create-pmos 0.46.0 → 0.48.0

package/workspace/public/pm/tab-doc.js

@@ -7,7 +7,10 @@
  * `view` renders the markdown — EXCEPT for an HTML file, which is a page, not prose. Handing one to
  * the markdown parser prints its own markup back at the PM: the document read as its source code.
  * So an `.html` document renders, in `view`, as the page it is; `raw` is the one click that still
- * shows the code. See `htmlFrame` for why rendering it is not a new privilege.
+ * shows the code. See `htmlFrame` for why rendering it is not a new privilege — and for the one
+ * privilege that IS grantable, per document and only by the PM: `run scripts` lets a page execute
+ * its own inline code in a frame with no origin and no network, which is what an interactive
+ * explainer companion needs and all it needs.
  * The diff is COMPUTED, never narrated — a "2 sections differ" that nothing read is the watermelon
  * this repo has a word for, and the same rule that governs artifact sync governs this pane.
  *
@@ -160,6 +163,7 @@ function save(tab, text) {
       if (out && out.ok === false) { saveErr.set(path, out.error || 'refused'); setState({}); return; }
       const final = out && typeof out.text === 'string' ? out.text : text;
       disk.set(path, final);
+      claims.delete(wsOf(tab));          // the consistency record may move with the file; read it again
       commit(final);
     },
     (e) => { saveErr.set(path, (e && e.message) || 'could not reach the workspace server'); setState({}); },
@@ -293,11 +297,26 @@ function rendersAsPage(tab) {
  * CSP is `default-src 'none'`, which blocks every network fetch the page could attempt. A poisoned
  * explainer therefore can neither execute nor beacon out, which is the same no-remote-fetch-on-view
  * invariant the markdown image rule holds (R4). Only inline styles, data: images and data: fonts
- * resolve — enough for a page to look like itself, not enough to reach anything. */
-const HTML_CSP = '<meta http-equiv="Content-Security-Policy" content="'
-  + "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:" + '">';
-
-const frames = new Map();     // tab id -> { text, node } — the frame currently showing that text
+ * resolve — enough for a page to look like itself, not enough to reach anything.
+ *
+ * ── …and why one privilege is nevertheless grantable, per document ──────────────────────────────
+ * That default left the surface short of what it is for: PMOS's own build explainers ship as
+ * INTERACTIVE HTML companions, so the one document class that most needs this reader was the class
+ * it could not run. `run scripts` grants exactly one thing and grants it per open document, on an
+ * act the PM performed: `allow-scripts` on the sandbox, `script-src 'unsafe-inline'` added to the
+ * same CSP. Read what is NOT in that list — `allow-same-origin` is absent, so the frame keeps an
+ * opaque origin and can never reach this app's document, storage or cookies; `default-src 'none'`
+ * is untouched, so `connect-src` is still `none` and fetch/XHR/WebSocket are refused; `script-src`
+ * names no host, so a remote `<script src>` is refused too; and forms, popups, top-level navigation
+ * and modals were never granted at all. The whole delta is: the page may run its own inline code,
+ * in a box with no origin and no network. Everything else the empty sandbox withheld stays withheld,
+ * and a page that needs a CDN does not work here by design. */
+const CSP_BASE = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:";
+const htmlCsp = (live) => '<meta http-equiv="Content-Security-Policy" content="'
+  + CSP_BASE + (live ? "; script-src 'unsafe-inline'" : '') + '">';
+
+const running = new Set();    // tab ids the PM has granted script execution to, this window only
+const frames = new Map();     // tab id -> { text, live, node } — the frame currently showing that
 
 /* THE FRAME IS NEVER RE-POINTED, IT IS REPLACED. Writing a new `srcdoc` onto a frame that is
  * already in the document does navigate it — but the replacement document does NOT get the meta
@@ -309,18 +328,24 @@ const frames = new Map();     // tab id -> { text, node } — the frame currentl
  * The cache is therefore keyed on the TEXT, not just the tab: a repaint that changed nothing hands
  * back the identical node — which is what `setChildren` needs to leave a live frame alone — while a
  * changed document gets a frame built from scratch. The cost is that saving an open HTML file
- * returns it to the top; the alternative is a page that renders contained only until it is edited. */
-function htmlFrame(tab, text) {
+ * returns it to the top; the alternative is a page that renders contained only until it is edited.
+ *
+ * The grant is keyed the same way and for the same reason. `sandbox` and the CSP are read when the
+ * frame loads its document, so re-writing them on a frame already showing a page changes an
+ * attribute and nothing else — the running document keeps whatever it was born with. Granting or
+ * revoking therefore builds a NEW frame too, which is also the honest behaviour: `stop` really
+ * stops, because the executing document is discarded rather than asked to behave. */
+function htmlFrame(tab, text, live) {
   const cur = frames.get(tab.id);
-  if (cur && cur.text === text) return cur.node;
+  if (cur && cur.text === text && cur.live === live) return cur.node;
   const node = el('iframe', {
     style: 'flex:1;min-height:0;width:100%;border:0;background:var(--background)',
-    sandbox: '',                        // no allow-scripts, no allow-same-origin
+    sandbox: live ? 'allow-scripts' : '',   // never allow-same-origin — that pair dissolves the box
     referrerpolicy: 'no-referrer',
     title: String(tab.path || 'document'),
-    srcdoc: HTML_CSP + text,            // set HERE, on a node not yet in the document — see above
+    srcdoc: htmlCsp(live) + text,       // set HERE, on a node not yet in the document — see above
   });
-  frames.set(tab.id, { text, node });
+  frames.set(tab.id, { text, live, node });
   return node;
 }
 
@@ -365,6 +390,170 @@ export function disposeDoc(id) {
   normNote.delete(id);
   frames.delete(id);
   scrollers.delete(id);
+  running.delete(id);         // the grant belonged to this open document, and it is closed
+  alignOpen.delete(id);
+  alignSkip.delete(id);
+  alignNodes.delete(id);
+}
+
+
+/* ── the Alignment drawer (workspace-cockpit-nav Run 3, ViewAlignment.dc.html) ──────────────────
+ *
+ * The board shows a drawer beside a document: the other documents with a CONCRETE tie to this one,
+ * and what to do about each. Everything in it here is read from the consistency record the Validate
+ * view already reads (`/api/claims`): which files a document is compared with, and which findings
+ * name a source. Nothing is guessed from similarity, and nothing is drafted:
+ *   · a tie is drawn only from `compared_with` and a finding's `source` — never from wording;
+ *   · the board's "Apply" (a proposed edit to the other file, with its diff) has no backing — PMOS
+ *     drafts no edit to another file — so it is not drawn, and the drawer says so;
+ *   · a file the last check did not read is said to be unread, not shown as clean.
+ * The drawer is closed by default, and closed it adds nothing to the pane: the pane is exactly
+ * [mode bar, body] as before. Open, it is a third child laid over the right of the pane, and the
+ * mode bar and body give it room with a margin. No node is re-parented, so a textarea keeps its
+ * caret, a scroller its offset and a sandboxed frame its document. */
+const alignOpen = new Set();      // tab ids whose drawer is open
+const alignSkip = new Map();      // tab id -> Set of rels the PM skipped for this tab
+const claims = new Map();         // ws -> { state: 'loading' | 'ok' | 'error', data?, error? }
+const ALIGN_W = 'min(420px, 50%)';
+const alignNodes = new Map();     // tab id -> the drawer element, kept so its scroll survives a repaint
+
+function readClaims(ws) {
+  let c = claims.get(ws);
+  if (c) return c;
+  c = { state: 'loading' };
+  claims.set(ws, c);
+  fetch('/api/claims?ws=' + encodeURIComponent(ws))
+    .then((r) => r.json())
+    .then((d) => { claims.set(ws, d && d.ok !== false ? { state: 'ok', data: d } : { state: 'error', error: (d && d.error) || 'refused' }); setState({}); },
+      (e) => { claims.set(ws, { state: 'error', error: (e && e.message) || 'could not reach the workspace server' }); setState({}); });
+  return c;
+}
+
+/** Whether a tab can have the drawer at all: a file in the checked-out tree, in real mode. */
+const canAlign = (tab) => !FIXTURE && !tab.guide && !tab.ref && !isReference(tab.path);
+
+const A_LBL = 'font-family:var(--mono);font-size:10px;font-weight:500;letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground)';
+const A_NOTE = 'font-size:12px;line-height:1.5;color:var(--muted-foreground)';
+const A_BADGE = 'font-family:var(--sans);font-size:11px;font-weight:500;border:1px solid var(--border);border-radius:999px;padding:0 8px;line-height:18px;white-space:nowrap;color:var(--foreground)';
+const A_CARD = 'border:1px solid var(--border);background:var(--background);border-radius:10px;padding:12px 14px;display:flex;flex-direction:column;gap:8px';
+const A_BTN = 'font-family:var(--sans);font-size:12.5px;font-weight:500;padding:0 12px;min-height:30px;border-radius:8px;background:transparent;border:1px solid var(--input);color:var(--foreground)';
+const STATUS_TONE = { contradicted: 'var(--destructive)', stale: 'var(--warning)', suspected: 'var(--muted-foreground)', undecided: 'var(--muted-foreground)' };
+const STATUS_WORD = { contradicted: 'contradicted', stale: 'stale', suspected: 'suspected by Jev', undecided: 'worth a look' };
+
+const statusBadge = (st) => el('span', {
+  style: A_BADGE + ';border-color:transparent;color:' + (STATUS_TONE[st] || 'var(--muted-foreground)')
+    + ';background:color-mix(in oklab, ' + (STATUS_TONE[st] || 'var(--muted-foreground)') + ' 14%, transparent)',
+}, iv(STATUS_WORD[st] || st));
+
+/**
+ * The documents tied to `rel`, each with the ties that put it there. Three kinds, all read:
+ *   · this file is compared with it        (this file's `compared_with`)
+ *   · it is compared with this file        (its `compared_with` names this file)
+ *   · a finding in it names this file      (a finding whose `source` is this file)
+ */
+function tiesFor(rel, docs) {
+  const out = new Map();
+  const add = (r, tie, finding) => {
+    if (!r || r === rel) return;
+    let c = out.get(r);
+    if (!c) { c = { rel: r, ties: new Set(), findings: [] }; out.set(r, c); }
+    c.ties.add(tie);
+    if (finding) c.findings.push(finding);
+  };
+  const self = docs.find((x) => x.rel === rel) || null;
+  if (self) for (const r of self.compared_with || []) add(r, 'this file checks against it');
+  for (const x of docs) {
+    if (x.rel === rel) continue;
+    if ((x.compared_with || []).includes(rel)) add(x.rel, 'checks against this file');
+    for (const f of x.findings || []) if (f && f.source === rel) add(x.rel, 'a finding names this file', f);
+  }
+  return { self, list: [...out.values()] };
+}
+
+function alignDrawer(tab) {
+  const ws = wsOf(tab);
+  const rel = String(tab.path || '');
+  const close = () => { alignOpen.delete(tab.id); setState({}); };
+  const kids = [
+    el('div', { style: 'display:flex;align-items:center;justify-content:space-between;gap:8px' },
+      el('span', { style: 'font-weight:600;font-size:15px;font-family:var(--sans)', 'data-r29': 'align-title' }, 'Alignment'),
+      el('button', { onClick: close, 'data-r29': 'align-close', 'aria-label': 'close alignment', title: 'close the drawer',
+        style: 'background:transparent;border:0;color:var(--muted-foreground);font-size:15px;padding:2px 6px', hover: 'color:var(--foreground)' }, '⟩')),
+    el('div', { style: A_NOTE, 'data-r29': 'align-rule' }, 'Only documents with a concrete tie to this file are listed. No similarity guesses.'),
+  ];
+  const c = readClaims(ws);
+  if (c.state === 'loading') {
+    kids.push(el('div', { style: A_NOTE, 'data-r29': 'align-status', 'data-state': 'loading' }, 'Reading the consistency record…'));
+  } else if (c.state === 'error') {
+    kids.push(el('div', { style: A_NOTE + ';color:var(--destructive)', 'data-r29': 'align-status', 'data-state': 'error' },
+      iv('The consistency record could not be read: ' + c.error + '. Nothing is listed.')));
+  } else {
+    const d = c.data || {};
+    const docs = Array.isArray(d.docs) ? d.docs : [];
+    const openValidate = () => import('./panel-cockpit.js').then((m) => m.openView('validate')).catch(() => {});
+    if (d.verdict === 'not-checked' || !docs.length) {
+      kids.push(el('div', { style: A_NOTE, 'data-r29': 'align-status', 'data-state': 'not-checked' },
+        'This repository has not been checked yet, so no tie is known. Open Validate and press “check now”.'));
+      kids.push(el('div', null, el('button', { style: A_BTN, hover: 'border-color:var(--ring)', onClick: openValidate, 'data-r29': 'align-validate' }, 'open Validate')));
+    } else {
+      const { self, list } = tiesFor(rel, docs);
+      const skipped = alignSkip.get(tab.id) || new Set();
+      const shown = list.filter((x) => !skipped.has(x.rel));
+      kids.push(el('div', { style: A_NOTE, 'data-r29': 'align-status', 'data-state': self ? 'read' : 'unread' },
+        iv(self
+          ? 'This file: ' + (self.classified ? self.type : 'not classified') + ' · ' + self.verified + ' statement(s) verified'
+            + (self.findings.length ? ' · ' + self.findings.length + ' finding(s)' : ' · no open findings')
+          : 'The last check did not read this file, so its own findings are unknown. Ties from other files are still listed.')));
+      if (self && self.findings.length) {
+        kids.push(el('div', { style: A_LBL }, 'findings in this file'));
+        kids.push(el('div', { style: 'display:flex;flex-direction:column;gap:6px', 'data-r29': 'align-self' },
+          self.findings.map((f) => el('div', { 'data-r29': 'align-finding', 'data-status': f.status, style: 'display:flex;flex-direction:column;gap:3px' },
+            el('span', null, statusBadge(f.status)),
+            el('span', { style: 'font-size:12px;line-height:1.5;color:var(--foreground)' }, iv(f.sentence))))));
+      }
+      if (state.savedDocs[docKey(tab)] != null && list.length) {
+        kids.push(el('div', { style: A_NOTE + ';color:var(--warning)', 'data-r29': 'align-saved' },
+          iv('Saved. ' + list.length + ' other document' + (list.length === 1 ? '' : 's') + ' may now disagree with this change.')));
+      }
+      kids.push(el('div', { style: A_LBL }, iv('tied documents · ' + list.length)));
+      if (!list.length) kids.push(el('div', { style: A_NOTE, 'data-r29': 'align-none' }, 'No other document has a concrete tie to this file.'));
+      for (const x of shown) {
+        kids.push(el('div', { style: A_CARD, 'data-r29': 'align-cand', 'data-rel': x.rel },
+          el('b', { style: 'font-family:var(--mono);font-size:12px;font-weight:600;overflow-wrap:anywhere' }, iv(x.rel)),
+          el('div', { style: 'display:flex;gap:6px;flex-wrap:wrap' }, [...x.ties].map((t) => el('span', { style: A_BADGE, 'data-r29': 'align-tie' }, iv(t)))),
+          x.findings.map((f) => el('div', { style: 'display:flex;flex-direction:column;gap:3px' },
+            el('span', null, statusBadge(f.status)),
+            el('span', { style: A_NOTE }, iv(f.sentence)))),
+          el('div', { style: 'display:flex;gap:6px' },
+            el('button', { style: A_BTN, hover: 'border-color:var(--ring)', 'data-r29': 'align-open', onClick: () => openDoc(tab.slug, x.rel, 'FILE', tab.ws ? { ws: tab.ws, branch: tab.branch || null, linked: true } : undefined) }, 'Open to edit'),
+            el('button', { style: A_BTN, hover: 'border-color:var(--ring)', 'data-r29': 'align-skip',
+              onClick: () => { const s2 = new Set(skipped); s2.add(x.rel); alignSkip.set(tab.id, s2); setState({}); } }, 'Skip'))));
+      }
+      if (skipped.size) {
+        kids.push(el('button', { style: A_BTN + ';align-self:flex-start', hover: 'border-color:var(--ring)', 'data-r29': 'align-unskip',
+          onClick: () => { alignSkip.delete(tab.id); setState({}); } }, iv('show ' + skipped.size + ' skipped')));
+      }
+    }
+    kids.push(el('div', { style: 'display:flex;gap:6px' },
+      el('button', { style: A_BTN, hover: 'border-color:var(--ring)', 'data-r29': 'align-reread', onClick: () => { claims.delete(ws); setState({}); } }, 're-read')));
+  }
+  kids.push(el('div', { style: A_NOTE, 'data-r29': 'align-foot' },
+    'Ties come from the last consistency check. PMOS drafts no edit to another file: open it to change it. Git keeps the history.'));
+  /* One node per tab, kept like the scrollers above, so a repaint does not take the drawer's own
+   * scroll back to the top. */
+  let node = alignNodes.get(tab.id);
+  if (!node) { node = makeDrawerNode(); alignNodes.set(tab.id, node); }
+  setChildren(node, kids);
+  return node;
+}
+
+function makeDrawerNode() {
+  return el('div', {
+    'data-r29': 'align-drawer', 'data-board': 'alignment',
+    style: 'position:absolute;top:0;right:0;bottom:0;width:' + ALIGN_W + ';box-sizing:border-box;overflow-y:auto;'
+      + 'border-left:1px solid var(--border);background:var(--sidebar);color:var(--foreground);padding:16px;'
+      + 'display:flex;flex-direction:column;gap:12px;font-family:var(--sans);font-size:13px;line-height:1.5',
+  });
 }
 
 /* ── mount ─────────────────────────────────────────────────────────────────────────────────── */
@@ -554,6 +743,27 @@ export function mountDoc(host, tab) {
     style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:var(--brand);color:oklch(0.987 0.002 197.1);font-weight:500',
   }, 'save') : null;
 
+  /* The one control that grants a privilege, and the only place the PM learns the page CAN run.
+   * Offered only where it means something — a document actually being rendered as a page, in the
+   * mode that renders it — so it never appears on markdown, on raw/edit/diff, or on a stub. Its two
+   * states differ in WORD, not only in colour: a page that is executing says so in as many words. */
+  const asPage = rendersAsPage(tab);
+  const live = running.has(tab.id);
+  const runBtn = (asPage && dm === 'view') ? el('button', {
+    onClick: () => {
+      if (live) running.delete(tab.id); else running.add(tab.id);
+      setState({});
+    },
+    title: live
+      ? 'This document is running its own scripts, in a frame with no origin and no network. Stop discards it.'
+      : "Run this document's own scripts. It stays sandboxed: no origin, no network, nothing loaded from anywhere.",
+    style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:'
+      + (live ? 'var(--secondary)' : 'transparent')
+      + ';color:' + (live ? 'var(--warning)' : 'var(--muted-foreground)')
+      + ';border:1px solid ' + (live ? 'var(--warning)' : 'var(--border)'),
+    hover: 'border-color:var(--ring)',
+  }, iv(live ? '● scripts running — stop' : 'run scripts')) : null;
+
   const revertBtn = dirty ? el('button', {
     onClick: () => revert(tab),
     style: 'font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground)',
@@ -597,13 +807,25 @@ export function mountDoc(host, tab) {
   const modeBar = el('div', {
     style: 'flex:none;display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
   },
-    modeBtns, normBtn, saveBtn, revertBtn,
+    modeBtns, normBtn, saveBtn, revertBtn, runBtn,
     FIXTURE || dm !== 'view' ? null : el('button', {
       onClick: () => setState((s) => ({ docNarrow: { ...(s.docNarrow || {}), [tab.id]: !narrowOf(tab) } })),
       style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground)',
       hover: 'color:var(--foreground)', 'data-r1': 'measure',
       title: narrowOf(tab) ? 'use the full width of the tab' : 'limit lines to a 72-character reading measure',
     }, iv(narrowOf(tab) ? '↔ full width' : '⇥ 72ch')),
+    canAlign(tab) ? el('button', {
+      onClick: () => {
+        if (alignOpen.has(tab.id)) alignOpen.delete(tab.id);
+        else { alignOpen.add(tab.id); claims.delete(wsOf(tab)); }    // opening reads the record afresh
+        setState({});
+      },
+      style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:'
+        + (alignOpen.has(tab.id) ? 'var(--secondary)' : 'transparent') + ';border:1px solid '
+        + (alignOpen.has(tab.id) ? 'var(--brand)' : 'var(--border)') + ';color:var(--foreground)',
+      hover: 'border-color:var(--ring)', 'data-r29': 'align-toggle', 'data-open': alignOpen.has(tab.id) ? 'yes' : 'no',
+      title: 'Show the documents with a concrete tie to this one, from the last consistency check.',
+    }, 'alignment') : null,
     el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:' + dirtyColor }, iv(dirtyLabel)),
   );
 
@@ -619,9 +841,15 @@ export function mountDoc(host, tab) {
     if (body.defaultValue !== text) body.defaultValue = text;
     if (body.value !== text) body.value = text;
   } else if (!FIXTURE && (extOfPath(tab.path) === 'csv' || extOfPath(tab.path) === 'tsv')) body = gridBody(tab, text);
-  else body = rendersAsPage(tab) ? htmlFrame(tab, text) : (nonMd && !unread.has(docKey(tab)) ? sourceBody(tab, text) : viewBody(tab, text));
-
-  setChildren(host, [modeBar, body]);
+  else body = asPage ? htmlFrame(tab, text, live) : (nonMd && !unread.has(docKey(tab)) ? sourceBody(tab, text) : viewBody(tab, text));
+
+  /* The drawer, when open, lies over the right of the pane; the bar and the body give it room. The
+   * margin is written on every paint so a closed drawer leaves no gap behind on a kept node. */
+  const drawerOn = canAlign(tab) && alignOpen.has(tab.id);
+  host.style.position = drawerOn ? 'relative' : '';
+  modeBar.style.marginRight = drawerOn ? ALIGN_W : '';
+  body.style.marginRight = drawerOn ? ALIGN_W : '';
+  setChildren(host, drawerOn ? [modeBar, body, alignDrawer(tab)] : [modeBar, body]);
   return host;
 }
 

package/workspace/public/pm/tab-term.js

@@ -913,8 +913,18 @@ export function disposeTerm(tab) {
     send({ t: 'detach', id: rec.sessionId });
     SOCK.attached.delete(rec.sessionId);
   }
-  try { rec.term.dispose(); } catch { /* already gone */ }
   if (rec.host && rec.host.parentNode) rec.host.parentNode.removeChild(rec.host);
+  /* DISPOSE ONE FRAME LATER, NOT NOW. `attached` calls `term.reset()`, and xterm 5's Viewport.reset()
+   * queues a requestAnimationFrame that reads the renderer's dimensions — a callback dispose() does
+   * not cancel. A tab closed inside that frame (a fast close, or a `tabs` replace that drops a
+   * terminal whose session has just attached) disposed the renderer first, and the queued callback
+   * then threw "Cannot read properties of undefined (reading 'dimensions')" as an uncaught page
+   * error, about half the runs of pm-term-test.js. Queued after it, this dispose runs after every
+   * callback xterm has already queued, against a renderer that still exists. The pane is already
+   * out of the document and out of `panes`, so nothing can draw into it or re-attach it meanwhile. */
+  const term = rec.term;
+  const later = typeof requestAnimationFrame === 'function' ? requestAnimationFrame : (f) => setTimeout(f, 0);
+  later(() => { try { term.dispose(); } catch { /* already gone */ } });
 }
 
 /**

package/workspace/public/pm/tokens.css

@@ -72,6 +72,7 @@ a{color:oklch(0.623 0.214 259.815)}a:hover{color:oklch(0.72 0.19 259.8)}
 button{font:inherit;color:inherit;background:none;border:0;cursor:pointer;text-align:left;padding:0}
 input,textarea{font:inherit;color:inherit;background:none;border:0;outline:none;padding:0;resize:none}
 /* overhaul-r1 R4: a collapsed-rail glyph draws its initials and kind badge from data attributes, so
-   the rail's text stays `repositories ⟩` and the glyph names itself through aria-label */
-[data-r1="rail-glyph"]::before{content:attr(data-ini)}
-[data-r1="rail-glyph"]::after{content:attr(data-kind);position:absolute;right:-2px;bottom:-3px;font-size:8px;line-height:1;color:var(--muted-foreground)}
+   the rail's text stays `repositories ⟩` and the glyph names itself through aria-label. The cockpit rail's tiles
+   (`data-rail`) carry the same hooks for the suites but draw their initial as text, so the glyph rule skips them. */
+[data-r1="rail-glyph"]:not([data-rail])::before{content:attr(data-ini)}
+[data-r1="rail-glyph"]:not([data-rail])::after{content:attr(data-kind);position:absolute;right:-2px;bottom:-3px;font-size:8px;line-height:1;color:var(--muted-foreground)}

package/workspace/public/pm/view-addrepo.js

@@ -0,0 +1,207 @@
+/* pm/view-addrepo.js — the Add repository view tab, drawn from planning/design/cockpit-mockup/ViewAddRepo.dc.html.
+ *
+ * PRD workspace-cockpit-nav, Run 3 (R10, done-criterion 3). The board is a header, three steps (Choose, Review the scan,
+ * Confirm), the scan's source line, a review table of the proposed initiatives, a note and the actions.
+ *
+ * It drives the existing add-repository flow and adds no new one:
+ *   - Choose is the existing form (panel-repos.js `addProductBody`, the `addprod` detail body): the source switch, the GitHub
+ *     reference or the local folder with its chooser, the "connect + ingest" and "add product" buttons and the ingest log. Its
+ *     nodes are placed in the board's frame as they are, so every handler and the shared state keys (addSrc, addRepo, addPath,
+ *     addLog) behave as in the detail. A local folder is registered at once and needs no review.
+ *   - Review the scan is the server's repo ingest: GET /api/ingest lists the open proposals the clone-and-scan produced, and
+ *     each row is decided one at a time with POST /api/ingest/confirm (with the anchor) or POST /api/ingest/dismiss. The
+ *     server refuses a bulk confirm by design ("the tedium is the gate"), so the board's tick boxes and "Import 2 selected"
+ *     are drawn as one Confirm per row. A guessed anchor is written only on an explicit "Accept the guess".
+ *   - Confirm is on when every row of the proposal has been decided.
+ * The board's Lane column is not drawn: the scan does not read a lane. "Dismiss scan" has no route (only per-row dismiss), so it
+ * is not drawn. In the fixture the form runs its scripted ingest and the review is not read.
+ */
+import { el } from './dom.js';
+import { addProductBody } from './panel-repos.js';
+
+const BTN = 'font:500 12.5px var(--sans);background:transparent;color:var(--foreground);border:1px solid var(--input);border-radius:8px;padding:0 12px;height:30px;min-height:30px;display:inline-grid;place-items:center;cursor:pointer;flex:none;white-space:nowrap';
+const BTNP = 'font:500 12.5px var(--sans);background:var(--foreground);color:var(--background);border:0;border-radius:8px;padding:0 12px;height:30px;min-height:30px;display:inline-grid;place-items:center;cursor:pointer;flex:none;white-space:nowrap';
+const BADGE = 'font:500 11px var(--sans);border:1px solid var(--border);border-radius:999px;padding:0 8px;line-height:18px;white-space:nowrap;display:inline-block';
+const TONE = {
+  s: ';border-color:transparent;background:color-mix(in oklab, var(--success) 16%, transparent);color:var(--success)',
+  w: ';border-color:transparent;background:color-mix(in oklab, var(--warning) 16%, transparent);color:var(--warning)',
+  d: ';color:var(--destructive)',
+};
+const TH = 'font:500 10px var(--mono);letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground);text-align:left;padding:10px 14px;border-bottom:1px solid var(--border)';
+const TD = 'padding:10px 14px;border-bottom:1px solid var(--border);font-size:13px;vertical-align:middle';
+const NOTE = 'color:var(--muted-foreground);font-size:13px;line-height:1.5';
+const FRAME = 'border:1px solid var(--border);border-radius:10px;overflow:hidden;background:var(--background)';
+const INPUT = 'font:12px var(--mono);padding:0 9px;height:30px;min-height:30px;border:1px solid var(--input);border-radius:8px;background:transparent;color:var(--foreground);width:150px;box-sizing:border-box';
+
+const badge = (text, tone, attrs) => el('span', { ...(attrs || {}), style: BADGE + (tone ? TONE[tone] : '') }, String(text));
+
+/** Open the Add repository view. Used by the rail's add tile and by anything else that offers "add a repository". */
+export async function openAddRepo() {
+  const m = await import('./panel-cockpit.js');
+  if (m.VIEWS && m.VIEWS.addrepo) { m.openView('addrepo'); return true; }
+  const r = await import('./panel-repos.js');
+  r.onAddProduct();
+  return false;
+}
+
+/* ── the ingest proposals: one read, read again after 15 seconds, or every 2.5 seconds while a scan runs ───────── */
+let ing = { state: 'idle', data: null, error: null, at: 0 };
+let pick = null;            // the proposal id the PM chose, when there are several
+let say = null;             // { tone: 'ok'|'bad', text } — what the last row action did
+let lastLog = -1;           // the ingest log's length at the last draw: a new line means the form did something
+let tick = null;
+
+const running = (pr) => pr && (pr.stage === 'acquire' || pr.stage === 'scan');
+
+function proposals(ctx) {
+  const ttl = ing.data && (ing.data.proposals || []).some(running) ? 2500 : 15000;
+  if (ing.state !== 'loading' && (ing.state === 'idle' || Date.now() - ing.at > ttl)) {
+    ing = { ...ing, state: 'loading' };
+    fetch('/api/ingest').then((r) => r.json()).then(
+      (d) => { ing = { state: d && d.ok === false ? 'error' : 'ok', data: d, error: d && d.error, at: Date.now() }; },
+      (e) => { ing = { state: 'error', data: ing.data, error: (e && e.message) || String(e), at: Date.now() }; },
+    ).finally(() => ctx.setState({}));
+  }
+  if (!tick && ing.data && (ing.data.proposals || []).some(running)) {
+    tick = setTimeout(() => { tick = null; ctx.setState({}); }, 2600);
+  }
+  return ing;
+}
+
+async function act(ctx, url, body, done) {
+  let out;
+  try { out = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }).then((r) => r.json()); }
+  catch (e) { out = { ok: false, error: (e && e.message) || String(e) }; }
+  say = !out || out.ok === false ? { tone: 'bad', text: (out && out.error) || 'the server did not answer. Nothing was written.' } : { tone: 'ok', text: done(out) };
+  ing = { ...ing, state: 'idle' };
+  ctx.setState({});
+}
+
+const confirmRow = (ctx, pr, row, anchor) => {
+  const a = String(anchor || '').trim();
+  if (!a) { say = { tone: 'bad', text: 'Type an anchor first: a KR id or health:<id>.' }; ctx.setState({}); return; }
+  act(ctx, '/api/ingest/confirm', { id: pr.id, item: row.id, anchor: a },
+    (o) => row.id + ': parent_kr: ' + a + ' written into ' + o.path + '. ' + (o.resolver_note || ''));
+};
+const dismissRow = (ctx, pr, row) => act(ctx, '/api/ingest/dismiss', { id: pr.id, item: row.id }, () => row.id + ' dismissed. Nothing was written.');
+
+function sourceBadge(row) {
+  if (row.disposition === 'confirmed') return badge('confirmed by you', 's', { 'data-board-badge': 'confirmed' });
+  if (row.disposition === 'dismissed') return badge('dismissed', null, { 'data-board-badge': 'dismissed' });
+  if (row.anchor_state === 'declared') return badge('declared by the repository', 's', { 'data-board-badge': 'declared' });
+  if (row.anchor_state === 'guessed') return badge('guessed from prose, not declared', 'w', { 'data-board-badge': 'guessed' });
+  return badge('will be rejected (D59)', 'd', { 'data-board-badge': 'none' });
+}
+
+function anchorCell(row) {
+  if (row.disposition === 'confirmed') return el('span', { style: 'font:12px var(--mono)' }, String(row.anchor_value || ''));
+  if (row.anchor_state === 'declared') return el('span', { style: 'font:12px var(--mono)' }, String(row.anchor_value));
+  if (row.anchor_state === 'guessed') return el('span', { style: 'font:12px var(--mono);color:var(--warning)' }, String(row.anchor_value) + ' ?');
+  return el('span', { style: 'color:var(--destructive)' }, 'no anchor');
+}
+
+function actionsCell(ctx, pr, row) {
+  if (row.disposition && row.disposition !== 'open') return null;
+  const parts = [];
+  if (row.anchor_state === 'declared') {
+    parts.push(el('button', { 'data-board-action': 'confirm', style: BTNP, title: 'write the declared anchor into the record', onClick: () => confirmRow(ctx, pr, row, row.anchor_value) }, 'Confirm'));
+  } else {
+    const input = el('input', { 'data-board-input': 'anchor', placeholder: 'KR id or health:<id>', style: INPUT, 'aria-label': 'anchor for ' + row.id });
+    parts.push(input);
+    parts.push(el('button', { 'data-board-action': 'confirm', style: BTN, hover: 'background:var(--accent)', title: 'write the anchor you typed into the record', onClick: () => confirmRow(ctx, pr, row, input.value) }, 'Confirm'));
+    if (row.anchor_state === 'guessed') {
+      parts.push(el('button', { 'data-board-action': 'accept-guess', style: BTN, hover: 'background:var(--accent)', title: 'you accept the guess: it is written as the anchor', onClick: () => confirmRow(ctx, pr, row, row.anchor_value) }, 'Accept the guess'));
+    }
+  }
+  parts.push(el('button', { 'data-board-action': 'dismiss', style: BTN, hover: 'background:var(--accent)', title: 'leave this record out; nothing is written', onClick: () => dismissRow(ctx, pr, row) }, 'Dismiss'));
+  return el('div', { style: 'display:flex;gap:6px;align-items:center;justify-content:flex-end;flex-wrap:wrap' }, parts);
+}
+
+/** The review for one proposal: the source line, the table and the note. */
+function review(ctx, pr) {
+  const rows = pr.initiatives || [];
+  const adrs = pr.adrs || [];
+  const decided = rows.filter((r) => r.disposition && r.disposition !== 'open').length;
+  const confirmed = rows.filter((r) => r.disposition === 'confirmed').length;
+  let summary;
+  if (running(pr)) summary = (pr.stage === 'acquire' ? 'cloning' : 'scanning') + ' …';
+  else if (pr.ok === false) summary = 'the scan did not finish: ' + (pr.error || 'no reason given');
+  else summary = 'found ' + rows.length + (rows.length === 1 ? ' initiative record' : ' initiative records') + ' and ' + adrs.length + (adrs.length === 1 ? ' decision' : ' decisions') + '. '
+    + (confirmed ? confirmed + ' confirmed.' : 'Nothing imported yet.');
+  const line = el('div', { 'data-board-part': 'source', style: 'display:flex;align-items:center;gap:10px;flex-wrap:wrap' },
+    badge((pr.source && pr.source.kind) || 'github', null, { 'data-board-badge': 'source' }),
+    el('span', { style: 'font:13px var(--mono)' }, String((pr.source && pr.source.ref) || pr.id)),
+    el('span', { 'data-board-summary': '', style: 'color:' + (pr.ok === false && !running(pr) ? 'var(--destructive)' : 'var(--muted-foreground)') }, summary));
+  const out = [line];
+  if (rows.length) {
+    out.push(el('div', { 'data-board-section': 'review', style: FRAME + ';overflow-x:auto' },
+      el('table', { style: 'width:100%;border-collapse:collapse' },
+        el('thead', null, el('tr', null, ['Initiative', 'Anchor', 'Source of the anchor', ''].map((h) => el('th', { style: TH }, h)))),
+        el('tbody', null, rows.map((row) => el('tr', { 'data-board-row': row.id, 'data-disposition': row.disposition || 'open', 'data-anchor-state': row.anchor_state || 'none' },
+          el('td', { style: TD }, el('b', null, String(row.id)), el('div', { style: 'font:11px var(--mono);color:var(--muted-foreground);overflow-wrap:anywhere' }, String(row.path || ''))),
+          el('td', { style: TD }, anchorCell(row)),
+          el('td', { style: TD }, sourceBadge(row)),
+          el('td', { style: TD + ';text-align:right' }, actionsCell(ctx, pr, row))))))));
+    out.push(el('div', { 'data-board-part': 'review-note', style: NOTE },
+      'Guessed anchors are never written as declared. Accept one only if you agree with the guess, or fix it in the repository first. '
+      + 'Each row is confirmed on its own. ' + decided + ' of ' + rows.length + ' decided.'
+      + (adrs.length ? ' ' + adrs.length + (adrs.length === 1 ? ' decision' : ' decisions') + ' found in the scan.' : '')));
+  }
+  return out;
+}
+
+export function renderBoard(inner, ctx) {
+  const { FIXTURE, state } = ctx;
+
+  // 1 · Choose: the existing form, as it is. Its own title is the board's header now, so it is hidden, not removed.
+  const formNodes = addProductBody();
+  if (formNodes[0]) { formNodes[0].style.display = 'none'; formNodes[0].setAttribute('data-board-source', 'form-title'); }
+  const form = el('div', { 'data-board-section': 'choose', 'data-addprod': 'form', style: FRAME + ';display:flex;flex-direction:column;max-width:760px' }, formNodes);
+
+  // a new line in the ingest log means the form started something: read the proposals again
+  const logLen = ((state && state.addLog) || []).length;
+  if (logLen !== lastLog) { if (lastLog !== -1) ing = { ...ing, state: ing.state === 'loading' ? 'loading' : 'idle' }; lastLog = logLen; }
+
+  // 2 · Review the scan
+  let list = [];
+  let reviewParts = [];
+  if (FIXTURE) {
+    reviewParts = [el('div', { 'data-board-empty': '', style: NOTE }, 'The scan review is not read in the fixture. The form above runs its scripted ingest.')];
+  } else {
+    const r = proposals(ctx);
+    list = (r.data && r.data.proposals) || [];
+    if (r.state === 'error' && !list.length) reviewParts = [el('div', { style: NOTE + ';color:var(--destructive)' }, 'The scans could not be read: ' + (r.error || 'error'))];
+    else if (!r.data) reviewParts = [el('div', { style: NOTE }, 'Reading the scans …')];
+    else if (!list.length) reviewParts = [el('div', { 'data-board-empty': '', style: NOTE }, 'No scan is waiting for review. Give a GitHub repository above and press connect + ingest. A local folder is added at once.')];
+    else {
+      if (!list.some((p) => p.id === pick)) pick = list[list.length - 1].id;
+      if (list.length > 1) {
+        reviewParts.push(el('div', { 'data-board-part': 'scans', style: 'display:flex;gap:6px;flex-wrap:wrap' },
+          list.map((p) => el('button', { 'data-board-scan': p.id, 'aria-pressed': p.id === pick ? 'true' : 'false',
+            style: BTN + (p.id === pick ? ';background:var(--accent);border-color:var(--brand)' : ''), onClick: () => { pick = p.id; say = null; ctx.setState({}); } },
+          String((p.source && p.source.ref) || p.id)))));
+      }
+      reviewParts.push(...review(ctx, list.find((p) => p.id === pick)));
+    }
+  }
+  if (say) reviewParts.push(el('div', { 'data-board-part': 'action-note', style: NOTE + (say.tone === 'bad' ? ';color:var(--destructive)' : '') }, say.text));
+
+  // the steps: Choose until a scan is open, Review while a row is undecided, Confirm when every row is decided
+  const cur = list.find((p) => p.id === pick) || null;
+  const rows = (cur && cur.initiatives) || [];
+  const step = !cur ? 1 : rows.length && rows.every((r) => r.disposition && r.disposition !== 'open') ? 3 : 2;
+  const stepEl = (n, label) => el('span', { 'data-board-step': String(n), 'data-on': n === step ? '1' : '0', style: 'display:flex;align-items:center;gap:8px;color:' + (n === step ? 'var(--foreground)' : 'var(--muted-foreground)') },
+    el('b', { style: 'display:grid;place-items:center;width:22px;height:22px;border-radius:50%;font:500 11px var(--mono);border:1px solid ' + (n === step ? 'var(--brand);background:var(--brand);color:var(--background)' : 'var(--input)') }, String(n)),
+    label);
+
+  const header = el('div', { 'data-board-part': 'header' },
+    el('div', { 'data-board-title': '', style: 'font:600 22px var(--sans);line-height:1.45' }, 'Add repository'),
+    el('div', { 'data-board-subtitle': '', style: 'color:var(--muted-foreground)' }, 'The scan proposes. It never decides, and it writes nothing until you confirm.'));
+
+  inner.appendChild(el('div', { 'data-board': 'addrepo', style: 'display:flex;flex-direction:column;gap:14px;padding:4px 6px;font-size:13px;line-height:1.45;color:var(--foreground)' },
+    header,
+    el('div', { 'data-board-part': 'steps', style: 'display:flex;gap:24px;flex-wrap:wrap' }, stepEl(1, 'Choose'), stepEl(2, 'Review the scan'), stepEl(3, 'Confirm')),
+    form,
+    el('div', { style: 'font-weight:600' }, 'Review the scan'),
+    el('div', { 'data-board-part': 'review', style: 'display:flex;flex-direction:column;gap:12px' }, reviewParts)));
+}