create-pmos 0.7.2 → 0.8.0

package/workspace/public/styles.css

@@ -922,86 +922,57 @@ details.tree>summary:hover{color:var(--text-2)}
   font-family:var(--mono);font-size:12px;line-height:1.5;outline:none}
 .scratch[data-open="true"] .scratch-text{display:block}
 
-/* ── the summoned review (workspace-review-and-edit) ──────────────────────────────────────────
-   Deliberately the quietest surface in the app. The PM's disposition on the prototype was "too much
-   guardrails and ceremony — guardrails is ok, just make it less obvious", so every guard here is
-   structural and none of them announces itself: no cards, no severity hues, no taxonomy headers.
-   A withheld finding is marked only by a hollow dot and the ABSENCE of an Apply button. */
-/* The rail is the surface's real home (~400-520px), not the full-width page the prototype was
-   judged on — so the rhythm is tuned for the column it actually lives in, and the max-width only
-   bites once the PM drags the rail wide. */
-.rv{max-width:660px;padding:16px 18px 36px}
-.rv-lede{font-size:15px;line-height:1.45;letter-spacing:-.01em;color:var(--text);margin-bottom:5px}
-.rv-sub{font-size:11.5px;line-height:1.55;color:var(--text-muted);margin-bottom:18px;
-  word-break:break-word;overflow-wrap:anywhere}
-.rv-sub .mono{font-size:10.5px}
-.rv-empty{padding:24px 22px;max-width:560px}
-.rv-empty p{font-size:14px;line-height:1.6;color:var(--text-2);margin-bottom:8px}
-.rv-empty .rv-dim{font-size:12.5px;color:var(--text-muted)}
-.rv-errs{margin:10px 0 0 18px;font-family:var(--mono);font-size:11px;color:var(--text-3);line-height:1.7}
-
-.rv-f{position:relative;padding:14px 0 14px 18px;border-top:1px solid var(--border-3);cursor:pointer}
-.rv-f:first-of-type{border-top:0}
-.rv-f::before{content:"";position:absolute;left:0;top:20px;width:5px;height:5px;border-radius:50%;
-  background:var(--text-dim)}
-.rv-f.on::before{background:var(--accent)}
-/* hollow = nothing to apply. The shape carries it, so meaning is never in hue alone. */
-.rv-f.rv-quiet::before{background:transparent;box-shadow:inset 0 0 0 1px var(--text-dim)}
-.rv-f.rv-done{opacity:.55}
-.rv-f.rv-done .rv-h{text-decoration:line-through;text-decoration-color:var(--text-dim)}
-.rv-h{font-size:13.5px;line-height:1.5;color:var(--text-2);letter-spacing:-.005em}
-.rv-f:hover .rv-h,.rv-f.on .rv-h{color:var(--text)}
-.rv-src{margin-top:4px;font-family:var(--mono);font-size:10.5px;color:var(--text-dim)}
-.rv-d{display:none;padding-top:11px}
-.rv-f.on .rv-d,.rv-f[data-editing="1"] .rv-d{display:block}
-.rv-d p{font-size:12.5px;line-height:1.7;color:var(--text-3);margin-bottom:10px}
-.rv-why{padding-left:11px;box-shadow:inset 2px 0 0 var(--border-strong);color:var(--text-muted)}
-.rv-acts{display:flex;gap:15px;align-items:center;flex-wrap:wrap;margin-top:12px}
-.rv-acts button{font-size:12.5px;color:var(--accent-text);padding:3px 0;min-height:30px}
-.rv-acts button:hover{text-decoration:underline}
-.rv-acts button.q{color:var(--text-dim)}
-.rv-only{font-size:12px;color:var(--text-dim)}
-.rv-tail{margin-top:30px;padding-top:14px;border-top:1px solid var(--border-3);
-  font-size:11.5px;line-height:1.7;color:var(--text-dim)}
-.rv-tail b{color:var(--text-muted);font-weight:500}
-.rv-say{margin-bottom:14px;padding:9px 12px;border-radius:9px;border:1px solid var(--bad);
-  background:rgba(242,101,95,.08);font-size:12px;line-height:1.55;color:var(--text-2)}
-
-/* the in-place editor — opens under the finding, never a modal or a mode switch */
-.rv-ed:empty{display:none}
-.rv-ed{padding-top:12px}
-.rv-edfile{display:flex;align-items:baseline;gap:10px;font-size:10.5px;color:var(--text-dim);margin-bottom:8px}
-.rv-n{margin-left:auto;font-family:var(--mono)}
-.rv-n b{color:var(--ok-text);font-weight:600}
-.rv-n i{color:var(--bad);font-style:normal;font-weight:600}
-.rv-code{font-family:var(--mono);font-size:11.5px;line-height:1.8;
-  border-top:1px solid var(--border-3);border-bottom:1px solid var(--border-3);padding:6px 0}
-.rv-l{display:grid;grid-template-columns:3px 1fr;align-items:start}
-.rv-l .g{align-self:stretch;border-radius:2px;background:transparent}
-.rv-l .t{padding:0 4px 0 11px;white-space:pre-wrap;word-break:break-word;color:var(--text-3)}
-.rv-l.was .g{background:rgba(242,101,95,.5)}
-.rv-l.was .t{color:var(--text-dim);text-decoration:line-through;text-decoration-color:rgba(242,101,95,.55)}
-.rv-ta{width:100%;box-sizing:border-box;margin-top:8px;resize:vertical;
-  border:1px solid var(--border);border-left:3px solid var(--ok);border-radius:0 7px 7px 0;
-  padding:8px 11px;background:rgba(72,213,151,.06);color:var(--text-2);
-  font-family:var(--mono);font-size:11.5px;line-height:1.8;outline:none}
-.rv-ta:focus{border-color:var(--accent);border-left-color:var(--ok)}
-
-/* the reason tap — required on an edit, and never defaulted. The nudge is inline, not a modal:
-   a silent default is exactly the bug this replaced (every edit recorded "incomplete"). */
-.rv-reason{display:flex;gap:7px;align-items:center;flex-wrap:wrap;margin-top:10px}
-.rv-rz{padding:0 9px;height:28px;border-radius:999px;border:1px solid var(--border-strong);
-  background:var(--chip);font-size:11.5px;color:var(--text-3)}
-.rv-rz:hover{background:var(--card-hover);color:var(--text)}
-/* Selected reads as accent TEXT on a wash, not a filled pill: nothing else on this surface carries
-   a solid fill, and no token exists for text-on-accent because no component here needed one. */
-.rv-rz.on{background:var(--accent-wash);border-color:var(--accent);color:var(--accent-text);font-weight:600}
-.rv-nudge{font-size:11.5px;color:var(--warn-text);flex-basis:100%}
-.rv-note{width:100%;box-sizing:border-box;margin-top:8px;border:1px solid var(--border);
-  border-radius:7px;padding:7px 10px;background:var(--chip);color:var(--text-2);
-  font-family:var(--sans);font-size:12px;outline:none}
-.rv-note:focus{border-color:var(--accent)}
-/* the success-signal counters — one quiet line, and an unmeasured number says so */
-.rv-stats{margin-top:6px;font-family:var(--mono);font-size:10.5px;color:var(--text-dim);line-height:1.7}
-.rv-stats i{font-style:normal;color:var(--warn-text)}
-.rv-stats .rv-bad{color:var(--bad);font-weight:600}
+/* The cap's controls carry TEXT labels, not icons, so they size to content. And `hidden` has to
+   actually hide: `.cap .mini` sets display:grid, which beats the UA's [hidden]{display:none} — the
+   attribute was being set correctly and doing nothing, so every control showed at once. Only the
+   first control takes the margin-left:auto that pushes the group right. */
+.cap .mini[hidden],.cap .x[hidden]{display:none}
+.cap .docrev{width:auto;min-width:0;padding:0 9px;font-size:11px}
+.cap .mini ~ .mini{margin-left:0}
+
+/* ── the document editor (workspace-doc-editor) ──────────────────────────────────────────────
+   The reader gains an edit mode. Quiet on purpose: editing a document should feel local and
+   undramatic, so there is no toolbar, no modal, and no mode banner — a control in the cap, a
+   textarea in the reader's own type, and the diff shown beside it as you type. */
+.ed-wrap{display:grid;grid-template-rows:minmax(0,1fr) auto;height:100%;min-height:0}
+.ed-split{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr);gap:0;min-height:0;overflow:hidden}
+.ed-split[data-diff="off"]{grid-template-columns:minmax(0,1fr)}
+.ed-split[data-diff="off"] .ed-diff{display:none}
+.ed-ta{width:100%;height:100%;box-sizing:border-box;resize:none;border:0;outline:none;
+  padding:14px 16px;background:var(--bg);color:var(--text-2);
+  font-family:var(--mono);font-size:12px;line-height:1.8;tab-size:2}
+.ed-diff{border-left:1px solid var(--border-3);overflow-y:auto;background:var(--panel);
+  font-family:var(--mono);font-size:11px;line-height:1.75;padding:8px 0}
+.ed-l{display:grid;grid-template-columns:3px 1fr;align-items:start}
+.ed-l .g{align-self:stretch;border-radius:2px;background:transparent}
+.ed-l .t{padding:0 10px;white-space:pre-wrap;word-break:break-word;color:var(--text-3)}
+.ed-l.del .g{background:var(--bad)}
+.ed-l.del .t{color:var(--text-dim);text-decoration:line-through;text-decoration-color:rgba(242,101,95,.5)}
+.ed-l.add .g{background:var(--ok)}
+.ed-l.add .t{color:var(--text-2)}
+.ed-l.ctx .t{color:var(--text-dim)}
+.ed-none{padding:14px 16px;font-size:11.5px;color:var(--text-dim);line-height:1.6}
+.ed-bar{display:flex;align-items:center;gap:12px;padding:8px 14px;border-top:1px solid var(--border-3);
+  background:var(--panel-head);font-size:11.5px;color:var(--text-dim)}
+.ed-bar .n{font-family:var(--mono)}
+.ed-bar .n b{color:var(--ok-text);font-weight:600}
+.ed-bar .n i{color:var(--bad);font-style:normal;font-weight:600}
+.ed-bar input{flex:1;min-width:80px;border:1px solid var(--border);border-radius:7px;
+  padding:6px 10px;background:var(--chip);color:var(--text-2);font-family:var(--sans);
+  font-size:11.5px;outline:none}
+.ed-bar input:focus{border-color:var(--accent)}
+.ed-bar .dirty{color:var(--warn-text)}
+.ed-err{margin:0 14px 8px;padding:8px 11px;border-radius:8px;border:1px solid var(--bad);
+  background:rgba(242,101,95,.08);font-size:11.5px;line-height:1.5;color:var(--text-2)}
+
+/* the change log for one document — read, not managed */
+.hist{padding:16px 18px;max-width:640px}
+.hist h3{font-size:14px;font-weight:600;margin-bottom:3px}
+.hist .sub{font-size:11.5px;color:var(--text-muted);margin-bottom:18px;line-height:1.6}
+.hist-row{padding:11px 0;border-top:1px solid var(--border-3)}
+.hist-row:first-of-type{border-top:0}
+.hist-when{font-family:var(--mono);font-size:10.5px;color:var(--text-dim)}
+.hist-when b{color:var(--ok-text);font-weight:600}
+.hist-when i{color:var(--bad);font-style:normal;font-weight:600}
+.hist-note{margin-top:4px;font-size:12.5px;color:var(--text-2);line-height:1.55}
+.hist-none{font-size:12px;color:var(--text-dim);line-height:1.6}

package/workspace/server.js

@@ -71,9 +71,7 @@ const consoleState = require('./lib/console-state');   // read-only console surf
 const fmParse = require('./lib/file-mode-parse');      // canonical file-mode parsers, shared with metrics.py (D64 D)
 const gitInfo = require('./lib/git-info');             // read-mostly branch awareness + select/create at session start
 const tmuxControl = require('./lib/tmux-control');     // tmux -CC protocol: the pane's raw stream, so xterm.js keeps its scrollback
-const findingContract = require('./lib/finding-contract');   // what a review finding is + the withheld guard (R3/R7)
-const applyChange = require('./lib/apply-change');            // pure change application, refuse-on-mismatch (R6/R9)
-const correctionRecord = require('./lib/correction-record');  // attribution never inferred (R8)
+const applyChange = require('./lib/apply-change');            // anchored + whole-document saves, refuse-on-stale
 // The "home" repo this server manages. In PMOS-self the app ships INSIDE its repo
 // (pmos/workspace) so the parent dir IS the repo. But a kit/tenant copy is installed standalone
 // — `npm i -g` puts it under node_modules/pmos-workspace, or it runs from an npx bundle — and
@@ -600,10 +598,6 @@ function buildSurface(name, root, w) {
 // extension, not v1. Cadence math is the pure shared module — the tick and the pane's next-run agree.
 const SCHED_FILE = path.join(STATE, 'schedules.json');
 const DELIV_DIR = path.join(STATE, 'deliverables');
-// Reviews the doc-review skill files (workspace-review-and-edit). One JSON per run, written by the
-// skill session, read back by /api/review. Runtime, not the record: the durable artifact of a review
-// is the correction records its dispositions produce, which live in planning/runs/ and are tracked.
-const REVIEW_DIR = path.join(STATE, 'reviews');
 // Skills are file-driven (workspace-skill-authoring): built-ins ship committed under workspace/skills/,
 // user-authored ones are scaffolded into state/skills/ by the New Skill flow. There is ONE user-facing
 // concept — a skill — so the picker never exposes the internal `run`/`kind`; how a skill runs (server
@@ -1599,6 +1593,11 @@ async function handleRequest(req, res) {
   if (p === '/app.js') return serveFile(res, path.join(PUB, 'app.js'), null, true);
   if (p === '/lib/preview-kind.js') return serveFile(res, path.join(__dirname, 'lib', 'preview-kind.js'));
   if (p === '/lib/layout.js') return serveFile(res, path.join(__dirname, 'lib', 'layout.js'));
+  // The editor computes its live diff with the SAME module the server saves through, so what the PM
+  // sees while typing and what gets written cannot disagree. NB: /lib/ is an explicit allowlist, not
+  // a directory route — a <script src> for a file missing from this list 404s silently, and the
+  // client feature that depends on it fails in a way no server-side test can see.
+  if (p === '/lib/apply-change.js') return serveFile(res, path.join(__dirname, 'lib', 'apply-change.js'));
   if (p === '/styles.css') return serveFile(res, path.join(PUB, 'styles.css'));
   // xterm assets straight from node_modules (offline; no CDN)
   if (p === '/vendor/xterm.js') return serveFile(res, path.join(XROOT, 'xterm', 'lib', 'xterm.js'));
@@ -1902,63 +1901,11 @@ async function handleRequest(req, res) {
     } catch (e) { warnWriteFail('needs.json (clearing the accepted need)', e); }
     return json(res, { ok: true, recorded: rec, sink, fallback });
   }
-  if (p === '/api/review') {
-    // Read a filed review. Latest by default; ?id= for a specific one. Honest-by-construction like
-    // the console surfaces (D64 B2): a broken or contract-failing read returns {ok:false,error} so the
-    // client can render RED — never a calm empty over a review that exists but could not be parsed.
-    const w = getWs(url.searchParams.get('ws'));
-    if (!w) return json(res, { ok: false, error: 'no workspace' }, 404);
-    const want = url.searchParams.get('id');
-    let files = [];
-    try { files = fs.readdirSync(REVIEW_DIR).filter((f) => f.endsWith('.json')).sort(); } catch {}
-    if (want && !/^[A-Za-z0-9._-]+$/.test(want)) return json(res, { ok: false, error: 'bad review id' }, 400);
-    const pick = want ? `${want}.json` : files[files.length - 1];
-    if (!pick || !files.includes(pick)) return json(res, { ok: true, empty: true, reviews: files.length });
-
-    let review;
-    try { review = JSON.parse(fs.readFileSync(path.join(REVIEW_DIR, pick), 'utf8')); }
-    catch { return json(res, { ok: false, error: `review '${pick}' is unreadable or not valid JSON` }, 500); }
-
-    // The SAME contract the write path enforces (R3/R7). A review that fails it is surfaced as an
-    // error rather than half-rendered: a malformed finding must never reach the UI, because the UI's
-    // job is to decide whether an Apply control exists.
-    const v = findingContract.validateReview(review);
-    if (!v.ok) return json(res, { ok: false, error: 'this review failed the finding contract', errors: v.errors.slice(0, 12) }, 422);
-
-    // Merge in what the PM has already settled, so a disposed finding renders as settled rather than
-    // being offered twice. Read-only: dispositions live in the correction records, not in the review.
-    const settled = {};
-    const records = [];
-    try {
-      const txt = fs.readFileSync(path.join(w.root, 'planning', 'runs', 'correction-records.jsonl'), 'utf8');
-      for (const line of txt.split('\n')) {
-        if (!line.trim()) continue;
-        try {
-          const r = JSON.parse(line);
-          if (!r) continue;
-          records.push(r);
-          if (r.finding_title) settled[r.finding_title] = r.disposition;
-        } catch {}
-      }
-    } catch {}
-    // The PRD's success signal is explicit that the counters are part of the build, not a follow-up:
-    // action rate must be derivable off the records with no manual counting. quiet-rate is NOT
-    // derivable here — it needs a corpus with a labelled CLEAN class, which does not exist — so it is
-    // reported as null and rendered as "not measured" rather than as a flattering zero.
-    const stats = { ...correctionRecord.summarise(records), quiet_rate: findingContract.quietRate(null, null) };
-    const findings = review.findings.map((f) => ({
-      ...f,
-      applyable: findingContract.isApplyable(f),      // the client asks the contract, never re-derives it
-      settled: settled[f.title] || null,
-    }));
-    return json(res, { ok: true, id: pick.replace(/\.json$/, ''), read: review.read, at: review.at || null, findings, reviews: files.length, stats, reasons: [...correctionRecord.REASONS] });
-  }
-  if (p === '/api/review/dispose' && req.method === 'POST') {
-    // The ONLY write path this surface has (workspace-review-and-edit R6/R8/R11). The reader was
-    // designed around there being none, so every guard here is load-bearing rather than ceremony.
-    //
-    // Three dispositions, one endpoint: `apply` and `edit` write the file, `dismiss` writes only
-    // the correction record. Never automatic — reached solely by an explicit PM click, like /api/gate.
+  if (p === '/api/doc/save' && req.method === 'POST') {
+    // The editor's save (workspace-doc-editor R3/R4). The ONLY write path on this surface, and it is
+    // reached solely by the PM pressing save on a document they were editing. Nothing here consults
+    // an agent, and nothing an agent produced can reach it — the agent is downstream of this write,
+    // never upstream of it (rubric dim 1, the hard floor).
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }
     catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
@@ -1966,82 +1913,66 @@ async function handleRequest(req, res) {
     const w = getWs(body.ws);
     if (!w) return json(res, { ok: false, error: 'no workspace' }, 404);
 
-    // The finding must satisfy the contract BEFORE anything else looks at it — a malformed
-    // finding never reaches a write, and never grows an Apply (fails closed by construction).
-    const f = body.finding;
-    const v = findingContract.validateFinding(f);
-    if (!v.ok) return json(res, { ok: false, error: 'finding failed the contract', errors: v.errors }, 400);
-
-    const disposition = body.disposition;
-    if (!correctionRecord.DISPOSITIONS.has(disposition)) {
-      return json(res, { ok: false, error: `disposition must be one of ${[...correctionRecord.DISPOSITIONS].join(' | ')}` }, 400);
+    // Path guard, identical to every read on this surface (R10).
+    const full = path.resolve(w.root, String(body.path || ''));
+    if (!insideRoot(w.root, full)) return json(res, { ok: false, error: 'outside workspace' }, 404);
+    if (preview.previewKind(path.basename(full)) !== 'markdown') {
+      return json(res, { ok: false, error: 'only markdown documents are editable here' }, 400);
     }
-
-    // R7 CONTAINMENT, server side. The client renders no Apply for a withheld finding; this is the
-    // half that survives a tampered or stale client. A withheld finding can only ever be dismissed.
-    const writes = disposition === 'apply' || disposition === 'edit';
-    if (writes && !findingContract.isApplyable(f)) {
-      return json(res, { ok: false, error: 'this finding offers nothing to apply — it is context, and yours to settle' }, 400);
+    let current;
+    try { current = fs.readFileSync(full, 'utf8'); }
+    catch { return json(res, { ok: false, error: 'could not read the document' }, 404); }
+
+    // REFUSE ON STALE. `base` is what the editor loaded; if the file has moved since, writing would
+    // silently discard whoever changed it. Loud failure beats a merge nobody asked for.
+    const saved = applyChange.saveWhole(current, String(body.base == null ? '' : body.base), String(body.text == null ? '' : body.text));
+    if (!saved.ok) {
+      const code = saved.reason === 'stale' ? 409 : 400;
+      return json(res, { ok: false, error: saved.reason, detail: saved.detail || null }, code);
     }
 
-    // R8, and it must happen BEFORE the write. buildRecord depends on nothing the write produces, and
-    // validating it after would let a missing reason leave the document changed with no record behind
-    // it — a half-applied state whose whole point was to be impossible. Refuse first, touch the file
-    // second: every rejection below this line leaves the repository byte-identical.
-    const built = correctionRecord.buildRecord({
-      run_id: body.run_id, initiative_id: body.initiative_id, finding: f, disposition,
-      pm_text: body.pm_text, reason: body.reason, reason_note: body.reason_note,
-      pm: body.pm || 'wawan', at: nowISO(),
-    });
-    if (!built.ok) {
-      return json(res, { ok: false, error: 'no correction record could be written, so nothing was changed', errors: built.errors }, 400);
+    try { fs.writeFileSync(full, saved.text); }
+    catch (e) {
+      warnWriteFail('document save (' + body.path + ')', e);
+      return json(res, { ok: false, error: 'could not write the document — nothing was changed' }, 500);
     }
 
-    let wrote = null;
-    if (writes) {
-      // Path guard, identical to every read on this surface (R12): traversal and cross-workspace
-      // paths are refused before the file is opened, not after.
-      const full = path.resolve(w.root, f.file || '');
-      if (!insideRoot(w.root, full)) return json(res, { ok: false, error: 'outside workspace' }, 404);
-      if (preview.previewKind(path.basename(full)) !== 'markdown') {
-        return json(res, { ok: false, error: 'only markdown documents are editable here' }, 400);
-      }
-      let current;
-      try { current = fs.readFileSync(full, 'utf8'); }
-      catch { return json(res, { ok: false, error: 'could not read the document' }, 404); }
-
-      // On `edit` the PM's text replaces the agent's — the proposal applied is what the PM saw.
-      const proposal = disposition === 'edit'
-        ? { before: f.proposal.before, after: body.pm_text }
-        : f.proposal;
-
-      // REFUSE ON MISMATCH (sprint criterion 4). The client sends back the exact text it rendered
-      // and the server re-derives it; disagreement means the file moved, or the client is stale or
-      // tampered. Either way the PM would be applying something they never looked at.
-      const m = applyChange.matchesRendered(current, proposal, body.rendered_after);
-      if (!m.ok) return json(res, { ok: false, error: 'refused: ' + m.reason, detail: m.detail || null }, 409);
-
-      // FAIL LOUD (D64 Track A2, same stance as /api/gate): a swallowed write returning {ok:true}
-      // would tell the PM their edit landed when it did not. No header/secret content in the error (D08).
-      try { fs.writeFileSync(full, m.text); }
-      catch (e) {
-        warnWriteFail('document apply (' + f.file + ')', e);
-        return json(res, { ok: false, error: 'could not write the document — nothing was changed' }, 500);
-      }
-      wrote = f.file;
+    // R4/R9: append to THIS repository's own change log. stateDirFor() is the same resolver
+    // needs.json and acceptances.jsonl use — a tenant product repo has no workspace/ folder, and
+    // assuming one is exactly the defect shipped in 0.7.1/0.7.2.
+    const region = applyChange.changedRegion(body.base, body.text);
+    const rec = { file: String(body.path), at: nowISO(), pm: body.pm || 'wawan',
+      note: typeof body.note === 'string' && body.note.trim() ? body.note.trim().slice(0, 400) : null,
+      at_line: region.at_line, added: region.added, removed: region.removed,
+      before: region.before, after: region.after };
+    const dir = stateDirFor(w, { create: true });
+    let logged = null;
+    if (dir) {
+      const sink = path.join(dir, 'doc-changes.jsonl');
+      try { fs.mkdirSync(dir, { recursive: true }); fs.appendFileSync(sink, JSON.stringify(rec) + '\n'); logged = sink; }
+      catch (e) { warnWriteFail('doc-changes.jsonl (the change log)', e); }
     }
-
-    // Curated record, tracked and append-only — deliberately NOT stateDirFor()'s runtime directory
-    // (PRD open question 1; pm-decisions.md 491–503 keeps that boundary the PM's to settle).
-    const sink = path.join(w.root, 'planning', 'runs', 'correction-records.jsonl');
+    // The document IS saved at this point. A failed log is reported honestly rather than as success,
+    // but it must not read as "your edit was lost".
+    return json(res, { ok: true, saved: body.path, logged, change: { added: rec.added, removed: rec.removed, at_line: rec.at_line },
+      warning: logged ? undefined : 'the document was saved but the change could not be logged' });
+  }
+  if (p === '/api/doc/changes') {
+    // The change log, read back (R8 — this is what an agent reads before working here).
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 404);
+    const dir = stateDirFor(w);
+    const sink = dir ? path.join(dir, 'doc-changes.jsonl') : null;
+    const only = url.searchParams.get('path');
+    let rows = [];
     try {
-      fs.mkdirSync(path.dirname(sink), { recursive: true });
-      fs.appendFileSync(sink, JSON.stringify(built.record) + '\n');
-    } catch (e) {
-      warnWriteFail('correction-records.jsonl (the north-star numerator)', e);
-      return json(res, { ok: false, error: 'the document changed but the correction record could NOT be written', wrote }, 500);
-    }
-    return json(res, { ok: true, wrote, recorded: built.record, sink });
+      if (sink && fs.existsSync(sink)) {
+        rows = fs.readFileSync(sink, 'utf8').split('\n').filter(Boolean)
+          .map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+      }
+    } catch (e) { return json(res, { ok: false, error: 'the change log is unreadable' }, 500); }
+    if (only) rows = rows.filter((r) => r.file === only);
+    return json(res, { ok: true, changes: rows.slice(-200).reverse(), total: rows.length });
   }
   res.writeHead(404); res.end('not found');
 }

package/workspace/lib/correction-record.js

@@ -1,127 +0,0 @@
-/* correction-record — what a PM disposition leaves behind. (workspace-review-and-edit · R8/R9)
- *
- * The north star is human correction rate per agent run, and its numerator is currently a
- * self-reported integer: all four runs in planning/runs/agent-runs.jsonl carry
- * "human_corrections": 0 with no artifact behind the number. correction-signal-derive.skill
- * explains why the obvious fix does not reach it — "pre-commit conversational steering is
- * git-invisible and stays the self-report's lane."
- *
- * This module builds the artifact for that lane, under one rule that is not negotiable:
- *
- *   ATTRIBUTION IS NEVER INFERRED.
- *
- * A record exists only for text an agent PROPOSED in this review and the PM then disposed of.
- * That is the single case where authorship is known rather than guessed — no git blame, no
- * "the file changed while session X was live" timing heuristic. correction-signal-derive.skill
- * states the rule this upholds: "Never guess an attribution. A commit you cannot confidently
- * classify is ambiguous: flagged to the PM, held OUT of the score." A record that would need
- * inference is not written at all (sprint criterion 7), because a manufactured attribution
- * poisons the exact metric this exists to feed.
- *
- * It stores WHY and BY WHOM. It does not store the diff (R9) — git already holds what changed.
- */
-'use strict';
-(function (root, factory) {
-  const api = factory();
-  if (typeof module !== 'undefined' && module.exports) module.exports = api;
-  else root.CorrectionRecord = api;
-})(typeof self !== 'undefined' ? self : this, function () {
-
-  const DISPOSITIONS = new Set(['apply', 'edit', 'dismiss']);
-
-  /* Reasons the PM taps. Deliberately short — a taxonomy nobody can hold in their head gets
-   * skipped, and a skipped reason is a record that teaches nothing. 'other' carries free text. */
-  const REASONS = new Set(['factually-wrong', 'incomplete', 'wrong-scope', 'style', 'not-now', 'other']);
-
-  /* Required on `edit` (the agent was wrong in a way worth knowing) and on `dismiss` only when
-   * the PM chooses to give one (PRD open question 2: optional on dismiss, required on edit —
-   * the most common action must not carry the most friction). Never required on `apply`:
-   * accepting a proposal unchanged is not a correction and must not inflate the numerator. */
-  function reasonRequired(disposition) {
-    return disposition === 'edit';
-  }
-
-  /** Is this a correction at all? Applying an agent's proposal unchanged is agreement. */
-  function isCorrection(disposition) {
-    return disposition === 'edit' || disposition === 'dismiss';
-  }
-
-  const isStr = (v) => typeof v === 'string' && v.trim().length > 0;
-
-  /**
-   * Build a record from a disposition, or refuse.
-   *   input = { run_id, initiative_id, finding, disposition, pm_text?, reason?, reason_note?, pm, at }
-   * Returns { ok: true, record } or { ok: false, errors[] }. Never throws, never guesses.
-   */
-  function buildRecord(input) {
-    const e = [];
-    const i = input || {};
-
-    if (!DISPOSITIONS.has(i.disposition)) e.push(`disposition must be one of ${[...DISPOSITIONS].join(' | ')}`);
-    if (!i.finding || typeof i.finding !== 'object') e.push('finding is required — the record is anchored to what was proposed');
-    if (!isStr(i.pm)) e.push('pm is required');
-    if (!isStr(i.at)) e.push('at (ISO 8601) is required');
-
-    // ── the attribution rule (R8) ───────────────────────────────────────────────
-    // The agent's text must be present and must have come from THIS review's proposal. Anything
-    // else would mean deriving authorship from git or from timing, which is exactly forbidden.
-    const f = i.finding || {};
-    const agentText = f.proposal && f.proposal.after;
-    if (i.disposition !== 'dismiss' && !isStr(agentText)) {
-      e.push('no agent-proposed text on this finding — attribution would have to be inferred, so no record is written (R8)');
-    }
-    if (f.withheld === true) {
-      // A withheld finding was never applyable, so a disposition other than dismiss is incoherent
-      // and would imply the containment guard leaked.
-      if (i.disposition !== 'dismiss') e.push('a withheld finding can only be dismissed — it never offered a change (R7)');
-    }
-
-    if (i.disposition === 'edit' && !isStr(i.pm_text)) {
-      e.push('pm_text is required on an edit — the record exists to hold what the PM wrote instead');
-    }
-    if (reasonRequired(i.disposition) && !REASONS.has(i.reason)) {
-      e.push(`reason is required on an edit and must be one of ${[...REASONS].join(' | ')}`);
-    }
-    if (i.reason != null && !REASONS.has(i.reason)) e.push(`unknown reason '${i.reason}'`);
-    if (i.reason === 'other' && !isStr(i.reason_note)) e.push("reason 'other' requires reason_note");
-
-    if (e.length) return { ok: false, errors: e };
-
-    return {
-      ok: true,
-      record: {
-        run_id: isStr(i.run_id) ? i.run_id : null,
-        initiative_id: isStr(i.initiative_id) ? i.initiative_id : null,
-        file: f.file || null,
-        finding_title: f.title || null,
-        disposition: i.disposition,
-        is_correction: isCorrection(i.disposition),
-        // attribution: known, because the agent proposed it here and the PM answered it here.
-        attribution: 'proposed-in-review',
-        agent_text: isStr(agentText) ? agentText : null,
-        pm_text: isStr(i.pm_text) ? i.pm_text : null,
-        reason: i.reason || null,
-        reason_note: isStr(i.reason_note) ? i.reason_note : null,
-        pm: i.pm,
-        at: i.at,
-      },
-    };
-  }
-
-  /** Roll records up into the numbers the PRD's success signal names. No manual counting
-   *  (sprint criterion 8): both come straight off the records. */
-  function summarise(records) {
-    const r = Array.isArray(records) ? records : [];
-    const total = r.length;
-    const corrections = r.filter((x) => x && x.is_correction).length;
-    const acted = r.filter((x) => x && (x.disposition === 'apply' || x.disposition === 'edit')).length;
-    return {
-      dispositions: total,
-      corrections,
-      action_rate: total === 0 ? null : acted / total,
-      inferred_attributions: r.filter((x) => x && x.attribution !== 'proposed-in-review').length,
-    };
-  }
-
-  return { DISPOSITIONS, REASONS, reasonRequired, isCorrection, buildRecord, summarise };
-});