create-pmos 0.59.2 → 0.59.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.59.2",
+  "version": "0.59.3",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@fdeb915
+kernel-source: pmos@ad3caaf
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T14:07:26Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T14:07:26Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T14:07:26Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -217,7 +217,7 @@ Run these from a machine that is **not** signed in to Access:
 - **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
 - **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
 - **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
-- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. If the Online section says the keys did not load, check the team domain.
+- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. Settings › Online on the desktop names the check that refused the last sign-in. To see which email Cloudflare signed you in with, open `https://<your address>/cdn-cgi/access/get-identity` and read `email`.
 - **Cloudflare error 1033** — the tunnel is not running. In **Settings › Online**, check the status line, and read `online-tunnel.log` in the workspace state folder. Another `cloudflared` for the same tunnel (for example a service you installed) also serves the hostname.
 
 - **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.

package/workspace/guide/layout.md

@@ -31,7 +31,7 @@ Settings holds settings only, in seven sections:
 - **Profiles**: the Claude profiles a session can start with. They open in the detail.
 - **New sessions**: the default CLI and the default model for a new session in the dock.
 - **Validate consent**: the consent of the current repository. Turn it on or off here. **Open Validate** opens the Validate page as a tab.
-- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
+- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. When a sign-in at the address is refused, this section names the check that failed, such as the email or the AUD tag. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
 - **Theme**: Dark or Light.
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, a button shows for each part that is older:
   - **Update the kit** does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
@@ -95,8 +95,6 @@ The bar at the top has Back (when you are deeper than a tab), Repository, the na
 
 Every row has a visible ⋯ button. Every control is at least 44 pixels high. Nothing works only when you hover.
 
-When the keyboard opens or closes, or you turn the phone, the terminal fits itself to the new space. The session is told its new size when the keyboard stops moving, not at every step, so an agent redraws its screen once. Scrolling the page does not resize the terminal.
-
 ## The older layout
 
 The address options `?layout=legacy` and `?fixture=cockpit` keep the older layouts. The rest of this page describes them. In the cockpit, the workspace has four columns: the repository rail, the list, the detail and the tabs. With `?layout=legacy` it has three columns: navigation, detail and tabs.

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.59.2",
+  "version": "0.59.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.59.2",
+  "version": "0.59.3",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -204,6 +204,7 @@ function onlineSection() {
     lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-tunnel' },
       r.running ? P.onlineRunning : r.lastExit ? P.onlineExited(r.lastExit.code) : P.onlineStarting));
     if (d.keys && !d.keys.keys) lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-keys' }, d.keys.lastError ? P.onlineKeysError(d.keys.lastError) : P.onlineKeysWait));
+    if (d.lastRefusal) lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-refused', role: 'status' }, P.onlineRefused(d.lastRefusal.reason, d.lastRefusal.at)));
   }
   if (!d.canChange) return section('online', P.online, [...lines, el('p', { class: 'fr-set__note' }, P.onlineRemote)]);
   const f = (key, label, placeholder) => field({

package/workspace/public/pm/frame-copy.js

@@ -170,6 +170,18 @@ export const COPY = {
     onlineEnv: (host) => `Online at https://${host}/, set by PMOS_PUBLIC_HOST when the workspace started. It signs in with the token. Restart the workspace without PMOS_PUBLIC_HOST to use this switch.`,
     onlineRemote: 'Only the computer that runs the workspace can change this.',
     onlineUnread: 'The Online settings did not load.',
+    onlineRefused: (reason, at) => `The last sign-in at the public address was refused${at ? ` (${at.slice(11, 16)} UTC)` : ''}: ${({
+      malformed: 'Cloudflare sent no sign-in, or one PMOS cannot read. Check that the Access application covers the public address.',
+      algorithm: 'the sign-in was not signed the way Cloudflare Access signs.',
+      'unknown key': 'it was signed with a key this team does not publish. Check the team domain.',
+      'no keys': 'Cloudflare\'s sign-in keys are not loaded. Check the team domain.',
+      signature: 'its signature did not match. Check the team domain.',
+      issuer: 'it came from another Cloudflare team. Check the team domain.',
+      audience: 'it was for another Access application. Check the audience (AUD) tag: copy it from the application for the public address.',
+      expired: 'it had expired, or this computer\'s clock is wrong. Sign in again.',
+      'not yet valid': 'it is not valid yet, so this computer\'s clock is probably wrong.',
+      email: 'you signed in with another email. The email field must be the address you sign in to Cloudflare with.',
+    })[reason] || reason}`,
     updates: 'Updates',
     updatesCheck: 'Check for updates',
     updatesChecking: 'Checking for updates…',

package/workspace/public/pm/mobile.js

@@ -505,11 +505,10 @@ export function mountMobile(context) {
   if (theme) theme.addEventListener('click', toggleTheme);
   document.addEventListener('click', onChromeClick);
 
-  /* `resize` only. A visual-viewport SCROLL moves the page under the keyboard and changes no box,
-   * so there is nothing to re-fit — but it fires on every frame of a touch scroll, and each one used
-   * to become a synthetic window `resize` that every resize listener on the page answered. That was
-   * the terminal stuttering under a finger on a phone. */
-  if (window.visualViewport) window.visualViewport.addEventListener('resize', refit);
+  if (window.visualViewport) {
+    window.visualViewport.addEventListener('resize', refit);
+    window.visualViewport.addEventListener('scroll', refit);
+  }
   window.addEventListener('orientationchange', () => setTimeout(refit, 250));
 
   // Crossing the breakpoint (rotate a tablet, drag a window narrow) has to re-decide whether the

package/workspace/public/pm/tab-term.js

@@ -678,25 +678,7 @@ function syncSize(rec) {
   if (!rec.sessionId || rec.attachedId !== rec.sessionId) return;
   const cols = rec.term.cols, rows = rec.term.rows;
   if (!cols || !rows) return;
-  if (rec.sentCols === cols && rec.sentRows === rows) { clearTimeout(rec.sizeTimer); rec.sizeTimer = null; return; }
-  /* The FIRST statement on an attach goes out at once: until it does, the shell is drawing into the
-   * 80×24 it was spawned with. A CHANGE after that waits for the grid to settle. A phone's soft
-   * keyboard slides in over about a quarter of a second and the pane is re-fitted on every frame of
-   * it; each `resize` the PTY gets makes a full-screen agent CLI repaint everything it shows, so
-   * stating every intermediate grid buried the session under a dozen redraws of screens that were
-   * gone before they arrived. The local fit is not delayed — only what the shell is told. */
-  if (rec.sentCols == null) { sendSize(rec); return; }
-  clearTimeout(rec.sizeTimer);
-  rec.sizeTimer = setTimeout(() => { rec.sizeTimer = null; sendSize(rec); }, RESIZE_SETTLE_MS);
-}
-
-/** How long the grid must hold still before a change is stated to the PTY. See syncSize. */
-const RESIZE_SETTLE_MS = 120;
-
-function sendSize(rec) {
-  if (!rec.term || !rec.sessionId || rec.attachedId !== rec.sessionId) return;
-  const cols = rec.term.cols, rows = rec.term.rows;
-  if (!cols || !rows || (rec.sentCols === cols && rec.sentRows === rows)) return;
+  if (rec.sentCols === cols && rec.sentRows === rows) return;
   if (send({ t: 'resize', id: rec.sessionId, cols, rows })) { rec.sentCols = cols; rec.sentRows = rows; }
 }
 
@@ -712,40 +694,19 @@ function note(rec, line, force) {
  * The single entry point. Coalesced into one animation frame so the six triggers below cost one
  * measure per frame rather than six. A pane that is not in the document, or has no box yet, is
  * skipped — fitting a zero-sized element is how a terminal ends up 1×1 and stays there.
- *
- * A pane whose box has not moved since it was last fitted is NOT re-measured. Every state change
- * in the app lands here (the `subscribe` below), and a fit is a getComputedStyle round-trip on the
- * terminal's parent per pane — on a phone, that was a forced style pass on every render for a grid
- * that could not have changed. The grid depends on the box and on the cell size; the box is the key
- * here, and the one event that moves the cell size without moving the box (the web font arriving)
- * passes `force`.
  */
 let refitQueued = false;
-let refitForce = false;
 
-export function refitVisible(force) {
-  if (force === true) refitForce = true;
+export function refitVisible() {
   if (refitQueued) return;
   refitQueued = true;
   const run = () => {
     refitQueued = false;
-    const forced = refitForce;
-    refitForce = false;
     for (const rec of panes.values()) {
       if (rec.kind !== 'real' || !rec.fit || !rec.host) continue;
       if (!rec.host.isConnected) continue;
-      const w = rec.host.offsetWidth, h = rec.host.offsetHeight;
-      if (!w || !h) continue;
-      if (!forced && rec.fitW === w && rec.fitH === h) { syncSize(rec); continue; }
-      try {
-        // Measured first, so a pane whose renderer cannot measure yet is retried next time rather
-        // than remembered as fitted at a grid it never reached.
-        const dims = rec.fit.proposeDimensions();
-        if (dims && dims.cols > 0 && dims.rows > 0) {
-          if (dims.cols !== rec.term.cols || dims.rows !== rec.term.rows) rec.fit.fit();
-          rec.fitW = w; rec.fitH = h;
-        }
-      } catch { /* a terminal mid-teardown */ }
+      if (!rec.host.offsetWidth || !rec.host.offsetHeight) continue;
+      try { rec.fit.fit(); } catch { /* a terminal mid-teardown */ }
       // …and state the resulting grid to the PTY. `fit()` only fires xterm's `onResize` when the
       // grid MOVES, so a pane that was measured before it had a session would otherwise never tell
       // the shell how wide it is. See the `attached` handler.
@@ -763,8 +724,7 @@ if (typeof window !== 'undefined') {
   subscribe(() => refitVisible());
   window.addEventListener('resize', () => refitVisible());
   document.addEventListener('visibilitychange', () => { if (!document.hidden) refitVisible(); });
-  // The face changes the CELL, not the box, so this one re-measures every pane regardless.
-  if (document.fonts && document.fonts.ready) document.fonts.ready.then(() => refitVisible(true)).catch(() => {});
+  if (document.fonts && document.fonts.ready) document.fonts.ready.then(() => refitVisible()).catch(() => {});
 }
 
 /* ── fixture pane ──────────────────────────────────────────────────────────────────────────── */
@@ -971,7 +931,6 @@ export function disposeTerm(tab) {
    * pane for the id and detaches from the orphan instead. */
   if (rec.kind !== 'real') return;
   if (rec.ro) { try { rec.ro.disconnect(); } catch { /* ignore */ } }
-  if (rec.sizeTimer) { clearTimeout(rec.sizeTimer); rec.sizeTimer = null; }
   if (rec.sessionId) {
     send({ t: 'detach', id: rec.sessionId });
     SOCK.attached.delete(rec.sessionId);
@@ -1099,9 +1058,6 @@ export function termProbe() {
  */
 export function __handleForTest(m) { return handle(m); }
 
-/* `fit` is the name mobile.js asks for when the soft keyboard or a rotation moves the box. Without it
- * that module fell back to dispatching a synthetic window `resize`, which every resize listener on
- * the page answered — not only this one. */
-if (typeof window !== 'undefined') window.pmTerm = { refitVisible, fit: () => refitVisible(), termProbe, panes, requestSpawn };
+if (typeof window !== 'undefined') window.pmTerm = { refitVisible, termProbe, panes, requestSpawn };
 
 export default mountTerm;

package/workspace/server.js

@@ -302,7 +302,8 @@ const TOKEN = BIND.token || null;                     // non-loopback peers must
 const onlineMode = require('./lib/online-mode');
 const accessJwt = require('./lib/access-jwt');
 const accessKeys = require('./lib/access-keys');
-const ONLINE = { settings: onlineMode.read(STATE), keys: null, keysTeam: null, fetchKeys: accessKeys.fetchCerts, find: onlineMode.findCloudflared };
+const ONLINE = { settings: onlineMode.read(STATE), keys: null, keysTeam: null, fetchKeys: accessKeys.fetchCerts, find: onlineMode.findCloudflared,
+  lastRefusal: null };   // { reason, at } of the last refused sign-in: a fixed reason word only, never the assertion or a claim (D08)
 const tunnel = onlineMode.createTunnel({ stateDir: STATE, find: () => ONLINE.find() });
 /** The public hostname the guards admit right now: the environment's, else the Online switch's while it is on. */
 function publicHost() { return BIND.publicHost || (ONLINE.settings.on ? ONLINE.settings.host : null); }
@@ -331,21 +332,26 @@ function applyOnline() {
 /** The D89 decision for one request: { ok: true } or { ok: false, reason }. The assertion is never logged (D08). */
 async function accessVerdict(headers) {
   const s = ONLINE.settings; const store = ONLINE.keys;
-  if (!store) return { ok: false, reason: 'no keys' };
+  if (!store) { const v = { ok: false, reason: 'no keys' }; noteVerdict(v); return v; }
   try { await store.ensure(); } catch { /* the store records its own error */ }
   const token = (headers || {})['cf-access-jwt-assertion'];
   const opts = { keyFor: store.keyFor, teamDomain: s.team, audience: s.audience, email: s.email, now: Math.floor(Date.now() / 1000) };
   let v = accessJwt.verify(token, opts);
   if (!v.ok && v.reason === 'unknown key' && v.kid && await store.refetchFor(v.kid)) v = accessJwt.verify(token, opts);
+  noteVerdict(v);
   return v;
 }
+/** Keep the reason of the last refusal for Settings › Online, so the PM can see which check failed. A pass clears it. */
+function noteVerdict(v) {
+  ONLINE.lastRefusal = v && v.ok ? null : { reason: String((v && v.reason) || 'unknown'), at: new Date().toISOString() };
+}
 /** The Online record and state, as GET /api/online returns it. Nothing secret is in it: the fields are not credentials. */
 function onlineView(req) {
   const s = ONLINE.settings;
   return {
     ok: true, on: s.on, host: s.host, tunnel: s.tunnel, team: s.team, audience: s.audience, email: s.email,
     complete: onlineMode.complete(s), envHost: BIND.publicHost || null, cloudflared: !!ONLINE.find(),
-    running: tunnel.status(), keys: ONLINE.keys ? ONLINE.keys.status() : null,
+    running: tunnel.status(), keys: ONLINE.keys ? ONLINE.keys.status() : null, lastRefusal: ONLINE.lastRefusal,
     canChange: onlineChangeAllowed(req),
   };
 }
@@ -453,13 +459,6 @@ function profileOverlay(profile) {
 }
 
 const SCROLLBACK = 200_000;                            // bytes of ring buffer per session
-const SCROLLBACK_SLACK = 32_768;                       // how far the ring may run over before a trim (appendBuf)
-// PTY output goes on the wire at most once per this window per session (queueOutput). node-pty
-// hands over whatever one read() returned, which for an agent CLI repainting its screen is many
-// small chunks — each one a JSON frame, a WebSocket message and a parse in the browser. The first
-// chunk after a quiet spell is sent at once, so a keystroke's echo is never delayed by it.
-const OUTPUT_COALESCE_MS = 4;
-const OUTPUT_COALESCE_MAX = 64 * 1024;                 // …and flushed at once past this, so a flood stays bounded
 // How often the server re-broadcasts the session list while anything is alive (see heartbeat()).
 // 2s is chosen against what it drives: the state dot and the quiet clock. QUIET_AFTER_MS is 30s, so
 // a 2s cadence puts the worst-case error in "quiet 31s" at one tick — under the rounding the UI
@@ -2843,11 +2842,7 @@ function trimBuf(buf, limit) {
 
 function appendBuf(s, data) {
   s.buf += data;
-  // Trimmed with SLACK, not on every byte past the limit. Once a busy session's ring is full, a trim
-  // per chunk flattens and scans the whole 200 KB string for each few bytes an agent CLI repaints —
-  // a spinner alone is dozens of chunks a second. Letting the ring run SCROLLBACK_SLACK over and then
-  // cutting it back to SCROLLBACK does the same work once per 32 KB of output.
-  if (s.buf.length > SCROLLBACK + SCROLLBACK_SLACK) s.buf = trimBuf(s.buf, SCROLLBACK);
+  if (s.buf.length > SCROLLBACK) s.buf = trimBuf(s.buf, SCROLLBACK);
   s.bufDirty = true;                    // the periodic writer skips a session that is not dirty
   // Parser 2's whole input: the moment output last arrived. `quiet` is derived from this, never
   // from reading the bytes — which is why it is the only one of the five that cannot misread.
@@ -2855,46 +2850,6 @@ function appendBuf(s, data) {
   s.parsed = null;                      // buffer moved; the cached parse is stale
 }
 
-/**
- * Put PTY output on the wire as at most ONE frame per OUTPUT_COALESCE_MS per session.
- *
- * Leading edge, then a window: a chunk that arrives when nothing has been sent recently goes out at
- * once — a keystroke's echo is never held back — and opens a window in which further chunks are
- * gathered and sent together when it closes. A burst (an agent CLI repainting its screen) therefore
- * costs one frame per window instead of one per node-pty read, and a lone echo costs nothing.
- *
- * The bytes reach the ring (`appendBuf`) at the same moment they reach the clients, never before:
- * a client that attaches in between gets `buf` without the pending bytes and then the flush, so it
- * sees every byte exactly once and in order. Anything that writes to `buf` directly while output may
- * be pending (the exit note) calls `flushOutput` first for the same reason.
- */
-function queueOutput(s, data) {
-  if (!data) return;
-  if (s._out) s._out += data; else s._out = data;
-  if (!s._outTimer) { sendOutput(s); s._outTimer = setTimeout(() => closeOutputWindow(s), OUTPUT_COALESCE_MS); return; }
-  if (s._out.length >= OUTPUT_COALESCE_MAX) sendOutput(s);
-}
-function closeOutputWindow(s) {
-  s._outTimer = null;
-  if (!s._out) return;
-  // Output kept arriving through the window: send it, and keep gathering for one more window.
-  sendOutput(s);
-  s._outTimer = setTimeout(() => closeOutputWindow(s), OUTPUT_COALESCE_MS);
-}
-function flushOutput(s) {
-  if (s._outTimer) { clearTimeout(s._outTimer); s._outTimer = null; }
-  sendOutput(s);
-}
-function sendOutput(s) {
-  const data = s._out;
-  if (!data) return;
-  s._out = '';
-  appendBuf(s, data);
-  if (!s.clients || !s.clients.size) return;
-  const frame = JSON.stringify({ t: 'data', id: s.id, data });
-  for (const c of s.clients) if (c.readyState === 1) c.send(frame);
-}
-
 // Platform-correct guidance when a spawn fails. On macOS `posix_spawnp failed` is almost always
 // node-pty's prebuilt `spawn-helper` missing its executable bit (prebuild extraction drops it) —
 // the binary is fine, just not +x. The server auto-restores it at startup and `npm run doctor`
@@ -3128,7 +3083,8 @@ function attachPty(s, { seed = false } = {}) {
     onOutput: (pane, text) => {
       if (paneId && pane !== paneId) return;              // only this session's pane
       if (s._reattempts) s._reattempts = 0;               // a working attach clears the retry budget
-      queueOutput(s, text);
+      appendBuf(s, text);
+      for (const c of s.clients) if (c.readyState === 1) c.send(JSON.stringify({ t: 'data', id: s.id, data: text }));
     },
   });
   p.onData((d) => parser.feed(d));
@@ -3136,7 +3092,6 @@ function attachPty(s, { seed = false } = {}) {
   // on the client PTY's own window size.
   client.resize(s.cols || 80, s.rows || 24);
   p.onExit(({ exitCode }) => {
-    flushOutput(s);   // whatever the pane said last lands before a reconnect or the exit note
     s.pty = null;
     // Our PTY is the tmux CLIENT: it exits when the pane process ends AND on a mere detach. If
     // the tmux session is still alive, the process lives on — reconnect (bounded, to never spin).
@@ -3378,9 +3333,11 @@ function spawnSession({ name, agent, cwd, ws, origin, initialInput, profile, ini
   announceStateHealth(s);
   announceTree(s);   // registered first: a session's co-tenancy question includes itself in the map
   announceModel(s);
-  p.onData((d) => queueOutput(s, d));
+  p.onData((d) => {
+    appendBuf(s, d);
+    for (const c of s.clients) if (c.readyState === 1) c.send(JSON.stringify({ t: 'data', id, data: d }));
+  });
   p.onExit(({ exitCode }) => {
-    flushOutput(s);   // the last bytes the process wrote come before the exit note, in the ring and on the wire
     s.state = 'exited'; s.pty = null;
     const fast = Date.now() - startedMs < 800;   // exited almost immediately → surface a hint
     s.note = fast
@@ -8241,7 +8198,7 @@ function httpGuard(req, res) {
     accessVerdict(req.headers).then((v) => {
       if (v.ok) return handleRequest(req, res);
       res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));
+      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace. Settings › Online on the computer that runs it says which check failed' }));
     }, () => {
       res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
       res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));
@@ -8544,7 +8501,7 @@ module.exports = { server, online: { ONLINE, applyOnline, tunnel, publicHost },
   stripLegacyClientScreen,
   // the scrollback ring's front trim, exported pure so the suite can assert that a cut never lands
   // inside an escape sequence or between the halves of a surrogate pair.
-  trimBuf, SCROLLBACK, queueOutput, flushOutput, OUTPUT_COALESCE_MS,
+  trimBuf, SCROLLBACK,
   // the liveness heartbeat's guard, exported pure so the "idle machine stays idle" half can be
   // asserted without a server that has no clients (the suite always has both).
   shouldHeartbeat, LIVENESS_MS, TX_REREAD_MS,