great-cto 2.85.2 → 2.86.0

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.85.2",
+  "version": "2.86.0",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"
@@ -236,6 +236,11 @@
             "type": "command",
             "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); node \"${PLUGIN_DIR}/scripts/hooks/cost-guard.mjs\" 2>&1 1>/dev/null; true",
             "timeout": 3
+          },
+          {
+            "type": "command",
+            "command": "[ -n \"$GREAT_CTO_CLASS_TELEMETRY\" ] && { PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); node \"${PLUGIN_DIR}/scripts/hooks/classify-telemetry.mjs\" 2>/dev/null; }; true",
+            "timeout": 3
           }
         ]
       }

package/board/packages/board/lib/beads.mjs

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import { spawnSync } from 'child_process';
+import { readSafe } from './util.mjs';
 import { bdCache } from './state.mjs';
 import { log } from './log.mjs';
 
@@ -119,13 +120,194 @@ function bdList(cwd = process.cwd(), runner = bd) {
   }
 }
 
-// Fallback: parse .great_cto/tasks.md when Beads isn't initialized.
-// Format: `- [ ] TASK-001: Title [agent] [~42min]\n  Description: ...\n  Depends: ...`
+// Map a free-form status word (from either tasks.md dialect) to the UI status
+// the board renders, plus the gate flag. Kept separate so both the checkbox and
+// the table parser classify identically.
+function tasksMdStatus(rawStatus, id, title) {
+  const s = String(rawStatus || '').toLowerCase().trim();
+  const isGate = /^gate[:\-]/i.test(title || '') || /^gate\b/i.test(id || '')
+    || (title || '').toLowerCase().includes('gate:');
+  let status;
+  if (s === 'done' || s === 'closed' || s === 'x') status = 'done';
+  else if (s === 'in_progress' || s === 'in-progress' || s === 'wip' || s === 'doing') status = 'in_progress';
+  else if (s === 'blocked') status = 'blocked';
+  else status = isGate ? 'gate' : 'backlog';
+  return { status, raw_status: status === 'done' ? 'closed' : 'open', isGate };
+}
+
+// Build the full task record both parsers emit — one shape so getTasks can
+// return either verbatim.
+function tasksMdRecord({ id, title, description, status, raw_status, isGate, owner, agent, est }) {
+  return {
+    id,
+    title: (title || '').trim(),
+    description: (description || '').trim(),
+    notes: '', design: '', acceptance: '',
+    status, raw_status,
+    priority: 2,
+    labels: agent ? [agent] : [],
+    owner: owner || agent || '',
+    created_at: null, updated_at: null, closed_at: null,
+    close_reason: '', comment_count: 0,
+    is_gate: isGate,
+    agent: agent || '',
+    estimated_minutes: est ? (parseInt(est) || null) : null,
+    source: 'tasks.md',
+  };
+}
+
+// The pipeline falls back to a Markdown *table* (`| id | title | status | owner |`)
+// when beads can't open the path (e.g. a space in it). Parse those rows. Requires
+// a header row containing at least `id`, `title`, `status` so unrelated tables in
+// the file (metrics, config) are never misread as tasks.
+// Split one Markdown table row into cells. Markdown escapes a literal pipe
+// inside a cell as `\|` (task notes are full of them: `range=1d\|1w\|1m\|all`,
+// `key\|secret\|token`). Splitting on a bare `|` shredded those rows into extra
+// columns, shoving `open`/`1m\`/`M` into the owner slot → junk filter chips and
+// broken layout. Split only on UNescaped pipes, then unescape each cell.
+function splitTableRow(line) {
+  return line
+    .replace(/^\s*\|/, '')
+    .replace(/\|\s*$/, '')
+    .split(/(?<!\\)\|/)
+    .map(c => c.replace(/\\\|/g, '|').trim());
+}
+
+// An owner/agent cell is a short handle (senior-dev, CTO, qa-engineer). This
+// tasks.md has 19 tables in 3 schemas (incl. `id|title|size|horizon|status|owner`
+// and `id|severity|finding|status`), plus ragged/duplicated rows, so a mis-aligned
+// row can drop a status word ("done"), a size ("M"), or a horizon code ("H2") into
+// the owner slot. Those became bogus agent/label filter chips. Accept only real
+// handle shapes; reject status/size words and anything with a digit.
+const NON_OWNER = new Set([
+  'done', 'closed', 'open', 'in_progress', 'in-progress', 'blocked', 'backlog',
+  'todo', 'wip', 'ready', 'gate', 'xs', 's', 'm', 'l', 'xl', // status + t-shirt sizes
+]);
+function cleanOwner(raw) {
+  const o = String(raw || '').trim();
+  if (!o || o === '—' || o.length > 40 || /\s—\s|[.;]/.test(o)) return '';
+  if (NON_OWNER.has(o.toLowerCase())) return '';
+  // Real handles are letters + hyphens (senior-dev, product-owner, CTO, pm).
+  // Anything with a digit (H2, P1, 1m) is a size/horizon/estimate code, not an owner.
+  if (!/^[A-Za-z]+(-[A-Za-z]+)*$/.test(o)) return '';
+  return o;
+}
+
+// tasks.md table "titles" can run to hundreds of chars (they carry a full
+// implementation note). bd titles are short, so no view was built to clamp this
+// much text and long rows overflowed the layout. Keep the card title readable and
+// push the overflow into the description (which renders in a scrollable panel).
+const TITLE_MAX = 160;
+function capTitle(title, description) {
+  const t = String(title || '').trim();
+  if (t.length <= TITLE_MAX) return { title: t, description };
+  const cut = t.lastIndexOf(' ', TITLE_MAX);
+  const at = cut > TITLE_MAX * 0.6 ? cut : TITLE_MAX;
+  const overflow = t.slice(at).trim();
+  return {
+    title: t.slice(0, at).trim() + '…',
+    description: overflow + (description ? ' — ' + description : ''),
+  };
+}
+
+function parseTableTasks(text) {
+  const lines = text.split('\n');
+  const tasks = [];
+  let cols = null; // { id, title, status, owner } → column indices
+  const idLike = /^[A-Za-z][\w.]*-[\w.\-]+$/; // e.g. GATE-arch, TASK-12, EPIC-2, AUTH-01
+  for (const line of lines) {
+    if (!/^\s*\|.*\|\s*$/.test(line)) { cols = null; continue; } // table ended
+    const cells = splitTableRow(line);
+    if (/^:?-{2,}:?$/.test(cells[0] || '')) continue; // separator row
+    if (!cols) {
+      const lower = cells.map(c => c.toLowerCase());
+      const idx = n => lower.indexOf(n);
+      if (idx('id') !== -1 && idx('title') !== -1 && idx('status') !== -1) {
+        cols = { id: idx('id'), title: idx('title'), status: idx('status'), owner: idx('owner') };
+      }
+      continue; // header consumed (or a non-task table's row skipped)
+    }
+    const id = cells[cols.id] || '';
+    if (!idLike.test(id)) continue; // not a task row
+    // Split a trailing `[ … ]` completion note off the title into the description.
+    let rawTitle = (cells[cols.title] || '').replace(/\*\*/g, '');
+    let description = '';
+    const noteAt = rawTitle.search(/`?\[/);
+    if (noteAt > 0) {
+      description = rawTitle.slice(noteAt).replace(/^`|`$/g, '').replace(/^\[|\]$/g, '').trim();
+      rawTitle = rawTitle.slice(0, noteAt).trim();
+    }
+    const owner = cols.owner !== -1 ? cleanOwner(cells[cols.owner]) : '';
+    const { status, raw_status, isGate } = tasksMdStatus(cells[cols.status], id, rawTitle);
+    const capped = capTitle(rawTitle, description);
+    tasks.push(tasksMdRecord({ id, title: capped.title, description: capped.description, status, raw_status, isGate, owner, agent: owner }));
+  }
+  return tasks;
+}
+
+// Best-effort write-back for bd-less projects (e.g. a path with a space, where
+// embedded-dolt can't open its store): flip the `status` cell of a task's row in
+// the tasks.md table so a board gate approve/reject still persists. Returns true
+// if a matching row was updated. Only touches the table dialect (the checkbox
+// dialect has no separate status cell to rewrite in place).
+function setTaskStatusInTasksMd(cwd, id, newStatus) {
+  const fp = path.join(cwd, '.great_cto', 'tasks.md');
+  if (!fs.existsSync(fp)) return false;
+  let text;
+  try { text = fs.readFileSync(fp, 'utf8'); } catch { return false; }
+  const lines = text.split('\n');
+  let cols = null, changed = false;
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*\|.*\|\s*$/.test(lines[i])) { cols = null; continue; }
+    const cells = splitTableRow(lines[i]);
+    if (/^:?-{2,}:?$/.test(cells[0] || '')) continue;
+    if (!cols) {
+      const lower = cells.map(c => c.toLowerCase());
+      if (lower.indexOf('id') !== -1 && lower.indexOf('status') !== -1) {
+        cols = { id: lower.indexOf('id'), status: lower.indexOf('status') };
+      }
+      continue;
+    }
+    if ((cells[cols.id] || '') === id) {
+      cells[cols.status] = newStatus;
+      // Re-escape pipes we unescaped on the way in, then rebuild the row.
+      lines[i] = '| ' + cells.map(c => c.replace(/\|/g, '\\|')).join(' | ') + ' |';
+      changed = true;
+      break;
+    }
+  }
+  if (!changed) return false;
+  try { fs.writeFileSync(fp, lines.join('\n')); return true; } catch { return false; }
+}
+
+// Fallback: parse .great_cto/tasks.md when Beads isn't initialized (or can't
+// open its store). Two dialects, tried in order:
+//   1. checkbox:  `- [ ] TASK-001: Title [agent] [~42min]` + indented description
+//   2. table:     `| id | title | status | owner |` rows (space-in-path fallback)
+// Why a read failed, per project dir — so the API can report "could not read
+// this" instead of an empty board. `null` means "nothing wrong": either the file
+// is legitimately absent or it parsed fine. Absence is normal; unreadable is not.
+const readDegradation = new Map();
+
+/** Degradation reason for a project's task sources, or null when healthy. */
+function getReadDegradation(cwd = process.cwd()) {
+  return readDegradation.get(cwd) || null;
+}
+
 function parseTasksMd(cwd) {
   const fp = path.join(cwd, '.great_cto', 'tasks.md');
-  if (!fs.existsSync(fp)) return [];
+  const r = readSafe(fp);
+  if (!r.ok) {
+    // Missing is a normal state (a project may track tasks in beads only).
+    // Unreadable is a defect the operator must see rather than read as "no tasks".
+    readDegradation.set(cwd, r.reason === 'missing'
+      ? null
+      : `tasks.md could not be read: ${r.error}`);
+    return [];
+  }
+  readDegradation.set(cwd, null);
   try {
-    const text = fs.readFileSync(fp, 'utf8');
+    const text = r.text;
     const tasks = [];
     const lines = text.split('\n');
     for (let i = 0; i < lines.length; i++) {
@@ -162,8 +344,15 @@ function parseTasksMd(cwd) {
         source: 'tasks.md',
       });
     }
+    // No checkbox tasks → try the table dialect before giving up.
+    if (tasks.length === 0) return parseTableTasks(r.text);
     return tasks;
-  } catch { return []; }
+  } catch (e) {
+    // The file was readable but we could not make sense of it. Record it: an
+    // empty list here is a parser defect, not an empty backlog.
+    readDegradation.set(cwd, `tasks.md could not be parsed: ${e?.message || e}`);
+    return [];
+  }
 }
 
 function getTasks(cwd = process.cwd()) {
@@ -236,6 +425,8 @@ export {
   bdWriteSerialised,
   bdList,
   parseTasksMd,
+  getReadDegradation,
+  setTaskStatusInTasksMd,
   getTasks,
   mapStatus,
   detectAgent,

package/board/packages/board/lib/fleet.mjs

@@ -3,6 +3,7 @@ import path from 'path';
 import os from 'os';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
+import { log } from './log.mjs';
 import { readVerdicts } from './verdicts.mjs';
 
 // ── Agent fleet view (DESIGN-agents-fleet-view §3) ─────────────────────────
@@ -297,23 +298,39 @@ function restoreAgent(slug) {
   return { ok: true, slug, restored_at: new Date().toISOString() };
 }
 
-// ── decisions.md (global ADR log) ──────────────────────────────────────────
+// ── decisions.md (per-project ADR log) ─────────────────────────────────────
 // Append-only architectural decisions log. Triggered on gate approve/reject.
 // One line per decision; pure markdown so users can `cat` / `grep` / view in
 // their editor without tooling.
-function decisionsLogPath() {
-  return path.join(GREAT_CTO_DIR, 'decisions.md');
+//
+// SCOPED PER PROJECT (ADR-008). A gate title carries the project's own words —
+// feature names, client names, internal slugs — so writing it to a file under
+// ~/.great_cto made it readable by agents working on *every other* project.
+// That is a real cross-tenant bleed, and it fired: a private client name reached
+// the global log via this exact path. New writes always go project-local; the
+// legacy global file is read-only history and is never appended to again.
+function decisionsLogPath(cwd) {
+  return cwd
+    ? path.join(cwd, '.great_cto', 'decisions.md')
+    : path.join(GREAT_CTO_DIR, 'decisions.md');
 }
 
-function appendDecisionLog({ ts, project, action, id, title, reason }) {
-  const file = decisionsLogPath();
-  try { fs.mkdirSync(GREAT_CTO_DIR, { recursive: true }); } catch {}
+function appendDecisionLog({ ts, project, action, id, title, reason, cwd }) {
+  // No project scope → refuse rather than fall back to the global file. Losing
+  // one log line is strictly better than leaking a project's vocabulary into
+  // every other project's agent context.
+  if (!cwd) {
+    log.warn('[decisions] skipped: no project cwd — refusing to write the global log');
+    return;
+  }
+  const file = decisionsLogPath(cwd);
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); } catch {}
   // Initialize header if file doesn't exist
   if (!fs.existsSync(file)) {
     const header =
 `# great_cto — decisions log
 
-Append-only architectural decisions across all projects. One line per
+Append-only architectural decisions for THIS project. One line per
 gate approve/reject. Agents and humans can grep this for "have we decided
 this before?" lookups.
 
@@ -323,14 +340,22 @@ Format: \`- [TIMESTAMP] [PROJECT] [APPROVED|REJECTED] gate-id — title — reas
     fs.writeFileSync(file, header);
   }
   const verdict = action === 'approve' ? 'APPROVED' : 'REJECTED';
-  const safeTitle = (title || '').replace(/\n/g, ' ').slice(0, 120);
-  const safeReason = (reason || '').replace(/\n/g, ' ').slice(0, 200);
+  // " — " is the field separator, so it must not survive inside a field. Gate
+  // titles are literally shaped `gate:plan — decompose X`, which used to make the
+  // reader split the title in half and mislabel its tail as the reason. Demote
+  // any in-field separator to a plain hyphen and the separator stays unique.
+  const clean = (s) => (s || '').replace(/\n/g, ' ').replace(/\s+—\s+/g, ' - ');
+  const safeTitle = clean(title).slice(0, 120);
+  const safeReason = clean(reason).slice(0, 200);
   const line = `- [${ts}] [${project}] [${verdict}] ${id} — ${safeTitle}${safeReason ? ` — ${safeReason}` : ''}\n`;
   fs.appendFileSync(file, line);
 }
 
-function readDecisionsLog(limit = 20) {
-  const file = decisionsLogPath();
+// Reads are scoped the same way writes are: project X's board shows project X's
+// decisions. The legacy global file is deliberately NOT merged in — surfacing it
+// everywhere is the bleed this change removes.
+function readDecisionsLog(limit = 20, cwd) {
+  const file = decisionsLogPath(cwd);
   if (!fs.existsSync(file)) return [];
   try {
     const text = fs.readFileSync(file, 'utf-8');

package/board/packages/board/lib/projects.mjs

@@ -4,7 +4,8 @@ import os from 'os';
 import { spawnSync } from 'child_process';
 import { planGates } from '../../../scripts/lib/gate-plan.mjs';
 import { GREAT_CTO_DIR, PROJECTS_FILE } from './config.mjs';
-import { isInsideDir } from './util.mjs';
+import { isInsideDir, readSafe, parseSafe } from './util.mjs';
+import { log } from './log.mjs';
 
 // Same HOME-boundary policy /api/projects/register enforces (lib/routes.mjs):
 // a raw absolute/tilde path must resolve inside the operator's home directory,
@@ -20,10 +21,28 @@ function resolveRawPathWithinHome(slugOrPath) {
 }
 
 // ── Project registry ───────────────────────────────────────────────────────────
+// Why the registry could not be read, or null when healthy. A corrupt or
+// unreadable projects.json used to yield `{projects: []}` silently, which the UI
+// renders as "you have no projects" — indistinguishable from a fresh install,
+// and a great way to lose a switcher full of work to one bad write.
+let registryDegradation = null;
+function getRegistryDegradation() { return registryDegradation; }
+
 function readProjectsRegistry() {
-  try { if (fs.existsSync(PROJECTS_FILE)) return JSON.parse(fs.readFileSync(PROJECTS_FILE, 'utf8')); }
-  catch {}
-  return { projects: [] };
+  const r = readSafe(PROJECTS_FILE);
+  if (!r.ok) {
+    registryDegradation = r.reason === 'missing' ? null : `projects.json could not be read: ${r.error}`;
+    if (registryDegradation) log.warn(`[projects] ${registryDegradation}`);
+    return { projects: [] };
+  }
+  const parsed = parseSafe(r.text);
+  if (!parsed.ok) {
+    registryDegradation = `projects.json is not valid JSON: ${parsed.error}`;
+    log.warn(`[projects] ${registryDegradation} — the switcher will look empty until this is fixed`);
+    return { projects: [] };
+  }
+  registryDegradation = null;
+  return parsed.value;
 }
 // Pick the best entry among several sharing a slug: prefer one whose path
 // still exists on disk; among several existing (or several missing), prefer
@@ -180,12 +199,16 @@ async function discoverProjects() {
     if (depth < 0 || seen.has(dir)) return;
     seen.add(dir);
     try {
-      // Check the dir itself first
-      try {
-        await fsAsync.access(path.join(dir, '.great_cto', 'PROJECT.md'));
-        found.push(dir);
-        return; // don't descend into a registered project
-      } catch {}
+      // Check the dir itself first — but NEVER treat HOME's own .great_cto as a
+      // project: ~/.great_cto is the global config dir, not a project. Without
+      // this guard, $HOME gets registered as a bogus project (great_cto-…).
+      if (dir !== HOME) {
+        try {
+          await fsAsync.access(path.join(dir, '.great_cto', 'PROJECT.md'));
+          found.push(dir);
+          return; // don't descend into a registered project
+        } catch {}
+      }
       if (depth === 0) return;
       // Scan children (skip dotfiles + heavyweight dirs)
       const entries = await fsAsync.readdir(dir, { withFileTypes: true });
@@ -238,8 +261,17 @@ function listProjects() {
   // Auto-register cwd if it has PROJECT.md (cheap)
   autoRegisterProject(process.cwd());
   const reg = readProjectsRegistry();
-  // Filter out projects whose paths no longer exist
-  reg.projects = reg.projects.filter(p => fs.existsSync(p.path));
+  const HOME = os.homedir();
+  // Show only live projects: drop entries whose path is gone, the global
+  // ~/.great_cto config dir ($HOME itself), and dead registrations whose
+  // .great_cto has no project marker or task source left (no PROJECT.md,
+  // no tasks.md, no .beads → nothing to show, just clutters the switcher).
+  reg.projects = reg.projects.filter(p =>
+    p.path !== HOME &&
+    fs.existsSync(p.path) &&
+    (fs.existsSync(path.join(p.path, '.great_cto', 'PROJECT.md')) ||
+     fs.existsSync(path.join(p.path, '.great_cto', 'tasks.md')) ||
+     fs.existsSync(path.join(p.path, '.beads'))));
   // Re-read metadata in case archetype/description changed
   // Enrich with last_activity (mtime of .beads/interactions.jsonl) so the UI
   // can sort projects by recent activity instead of slug-alpha.
@@ -323,6 +355,7 @@ export {
   readProjectMd,
   getChangeTier,
   autoRegisterProject,
+  getRegistryDegradation,
   discoverProjects,
   listProjects,
   resolveProjectCwd,

package/board/packages/board/lib/routes.mjs

@@ -14,7 +14,7 @@ import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
 import { getMemory, getPipeline, getCostHistory, getInbox } from './data-readers.mjs';
 import { log } from './log.mjs';
-import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks } from './beads.mjs';
+import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
@@ -102,8 +102,16 @@ async function dispatch(req, res, url, cwd) {
   }
 
   if (pathname === '/api/tasks' && req.method === 'GET') {
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(getTasks(cwd)));
+    const tasks = getTasks(cwd);
+    // An empty list has two very different meanings: "no tasks" and "we could
+    // not read them". Carry the second in a header so the UI can render an
+    // error state instead of a clean-looking empty board. A header keeps the
+    // array body shape, so existing consumers are unaffected.
+    const degraded = getReadDegradation(cwd);
+    const headers = { 'Content-Type': 'application/json' };
+    if (degraded) headers['X-Board-Degraded'] = encodeURIComponent(degraded);
+    res.writeHead(200, headers);
+    res.end(JSON.stringify(tasks));
     return true;
   }
 
@@ -332,8 +340,13 @@ async function dispatch(req, res, url, cwd) {
         res.end(JSON.stringify({ error: 'invalid action' }));
         return;
       }
+      // A project can be tasks.md-backed (no working beads — e.g. its path
+      // contains a space, which embedded-dolt can't open). Only 409 when there
+      // is neither a beads store NOR a tasks.md to record the decision in.
       const beadsErr = checkBeadsAvailable(gateCwd);
-      if (beadsErr) {
+      const tasksMdPath = path.join(gateCwd, '.great_cto', 'tasks.md');
+      const hasTasksMd = fs.existsSync(tasksMdPath);
+      if (beadsErr && !hasTasksMd) {
         res.writeHead(409, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(beadsErr));
         return;
@@ -344,10 +357,20 @@ async function dispatch(req, res, url, cwd) {
       // rejected. bdWriteSerialised guarantees one-at-a-time semantics.
       const result = await bdWriteSerialised(() => {
         const status = action === 'approve' ? 'closed' : 'blocked';
-        const args = ['update', id, '--status', status];
-        if (reason) args.push('--notes', `[${action}] ${reason}`);
-        const r = bd(args, { cwd: gateCwd, timeout: 5000 });
-        if (r.status !== 0) return { error: bdErr(r, 'bd update failed') };
+        let via = 'beads';
+        // Try beads first (unless there's no store at all); on any bd failure
+        // fall back to rewriting the tasks.md status cell so the gate still lands.
+        const r = beadsErr
+          ? { status: 1, error: { code: 'NO_BEADS' } }
+          : bd(['update', id, '--status', status, ...(reason ? ['--notes', `[${action}] ${reason}`] : [])],
+              { cwd: gateCwd, timeout: 5000 });
+        if (r.status !== 0) {
+          if (!setTaskStatusInTasksMd(gateCwd, id, status)) {
+            return { error: (beadsErr ? 'beads unavailable' : bdErr(r, 'bd update failed'))
+              + ` — and no matching '${id}' row in tasks.md to update` };
+          }
+          via = 'tasks.md';
+        }
         bdCacheInvalidate(gateCwd);
         // Append to global decisions log — still inside the lock window
         try {
@@ -362,9 +385,10 @@ async function dispatch(req, res, url, cwd) {
             id,
             title,
             reason: reason || '',
+            cwd: gateCwd,   // project-scoped (ADR-008) — never the global log
           });
         } catch { /* best-effort */ }
-        return { ok: true };
+        return { ok: true, via };
       });
       if (!result || result.error) {
         res.writeHead(500, { 'Content-Type': 'application/json' });
@@ -372,8 +396,8 @@ async function dispatch(req, res, url, cwd) {
         return;
       }
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ ok: true, id, action }));
-      broadcastTasks(cwd);
+      res.end(JSON.stringify({ ok: true, id, action, via: result.via }));
+      broadcastTasks(gateCwd);
       // Auto-republish share report when a gate is approved (fire-and-forget)
       if (action === 'approve') {
         const shareState = getShareState(gateCwd);
@@ -411,7 +435,7 @@ async function dispatch(req, res, url, cwd) {
       ? Math.min(parsed, 200)
       : 20;
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(readDecisionsLog(limit)));
+    res.end(JSON.stringify(readDecisionsLog(limit, cwd)));
     return true;
   }
 
@@ -701,6 +725,10 @@ async function dispatch(req, res, url, cwd) {
   if (pathname === '/api/logs') {
     const logsDir = path.join(cwd, '.great_cto', 'logs');
     let logs = [];
+    // Why the session-log read failed, if it did. "No logs" and "could not read
+    // the logs directory" look identical in the UI otherwise — the same collapse
+    // that made an unreadable tasks.md look like an empty backlog.
+    let logsDegraded = null;
     try {
       const files = fs.readdirSync(logsDir)
         .filter(f => f.startsWith('session-') && f.endsWith('.md'))
@@ -711,11 +739,18 @@ async function dispatch(req, res, url, cwd) {
         const dateM = raw.match(/^date:\s*(.+)$/m);
         const timeM = raw.match(/^time:\s*(.+)$/m);
         const durM  = raw.match(/^duration:\s*(.+)$/m);
-        const titleM = raw.match(/^#\s+Session:\s*(.+)$/m);
-        const doneM = raw.match(/## Done\n([\s\S]*?)(?=\n##|$)/);
-        let done = doneM ? doneM[1].trim().split('\n').filter(l => l.startsWith('- ')).map(l => l.slice(2)) : [];
-        const pendM = raw.match(/## Pending\n([\s\S]*?)(?=\n##|$)/);
-        let pending = pendM ? pendM[1].trim().split('\n').filter(l => l.startsWith('- ')).map(l => l.slice(2)) : [];
+        const titleM = raw.match(/^#\s+Session:\s*(.+)$/m) || raw.match(/^#\s+(Session[^\n]*)$/m);
+        // Headings vary across /save versions and hand-written logs: "## Done",
+        // "## Done today", "## Pending", "## Next", "## TODO". Match the keyword
+        // and ignore any trailing words on the heading line; bullets may be - or *.
+        // Accept "- ", "* ", and "1." / "2)" numbered list items.
+        const bulletsFrom = (m) => m
+          ? m[1].trim().split('\n').filter(l => /^(?:[-*]|\d+[.)])\s+/.test(l)).map(l => l.replace(/^(?:[-*]|\d+[.)])\s+/, ''))
+          : [];
+        const doneM = raw.match(/##\s+Done[^\n]*\n([\s\S]*?)(?=\n##|$)/i);
+        let done = bulletsFrom(doneM);
+        const pendM = raw.match(/##\s+(?:Pending|Next(?:\s+steps?)?|To\s?do|Blocked)[^\n]*\n([\s\S]*?)(?=\n##|$)/i);
+        let pending = bulletsFrom(pendM);
 
         // v2.7.0: SessionEnd hook auto-captures use a different schema
         // (## Git / ## Beads / ## Cost). When no /save format found,
@@ -749,14 +784,22 @@ async function dispatch(req, res, url, cwd) {
           raw,
         };
       });
-    } catch {}
+    } catch (e) {
+      // ENOENT is the normal "this project has never run /save" state; anything
+      // else means logs exist and we failed to read them, which the user must see.
+      if (e && e.code !== 'ENOENT') {
+        logsDegraded = `session logs could not be read: ${e.message || e}`;
+        log.warn(`[logs] ${logsDegraded}`);
+      }
+    }
 
     // Fallback: synthesize from verdicts grouped by day
     if (!logs.length) {
       try {
-        const verdicts = readVerdicts();
-        // Filter to verdicts referencing this project (best-effort: include all
-        // when project-tagging not available)
+        // Scope to THIS project: readVerdicts(cwd) returns project-local verdicts
+        // plus global lines tagged `project=<slug>`. Without the cwd every project
+        // showed the same unfiltered global verdict feed (another project's work).
+        const verdicts = readVerdicts(cwd);
         const byDay = new Map();
         for (const v of verdicts) {
           const day = (v.ts || '').slice(0, 10);
@@ -786,11 +829,17 @@ async function dispatch(req, res, url, cwd) {
             pending: b.fail.slice(0, 50),
             raw: '_Auto-generated from ~/.great_cto/verdicts/. Run `/save` to create a curated session log._',
           }));
-      } catch {}
+      } catch (e) {
+        logsDegraded = logsDegraded
+          || `verdict fallback could not be built: ${e?.message || e}`;
+        log.warn(`[logs] ${logsDegraded}`);
+      }
     }
 
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ logs }));
+    const logHeaders = { 'Content-Type': 'application/json' };
+    if (logsDegraded) logHeaders['X-Board-Degraded'] = encodeURIComponent(logsDegraded);
+    res.writeHead(200, logHeaders);
+    res.end(JSON.stringify({ logs, degraded: logsDegraded || undefined }));
     return true;
   }
 

package/board/packages/board/lib/util.mjs

@@ -34,6 +34,53 @@ function readFileSafe(p) {
   try { return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null; } catch { return null; }
 }
 
+/**
+ * Read a file while keeping the three outcomes a caller must treat differently
+ * apart: the file is absent, the file exists but could not be read, or here are
+ * its contents.
+ *
+ * `readFileSafe` collapses the middle case into the first — it returns null for
+ * both — so every caller downstream renders "no data". That is how a permission
+ * error, a truncated file, or a parse failure became indistinguishable from an
+ * empty project, and it is the shared root of five separate board bugs: tasks
+ * that silently listed nothing, a metrics panel showing "—" while the API had
+ * real counts, and session logs reporting "nothing recorded" over a file full of
+ * entries. Emptiness must be a finding, not a fallback.
+ *
+ * @returns {{ok:true,text:string}
+ *          |{ok:false,reason:'missing'}
+ *          |{ok:false,reason:'unreadable',error:string}}
+ */
+function readSafe(p) {
+  let exists;
+  try {
+    exists = fs.existsSync(p);
+  } catch (e) {
+    // existsSync itself throws on some permission/loop conditions.
+    return { ok: false, reason: 'unreadable', error: e?.message || String(e) };
+  }
+  if (!exists) return { ok: false, reason: 'missing' };
+  try {
+    return { ok: true, text: fs.readFileSync(p, 'utf8') };
+  } catch (e) {
+    return { ok: false, reason: 'unreadable', error: e?.message || String(e) };
+  }
+}
+
+/**
+ * Wrap a parse step so a malformed payload is reported rather than swallowed.
+ * Callers that used `try { JSON.parse(x) } catch { return [] }` cannot tell a
+ * genuinely empty list from a corrupt file; this keeps that distinction.
+ * @returns {{ok:true,value:any}|{ok:false,reason:'unparsable',error:string}}
+ */
+function parseSafe(text, parser = JSON.parse) {
+  try {
+    return { ok: true, value: parser(text) };
+  } catch (e) {
+    return { ok: false, reason: 'unparsable', error: e?.message || String(e) };
+  }
+}
+
 // Path-containment check used by any handler that joins user-controlled input
 // onto a base directory (static file serving, doc reads, etc.). Resolves both
 // sides and requires `target` to be exactly `base`, or a real descendant of
@@ -46,4 +93,4 @@ function isInsideDir(base, target) {
   return resolvedTarget === resolvedBase || resolvedTarget.startsWith(resolvedBase + path.sep);
 }
 
-export { csvCell, originAllowed, eventSurface, readFileSafe, isInsideDir };
+export { csvCell, originAllowed, eventSurface, readFileSafe, readSafe, parseSafe, isInsideDir };

package/board/packages/board/public/index.html

@@ -558,6 +558,24 @@ button { font-family: inherit; cursor: pointer; }
   text-align: center;
 }
 
+/* A read failed. Deliberately louder than .empty — the whole point is that this
+   must not be mistaken for "there is nothing here". */
+.degraded-banner {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  margin: 0 0 12px;
+  padding: 10px 12px;
+  border: 1px solid #f0b429;
+  border-left-width: 3px;
+  border-radius: 6px;
+  background: rgba(240, 180, 41, 0.08);
+  font-size: 12px;
+  line-height: 1.45;
+}
+.degraded-banner strong { color: var(--text1); font-weight: 600; }
+.degraded-banner span { color: var(--text2); font-family: var(--mono, ui-monospace, monospace); word-break: break-word; }
+
 /* ── Side panel ───────────────────────────────────────────────────────────── */
 .side {
   position: absolute;
@@ -2678,7 +2696,12 @@ function renderInbox(d) {
   inboxData = d || {};
   const s = d?.summary || { gates: 0, blocked: 0, p0: 0, stale: 0 };
   document.getElementById('nav-inbox-count').textContent = s.gates + s.p0 + s.blocked;
-  document.getElementById('inbox-greet').textContent = `${greetByHour()} ${s.gates + s.p0 ? "Here's what needs your decision." : 'Nothing urgent — back to deep work.'}`;
+  // Same rule as the all-clear card: "nothing urgent" is a claim about data we
+  // may not have. When a read failed, say that instead of reassuring the user.
+  const greetTail = anyDegraded()
+    ? "Some data could not be read — treat the counts below as incomplete."
+    : (s.gates + s.p0 ? "Here's what needs your decision." : 'Nothing urgent — back to deep work.');
+  document.getElementById('inbox-greet').textContent = `${greetByHour()} ${greetTail}`;
   document.getElementById('inbox-summary').innerHTML = `
     <div class="pill-stat"><span class="dot dot-purple"></span><div><div class="num">${s.gates}</div><div class="lbl">Pending decisions</div></div></div>
     <div class="pill-stat"><span class="dot dot-red"></span><div><div class="num">${s.p0}</div><div class="lbl">P0 open</div></div></div>
@@ -2693,7 +2716,14 @@ function renderInbox(d) {
   const attention = (d?.pending_gates || []).length + (d?.p0_open || []).length
     + (d?.blocked || []).length + (d?.stale_in_progress || []).length;
   const ac = document.getElementById('inbox-allclear');
-  if (ac) ac.style.display = attention === 0 ? '' : 'none';
+  // "All clear" is a claim about the data, so it may only be made when the data
+  // was actually read. With an unreadable tasks.md every one of these counts is
+  // zero and the card used to headline "Nothing needs your decision" — maximum
+  // confidence at exactly the moment we knew least. Absence of findings is not
+  // a finding of absence.
+  if (ac) ac.style.display = (attention === 0 && !anyDegraded()) ? '' : 'none';
+  renderDegradedBanner('degraded-read', degradedFor('/api/tasks'),
+    'Some project data could not be read — counts below are incomplete.');
 }
 
 function renderInboxList(rootId, items, countId, opts = {}) {
@@ -3159,7 +3189,7 @@ function renderCost(d) {
       <div class="cost-cell ${overBudget ? 'warn' : (budget != null ? 'good' : '')}">
         <div class="lbl">Projected month</div>
         <div class="v">$${projected.toFixed(0)}</div>
-        <div class="sub">${budget != null ? (overBudget ? `over budget by $${(projected - budget).toFixed(0)}` : `${Math.round((projected/budget)*100)}% of $${budget} budget`) : 'set monthly-budget in PROJECT.md'}</div>
+        <div class="sub">${budget > 0 ? (overBudget ? `over budget by $${(projected - budget).toFixed(0)}` : `${Math.round((projected/budget)*100)}% of $${budget} budget`) : 'set monthly-budget in PROJECT.md'}</div>
       </div>
       <div class="cost-cell good">
         <div class="lbl">vs Human team</div>
@@ -3484,6 +3514,7 @@ async function switchProject(slug) {
   loadMemory();
   refreshCost();
   refreshPipeline();
+  refreshLogs();   // populate the Logs nav badge (was lazy — stuck at 0 until the tab was opened)
   refreshAgentsInstalled();   // reload agents with verdicts for the new project
   connectSSE();
   if (lbl) lbl.textContent = 'live · synced just now';
@@ -3671,6 +3702,7 @@ async function init() {
   loadMemory();
   refreshCost();
   refreshPipeline();
+  refreshLogs();   // populate the Logs nav badge (was lazy — stuck at 0 until the tab was opened)
   refreshAgentsInstalled();  // preload fleet so Agents tab is instant
   connectSSE();
 
@@ -3684,8 +3716,50 @@ async function init() {
   }
 }
 
+// Reasons the server could not read something, keyed by API path. An empty list
+// means either "nothing here" or "we failed to read it", and rendering both as a
+// tidy empty state is what let a broken tasks.md look like an empty backlog for
+// a week. The server now says which via X-Board-Degraded; keep it so the view
+// can show it.
+const BOARD_DEGRADED = Object.create(null);
+function degradedFor(path) { return BOARD_DEGRADED[path] || null; }
+
+/**
+ * Show or clear a read-failure banner, and remove it as soon as the read
+ * recovers — a stale error is its own bug.
+ *
+ * It mounts at the top of `.workspace`, NOT inside the tasks panel. Mounting it
+ * next to the thing that failed hides it on every other tab: with an unreadable
+ * tasks.md the landing view was still headlining "Nothing urgent" and "All
+ * clear" while the banner sat in the DOM, invisible, one tab away. A failure
+ * notice that only appears where you already suspect a problem is decoration.
+ */
+function renderDegradedBanner(id, reason, headline) {
+  const existing = document.getElementById(id);
+  if (!reason) { if (existing) existing.remove(); return; }
+  const el = existing || document.createElement('div');
+  el.id = id;
+  el.className = 'degraded-banner';
+  el.setAttribute('role', 'alert');
+  el.innerHTML = `<strong>${esc(headline)}</strong><span>${esc(reason)}</span>`;
+  if (!existing) {
+    const host = document.querySelector('.workspace')
+      || (document.getElementById('kanban-board') || {}).parentNode;
+    if (host) host.insertBefore(el, host.firstChild);
+  }
+}
+
+/** True when any project-scoped read failed — used to suppress "all clear" claims. */
+function anyDegraded() { return Object.keys(BOARD_DEGRADED).length > 0; }
+
 function api(url, opts) {
-  return fetch(url, opts).then(r => r.json()).catch(() => null);
+  const key = String(url).split('?')[0];
+  return fetch(url, opts).then(r => {
+    const d = r.headers && r.headers.get('X-Board-Degraded');
+    if (d) { try { BOARD_DEGRADED[key] = decodeURIComponent(d); } catch { BOARD_DEGRADED[key] = d; } }
+    else delete BOARD_DEGRADED[key];
+    return r.json();
+  }).catch(() => null);
 }
 
 function connectSSE() {
@@ -3856,6 +3930,10 @@ function clearFilters() {
 function renderKanban(tasks) {
   renderFilterBar();
   const board = document.getElementById('kanban-board');
+  // If the server could not read the task source, say so. An empty board that
+  // looks clean is a lie when the truth is "we failed to read tasks.md".
+  renderDegradedBanner('degraded-read', degradedFor('/api/tasks'),
+    'Tasks could not be read — this board is not empty, it is unreadable.');
   const byCol = Object.fromEntries(COLUMNS.map(c => [c.id, []]));
   for (const t of tasks) {
     if (byCol[t.status]) byCol[t.status].push(t);
@@ -4034,8 +4112,11 @@ function renderDashboard(m) {
   const llmUsd = m.cost?.llm_usd ?? 0;
   const realLlmUsd = m.cost?.real_llm_usd ?? 0;
   const planSavingsX = m.cost?.savings_x;
-  // Prefer window-scoped count when API provides it (matches selected period)
-  const done = m.tasks?.done_in_window ?? m.tasks?.done ?? 0;
+  // Prefer the window-scoped count, but fall back to the all-time total when it
+  // is 0 — otherwise projects with completed-but-untimestamped tasks (e.g. a
+  // tasks.md fallback with no dates) show a meaningless "—" despite real work.
+  // (`??` kept 0 because done_in_window is 0, not null; `||` fixes that.)
+  const done = (m.tasks?.done_in_window || m.tasks?.done) ?? 0;
   const avgMin = m.avg_completion_min ?? 0;
   const cycleStat = m.cycle_time_stat === 'median_30d' ? 'Median cycle (30d)' : 'Avg cycle time';
 

package/dist/board-daemon.js

@@ -0,0 +1,143 @@
+// OS-supervisor units + the `board ensure` decision — the pure, unit-testable
+// core of ADR-007. No process is spawned and no file is written here; main.ts
+// owns the side effects (spawn / launchctl / systemctl / writing the unit).
+//
+// Kept dependency-free and string-only so the renderers can be asserted directly,
+// the same way board-path.ts isolates resolution from the spawn in main.ts.
+export const DEFAULT_LABEL = "co.greatcto.board";
+function xmlEscape(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+/** launchd LaunchAgent plist: RunAtLoad + KeepAlive = "always on" across reboots/crashes. */
+export function renderLaunchdPlist(o) {
+    const label = o.label ?? DEFAULT_LABEL;
+    const args = [o.nodePath, o.cliPath, "board", "--no-open"];
+    const argXml = args.map(a => `    <string>${xmlEscape(a)}</string>`).join("\n");
+    const logDir = `${o.home}/.great_cto`;
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlEscape(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${argXml}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>BOARD_PORT</key>
+    <string>${o.port}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(logDir)}/board.log</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(logDir)}/board.err</string>
+</dict>
+</plist>
+`;
+}
+/** systemd --user service: Restart=always + WantedBy=default.target = "always on" per login session. */
+export function renderSystemdUnit(o) {
+    const execStart = `${o.nodePath} ${o.cliPath} board --no-open`;
+    return `[Unit]
+Description=great_cto board (Kanban + CTO Dashboard)
+After=network.target
+
+[Service]
+Type=simple
+Environment=BOARD_PORT=${o.port}
+ExecStart=${execStart}
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`;
+}
+/** Windows Task Scheduler command that (re)creates an at-logon task for the board. */
+export function renderSchtasksCommand(o) {
+    const label = o.label ?? DEFAULT_LABEL;
+    const tr = `"${o.nodePath}" "${o.cliPath}" board --no-open`;
+    return `schtasks /create /tn "${label}" /sc onlogon /rl limited /f /tr "${tr}"`;
+}
+/** Map a platform to its supervisor: where the unit goes and how to (de)activate it. */
+export function daemonSpec(platform, o) {
+    const label = o.label ?? DEFAULT_LABEL;
+    if (platform === "darwin") {
+        const unitPath = `${o.home}/Library/LaunchAgents/${label}.plist`;
+        return {
+            platform,
+            supported: true,
+            kind: "launchd",
+            label,
+            unitPath,
+            render: () => renderLaunchdPlist(o),
+            // unload first (ignore failure) so re-install is idempotent, then load with -w (persist).
+            installCmds: [
+                ["launchctl", "unload", unitPath],
+                ["launchctl", "load", "-w", unitPath],
+            ],
+            uninstallCmds: [["launchctl", "unload", "-w", unitPath]],
+        };
+    }
+    if (platform === "linux") {
+        const unitPath = `${o.home}/.config/systemd/user/greatcto-board.service`;
+        return {
+            platform,
+            supported: true,
+            kind: "systemd",
+            label,
+            unitPath,
+            render: () => renderSystemdUnit(o),
+            installCmds: [
+                ["systemctl", "--user", "daemon-reload"],
+                ["systemctl", "--user", "enable", "--now", "greatcto-board.service"],
+            ],
+            uninstallCmds: [["systemctl", "--user", "disable", "--now", "greatcto-board.service"]],
+        };
+    }
+    if (platform === "win32") {
+        return {
+            platform,
+            supported: true,
+            kind: "schtasks",
+            label,
+            unitPath: "", // no separate file — the task IS the config
+            render: () => renderSchtasksCommand(o),
+            installCmds: [["cmd", "/c", renderSchtasksCommand(o)]],
+            uninstallCmds: [["cmd", "/c", `schtasks /delete /tn "${label}" /f`]],
+        };
+    }
+    // Unknown platform — degrade safely rather than throw.
+    return {
+        platform,
+        supported: false,
+        kind: "none",
+        label,
+        unitPath: "",
+        render: () => "",
+        installCmds: [],
+        uninstallCmds: [],
+    };
+}
+/**
+ * Decide what `board ensure` should do:
+ *   - no live process              → start
+ *   - live process, port hung      → restart (the case a liveness supervisor misses)
+ *   - live process, port answering → noop (never kill a healthy board)
+ */
+export function decideEnsureAction(s) {
+    if (s.pid === null || !s.alive)
+        return "start";
+    if (!s.healthy)
+        return "restart";
+    return "noop";
+}

package/dist/main.js

@@ -23,6 +23,7 @@ import { shouldUseLlmFallback, suggestArchetypeFromLlm } from "./llm-fallback.js
 import { sendUsagePing, sendInstallPing, telemetrySubcommand, isTelemetryEnabled, computeAnonId } from "./telemetry.js";
 import { checkForUpdate } from "./update-check.js";
 import { findBoardServerPath } from "./board-path.js";
+import { daemonSpec, decideEnsureAction } from "./board-daemon.js";
 import { readFileSync, writeFileSync, copyFileSync, chmodSync, mkdirSync, unlinkSync, existsSync as fsExistsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -345,6 +346,160 @@ async function runBoard(args, surface) {
     });
     return 0;
 }
+// ── Always-on board: `ensure` gate + OS-supervisor install (ADR-007) ─────────
+/** Absolute path to the CLI entry (index.mjs), one level up from dist/main.js. */
+function cliEntryPath() {
+    const here = dirname(fileURLToPath(import.meta.url)); // …/dist
+    return join(here, "..", "index.mjs");
+}
+/** Read the board PID file → number, or null if missing / garbage. */
+function readBoardPid(surface) {
+    const pidFile = boardPidFilePath(surface);
+    if (!fsExistsSync(pidFile))
+        return null;
+    const pid = parseInt(readFileSync(pidFile, "utf8").trim(), 10);
+    return pid && !isNaN(pid) ? pid : null;
+}
+/** signal-0 existence check. */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Does the board answer HTTP on this port? Any response (even 4xx) = healthy. */
+async function probeBoardPort(port) {
+    const http = await import("node:http");
+    return new Promise(resolve => {
+        const req = http.request({ host: "127.0.0.1", port, path: "/", method: "GET", timeout: 1200 }, res => { res.resume(); resolve(true); });
+        req.on("error", () => resolve(false));
+        req.on("timeout", () => { req.destroy(); resolve(false); });
+        req.end();
+    });
+}
+/** Detached relaunch of the board (survives this CLI process). Returns the new pid. */
+async function spawnDetachedBoard(port) {
+    const { spawn } = await import("node:child_process");
+    const serverPath = findBoardServerPath();
+    if (!serverPath) {
+        error("Board server not found. Reinstall the CLI (npm i -g great-cto@latest).");
+        return undefined;
+    }
+    const child = spawn(process.execPath, [serverPath, "--no-open"], {
+        env: { ...process.env, BOARD_PORT: String(port) },
+        stdio: "ignore",
+        detached: true,
+    });
+    child.unref();
+    try {
+        mkdirSync(join(homedir(), ".great_cto"), { recursive: true });
+        if (child.pid)
+            writeFileSync(boardPidFilePath(), String(child.pid));
+    }
+    catch { /* best-effort */ }
+    return child.pid;
+}
+/**
+ * `great-cto board ensure` — idempotent health gate. Starts the board only if it
+ * isn't already answering; never kills a healthy instance. Safe to call from a
+ * supervisor, cron line, or shell hook.
+ */
+async function runBoardEnsure(args) {
+    const port = args.boardPort;
+    const pid = readBoardPid();
+    const alive = pid !== null && isPidAlive(pid);
+    const healthy = alive && await probeBoardPort(port);
+    const action = decideEnsureAction({ pid, alive, healthy });
+    if (action === "noop") {
+        log(`  ${green("✓")} board already running → http://localhost:${port} (pid ${pid})`);
+        return 0;
+    }
+    if (action === "restart") {
+        log(`  ${dim(`board pid ${pid} alive but not answering on ${port} — restarting…`)}`);
+        await killExistingBoard();
+    }
+    const newPid = await spawnDetachedBoard(port);
+    if (!newPid)
+        return 1;
+    log(`  ${green("✓")} board ${action === "restart" ? "restarted" : "started"} → http://localhost:${port} (pid ${newPid})`);
+    return 0;
+}
+/**
+ * `great-cto board install-daemon` — write + activate a per-user OS service that
+ * keeps the board running across crashes and reboots. `--dry-run` prints only.
+ */
+async function runBoardInstallDaemon(args) {
+    const { spawnSync } = await import("node:child_process");
+    const spec = daemonSpec(process.platform, {
+        nodePath: process.execPath,
+        cliPath: cliEntryPath(),
+        port: args.boardPort,
+        home: homedir(),
+    });
+    if (!spec.supported) {
+        error(`No supervisor integration for platform '${process.platform}'.`);
+        log("Run `great-cto board ensure` from your own scheduler instead.");
+        return 1;
+    }
+    const body = spec.render();
+    if (args.dryRun) {
+        log(bold(`Would install ${spec.kind} unit${spec.unitPath ? ` at ${spec.unitPath}` : ""}:\n`));
+        log(body);
+        log(dim(`Then run: ${spec.installCmds.map(c => c.join(" ")).join(" && ")}`));
+        return 0;
+    }
+    // Write the unit file (launchd/systemd). win32 has no separate file — the task IS the config.
+    if (spec.unitPath) {
+        try {
+            mkdirSync(dirname(spec.unitPath), { recursive: true });
+            writeFileSync(spec.unitPath, body);
+            log(`  ${green("✓")} wrote ${spec.kind} unit → ${spec.unitPath}`);
+        }
+        catch (e) {
+            error(`Could not write unit file: ${e.message}`);
+            return 1;
+        }
+    }
+    for (const cmd of spec.installCmds) {
+        const r = spawnSync(cmd[0], cmd.slice(1), { stdio: "ignore" });
+        // launchctl unload of a not-yet-loaded agent returns non-zero — that's expected on first install.
+        if (r.status !== 0 && !(cmd[0] === "launchctl" && cmd.includes("unload"))) {
+            warn(`command exited ${r.status}: ${cmd.join(" ")}`);
+        }
+    }
+    log(`  ${green("✓")} board daemon installed — it will start at login and restart on crash.`);
+    log(dim(`  now:      great-cto board ensure   (brings it up immediately)`));
+    log(dim(`  remove:   great-cto board uninstall-daemon`));
+    return 0;
+}
+/** `great-cto board uninstall-daemon` — deactivate the service and remove its unit file. */
+async function runBoardUninstallDaemon(args) {
+    const { spawnSync } = await import("node:child_process");
+    const spec = daemonSpec(process.platform, {
+        nodePath: process.execPath,
+        cliPath: cliEntryPath(),
+        port: args.boardPort,
+        home: homedir(),
+    });
+    if (!spec.supported) {
+        error(`No supervisor integration for platform '${process.platform}'.`);
+        return 1;
+    }
+    for (const cmd of spec.uninstallCmds) {
+        spawnSync(cmd[0], cmd.slice(1), { stdio: "ignore" });
+    }
+    if (spec.unitPath && fsExistsSync(spec.unitPath)) {
+        try {
+            unlinkSync(spec.unitPath);
+        }
+        catch { /* ignore */ }
+    }
+    log(`  ${green("✓")} board daemon removed. (A running board keeps running — stop it with a new \`board\` or reboot.)`);
+    return 0;
+}
 function printHelp() {
     log(`${bold("great-cto")} — one-command install for the great_cto Claude Code plugin
 
@@ -367,6 +522,10 @@ ${bold("Board:")}
   great-cto board              Open Kanban + CTO Dashboard at localhost:3141
   great-cto board --port 4000  Use a different port
   great-cto board --no-open    Start server without opening browser
+  great-cto board ensure       Start only if not already running (idempotent; for cron/hooks)
+  great-cto board install-daemon    Keep the board always on (launchd/systemd/schtasks)
+  great-cto board install-daemon --dry-run   Print the service unit without installing
+  great-cto board uninstall-daemon  Remove the always-on service
 
 ${bold("Operator console (the second surface — invite-only, hostable):")}
   great-cto console                 Serve ONLY the operator console (no dev board)
@@ -1110,7 +1269,21 @@ async function main() {
     }
     if (args.command === "board") {
         try {
-            const code = await runBoard(args);
+            const verb = args.positional[0];
+            let code;
+            if (verb === "ensure")
+                code = await runBoardEnsure(args);
+            else if (verb === "install-daemon")
+                code = await runBoardInstallDaemon(args);
+            else if (verb === "uninstall-daemon")
+                code = await runBoardUninstallDaemon(args);
+            else if (verb) {
+                error(`great-cto board: unknown subcommand '${verb}'`);
+                log(`Try: ${cyan("board")} · ${cyan("board ensure")} · ${cyan("board install-daemon")} · ${cyan("board uninstall-daemon")}`);
+                code = 2;
+            }
+            else
+                code = await runBoard(args);
             await finish(code);
         }
         catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.85.2",
+  "version": "2.86.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",