create-pmos 0.69.0 → 0.69.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.69.0",
+  "version": "0.69.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@b38c47a
+kernel-source: pmos@80fcbdd
 assembled: 2026-10-07
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:49:30Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:49:30Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:49:30Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -36,7 +36,7 @@ Settings holds settings only, in eight sections:
 - **Theme**: Dark or Light.
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, one button shows: **Update to** and the version. It updates every part that is older, in this order:
   - **The kit** in the current repository, when it is older. This does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
-  - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. You do not need a terminal. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
+  - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. The reloaded page runs the new version's code: each start gives the page files a new address, so neither the browser nor the Online address's tunnel can keep the old ones. You do not need a terminal or a hard refresh. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
 
   A new screen or a renamed menu comes with the workspace app, not with the kit.
 
@@ -55,7 +55,7 @@ The dock holds your terminals, documents, conversations, skills and web pages. I
 - Press **⋯** on a row to change the name, the initiative or the type of work.
 - Press **✕** on a row to end the session. The row asks "End “name”?". Press **End** or **Cancel**. When you end the last running session on its own working copy, the message offers **Remove working copy**. This removes the folder only. The branch stays. If the folder has unsaved work, the workspace keeps it and tells you why.
 - **＋ Session** at the top of the dock, or **＋** on an initiative, opens one sheet. Type a name, or leave it empty to name the session after the skill and the initiative. **For** is the initiative. **On** is where the session runs. **Automatic** uses the initiative's own working copy on `initiative/<id>` (made the first time), or the main tree when there is no initiative. You can also choose a branch that has a working copy, or **New branch…**. Then press **Blank session** (the CLI and model from Settings) or a skill. The session starts at once.
-- The icons at the bottom of the dock show the sessions as a strip on top, give the dock the whole window (Focus), and fold the dock. On top, a select chooses the group, and each session of the group is a button. **＋** starts a session, and **✕** ends the session in front.
+- The icons at the top of the session list, under **＋ Session**, show the sessions as a strip on top, give the dock the whole window (Focus), and fold the dock. They stay in view when you scroll the list. On top, a select chooses the group, and each session of the group is a button. **＋** starts a session, and **✕** ends the session in front.
 - To make the dock wider or narrower, drag its left edge. With the edge focused, the left and right arrow keys change the width in steps. Double-click the edge to go back to the default width. The width is kept in this browser.
 - **Focus** in the dock gives the dock the whole window. The place and the detail are hidden, and the dock stays full width on every place. Press Focus again, or ⌘⇧J (Ctrl-Shift-J), to show the place again. Folding the dock also ends Focus.
 - **Scratchpad** in the bar at the bottom of the dock opens and closes the scratchpad. The pad keeps one note for each terminal session, and one for the repository when no terminal is in front. **Send to terminal** types the note into the session in front and presses Enter. It is available only when a terminal is in front. **Copy** and **Clear** act on the note.

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.69.0",
+  "version": "0.69.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.69.0",
+  "version": "0.69.2",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/components.css

@@ -2500,13 +2500,21 @@
   align-self: center;
   padding: 0 6px;
 }
-.fr-ds-foot {
+.fr-ds-top {
+  position: sticky;
+  top: 0;
+  z-index: 1;
   display: flex;
+  flex-wrap: wrap;
   justify-content: flex-end;
+  align-items: center;
   gap: 4px;
-  margin-top: auto;
-  padding-top: 8px;
-  border-top: 1px solid var(--border);
+  padding-bottom: 6px;
+  background: var(--background);
+}
+/* ＋ Session keeps its whole label on its own row; the controls sit in a row under it, right-aligned, still above the list */
+.fr-ds-top .fr-session {
+  flex: 1 0 100%;
 }
 .fr-ds-note {
   margin: 0;

package/workspace/public/pm/panel-tabs.js

@@ -1139,6 +1139,7 @@ let dsMod = null;
 if (!FIXTURE) import('./dock-sessions.js').then((m) => { dsMod = m; if (inFrame()) setState({}); }).catch(() => { dsMod = null; });
 let dockParts = null;
 let dockOrient = null;
+let dockHead = null;   // the side list's head: ＋ Session and the dock's controls, one node across paints
 function frameDock() {
   if (!dockMod || !inFrame()) return null;
   const repo = currentProduct();
@@ -1429,16 +1430,18 @@ export function renderTabs(host) {
    * the frame's dock (split stays only to undo one already made). */
   if (ck && ds) {
     const others = notListed(dsMod.listedSessionIds(ds));
+    // The dock's own controls (tabs on top, Focus, Minimize) sit beside ＋ Session at the head of the list, held in view while
+    // the list scrolls: at the foot they were below every session, and a long list put them off screen.
     setChildren(tabBar, vertical ? [
-      fr.session,
+      dockHead || (dockHead = el('div', { 'data-tabs': 'vcontrols', class: 'fr-ds-top' })),
       ...dsMod.railNodes(ds, others.map((t) => dockTabRow(t, (act && act.id === t.id) || (splitTab && splitTab.id === t.id)))),
-      el('div', { 'data-tabs': 'vcontrols', class: 'fr-ds-foot' }, state.splitId ? splitBtn : null, fr.orient, fr.focus, fr.fold),
     ] : [
       ...dsMod.stripNodes(ds, others.map((t) => dockTabChip(t, (act && act.id === t.id) || (splitTab && splitTab.id === t.id)))),
       state.splitId ? splitBtn : null, fr.orient, fr.focus, fr.fold,
     ]);
   }
 
+  if (ck && ds && vertical) setChildren(dockHead, [fr.session, state.splitId ? splitBtn : null, fr.orient, fr.focus, fr.fold]);
   if (tabBar.scrollLeft !== keepX) tabBar.scrollLeft = keepX;
   if (tabBar.scrollTop !== keepY) tabBar.scrollTop = keepY;
   // When the tab in front changes, the bar scrolls just enough to show it, so a tab opened at the far end of a crowded strip or a

package/workspace/public/pm/primitives.js

@@ -61,12 +61,13 @@ export const SEL = Object.freeze({
 
 /* ── stylesheet and layer ─────────────────────────────────────────────────────────────────────────────────────────── */
 
-/** Link /pm/components.css once. index.html is not edited: the sheet arrives with the first Breakdown. */
+/** Link components.css once, from this module's own folder, so it comes from the same build as the code. index.html is
+ * not edited: the sheet arrives with the first Breakdown. */
 export function ensureComponentsCss() {
   if (typeof document === 'undefined' || document.querySelector('link[data-pmc]')) return;
   const l = document.createElement('link');
   l.rel = 'stylesheet';
-  l.href = '/pm/components.css';
+  l.href = new URL('./components.css', import.meta.url).href;
   l.setAttribute('data-pmc', '');
   document.head.appendChild(l);
 }

package/workspace/public/pm/report-view.js

@@ -140,11 +140,11 @@ export async function copyMarkdown(md) {
   return done;
 }
 
-/** Link /pm/print.css once, for print only. */
+/** Link print.css once, for print only, from this module's own folder (the same build as the code). */
 export function ensurePrintCss() {
   if (typeof document === 'undefined' || document.querySelector('link[data-rp-print]')) return;
   const l = document.createElement('link');
-  l.rel = 'stylesheet'; l.href = '/pm/print.css'; l.media = 'print';
+  l.rel = 'stylesheet'; l.href = new URL('./print.css', import.meta.url).href; l.media = 'print';
   l.setAttribute('data-rp-print', '');
   document.head.appendChild(l);
 }

package/workspace/server.js

@@ -187,6 +187,17 @@ const PUB = path.join(__dirname, 'public');
 const PM_DIR = path.join(PUB, 'pm');   // the four-panel front end — served as a directory, guarded below
 const XROOT = path.join(__dirname, 'node_modules', '@xterm');
 const APP_VERSION = (() => { try { return require('./package.json').version || null; } catch { return null; } })();
+// THE BUILD PREFIX. index.html loads the page code from /b/<BUILD>/pm/ and /b/<BUILD>/lib/, and the route below strips the
+// prefix. Each launch has a new BUILD, so after an update or a restart every page file has a new address. `no-cache`
+// alone was not enough: a page opened through the Online address (a Cloudflare tunnel) kept running the previous
+// version's modules after Update, because a cache between the browser and this server answered the old address.
+const BUILD = String(APP_VERSION || 'dev').replace(/[^0-9A-Za-z.-]/g, '') + '-' + Date.now().toString(36);
+const BUILD_RE = /^\/b\/[0-9A-Za-z.-]{1,64}(\/(?:pm|lib)\/.*)$/;
+/** index.html with its /pm/ and /lib/ references moved under this launch's build prefix, and an import map that sends an
+ * absolute import('/pm/…') to the same address, so it gets the module instance the page already holds, not a second one. */
+const withBuild = (html) => html
+  .replace(/(["'])\/(pm|lib)\//g, (m, q, dir) => q + '/b/' + BUILD + '/' + dir + '/')
+  .replace('<meta charset="utf-8" />', '<meta charset="utf-8" />\n<script type="importmap">' + JSON.stringify({ imports: { '/pm/': '/b/' + BUILD + '/pm/' } }) + '</script>');
 // ── WHERE THE PM'S RUNTIME STATE LIVES (see lib/state-root.js for the whole argument). ─────────
 // It is NOT `workspace/state/` any more. That directory is inside the application directory the
 // test suite runs from, which put the PM's live sessions, workspace registry and authored skills
@@ -5293,17 +5304,20 @@ function json(res, obj, code = 200) {
 
 async function handleRequest(req, res) {
   const url = new URL(req.url, 'http://localhost');
-  const p = url.pathname;
+  // A page file under this or an earlier launch's build prefix is the same file without it (see BUILD above).
+  const built = BUILD_RE.exec(url.pathname);
+  const p = built ? built[1] : url.pathname;
 
   if (p === '/' || p === '/index.html') {
     // pm-os-absorb Run 2 (R25, X11): the per-launch nonce goes into the base meta line, nowhere else. no-store, so a
-    // restarted server never answers a press from a page that holds the previous launch's value.
+    // restarted server never answers a press from a page that holds the previous launch's value. The page code is
+    // referenced under this launch's build prefix.
     const n = pmGuard.launchNonce();
-    if (!n) return serveFile(res, path.join(PUB, 'index.html'), null, true);
     return fs.readFile(path.join(PUB, 'index.html'), 'utf8', (err, html) => {
       if (err) { res.writeHead(404); res.end('not found'); return; }
-      const out = html.replace('<meta name="' + pmGuard.NONCE_META + '" content="" />', '<meta name="' + pmGuard.NONCE_META + '" content="' + n + '" />');
-      res.writeHead(200, { 'Content-Type': TYPES['.html'], 'Cache-Control': 'no-store' });
+      let out = withBuild(html);
+      if (n) out = out.replace('<meta name="' + pmGuard.NONCE_META + '" content="" />', '<meta name="' + pmGuard.NONCE_META + '" content="' + n + '" />');
+      res.writeHead(200, { 'Content-Type': TYPES['.html'], 'Cache-Control': 'no-cache, no-store' });
       res.end(out);
     });
   }