create-pmos 0.47.0 → 0.48.0

package/workspace/public/pm/view-validate.js

@@ -0,0 +1,171 @@
+/* pm/view-validate.js — the Validate view, drawn from planning/design/cockpit-mockup/ViewValidate.dc.html.
+ *
+ * PRD workspace-cockpit-nav, Run 3 (R4). The board is a header with two actions on the right, a row of five stat cards, a
+ * table of findings and a closing note. The content is the view's existing list (modes-live.js `validateList`): this module
+ * draws it into a host and arranges its parts into the board. No node is removed and no text is changed, so every `data-r19`,
+ * `data-r22` and `data-r24` hook and every live behaviour stays as it was. Only the frame is new.
+ *
+ * Where each part comes from:
+ *  - The two header actions are the list's own buttons, moved: "check now" (`data-r22="check"`, the local consistency check)
+ *    and "show what would be sent" (`data-r19="plan"`, the first step of a TypeSafe run). Their labels are kept because the
+ *    verdict line and the guide page name them.
+ *  - The stat cards count the findings of the last TypeSafe run by rule (`broken-link`, `stale-after-passed`,
+ *    `workflow-sweep`, `withheld-by-secret-scan`), read off the rows the list drew, so a card and the table always agree.
+ *    The consent card reads `data-r19="consent-state"`. When no run exists, or the read has not answered, a card says so.
+ *  - The table is the run's finding rows (`data-r19="finding"`), restyled as a grid. The board's "Status" column has no
+ *    backing (a finding has no open or closed state), so the table shows the finding's severity instead.
+ *  - The local consistency check and the TypeSafe settings have no place on the board. They are kept below the table as
+ *    two cards, unchanged inside.
+ * In the fixture the list is empty, and the board says that validation is not read there.
+ */
+import { el } from './dom.js';
+
+const BTN = 'font:500 12.5px var(--sans);background:transparent;color:var(--foreground);border:1px solid var(--input);border-radius:8px;padding:0 12px;height:30px;min-height:30px;display:inline-grid;place-items:center;cursor:pointer;flex:none';
+const BTNP = 'font:500 12.5px var(--sans);background:var(--foreground);color:var(--background);border:0;border-radius:8px;padding:0 12px;height:30px;min-height:30px;display:inline-grid;place-items:center;cursor:pointer;flex:none';
+const BADGE = 'font:500 11px var(--sans);border:1px solid var(--border);border-radius:999px;padding:0 8px;line-height:18px;white-space:nowrap;display:inline-block';
+const TONE = {
+  s: ';border-color:transparent;background:color-mix(in oklab, var(--success) 16%, transparent);color:var(--success)',
+  w: ';border-color:transparent;background:color-mix(in oklab, var(--warning) 16%, transparent);color:var(--warning)',
+  d: ';border-color:transparent;background:color-mix(in oklab, var(--destructive) 18%, transparent);color:var(--destructive)',
+};
+const STAT = 'flex:1 1 150px;min-width:0;border:1px solid var(--border);background:var(--background);border-radius:10px;padding:12px 14px';
+const TH = 'font:500 10px var(--mono);letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground);text-align:left';
+const COLS = 'display:grid;grid-template-columns:minmax(0,2.4fr) minmax(0,1fr) 92px minmax(0,1.3fr);gap:0 14px;align-items:center';
+const CARD = 'border:1px solid var(--border);border-radius:10px;background:var(--background);padding:4px 0 8px;overflow:hidden';
+const CARD_HEAD = 'padding:12px 14px 2px;font:600 15px var(--sans);color:var(--foreground)';
+const LBL = 'font:500 10px var(--mono);letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground)';
+const NOTE = 'color:var(--muted-foreground);font-size:13px;line-height:1.5';
+
+const badge = (text, tone) => el('span', { style: BADGE + (tone ? TONE[tone] : '') }, String(text));
+
+/** The board's stat cards. `kind` is what the card counts; the counts come from the rows the list drew. */
+const STATS = [
+  { key: 'broken', label: 'Broken links', rule: 'broken-link', tone: 'var(--destructive)' },
+  { key: 'stale', label: 'Stale documents', rule: 'stale-after-passed', tone: 'var(--warning)' },
+  { key: 'workflow', label: 'Workflow defects', rule: 'workflow-sweep', tone: 'var(--warning)' },
+  { key: 'withheld', label: 'Withheld (credential shape)', rule: 'withheld-by-secret-scan', tone: null },
+];
+
+/** What the list says about the last run: 'run' (the coverage line is drawn), 'none' (no run), or 'unread'. */
+function runState(wrap) {
+  if (!wrap) return 'unread';
+  if (wrap.querySelector('[data-r19="coverage"]')) return 'run';
+  if (wrap.querySelector('[data-r19="no-run"]')) return 'none';
+  return 'unread';
+}
+
+function stats(wrap) {
+  const run = runState(wrap);
+  const rows = wrap ? [...wrap.querySelectorAll('[data-r19="finding"]')] : [];
+  const cards = STATS.map((s) => {
+    const n = rows.filter((r) => r.getAttribute('data-rule') === s.rule).length;
+    const value = run === 'run'
+      ? el('div', { 'data-board-value': String(n), style: 'font:600 24px var(--sans);line-height:1.3;color:' + (n > 0 && s.tone ? s.tone : 'var(--foreground)') }, String(n))
+      : el('div', { 'data-board-value': run, style: 'margin-top:6px' }, badge(run === 'none' ? 'no run yet' : 'not read'));
+    return el('div', { 'data-board-stat': s.key, style: STAT }, el('div', { style: 'color:var(--muted-foreground)' }, s.label), value);
+  });
+  const cs = wrap ? wrap.querySelector('[data-r19="consent-state"]') : null;
+  const txt = cs ? cs.textContent || '' : '';
+  const consent = !cs ? badge('not read') : /\bON\b/.test(txt) ? badge('given', 's') : badge('not given', 'w');
+  cards.push(el('div', { 'data-board-stat': 'consent', 'data-board-value': !cs ? 'unread' : /\bON\b/.test(txt) ? 'given' : 'not-given', style: STAT },
+    el('div', { style: 'color:var(--muted-foreground)' }, 'Jev consent'), el('div', { style: 'margin-top:6px' }, consent)));
+  return el('div', { 'data-board-part': 'stats', style: 'display:flex;gap:14px;flex-wrap:wrap' }, cards);
+}
+
+/** Split the list's children at its section labels. The labels are fixed text in modes-live.js. */
+function sections(wrap) {
+  const kids = [...wrap.children];
+  const at = (re) => kids.findIndex((k) => re.test((k.textContent || '').trim()));
+  const iT = at(/^typesafe \(jev\)/i);
+  const iF = at(/^4 · findings/);
+  const end = (i, fallback) => (i < 0 ? fallback : i);
+  return {
+    consistency: kids.slice(0, end(iT, end(iF, kids.length))),
+    typesafe: iT < 0 ? [] : kids.slice(iT, end(iF, kids.length)),
+    findings: iF < 0 ? [] : kids.slice(iF),
+  };
+}
+
+/** Restyle one finding row as a table row. Only styles change: the row keeps its nodes, text, hooks and click. */
+function asTableRow(row) {
+  row.setAttribute('style', COLS + ';width:100%;box-sizing:border-box;padding:10px 14px;text-align:left;border-bottom:1px solid var(--border);font-size:13px;color:var(--foreground);cursor:pointer;min-height:40px');
+  const [head, files] = row.children;
+  if (files) files.setAttribute('style', 'order:0;font:12px var(--mono);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0;color:var(--foreground)');
+  if (head) {
+    head.setAttribute('style', 'display:contents');
+    const [sev, rule, meta] = head.children;
+    if (rule) rule.setAttribute('style', 'order:1;font-size:13px;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap');
+    if (sev) {
+      const v = (sev.textContent || '').trim();
+      const tone = v === 'high' ? TONE.d : v === 'medium' ? TONE.w : '';
+      sev.setAttribute('style', 'order:2;justify-self:start;' + BADGE + tone);
+    }
+    if (meta) meta.setAttribute('style', 'order:3;font:11px var(--mono);color:var(--muted-foreground);min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap');
+  }
+  row.setAttribute('data-board-row', 'finding');
+}
+
+function findingsSection(parts) {
+  const [label, ...rest] = parts;
+  if (label) label.setAttribute('style', LBL + ';padding:0 2px');
+  const rows = rest.filter((n) => n.getAttribute && n.getAttribute('data-r19') === 'finding');
+  const notes = rest.filter((n) => !rows.includes(n));
+  for (const n of notes) {
+    const tone = /color:var\(--destructive\)/.test(n.getAttribute('style') || '') ? ';color:var(--destructive)' : '';
+    n.setAttribute('style', NOTE + tone + ';padding:0 2px');
+  }
+  rows.forEach(asTableRow);
+  const table = rows.length
+    ? el('div', { 'data-board-part': 'table', style: 'border:1px solid var(--border);border-radius:10px;overflow:hidden;background:var(--background)' },
+      el('div', { 'data-board-part': 'table-head', style: COLS + ';padding:10px 14px;border-bottom:1px solid var(--border)' },
+        el('span', { style: TH }, 'File and finding'), el('span', { style: TH }, 'Rule'), el('span', { style: TH }, 'Severity'), el('span', { style: TH }, 'Checked by')),
+      rows)
+    : null;
+  return el('div', { 'data-board-section': 'findings', style: 'display:flex;flex-direction:column;gap:8px' }, label || null, notes, table);
+}
+
+function card(key, title, parts) {
+  if (!parts.length) return null;
+  return el('div', { 'data-board-section': key, style: CARD }, el('div', { style: CARD_HEAD }, title), parts);
+}
+
+export function renderBoard(inner, ctx) {
+  const { FIXTURE, state } = ctx;
+  const repo = state.product || null;
+
+  const toolbar = el('div', { 'data-board-part': 'toolbar', style: 'display:flex;gap:8px;flex-wrap:wrap;align-items:center' });
+  const header = el('div', { 'data-board-part': 'header', style: 'display:flex;justify-content:space-between;align-items:flex-end;gap:12px;flex-wrap:wrap' },
+    el('div', null,
+      el('div', { 'data-board-title': '', style: 'font:600 22px var(--sans);line-height:1.45' }, 'Validate documents'),
+      el('div', { 'data-board-subtitle': '', style: 'color:var(--muted-foreground)' },
+        'Local checks first. Nothing is sent anywhere until you consent for ' + (repo ? repo : 'this repository') + '.')),
+    toolbar);
+
+  const host = el('div', { 'data-board-section': 'list', style: 'display:flex;flex-direction:column;gap:14px' });
+  ctx.renderMode(host);
+  const wrap = host.querySelector('[data-r19="validate"]');
+
+  let statRow = null;
+  if (FIXTURE) {
+    statRow = el('div', { 'data-board-part': 'stats', style: NOTE }, 'Validation is not read in the fixture.');
+  } else if (wrap) {
+    statRow = stats(wrap);
+    // the two header actions are the list's own buttons, moved, so their hooks and presses stay as they were
+    const check = wrap.querySelector('[data-r22="check"]');
+    const plan = wrap.querySelector('[data-r19="plan"]');
+    if (check) { check.setAttribute('style', BTN); toolbar.appendChild(check); }
+    if (plan) { plan.setAttribute('style', BTNP); toolbar.appendChild(plan); }
+    const s = sections(wrap);
+    wrap.setAttribute('style', 'display:flex;flex-direction:column;gap:14px;padding:0');
+    const findings = s.findings.length ? findingsSection(s.findings) : null;
+    const foot = el('div', { 'data-board-part': 'note', style: NOTE }, 'Findings never edit a file. You decide what to fix.');
+    const cons = card('consistency', 'Consistency of this repository', s.consistency);
+    const ts = card('typesafe', 'TypeSafe (Jev)', s.typesafe);
+    // the consistency card keeps its own label, which the card head now says
+    if (s.consistency[0] && /^consistency of this repository/.test((s.consistency[0].textContent || '').trim())) s.consistency[0].style.display = 'none';
+    for (const n of [findings, foot, cons, ts]) if (n) wrap.appendChild(n);
+  }
+
+  inner.appendChild(el('div', { 'data-board': 'validate', style: 'display:flex;flex-direction:column;gap:14px;padding:4px 6px;font-size:13px;line-height:1.45;color:var(--foreground)' },
+    header, statRow, host));
+}

package/workspace/server.js

@@ -20,6 +20,12 @@
  * under state/ (the reconcile seam). Request headers are never logged (D08).
  */
 'use strict';
+// The workspace reads git in the background (repo-watch, git-info, claims), and a plain `git status` takes the index lock to
+// refresh the index. A press that writes, such as Sync's `git add`, then fails on `index.lock: File exists` when the two
+// meet. With optional locks off, the server's reads never take that lock. Set only when the PM has not set it, and taken back
+// out of every terminal session's environment (sessionEnv), so the PM's own shells and agents are unchanged.
+const SET_GIT_OPTIONAL_LOCKS = process.env.GIT_OPTIONAL_LOCKS === undefined;
+if (SET_GIT_OPTIONAL_LOCKS) process.env.GIT_OPTIONAL_LOCKS = '0';
 const http = require('http');
 const fs = require('fs');
 const os = require('os');
@@ -65,9 +71,15 @@ const { createSinkGuard } = require('./lib/sink.js');
 const tsSettings = require('./lib/typesafe-settings.js');
 const sessionFlag = require('./lib/session-flag');   // PMOS_WORKSPACE=1 in each agent terminal (cockpit mod, M12)
 const tsClient = require('./lib/typesafe.js');
+const jevRoute = require('./lib/jev-route.js');     // prompt-model-routing — the bridge between prompt routing and the one TypeSafe module
 const jevClaims = require('./lib/jev-claims.js');   // D80 — the bridge between the claims ledger and the one TypeSafe module
+const jevCategorize = require('./lib/jev-categorize.js');   // D82 — the bridge between the document categorizer and the one TypeSafe module
 const validateLib = require('./lib/validate.js');
+const liveNotes = require('./lib/live-notes.js');   // jev-live-notes — reads and appends a repository's live-notes ledger; no network
 const claimsLib = require('./lib/claims.js');
+const docCategory = require('./lib/doc-category.js');   // jev-doc-categorizer Run 1 — the PM-facing kind of a document, derived, local, no model
+const docCatCorrections = require('./lib/doc-category-corrections.js');   // jev-doc-categorizer Run 3 — the PM's own category, per user, outside the repository
+const docCatWriteback = require('./lib/doc-category-writeback.js');       // …and the separate press that writes it into the file's frontmatter
 const repoWatch = require('./lib/repo-watch.js');
 tsSettings.adoptEnv(process.env);   // D79 — take the env key into memory and delete it, before anything is spawned
 const scheduleLogic = require('./lib/schedule-logic');
@@ -278,6 +290,7 @@ function sessionEnv() {
   // D79 — the TypeSafe key is the workspace server's own credential. A terminal runs an agent that can
   // print its environment, so the key is never handed to one, whether it came from settings or the shell.
   delete env[tsSettings.ENV_NAME];
+  if (SET_GIT_OPTIONAL_LOCKS) delete env.GIT_OPTIONAL_LOCKS;
   return env;
 }
 
@@ -1536,6 +1549,85 @@ function stampEdit(text, at) {
   const next = fm.replace(re, `generated: {by: human:wawan, at: "${at}"}`);
   return next === fm ? text : text.replace(fm, () => next);
 }
+// ── Document category (jev-doc-categorizer Run 1) ───────────────────────────────────────────────────
+// A derived label beside the document's own `type`: local rules only, no model, nothing written. The library lists it with the
+// basis that decided it, so the PM can see why. A file is read once per modification; only its first 16 KB is needed, because
+// the evidence is the frontmatter, the name and the headings.
+const catCache = new Map();
+function categoryInput(full) {
+  let st; try { st = fs.statSync(full); } catch { return null; }
+  const hit = catCache.get(full);
+  if (hit && hit.m === st.mtimeMs) return hit;
+  let text = '';
+  try { const fd = fs.openSync(full, 'r'); const buf = Buffer.alloc(16384); const n = fs.readSync(fd, buf, 0, 16384, 0); fs.closeSync(fd); text = buf.slice(0, n).toString('utf8'); } catch { return null; }
+  let fm = {}; try { fm = relatedDocs.frontmatter(text) || {}; } catch { /* no frontmatter */ }
+  const ent = { m: st.mtimeMs, fm, text };
+  catCache.set(full, ent);
+  return ent;
+}
+function namedRecords(root) {
+  const records = [];
+  for (const rel of ['planning/initiatives', 'pmos/state/initiatives', 'state/initiatives']) {
+    const d = path.join(root, ...rel.split('/'));
+    let names = []; try { names = fs.readdirSync(d).filter((f) => f.endsWith('.md')); } catch { continue; }
+    for (const f of names) { const c = categoryInput(path.join(d, f)); if (c) records.push({ rel: rel + '/' + f, fm: c.fm }); }
+  }
+  return docCategory.namedFromRecords(records);
+}
+// Run 3 (C7) — the PM's corrections for one repository live in the per-user runtime directory, keyed like the claims cache
+// (sha1 of the root), never in the repository.
+function doccatDir(root) { return docCatCorrections.repoDir(STATE, root); }
+// Adds `category`, `category_basis` and `category_why` to every markdown document anywhere in a library answer, and
+// `category_kind` for a ticket. A stored correction is passed in, so it wins with basis `pm correction`; the bases that
+// disagree with the winner come as `category_disagrees`.
+function annotateCategories(root, node, named, corr = {}, seen = new Set()) {
+  if (!node || typeof node !== 'object' || seen.has(node)) return node;
+  seen.add(node);
+  if (Array.isArray(node)) { for (const x of node) annotateCategories(root, x, named, corr, seen); return node; }
+  if (typeof node.path === 'string' && /\.md$/i.test(node.path)) {
+    const c = categoryInput(path.join(root, node.path));
+    if (c) {
+      const rel = node.path.split(path.sep).join('/');
+      const r = docCategory.categorize({ rel, fm: c.fm, text: c.text, named, correction: Object.prototype.hasOwnProperty.call(corr, rel) ? corr[rel] : null });
+      node.category = r.category; node.category_basis = r.basis; node.category_why = r.via;
+      if (r.ticket_kind) node.category_kind = r.ticket_kind;
+      if (r.disagrees.length) node.category_disagrees = r.disagrees;
+    }
+  }
+  for (const k of Object.keys(node)) if (node[k] && typeof node[k] === 'object') annotateCategories(root, node[k], named, corr, seen);
+  return node;
+}
+// ── D82 — Jev's category for a file the local rules leave undetermined ─────────────────────────────────
+// Its state lives beside the corrections, in doccatDir(root): per user, outside the repository.
+// Reads Jev's CACHED answers only; sends nothing. A decided answer becomes the category with the basis `jev`; an unsure one
+// leaves the file `undetermined` and says which two options led. Advisory (D40): nothing downstream reads it as fact.
+function annotateJev(root, node, cache, seen = new Set()) {
+  if (!node || typeof node !== 'object' || seen.has(node)) return node;
+  seen.add(node);
+  if (Array.isArray(node)) { for (const x of node) annotateJev(root, x, cache, seen); return node; }
+  if (node.category === docCategory.UNDETERMINED && typeof node.path === 'string' && /\.md$/i.test(node.path)) {
+    const c = categoryInput(path.join(root, node.path));
+    const l = c ? jevCategorize.lookup(cache, { fm: c.fm, text: c.text }) : null;
+    if (l && l.decided) { node.category = l.category; node.category_basis = 'jev'; node.category_why = l.sentence; if (l.ticket_kind) node.ticket_kind = l.ticket_kind; }
+    else if (l) node.category_why = l.sentence;
+  }
+  for (const k of Object.keys(node)) if (node[k] && typeof node[k] === 'object') annotateJev(root, node[k], cache, seen);
+  return node;
+}
+// Every Markdown document the library lists, with what the categorizer needs. Read through the same per-file cache.
+function doccatDocs(root, lib) {
+  const rels = new Set();
+  (function walk(n, seen) {
+    if (!n || typeof n !== 'object' || seen.has(n)) return; seen.add(n);
+    if (Array.isArray(n)) { for (const x of n) walk(x, seen); return; }
+    if (typeof n.path === 'string' && /\.md$/i.test(n.path)) rels.add(n.path.split(path.sep).join('/'));
+    for (const k of Object.keys(n)) if (n[k] && typeof n[k] === 'object') walk(n[k], seen);
+  })(lib, new Set());
+  const docs = [];
+  const corrections = docCatCorrections.get(doccatDir(root));   // C7 — a corrected file is decided, so it is never sent
+  for (const rel of rels) { const c = categoryInput(path.join(root, ...rel.split('/'))); if (c) docs.push({ rel, fm: c.fm, text: c.text, correction: corrections[rel] || null }); }
+  return docs;
+}
 function library(root) {
   const shape = wsShape(root);
   const roots = libraryTree(root);
@@ -1553,7 +1645,8 @@ function library(root) {
   const notes = NOTE_DIRS.map((d) => path.join(root, ...d.split('/'))).filter((d) => isDir(d))
     .map((d) => tree(root, d, {}, 0, { n: TREE_MAX_NODES }))
     .filter((t) => t.dirs.length || t.docs.length);
-  return { shape, roots, initiatives, ungrouped, knowledge, notes, governance: looseDocs(root) };
+  const out = { shape, roots, initiatives, ungrouped, knowledge, notes, governance: looseDocs(root) };
+  return annotateJev(root, annotateCategories(root, out, namedRecords(root), docCatCorrections.get(doccatDir(root))), jevCategorize.readCache(doccatDir(root)));
 }
 
 // ── On-demand surfaces (D60 / the workspace-ondemand-surfaces PRD). ────────────────────────────
@@ -4594,19 +4687,39 @@ async function runClaims(w, { sweep = false } = {}) {
     // D80 — after the local check, and only when all four gates hold (the bridge decides), ask Jev about changed claim pairs.
     if (out.ok) {
       const f = tsSettings.getRepo(STATE, w.root);
-      const jev = await jevClaims.run({ root: w.root, cacheDir, ledgerFile, key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude, changed: out.run ? out.run.changed : null });
+      const jev = await jevClaims.run({ root: w.root, cacheDir, ledgerFile, key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude, changed: out.run ? out.run.changed : null, askOpts: jevModelOpts(w.root) });
       const fresh = claimsLib.readView({ cacheDir, ledgerFile });
       return { ...out, ...fresh, jev };
     }
     return out;
   } finally { claimsRunning.delete(w.root); }
 }
+// prompt-model-routing R11 — the Jev version a PM names in the model policy reaches the claim checks and keys their cache. None named: the module's own default.
+function jevModelOpts(root) { const m = jevRoute.modelFromPolicy(root); return m ? { model: m } : {}; }
 // D80 — what the page needs to explain the Jev switch: which gates hold, and what the last pass did.
 function jevGateInfo(w) {
   const f = tsSettings.getRepo(STATE, w.root);
   const g = jevClaims.gates({ key: tsSettings.status(STATE).present, consent: f.consent, watch: f.watch, jev: f.jev });
   const { cacheDir } = claimsPaths(w);
-  return { switch: f.jev, open: g.open, missing: g.missing, sentence: g.open ? null : jevClaims.gateSentence(g.missing), ...jevClaims.status(cacheDir) };
+  return { switch: f.jev, status_read: f.status_read, open: g.open, missing: g.missing, sentence: g.open ? null : jevClaims.gateSentence(g.missing), ...jevClaims.status(cacheDir) };
+}
+// D82 — what the page needs to explain the categorize switch: which gates hold, and what the last pass did.
+const doccatRunning = new Set();
+const doccatAutoAt = new Map();    // root → time of the last automatic pass; at most one a minute
+function doccatInfo(w) {
+  const f = tsSettings.getRepo(STATE, w.root);
+  const g = jevCategorize.gates({ key: tsSettings.status(STATE).present, consent: f.consent, categorize: f.categorize });
+  return { switch: f.categorize, open: g.open, missing: g.missing, sentence: g.open ? null : jevCategorize.gateSentence(g.missing), running: doccatRunning.has(w.root), ...jevCategorize.status(doccatDir(w.root)) };
+}
+// The automatic pass, after a library listing. The bridge checks the three gates and the confirmed first run; this only
+// keeps it to one pass at a time and one a minute, and never makes the listing wait for it.
+function doccatAuto(w, lib) {
+  const f = tsSettings.getRepo(STATE, w.root);
+  if (!f.categorize || doccatRunning.has(w.root) || Date.now() - (doccatAutoAt.get(w.root) || 0) < 60000) return;
+  doccatAutoAt.set(w.root, Date.now());
+  doccatRunning.add(w.root);
+  jevCategorize.runAuto({ docs: doccatDocs(w.root, lib), named: namedRecords(w.root), cacheDir: doccatDir(w.root), key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude })
+    .catch(() => null).finally(() => doccatRunning.delete(w.root));
 }
 const claimsLast = new Map();      // root → { at, run, error }
 const claimsWatcher = repoWatch.createWatcher({
@@ -5072,7 +5185,9 @@ async function handleRequest(req, res) {
   if (p === '/api/library') {
     const w = getWs(url.searchParams.get('ws'));
     if (!w) return json(res, { ws: null, shape: 'plain', roots: [], initiatives: [], ungrouped: [], knowledge: [], governance: [] });
-    return json(res, { ws: w.id, ...library(w.root) });
+    const lib = library(w.root);
+    doccatAuto(w, lib);                 // D82 — in the background, and only when the three gates hold and the first run was confirmed
+    return json(res, { ws: w.id, ...lib, doccat: doccatInfo(w) });
   }
   if (p === '/api/surface') {
     // On-demand P/D/M/R surface, derived through the local state adapter only (no network).
@@ -5427,6 +5542,36 @@ async function handleRequest(req, res) {
     let md; try { md = fs.readFileSync(path.join(DELIV_DIR, id + '.md'), 'utf8'); } catch { res.writeHead(404); return res.end('not found'); }
     res.writeHead(200, { 'Content-Type': 'text/markdown; charset=utf-8' }); return res.end(md);
   }
+  // ── prompt-model-routing — route ANY prompt to a tier. A SUGGESTION: nothing here starts, switches or types into a session. ──
+  if (p === '/api/model/route/switch' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws); if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (typeof body.route !== 'boolean') return json(res, { ok: false, error: 'route must be true or false' }, 400);
+    const out = tsSettings.setRepo(STATE, w.root, { route: body.route });
+    if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
+    const f = tsSettings.getRepo(STATE, w.root);
+    const g = jevRoute.gates({ key: tsSettings.status(STATE).present, consent: f.consent, route: f.route });
+    return json(res, { ok: true, ws: w.id, route: f.route, open: g.open, missing: g.missing, sentence: g.open ? null : jevRoute.gateSentence(g.missing) });
+  }
+  if (p === '/api/model/route' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws); if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (typeof body.prompt !== 'string' || !body.prompt.trim() || body.prompt.length > 60000) return json(res, { ok: false, error: 'prompt must be text of up to 60000 characters' }, 400);
+    const f = tsSettings.getRepo(STATE, w.root);
+    const out = await jevRoute.routePrompt({ root: w.root, prompt: body.prompt, ctx: { skill: typeof body.skill === 'string' ? body.skill : undefined, source: body.source, running: true },
+      key: tsSettings.getKey(STATE), flags: { consent: f.consent, route: f.route, exclude: f.exclude } });
+    if (!out.ok) return json(res, { ok: false, error: out.error }, 400);
+    if (out.shadow) return json(res, { ok: true, shadow: true, id: out.id });             // shadow: logged, nothing shown, nothing applied
+    return json(res, { ok: true, ws: w.id, id: out.id, tier: out.tier, model: out.model, effort: out.effort, stage: out.stage, confidence: out.confidence, why: out.why,
+      applies: out.applies, sent: out.sent, withheld: out.withheld ? out.withheld.why : null, gate: out.gate });
+  }
+  if (p === '/api/model/route/outcome' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws); if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const mc = modelLib.core(); if (!mc.ok) return json(res, { ok: false, error: mc.error }, 500);
+    if (!mc.core.attachOutcome(w.root, body.id, { outcome: body.outcome, applied_tier: body.tier })) return json(res, { ok: false, error: 'an id from a routed prompt and an outcome of ' + mc.core.OUTCOMES.join(', ') + ' are needed (and the decisions ledger opted in)' }, 400);
+    return json(res, { ok: true });
+  }
   if (p === '/api/session/model' && req.method === 'POST') {
     // D75 — switch the model of a RUNNING Claude session, on the PM's press only. It types the harness's own
     // `/model <model>` command into the pane; effort is not changed by it. Never automatic, never for a binary
@@ -5740,7 +5885,12 @@ async function handleRequest(req, res) {
     try { nextStepActions.annotate(nextSteps, (it) => nextStepPathOf(root, it)); attachRuns(nextSteps, id); } catch (e) { void e; }
     let lcHistory = [];
     try { lcHistory = lifecycleHistory(w, id); } catch { lcHistory = []; }
-    return json(res, { ws: w ? w.id : null, ...out, lanes, conversations, files, next_steps: nextSteps, lifecycle_history: lcHistory });
+    // D83 — what Jev suggests about the documents tied to this initiative, read from the claims ledger. Advisory: the
+    // panel shows it beside the ladder and nothing derives a step, a stage or a count from it.
+    let suggestions = null;
+    try { if (w) suggestions = jevClaims.suggestionsFor({ ledgerFile: claimsPaths(w).ledgerFile, initiativeId: id }); }
+    catch { suggestions = { ok: false, reason: 'the suggestions could not be read', items: [] }; }
+    return json(res, { ws: w ? w.id : null, ...out, lanes, conversations, files, next_steps: nextSteps, lifecycle_history: lcHistory, suggestions });
   }
   if (p === '/api/audit' && req.method === 'GET') {
     /* The workflow audit (D77): the sweep run on one repository, read-only. It reports state that contradicts
@@ -6231,6 +6381,62 @@ async function handleRequest(req, res) {
     if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
     return json(res, { ok: true, ws: w.id, watching: tsSettings.getRepo(STATE, w.root).watch === true });
   }
+  // ── jev-doc-categorizer Run 3 (C7) — the PM corrects a category, and may write it into the file ─────────────────────
+  // A correction is per-user state OUTSIDE the repository and never edits a file. The write-back is a separate press with
+  // two steps — the diff first, then a confirmed write that names the sha1 of the text the PM saw — and it is the ONLY
+  // write into the repository on this surface.
+  if (p === '/api/doccat/corrections' && req.method === 'GET') {
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    return json(res, { ok: true, ws: w.id, corrections: docCatCorrections.get(doccatDir(w.root)) });
+  }
+  if ((p === '/api/doccat/correct' || p === '/api/doccat/writeback') && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    // Path guard: the store's own check (relative, no `..`, Markdown only), then the same inside-the-workspace rule every
+    // read and write on this surface uses, then the real path, so a symlink cannot lead out of the repository.
+    const chk = docCatCorrections.checkRel(body.path);
+    if (chk.error) return json(res, { ok: false, error: chk.error }, 400);
+    const rel = chk.rel;
+    const full = path.resolve(w.root, ...rel.split('/'));
+    if (!insideRoot(w.root, full)) return json(res, { ok: false, error: 'outside workspace' }, 404);
+    let lst = null; try { lst = fs.lstatSync(full); } catch { /* reported below */ }
+    if (!lst) return json(res, { ok: false, error: 'There is no such document in this repository.' }, 404);
+    let real = null; try { real = fs.realpathSync(full); } catch { /* reported below */ }
+    let realRoot = w.root; try { realRoot = fs.realpathSync(w.root); } catch { /* keep the root as given */ }
+    if (!real || !insideRoot(realRoot, real)) return json(res, { ok: false, error: 'outside workspace' }, 404);
+    const dir = doccatDir(w.root);
+    if (p === '/api/doccat/correct') {
+      const out = body.clear === true
+        ? docCatCorrections.clear(dir, rel)
+        : docCatCorrections.set(dir, rel, { category: body.category, ticket_kind: body.ticket_kind === undefined ? null : body.ticket_kind });
+      if (!out.ok) return json(res, { ok: false, error: out.error }, /could not be saved|symlink/.test(out.error) ? 500 : 400);
+      return json(res, { ok: true, ws: w.id, path: rel, cleared: body.clear === true ? out.cleared : undefined, correction: out.correction || null, corrections: docCatCorrections.get(dir) });
+    }
+    // the write-back
+    if (lst.isSymbolicLink() || !lst.isFile()) return json(res, { ok: false, error: 'This document is a link or not a plain file, so the category was not written into it.' }, 400);
+    let current;
+    try { current = fs.readFileSync(full, 'utf8'); }
+    catch { return json(res, { ok: false, error: 'could not read the document' }, 404); }
+    const corr = { category: body.category, ticket_kind: body.ticket_kind === undefined ? null : body.ticket_kind };
+    if (body.confirm !== true) {
+      const plan = docCatWriteback.plan(current, corr);
+      if (!plan.ok) return json(res, { ok: false, error: plan.error, sha: plan.sha }, 400);
+      return json(res, { ok: true, ws: w.id, path: rel, written: false, diff: plan.diff, changes: plan.changes, sha: plan.sha, next_sha: plan.next_sha, unchanged: plan.unchanged });
+    }
+    const done = docCatWriteback.apply(current, corr, body.expect_sha, body.expect_next_sha);
+    if (!done.ok) return json(res, { ok: false, error: done.error, stale: !!done.stale, sha: done.sha }, done.stale ? 409 : 400);
+    if (done.unchanged) return json(res, { ok: true, ws: w.id, path: rel, written: false, unchanged: true, diff: '' });
+    try { fs.writeFileSync(full, done.next); }
+    catch (e) {
+      warnWriteFail('category write-back (' + rel + ')', e);
+      return json(res, { ok: false, error: 'could not write the document — nothing was changed' }, 500);
+    }
+    return json(res, { ok: true, ws: w.id, path: rel, written: true, diff: done.diff, changes: done.changes, sha: docCatWriteback.sha1(done.next) });
+  }
   // ── D80 — Jev on changed claim pairs: the switch, a resume after a pause, and the backlog (plan, then confirmed run) ──
   if (p === '/api/claims/jev' && req.method === 'POST') {
     let body = {};
@@ -6243,6 +6449,18 @@ async function handleRequest(req, res) {
     if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
     return json(res, { ok: true, ws: w.id, jev: jevGateInfo(w) });
   }
+  // D83 — the second switch: also read the documents tied to each initiative for the two status questions. Default off.
+  if (p === '/api/claims/jev/status' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (typeof body.status_read !== 'boolean') return json(res, { ok: false, error: 'status_read must be true or false' }, 400);
+    const out = tsSettings.setRepo(STATE, w.root, { status_read: body.status_read });
+    if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
+    return json(res, { ok: true, ws: w.id, jev: jevGateInfo(w) });
+  }
   if (p === '/api/claims/jev/resume' && req.method === 'POST') {
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }
@@ -6262,14 +6480,61 @@ async function handleRequest(req, res) {
     const g = jevClaims.gates({ key: tsSettings.status(STATE).present, consent: f.consent, watch: true, jev: f.jev });
     if (!g.open) return json(res, { ok: false, error: jevClaims.gateSentence(g.missing) }, 409);
     const { cacheDir, ledgerFile } = claimsPaths(w);
-    if (body.confirm !== true) return json(res, { ok: true, ws: w.id, plan: jevClaims.backlogPlan({ root: w.root, cacheDir, exclude: f.exclude }) });
+    if (body.confirm !== true) return json(res, { ok: true, ws: w.id, plan: jevClaims.backlogPlan({ root: w.root, cacheDir, exclude: f.exclude, model: jevRoute.modelFromPolicy(w.root) || undefined, flags: f }) });
     if (claimsRunning.has(w.root)) return json(res, { ok: false, busy: true, error: 'a check is already running for this repository' }, 409);
     claimsRunning.add(w.root);
     try {
-      const out = await jevClaims.runBacklog({ root: w.root, cacheDir, ledgerFile, key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude, expectRequests: body.expect_requests });
+      const out = await jevClaims.runBacklog({ root: w.root, cacheDir, ledgerFile, key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude, expectRequests: body.expect_requests, askOpts: jevModelOpts(w.root) });
       return json(res, { ws: w.id, ...out, jev: jevGateInfo(w), ...claimsLib.readView({ cacheDir, ledgerFile }) }, out.ok ? 200 : (out.conflict ? 409 : 500));
     } finally { claimsRunning.delete(w.root); }
   }
+  // ── D82 — Jev on documents the local rules leave undetermined: the switch, a resume, and the run (plan, then confirmed) ──
+  if (p === '/api/doccat/jev' && req.method === 'GET') {
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    return json(res, { ok: true, ws: w.id, doccat: doccatInfo(w) });
+  }
+  if (p === '/api/doccat/jev' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (typeof body.categorize !== 'boolean') return json(res, { ok: false, error: 'categorize must be true or false' }, 400);
+    const out = tsSettings.setRepo(STATE, w.root, { categorize: body.categorize });
+    if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
+    return json(res, { ok: true, ws: w.id, doccat: doccatInfo(w) });
+  }
+  if (p === '/api/doccat/jev/resume' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    jevCategorize.resume(doccatDir(w.root));
+    return json(res, { ok: true, ws: w.id, doccat: doccatInfo(w) });
+  }
+  if (p === '/api/doccat/jev/run' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const f = tsSettings.getRepo(STATE, w.root);
+    const g = jevCategorize.gates({ key: tsSettings.status(STATE).present, consent: f.consent, categorize: f.categorize });
+    if (!g.open) return json(res, { ok: false, error: jevCategorize.gateSentence(g.missing), doccat: doccatInfo(w) }, 409);
+    const cacheDir = doccatDir(w.root);
+    const docs = doccatDocs(w.root, library(w.root));
+    const named = namedRecords(w.root);
+    if (body.confirm !== true) return json(res, { ok: true, ws: w.id, plan: jevCategorize.plan({ docs, named, cacheDir, exclude: f.exclude }) });
+    if (doccatRunning.has(w.root)) return json(res, { ok: false, busy: true, error: 'Jev is already categorizing this repository' }, 409);
+    doccatRunning.add(w.root);
+    try {
+      const out = await jevCategorize.runConfirmed({ docs, named, cacheDir, key: tsSettings.getKey(STATE), flags: f, exclude: f.exclude, expectRequests: body.expect_requests,
+        expectFingerprint: typeof body.expect_fingerprint === 'string' ? body.expect_fingerprint : null });
+      return json(res, { ws: w.id, ...out, doccat: doccatInfo(w) }, out.ok ? 200 : (out.conflict || out.busy ? 409 : 500));
+    } finally { doccatRunning.delete(w.root); }
+  }
   // ── D79 — repository validation through TypeSafe ──────────────────────────────────────────────────
   // The ONLY routes that lead to an outbound request, and only through lib/typesafe.js. The key is never
   // in a response: `status` says present or absent. Nothing here edits a repository file.
@@ -6300,6 +6565,24 @@ async function handleRequest(req, res) {
     }
     return json(res, { ok: true, ws: w.id, name: w.name, ...tsSettings.getRepo(STATE, w.root), key: tsSettings.status(STATE) });
   }
+  /* ── live notes (jev-live-notes, Run 2): the ranked proposals of a conversation, and the PM's accept, change or reject.
+   *    Reads the repository's ledger; the one write is a decision row. No request leaves this process, and no page is built yet. ── */
+  if (p === '/api/live-notes' && req.method === 'GET') {
+    const wsq = url.searchParams.get('ws');
+    const w = wsq ? workspaces.get(wsq) : homeWorkspace();     // a named workspace the server does not know is refused, never replaced by the home one
+    if (!w) return json(res, { ok: false, error: 'no such workspace' }, 400);
+    const r = liveNotes.apiList({ root: w.root, session: url.searchParams.get('session') || null });
+    return json(res, r, r.ok ? 200 : (r.status || 400));
+  }
+  if (p === '/api/live-notes/decide' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = body.ws ? workspaces.get(String(body.ws)) : homeWorkspace();
+    if (!w) return json(res, { ok: false, error: 'no such workspace' }, 400);
+    const r = liveNotes.apiDecide({ root: w.root, runtimeDir: STATE, session: body.session, segment: body.segment, action: body.action, initiative: body.initiative || null, relation: body.relation || null, exclude: tsSettings.getRepo(STATE, w.root).exclude });
+    return json(res, r, r.ok ? 200 : (r.status || 400));
+  }
   if (p === '/api/validate/plan' && req.method === 'POST') {
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }