create-pmos 0.7.0 → 0.7.2

package/README.md

@@ -333,6 +333,66 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.7.2
+
+**A fix — read this if you use the Terminal Workspace on a machine with `tmux` installed.**
+
+0.7.0 and 0.7.1 both shipped a workspace terminal that renders **gibberish** there. Box-drawing
+characters, check marks, spinners, emoji and accented letters all arrived damaged, and the output
+lost its structure — which matters because agent CLIs print those constantly, so in practice most
+frames were affected. If your terminal has looked broken since 0.7.0, this is why, and it was our
+bug, not your setup.
+
+The cause: the workspace drives `tmux` in control mode, and that stream is **bytes**. `tmux` escapes
+only the control characters and the backslash — every byte of a UTF-8 character passes through raw.
+The workspace decoded that stream as text and then narrowed it back to bytes, which does not merely
+lose characters, it *manufactures* control codes out of the wreckage. `┌` became a **form feed**,
+which is why the layout collapsed and not just the glyphs.
+
+- **Fixed.** The control stream is now handled as bytes end to end, with a single UTF-8 decode in
+  one place. A character split across two `tmux` frames still survives.
+- **A second, smaller source of the same symptom, also fixed.** The scrollback ring trims from the
+  front once it fills, and it used to cut at an arbitrary offset — routinely *inside* an escape
+  sequence, so the leftover fragment replayed as literal rubble like `5;203m` when you reattached.
+  It now cuts at a line boundary.
+- **Nothing else changed.** 0.7.2 carries this fix and only this fix.
+
+**You were only affected if `tmux` is on your PATH.** The workspace falls back to a direct terminal
+when it is not, and that path never had the defect — which is exactly why this survived two
+releases. The regression test now reports which of the two transports it exercised, so a green run
+on a machine without `tmux` can no longer read as if it had covered the one that broke.
+
+## What's new in 0.7.1
+
+**A correction to 0.7.0 — read this if you used the review surface.**
+
+0.7.0 shipped the summoned document review with a defect in the part that records *why* you changed
+an agent's proposal. The client sent a fixed reason — `incomplete` — on **every** edit, whatever the
+actual reason was. So any correction record written by 0.7.0 carries a reason that is very likely
+false, in the one file whose whole purpose is to make the human-correction rate trustworthy.
+
+If you ran a review on 0.7.0, treat the `reason` field in `planning/runs/correction-records.jsonl` as
+unreliable. Everything else in those records — the agent's text, your text, the attribution — is
+sound.
+
+- **You pick the reason now.** Applying an edit asks *what was wrong with it?* and offers
+  `factually wrong · incomplete · wrong scope · style · other…`. It **nudges rather than defaulting**,
+  and `other` asks for a few words. Dismiss is still one click — friction belongs on the action that
+  teaches something, not the common one.
+- **A half-applied state is now impossible.** The record was validated *after* the document was
+  written, so a missing reason could leave your file changed with nothing recorded. Validation runs
+  first: every refusal leaves the repository byte-identical.
+- **The counters are on the surface, and honest.** Dispositions, corrections and the action rate are
+  derived from the records themselves. Quiet-on-clean reads **`not measured`** rather than a
+  flattering zero — measuring it needs a corpus of documents known to be clean, which does not exist
+  yet.
+
+**The disclosure from 0.7.0 still stands**, and it matters more than this release note: the review
+surface has **not** been through its own review gate. Its false-positive rate is unmeasured. It
+withholds any proposal that would close a recorded open question or overwrite a decision — that guard
+is tested, including in a real browser — but nothing yet tells you how often its findings are simply
+wrong. Use it on documents you are willing to read carefully.
+
 ## What's new in 0.7.0
 
 **The workspace GUI has layouts.** Until now it had exactly one arrangement: a fixed sidebar, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@a2227ff
+kernel-source: pmos@bd8056d
 assembled: 2026-07-28
 mode: vendor

package/workspace/lib/tmux-control.js

@@ -17,28 +17,55 @@
 // The protocol, as it actually arrives on the wire:
 //   \x1bP1000p                       DCS introducer, once, before the first line
 //   %begin <t> <n> <f> … %end        a command's reply is wrapped in a begin/end block
-//   %output %0 line-1\015\012…       pane bytes, NON-PRINTABLES OCTAL-ESCAPED (\015 = CR)
+//   %output %0 line-1\015\012…       pane bytes, with SOME bytes octal-escaped (\015 = CR)
 //   %exit [reason]                   the control client is going away
 //   %session-changed, %window-*, …   notifications we do not need
-// Lines are CRLF-terminated. Because every byte outside printable ASCII is octal-escaped, the
-// control stream itself is pure ASCII — so reading the client PTY as utf8 is safe, and the real
-// UTF-8 decoding happens HERE, after unescaping, with a streaming decoder (a multi-byte character
-// can be split across two %output frames).
+//
+// THE CONTROL STREAM IS BYTES, NOT TEXT. tmux escapes only `c < 0x20` and the backslash itself
+// (control.c); every byte >= 0x80 is written through RAW. So a `─` (E2 94 80) arrives on the wire
+// as three raw high bytes, NOT as three octal escapes. Reading the client PTY as a utf8 STRING and
+// then narrowing each code unit back to a byte therefore destroys every non-ASCII character —
+// U+2500 & 0xff = 0x00, U+250C & 0xff = 0x0C (a form feed), U+2713 & 0xff = 0x13 — which is
+// injected control codes and replacement characters in the pane: box-drawing rubble, mangled
+// layout, gibberish. Verified against tmux 3.4.
+//
+// So this parser works on BUFFERS end to end, and the single UTF-8 decode happens HERE, after
+// unescaping, with a per-pane streaming decoder (a multi-byte character can be split across two
+// %output frames). The caller must read the control client's PTY with `encoding: null`.
 
 const { StringDecoder } = require('string_decoder');
 
+const LF = 0x0a, CR = 0x0d, BACKSLASH = 0x5c, SPACE = 0x20, PCT = 0x25;
+const EMPTY = Buffer.alloc(0);
+const DCS = Buffer.from('\x1bP1000p', 'latin1');       // introducer, once, before the first line
+const ST = Buffer.from('\x1b\\', 'latin1');            // string terminator, may trail the last
+
+const isOct = (b) => b >= 0x30 && b <= 0x37;
+
+// A control-mode chunk is a byte stream. A string is accepted for ASCII test fixtures and is read
+// as latin1 — one code unit per byte — because that is the only faithful string view of bytes.
+const toBytes = (chunk) => (Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'latin1'));
+
+function startsWithAscii(buf, s) {
+  if (buf.length < s.length) return false;
+  for (let i = 0; i < s.length; i++) if (buf[i] !== s.charCodeAt(i)) return false;
+  return true;
+}
+
 // tmux escapes a byte as a backslash + exactly three octal digits (backslash itself is \134),
-// so there is no two-character `\\` case to handle — only the octal form.
-function unescapeToBytes(s) {
-  const out = Buffer.allocUnsafe(s.length);
+// so there is no two-character `\\` case to handle — only the octal form. Every other byte,
+// INCLUDING the raw >= 0x80 bytes of a UTF-8 sequence, passes through untouched.
+function unescapeToBytes(input) {
+  const buf = toBytes(input);
+  const out = Buffer.allocUnsafe(buf.length);
   let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c === 0x5c && i + 3 < s.length) {                       // '\'
-      const oct = s.slice(i + 1, i + 4);
-      if (/^[0-7]{3}$/.test(oct)) { out[n++] = parseInt(oct, 8) & 0xff; i += 3; continue; }
+  for (let i = 0; i < buf.length; i++) {
+    if (buf[i] === BACKSLASH && i + 3 < buf.length && isOct(buf[i + 1]) && isOct(buf[i + 2]) && isOct(buf[i + 3])) {
+      out[n++] = (((buf[i + 1] - 0x30) << 6) | ((buf[i + 2] - 0x30) << 3) | (buf[i + 3] - 0x30)) & 0xff;
+      i += 3;
+      continue;
     }
-    out[n++] = c & 0xff;
+    out[n++] = buf[i];
   }
   return out.subarray(0, n);
 }
@@ -49,51 +76,68 @@ function unescapeToBytes(s) {
  * @param {(paneId: string, text: string) => void} h.onOutput  decoded pane bytes
  * @param {(reason: string) => void} [h.onExit]                %exit seen
  * @param {(lines: string[], isError: boolean) => void} [h.onBlock]  a %begin…%end command reply
- * @returns {{feed: (chunk: string) => void}}
+ * @returns {{feed: (chunk: Buffer|string) => void}}
  */
 function createParser({ onOutput, onExit, onBlock } = {}) {
-  let pending = '';                       // partial line carried between chunks
+  let pending = EMPTY;                    // partial line carried between chunks, as BYTES
   let inBlock = false;
   let block = [];
   const decoders = new Map();             // paneId → StringDecoder, for split multi-byte chars
 
   function line(raw) {
     // The DCS introducer rides in front of the very first line; the terminator can trail the last.
-    let l = raw.replace(/^\x1bP1000p/, '').replace(/\x1b\\$/, '');
+    let l = raw;
+    if (startsWithAscii(l, '\x1bP1000p')) l = l.subarray(DCS.length);
+    if (l.length >= ST.length && l[l.length - 2] === ST[0] && l[l.length - 1] === ST[1]) {
+      l = l.subarray(0, l.length - ST.length);
+    }
     if (inBlock) {
-      if (l.startsWith('%end') || l.startsWith('%error')) {
+      // A command reply is text (it is what tmux printed for `capture-pane` and friends), so it
+      // decodes as UTF-8 in one shot — a reply line always arrives whole.
+      if (startsWithAscii(l, '%end') || startsWithAscii(l, '%error')) {
         inBlock = false;
-        if (onBlock) onBlock(block, l.startsWith('%error'));
+        if (onBlock) onBlock(block, startsWithAscii(l, '%error'));
         block = [];
-      } else block.push(l);
+      } else block.push(l.toString('utf8'));
       return;
     }
-    if (l.startsWith('%begin')) { inBlock = true; block = []; return; }
-    if (l.startsWith('%output ')) {
-      // %output %<pane> <escaped bytes>   — the data may legitimately be empty
-      const m = /^%output (%\d+) ?([\s\S]*)$/.exec(l);
-      if (!m || !onOutput) return;
-      const pane = m[1];
+    if (startsWithAscii(l, '%begin')) { inBlock = true; block = []; return; }
+    if (startsWithAscii(l, '%output ')) {
+      // %output %<pane> <bytes>   — the data may legitimately be empty. The header is pure ASCII,
+      // so it is scanned by byte offset; everything after the separating space is PANE BYTES and is
+      // never treated as text until the decoder below.
+      if (!onOutput) return;
+      let j = 8;                                             // past '%output '
+      if (l[j] !== PCT) return;                              // '%' of the pane id
+      let k = j + 1;
+      while (k < l.length && l[k] >= 0x30 && l[k] <= 0x39) k++;
+      if (k === j + 1) return;                               // no digits — not a pane id
+      const pane = l.subarray(j, k).toString('latin1');
+      const data = l[k] === SPACE ? l.subarray(k + 1) : l.subarray(k);
       let dec = decoders.get(pane);
       if (!dec) { dec = new StringDecoder('utf8'); decoders.set(pane, dec); }
-      const text = dec.write(unescapeToBytes(m[2]));
+      const text = dec.write(unescapeToBytes(data));
       if (text) onOutput(pane, text);
       return;
     }
-    if (l.startsWith('%exit')) { if (onExit) onExit(l.slice(5).trim()); return; }
+    if (startsWithAscii(l, '%exit')) { if (onExit) onExit(l.subarray(5).toString('utf8').trim()); return; }
     // every other %notification (session-changed, window-add, layout-change, …) is not needed here
   }
 
   return {
     feed(chunk) {
-      pending += chunk;
-      let i;
-      while ((i = pending.indexOf('\n')) !== -1) {
-        let l = pending.slice(0, i);
-        pending = pending.slice(i + 1);
-        if (l.endsWith('\r')) l = l.slice(0, -1);
-        line(l);
+      const b = toBytes(chunk);
+      pending = pending.length ? Buffer.concat([pending, b]) : b;
+      // %output data never contains a raw LF — tmux escapes every byte below 0x20 — so splitting
+      // the stream on LF can never cut a frame in half.
+      let start = 0, i;
+      while ((i = pending.indexOf(LF, start)) !== -1) {
+        const end = i > start && pending[i - 1] === CR ? i - 1 : i;
+        line(pending.subarray(start, end));
+        start = i + 1;
       }
+      // Copy the remainder rather than holding a subarray: a subarray pins the whole parent chunk.
+      pending = start >= pending.length ? EMPTY : (start ? Buffer.from(pending.subarray(start)) : pending);
     },
   };
 }

package/workspace/public/app.js

@@ -1905,9 +1905,27 @@ function reviewBody(p) {
     <div class="rv-lede">${esc(lede)}</div>
     <div class="rv-sub">Read ${p.read.map((r) => `<span class="mono">${esc(r)}</span>`).join(', ')}.</div>
     ${p.findings.map((f, i) => rvFinding(f, i)).join('')}
-    <div class="rv-tail">Read ${p.read.length} document${p.read.length === 1 ? '' : 's'}. <b>Nothing written.</b></div>
+    <div class="rv-tail">Read ${p.read.length} document${p.read.length === 1 ? '' : 's'}. <b>Nothing written.</b>${rvStats(p.stats)}</div>
   </div>`;
 }
+// The PRD's success signal, on the face of the surface. Action rate comes straight off the correction
+// records. Quiet-rate CANNOT — it needs a corpus with a labelled clean class, which does not exist —
+// so it says "not measured" rather than rendering a flattering zero. An unmeasured number shown as a
+// number is the watermelon this whole surface exists to catch.
+function rvStats(s) {
+  if (!s || !s.dispositions) return '';
+  const pct = (v) => (v == null ? null : `${Math.round(v * 100)}%`);
+  const bits = [
+    `${s.dispositions} disposition${s.dispositions === 1 ? '' : 's'}`,
+    `${s.corrections} correction${s.corrections === 1 ? '' : 's'}`,
+    `acted on ${pct(s.action_rate)}`,
+    `quiet on clean <i>not measured</i>`,
+  ];
+  const warn = s.inferred_attributions
+    ? ` <b class="rv-bad">${s.inferred_attributions} inferred attribution${s.inferred_attributions === 1 ? '' : 's'}</b>`
+    : '';
+  return `<div class="rv-stats">${bits.join(' · ')}${warn}</div>`;
+}
 function rvFinding(f, i) {
   const ev = (f.evidence || []).map((e) => `${e.file}:${e.line}`).join(' · ');
   // Three states, and only one of them offers a write. `settled` is terminal for this review.
@@ -1930,6 +1948,13 @@ function rvFinding(f, i) {
 // The edit surface: opens IN PLACE under the finding — no modal, no mode switch, no navigation.
 // Gutter change bars are the VS Code cue; the replaced lines sit struck through above the new ones.
 // Cancel needs no write path at all — it just closes, which is the whole of "Cancel writes nothing".
+// The reason taxonomy, deliberately short. A vocabulary nobody can hold in their head gets skipped,
+// and a skipped reason is a record that teaches nothing. Values match correction-record.js's REASONS;
+// the server rejects anything outside it, so this list can never drift into inventing one.
+const RV_REASONS = [
+  ['factually-wrong', 'factually wrong'], ['incomplete', 'incomplete'],
+  ['wrong-scope', 'wrong scope'], ['style', 'style'], ['other', 'other…'],
+];
 function rvEditor(f, i) {
   const before = (f.proposal && f.proposal.before) || '';
   const after = (f.proposal && f.proposal.after) || '';
@@ -1940,6 +1965,11 @@ function rvEditor(f, i) {
       ${before.split('\n').map((l) => `<div class="rv-l was"><span class="g"></span><span class="t">${esc(l)}</span></div>`).join('')}
     </div>
     <textarea class="rv-ta" data-rv-ta="${i}" spellcheck="false" rows="${Math.min(12, Math.max(3, nl(after) + 1))}">${esc(after)}</textarea>
+    <div class="rv-reason" data-rv-reason="${i}">
+      <span class="rv-only">What was wrong with it?</span>
+      ${RV_REASONS.map((r) => `<button class="rv-rz" data-rv-rz="${i}" data-val="${r[0]}">${esc(r[1])}</button>`).join('')}
+    </div>
+    <input class="rv-note" data-rv-note="${i}" hidden placeholder="in a few words…" aria-label="Why" autocomplete="off" />
     <div class="rv-acts">
       <button data-rv-save="${i}">Apply</button>
       <button class="q" data-rv-cancel="${i}">Cancel</button>
@@ -1972,13 +2002,40 @@ function wireReview() {
   });
   $('docBody').querySelectorAll('[data-rv-apply]').forEach((b) => b.onclick = () => rvDispose(F(b.dataset.rvApply), 'apply'));
   $('docBody').querySelectorAll('[data-rv-dismiss]').forEach((b) => b.onclick = () => rvDispose(F(b.dataset.rvDismiss), 'dismiss'));
+  // The reason tap. Required on an edit (R8 / correction-record.js) — an edit is where the agent was
+  // wrong in a way worth knowing, and a record that cannot say HOW is the self-report this feature
+  // exists to replace. Dismiss stays one click: friction belongs on the informative action, not the
+  // common one (PRD open question 2).
+  $('docBody').querySelectorAll('[data-rv-rz]').forEach((b) => b.onclick = () => {
+    const n = b.dataset.rvRz;
+    const row = $('docBody').querySelector(`[data-rv-reason="${n}"]`);
+    row.querySelectorAll('.rv-rz').forEach((x) => x.classList.toggle('on', x === b));
+    row.dataset.picked = b.dataset.val;
+    const note = $('docBody').querySelector(`[data-rv-note="${n}"]`);
+    note.hidden = b.dataset.val !== 'other';                 // 'other' is only useful with words
+    if (b.dataset.val === 'other') note.focus();
+    const nudge = row.querySelector('.rv-nudge'); if (nudge) nudge.remove();
+  });
   $('docBody').querySelectorAll('[data-rv-save]').forEach((b) => b.onclick = () => {
     const n = b.dataset.rvSave;
+    const row = $('docBody').querySelector(`[data-rv-reason="${n}"]`);
+    const picked = row && row.dataset.picked;
+    if (!picked) {
+      // An inline nudge, not a modal and not a silent default. Defaulting is what produced the bug
+      // this replaces: every edit recorded "incomplete" whether or not it was.
+      if (!row.querySelector('.rv-nudge')) {
+        const s = document.createElement('span');
+        s.className = 'rv-nudge'; s.textContent = 'Pick one — the record is worth nothing without it.';
+        row.appendChild(s);
+      }
+      return;
+    }
+    const note = $('docBody').querySelector(`[data-rv-note="${n}"]`);
     const ta = $('docBody').querySelector(`[data-rv-ta="${n}"]`);
-    rvDispose(F(n), 'edit', ta ? ta.value : '');
+    rvDispose(F(n), 'edit', ta ? ta.value : '', picked, note && !note.hidden ? note.value : undefined);
   });
 }
-async function rvDispose(f, disposition, pmText) {
+async function rvDispose(f, disposition, pmText, reason, reasonNote) {
   if (!f) return;
   const rv = state.review || {};
   // The client sends back the exact text it rendered; the server re-derives the diff and refuses if
@@ -1995,7 +2052,7 @@ async function rvDispose(f, disposition, pmText) {
   const body = {
     ws: state.wsId, disposition, finding: f, rendered_after: renderedAfter,
     pm_text: disposition === 'edit' ? pmText : undefined,
-    reason: disposition === 'edit' ? 'incomplete' : undefined,   // TODO: the reason tap (PRD open q2)
+    reason, reason_note: reasonNote,          // the PM's own word — never defaulted, never inferred
     run_id: rv.id, initiative_id: 'workspace-review-and-edit',
   };
   let out = {};

package/workspace/public/styles.css

@@ -986,3 +986,22 @@ details.tree>summary:hover{color:var(--text-2)}
   padding:8px 11px;background:rgba(72,213,151,.06);color:var(--text-2);
   font-family:var(--mono);font-size:11.5px;line-height:1.8;outline:none}
 .rv-ta:focus{border-color:var(--accent);border-left-color:var(--ok)}
+
+/* the reason tap — required on an edit, and never defaulted. The nudge is inline, not a modal:
+   a silent default is exactly the bug this replaced (every edit recorded "incomplete"). */
+.rv-reason{display:flex;gap:7px;align-items:center;flex-wrap:wrap;margin-top:10px}
+.rv-rz{padding:0 9px;height:28px;border-radius:999px;border:1px solid var(--border-strong);
+  background:var(--chip);font-size:11.5px;color:var(--text-3)}
+.rv-rz:hover{background:var(--card-hover);color:var(--text)}
+/* Selected reads as accent TEXT on a wash, not a filled pill: nothing else on this surface carries
+   a solid fill, and no token exists for text-on-accent because no component here needed one. */
+.rv-rz.on{background:var(--accent-wash);border-color:var(--accent);color:var(--accent-text);font-weight:600}
+.rv-nudge{font-size:11.5px;color:var(--warn-text);flex-basis:100%}
+.rv-note{width:100%;box-sizing:border-box;margin-top:8px;border:1px solid var(--border);
+  border-radius:7px;padding:7px 10px;background:var(--chip);color:var(--text-2);
+  font-family:var(--sans);font-size:12px;outline:none}
+.rv-note:focus{border-color:var(--accent)}
+/* the success-signal counters — one quiet line, and an unmeasured number says so */
+.rv-stats{margin-top:6px;font-family:var(--mono);font-size:10.5px;color:var(--text-dim);line-height:1.7}
+.rv-stats i{font-style:normal;color:var(--warn-text)}
+.rv-stats .rv-bad{color:var(--bad);font-weight:600}

package/workspace/server.js

@@ -898,9 +898,27 @@ function heartbeat() {
 }
 try { const _hb = setInterval(heartbeat, LIVENESS_MS); if (_hb.unref) _hb.unref(); } catch {}
 
+// Trim the ring from the FRONT at a LINE boundary. A blind slice cuts wherever the byte count
+// lands — which is routinely INSIDE an escape sequence, and the truncated tail then replays as
+// literal rubble ("5;203m") the next time a client attaches and we write the buffer to xterm.js;
+// or BETWEEN the halves of a surrogate pair, and the lone surrogate becomes U+FFFD on the JSON hop
+// to the browser. Neither is recoverable downstream. An escape sequence never spans a newline, so
+// moving the cut forward to just past the next one makes both impossible. If the kept region has no
+// newline near its head (one enormous line) the raw cut stands, stepping off a lone low surrogate.
+const TRIM_SCAN = 8192;                                // how far past the cut to look for a boundary
+function trimBuf(buf, limit) {
+  if (buf.length <= limit) return buf;
+  let cut = buf.length - limit;
+  const nl = buf.indexOf('\n', cut);
+  if (nl !== -1 && nl - cut <= TRIM_SCAN) return buf.slice(nl + 1);
+  const c = buf.charCodeAt(cut);
+  if (c >= 0xdc00 && c <= 0xdfff) cut++;               // never start on a low surrogate
+  return buf.slice(cut);
+}
+
 function appendBuf(s, data) {
   s.buf += data;
-  if (s.buf.length > SCROLLBACK) s.buf = s.buf.slice(s.buf.length - SCROLLBACK);
+  if (s.buf.length > SCROLLBACK) s.buf = trimBuf(s.buf, SCROLLBACK);
   // Parser 2's whole input: the moment output last arrived. `quiet` is derived from this, never
   // from reading the bytes — which is why it is the only one of the five that cannot misread.
   s.lastOutputAt = Date.now();
@@ -1005,7 +1023,7 @@ function seedFromPaneHistory(s, name) {
   if (r.status !== 0 || !r.stdout) return false;
   const text = r.stdout.replace(/\s+$/, '').replace(/\r?\n/g, '\r\n');
   if (!text) return false;
-  s.buf = text + '\r\n';
+  s.buf = trimBuf(text + '\r\n', SCROLLBACK);          // 5000 lines of history can overrun the ring
   s.parsed = null;
   return true;
 }
@@ -1022,8 +1040,14 @@ function attachPty(s, { seed = false } = {}) {
   const startedMs = Date.now();
   let p;
   try {
+    // `encoding: null` is LOAD-BEARING, not a style choice. A control-mode stream is BYTES: tmux
+    // escapes only c < 0x20 and the backslash, so every byte of a UTF-8 sequence rides through raw.
+    // Letting node-pty decode it to a string first and re-narrowing to bytes in the parser destroyed
+    // every non-ASCII character — box drawing became NULs and form feeds, ✓ became 0x13, emoji and
+    // accents became U+FFFD. The parser owns the one and only decode. See lib/tmux-control.js.
     p = pty.spawn(TMUX, ['-L', TMUX_SOCK, '-CC', 'attach-session', '-t', name],
-      { name: 'xterm-256color', cols: s.cols || 80, rows: s.rows || 24, cwd: s.cwd, env: sessionEnv() });
+      { name: 'xterm-256color', cols: s.cols || 80, rows: s.rows || 24, cwd: s.cwd,
+        env: sessionEnv(), encoding: null });
   } catch (e) {
     // A broken node-pty (e.g. a non-executable spawn-helper) throws synchronously here. This must
     // NOT propagate: on the startup first-shell it would crash the whole server and blank the
@@ -1904,19 +1928,30 @@ async function handleRequest(req, res) {
     // Merge in what the PM has already settled, so a disposed finding renders as settled rather than
     // being offered twice. Read-only: dispositions live in the correction records, not in the review.
     const settled = {};
+    const records = [];
     try {
       const txt = fs.readFileSync(path.join(w.root, 'planning', 'runs', 'correction-records.jsonl'), 'utf8');
       for (const line of txt.split('\n')) {
         if (!line.trim()) continue;
-        try { const r = JSON.parse(line); if (r && r.finding_title) settled[r.finding_title] = r.disposition; } catch {}
+        try {
+          const r = JSON.parse(line);
+          if (!r) continue;
+          records.push(r);
+          if (r.finding_title) settled[r.finding_title] = r.disposition;
+        } catch {}
       }
     } catch {}
+    // The PRD's success signal is explicit that the counters are part of the build, not a follow-up:
+    // action rate must be derivable off the records with no manual counting. quiet-rate is NOT
+    // derivable here — it needs a corpus with a labelled CLEAN class, which does not exist — so it is
+    // reported as null and rendered as "not measured" rather than as a flattering zero.
+    const stats = { ...correctionRecord.summarise(records), quiet_rate: findingContract.quietRate(null, null) };
     const findings = review.findings.map((f) => ({
       ...f,
       applyable: findingContract.isApplyable(f),      // the client asks the contract, never re-derives it
       settled: settled[f.title] || null,
     }));
-    return json(res, { ok: true, id: pick.replace(/\.json$/, ''), read: review.read, at: review.at || null, findings, reviews: files.length });
+    return json(res, { ok: true, id: pick.replace(/\.json$/, ''), read: review.read, at: review.at || null, findings, reviews: files.length, stats, reasons: [...correctionRecord.REASONS] });
   }
   if (p === '/api/review/dispose' && req.method === 'POST') {
     // The ONLY write path this surface has (workspace-review-and-edit R6/R8/R11). The reader was
@@ -1949,6 +1984,19 @@ async function handleRequest(req, res) {
       return json(res, { ok: false, error: 'this finding offers nothing to apply — it is context, and yours to settle' }, 400);
     }
 
+    // R8, and it must happen BEFORE the write. buildRecord depends on nothing the write produces, and
+    // validating it after would let a missing reason leave the document changed with no record behind
+    // it — a half-applied state whose whole point was to be impossible. Refuse first, touch the file
+    // second: every rejection below this line leaves the repository byte-identical.
+    const built = correctionRecord.buildRecord({
+      run_id: body.run_id, initiative_id: body.initiative_id, finding: f, disposition,
+      pm_text: body.pm_text, reason: body.reason, reason_note: body.reason_note,
+      pm: body.pm || 'wawan', at: nowISO(),
+    });
+    if (!built.ok) {
+      return json(res, { ok: false, error: 'no correction record could be written, so nothing was changed', errors: built.errors }, 400);
+    }
+
     let wrote = null;
     if (writes) {
       // Path guard, identical to every read on this surface (R12): traversal and cross-workspace
@@ -1983,18 +2031,6 @@ async function handleRequest(req, res) {
       wrote = f.file;
     }
 
-    // R8: the record is built only where attribution is KNOWN. buildRecord refuses anything that
-    // would need inference, and a refusal here means no record is written at all — never a guess.
-    const built = correctionRecord.buildRecord({
-      run_id: body.run_id, initiative_id: body.initiative_id, finding: f, disposition,
-      pm_text: body.pm_text, reason: body.reason, reason_note: body.reason_note,
-      pm: body.pm || 'wawan', at: nowISO(),
-    });
-    if (!built.ok) {
-      // The document may already have been written — say so rather than imply a clean failure.
-      return json(res, { ok: false, error: 'no correction record written (attribution would have to be inferred)', errors: built.errors, wrote }, 400);
-    }
-
     // Curated record, tracked and append-only — deliberately NOT stateDirFor()'s runtime directory
     // (PRD open question 1; pm-decisions.md 491–503 keeps that boundary the PM's to settle).
     const sink = path.join(w.root, 'planning', 'runs', 'correction-records.jsonl');
@@ -2198,6 +2234,9 @@ module.exports = { server, spawnSession, removeSession, renameSession, sessions,
   // the legacy-scrollback migration, exported so the suite can assert BOTH halves: the tmux
   // client's preamble is stripped, an inner TUI's own alt-screen use is not.
   stripLegacyClientScreen,
+  // the scrollback ring's front trim, exported pure so the suite can assert that a cut never lands
+  // inside an escape sequence or between the halves of a surrogate pair.
+  trimBuf, SCROLLBACK,
   // the liveness heartbeat's guard, exported pure so the "idle machine stays idle" half can be
   // asserted without a server that has no clients (the suite always has both).
   shouldHeartbeat, LIVENESS_MS, TX_REREAD_MS };