create-pmos 0.37.0 → 0.38.1

package/workspace/server.js

@@ -71,6 +71,10 @@ const rateLimit = require('./lib/rate-limit');         // per-connection token b
 const consoleState = require('./lib/console-state');   // read-only console surfaces over file-mode state (D64 B)
 const boardCache = require('./lib/board-cache');   // the workflow board, cached + derived off the event loop (R4)
 const fmParse = require('./lib/file-mode-parse');      // canonical file-mode parsers, shared with metrics.py (D64 D)
+const skillsReg = require('./lib/skills-registry');     // discovered and generated skills: quarantine, provenance, local approval (D76)
+const modelLib = require('./lib/models');               // tier routing — one code path, shared with the agents' CLI (D75)
+const memoryLib = require('./lib/memory');             // curated repository memory — one ledger code path, shared with the agents' CLI (D72)
+const syncLib = require('./lib/sync');                 // press-only fetch / integrate / commit records / push (D70)
 const gitInfo = require('./lib/git-info');             // read-mostly branch awareness + select/create at session start
 const startPolicy = require('./lib/start-policy');     // ONE stated rule for where a session starts (repo-first R1/R3)
 const treeShare = require('./lib/tree-share');         // who shares a working tree, and who is DECLARED to be driving it
@@ -112,6 +116,7 @@ const HOME_ENABLED = EMBEDDED_SELF || (!!process.env.PMOS_SELF_ROOT && dirExists
 const PUB = path.join(__dirname, 'public');
 const PM_DIR = path.join(PUB, 'pm');   // the four-panel front end — served as a directory, guarded below
 const XROOT = path.join(__dirname, 'node_modules', '@xterm');
+const APP_VERSION = (() => { try { return require('./package.json').version || null; } catch { return null; } })();
 // ── WHERE THE PM'S RUNTIME STATE LIVES (see lib/state-root.js for the whole argument). ─────────
 // It is NOT `workspace/state/` any more. That directory is inside the application directory the
 // test suite runs from, which put the PM's live sessions, workspace registry and authored skills
@@ -355,7 +360,7 @@ function loadWorkspaces() {
       if (!w || !w.root) continue;
       const root = path.resolve(w.root);
       if (!isDir(root)) continue;                       // a moved/deleted repo drops out quietly
-      workspaces.set(wsId(root), { id: wsId(root), name: w.name || path.basename(root), root, addedAt: w.addedAt || nowISO() });
+      workspaces.set(wsId(root), { id: wsId(root), name: w.name || path.basename(root), root, addedAt: w.addedAt || nowISO(), ...(w.label ? { label: String(w.label) } : {}) });
     }
   }
 }
@@ -378,13 +383,49 @@ function registerWorkspace(root, name) {
 }
 // Forgetting a workspace never touches the repo — it only stops hosting it here. Blocked
 // while it still owns sessions, so scrollback is never orphaned by a click.
-function forgetWorkspace(id) {
+/**
+ * Why a workspace cannot be forgotten, or null when it can. The three causes used to share one
+ * message ("unknown workspace, the home workspace, or it still owns sessions"), which told the PM
+ * nothing they could act on (overhaul-r1 R3.3). Sessions are NAMED, live or exited, because an
+ * exited session still belongs to the row and would re-register it on restart (~recovery).
+ */
+function forgetBlocker(id) {
   const w = workspaces.get(id);
-  if (!w || (HOME_ENABLED && w.root === SELF_ROOT)) return false;
-  if ([...sessions.values()].some((s) => s.ws === id)) return false;
+  if (!w) return { reason: 'unknown', error: 'unknown repository — it may already have been removed' };
+  if (HOME_ENABLED && w.root === SELF_ROOT) return { reason: 'home', error: `“${w.name}” is the home workspace and cannot be removed` };
+  const owned = [...sessions.values()].filter((s) => s.ws === id);
+  if (owned.length) {
+    const names = owned.map((s) => s.name || s.id);
+    return { reason: 'sessions', sessions: names,
+      error: `${owned.length} session${owned.length === 1 ? '' : 's'} still use${owned.length === 1 ? 's' : ''} “${w.name}”: ${names.join(', ')} — close or remove ${owned.length === 1 ? 'it' : 'them'} first` };
+  }
+  return null;
+}
+function forgetWorkspace(id) {
+  if (forgetBlocker(id)) return false;
   workspaces.delete(id); saveWorkspaces(); pushWorkspaces();
   return true;
 }
+/**
+ * Remove a REPOSITORY: its row and every linked-worktree row of the same repo (overhaul-r1 R3.2).
+ * All-or-nothing — if any row is blocked, nothing is forgotten and every blocker is reported. Never
+ * deletes a folder; reclaiming a worktree's folder stays with /api/git/worktrees/remove.
+ */
+function forgetRepository(id) {
+  const w = workspaces.get(id);
+  if (!w) return { ok: false, ...forgetBlocker(id) };
+  const fam = treeFamily(w);
+  const blocked = fam.map((x) => ({ x, b: forgetBlocker(x.id) })).filter((y) => y.b);
+  if (blocked.length) {
+    const sessionsNamed = blocked.flatMap((y) => y.b.sessions || []);
+    const first = blocked[0].b;
+    return { ok: false, reason: first.reason, sessions: sessionsNamed.length ? sessionsNamed : undefined,
+      error: blocked.map((y) => y.b.error).join('; ') };
+  }
+  for (const x of fam) workspaces.delete(x.id);
+  saveWorkspaces(); pushWorkspaces();
+  return { ok: true, removed: fam.map((x) => x.id) };
+}
 // The home is SELF_ROOT when enabled; otherwise (installed copy, no launcher env) there is no
 // privileged home, so an unresolved ws id falls back to the first registered repo rather than
 // resolving to the package dir.
@@ -501,6 +542,11 @@ function treeWriter(tree) {
  * definition looking at and which persists in the session record. Every new session, until the two
  * directories are resolved, because a notice that shows once is a notice that is missed once.
  */
+// D75 — say which model was applied, in the pane's own record, when one was asked for. Silent for 'not asked'.
+function announceModel(s) {
+  if (!s.model || s.model.state === 'not-asked') return;
+  appendBuf(s, `\x1b[38;5;244mpmos: ${modelLib.line(s.model)}\x1b[0m\r\n`);
+}
 function announceStateHealth(s) {
   const h = stateHealthNow();
   if (h.ok) return;
@@ -542,7 +588,7 @@ function wsList() {
   return [...workspaces.values()].map((w) => {
     const rid = repoIdentity(w.root);
     return {
-      id: w.id, name: w.name, root: w.root, home: HOME_ENABLED && w.root === SELF_ROOT,
+      id: w.id, name: w.name, label: w.label || null, root: w.root, home: HOME_ENABLED && w.root === SELF_ROOT,
       shape: wsShape(w.root), addedAt: w.addedAt,
       sessions: [...sessions.values()].filter((s) => s.ws === w.id).length,
       // the repository this working tree belongs to, and the branch it is on. `branch_code`
@@ -832,7 +878,7 @@ const SEARCH_LIMIT_DEFAULT = 40;
 const SEARCH_LIMIT_MAX = 200;
 const SEARCH_INDEX_TTL_MS = 4000;        // one word of typing costs one walk, not one per keystroke
 const SEARCH_SNIPPET = 160;
-const SEARCH_OPENABLE = new Set(['markdown', 'text', 'html']);   // what /api/doc will serve
+const SEARCH_OPENABLE = new Set(['markdown', 'text', 'html', 'pdf', 'sheet']);   // what /api/doc (or /api/asset, for pdf) will serve
 const searchIndexCache = new Map();      // root -> { at, files, truncated, scanned }
 
 /** Every file under `root`, flat and repo-relative, cached for SEARCH_INDEX_TTL_MS. */
@@ -949,6 +995,7 @@ function searchWorkspace(root, query, limit) {
        * cannot click into an unknown. */
       const st = fs.statSync(path.join(root, rel));
       if (!st.isFile()) return false;
+      if (['pdf', 'sheet'].includes(preview.previewKind(rel))) return st.size > 0;   // served by /api/asset, never read as text
       /* Past the byte budget we do not READ the file — but "we did not look" is not "the reader
        * refuses it". Returning false there swapped one false label for its opposite: a legitimate
        * 316 KB markdown doc reported openable:false while /api/doc served it 200 with 324,017 bytes.
@@ -977,7 +1024,7 @@ function searchWorkspace(root, query, limit) {
   if (overflow) contentCut = true;
   if (!overflow) {
     for (const f of idx.files) {
-      if (seen.has(f.path) || !SEARCH_OPENABLE.has(f.kind)) continue;
+      if (seen.has(f.path) || !SEARCH_OPENABLE.has(f.kind) || f.kind === 'pdf' || f.kind === 'sheet') continue;   // a PDF body is not text
       if (read >= SEARCH_CONTENT_FILES) { contentCut = true; break; }
       const full = path.join(root, f.path);
       let st;
@@ -1015,6 +1062,86 @@ function searchWorkspace(root, query, limit) {
   };
 }
 
+/**
+ * Every registered tree of the repository `w` belongs to — its LINES OF WORK (overhaul-r1 R1).
+ * Derived per call from `repo_key`, the same identity `wsList()` publishes and the client folds
+ * by, so the registry gains no parent pointer and there is still one source of truth. The main
+ * tree (the one whose root IS the repo key) comes first; the rest keep registry order. A folder
+ * with no git is a family of one, which is the truth.
+ */
+function treeFamily(w) {
+  if (!w) return [];
+  const key = repoIdentity(w.root).key;
+  const fam = [...workspaces.values()].filter((x) => x.id === w.id || repoIdentity(x.root).key === key);
+  fam.sort((a, b) => (b.root === key) - (a.root === key));
+  return fam;
+}
+
+/** Content identity for the merge — full-body sha1, only within the content budget. A file past
+ * the budget is NOT compared, so it is never merged on a guess: it stays one row per tree. */
+function contentDigest(root, rel) {
+  try {
+    const full = path.join(root, rel);
+    const st = fs.statSync(full);
+    if (!st.isFile() || st.size > SEARCH_CONTENT_BYTES) return null;
+    return crypto.createHash('sha1').update(fs.readFileSync(full)).digest('hex');
+  } catch { return null; }
+}
+
+/**
+ * Search every line of work of a repository (overhaul-r1 R1.1–R1.5). Each hit carries the `ws` and
+ * `branch` of the tree it came from, plus `branches` — every tree that holds the same path with
+ * byte-identical content, which is then listed ONCE (PM choice, 2026-10-01). A path that differs
+ * between trees, or exists on only some, is one hit per distinct tree. Walk bounds stay per tree
+ * and are reported per tree in `trees[]`, so a capped walk on one branch cannot read as complete;
+ * the top-level flags are the OR across trees. `only` narrows the search to one tree.
+ */
+function searchFamily(w, query, limit, only) {
+  let fam = treeFamily(w);
+  if (only) fam = fam.filter((x) => x.id === only);
+  if (!fam.length) fam = [w];
+  const branchOf = (x) => repoIdentity(x.root).branch || null;
+  const per = fam.map((x) => ({ x, branch: branchOf(x), r: searchWorkspace(x.root, query, limit) }));
+  const first = per[0].r;
+  const cap = first.limit;
+  const groups = new Map();            // path -> [{hit, x, branch, digest}]
+  for (const t of per) {
+    for (const h of t.r.hits || []) {
+      if (!groups.has(h.path)) groups.set(h.path, []);
+      groups.get(h.path).push({ h, x: t.x, branch: t.branch });
+    }
+  }
+  const hits = [];
+  for (const list of groups.values()) {
+    if (list.length === 1) {
+      const e = list[0];
+      hits.push({ ...e.h, ws: e.x.id, branch: e.branch, branches: [e.branch] });
+      continue;
+    }
+    const buckets = new Map();          // digest (or a per-tree token when uncomparable) -> entries
+    for (const e of list) {
+      const d = contentDigest(e.x.root, e.h.path) || ('uncompared:' + e.x.id);
+      if (!buckets.has(d)) buckets.set(d, []);
+      buckets.get(d).push(e);
+    }
+    for (const b of buckets.values()) {
+      const e = b[0];
+      hits.push({ ...e.h, ws: e.x.id, branch: e.branch, branches: b.map((y) => y.branch) });
+    }
+  }
+  const overflow = hits.length > cap;
+  return {
+    ok: per.every((t) => t.r.ok !== false), q: first.q, limit: cap,
+    hits: hits.slice(0, cap),
+    truncated: overflow || per.some((t) => t.r.truncated),
+    content_truncated: per.some((t) => t.r.content_truncated),
+    scanned: per.reduce((n, t) => n + (t.r.scanned || 0), 0),
+    content_scanned: per.reduce((n, t) => n + (t.r.content_scanned || 0), 0),
+    trees: per.map((t) => ({ ws: t.x.id, branch: t.branch, main: t.x.root === repoIdentity(w.root).key,
+      truncated: !!t.r.truncated, content_truncated: !!t.r.content_truncated, scanned: t.r.scanned || 0 })),
+  };
+}
+
 // Serve a TEXTUAL document — markdown (incl. .skill), plain-text/config source, or HTML source —
 // per-workspace-guarded. Images are NOT served here (they stream through /api/asset); anything
 // non-textual returns null so the reader shows it inert. A NUL byte ⇒ binary masquerading as text
@@ -1131,8 +1258,23 @@ function parseHead(full) {
   const clean = (m) => m ? m[1].replace(/\*\*/g, '').split(/\s+[—–-]\s|\(/)[0].trim().slice(0, 48) : null;
   const kr = head.match(/^\s*[-*]?\s*parent[_-]?kr\s*:\s*(.+?)\s*$/mi);
   const lane = head.match(/^\s*[-*]?\s*lane\s*:\s*(.+?)\s*$/mi);
+  // overhaul-r2 C1 — an artifact may serve SEVERAL initiatives: `initiatives: [a, b]`,
+  // `initiative: a, b`, or a YAML list under `initiatives:`. Each named id lists the artifact; the
+  // first is also its primary owner when no `initiative_id:` is declared.
+  const also = [];
+  const multi = head.match(/^\s*initiatives?\s*:[ \t]*(.*)$/m);
+  if (multi) {
+    const inline = multi[1].replace(/^\[|\]$/g, '').trim();
+    if (inline) inline.split(',').forEach((x) => also.push(x.trim().replace(/^["']|["']$/g, '')));
+    else {
+      const after = head.slice(multi.index + multi[0].length).split('\n').slice(1);
+      for (const ln of after) { const li = /^\s+-\s*["']?([A-Za-z0-9][\w.-]*)["']?\s*$/.exec(ln); if (!li) break; also.push(li[1]); }
+    }
+  }
+  const alsoIds = [...new Set(also.filter((x) => /^[A-Za-z0-9][\w.-]*$/.test(x)))];
   return {
-    initiative: id ? id[1] : null,
+    initiative: id ? id[1] : (alsoIds[0] || null),
+    also: alsoIds,
     recordId: rid ? rid[1] : null,
     title: h1 ? h1[1].replace(/^(PRD|Eval Rubric|Design Brief)\s*:\s*/i, '').trim() : null,
     kr: clean(kr), lane: clean(lane),
@@ -1195,6 +1337,7 @@ function docMeta(root, full) {
     mtimeMs: st.mtimeMs, path: rel, name: base, role,
     // frontmatter wins; the filename convention is the fallback, never the override
     initiative: head.initiative || (role === 'record' ? head.recordId : null) || null,
+    also: role === 'record' ? [] : (head.also || []),
     stem, title: head.title || null,
     kr: head.kr || null, lane: head.lane || null,
     dest: head.dest || null,
@@ -1288,6 +1431,13 @@ function initiativeIndex(root) {
     if (!groups.has(k)) groups.set(k, { id: k, title: null, kr: null, lane: null, artifacts: [] });
     const g = groups.get(k);
     g.artifacts.push(art);
+    // overhaul-r2 C1 — listed under every OTHER initiative it names too (it does not lend them a
+    // title, an anchor or a lane: those stay the record's and its primary owner's)
+    for (const other of m.also || []) {
+      if (other === k) continue;
+      if (!groups.has(other)) groups.set(other, { id: other, title: null, kr: null, lane: null, artifacts: [] });
+      groups.get(other).artifacts.push({ ...art, shared: true });
+    }
     if (m.role === 'PRD' && m.title) g.title = m.title;      // the PRD names the initiative
     else if (!g.title && m.title) g.title = m.title;
     // The anchor and lane are the RECORD's to declare (D56/D59 — it is what the gates read); the
@@ -1314,6 +1464,17 @@ function initiativeIndex(root) {
 // groups planning/ into initiatives and carries the PMOS knowledge (okf/skills/build-skills,
 // wherever they live) + governance. Its guarantee is that it never DROPS a planning document —
 // not that it mirrors every file in the repo (the folder lens is for that).
+// R11 — rewrite a single-line `generated: {by: …, at: …}` in the LEADING frontmatter block to the PM as author.
+// Returns the text unchanged when there is no such line (never adds one, never touches a nested block).
+function stampEdit(text, at) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?=\r?\n|$)/.exec(text);
+  if (!m) return text;
+  const fm = m[1];
+  const re = /^generated:[ \t]*\{[^\n}]*\}[ \t]*$/m;
+  if (!re.test(fm)) return text;
+  const next = fm.replace(re, `generated: {by: human:wawan, at: "${at}"}`);
+  return next === fm ? text : text.replace(fm, () => next);
+}
 function library(root) {
   const shape = wsShape(root);
   const roots = libraryTree(root);
@@ -1323,7 +1484,15 @@ function library(root) {
       .map((d) => tree(root, d, {}, 0, { n: TREE_MAX_NODES }))
       .filter((t) => t.dirs.length || t.docs.length)
     : [];
-  return { shape, roots, initiatives, ungrouped, knowledge, governance: looseDocs(root) };
+  // D74/R11 — the notes PMOS and its agents write into a repository: requirement notes, report drafts and
+  // definitions, memory views (and the portfolio report at the root). Listed for ANY repository shape, because a
+  // PM repository is not a 'pmos'-shaped bundle and its notes were invisible to this lens.
+  const NOTE_DIRS = ['pmos/state/requirements', 'pmos/state/reports', 'pmos/state/memory',
+    'planning/requirements', 'planning/reports', 'planning/memory', 'reports'];
+  const notes = NOTE_DIRS.map((d) => path.join(root, ...d.split('/'))).filter((d) => isDir(d))
+    .map((d) => tree(root, d, {}, 0, { n: TREE_MAX_NODES }))
+    .filter((t) => t.dirs.length || t.docs.length);
+  return { shape, roots, initiatives, ungrouped, knowledge, notes, governance: looseDocs(root) };
 }
 
 // ── On-demand surfaces (D60 / the workspace-ondemand-surfaces PRD). ────────────────────────────
@@ -1334,7 +1503,7 @@ function library(root) {
 // client renders it; a surface that can't be produced returns ok:false and the client shows an
 // honest can't-produce state. RICE/effort/milestones/progress are NET-NEW state → emitted as null
 // ("— not tracked"), never invented (D14/D40 honesty).
-const PHASE_OF = { planning: 'plan', building: 'deliver', blocked: 'deliver', delivered: 'report', accepted: 'report', unknown: 'plan' };
+const PHASE_OF = { stopped: 'plan', planning: 'plan', building: 'deliver', blocked: 'deliver', delivered: 'report', accepted: 'report', unknown: 'plan' };
 
 // ── Delivery evidence (board-delivery-truth R-2/R-3; shared reader, workflow-status-sweep R-1). ──
 // "Has this shipped?" answered from the trunk's own history rather than from anything anyone typed.
@@ -1399,6 +1568,7 @@ function deliveryIndex(root, ids) {
  * one ordering departure, made because the alternative buries a returned initiative.)
  */
 function deriveState(ev) {
+  if (ev.stopped && !ev.accepted) return { state: 'stopped', why: `${ev.stopped.state}${ev.stopped.reason ? ` — ${ev.stopped.reason}` : ''} (lifecycle.jsonl, D70)` };
   if (ev.accepted) return { state: 'accepted', why: `accepted by the PM${ev.acceptedAt ? ` on ${String(ev.acceptedAt).slice(0, 10)}` : ''}` };
   if (ev.returned) return { state: 'blocked', why: 'the PM returned this at the Acceptance Gate' };
   if (ev.needs) return { state: 'blocked', why: `${ev.needs} open item${ev.needs > 1 ? 's' : ''} in needs.json` };
@@ -1439,6 +1609,19 @@ function readLedger(w, basename) {
   }
   return out;
 }
+// D70 — the lifecycle ledger: the latest line for an initiative wins; `active` reopens. The same rule
+// as scripts/workflow-state.js#readLifecycle (a parity case in workspace/test.js keeps them in step).
+const syncing = new Set();   // repositories with a sync in flight — one at a time
+const STOPPED_STATES = ['closed', 'on-hold', 'cancelled'];
+function readLifecycle(w) {
+  const latest = new Map();
+  for (const r of readLedger(w, 'lifecycle.jsonl')) {
+    if (!r || typeof r.initiative_id !== 'string') continue;
+    if (r.state !== 'active' && !STOPPED_STATES.includes(r.state)) continue;
+    latest.set(r.initiative_id, { state: r.state, reason: r.reason || '', pm: r.pm || '', at: r.at || '' });
+  }
+  return latest;
+}
 function readAcceptances(w) {
   const acc = new Map();   // initiative_id -> { action, at }
   for (const r of readLedger(w, 'acceptances.jsonl')) {
@@ -1490,6 +1673,7 @@ function readRunCounts(w) {
 function surfaceInitiatives(root, w) {
   const { initiatives } = initiativeIndex(root);
   const acc = readAcceptances(w);
+  const life = readLifecycle(w);
   const runs = readRunCounts(w);
   const needsRaw = readNeeds(w) || [];
   const needsBy = new Map();
@@ -1502,6 +1686,7 @@ function surfaceInitiatives(root, w) {
     const { state, why } = deriveState({
       // readAcceptances already folds every accepting label (approve/merge/publish) into 'accept'.
       accepted: a.action === 'accept', acceptedAt: a.at,
+      stopped: (life.get(g.id) && life.get(g.id).state !== 'active') ? life.get(g.id) : null,
       returned: a.action === 'return',
       needs: needsBy.get(g.id) || 0,
       delivery: del.ok ? 'known' : 'unknown',
@@ -1515,6 +1700,7 @@ function surfaceInitiatives(root, w) {
       // the client renders `statusText`, which always names the artifact the state was read from.
       stage: null, kr: g.kr || null, lane: g.lane || null,
       accepted: state === 'accepted',
+      lifecycle: (life.get(g.id) && life.get(g.id).state !== 'active') ? life.get(g.id) : null,
       delivered: state === 'accepted' || state === 'delivered',
       delivery_evidence: deliveredBy,
       artifacts: g.artifacts.map((a2) => ({ role: a2.role, name: a2.name, path: a2.path, dest: a2.dest || null })),
@@ -1530,7 +1716,7 @@ function surfaceInitiatives(root, w) {
     initiatives: items,
     pulse: {
       total: items.length, planning: by('planning'), building: by('building'),
-      blocked: by('blocked'), delivered: by('delivered'), accepted: by('accepted'),
+      blocked: by('blocked'), delivered: by('delivered'), accepted: by('accepted'), stopped: by('stopped'),
       unknown: by('unknown'),
     },
     // R-3: a failed read is reported, never absorbed. The client renders this RED above the list
@@ -1664,6 +1850,7 @@ function surfaceSpine(root) {
 
   const budgets = new Map();       // health:<id> groups — peers of objectives (D59), not a footnote
   const unanchored = [];           // R6 — never dropped to make the tree tidy
+  const domains = new Map();       // domain:<id> groups (D67) — work that serves a domain, no OKR
 
   for (const dir of initiativeDirs(root)) {
     let files = [];
@@ -1691,6 +1878,13 @@ function surfaceSpine(root) {
         budgets.get(key).initiatives.push(rec);
         continue;
       }
+      // D67 — a domain is a peer group like a health budget: the standing goal it serves, no OKR
+      if (r.kind === 'domain' && r.status === 'resolved') {
+        const key = `domain:${r.domain}`;
+        if (!domains.has(key)) domains.set(key, { id: key, name: r.domain, goal: r.domain_goal || null, initiatives: [] });
+        domains.get(key).initiatives.push(rec);
+        continue;
+      }
       if (r.kind === 'okr' && r.status === 'resolved') {
         const kr = r.kr ? krByKey.get(`${A.objectiveId(r.objective)}::${A.krId(r.kr)}`) : null;
         if (kr) { kr.initiatives.push(rec); continue; }
@@ -1714,6 +1908,7 @@ function surfaceSpine(root) {
   return {
     objectives,
     budgets: [...budgets.values()].sort((a, b) => a.id.localeCompare(b.id)),
+    domains: [...domains.values()].sort((a, b) => a.id.localeCompare(b.id)),
     unanchored,
     unreadable: null,
     budgets_readable: !!(budgetsDoc && budgetsDoc.ok),
@@ -1759,6 +1954,9 @@ function buildSurface(name, root, w) {
 // refused the move, takes effect on the next read instead of on the next restart.
 function schedFile() { return schedStore().path; }
 const DELIV_DIR = path.join(STATE, 'deliverables');
+// D76 — the PM's LOCAL approvals of discovered skills. Runtime state on this machine, never the repository: a commit or a
+// hand-edited registry must not be able to approve a skill for the PM.
+const SKILL_APPROVALS = path.join(STATE, 'skill-approvals.jsonl');
 // Skills are file-driven (workspace-skill-authoring): built-ins ship committed under workspace/skills/,
 // user-authored ones are scaffolded into state/skills/ by the New Skill flow. There is ONE user-facing
 // concept — a skill — so the picker never exposes the internal `run`/`kind`; how a skill runs (server
@@ -1783,22 +1981,42 @@ function filingContract(w) {
 }
 // Read the skill files fresh each call so a just-created user skill appears with no restart. User dirs
 // load FIRST and built-ins LAST, so a built-in's load-bearing deterministic fast-path can't be shadowed.
-function loadTasks() {
+// D76 — `root` adds the repository's APPROVED discovered skills, loaded FIRST so the PM's own skill of the same id
+// overrides one and a built-in overrides both. Only an approved candidate whose file still hashes to what was approved
+// is ever offered; its harness is forced to an agent skill running claude.
+// The loaded skill records, each with the `file` it came from. loadTasks maps these to the task shape
+// and drops the file; the skill detail routes below need the file, so both read through here.
+function loadSkillRecords(root) {
+  const discovered = root ? skillsReg.loadApproved(root, SKILL_APPROVALS, skillStore.parseSkill).skills : [];
   return skillStore.loadSkills([
+    ...(discovered.length ? [{ skills: discovered }] : []),
     { dir: userSkillsDir(), source: 'user' },
     { dir: BUILTIN_SKILLS_DIR, source: 'builtin' },
-  ]).map(toTask);
+  ]);
 }
+function loadTasks(root) { return loadSkillRecords(root).map(toTask); }
 // Map a loaded skill to the internal task shape fireSchedule/the picker use. `kind` is derived from the
 // file's `run` and stays INTERNAL — it is never a field the PM selects.
 function toTask(s) {
   const t = { id: s.id, label: s.label, skill: s.id, kind: s.run, source: s.source,
-    description: s.description, output: s.output };
+    description: s.description, output: s.output, tier: s.tier || null };
   if (s.run === 'deterministic') t.surface = s.surface;
   else { t.agent = s.agent || 'claude'; t.prompt = s.body || null; }
   return t;
 }
-function taskById(id) { return loadTasks().find((t) => t.id === id || t.skill === id) || null; }
+function taskById(id, root) { return loadTasks(root).find((t) => t.id === id || t.skill === id) || null; }
+// D71 — the recommended schedules, one set per purpose. Times are host-local, like every schedule.
+const SEED_SETS = {
+  requirements: [{ name: 'Daily requirement gathering', skill: 'gather-requirements', cadence: 'daily', time: '07:30' }],
+  memory: [{ name: 'Weekly memory grooming', skill: 'memory-groom', cadence: 'weekly', day: 'Mon', time: '08:00' }],
+  skills: [{ name: 'Weekly skill discovery', skill: 'skill-discover', cadence: 'weekly', day: 'Wed', time: '09:00' }],
+  reports: [
+    { name: 'Daily report draft', skill: 'report-daily', cadence: 'daily', time: '17:30' },
+    { name: 'Weekly report draft', skill: 'report-weekly', cadence: 'weekly', day: 'Fri', time: '16:00' },
+    { name: 'Bi-weekly report draft', skill: 'report-biweekly', cadence: 'bi-weekly', day: 'Fri', time: '16:00' },
+    { name: 'Monthly report draft', skill: 'report-monthly', cadence: 'monthly', dayOfMonth: 1, time: '08:00' },
+  ],
+};
 function readSchedules() {
   try { const a = JSON.parse(fs.readFileSync(schedFile(), 'utf8')); return Array.isArray(a) ? a : []; } catch { return []; }
 }
@@ -1822,7 +2040,7 @@ function fireSchedule(sched) {
   const w = workspaces.get(sched.ws) || homeWorkspace();
   const root = w ? w.root : SELF_ROOT;
   // One corpus load probing both keys — taskById would re-read every .skill file per probe.
-  const tasks = loadTasks();
+  const tasks = loadTasks(root);
   const byId = (id) => tasks.find((t) => t.id === id || t.skill === id) || null;
   const task = byId(sched.task) || byId(sched.skill);
   // AGENT task — fire as a real PTY session running its skill (async; the skill files its own
@@ -1836,16 +2054,21 @@ function fireSchedule(sched) {
     // Fixing only the SCAFFOLD fixes only skills that do not exist yet, which is no help to the
     // eleven that do. `needs.json` is resolved per workspace, so this cannot be a one-off rewrite
     // of the files either — the right answer for a given fire depends on which repo it fires in.
-    const prompt = task.prompt ? skillStore.retargetFiling(task.prompt, filingContract(w)) : null;
+    let prompt = task.prompt ? skillStore.retargetFiling(task.prompt, filingContract(w)) : null;
+    // R11 — a schedule may carry the PM's own request ("a special report for the board meeting on …"). It is
+    // appended AFTER the skill body so the skill's "if they already said, do not ask again" rule applies.
+    if (prompt && sched.args) prompt += `\n\nThe PM's request for this run, given when it was scheduled (do not ask again): ${String(sched.args).replace(/\s+/g, ' ').trim()}`;
     // The schedule's recorded profile travels with the process it creates (profiles R8.3). Only an
     // AGENT-kind task has a PTY, which is why `profile_applies` is false for the skill-kind rows
     // below rather than the control simply being hidden.
     const s = spawnSession({ name: sched.name, agent: task.agent || 'claude', ws: sched.ws,
       origin: 'schedule:' + sched.id, initialInput: prompt ? prompt + '\r' : null,
-      profile: sched.profile == null ? null : sched.profile });
+      profile: sched.profile == null ? null : sched.profile,
+      // D75 — the schedule's tier, then the skill's, then the policy's route for the skill: the harness picks the model for the work.
+      modelAsk: { scheduleTier: sched.tier || null, skillTier: task.tier || null, skill: task.skill } });
     const list = readSchedules(); const cur = list.find((x) => x.id === sched.id);
     const started = s.state !== 'exited';
-    if (cur) { cur.lastRun = nowISO(); cur.lastStatus = started ? 'started' : 'fail'; cur.nextRun = scheduleLogic.nextRun(cur); writeSchedules(list); }
+    if (cur) { cur.lastRun = nowISO(); cur.lastStatus = started ? 'started' : 'fail'; cur.nextRun = scheduleLogic.nextRun(cur); if (cur.cadence === 'once') cur.enabled = false; writeSchedules(list); }
     // A run that started WITHOUT the profile it recorded is reported as such rather than as a
     // clean start: the session is real, the environment is not the one the schedule declared.
     return { ok: started, kind: 'agent', sessionId: s.id,
@@ -1884,6 +2107,12 @@ function fireSchedule(sched) {
 function checkDueSchedules() {
   let fired = 0;
   for (const s of readSchedules()) { try { if (scheduleLogic.isDue(s)) { fireSchedule(s); fired++; } } catch {} }
+  // R11 — a one-off whose moment passed while nothing was running is marked missed and off, never caught up.
+  try {
+    const list = readSchedules(); let changed = false;
+    for (const s of list) if (scheduleLogic.isMissed(s)) { s.enabled = false; s.lastStatus = 'missed'; s.nextRun = null; changed = true; }
+    if (changed) writeSchedules(list);
+  } catch {}
   return fired;
 }
 // the tick — the persistent server checks on an interval; unref'd so it never blocks exit
@@ -1906,6 +2135,9 @@ function persist(s) {
   // fact: a record persisted before profiles existed restores as "not recorded", and inventing a
   // key for the past would be a lie about it.
   if ('profile' in s) meta.profile = s.profile == null ? null : s.profile;
+  // D75 — what model was asked for and what was APPLIED. Same `in`-guard as the profile: a record from before
+  // routing existed restores as 'not recorded', and writing a key for the past would be a lie about it.
+  if ('model' in s) { meta.model = s.model; meta.modelAsk = s.modelAsk || null; }
   // WHAT THIS SESSION IS FOR, and where that came from. Same `in`-guard as `profile` above and for
   // the same reason: every session running before this field existed has no attribution, and
   // writing a key for it would turn "we were never told" into "it belongs to nothing". Both keys
@@ -2164,6 +2396,7 @@ function sessionList() {
     const hx = transcriptHarness(s);
     return {
       id: s.id, ws: s.ws, name: s.name, agent: s.agent, state: s.state, created: s.created,
+      model: 'model' in s ? s.model : null, model_line: modelLib.line('model' in s ? s.model : null),
       cwd: path.relative(s.root, s.cwd) || '.', note: s.note || '', origin: s.origin || null,
       // Derived presentation state, JOINED from both sources: the cadence clock above and the
       // transcript's answer to whose turn it is (lib/session-state). working | quiet | exited |
@@ -2610,11 +2843,13 @@ function resolveProfileForSpawn(id) {
       : `profile "${id}" is not among the descriptors in ${read.dir} — PMOS will not substitute another` };
 }
 
-function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, initiative }) {
+function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, initiative, modelAsk }) {
   const id = nextSessionId();
   const w = getWs(ws);
   const root = w ? w.root : SELF_ROOT;
   const isShell = agent === 'shell';
+  // D72 — the session reads the memory views once, at its start; rebuild them from the ledger now.
+  try { memoryLib.renderFor(root); } catch { /* memory is never a reason a session fails to start */ }
   // a scheduled run tags the session with its origin, and feeds the skill invocation as first input
   const tag = origin || null;
   const feed = (s) => { if (initialInput && s && s.pty) { try { setTimeout(() => { try { s.pty.write(initialInput); } catch {} }, 700); } catch {} } };
@@ -2632,6 +2867,25 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
   const base = { id, ws: w ? w.id : wsId(SELF_ROOT), root, name: (name && String(name).trim()) || agent, agent, origin: tag,
     profile: pres.id, profileRefusal: pres.ok ? null : pres.error };
 
+  /* WHICH MODEL (D75). Resolved once, here, with the profile, so the record can say only what was applied.
+   * Three states are kept apart — not asked, applied, and "this binary has no model control" — and a choice that
+   * cannot be honoured (a pinned review route being lowered, a value that is not a plain token, an unreadable
+   * policy) refuses BEFORE anything starts, as an unreadable profile does. */
+  const mres = modelLib.resolveForSpawn(root, agent, modelAsk);
+  if (!mres.ok) {
+    base.model = { state: 'refused', tier: null, model: null, effort: null, decidedBy: null, why: mres.error };
+    return exitedSession(base, workdir, `model choice refused — ${mres.error}`);
+  }
+  base.model = { state: mres.state, tier: mres.tier || null, model: mres.model || null, effort: mres.effort || null,
+    decidedBy: mres.decidedBy || null, why: mres.why || null };
+  base.modelAsk = modelAsk || null;
+  const launchArgs = mres.state === 'applied' ? mres.args : [];
+  if (mres.tier) {
+    const mc = modelLib.core();
+    if (mc.ok) mc.core.logDecision(root, { kind: 'spawn', session: id, agent, tier: mres.tier, model: mres.model, effort: mres.effort,
+      decidedBy: mres.decidedBy, state: mres.state, skill: (modelAsk && modelAsk.skill) || null, by: 'workspace' });
+  }
+
   /* WHAT THIS SESSION IS FOR (workspace-session-attribution R1).
    *
    * A PMOS session has never recorded which initiative it is working on — not here, not on the wire,
@@ -2665,7 +2919,8 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
     sessions.set(id, s);
     // the OVERLAY, not the merged env — the merged env is for the direct-PTY path below, which
     // really does spawn the process itself. See createTmuxSession for why the two differ.
-    if (!createTmuxSession(tname, cmd, workdir, 80, 24, profileOverlay(pres.profile))) {
+    // The launch args are plain tokens by construction (pmos-model's strict pattern), so joining them is safe.
+    if (!createTmuxSession(tname, launchArgs.length ? [cmd, ...launchArgs].join(' ') : cmd, workdir, 80, 24, profileOverlay(pres.profile))) {
       const why = `could not start a tmux session for '${cmd}'. Run \`npm run doctor\` in workspace/.`;
       s.state = 'exited'; s.tmux = null; s.note = why;
       s.buf = `\x1b[38;5;203m✗ ${why}\x1b[0m\r\n\x1b[38;5;244mFix the above, then ↻ respawn.\x1b[0m\r\n`;
@@ -2673,6 +2928,7 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
     }
     announceStateHealth(s);   // the unmigrated notice comes FIRST — it explains an empty skills list
     announceTree(s);   // before attach, so the advisory is the first line of the pane's record
+    announceModel(s);
     attachPty(s);
     feed(s);
     persist(s); pushSessions(); pushWorkspaces(); return s;
@@ -2683,7 +2939,7 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
   let p, usedCmd = cmd;
   try {
     if (isShell) { const r = spawnPty(cmd, workdir, penv); p = r.pty; usedCmd = r.cmd; }
-    else p = pty.spawn(cmd, [], { name: 'xterm-256color', cols: 80, rows: 24, cwd: workdir, env: penv });
+    else p = pty.spawn(cmd, launchArgs, { name: 'xterm-256color', cols: 80, rows: 24, cwd: workdir, env: penv });
   } catch (e) {
     return exitedSession(base, workdir, spawnFailureAdvice(e, cmd, isShell));
   }
@@ -2693,6 +2949,7 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
   sessions.set(id, s);
   announceStateHealth(s);
   announceTree(s);   // registered first: a session's co-tenancy question includes itself in the map
+  announceModel(s);
   p.onData((d) => {
     appendBuf(s, d);
     for (const c of s.clients) if (c.readyState === 1) c.send(JSON.stringify({ t: 'data', id, data: d }));
@@ -2727,7 +2984,7 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
 // A FAILED git operation in a real repo must never spawn a session on the wrong branch (rubric
 // hard floor): we return {ok:false} and spawn nothing. Kept as its own function so the
 // git-then-maybe-spawn contract is unit-testable without a WS client.
-function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate, profile, initiative }) {
+function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate, profile, initiative, modelAsk }) {
   const w = getWs(ws);
   if (!w) return { ok: false, error: 'no workspace' };
   // The profile is checked BEFORE any git operation. A composer that picked a profile PMOS cannot
@@ -2735,6 +2992,9 @@ function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate,
   // and a session that claims a profile it never got is the quietest failure this feature has.
   const pres = resolveProfileForSpawn(profile);
   if (!pres.ok) return { ok: false, error: pres.error };
+  // The model choice is checked on the same terms (D75): a refused choice starts nothing, and leaves no branch moved.
+  const mchk = modelLib.resolveForSpawn(w.root, agent || 'shell', modelAsk);
+  if (!mchk.ok) return { ok: false, error: `model choice refused — ${mchk.error}` };
   let targetWs = w.id;
   let notice = null;
   // Isolation exists to protect OTHER sessions. Alone in the working TREE there are none to
@@ -2771,7 +3031,7 @@ function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate,
       broadcast({ t: 'branch', ws: w.id, ...gitInfo.branchInfo(w.root) });   // let every client refresh the chip
     }
   }
-  const s = spawnSession({ name, agent: agent || 'shell', cwd, ws: targetWs, profile: pres.id, initiative });
+  const s = spawnSession({ name, agent: agent || 'shell', cwd, ws: targetWs, profile: pres.id, initiative, modelAsk });
   // The co-tenancy fact, on the ordinary path too. Note where this sits: OUTSIDE the `if (branch)`
   // block above. The isolate default already computes that other sessions would be disturbed — and
   // then the whole git block is skipped when no branch was picked, which is the common path and the
@@ -3435,6 +3695,143 @@ function budgetRegistryFor(root) {
 // are one product with one board, and counting them separately is what put the same initiative in
 // the queue three times. boardCache.board() ONLY (§6.8): consoleState.workflow() is ~30s and
 // synchronous, and on a request path it freezes every PTY socket for the whole half minute.
+/* ── overhaul-r4 — the portfolio, across every registered repository ───────────────────────────
+ * One entry per REPOSITORY (repo_key), never per worktree. Boards come from boardCache only — the
+ * synchronous derive freezes every PTY socket for ~30 s (board-cache.js) — so every repository
+ * carries its own as_of / stale / pending, and one that cannot be read is listed WITH its error,
+ * never dropped and never shown as empty. Grouping comes from the spine (domain › objective › KR, or
+ * a health budget), which is a cheap read of the records. */
+function repoLeads() {
+  const groups = new Map();
+  for (const t of wsList()) {
+    const key = t.repo_key || t.root;
+    if (!groups.has(key)) groups.set(key, { key, name: t.label || t.repo_name || t.name, trees: [] });
+    groups.get(key).trees.push(t);
+  }
+  return [...groups.values()].map((g) => {
+    const lead = g.trees.find((t) => path.resolve(t.root) === path.resolve(g.key)) || g.trees[0];
+    const label = (g.trees.find((t) => t.label) || {}).label;
+    return { key: g.key, name: label || g.name, ws: lead.id, root: (workspaces.get(lead.id) || lead).root, ids: new Set(g.trees.map((t) => t.id)) };
+  });
+}
+/** The hub (D-3): the registered repository whose root holds portfolio.yaml. Null when there is none. */
+function portfolioHub(leads) {
+  const hub = (leads || repoLeads()).find((r) => isDir(r.root) && fs.existsSync(path.join(r.root, 'portfolio.yaml')));
+  if (!hub) return null;
+  // `repos:` then indented `<repository name>: <domain>` lines — the only shape read, stated in the PRD
+  const map = {};
+  let inRepos = false;
+  for (const line of fs.readFileSync(path.join(hub.root, 'portfolio.yaml'), 'utf8').split('\n')) {
+    if (/^repos\s*:\s*$/.test(line)) { inRepos = true; continue; }
+    if (/^\S/.test(line)) inRepos = false;
+    const m = inRepos && /^\s+["']?([^:"']+?)["']?\s*:\s*["']?([A-Za-z0-9][\w-]*)["']?\s*$/.exec(line);
+    if (m) map[m[1].trim()] = m[2];
+  }
+  return { name: hub.name, ws: hub.ws, root: hub.root, domains: map };
+}
+function portfolio() {
+  const leads = repoLeads();
+  const hub = portfolioHub(leads);
+  const sessions = sessionList();
+  const repos = [];
+  const rows = [];
+  for (const r of leads) {
+    const board = boardCache.board(r.root);
+    let spine;
+    try { spine = surfaceSpine(r.root); }
+    catch (e) { spine = { unreadable: 'the records could not be read — ' + String((e && e.message) || 'error').slice(0, 120) }; }
+    const repoDomain = hub ? hub.domains[r.name] || null : null;
+    const entry = { name: r.name, ws: r.ws, domain: repoDomain, as_of: board.as_of || null, stale: !!board.stale,
+      pending: !!board.pending, error: board.ok === false ? board.error : (spine.unreadable || null), count: 0 };
+    repos.push(entry);
+    if (spine.unreadable) continue;
+    const group = new Map();     // initiative id -> { group, domain }
+    for (const o of spine.objectives || []) {
+      for (const k of o.krs || []) for (const i of k.initiatives || []) group.set(i.id, { group: `${o.name || o.key} › ${k.name || k.key}`, kind: 'kr', rec: i });
+      for (const i of o.direct || []) group.set(i.id, { group: o.name || o.key, kind: 'objective', rec: i });
+    }
+    for (const b of spine.budgets || []) for (const i of b.initiatives || []) group.set(i.id, { group: b.id, kind: 'health', rec: i });
+    for (const d of spine.domains || []) for (const i of d.initiatives || []) group.set(i.id, { group: `${d.id} (no OKR)`, kind: 'domain', domain: d.name, rec: i });
+    for (const i of spine.unanchored || []) group.set(i.id, { group: 'no resolvable anchor', kind: 'unanchored', rec: i });
+    const byId = new Map(((board && board.rows) || []).filter((x) => x && x.id).map((x) => [String(x.id), x]));
+    for (const [id, g] of group) {
+      const b = byId.get(id);
+      rows.push({
+        repo: r.name, ws: r.ws, id, title: (b && b.title) || g.rec.title || id, lane: (b && b.lane) || g.rec.lane || null,
+        stage: b ? b.stage : null, accepted: b ? !!b.accepted : null, next: b && b.next ? b.next.action || b.next.why || null : null,
+        blocked: b ? (b.blockers || []).length > 0 : null,
+        group: g.group, group_kind: g.kind, domain: g.domain || repoDomain,
+        sessions: sessions.filter((x) => r.ids.has(x.ws) && x.initiative === id && x.state !== 'exited').length,
+      });
+      entry.count++;
+    }
+  }
+  return { ok: true, as_of: nowISO(), hub: hub ? { name: hub.name, ws: hub.ws } : null, repos, rows };
+}
+
+/* overhaul-r4 C — a report from the portfolio aggregate, written into the HUB on a PM press only. It
+ * creates a new file (never overwrites; a numeric suffix is added) and is NOT logged as a PM edit of
+ * an existing document — that is /api/doc/save's meaning, and a generated report is not one. */
+function portfolioReport(kind, q) {
+  const pf = portfolio();
+  const hubInfo = pf.hub && workspaces.get(pf.hub.ws);
+  if (!hubInfo) return { ok: false, reason: 'no-hub', error: 'no hub repository — add a portfolio.yaml to your PM repository and register it (D-3); a report is never written to a guessed place' };
+  if (!['weekly', 'okr', 'query'].includes(kind)) return { ok: false, error: 'kind must be weekly, okr or query' };
+  const needle = String(q || '').trim().toLowerCase();
+  if (kind === 'query' && !needle) return { ok: false, error: 'a query report needs a q' };
+  let rows = pf.rows;
+  if (kind === 'query') rows = rows.filter((x) => [x.id, x.title, x.group, x.repo, x.domain].some((v) => v && String(v).toLowerCase().includes(needle)));
+  const day = nowISO().slice(0, 10);
+  const titles = { weekly: 'Weekly portfolio report', okr: 'OKR and domain progress', query: `Portfolio query — "${String(q).trim()}"` };
+  const lines = [];
+  // OKF v0.2 (D73): one key per line, nothing indented — the frontmatter readers stop at the first indented line.
+  lines.push('---', 'type: Reference', `title: "${titles[kind].replace(/"/g, "'")} — ${day}"`,
+    `description: "Portfolio aggregate across the registered repositories, written on the PM's request."`,
+    `generated: {by: process:pmos-workspace, at: "${nowISO()}"}`, 'status: stable', '---', '');
+  lines.push(`# ${titles[kind]} — ${day}`, '');
+  lines.push(`Generated by the PMOS workspace from the portfolio aggregate at ${pf.as_of}, on the PM's request. It reads every registered repository's derived board; it states what it could not read rather than leaving it out.`, '');
+  const unread = pf.repos.filter((r) => r.error || r.pending);
+  const staleR = pf.repos.filter((r) => r.stale && !r.error);
+  lines.push('## Coverage', '');
+  lines.push('| repository | domain | initiatives | board as of | state |', '|---|---|---:|---|---|');
+  for (const r of pf.repos) lines.push(`| ${r.name} | ${r.domain || '—'} | ${r.count} | ${r.as_of || '—'} | ${r.error ? 'NOT READ — ' + String(r.error).replace(/\|/g, '/').slice(0, 80) : r.pending ? 'board pending — stages not yet derived' : r.stale ? 'stale' : 'fresh'} |`);
+  lines.push('');
+  if (unread.length) lines.push(`**Not fully read:** ${unread.map((r) => r.name).join(', ')}. Their initiatives are missing or shown without a stage.`, '');
+  if (staleR.length) lines.push(`**Stale boards:** ${staleR.map((r) => r.name).join(', ')} (refreshing in the background).`, '');
+  const cell = (v) => String(v == null ? '—' : v).replace(/\|/g, '/').replace(/\n/g, ' ').slice(0, 140);
+  const table = (list) => {
+    const out = ['| initiative | repository | lane | stage | next |', '|---|---|---|---|---|'];
+    for (const x of list) out.push(`| \`${x.id}\` — ${cell(x.title)} | ${x.repo} | ${x.lane || '—'} | ${x.accepted ? 'accepted' : (x.stage || 'not derived')}${x.blocked ? ' ✗' : ''} | ${cell(x.next)} |`);
+    return out;
+  };
+  const groupBy = (list, keyFn) => { const m = new Map(); for (const x of list) { const k = keyFn(x); if (!m.has(k)) m.set(k, []); m.get(k).push(x); } return [...m.entries()].sort((a, b) => a[0].localeCompare(b[0])); };
+  if (kind === 'okr') {
+    for (const [dom, list] of groupBy(rows, (x) => x.domain || '(no domain declared)')) {
+      lines.push(`## Domain: ${dom}`, '');
+      for (const [grp, l2] of groupBy(list, (x) => x.group)) {
+        const done = l2.filter((x) => x.accepted).length;
+        lines.push(`### ${grp} — ${done} of ${l2.length} accepted`, '', ...table(l2), '');
+      }
+    }
+  } else {
+    const waiting = rows.filter((x) => x.blocked && !x.accepted);
+    lines.push('## Needs you', '');
+    if (waiting.length) lines.push(...table(waiting), ''); else lines.push('Nothing derived as blocked across the repositories that were read.', '');
+    for (const [dom, list] of groupBy(rows, (x) => x.domain || '(no domain declared)')) {
+      lines.push(`## Domain: ${dom}`, '');
+      for (const [repo, l2] of groupBy(list, (x) => x.repo)) lines.push(`### ${repo}`, '', ...table(l2), '');
+    }
+    if (!rows.length) lines.push('No initiative matched.', '');
+  }
+  const slug = kind === 'query' ? '-' + needle.replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 40) : '';
+  const dir = path.join(hubInfo.root, 'reports');
+  fs.mkdirSync(dir, { recursive: true });
+  let rel = `reports/${day}-${kind}${slug}.md`;
+  for (let n = 2; fs.existsSync(path.join(hubInfo.root, rel)); n++) rel = `reports/${day}-${kind}${slug}-${n}.md`;
+  fs.writeFileSync(path.join(hubInfo.root, rel), lines.join('\n') + '\n', { flag: 'wx' });
+  return { ok: true, ws: hubInfo.id, path: rel, rows: rows.length, unread: unread.map((r) => r.name) };
+}
+
 function focusProducts() {
   const trees = wsList();
   const groups = new Map();   // repo_key -> { id, name, trees[] }
@@ -3544,7 +3941,8 @@ function buildConsole(name, w, root, params) {
     if (s.unreadable) return { ok: false, error: s.unreadable };
     const placed = s.objectives.reduce((n, o) =>
       n + o.krs.reduce((m, k) => m + k.initiatives.length, 0) + (o.direct ? o.direct.length : 0), 0)
-      + s.budgets.reduce((n, b) => n + b.initiatives.length, 0);
+      + s.budgets.reduce((n, b) => n + b.initiatives.length, 0)
+      + (s.domains || []).reduce((n, d) => n + d.initiatives.length, 0);   // D67 domain groups
     // `empty` is a SUCCESSFUL read of genuinely nothing — a repo with no initiative records at all.
     // It is a supported thing to point the workspace at, so it renders calm, not red.
     return { ok: true, empty: placed === 0 && s.unanchored.length === 0, ...s };
@@ -3866,10 +4264,31 @@ async function handleRequest(req, res) {
     return json(res, { ok: true, workspace: { ...w, home: HOME_ENABLED && w.root === SELF_ROOT, shape: wsShape(w.root) } });
   }
   if (p === '/api/workspaces/forget' && req.method === 'POST') {
+    // `repository: true` removes the repository's whole family of rows (overhaul-r1 R3.2); without it,
+    // one row, as before. A refusal names its cause — unknown / home / sessions (R3.3).
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); } catch {}
+    if (body.repository) {
+      const out = forgetRepository(body.id);
+      return json(res, out, out.ok ? 200 : 409);
+    }
+    const blocker = forgetBlocker(body.id);
+    if (blocker) return json(res, { ok: false, ...blocker }, 409);
+    forgetWorkspace(body.id);
+    return json(res, { ok: true, removed: [body.id] });
+  }
+  if (p === '/api/workspaces/rename' && req.method === 'POST') {
+    // A display name only (overhaul-r1 R3.1): the id is a hash of the root and does not move.
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); } catch {}
-    const ok = forgetWorkspace(body.id);
-    return json(res, { ok, error: ok ? undefined : 'unknown workspace, the home workspace, or it still owns sessions' }, ok ? 200 : 409);
+    const w = workspaces.get(body.id);
+    const name = String(body.name || '').trim();
+    if (!w) return json(res, { ok: false, reason: 'unknown', error: 'unknown repository' }, 404);
+    if (!name) return json(res, { ok: false, error: 'a name is required' }, 400);
+    // `label` is the PM's name for the REPOSITORY. The client names a product after its folder
+    // (`repo_name`), so changing `name` alone would never show; `label` wins over both.
+    w.label = name; saveWorkspaces(); pushWorkspaces();
+    return json(res, { ok: true, workspace: { id: w.id, name, label: name } });
   }
   if (p === '/api/git/worktrees/remove' && req.method === 'POST') {
     // Reclaim a worktree's folder. `dir` comes from a client, so it is checked against git's own
@@ -4120,11 +4539,103 @@ async function handleRequest(req, res) {
   // ── scheduled tasks ──
   // The picker's source: file-driven skills. `kind` is carried for internal/back-compat consumers,
   // but the New Skill flow + the scheduled lens never render it — one concept, no user-facing kind.
+  if (p === '/api/skills/candidates' && req.method === 'GET') {
+    // D76 — the directory of discovered and generated skills for one repository, with what the PM has done about each.
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const c = skillsReg.core();
+    if (!c.ok) return json(res, { ok: false, error: c.error });
+    const { rows, torn } = c.core.candidates(w.root);
+    const reads = skillsReg.readsFor(SKILL_APPROVALS, w.root);
+    const approved = new Set(skillsReg.approvedFor(SKILL_APPROVALS, w.root).map((a) => `${a.id}@${a.sha}`));
+    const res2 = c.core.resolve(w.root, skillsReg.approvedFor(SKILL_APPROVALS, w.root));
+    const live = new Set(res2.skills.map((x) => `${x.id}@${x.sha}`));
+    const others = new Set(skillStore.loadSkills([{ dir: userSkillsDir(), source: 'user' }, { dir: BUILTIN_SKILLS_DIR, source: 'builtin' }]).map((x) => x.id));
+    return json(res, { ok: true, ws: w.id, torn, blocked: res2.blocked,
+      candidates: rows.map((r) => ({ ...r, read: reads.has(`${r.id}@${r.sha}`), approved: approved.has(`${r.id}@${r.sha}`), running: live.has(`${r.id}@${r.sha}`),
+        needs_license_ack: c.core.licenseNeedsAck(r.license), collides: others.has(r.id) })) });
+  }
+  if (p === '/api/skills/decide' && req.method === 'POST') {
+    // D76 — the PM's press. `read` returns the full text and records that it was opened; `approve` is refused without
+    // it, and for an unknown or non-permissive licence without an acknowledgement; `reject` and `retire` go to the
+    // repository's registry. Approval is recorded HERE, locally, never in the repository.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const c = skillsReg.core();
+    if (!c.ok) return json(res, { ok: false, error: c.error });
+    const row = c.core.candidates(w.root).rows.find((r) => r.id === String(body.id || '') && r.sha.startsWith(String(body.sha || 'x')));
+    if (!row) return json(res, { ok: false, error: 'no such candidate' }, 404);
+    const key = skillsReg.rootKey(w.root); const at = nowISO();
+    const by = 'human:wawan'; const eid = 'a-' + Date.now().toString(36) + '-' + crypto.randomBytes(3).toString('hex');
+    try {
+      if (body.op === 'read') {
+        const t = c.core.textOf(w.root, row);
+        if (!t.ok) return json(res, { ok: false, error: t.error, changed: !!t.changed }, 409);
+        skillsReg.appendApproval(SKILL_APPROVALS, { eid, at, by, op: 'read', root: key, id: row.id, sha: row.sha });
+        return json(res, { ok: true, text: t.text, id: row.id, sha12: row.sha12, scan: row.scan, ignored_keys: row.ignored_keys });
+      }
+      if (body.op === 'approve') {
+        if (row.state !== 'quarantined') return json(res, { ok: false, error: `that candidate is ${row.state} — it cannot be approved` }, 409);
+        if (!skillsReg.readsFor(SKILL_APPROVALS, w.root).has(`${row.id}@${row.sha}`)) return json(res, { ok: false, error: 'open the full text first (read it) — approval needs the exact text to have been opened' }, 409);
+        if (c.core.licenseNeedsAck(row.license) && body.ack_license !== true) return json(res, { ok: false, error: `its licence is "${row.license}": say you have read it and accept it (acknowledge the licence) to approve`, needs_license_ack: true }, 409);
+        const t = c.core.textOf(w.root, row);
+        if (!t.ok) return json(res, { ok: false, error: t.error }, 409);
+        if (loadTasks(null).some((x) => x.id === row.id)) return json(res, { ok: false, error: `a skill named "${row.id}" already exists here and always wins over a discovered one — rename the candidate or retire it`, collides: true }, 409);
+        skillsReg.appendApproval(SKILL_APPROVALS, { eid, at, by, op: 'approve', root: key, id: row.id, sha: row.sha, ack_license: body.ack_license === true, ignored_keys: row.ignored_keys || [] });
+        return json(res, { ok: true, approved: row.id, sha12: row.sha12, note: `runs as an agent skill on claude; ${(row.ignored_keys || []).length ? 'its own ' + row.ignored_keys.join(', ') + ' were ignored' : 'it set no harness keys'}; approval is local to this machine` });
+      }
+      if (body.op === 'reject' || body.op === 'retire') {
+        const r = c.core.decide(w.root, body.op, { id: row.id, sha: row.sha12, reason: body.reason, by });
+        return json(res, r, r.ok ? 200 : 400);
+      }
+    } catch (e) { return json(res, { ok: false, error: 'could not record that — ' + String((e && e.message) || e).slice(0, 120) }, 500); }
+    return json(res, { ok: false, error: 'op must be read, approve, reject or retire' }, 400);
+  }
   if (p === '/api/tasks') return json(res, { tasks: loadTasks().map((t) => ({ id: t.id, label: t.label, skill: t.skill, kind: t.kind })) });
   // ── skills (workspace-skill-authoring): the ONE-concept surface + the New Skill flow ──
+  // One skill's full text, for the detail panel. Only the PM's own skills (source `user`) are
+  // editable: a builtin ships with the app and a discovered one is pinned to the text the PM approved,
+  // so editing either in place would change what was reviewed. Both can be copied to an editable one.
+  if (p === '/api/skills/read' && req.method === 'GET') {
+    const sw = getWs(url.searchParams.get('ws'));
+    const rec = loadSkillRecords(sw ? sw.root : null).find((x) => x.id === url.searchParams.get('id'));
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    return json(res, { ok: true, id: rec.id, label: rec.label || rec.id, source: rec.source, editable: rec.source === 'user',
+      file: path.basename(rec.file), description: rec.description || '', output: rec.output || [], text });
+  }
+  if (p === '/api/skills/save' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const rec = loadSkillRecords(null).find((x) => x.id === body.id && x.source === 'user');
+    if (!rec) return json(res, { ok: false, error: 'only your own skills can be edited here' }, 403);
+    const text = typeof body.text === 'string' ? body.text : '';
+    if (!text.trim() || text.length > 200000) return json(res, { ok: false, error: 'the skill text is empty or too long' }, 400);
+    const parsed = skillStore.parseSkill(text);
+    if (parsed.name !== rec.id) return json(res, { ok: false, error: `the name: line must stay "${rec.id}" — rename by copying instead` }, 400);
+    if (!String(parsed.description || '').trim()) return json(res, { ok: false, error: 'the skill needs a description: line' }, 400);
+    try { const tmp = rec.file + '.tmp'; fs.writeFileSync(tmp, text.endsWith('\n') ? text : text + '\n'); fs.renameSync(tmp, rec.file); }
+    catch { return json(res, { ok: false, error: 'the skill file could not be written' }, 500); }
+    return json(res, { ok: true, id: rec.id });
+  }
+  if (p === '/api/skills/copy' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const sw = getWs(body.ws);
+    const all = loadSkillRecords(sw ? sw.root : null);
+    const rec = all.find((x) => x.id === body.id);
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let id = rec.id + '-copy';
+    for (let n = 2; all.some((x) => x.id === id); n++) id = rec.id + '-copy-' + n;
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    text = text.replace(/^name:.*$/m, 'name: ' + id).replace(/^label:\s*"?(.*?)"?\s*$/m, (_, l) => 'label: "' + l.replace(/"/g, "'") + ' (my copy)"');
+    try { const d = userSkillsDir(); fs.mkdirSync(d, { recursive: true }); fs.writeFileSync(path.join(d, id + '.skill'), text, { flag: 'wx' }); }
+    catch { return json(res, { ok: false, error: 'the copy could not be written' }, 500); }
+    return json(res, { ok: true, id });
+  }
   // GET lists every skill with NO kind field — from the user's view there is just a skill.
   if (p === '/api/skills' && req.method === 'GET') {
-    const skills = loadTasks().map((t) => ({ id: t.id, label: t.label, skill: t.skill,
+    const sw = getWs(url.searchParams.get('ws'));
+    const skills = loadTasks(sw ? sw.root : null).map((t) => ({ id: t.id, label: t.label, skill: t.skill,
       description: t.description || '', output: t.output || [], source: t.source || 'builtin' }));
     // NEVER a bare list. Under an unmigrated conflict this list is either short by every skill the
     // PM authored or is being read from the old directory, and in both cases the payload has to say
@@ -4225,7 +4736,9 @@ async function handleRequest(req, res) {
     return json(res, { ok: true, prefs });
   }
   if (p === '/api/schedules' && req.method === 'GET') {
-    const wsFilter = getWs(url.searchParams.get('ws'));
+    // `all=1` (overhaul-r4 D1): every repository's schedules — the drawer lists `scheduled` under "all
+    // repositories", so filtering to the home workspace there would hide the PM's other schedules
+    const wsFilter = url.searchParams.get('all') ? null : getWs(url.searchParams.get('ws'));
     const id = wsFilter ? wsFilter.id : null;
     // One skills-corpus read per request, not one per schedule row — taskById re-reads every
     // .skill file, and the PM's forty-five schedules made that forty-five reads per GET.
@@ -4246,7 +4759,9 @@ async function handleRequest(req, res) {
   }
   if (p === '/api/schedules' && req.method === 'POST') {
     let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
-    if (!taskById(body.task || body.skill)) return json(res, { ok: false, error: 'that task has no backing skill' }, 400);
+    // D76 — an APPROVED discovered skill of this repository is a skill too, so it can be scheduled; a quarantined one is not.
+    const swsch = getWs(body.ws);
+    if (!taskById(body.task || body.skill, swsch ? swsch.root : null)) return json(res, { ok: false, error: 'that task has no backing skill' }, 400);
     const norm = scheduleLogic.normalizeSchedule(body);
     if (!norm.ok) return json(res, { ok: false, error: norm.error }, 400);
     const w = getWs(body.ws);
@@ -4259,12 +4774,35 @@ async function handleRequest(req, res) {
     const list = readSchedules(); list.unshift(sched); writeSchedules(list);
     return json(res, { ok: true, schedule: sched });
   }
+  if (p === '/api/schedules/seed' && req.method === 'POST') {
+    // D71 — one press creates the recommended schedules for a repository. Idempotent: a schedule for
+    // the same skill in the same repository is never created twice. Never reached by anything but the
+    // PM's press; the tick then fires them like any other schedule.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const set = SEED_SETS[body.set];
+    if (!set) return json(res, { ok: false, error: `unknown set '${body.set}' — one of ${Object.keys(SEED_SETS).join(', ')}` }, 400);
+    const list = readSchedules(); const made = []; const kept = [];
+    for (const def of set) {
+      if (!taskById(def.skill, w.root)) { kept.push({ skill: def.skill, why: 'the skill is not installed' }); continue; }
+      if (list.some((x) => x.ws === w.id && x.skill === def.skill)) { kept.push({ skill: def.skill, why: 'already scheduled' }); continue; }
+      const norm = scheduleLogic.normalizeSchedule({ ...def, task: def.skill });
+      if (!norm.ok) { kept.push({ skill: def.skill, why: norm.error }); continue; }
+      const sched = { id: 'sc-' + Date.now().toString(36) + made.length, ws: w.id, ...norm.schedule, profile: null, lastRun: null, lastStatus: null };
+      sched.nextRun = scheduleLogic.nextRun(sched);
+      list.unshift(sched); made.push(sched);
+    }
+    if (made.length) writeSchedules(list);
+    return json(res, { ok: true, created: made.map((x) => ({ id: x.id, name: x.name, skill: x.skill, cadence: x.cadence, time: x.time, nextRun: x.nextRun })), kept });
+  }
   if (p === '/api/schedules/update' && req.method === 'POST') {
     let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
     const list = readSchedules(); const s = list.find((x) => x.id === body.id);
     if (!s) return json(res, { ok: false, error: 'no such schedule' }, 404);
     if (typeof body.enabled === 'boolean') s.enabled = body.enabled;
-    for (const k of ['name', 'cadence', 'day', 'dayOfMonth', 'time', 'task', 'skill']) if (body[k] != null) s[k] = body[k];
+    for (const k of ['name', 'cadence', 'day', 'dayOfMonth', 'time', 'task', 'skill', 'date', 'args']) if (body[k] != null) s[k] = body[k];
+    if ('tier' in body) { if (body.tier === null || body.tier === '') delete s.tier; else if (/^(fast|balanced|deep)$/.test(String(body.tier))) s.tier = String(body.tier); else return json(res, { ok: false, error: 'tier must be fast, balanced or deep' }, 400); }
     // `profile` is settable to null (clear it) as well as to an id, so it is checked for PRESENCE
     // of the key rather than for a non-null value — the other fields above cannot be cleared.
     if ('profile' in body) {
@@ -4293,7 +4831,30 @@ async function handleRequest(req, res) {
     let md; try { md = fs.readFileSync(path.join(DELIV_DIR, id + '.md'), 'utf8'); } catch { res.writeHead(404); return res.end('not found'); }
     res.writeHead(200, { 'Content-Type': 'text/markdown; charset=utf-8' }); return res.end(md);
   }
-  if (p === '/api/sessions') return json(res, { sessions: sessionList() });
+  if (p === '/api/session/model' && req.method === 'POST') {
+    // D75 — switch the model of a RUNNING Claude session, on the PM's press only. It types the harness's own
+    // `/model <model>` command into the pane; effort is not changed by it. Never automatic, never for a binary
+    // PMOS has not checked, and a pinned review route cannot be lowered here either.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const s = sessions.get(String(body.id || ''));
+    if (!s) return json(res, { ok: false, error: 'no such session' }, 404);
+    if (!s.pty || s.state === 'exited') return json(res, { ok: false, error: 'that session is not running — there is nothing to switch' }, 400);
+    if (s.agent !== 'claude') return json(res, { ok: false, error: `'${s.agent}' has no model command PMOS has checked — nothing was typed` }, 400);
+    const r = modelLib.resolveForSpawn(s.root, s.agent, { explicit: { tier: body.tier, model: body.model }, skill: s.modelAsk && s.modelAsk.skill });
+    if (!r.ok) return json(res, { ok: false, error: r.error }, 400);
+    if (!r.model) return json(res, { ok: false, error: 'say a tier (fast, balanced, deep) or a model' }, 400);
+    try { s.pty.write(`/model ${r.model}\r`); }
+    catch (e) { return json(res, { ok: false, error: 'could not write to the session — ' + String((e && e.message) || e).slice(0, 100) }, 500); }
+    const at = nowISO();
+    s.model = { ...(s.model || {}), state: 'applied', switched: { model: r.model, tier: r.tier, at } };
+    persist(s); pushSessions();
+    const mc = modelLib.core();
+    if (mc.ok) mc.core.logDecision(s.root, { kind: 'switch', session: s.id, agent: s.agent, tier: r.tier, model: r.model, by: 'human:wawan' });
+    return json(res, { ok: true, model: r.model, tier: r.tier, note: 'typed /model into the pane; effort is unchanged' });
+  }
+  // `version` lets the launcher notice a server still running OLD code after an upgrade: files on disk
+  // advance under a live process, so the UI would otherwise call routes that process never learned.
+  if (p === '/api/sessions') return json(res, { sessions: sessionList(), version: APP_VERSION });
   if (p === '/api/git/branches') {
     // Read-only branch awareness for a workspace. A non-repo returns {ok:false} (never a fake
     // branch). Fixed git args, no caller input in the read path (R1).
@@ -4403,14 +4964,20 @@ async function handleRequest(req, res) {
     if (!w) { res.writeHead(404); return res.end('no workspace'); }
     const full = path.resolve(w.root, url.searchParams.get('path') || '');
     if (!insideRoot(w.root, full)) { res.writeHead(404); return res.end('outside workspace'); }
-    const mime = preview.imageMime(path.basename(full));
+    const mime = preview.assetMime(path.basename(full));
     if (!mime) { res.writeHead(404); return res.end('not a servable asset'); }
     return fs.readFile(full, (err, buf) => {
       if (err) { res.writeHead(404); return res.end('not found'); }
       res.writeHead(200, {
         'Content-Type': mime,
         'X-Content-Type-Options': 'nosniff',
-        'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+        // An image keeps the script-blocking sandbox. A PDF cannot: the CSP `sandbox` directive
+        // disables the browser's built-in PDF viewer, which is the whole point of serving it
+        // (overhaul-r2 D1). It still gets `default-src 'none'` — nothing it references is fetched —
+        // and it is only ever a file inside this workspace's root, on 127.0.0.1.
+        'Content-Security-Policy': mime === 'application/pdf'
+          ? "default-src 'none'; style-src 'unsafe-inline'"
+          : "default-src 'none'; style-src 'unsafe-inline'; sandbox",
       });
       res.end(buf);
     });
@@ -4630,6 +5197,15 @@ async function handleRequest(req, res) {
   // share no field (`{session, line, after}` vs `{path, kind, match, openable}`), the scrollback
   // search scrubs secrets out of text an agent typed, and the file search reports a walk bound.
   // Collapsing them into one payload would mean one of the two lying about what it looked at.
+  if (p === '/api/portfolio' && req.method === 'GET') return json(res, portfolio());
+  if (p === '/api/reports' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    let out;
+    try { out = portfolioReport(String(body.kind || ''), body.q); }
+    catch (e) { out = { ok: false, error: 'the report could not be written — ' + String((e && e.message) || 'error').slice(0, 140) }; }
+    return json(res, out, out.ok ? 200 : (out.reason === 'no-hub' ? 409 : 400));
+  }
   if (p === '/api/search/files') {
     // `search everything…`, finally over everything: every file under THIS workspace's root, by
     // path and by content. There is no path parameter — the query is a needle, not a location — so
@@ -4641,7 +5217,19 @@ async function handleRequest(req, res) {
       return json(res, { ok: false, error: 'no workspace to search', q: url.searchParams.get('q') || '',
         hits: [], truncated: false, scanned: 0, content_scanned: 0, limit: SEARCH_LIMIT_DEFAULT });
     }
-    return json(res, { ws: w.id, ...searchWorkspace(w.root, url.searchParams.get('q'), url.searchParams.get('limit')) });
+    // Every line of work of the repository, not only the tree the id names (overhaul-r1 R1): a file
+    // that exists only on a linked worktree's branch was unfindable from its product. `tree` narrows.
+    // overhaul-r4 B1 — `scope=all`: every registered repository's family of trees, each hit tagged
+    // with its repository, truncation reported PER repository (a capped repo never reads as complete)
+    if (url.searchParams.get('scope') === 'all') {
+      const per = repoLeads().map((r) => ({ r, out: searchFamily(workspaces.get(r.ws) || w, url.searchParams.get('q'), url.searchParams.get('limit')) }));
+      const hits = per.flatMap(({ r, out }) => (out.hits || []).map((h) => ({ ...h, repo: r.name })));
+      return json(res, { ok: true, scope: 'all', q: url.searchParams.get('q') || '', hits,
+        truncated: per.some(({ out }) => out.truncated), content_truncated: per.some(({ out }) => out.content_truncated),
+        scanned: per.reduce((n, { out }) => n + (out.scanned || 0), 0), content_scanned: per.reduce((n, { out }) => n + (out.content_scanned || 0), 0),
+        repos: per.map(({ r, out }) => ({ repo: r.name, ws: r.ws, truncated: !!out.truncated, scanned: out.scanned || 0, hits: (out.hits || []).length })) });
+    }
+    return json(res, { ws: w.id, ...searchFamily(w, url.searchParams.get('q'), url.searchParams.get('limit'), url.searchParams.get('tree')) });
   }
   if (p === '/api/search') {
     // Episodic recall over this workspace's own past sessions. Localhost only, like everything
@@ -4738,6 +5326,104 @@ async function handleRequest(req, res) {
       pm_label_recorded: rec.pm_label === 'pass' || rec.pm_label === 'fail',
     });
   }
+  if (p === '/api/memory' && req.method === 'GET') {
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const c = memoryLib.core();
+    if (!c.ok) return json(res, { ok: false, error: c.error });
+    const cur = c.core.load(w.root);
+    return json(res, { ok: true, ws: w.id, name: w.name, entries: cur.state.entries, pending: cur.state.pending, blocked: cur.state.blocked,
+      usage: cur.usage, torn: cur.torn, config: { write_approval: !!cur.cfg.write_approval }, wired: memoryLib.wired(w.root),
+      has_state_dir: !!c.core.stateDir(w.root, false) });
+  }
+  if (p === '/api/memory' && req.method === 'POST') {
+    // D72 — a PM write. The actor is the PM, so it is never staged, and only the PM can confirm, approve or reject.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const c = memoryLib.core();
+    if (!c.ok) return json(res, { ok: false, error: c.error });
+    const out = c.core.write(w.root, { op: body.op, target: body.target, text: body.text, old: body.old, ref: body.ref,
+      confidence: body.confidence, source: body.source, stale_after: body.stale_after, by: 'human:wawan' });
+    return json(res, out, out.ok ? 200 : 400);
+  }
+  if (p === '/api/memory/config' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const c = memoryLib.core();
+    if (!c.ok) return json(res, { ok: false, error: c.error });
+    const dir = c.core.memDir(w.root, true);
+    const cfg = c.core.readConfig(dir);
+    if (typeof body.write_approval === 'boolean') cfg.write_approval = body.write_approval;
+    try { fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ memory_chars: cfg.memory_chars, user_chars: cfg.user_chars, write_approval: cfg.write_approval }, null, 2) + '\n'); }
+    catch (e) { return json(res, { ok: false, error: 'could not save the setting — ' + String((e && e.message) || e).slice(0, 120) }, 500); }
+    return json(res, { ok: true, config: { write_approval: !!cfg.write_approval } });
+  }
+  if (p === '/api/memory/wire' && req.method === 'POST') {
+    // D72 — one press adds a marked block to the repository's CLAUDE.md so sessions import the snapshot.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    return json(res, memoryLib.wire(w.root));
+  }
+  if (p === '/api/sync/status') {
+    // Local only — no network. Safe to poll; it is what tells the PM whether a press is needed.
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    return json(res, { ws: w.id, name: w.name, ...(await syncLib.status(w.root)) });
+  }
+  if (p === '/api/sync' && req.method === 'POST') {
+    // D70 — the ONE place the workspace runs fetch / integrate / commit / push. Only the PM's press
+    // reaches it; nothing schedules or chains it, and it is off every other action's request path.
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (syncing.has(w.root)) return json(res, { ok: false, error: 'a sync is already running for this repository' }, 409);
+    syncing.add(w.root);
+    try {
+      const out = await syncLib.sync(w.root, { label: os.hostname() });
+      boardCache.invalidate(w.root);
+      return json(res, { ws: w.id, name: w.name, ...out });
+    } finally { syncing.delete(w.root); }
+  }
+  if (p === '/api/lifecycle' && req.method === 'POST') {
+    // D70 — close, hold, cancel or reopen an initiative. Only reached by an explicit PM press. It
+    // appends ONE line to lifecycle.jsonl and never writes an acceptance.
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const id = String(body.initiative_id || '');
+    if (!/^[a-z0-9][a-z0-9._-]*$/i.test(id)) return json(res, { ok: false, error: 'initiative_id is required' }, 400);
+    if (body.state !== 'active' && !STOPPED_STATES.includes(body.state)) {
+      return json(res, { ok: false, error: `state must be one of ${STOPPED_STATES.concat('active').join(', ')}` }, 400);
+    }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (!initiativeIndex(w.root).initiatives.some((g) => g.id === id)) {
+      return json(res, { ok: false, error: `no initiative '${id}' in ${w.name}` }, 404);
+    }
+    const rec = { initiative_id: id, state: body.state, reason: String(body.reason || '').slice(0, 500), pm: 'wawan', at: nowISO() };
+    // The ledger the ENGINE reads for this repository's layout (scripts/workflow-state.js#layout): a repository
+    // with planning/initiatives/ keeps its ledgers in planning/runs/, a kit in pmos/state/. Writing anywhere else
+    // (R6 wrote the workspace's runtime state for PMOS-self) shows on the board but never clears the gate.
+    let d = null;
+    if (isDir(path.join(w.root, 'planning', 'initiatives'))) d = path.join(w.root, 'planning', 'runs');
+    else if (isDir(path.join(w.root, 'pmos', 'state', 'initiatives'))) d = path.join(w.root, 'pmos', 'state');
+    else d = stateDirFor(w, { create: true });
+    if (!d) return json(res, { ok: false, error: 'this repository has no state directory to record in — nothing was written' }, 500);
+    try { fs.mkdirSync(d, { recursive: true }); } catch { /* the guard reports it */ }
+    const sink = path.join(d, 'lifecycle.jsonl');
+    try { createSinkGuard({ sink, what: 'lifecycle' }).appendLine(sink, rec); }
+    catch (e) {
+      warnWriteFail('lifecycle.jsonl', e);
+      return json(res, { ok: false, error: 'could not record the change — nothing was saved', sink }, 500);
+    }
+    boardCache.invalidate(w.root);
+    return json(res, { ok: true, recorded: rec, sink });
+  }
   if (p === '/api/doc/save' && req.method === 'POST') {
     // The editor's save (workspace-doc-editor R3/R4). The ONLY write path on this surface, and it is
     // reached solely by the PM pressing save on a document they were editing. Nothing here consults
@@ -4768,7 +5454,12 @@ async function handleRequest(req, res) {
       return json(res, { ok: false, error: saved.reason, detail: saved.detail || null }, code);
     }
 
-    try { fs.writeFileSync(full, saved.text); }
+    // R11 (D74) — a document that declares `generated: {by, at}` on one line says who last produced it. A save
+    // from here is the PM's own hand, so the line is rewritten to say so. Only that one line, only in the leading
+    // block, and only when it is already there: nothing is added to a document that never had one. The stamped text
+    // goes back to the editor, which takes it as its new base, so the next save is not read as stale.
+    const stamped = stampEdit(saved.text, nowISO());
+    try { fs.writeFileSync(full, stamped); }
     catch (e) {
       warnWriteFail('document save (' + body.path + ')', e);
       return json(res, { ok: false, error: 'could not write the document — nothing was changed' }, 500);
@@ -4792,7 +5483,7 @@ async function handleRequest(req, res) {
     }
     // The document IS saved at this point. A failed log is reported honestly rather than as success,
     // but it must not read as "your edit was lost".
-    return json(res, { ok: true, saved: body.path, logged, change: { added: rec.added, removed: rec.removed, at_line: rec.at_line },
+    return json(res, { ok: true, saved: body.path, logged, ...(stamped !== saved.text ? { text: stamped, stamped: true } : {}), change: { added: rec.added, removed: rec.removed, at_line: rec.at_line },
       warning: logged ? undefined : 'the document was saved but the change could not be logged' });
   }
   if (p === '/api/align/candidates') {
@@ -5018,7 +5709,8 @@ function writeChangeContext(dir) {
   const out = [
     '---', 'type: Reference',
     'title: "Change context — what the PM has been editing here, and why"',
-    'timestamp: ' + nowISO().slice(0, 10), '---', '',
+    'description: "A digest of the PM\'s recent edits and their reasons, regenerated on every save. For agents writing documents here."',
+    `generated: {by: process:pmos-workspace, at: "${nowISO()}"}`, 'status: stable', '---', '',
     '# Change context',
     '',
     '**Read this before writing documents in this repository.** It is generated from the PM\'s own',
@@ -5153,10 +5845,12 @@ wss.on('connection', (ws) => {
       // `initiative` is what the client has always held and never sent: `＋ session` is clicked on
       // an initiative row, the tab carries its `slug`, and the spawn message named three other
       // fields. An absent or unusable value leaves the session unattributed — never a refused spawn.
-      const r = spawnWithBranch({ name: m.name, agent: m.agent, cwd: m.cwd, ws: m.ws, branch: m.branch, createBranch: m.createBranch, isolate: m.isolate, profile: m.profile, initiative: m.initiative });
+      const r = spawnWithBranch({ name: m.name, agent: m.agent, cwd: m.cwd, ws: m.ws, branch: m.branch, createBranch: m.createBranch, isolate: m.isolate, profile: m.profile, initiative: m.initiative,
+        // D75 — what the composer chose (a tier, or a model), carried like the profile. Absent = not asked.
+        modelAsk: (m.tier || m.model) ? { explicit: { tier: m.tier, model: m.model, effort: m.effort } } : null });
       // A refused profile is its own sentence, not "branch: …" — the composer's error line names
       // what PMOS could not read, and nothing was started.
-      if (!r.ok) { ws.send(JSON.stringify({ t: 'error', error: (/^profile /.test(r.error || '') ? '' : 'branch: ') + r.error })); return; }
+      if (!r.ok) { ws.send(JSON.stringify({ t: 'error', error: (/^(profile|model choice) /.test(r.error || '') ? '' : 'branch: ') + r.error })); return; }
       // a non-fatal truth about what just happened (a worktree's path, a branch ignored on a
       // non-repo) — said out loud, never swallowed
       if (r.notice) ws.send(JSON.stringify({ t: 'notice', notice: r.notice }));
@@ -5176,7 +5870,7 @@ wss.on('connection', (ws) => {
       // server already holds, not re-sent by the client — a client that forgot it would otherwise
       // silently restart the pane on a different environment, and the pane would look identical.
       const carried = 'profile' in old ? old.profile : null;
-      const s = spawnSession({ name: old.name, agent: old.agent, cwd: path.relative(old.root, old.cwd), ws: old.ws, profile: carried });
+      const s = spawnSession({ name: old.name, agent: old.agent, cwd: path.relative(old.root, old.cwd), ws: old.ws, profile: carried, modelAsk: old.modelAsk || null });
       // A descriptor deleted since the original spawn does NOT get substituted. The respawn goes
       // ahead with no profile — the pane line already says so — and the reason is said out loud
       // rather than left for the PM to notice.
@@ -5302,4 +5996,4 @@ module.exports = { server, spawnSession, removeSession, renameSession, sessions,
   // things that matter independently of a rendered page: that no declared field reaches a status,
   // that an unreadable history reports rather than degrades, and that a planning-only commit does
   // not count as delivery.
-  surfaceInitiatives, deliveryIndex, deriveState, isDeliveryPath };
+  surfaceInitiatives, readLifecycle, deliveryIndex, deriveState, isDeliveryPath };