@ function joinNotices(...parts) {
 }
 
 return { isLive, coTenants, writerOf, roleOf, coTenancyNotice, paneAdvisory, joinNotices,
-  nameList, statedList, ago, endRisk, describeTenant, coTenancyReport, ADVISORY_ROWS };
+  nameList, statedList, ago, endRisk, describeTenant, coTenancyReport, ADVISORY_ROWS,
+  endAttempt, END_REFUSALS };
 });

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.33.0",
+  "version": "0.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.33.0",
+      "version": "0.36.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/board-read.js

@@ -0,0 +1,38 @@
+/* pm/board-read.js — the board, read ONE way.
+ *
+ * Four panels (panel-initiatives, panel-detail, panel-tabs, modes) render from the same three
+ * facts — which board is published, which records back it, which repository is showing — and each
+ * carried its own copy of the derivation: four chances to disagree about one fact, the exact class
+ * of bug the panels' own comments guard against. The byte-identical trio lives here.
+ *
+ * What deliberately does NOT live here: `repoOf` (panel-detail) falls back to `currentProduct()`
+ * while `slugProductOf` (panel-tabs) leaves an unknown slug undefined — `visibleTabs` reads
+ * undefined as "visible everywhere" and `openDoc` stamps the current repository precisely because
+ * of that difference. Two answers on purpose, not one answer drifted.
+ *
+ * The seed board is reachable ONLY in fixture mode. In normal mode an unpublished board is an
+ * EMPTY board — never the seed data: fixture rows rendering in the real app is "the beautiful
+ * shell" the PRD names as a failure mode.
+ */
+
+import { state, FIXTURE } from './state.js';
+import * as FX from './fixture.js';
+
+/** The published board, else the fixture seed — else an EMPTY board, never the seed. */
+export const boardOf = () =>
+  (state.board && typeof state.board === 'object' ? state.board : (FIXTURE ? FX.ALLGROUPS : {}));
+
+/** Every initiative record: the board's own records, with user-filed ones layered on. */
+export function records() {
+  const base = state.records && typeof state.records === 'object'
+    ? state.records
+    : (FIXTURE ? FX.DATA : {});
+  return { ...base, ...state.userInits };
+}
+
+/** The repository whose board is showing (prototype line 1395). */
+export function currentProduct() {
+  if (state.product) return state.product;
+  const keys = Object.keys(boardOf());
+  return keys.length ? keys[0] : 'workspace';
+}

package/workspace/public/pm/data.js

@@ -706,6 +706,101 @@ function currentProductName() {
   return productOrder[0] || null;
 }
 
+/* ── the Focus queue ─────────────────────────────────────────────────────────────────────────
+ * `/api/console?name=focus` is cross-product (the server accepts and ignores `ws`) and it runs the
+ * board and ladder derivations for every registered workspace — a cold derive the boot path
+ * deliberately avoids (see `lightRecord`). So it is fetched LAZILY, on entry to focus mode, never
+ * at load.
+ *
+ * The server's view (lib/focus.js buildFocus) is `{queue, handoffs, delegated, upkeep, badge, …}`;
+ * modes.js renders the fixture rows' shape `{first, waiting, syn, saw}`. The reshape happens here
+ * — one adapter, not a second renderer — and a failed read is published as `{readError}`, which
+ * the mode renders as a failed read, never as "a successful read of nothing".
+ */
+
+/** One focus row in the shape the mode's queue renderer reads. The `read:` label is the caller's
+ * to add (lib/focus.js R4) — the server's string is the content after it. */
+function focusRow(r) {
+  return {
+    n: r.rank == null ? '' : String(r.rank),
+    slug: r.subject || '',
+    // `productName` is the board's own key (the repo name data.js registered), which is what
+    // `jump` needs; `product` is the server's repo-key path and matches no board.
+    prod2: r.productName || '',
+    why: r.why || '',
+    read: r.read ? 'read: ' + r.read : '',
+  };
+}
+
+/** The server's focus view, reshaped to what focusList renders. Every row is the payload's — no
+ * fixture constant is reachable from here. */
+function focusFrom(view) {
+  const h = view.handoffs || {};
+  const d = view.delegated || {};
+  const u = view.upkeep || {};
+
+  const syn = [];
+  for (const s of d.running || []) {
+    syn.push({
+      t: (s.name || s.id) + ' · ' + (s.word || s.shown) + (s.productName ? ' — ' + s.productName : ''),
+      hasBtn: false,
+    });
+  }
+  /* `starts` are the engine's own delegate OFFERS. They render as rows, not buttons: this surface
+   * has no runner that can feed `initialInput` into a spawn, and a ▶ button PMOS cannot honour is
+   * worse than no button (the server's own starts_note rule). */
+  for (const s of d.starts || []) {
+    syn.push({ t: (s.initiative || '') + ' — ' + (s.action || s.skill || ''), hasBtn: false });
+  }
+
+  const saw = [];
+  if (u.memory && u.memory.heading) {
+    saw.push({ t: u.memory.heading + ' — ' + (u.memory.body || u.memory.state || '') });
+  }
+  const bud = u.budgets || {};
+  if (bud.state === 'error') {
+    saw.push({ t: 'health budgets — read failed: ' + (bud.error || 'no reason given') });
+  }
+  for (const r of bud.rows || []) {
+    saw.push({
+      t: r.id + ' — cap ' + (r.cap || 'not declared') + ' · ' + (r.total || 0)
+        + ' anchored initiative' + (r.total === 1 ? '' : 's'),
+    });
+  }
+  // The server's caveat travels with the counts it qualifies: without it the totals above read as
+  // the cap test, which is exactly the claim the view refuses to make.
+  if ((bud.rows || []).length && bud.caveat) saw.push({ t: bud.caveat });
+
+  return {
+    first: (view.queue || []).map(focusRow),
+    waiting: (h.items || []).map(focusRow),
+    // The handoffs body for a tracker that is NOT CONNECTED — a different sentence from an empty
+    // list, rendered by the mode in place of the calm empty line.
+    waitingNote: (h.items || []).length ? null : (h.body || null),
+    syn,
+    saw,
+  };
+}
+
+let focusInFlight = false;
+
+async function loadFocus() {
+  if (FIXTURE || focusInFlight) return;
+  focusInFlight = true;
+  // The in-flight read is STATED. With nothing published yet, the mode would otherwise render its
+  // calm empty line — a claim of a successful read of nothing while the read is still out. A
+  // usable earlier payload stays on screen for the refresh instead.
+  if (!state.focus || state.focus.readError) setState({ focus: { reading: true } });
+  try {
+    const view = await getJson('/api/console', { name: 'focus' });
+    setState({
+      focus: view && view.ok !== false
+        ? focusFrom(view)
+        : { readError: (view && view.error) || 'the focus queue could not be read' },
+    });
+  } finally { focusInFlight = false; }
+}
+
 /* ── sessions ───────────────────────────────────────────────────────────────────────────────
  * Polled rather than pushed. The WebSocket that carries `sessions` frames belongs to panel 4's
  * terminal module, which owns the attach/input protocol; opening a SECOND socket here to read a
@@ -1214,7 +1309,7 @@ export function runningCount(s) {
  * newly selected initiative, and a repaint when it lands.
  */
 if (!FIXTURE) {
-  let lastSel = null, lastProduct = null;
+  let lastSel = null, lastProduct = null, lastMode = null;
   subscribe(() => {
     if (state.product !== lastProduct) {
       lastProduct = state.product;
@@ -1222,6 +1317,12 @@ if (!FIXTURE) {
       if (p && p.ws && state.wsId !== p.ws) setState({ wsId: p.ws });
       if (p && !p.board) loadInitiatives(state.product);
     }
+    // The focus view is fetched on ENTRY to focus mode, and re-fetched on every re-entry — the
+    // queue is a statement about now, and the mode switch is the moment the PM asks for it.
+    if (state.mode !== lastMode) {
+      lastMode = state.mode;
+      if (state.mode === 'focus') loadFocus();
+    }
     const sel = state.sel;
     if (sel && sel !== lastSel) {
       lastSel = sel;