create-pmos 0.523.0 → 0.525.0

package/workspace/lib/route-modules.js

@@ -33,6 +33,7 @@ const path = require('path');
 const MODULES = Object.freeze([
   'routes-setup', // Claude-ready onboarding, explicit profile checks and real first work
   'routes-onboard', // project-first onboarding in the Cozy Home (claude-onboarding-build), bound to no workspace
+  'routes-reveal',  // onboarding B2: Home right after setup (the ticks, the product portrait, the drafted first initiative)
   'routes-initiatives',   // Run 2 (2C): Roadmap, List, placements, new initiative, measurements
   'routes-today',         // Run 3 (3B): GET /api/today
   'routes-capture',       // Run 3 (3C): ⌘K capture
@@ -56,6 +57,7 @@ const MODULES = Object.freeze([
   'routes-board-grill',   // premium-uncovered-features (Board): a new initiative's Why, material and first questions (page press; file mode)
   'routes-insights-premium', // briefing-premium-insights: the premium Insights page's model from the KR metric records and report files (read-only)
   'routes-forecast',      // build brief Grill and Forecast F-A: a goal forecast's kept baseline, and the forecasts that turned
+  'routes-morning-goals', // build brief Good morning GM1: the quarter strip, the PM's line, the morning snapshot, goal tags, what Yes does
   'routes-grill',         // Grill and Forecast screens: Claude's checks for the pages (mode, cap, spend, each initiative's last run, Home's one line; read-only)
   'routes-home-desk',     // premium-agreed-design (Home): seen marks, queued messages, the weekly update's recipients and sends, stakeholders (page press; file mode)
   'routes-live',          // batch 6 item 2: the Live pill's sessions and the titles of their initiatives (read-only)
@@ -82,6 +84,7 @@ const MODULES = Object.freeze([
   'routes-task-plans',    // batch 11 item 8: drafts of an initiative's tasks, saved plans, Make live (task-plans.jsonl; page-press POST)
   'routes-task-links',    // batch 11 item 15: links between tasks, Claude's proposals, the quiet moves (task-links.jsonl; page-press POST)
   'routes-proposals',     // batch 12 items 2, 3 and 4: everything Claude proposes on an initiative, under its one ✦ (proposals.jsonl; page-press POST)
+  'routes-lab',           // idle lab (build U): Intelligence › Lab, the compare view, the specimen files and the Lab's own ✦ (idle-lab.jsonl; page-press POST)
   'routes-loose',         // batch 13 item 3: Claude's clean-up of Home's "Not in an initiative" under the group's ✦ (loose-props/; page-press POST)
   'routes-workflows',     // workflows-per-initiative (D99): the workflow library, save, copy, archive and the chat's draft (workflows.jsonl; page-press POST)
   'routes-settings',      // console3 Settings: the settings store for settings with no home of their own (GET; page-press POST)
@@ -116,6 +119,7 @@ const MODULES = Object.freeze([
   'routes-impact-views',  // batch 16 item 7 (Your impact, Phase 4): the chapter card's read, a stage that closed this week (boards.jsonl; read-only)
   'routes-next-prompt',   // batch 26 item 2: the chat's suggested next prompt and Sharper card (lib/next-prompt.js, through lib/ai-guard.js)
   'routes-drift',         // weekly-drift-check: What would I have missed, Home's weekly ✦ and its ⋯ drop and Undo (runtime drift/drift.jsonl; page-press POST)
+  'routes-moments',       // onboarding B3 gradual exposure: the day's ✦ in Home's chat, the menu dots, a quiet place's one line (onboarding-progress record; page-press POST)
 ]);
 const PM_DIR = path.join(__dirname, '..', 'public', 'pm');
 const MODULE_NAME = /^[a-z0-9][a-z0-9-]*\.js$/;

package/workspace/lib/routes-lab.js

@@ -0,0 +1,137 @@
+'use strict';
+/* routes-lab.js — what the pages show of the idle lab (build U, idle-lab B+C 2026-11-04; canvas main, In development I1 IlBC, I3 IlCompare).
+ * The fold and the shapes are lib/idle-lab.js; a result on an initiative is a ✦ under its one blue ✦ (lib/routes-proposals.js keeps, drops
+ * and undoes it). This module answers Intelligence › Lab, the compare view and the specimen files, and the Lab's own ✦.
+ *
+ *   GET  /api/lab?ws&board                → { ok, lab }   lab: lib/idle-lab.js labOf (null: nothing ran this week and nothing waits)
+ *   GET  /api/lab/compare?ws&board&id[&key] → { ok, compare }   lib/idle-lab.js compareOf (404 when the prototype is gone)
+ *   GET  /api/lab/specimen?file           → text/html, a specimen from <runtime>/idle-lab/specimens/, served sandboxed (no scripts that can
+ *                                          reach PMOS: CSP sandbox without allow-same-origin, no network but the fonts)
+ *   POST /api/lab/keep  { ws, id }        → { ok, batch, said }   ✓ on a Lab ✦: start keeps it and starts the initiative on its board
+ *   POST /api/lab/drop  { ws, id, why? }  → { ok, batch }         ✕, with the PM's reason when given
+ *   POST /api/lab/undo  { ws, batch }     → { ok }                Undo of a keep or a drop (a started initiative stays: close it on the Board)
+ *
+ * The week's record lists every background job: the idle lab, the grill runs (lib/grill.js), the AI jobs through lib/ai-guard.js, and
+ * whatever the shared queue reports (ctx.bgQueue.record({ ws, since }) → [{ job, title, meta?, at, ini?, board? }], when it is there).
+ * Every POST passes pm-guard requirePagePress. */
+const fs = require('fs');
+const guard = require('./pm-guard.js');
+const LAB = require('./idle-lab.js');
+const PR = require('./proposals.js');
+
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const fail = (ctx, res, status, error) => { ctx.json(res, { ok: false, error }, status); return true; };
+const WEEK = 7 * 864e5;
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/;
+const JOB_NAMES = { 'past-repeat': 'You decided this before', 'decision-memory': 'Earlier decisions', outcomes: 'Expected outcomes', descriptions: 'Descriptions',
+  drift: 'What you might have missed', rehearse: 'Rehearse a plan', 'next-prompt': 'Next prompt', 'sharpen-prompt': 'Sharper prompt' };
+const CSP = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com data:; img-src data: blob:";
+
+function wsOf(ctx, id) { let w = null; try { w = ctx.getWs(id || null); } catch { w = null; } return w && (!id || w.id === id) ? w : null; }
+const dirOf = (ctx, w) => { try { return ctx.stateDirFor ? ctx.stateDirFor(w) : null; } catch { return null; } };
+/** The initiatives' names, from the rows the Board already read (none while they are still being read). */
+function titles(w) {
+  const m = new Map();
+  try { const b = require('./routes-boards.js').baseRows(w); if (b && b.ok) for (const r of b.rows || []) if (r && r.id) m.set(r.id, { title: r.title || r.id, board: r.board || '' }); } catch { /* none */ }
+  return m;
+}
+/** What the other background jobs did this week, as record rows. Each source that cannot be read is left out. */
+function others(ctx, w, dir, T, now) {
+  const out = [], since = now - WEEK, name = (ini) => (T.get(ini) || {}).title || ini;
+  try {
+    const G = require('./grill.js'), F = ctx.runtimeDir ? G.read(ctx.runtimeDir) : null;
+    for (const r of F ? F.runs.values() : []) if (r.ended && r.ok !== false && r.ws === w.id && (Date.parse(r.endAt || r.at) || 0) >= since) out.push({ job: 'grill', title: 'Grill · ' + name(r.ini), meta: 'why: ' + r.why, at: r.endAt || r.at, ini: r.ini, board: r.board || '' });
+  } catch { /* no grill log */ }
+  try {
+    // the AI jobs' audit (lib/ai-guard.js AUDIT), read as a file: this page files nothing through the guard
+    const audit = dir ? fs.readFileSync(require('path').join(dir, 'ai-audit.jsonl'), 'utf8').split('\n').slice(-400).map((s) => { try { return JSON.parse(s); } catch { return null; } }).filter(isObj) : [];
+    for (const l of audit) if (l.event === 'end' && (Date.parse(l.at) || 0) >= since) out.push({ job: l.job, title: (JOB_NAMES[l.job] || l.job), meta: l.filed != null ? l.filed + ' filed' : '', at: l.at });
+  } catch { /* no audit */ }
+  try { if (ctx.bgQueue && typeof ctx.bgQueue.record === 'function') for (const x of ctx.bgQueue.record({ ws: w.id, since }) || []) if (isObj(x) && x.job !== 'grill') out.push(x); /* grill runs are read above, from their own log */ } catch { /* the queue says nothing */ }
+  return out;
+}
+
+const READS = {
+  '/api/lab': (ctx, res, url) => {
+    const w = wsOf(ctx, url.searchParams.get('ws')); if (!w) return fail(ctx, res, 404, 'no such workspace');
+    const dir = dirOf(ctx, w); if (!dir) { ctx.json(res, { ok: true, lab: null }); return true; }
+    const now = Date.now(), T = titles(w);
+    const lab = LAB.labOf({ P: PR.read(dir), L: LAB.read(dir), extra: others(ctx, w, dir, T, now), now, titleOf: (ini) => (T.get(ini) || {}).title || '' });
+    ctx.json(res, { ok: true, lab });
+    return true;
+  },
+  '/api/lab/compare': (ctx, res, url) => {
+    const w = wsOf(ctx, url.searchParams.get('ws')); if (!w) return fail(ctx, res, 404, 'no such workspace');
+    const dir = dirOf(ctx, w), id = url.searchParams.get('id') || '';
+    if (!dir || !ID_RE.test(id)) return fail(ctx, res, 400, 'id names a prototype');
+    const T = titles(w);
+    const c = LAB.compareOf(PR.read(dir), id, { key: url.searchParams.get('key') || '', titleOf: (ini) => (T.get(ini) || {}).title || '' });
+    if (!c) return fail(ctx, res, 404, 'That prototype is no longer here');
+    for (const col of c.columns) if (col.file) col.url = LAB.specimenUrl(col.file);
+    ctx.json(res, { ok: true, compare: c });
+    return true;
+  },
+  '/api/lab/specimen': (ctx, res, url) => {
+    const f = LAB.specimenPath(ctx.runtimeDir, url.searchParams.get('file') || '');
+    let html = null;
+    try { html = f ? fs.readFileSync(f) : null; } catch { html = null; }
+    if (!html) return fail(ctx, res, 404, 'That specimen is not in the idle lab folder');
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Security-Policy': CSP, 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'private, no-cache', 'Referrer-Policy': 'no-referrer' });
+    res.end(html);
+    return true;
+  },
+};
+
+const WRITES = {
+  '/api/lab/keep': (ctx, res, body, g, w, dir) => {
+    const F = LAB.read(dir), p = LAB.looseOpen(F).find((x) => x.id === body.id);
+    if (!p) return fail(ctx, res, 409, 'That is no longer waiting');
+    const wrote = [];
+    let said = 'Kept it.';
+    if (p.type === 'start') {
+      const r = require('./routes-loose.js').createIni(ctx, g, { ws: w.id, board: p.data.board }, p.data.title, p.data.anchor, p.why);
+      if (r.error) return fail(ctx, res, 409, r.error);
+      wrote.push(r.write); said = 'Started ' + p.data.title + '.';
+    }
+    const batch = PR.newBatch();
+    LAB.append(dir, g.actor, { kind: 'keep', id: p.id, batch, wrote });
+    ctx.json(res, { ok: true, batch, said });
+    return true;
+  },
+  '/api/lab/drop': (ctx, res, body, g, w, dir) => {
+    const p = LAB.looseOpen(LAB.read(dir)).find((x) => x.id === body.id);
+    if (!p) return fail(ctx, res, 409, 'That is no longer waiting');
+    const why = typeof body.why === 'string' ? body.why.replace(/\s+/g, ' ').trim().slice(0, 300) : '';
+    const batch = PR.newBatch();
+    LAB.append(dir, g.actor, { kind: 'drop', id: p.id, batch, ...(why ? { why } : {}) });
+    ctx.json(res, { ok: true, batch });
+    return true;
+  },
+  '/api/lab/undo': (ctx, res, body, g, w, dir) => {
+    const F = LAB.read(dir), b = String(body.batch || '');
+    const known = F.kept.some((k) => k.batch === b) || readsDrop(dir, b);
+    if (!known || F.undone.has(b)) return fail(ctx, res, 409, 'Nothing to undo');
+    LAB.append(dir, g.actor, { kind: 'undo', batch: b });
+    ctx.json(res, { ok: true });
+    return true;
+  },
+};
+const readsDrop = (dir, b) => LAB.readLines(LAB.ledgerFile(dir)).some((l) => l.kind === 'drop' && l.batch === b);
+
+module.exports = {
+  prefixes: ['/api/lab'],
+  handle: async (req, res, url, ctx) => {
+    const p0 = url.pathname;
+    if (req.method === 'GET') { const fn = READS[p0]; if (!fn) return fail(ctx, res, 404, 'not found'); return fn(ctx, res, url); }
+    if (req.method !== 'POST') return fail(ctx, res, 405, 'GET or POST only');
+    const fn = WRITES[p0];
+    if (!fn) return fail(ctx, res, 404, 'not found');
+    const got = await ctx.readJson(req);
+    if (!got.ok || !isObj(got.body)) return fail(ctx, res, 400, 'the body must be a JSON object');
+    const g = guard.requirePagePress(req, got.body);
+    if (!g.ok) return fail(ctx, res, g.status, g.error);
+    const w = wsOf(ctx, typeof got.body.ws === 'string' ? got.body.ws : null); if (!w) return fail(ctx, res, 404, 'no such workspace');
+    const dir = dirOf(ctx, w); if (!dir) return fail(ctx, res, 409, 'This repository has no PMOS state folder. Nothing is saved until the folder exists.');
+    return fn(ctx, res, got.body, g, w, dir);
+  },
+};

package/workspace/lib/routes-loose.js

@@ -187,6 +187,7 @@ function dropLine(ctx, res, body, g, dir, kind) {
 
 module.exports = {
   prefixes: ['/api/loose-props'],
+  createIni,   // the idle lab's Lab ✦ "start an initiative" uses the same Add an ask and Accept (lib/routes-lab.js)
   handle: async (req, res, url, ctx) => {
     const p = url.pathname;
     const dir = LP.dirOf(ctx.runtimeDir);

package/workspace/lib/routes-moments.js

@@ -0,0 +1,42 @@
+'use strict';
+/* routes-moments.js — a feature appears when its moment comes, over HTTP (onboarding build B3; lib/moments.js holds the rules).
+ *
+ *   GET  /api/moments                         → { ok, moment: { id, ws, product, text, sub, href, guide, guideLabel, go, shown } | null,
+ *                                                places: { board|insights|reports: { quiet, dot, line } } }
+ *                                               the day's ✦ for Home's chat, the menu dots, and the quiet line of a place not open yet
+ *   POST /api/moments/shown { ws, id }        → { ok }   the ✦ was drawn: it is that day's moment
+ *   POST /api/moments/keep  { ws, id }        → { ok }   ✓: the page opens the place; its dot clears
+ *   POST /api/moments/drop  { ws, id }        → { ok }   ✕: that moment never comes back
+ *   POST /api/moments/visit { place }         → { ok }   the PM opened Board, Intelligence or reports: its dot clears
+ *
+ * Reads files only (no model, no connector). A GET records a place that just opened in the workspace's onboarding-progress record, so its
+ * dot shows once. WHO WRITES: every POST is a page press (pm-guard requirePagePress); an agent session header is refused (403). */
+const guard = require('./pm-guard.js');
+const MO = require('./moments.js');
+
+const text = (v) => (typeof v === 'string' ? v : '');
+const bad = (status, error) => ({ status, body: { ok: false, error } });
+const nowMs = (ctx) => { const t = Date.parse((ctx.env || process.env).PMOS_MOMENTS_NOW || ''); return Number.isFinite(t) ? t : Date.now(); };
+
+async function handle(req, res, url, ctx) {
+  const send = (r) => { ctx.json(res, r.body, r.status); return true; };
+  const what = url.pathname.replace(/^\/api\/moments\/?/, '');
+  if (!ctx.runtimeDir) return send(bad(409, 'There is no runtime folder.'));
+  if (what === '') {
+    if (req.method !== 'GET') return send(bad(405, 'GET only'));
+    try { return send({ status: 200, body: { ok: true, ...MO.current(ctx, nowMs(ctx)) } }); }
+    catch { return send(bad(500, 'The moments could not be read.')); }
+  }
+  if (!['shown', 'keep', 'drop', 'visit'].includes(what)) return send(bad(404, 'no such moments route'));
+  if (req.method !== 'POST') return send(bad(405, 'POST only'));
+  if (req.headers && req.headers['x-pmos-session']) return send(bad(403, 'Only you answer a moment, from the page.'));
+  const rd = await ctx.readJson(req);
+  if (!rd.ok) return send(bad(400, 'the body is not JSON'));
+  const body = rd.body || {};
+  const g = guard.requirePagePress(req, body);
+  if (!g.ok) return send(bad(g.status, g.error));
+  const r = what === 'visit' ? MO.visit(ctx, text(body.place), nowMs(ctx)) : MO.answer(ctx, what, text(body.ws), text(body.id), nowMs(ctx));
+  return send(r.ok ? { status: 200, body: { ok: true } } : bad(r.status, r.error));
+}
+
+module.exports = { prefixes: ['/api/moments'], handle };

package/workspace/lib/routes-morning-goals.js

@@ -0,0 +1,109 @@
+'use strict';
+/* routes-morning-goals.js — the quarter under Good morning (build brief Good morning, GM1). lib/morning-goals.js holds the rules.
+ *
+ *   GET  /api/morning-goals[?ws=a,b]     → { ok, today, quarter, weeksLeft, strip, line, proposal, since, tags, goals, missing }
+ *        ws: the products to read; with none, the products Home reads (GET /api/briefing-premium/products, the ticked ones).
+ *        Each product's goals come from its Intelligence model (GET /api/insights-premium?ws=), so a goal says the same thing on both pages.
+ *        line: { line, at } the PM kept for this quarter, or null. proposal: Claude's ✦ { line, of, why } when there is no line and the
+ *        ✦ was not put off. since: the move since the day's first read (null on the first read). A product that cannot be read is named
+ *        in missing and is not counted. The first read of the day writes <runtime>/goal-morning.jsonl once.
+ *   POST /api/morning-goals/line         { line, quarter? }   the PM keeps the line (✓, the number may be changed). A page press
+ *   POST /api/morning-goals/line-off     { quarter? }         the ✦ is put off for the quarter (✕). A page press
+ *   POST /api/morning-goals/yes-effect   { ws, goal, date } | { ws, initiative, date, from }   → { ok, effect | null }
+ *        the forecast run again with the proposed date (lib/forecast.js). Reads and writes nothing else. null when it cannot run. */
+const guard = require('./pm-guard.js');
+const MG = require('./morning-goals.js');
+
+const localDay = (ms = Date.now()) => { const d = new Date(ms); return d.getFullYear() + '-' + String(d.getMonth() + 1).padStart(2, '0') + '-' + String(d.getDate()).padStart(2, '0'); };
+const text = (v) => (typeof v === 'string' ? v : '');
+
+async function via(mod, pathAndQuery, req, ctx) {
+  let out = { status: 500, body: null };
+  const c = Object.assign({}, ctx, { json: (res, obj, code) => { out = { status: code || 200, body: obj }; } });
+  const handled = await mod.handle({ method: 'GET', headers: (req && req.headers) || {} }, {}, new URL('http://local' + pathAndQuery), c);
+  return handled === false ? { status: 404, body: null } : out;
+}
+
+async function productsOf(ctx, req, want) {
+  if (want.length) return want.map((ws) => ({ ws, name: ws }));
+  const r = await via(require('./routes-briefing-premium.js'), '/api/briefing-premium/products', req, ctx).catch(() => ({ status: 500, body: null }));
+  const P = (r.body && Array.isArray(r.body.products) && r.body.products) || [];
+  return P.filter((p) => p && p.on).map((p) => ({ ws: p.ws, name: p.name || p.ws }));
+}
+
+/** One product's Intelligence model goals, or null when it cannot be read. */
+async function modelOf(ctx, req, ws) {
+  const r = await via(require('./routes-insights-premium.js'), '/api/insights-premium?ws=' + encodeURIComponent(ws), req, ctx).catch(() => ({ status: 500, body: null }));
+  const m = r.status === 200 && r.body && r.body.ok && r.body.model;
+  return m && m.board && m.board.ws === ws ? m : null;
+}
+
+async function read(ctx, req, want) {
+  const today = localDay(), quarter = MG.quarterOf(today);
+  const products = [], missing = [];
+  for (const p of await productsOf(ctx, req, want)) {
+    const m = await modelOf(ctx, req, p.ws);
+    if (!m) { missing.push(p.name); continue; }
+    products.push({ ws: p.ws, name: (m.board && m.board.name && m.board.name !== 'Intelligence' ? m.board.name : p.name), goals: m.goals || [], model: m });
+  }
+  const list = MG.collect(products);
+  const dir = ctx.runtimeDir || null;
+  const kept = dir ? MG.lineFor(dir, quarter) : null;
+  const line = kept && kept.line ? kept : null;
+  const strip = MG.stripOf(list, line ? line.line : null);
+  const proposal = !line && !(kept && kept.off) ? MG.proposeLine(strip) : null;
+  let since = null;
+  if (dir && list.length) {
+    try {
+      const had = MG.snapshotFor(dir, today);
+      if (had) since = MG.deltaOf(had, list);
+      else if (!missing.length) MG.takeSnapshot(dir, today, list);   // a part read is no morning: the snapshot waits for every product
+    } catch { since = null; }
+  }
+  return { ok: true, today, quarter, weeksLeft: MG.weeksLeft(today), strip, line, proposal, since, tags: MG.tagsOf(list),
+    goals: list.map(({ moves, ...g }) => g), missing, products };
+}
+
+module.exports = {
+  prefixes: ['/api/morning-goals'],
+  handle: async (req, res, url, ctx) => {
+    const send = (status, body) => { ctx.json(res, body, status); return true; };
+    const what = url.pathname.replace(/^\/api\/morning-goals\/?/, '');
+    if (!['', 'line', 'line-off', 'yes-effect'].includes(what)) return send(404, { ok: false, error: 'no such morning-goals route' });
+    if (what === '') {
+      if (req.method !== 'GET') return send(405, { ok: false, error: 'GET only' });
+      const want = text(url.searchParams.get('ws')).split(',').map((s) => s.trim()).filter(Boolean);
+      try { const out = await read(ctx, req, want); delete out.products; return send(200, out); } catch (e) { return send(500, { ok: false, error: String((e && e.message) || e) }); }
+    }
+    if (req.method !== 'POST') return send(405, { ok: false, error: 'POST only' });
+    const got = await ctx.readJson(req);
+    if (!got.ok) return send(400, { ok: false, error: 'the body is not JSON' });
+    const body = got.body || {};
+    if (what === 'yes-effect') {
+      const date = text(body.date), today = localDay();
+      if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return send(400, { ok: false, error: 'date is required, as YYYY-MM-DD' });
+      const FC = require('./forecast.js');
+      let effect = null;
+      try {
+        if (body.goal) {
+          const m = await modelOf(ctx, req, text(body.ws));
+          const g = m && (m.goals || []).find((x) => String(x.id) === String(body.goal));
+          if (g) effect = MG.yesEffect({ goal: g, date }, FC, today);
+        } else if (body.initiative) {
+          const w = ctx.getWs(text(body.ws) || null), sn = w ? require('./jira-status.js').readSnapshot(w.root, String(body.initiative)) : null;
+          const jira = sn ? { at: sn.fetchedAt, tickets: [...sn.tickets.values()].map((t) => ({ category: t.category, resolved: t.resolved || null })) } : null;
+          effect = MG.yesEffect({ initiative: { id: String(body.initiative), title: text(body.title) }, jira, date, from: text(body.from) }, FC, today);
+        }
+      } catch { effect = null; }
+      return send(200, { ok: true, effect });
+    }
+    const g = guard.requirePagePress(req, body);
+    if (!g.ok) return send(g.status, { ok: false, error: g.error });
+    if (!ctx.runtimeDir) return send(409, { ok: false, error: 'PMOS has no runtime folder, so the line cannot be kept' });
+    const quarter = text(body.quarter) || MG.quarterOf(localDay());
+    const r = what === 'line' ? MG.setLine(ctx.runtimeDir, g.actor, { quarter, line: body.line }) : MG.putOff(ctx.runtimeDir, g.actor, quarter);
+    if (r.error) return send(400, { ok: false, error: r.error });
+    return send(200, { ok: true, line: r.line });
+  },
+  _read: read,
+};

package/workspace/lib/routes-onboard.js

@@ -14,7 +14,8 @@
  *   POST /api/onboard/discover                      the verified profile's connectors, no model call
  *   POST /api/onboard/search    { sources: [id], local: bool }          read-only search of the ticked sources
  *   POST /api/onboard/review    { fields, jira }    the PM's edits to the draft
- *   POST /api/onboard/init                          initialize or reuse, register, open in My Work (resumable)
+ *   POST /api/onboard/init                          initialize or reuse, register, settle the fundamentals (resumable)
+ *   POST /api/onboard/fundamental { key }           the one-press change of one fundamentals line (lib/onboard-fundamentals.js)
  *   POST /api/onboard/reset                         start again (the folder and anything written stay)
  */
 const fs = require('fs');
@@ -22,6 +23,7 @@ const path = require('path');
 const crypto = require('crypto');
 const guard = require('./pm-guard.js');
 const P = require('./project-onboard.js');
+const F = require('./onboard-fundamentals.js');
 
 function file(ctx) { return path.join(ctx.runtimeDir, 'onboarding', 'project.json'); }
 function journal(ctx) { return path.join(ctx.runtimeDir, 'onboarding', 'project-init.json'); }
@@ -73,7 +75,8 @@ function installerKit(ctx) {
 function view(ctx) {
   const { st, bound } = fresh(ctx, read(ctx));
   const ws = st.done && st.done.ws && ctx.getWs(st.done.ws);
-  return { ok: true, progress: { ...st, verified: !!bound, done: ws ? st.done : null }, claude: ctx.claudeSetup.list(), platform: process.platform,
+  const fundamentals = st.fundamentals ? { at: st.fundamentals.at, lines: st.fundamentals.lines, error: st.fundamentals.error || null } : null;
+  return { ok: true, progress: { ...st, verified: !!bound, done: ws ? st.done : null, fundamentals }, claude: ctx.claudeSetup.list(), platform: process.platform,
     // a project the PM already has: a registered workspace with PMOS in it, or with the planning/ folder a PMOS workspace keeps its records in
     // ...that holds work: an initiative or a filled record file. A PMOS folder with none is not one: the one-line installer makes ~/PMOS with an empty kit
     // and registers it, so counting the bare folder skipped setup for every new user (bug 2026-11-02, Windows).
@@ -81,7 +84,7 @@ function view(ctx) {
 }
 
 async function handle(req, res, url, ctx) {
-  const m = /^\/api\/onboard\/(state|own|login|check|project|folder|discover|search|review|init|reset)$/.exec(url.pathname);
+  const m = /^\/api\/onboard\/(state|own|login|check|project|folder|discover|search|review|init|fundamental|reset)$/.exec(url.pathname);
   if (!m) return false;
   const send = (body, code = 200) => { ctx.json(res, body, code); return true; };
   if (!ctx.claudeSetup) return send({ ok: false, error: 'Claude setup is unavailable.' }, 503);
@@ -167,7 +170,8 @@ async function handle(req, res, url, ctx) {
       const picked = all.filter((s) => Array.isArray(b.sources) && b.sources.includes(s.id) && s.status === 'connected');
       const local = b.local !== false && st.folder && st.folder.mode === 'existing';
       if (!picked.length && !local) return send({ ok: false, error: 'Tick at least one source, or continue with your own description.' }, 400);
-      let found = { ok: true, sources: [], findings: [], jira: [], fields: {} };
+      let found = { ok: true, sources: [], findings: [], jira: [], fields: {}, highlights: [], goal: null, facts: {} };
+      const startedAt = new Date().toISOString();   // the reveal's ticks count from here (lib/first-reveal.js)
       if (picked.length) {
         const inv = await P.inventory({ bound, sources: picked });
         found = inv.ok ? await P.search({ bound, project: st.project, sources: picked, tools: inv.tools }) : { ok: false, error: inv.error };
@@ -177,12 +181,12 @@ async function handle(req, res, url, ctx) {
       if (local) found.sources.push({ id: 'folder', label: 'The folder', state: folder && folder.ok ? (folder.readme || folder.commits ? 'found' : 'empty') : 'failed', count: folder && folder.commits || 0 });
       const jiraMatches = found.jira.length ? found.jira : [];
       const draft = P.draftContext({ project: st.project, folder: folder || (st.folder && st.folder.facts), found });
-      write(ctx, { ...st, found: { fingerprint: bound.fingerprint, at: new Date().toISOString(), sources: found.sources, findings: found.findings, jira: jiraMatches }, review: { fields: draft, jira: jiraMatches.length === 1 ? jiraMatches[0].key : null } });
+      write(ctx, { ...st, found: { fingerprint: bound.fingerprint, started_at: startedAt, at: new Date().toISOString(), sources: found.sources, findings: found.findings, jira: jiraMatches, highlights: found.highlights || [], goal: found.goal || null, facts: found.facts || {} }, review: { fields: draft, jira: jiraMatches.length === 1 ? jiraMatches[0].key : null } });
       return send(view(ctx));
     }
     if (verb === 'review') {
       const fields = { ...((st.review && st.review.fields) || P.draftContext({ project: st.project, folder: st.folder && st.folder.facts, found: null })) };
-      for (const k of ['name', 'purpose', 'team', 'owner', 'timeline', 'goals']) {
+      for (const k of ['name', 'purpose', 'team', 'owner', 'timeline', 'weekly', 'goals']) {
         if (!(b.fields && k in b.fields)) continue;
         const v = str(b.fields[k], 400);
         fields[k] = v ? (fields[k] && fields[k].value === v ? fields[k] : { value: v, source: 'you' }) : null;
@@ -201,15 +205,31 @@ async function handle(req, res, url, ctx) {
       const fields = (st.review && st.review.fields) || P.draftContext({ project: st.project, folder: st.folder.facts, found: null });
       const jira = jiraKey && jiraKey !== 'none' ? (matches.find((j) => j.key === jiraKey) || null) : null;
       const name = (fields.name && fields.name.value) || st.project.name;
-      const plan = { mode: st.folder.mode, root: st.folder.root, name, context: { name, fields, jira, sources: (st.found && st.found.findings || []).slice(0, 20) } };
+      const fg = st.found && st.found.goal, gf = fg && (st.found.findings || []).find((x) => x.id === fg.finding);
+      const goal = fg ? { objective: fg.objective, kr: fg.kr, source_label: gf ? gf.source_label : null } : null;
+      const plan = { mode: st.folder.mode, root: st.folder.root, name, context: { name, fields, jira, goal, sources: (st.found && st.found.findings || []).slice(0, 20) } };
       const r = P.initialize({ plan, journalFile: journal(ctx) });
       if (!r.ok) { write(ctx, { ...st, init: { ok: false, step: r.step, error: r.error, steps: r.journal && r.journal.steps } }); return send({ ...view(ctx), ok: false, error: r.error, step: r.step }); }
       const w = ctx.registerWorkspace(r.root, name);
       if (!w) { write(ctx, { ...st, init: { ok: false, step: 'register', error: 'The project could not be added to My Work.', steps: r.journal.steps } }); return send({ ...view(ctx), ok: false, error: 'The project could not be added to My Work.' }); }
+      // A3: the fundamentals are settled for the PM right after init, read from the project-context.md just written. Once per product: a
+      // retried init keeps the card it already has, so a change the PM pressed is not undone.
+      let fundamentals = st.fundamentals && st.fundamentals.root === r.root ? st.fundamentals : null;
+      if (!fundamentals) {
+        try { fundamentals = F.settle({ root: r.root, ws: w.id, sources: (st.found && st.found.sources) || [], fresh: !!(r.journal.steps.kit && r.journal.steps.kit.detail === 'installed'), refresh: ctx.refreshSources ? ctx.refreshSources() : F.refreshAt(ctx.runtimeDir), ...(ctx.launcher !== undefined ? { launcher: ctx.launcher } : {}) }); }
+        catch { fundamentals = { root: r.root, ws: w.id, lines: [], did: {}, error: 'Some fundamentals could not be settled. Change them in Settings.' }; }
+      }
       if (ctx.broadcast) ctx.broadcast({ t: 'focus', ws: w.id });
-      write(ctx, { ...st, init: { ok: true, steps: r.journal.steps }, done: { ws: w.id, name, root: r.root, context: r.journal.steps.context && r.journal.steps.context.detail, at: new Date().toISOString() } });
+      write(ctx, { ...st, init: { ok: true, steps: r.journal.steps }, fundamentals, done: { ws: w.id, name, root: r.root, context: r.journal.steps.context && r.journal.steps.context.detail, at: new Date().toISOString() } });
       return send(view(ctx));
     }
+    if (verb === 'fundamental') {
+      if (!st.fundamentals) return send({ ok: false, error: 'Set up the project first.', need: 'init' }, 409);
+      const r = F.change(st.fundamentals, str(b.key, 20), { refresh: ctx.refreshSources ? ctx.refreshSources() : F.refreshAt(ctx.runtimeDir), ...(ctx.launcher !== undefined ? { launcher: ctx.launcher } : {}) });
+      if (!r.ok) return send({ ...view(ctx), ok: false, error: r.error });
+      if (r.state !== st.fundamentals) write(ctx, { ...st, fundamentals: r.state });
+      return send({ ...view(ctx), follow: r.follow || null });
+    }
   } catch { return send({ ok: false, error: 'This step could not finish. Nothing you had was removed. Try again.' }, 500); }
   return false;
 }

package/workspace/lib/routes-proposals.js

@@ -8,7 +8,7 @@
  *   POST /api/proposals/keep  { ws, board, initiative, ids?: [id] | all: true, choices?: { <from>><to>: 'keep' | 'ignore' } }
  *                             → { ok, batch, said, counts, props }   ✓ one proposal, or ✓ in the header (all: every one Claude is sure of;
  *                             Check these and a Jira ticket's comment never ride on it). One batch, one toast, one Undo.
- *   POST /api/proposals/drop  { ws, board, initiative, sig }   → { ok }   ✕ on a proposal or on one item of it, for good (rule 7); the line
+ *   POST /api/proposals/drop  { ws, board, initiative, sig, why? }   → { ok }   why: the PM's reason (the idle lab asks for one);   ✕ on a proposal or on one item of it, for good (rule 7); the line
  *                             also keeps its facts (PR.factsOf), so a re-sectioned task or a new day does not bring it back
  *   POST /api/proposals/undo  { ws, board, batch }           → { ok, back, kept }   the whole batch; a task changed since keeps its change
  *   POST /api/proposals/stop  { ws, board, initiative }      → { ok }   ■ Stop: the look ends; what was found so far stays proposed
@@ -142,6 +142,14 @@ function applyOne(ctx, p, g, f, ini, x, choices, outbox) {
     // the record's own description (initiative-description-field): ✓ writes its description line, Undo puts back what was there
     const r = require('./initiative-writer.js').setDescription(p.w.root, ini, (x.data || {}).text, { actor: g.actor });
     if (r.ok && !r.same) add({ op: 'description', from: r.from, to: r.text });
+  } else if (x.group === 'prototyped' || x.group === 'improved' || x.group === 'scanned') {
+    // the idle lab (lib/idle-lab.js): ✓ keeps it as the initiative's own document. A prototype is each specimen of round 1, or the new
+    // round; a scan finding is evidence. The specimen stays in the runtime folder; the document links it (GET /api/lab/specimen)
+    const LAB = require('./idle-lab.js'), d = x.data || {}, name = (sp) => 'Prototype ' + sp.key + ' · ' + sp.title;
+    const docOf = (title, ref, kind) => add({ op: 'doc', id: 'fd-' + PR.hash(ini + '|' + x.id + '|' + (ref || title)), title: String(title).slice(0, 140), source: 'Claude, while you were away', at: x.at || '', ref, kind, claude: true });
+    if (x.group === 'prototyped') for (const sp of d.specimens || []) docOf(name(sp), LAB.specimenUrl(sp.file), 'prototype');
+    else if (x.group === 'improved') docOf('Prototype ' + (d.base || '') + ' · round ' + d.round + ': ' + (d.changed || ''), LAB.specimenUrl(d.file), 'prototype');
+    else docOf(x.why, ((x.sources || [])[0] || {}).ref || '', 'evidence');
   } else if (x.group === 'grill') {
     // a grill finding (lib/grill.js): ✓ adds its next step as a task, with the finding and its sources in the notes
     // ✎ on the finding: the PM's own words for the next step (choices[id]) replace Claude's
@@ -279,7 +287,9 @@ const WRITES = {
         if (it) { facts = PR.factsOf(x, it); break; }
       }
     } catch { facts = []; }
-    PR.append(dirOf(ctx, p.w), g.actor, { kind: 'drop', ini, sig, ...(facts.length ? { facts } : {}) });
+    // the PM's reason, when given (the idle lab's ✕ asks for one; Claude learns from it)
+    const why = typeof body.why === 'string' ? body.why.replace(/\s+/g, ' ').trim().slice(0, 300) : '';
+    PR.append(dirOf(ctx, p.w), g.actor, { kind: 'drop', ini, sig, ...(facts.length ? { facts } : {}), ...(why ? { why } : {}) });
     ctx.json(res, { ok: true });
   },
   '/api/proposals/undo': (ctx, res, body, g, p) => {

package/workspace/lib/routes-reveal.js

@@ -0,0 +1,73 @@
+'use strict';
+/* routes-reveal.js — Home right after setup (onboarding build B2; lib/first-reveal.js has the model and the one write).
+ *
+ *   GET  /api/first-reveal?ws=<id>                 → the reveal of a product just set up, or { none: true }
+ *   POST /api/first-reveal/keep  { ws, outcome? }  → ✓ on the drafted initiative: it is created with its expected outcome and check date
+ *   POST /api/first-reveal/drop  { ws }            → ✕: nothing is written; the draft does not come back for this product
+ *
+ * It reads the onboarding progress of lib/routes-onboard.js (the per-user runtime folder) and nothing from a connector: what the portrait
+ * shows is what the read-only search returned during setup. Every POST is the PM's own page press (pm-guard requirePagePress).
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const guard = require('./pm-guard.js');
+const R = require('./first-reveal.js');
+
+const pad = (n) => String(n).padStart(2, '0');
+const localDay = (d = new Date()) => d.getFullYear() + '-' + pad(d.getMonth() + 1) + '-' + pad(d.getDate());
+const readJsonFile = (f) => { try { const v = JSON.parse(fs.readFileSync(f, 'utf8')); return v && typeof v === 'object' ? v : null; } catch { return null; } };
+const progressOf = (ctx) => readJsonFile(path.join(ctx.runtimeDir, 'onboarding', 'project.json')) || {};
+const journalOf = (ctx) => readJsonFile(path.join(ctx.runtimeDir, 'onboarding', 'project-init.json'));
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$/;
+
+/** The default workflow's name for new initiatives of this product (D99; Product feature when none is set). */
+function workflowName(ctx, w) {
+  try {
+    const WS = require('./workflows-store.js');
+    const WF = require(require('./repo-script.js').repoScript('workflows.js'));
+    const dir = ctx.stateDirFor ? ctx.stateDirFor(w) : null;
+    return (dir && WF.defaultOf(WS.library(dir)).name) || 'Product feature';
+  } catch { return 'Product feature'; }
+}
+function hasKr(w) { return !!R.firstKr(w.root); }
+
+async function handle(req, res, url, ctx) {
+  const m = /^\/api\/first-reveal(?:\/(keep|drop))?$/.exec(url.pathname);
+  if (!m) return false;
+  const send = (body, code = 200) => { ctx.json(res, body, code); return true; };
+  if (!ctx.runtimeDir) return send({ ok: false, error: 'PMOS has no runtime folder.' }, 409);
+  if (!m[1]) {
+    if (req.method !== 'GET') return send({ ok: false, error: 'GET only' }, 405);
+    const ws = url.searchParams.get('ws') || '';
+    const st = progressOf(ctx);
+    if (!ws || !st.done || st.done.ws !== ws) return send({ ok: true, none: true });
+    const w = ctx.getWs(ws);
+    if (!w) return send({ ok: true, none: true });
+    const today = /^\d{4}-\d{2}-\d{2}$/.test(url.searchParams.get('today') || '') ? url.searchParams.get('today') : localDay();
+    return send(R.model({ st, journal: journalOf(ctx), ws, today, workflow: workflowName(ctx, w), decided: R.read(ctx.runtimeDir, ws), home: os.homedir(), hasKr: hasKr(w) }));
+  }
+  if (req.method !== 'POST') return send({ ok: false, error: 'POST only' }, 405);
+  const got = await ctx.readJson(req);
+  if (!got.ok || !got.body || typeof got.body !== 'object') return send({ ok: false, error: 'Invalid JSON.' }, 400);
+  const b = got.body, g = guard.requirePagePress(req, b);
+  if (!g.ok) return send({ ok: false, error: g.error }, g.status);
+  const ws = String(b.ws || '');
+  if (!ID_RE.test(ws)) return send({ ok: false, error: 'Name the product.' }, 400);
+  const st = progressOf(ctx);
+  if (!st.done || st.done.ws !== ws) return send({ ok: false, error: 'This product was not set up here.' }, 409);
+  const today = /^\d{4}-\d{2}-\d{2}$/.test(String(b.today || '')) ? String(b.today) : localDay();
+  try {
+    if (m[1] === 'drop') {
+      const d = R.read(ctx.runtimeDir, ws);
+      if (!d.kept && !d.dropped) R.write(ctx.runtimeDir, ws, { dropped: new Date().toISOString() });
+      return send({ ok: true, dropped: true });
+    }
+    const r = R.keep(ctx, g, { ws, outcome: typeof b.outcome === 'string' ? b.outcome : '', today, st });
+    if (!r.ok) return send({ ok: false, error: r.error, field: r.field || null }, r.status || 400);
+    if (ctx.invalidateNeedsAgg) ctx.invalidateNeedsAgg(ws);
+    return send(r);
+  } catch { return send({ ok: false, error: 'This did not finish. Nothing was removed. Try again.' }, 500); }
+}
+
+module.exports = { prefixes: ['/api/first-reveal'], handle };

package/workspace/lib/scan-run.js

@@ -7,7 +7,8 @@
  *   1. closes a scan that was alive when the server stopped (`scan-end`, reason "interrupted"), and writes the report documents it already held;
  *   2. starts at most one job, and none while one is running (one scan at a time across the workspace):
  *        - a suggest run for a workspace with no watch list (lib/scan.js suggestDue), or
- *        - the portfolio scan, when it is due (lib/scan.js dueNow: the cadence, 09:00, the working hours, quiet hours, once per day).
+ *        - the portfolio scan, when it is due (lib/scan.js dueNow: the cadence, 09:00, the working hours, quiet hours, once per day) and the
+ *          queue gives it an idle turn (`idle`, lib/bg-queue.js step 5: the PM stepped away, or the last hour of the working day came first).
  * The routes call the other three: Scan now (`startNow`: at most 3 a day, never in quiet hours, one at a time), an approved research proposal
  * (`startResearch`) and Stop (`stop`).
  *
@@ -292,7 +293,7 @@ function create(deps) {
     return { ok: true, scans: stopped };
   }
 
-  function tick({ now = Date.now(), env } = {}) {
+  function tick({ now = Date.now(), env, idle = true } = {}) {
     if (off(env || deps.env)) return { off: true };
     const summary = { closed: 0, started: 0 };
     const settings = deps.settings();
@@ -318,7 +319,7 @@ function create(deps) {
           if (got && got.initiatives.length) { startSuggest(w, file, got, now); summary.started++; }
           continue;
         }
-        if (S.dueNow(state, null, now, { open }).ok) {
+        if (S.dueNow(state, null, now, { open, idle }).ok) {
           const sel = S.selectScan(state, {});
           if (!sel.ok) continue;
           let ctx = { boards: [], initiatives: [] };

package/workspace/lib/scan.js

@@ -430,7 +430,7 @@ function isWorkingDay(ms, cadence) {
   return false;
 }
 const slotMs = (ms) => { const d = new Date(ms); const [h, m] = SLOT.split(':').map(Number); d.setHours(h, m, 0, 0); return d.getTime(); };
-const scheduleText = (cadence) => (cadence === 'daily' ? 'Every working day, 09:00' : cadence === 'weekly' ? 'Every Monday, 09:00' : 'Off. No scan runs');
+const scheduleText = (cadence) => (cadence === 'daily' ? 'Every working day, when you step away after 09:00' : cadence === 'weekly' ? 'Every Monday, when you step away after 09:00' : 'Off. No scan runs');
 
 /** The report types a scan can write, given the repository switch and the number of web items it will search. Web reports (benchmark, competitive, insight)
  * need an item or the repository; the productivity report needs the repository. */
@@ -441,8 +441,9 @@ function effectiveTypes(types, { repo, items }) {
 
 /** May a scheduled scan start now? `open` is the day-check window and quiet hours as one boolean (lib/driver-run.js dayCheckOpen). `board` null = the portfolio.
  * → { ok } | { ok: false, why }. A scan that missed 09:00 starts at the first tick inside the working hours of that day, never outside them.
- * One scan per day across the portfolio, whoever started it: a manual scan today is today's scan. */
-function dueNow(state, board, now, { open = true } = {}) {
+ * One scan per day across the portfolio, whoever started it: a manual scan today is today's scan. `idle` is the turn lib/bg-queue.js gave
+ * (idle lab, frame I4): the daily scan starts in the first idle stretch of the day after 09:00, or in the last working hour if none came. */
+function dueNow(state, board, now, { open = true, idle = true } = {}) {
   const cadence = cadenceOf(state);
   if (cadence === 'off') return { ok: false, why: 'off' };
   const kept = keptItems(state, board);
@@ -453,6 +454,7 @@ function dueNow(state, board, now, { open = true } = {}) {
   if (scanDay(state, board, D.localDay(now)).length) return { ok: false, why: 'done-today' };
   if (openScans(state).some((x) => !board || x.board === board)) return { ok: false, why: 'running' };
   if (!effectiveTypes(state.setting.types, { repo: state.setting.repo, items: kept.length }).length) return { ok: false, why: 'no-reports' };
+  if (!idle) return { ok: false, why: 'waiting-for-idle' };
   return { ok: true };
 }
 

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.523.0",
+  "version": "0.525.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.523.0",
+      "version": "0.525.0",
       "license": "MIT",
       "dependencies": {
         "@anthropic-ai/sdk": "^1.3.0",