@cspeach/cli 1.1.33 → 1.1.35

package/dist/tools/sap-write.js

@@ -16,7 +16,7 @@
  *   unlock(type, name, lockHandle)                   → Promise<void>             line 1949
  *   serviceBindingPublish(name)                      → Promise<{status,error?}>  line 2658
  *   serviceBindingUnpublish(name)                    → Promise<{status,error?}>
- *   messageMaintain (STUB — not yet in sap-client)
+ *   maintainMessages({name, messages, transport?})   → Promise<MaintainMessagesResult> (0.1.19)
  *   numberRangeIntervals (STUB — not yet in sap-client)
  *
  * auditLog aliased from safety/audit-log.ts#log via sap-client/src/index.ts.
@@ -26,7 +26,7 @@ import { readFileSync } from 'node:fs';
 import { registerTool } from './index.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
 import { grantClaimMismatch, grantActivateMismatch, grantOwningTransportMismatch, grantOwningTransportDetail } from '../approvals/grant-claims.js';
-import { autoSnapshot, autoSnapshotClassInclude } from './snapshot.js';
+import { autoSnapshot, autoSnapshotClassInclude, autoSnapshotMessageClass } from './snapshot.js';
 import { includeSnapshotType } from './include-snapshot.js';
 import { buildWriteChainLine } from '../renderer/verify-chain.js';
 import { buildChangeCard } from '../renderer/change-card.js';
@@ -49,6 +49,7 @@ import { noteWriteTransport, setCurrentTransport } from '../repl/current-transpo
 import { markTransportCreatedThisSession } from './transport.js';
 import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { isSafetyConfirmEnabled } from '../repl/safety-mode-state.js';
+import { noteManualLock, noteManualUnlock } from '../sap/session-end.js';
 // ── Transcript visibility helpers (D16-display + tour slide-7, 2026-06-12) ──
 //
 // Rule 7 auto-snapshots always fired but the transcript never said so
@@ -868,7 +869,11 @@ registerTool({
                 object: result.objectName,
                 type: result.objectType,
                 package: result.packageName,
-                next_step: 'write_source_via_sap_set_source_then_activate',
+                // A message class has no source and is never activated: its messages
+                // go in through sap_message_maintain (bug 3, 2026-10-12).
+                next_step: String(result.objectType ?? '').toUpperCase() === 'MSAG'
+                    ? 'add_messages_via_sap_message_maintain (a message class has no source and no activation)'
+                    : 'write_source_via_sap_set_source_then_activate',
             }),
         };
     },
@@ -1573,6 +1578,9 @@ registerTool({
     },
     handler: async (args, ctx) => {
         const result = await ctx.adt.lock(args.type, args.name);
+        // The turn-end session close keeps the session while this lock is held.
+        if (result?.status === 'locked')
+            noteManualLock();
         return { content: JSON.stringify(result) };
     },
 });
@@ -1596,6 +1604,7 @@ registerTool({
     },
     handler: async (args, ctx) => {
         await ctx.adt.unlock(args.type, args.name, args.lockHandle);
+        noteManualUnlock();
         return { content: JSON.stringify({ status: 'ok' }) };
     },
 });
@@ -1644,34 +1653,256 @@ registerTool({
         return { content: JSON.stringify(result) };
     },
 });
-// ── sap_message_maintain (STUB) ───────────────────────────────────────────────
+// ── sap_message_maintain ──────────────────────────────────────────────────────
 //
-// STUB — MSAG message-class maintenance requires XML message-class-format
-// parsing not yet implemented in @cspeach/sap-client.
+// Signature (sap-client 0.1.19): maintainMessages({name, messages, transport?})
+//   → Promise<MaintainMessagesResult>
+// Adds or changes T100 messages in an existing message class, in one batch.
+// sap-client merges into the existing rows, locks, PUTs the whole class,
+// unlocks in a finally and READS BACK: success is `verified`, never HTTP 200.
+// Rule 7 snapshot = the class document (all messages) before the write.
+// No syntax check and no activation: a message class is not activatable.
+const MESSAGE_TEXT_MAX = 73;
+/** Same rule as sap-client's isValidMessageClassName (optional /NAMESPACE/). */
+const MESSAGE_CLASS_NAME_RE = /^(?:\/[A-Z0-9_]{1,10}\/)?[A-Z0-9_]{1,20}$/;
+/** Review M-1: a plain sentence when SAP may still hold a lock, else undefined. */
+function lockWarning(className, r) {
+    if (r.released !== false)
+        return undefined;
+    const what = (r.unlockFailures ?? []).join(', ') || 'unlock';
+    return `SAP may still hold a lock on message class ${className} (failed: ${what}). Check SM12 and remove it there, or it clears when the session ends.`;
+}
+/** The rows from the tool args (`messages`, or the single-message short form). */
+function messageRowsFromArgs(args) {
+    const list = Array.isArray(args['messages']) ? args['messages'] : [];
+    const rows = list.map((m) => ({
+        msgno: String(m?.['msgno'] ?? m?.['number'] ?? '').trim(),
+        text: typeof m?.['text'] === 'string' ? m['text'] : '',
+        ...(typeof m?.['selfExplanatory'] === 'boolean' ? { selfExplanatory: m['selfExplanatory'] } : {}),
+    }));
+    if (rows.length === 0 && args['messageNumber'] !== undefined) {
+        rows.push({
+            msgno: String(args['messageNumber']).trim(),
+            text: typeof args['messageText'] === 'string' ? args['messageText'] : '',
+        });
+    }
+    return rows;
+}
+/** Same rules as sap-client's validateMessageUpserts — checked here so a bad
+ *  request never spends the approval. A plain sentence, or null. */
+function messageRowsProblem(rows) {
+    if (rows.length === 0)
+        return 'Give at least one message to add or change.';
+    const seen = new Set();
+    for (const r of rows) {
+        if (!/^\d{3}$/.test(r.msgno))
+            return `Message number "${r.msgno}" is not valid. Use three digits, 000 to 999.`;
+        if (seen.has(r.msgno))
+            return `Message ${r.msgno} is in the request more than once.`;
+        seen.add(r.msgno);
+        if (r.text.trim().length === 0)
+            return `Message ${r.msgno} has an empty text.`;
+        const len = Array.from(r.text).length;
+        if (len > MESSAGE_TEXT_MAX)
+            return `Message ${r.msgno} is ${len} characters long. SAP allows ${MESSAGE_TEXT_MAX}.`;
+    }
+    return null;
+}
 registerTool({
     name: 'sap_message_maintain',
-    description: 'STUB — not currently implemented; do not call. '
-        + 'Maintaining MSAG message-class entries via ADT requires XML message-class-format '
-        + 'parsing not yet implemented in @cspeach/sap-client.',
+    description: 'Add or change messages in an existing message class (MSAG, the T100 texts behind SE91). '
+        + 'Create the class first with sap_create_object type MSAG. One call takes many messages. '
+        + 'Each message: msgno (three digits, 000-999) and text (up to 73 characters, &1-&4 placeholders allowed). '
+        + 'Messages not in the call are kept. No source, no syntax check, no activation. '
+        + 'The type (E, W, I, S) is not stored: it is chosen where the message is raised, e.g. MESSAGE e001(zfoo). '
+        + 'Requires approval_id.',
     isMutating: true,
     requiresSap: true,
     input_schema: {
         type: 'object',
         properties: {
-            messageClass: { type: 'string', description: 'Message class name (e.g. ZMSAG_FOO)' },
-            messageNumber: { type: 'string', description: 'Three-digit message number (e.g. 001)' },
-            messageText: { type: 'string', description: 'Message text (up to 73 characters)' },
-            messageType: { type: 'string', description: 'Message type: I, W, E, A, X, S' },
+            messageClass: { type: 'string', description: 'Message class name (e.g. ZSALES_MSG)' },
+            messages: {
+                type: 'array',
+                description: 'Messages to add or change',
+                items: {
+                    type: 'object',
+                    properties: {
+                        msgno: { type: 'string', description: 'Three-digit message number (e.g. 001)' },
+                        text: { type: 'string', description: 'Message text, up to 73 characters (e.g. "Order &1 not found")' },
+                        selfExplanatory: { type: 'boolean', description: 'Optional. New messages default to true (no long text).' },
+                    },
+                    required: ['msgno', 'text'],
+                },
+            },
+            messageNumber: { type: 'string', description: 'Short form for one message: the number (use messages for several)' },
+            messageText: { type: 'string', description: 'Short form for one message: the text' },
+            transport: { type: 'string', description: 'Transport request number (optional)' },
+            approval_id: { type: 'string', description: 'JWT from request_approval' },
         },
-        required: ['messageClass', 'messageNumber', 'messageText'],
+        required: ['messageClass', 'approval_id'],
     },
-    handler: async (_args, _ctx) => {
+    handler: async (args, ctx) => {
+        const className = String(args.messageClass ?? '').trim().toUpperCase();
+        // ── Input check — before the approval is spent ──────────────────────────
+        const rows = messageRowsFromArgs(args);
+        const problem = !className
+            ? 'Give the message class name.'
+            : !MESSAGE_CLASS_NAME_RE.test(className)
+                ? `"${String(args.messageClass)}" is not a valid message class name (letters, digits and _ only, 20 characters at most).`
+                : messageRowsProblem(rows);
+        if (problem) {
+            return { content: JSON.stringify({ error: 'invalid_messages', detail: problem }), is_error: true };
+        }
+        // ── Capability — before the approval is spent (review I-1) ──────────────
+        const adt = ctx.adt;
+        if (typeof adt.readMessageClass !== 'function' || typeof adt.maintainMessages !== 'function') {
+            return {
+                content: JSON.stringify({
+                    error: 'message_maintain_unavailable',
+                    detail: 'This CSPeach build cannot write messages yet. Update CSPeach and try again.',
+                }),
+                is_error: true,
+            };
+        }
+        const msagClient = adt;
+        // ── Gate 1: Approval ────────────────────────────────────────────────────
+        const verify = await verifyAndSpendApprovalId(args.approval_id, args.messageClass, 'modify');
+        if (!verify.ok) {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: verify.reason }),
+                is_error: true,
+            };
+        }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'MSAG', transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
+        const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
+        const startedAt = Date.now();
+        // ── Rule 9 conflict warning + 3-tier transport fallback ──────────────────
+        {
+            const sessionTransport = ctx.currentTransport?.get() ?? null;
+            if (args.transport && sessionTransport && args.transport !== sessionTransport) {
+                ctx.chunkEmitter?.emit('warn', `LLM passed transport=${args.transport} but session current-transport=${sessionTransport}`);
+            }
+        }
+        const effectiveTransport = args.transport ?? ctx.currentTransport?.get() ?? undefined;
+        const resolved = await resolveWriteTransport(ctx, 'MSAG', className, effectiveTransport);
+        // 2026-10-04 — a plan-grant id never writes into a transport other than the grant's.
+        if (grantOwningTransportMismatch(verify.payload, resolved.owning)) {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: 'transport_mismatch', detail: grantOwningTransportDetail(className, resolved.owning) }),
+                is_error: true,
+            };
+        }
+        // ── Gate 2: Snapshot (Rule 7) — HARD gate, of the whole class ────────────
+        let snapOutcome;
+        try {
+            snapOutcome = await autoSnapshotMessageClass(className, msagClient);
+        }
+        catch (err) {
+            return {
+                content: JSON.stringify({ error: ERR.SNAPSHOT_FAILED, detail: String(err) }),
+                is_error: true,
+            };
+        }
+        if (snapOutcome.reason === 'object_not_found') {
+            return {
+                content: JSON.stringify({
+                    error: 'message_class_not_found',
+                    detail: `Message class ${className} does not exist. Create it first with sap_create_object type MSAG, then add the messages.`,
+                }),
+                is_error: true,
+            };
+        }
+        if (!snapOutcome.taken) {
+            return {
+                content: JSON.stringify({
+                    error: ERR.SNAPSHOT_FAILED,
+                    reason: snapOutcome.reason ?? 'source_read_failed',
+                    detail: snapOutcome.detail,
+                    recovery: 'The message class could not be read, so no snapshot was possible and nothing was written. If this is a connection or sign-in problem, fix it and try again.',
+                }),
+                is_error: true,
+            };
+        }
+        emitSnapshotNotice(ctx, snapOutcome, 'MSAG', className);
+        // ── WAL: record pending entry ────────────────────────────────────────────
+        await appendPending(ctx.session, {
+            tool_use_id: toolUseId,
+            tool: 'sap_message_maintain',
+            args: { messageClass: className, messages: rows.map((r) => r.msgno) },
+            started_at: new Date().toISOString(),
+        });
+        // ── Write (sap-client locks, PUTs, unlocks and reads back) ───────────────
+        let result;
+        try {
+            result = await msagClient.maintainMessages({
+                name: className,
+                messages: rows,
+                ...(resolved.transport ? { transport: resolved.transport } : {}),
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            await finalizeToolCall(ctx.session, toolUseId, detail, true, Date.now() - startedAt);
+            return {
+                content: JSON.stringify({ error: 'message_maintain_failed', detail }),
+                is_error: true,
+            };
+        }
+        const lockNote = lockWarning(className, result);
+        if (lockNote)
+            ctx.chunkEmitter?.emit('warn', lockNote);
+        if (!result.verified) {
+            await finalizeToolCall(ctx.session, toolUseId, JSON.stringify(result), true, Date.now() - startedAt);
+            return {
+                content: JSON.stringify({
+                    error: 'message_maintain_failed',
+                    ...(lockNote ? { lock_warning: lockNote } : {}),
+                    detail: result.error ?? 'The messages could not be confirmed in SAP.',
+                    missing: result.missing,
+                    ...(result.httpStatus !== undefined ? { http_status: result.httpStatus } : {}),
+                    ...(result.lockedInTransport ? {
+                        locked_in_transport: result.lockedInTransport,
+                        recovery: `Retry this exact call with transport=${result.lockedInTransport} — that request already owns the message class.`,
+                    } : {}),
+                }),
+                is_error: true,
+            };
+        }
+        if (result.noChange) {
+            await finalizeToolCall(ctx.session, toolUseId, JSON.stringify({ unchanged: true }), false, Date.now() - startedAt);
+            return {
+                content: JSON.stringify({
+                    written: false,
+                    unchanged: true,
+                    message_class: className,
+                    changes: result.changes,
+                    message: `Message class ${className} already has these texts. Nothing was changed.`,
+                }),
+            };
+        }
+        // Audit only after SAP's read-back confirmed every message.
+        await auditLog('maintainMessages', 'MSAG', className, 'success', Date.now() - startedAt, result.changes.map((c) => `${c.msgno}:${c.action}`).join(' '));
+        noteWriteTransport(resolved.transport); // F-L2-1 statusline wire
+        await finalizeToolCall(ctx.session, toolUseId, JSON.stringify({ written: true, verified: true, changes: result.changes }), false, Date.now() - startedAt);
+        const written = result.changes.filter((c) => c.action !== 'unchanged').map((c) => c.msgno);
+        ctx.chunkEmitter?.emit('info', `messages ✓ ${className} ${written.join(' ')} (no activation needed)`);
+        const first = written[0] ?? rows[0].msgno;
         return {
             content: JSON.stringify({
-                error: 'not_implemented',
-                detail: 'MSAG message maintenance via ADT requires XML message-class-format parsing not yet implemented in @cspeach/sap-client',
+                written: true,
+                verified: true,
+                message_class: className,
+                changes: result.changes,
+                ...(resolved.owning ? { transport_used: resolved.owning, transport_note: resolved.note } : {}),
+                ...(lockNote ? { lock_warning: lockNote } : {}),
+                next_step: `Done — no activation needed. Raise these from code by number, e.g. MESSAGE e${first}(${className.toLowerCase()}) WITH …, or a T100 textid in an exception class. Never hard-code the texts.`,
             }),
-            is_error: true,
         };
     },
 });

package/dist/tools/snapshot.js

@@ -127,6 +127,32 @@ export async function autoSnapshotClassInclude(className, includeType, adt) {
     const entry = await snapshots.take(includeSnapshotType(includeType), className, src, 'before_write');
     return { taken: true, entry };
 }
+/**
+ * Rule-7 snapshot of a message class, taken before sap_message_maintain
+ * changes it. A message class has no source: the snapshot is the whole class
+ * document as SAP serves it (every message), stored under type MSAG.
+ *
+ *   404               → 'object_not_found' (no such class — the write cannot go ahead)
+ *   other read error  → 'source_read_failed' (+ detail) — the write is blocked
+ *   read OK           → snapshot taken
+ * A snapshots.take failure THROWS, like autoSnapshot.
+ */
+export async function autoSnapshotMessageClass(name, adt) {
+    let xml;
+    try {
+        xml = (await adt.readMessageClass(name)).xml;
+    }
+    catch (err) {
+        if (isNotFound(err))
+            return { taken: false, reason: 'object_not_found' };
+        return { taken: false, reason: 'source_read_failed', detail: shortErrorMessage(err) };
+    }
+    if (typeof xml !== 'string' || xml.length === 0) {
+        return { taken: false, reason: 'source_read_failed', detail: 'the message class read returned no document' };
+    }
+    const entry = await snapshots.take('MSAG', name.toUpperCase(), xml, 'before_write');
+    return { taken: true, entry };
+}
 // ── sap_snapshot_list ─────────────────────────────────────────────────────────
 registerTool({
     name: 'sap_snapshot_list',

package/dist/tools/tool-loading.js

@@ -1,4 +1,5 @@
 import { toAnthropicTools } from './index.js';
+import { profileForMode } from '../agent/connection-profile.js';
 /** The server-side tool search tool (probe P6: this exact name). */
 export const TOOL_SEARCH_TOOL = Object.freeze({
     type: 'tool_search_tool_regex_20251119',
@@ -105,25 +106,23 @@ export function modelAcceptsDeferredTools(model) {
     return DEFERRED_TOOL_MODELS.has(model.trim().toLowerCase().replace(/-\d{8}$/, ''));
 }
 /**
- * Mode precedence (ruling F13): AI-hub and local are always 'static' (their
- * wire has no deferred loading). Otherwise env `CSPEACH_TOOL_LOADING`
- * (`deferred` | `static`) wins; then managed uses the served value (default
- * 'static': only a proxy that serves tool_loading takes the new shapes);
- * BYOK uses the served value when it fetched one, else 'static'.
+ * Mode precedence (ruling F13), read from the connection profile since the
+ * Azure tenant mode (Task 1): 'static' profiles (AI-hub, local, azure v0) are
+ * always 'static'; otherwise env `CSPEACH_TOOL_LOADING` (`deferred` | `static`)
+ * wins; then 'served' profiles (managed, BYOK) use the served value (default
+ * 'static'); an unknown/fake mode ('env-only') stays 'static'.
  */
 export function resolveToolLoading(i) {
-    if (i.providerMode === 'ai-hub' || i.providerMode === 'local')
+    const rule = (i.profile ?? profileForMode(i.providerMode)).deferredTools;
+    if (rule === 'static')
         return 'static';
     const raw = i.env.CSPEACH_TOOL_LOADING?.trim().toLowerCase();
     if (raw === 'deferred' || raw === 'static')
         return raw;
     // Task 21 fix round (controller ruling): an old proxy serves no tool_loading
     // and adds none of the deferred-tool betas, so 'deferred' only when served.
-    if (i.providerMode === 'managed')
+    if (rule === 'served')
         return i.served ?? 'static';
-    if (i.providerMode === 'byok')
-        return i.served ?? 'static';
-    // Unknown/fake provider modes keep today's full list.
     return 'static';
 }
 /**

package/dist/ui/app.js

@@ -6,7 +6,7 @@ import { roleProps } from './role-props.js';
 import { IDLE_EXIT_WINDOW_MS } from './interrupt.js';
 import { Body } from './body.js';
 import { Footer } from './footer.js';
-import { ApprovalModal } from './approval-modal.js';
+import { ApprovalModal, estimateApprovalModalRows } from './approval-modal.js';
 import { CommandPalette } from './command-palette.js';
 import { FilePalette } from './file-palette.js';
 import { nextResolutionStep, applySlashPick } from './line-resolution.js';
@@ -15,7 +15,7 @@ import { FooterLine } from './footer-line.js';
 import { ShortcutsSheet } from './widgets/shortcuts-sheet.js';
 import { wasPasted } from '../repl/paste-marker.js';
 import { turnStatusEmitter } from './turn-status-emitter.js';
-import { pickSlotOccupant, liveBudget, SLOT_ROWS_ESTIMATE, PALETTE_ROWS } from './live-area.js';
+import { pickSlotOccupant, liveBudget, cardRowBudget, SLOT_ROWS_ESTIMATE, PALETTE_ROWS } from './live-area.js';
 import { Checklist } from './checklist.js';
 import { formatChecklist, isPlanFinished, CHECKLIST_MAX_ROWS } from '../renderer/checklist-format.js';
 import { listWorkspaceFileChoices } from '../repl/at-picker.js';
@@ -27,7 +27,7 @@ import { approvalEmitter } from './approval-emitter.js';
 import { useHoldRawMode } from './widgets/hold-raw-mode.js';
 import { SapStateContext, globalStore } from './sap-state-store.js';
 import { coachingPickerEmitter } from './coaching-picker-emitter.js';
-import { CoachingPicker } from './widgets/coaching-picker.js';
+import { CoachingPicker, estimateCoachingPickerRows } from './widgets/coaching-picker.js';
 import { askQuestionEmitter } from './ask-question-emitter.js';
 import { AskCard, estimateAskCardRows } from './widgets/ask-card.js';
 import { ConfirmCard, estimateConfirmCardRows } from './widgets/confirm-card.js';
@@ -575,14 +575,24 @@ export function App({ chunkEmitter, onSubmit, onSlashTrigger, onHistoryTrigger,
     // contributes a fixed estimate. Q2 (ask) and C1 (confirm) replace theirs
     // with a real estimator right below this line. P2 replaces `checklistRows: 0`.
     let cardRows = occupant === null ? 0 : SLOT_ROWS_ESTIMATE[occupant];
-    // Q2 — the ask card's full height (descriptions included, so shedding them
-    // cannot oscillate; spec §2 fold order: descriptions drop before options).
+    const paletteRows = lineResolution ? PALETTE_ROWS : 0;
+    // Fix round 1 (review I1): the room a card may take beside one input line.
+    const askMaxRows = cardRowBudget({ rows, paletteRows });
+    // Q2 — the ask card's height after its own folds under askMaxRows (labels
+    // to 1 row, descriptions to 1 row, then none — askCardLayout). Computed
+    // with descriptions ON, so shedding them cannot oscillate.
     if (occupant === 'ask' && askQuestionPending)
-        cardRows = estimateAskCardRows(askQuestionPending, true, uiWidth(columns));
+        cardRows = estimateAskCardRows(askQuestionPending, true, uiWidth(columns), askMaxRows);
     // C1 — the confirm card's real height (facts + choices) for the spec §2 cap.
     if (occupant === 'confirm' && confirmSlot.pending)
         cardRows = estimateConfirmCardRows(confirmSlot.pending, uiWidth(columns), rows - 6);
-    const paletteRows = lineResolution ? PALETTE_ROWS : 0;
+    // Fix batch 2026-10-12 — "Pick if:" wraps; count every row.
+    if (occupant === 'coaching' && coachingPending)
+        cardRows = estimateCoachingPickerRows(coachingPending.params, uiWidth(columns));
+    // Fix batch 2026-10-12 — the approval card's risk reasons wrap; count every
+    // row (+1: the slot's top margin).
+    if (occupant === 'approval' && pendingApproval)
+        cardRows = 1 + estimateApprovalModalRows(pendingApproval, uiWidth(columns) - 2);
     // P2 — the checklist's WANTED height (header + rows); liveBudget folds it.
     const showChecklist = todos.length > 0 && !planClosed;
     const checklistWidth = uiWidth(columns);
@@ -597,7 +607,7 @@ export function App({ chunkEmitter, onSubmit, onSlashTrigger, onHistoryTrigger,
     const budget = liveBudget({ rows, checklistRows: checklistDesiredRows, cardRows, inputLines, paletteRows });
     let slot = null;
     if (occupant === 'approval' && pendingApproval) {
-        slot = (_jsx(Box, { marginTop: 1, marginLeft: 2, children: _jsx(ApprovalModal, { change: pendingApproval.change, effectiveRisk: pendingApproval.effectiveRisk, transport: pendingApproval.transport, onApply: () => {
+        slot = (_jsx(Box, { marginTop: 1, marginLeft: 2, children: _jsx(ApprovalModal, { change: pendingApproval.change, effectiveRisk: pendingApproval.effectiveRisk, transport: pendingApproval.transport, width: uiWidth(columns) - 2, onApply: () => {
                     pendingApproval.resolve({ approved: true });
                     clearApproval(pendingApproval);
                 }, onSkip: () => {
@@ -614,7 +624,7 @@ export function App({ chunkEmitter, onSubmit, onSlashTrigger, onHistoryTrigger,
     }
     else if (occupant === 'ask' && askQuestionPending) {
         const req = askQuestionPending;
-        slot = (_jsx(AskCard, { request: req, width: uiWidth(columns), showDescriptions: budget.showDescriptions, onResolveV1: (result) => {
+        slot = (_jsx(AskCard, { request: req, width: uiWidth(columns), showDescriptions: budget.showDescriptions, maxRows: askMaxRows, onResolveV1: (result) => {
                 if (!('questions' in req))
                     req.resolve(result);
                 clearAskIfCurrent(req);

package/dist/ui/approval-modal.js

@@ -16,6 +16,35 @@ import { verbLine, viewAffordance, toSourceLines } from '../approvals/op-labels.
 import { useReclaimRawStdin } from './widgets/reclaim-raw-stdin.js';
 import { getLook } from '../renderer/look.js';
 import { roleProps, inkChip, legacyInkColor } from './role-props.js';
+import { wrapRows } from '../renderer/wrap-rows.js';
+import { uiWidth } from '../renderer/ui-width.js';
+/**
+ * Fix batch 2026-10-12 (Task 2): why the risk went up is the decision input,
+ * so the "Risk: … (raised: …)" text wraps onto up to this many rows (both
+ * looks) instead of being cut. The verb and meta rows stay one row (chrome).
+ */
+export const RISK_MAX_ROWS = 4;
+/** Border 2 + paddingX 2 on each side. */
+const MODAL_CHROME_COLS = 6;
+function riskText(effectiveRisk) {
+    const raised = shownRiskReasons(effectiveRisk.raisedBy).map(riskReasonText).join('; ');
+    return `Risk: ${effectiveRisk.level}${raised ? `  (raised: ${raised})` : ''}`;
+}
+/** The risk text as the rows it is drawn on at card width `width`. */
+export function riskRows(effectiveRisk, width) {
+    return wrapRows(riskText(effectiveRisk), Math.max(1, width - MODAL_CHROME_COLS), RISK_MAX_ROWS);
+}
+/**
+ * The collapsed card's rendered height at `width` (the live-area budget; the
+ * App adds its own one-row top margin). Panels: border 2 + paddingY 2 + verb
+ * + meta? + risk rows + gap + keys. Legacy adds the "Write approval" title and
+ * the gap under it.
+ */
+export function estimateApprovalModalRows(p, width = uiWidth()) {
+    const meta = p.change.package || p.transport ? 1 : 0;
+    const body = 1 + meta + riskRows(p.effectiveRisk, width).length + 2;
+    return 4 + body + (getLook() === 'panels' ? 0 : 2);
+}
 // Legacy look: today's literal names (bytes unchanged while colour is on).
 function riskColor(level) {
     return level === 'high' ? 'red' : level === 'medium' ? 'yellow' : 'green';
@@ -35,7 +64,8 @@ function diffLineColor(line, panels) {
 export const BACK_GUARD_MS = 300;
 /** The review view's key line, always at its bottom: how to go back and how to answer from here. */
 export const viewKeysLine = (reviewKey) => `Esc or ${reviewKey}: back · a: approve · s: skip · c: cancel turn`;
-export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSkip, onDiff, onCancel, onInterruptTurn }) {
+export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSkip, onDiff, onCancel, onInterruptTurn, width }) {
+    const cardWidth = width ?? uiWidth();
     // BUG-1 — re-assert raw mode on mount so keypresses reach useInput even
     // when an inquirer gate ran earlier in the turn (see import block).
     useReclaimRawStdin();
@@ -148,7 +178,8 @@ export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSki
             : '';
         return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: panels ? roleProps('frame').color : quiet, paddingX: 1, children: [_jsxs(Text, { bold: true, wrap: "truncate-end", children: [isDiff ? 'Diff' : aff.label, _jsx(Text, { color: quiet, children: where })] }), change.diff ? (isDiff ? (shownLines.map((line, i) => (_jsx(Text, { wrap: "truncate-end", color: diffLineColor(line, panels), children: line }, from + i)))) : (shownLines.map((line, i) => (_jsxs(Text, { wrap: "truncate-end", children: [_jsxs(Text, { color: quiet, children: [String(from + i + 1).padStart(4), "  "] }), line] }, from + i))))) : (_jsx(Text, { dimColor: true, children: "(no source provided by the model)" })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { wrap: "truncate-end", children: viewKeysLine(aff.key) }) })] }));
     }
-    const raisedLabel = shownRiskReasons(effectiveRisk.raisedBy).map(riskReasonText).join('; ');
+    // Pre-wrapped rows, never Ink soft-wrap (Wave-1 rule): every row is counted.
+    const risks = riskRows(effectiveRisk, cardWidth);
     // Meta line: Package · Transport — each segment only when genuinely known.
     // The handler resolves `transport` per op (see op-labels displayTransport:
     // create-family may fall back to the session transport because the create
@@ -170,11 +201,12 @@ export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSki
     keys.push('[s] Skip', '[c] Cancel turn');
     // Panels look — same content, keys and risk colour; restyled only. The
     // approval runs BEFORE snapshot/write/syntax check, so the card claims no
-    // step has run. Legacy return below stays byte-for-byte unchanged.
+    // step has run. (Fix batch 2026-10-12: the owner lifted the legacy byte pin
+    // for the wrapped risk rows and the fixed card width.)
     if (getLook() === 'panels') {
         const risk = roleProps(riskRole(effectiveRisk.level));
         const tag = inkChip('APPROVAL');
-        return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: risk.color, paddingX: 2, paddingY: 1, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...tag.props, children: tag.text }), _jsx(Text, { children: '  ' }), _jsx(Text, { ...(change.op === 'delete' ? roleProps('bad') : {}), bold: true, children: verb }), change.op === 'create' ? _jsx(Text, { ...roleProps('dim'), children: "  (new object)" }) : null] }), metaSegs.length > 0 && _jsx(Text, { ...roleProps('dim'), wrap: "truncate-end", children: metaSegs.join(' · ') }), _jsxs(Text, { ...risk, wrap: "truncate-end", children: ["Risk: ", effectiveRisk.level, raisedLabel ? `  (raised: ${raisedLabel})` : ''] }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...roleProps('sap', { bold: true }), children: keys[0] }), _jsx(Text, { children: '   ' + keys.slice(1).join('   ') })] }) })] }));
+        return (_jsxs(Box, { flexDirection: "column", width: cardWidth, borderStyle: "round", borderColor: risk.color, paddingX: 2, paddingY: 1, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...tag.props, children: tag.text }), _jsx(Text, { children: '  ' }), _jsx(Text, { ...(change.op === 'delete' ? roleProps('bad') : {}), bold: true, children: verb }), change.op === 'create' ? _jsx(Text, { ...roleProps('dim'), children: "  (new object)" }) : null] }), metaSegs.length > 0 && _jsx(Text, { ...roleProps('dim'), wrap: "truncate-end", children: metaSegs.join(' · ') }), risks.map((row, i) => _jsx(Text, { ...risk, wrap: "truncate-end", children: row }, `risk-${i}`)), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...roleProps('sap', { bold: true }), children: keys[0] }), _jsx(Text, { children: '   ' + keys.slice(1).join('   ') })] }) })] }));
     }
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: legacyInkColor(riskColor(effectiveRisk.level)), paddingX: 2, paddingY: 1, children: [_jsx(Text, { bold: true, children: "Write approval" }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { bold: true, color: verbColor, children: verb }), change.op === 'create' ? _jsx(Text, { dimColor: true, children: "  (new object)" }) : null] }) }), metaSegs.length > 0 && (_jsx(Text, { dimColor: true, wrap: "truncate-end", children: metaSegs.join(' · ') })), _jsxs(Text, { color: legacyInkColor(riskColor(effectiveRisk.level)), wrap: "truncate-end", children: ["Risk: ", effectiveRisk.level, raisedLabel ? `  (raised: ${raisedLabel})` : ''] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { wrap: "truncate-end", children: keys.join('   ') }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", width: cardWidth, borderStyle: "round", borderColor: legacyInkColor(riskColor(effectiveRisk.level)), paddingX: 2, paddingY: 1, children: [_jsx(Text, { bold: true, children: "Write approval" }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { bold: true, color: verbColor, children: verb }), change.op === 'create' ? _jsx(Text, { dimColor: true, children: "  (new object)" }) : null] }) }), metaSegs.length > 0 && (_jsx(Text, { dimColor: true, wrap: "truncate-end", children: metaSegs.join(' · ') })), risks.map((row, i) => (_jsx(Text, { color: legacyInkColor(riskColor(effectiveRisk.level)), wrap: "truncate-end", children: row }, `risk-${i}`))), _jsx(Box, { marginTop: 1, children: _jsx(Text, { wrap: "truncate-end", children: keys.join('   ') }) })] }));
 }

package/dist/ui/live-area.js

@@ -23,7 +23,8 @@ export const INPUT_MAX_LINES = 6;
  * occupant, fed to liveBudget as `cardRows`. They cover the collapsed card.
  * A task that owns a card with a variable height replaces its entry at the
  * App call site with a real estimator (Q2: estimateAskCardRows, C1:
- * estimateConfirmCardRows).
+ * estimateConfirmCardRows, fix batch 2026-10-12: estimateApprovalModalRows
+ * and estimateCoachingPickerRows).
  *   approval  margin 1 + border 2 + padding 2 + 3 fact rows + margin 1 + keys 1
  *   rewind    margin 1 + border 2 + title 1 + margin 1 + more 2 + REWIND_VISIBLE_ROWS 9 + margin 1 + hint 1
  *   timeline  margin 1 + border 2 + title 1 + margin 1 + more 2 + TIMELINE_VISIBLE_ROWS 9
@@ -69,3 +70,15 @@ export function liveBudget(args) {
     const inputMaxLines = Math.max(1, Math.min(Math.max(1, args.inputLines), INPUT_MAX_LINES, remaining));
     return { checklistRows, inputMaxLines, showDescriptions: remaining >= 1 };
 }
+/**
+ * Fix round 1 (review I1): the rows a card may take so the whole live area
+ * stays ≤ rows − 2 with one input line beside it — the cap less the status
+ * strip, the input border, the footer, an open palette, the checklist's one
+ * folded line and one input line. A card that can fold (AskCard) folds to
+ * fit this.
+ */
+export function cardRowBudget(args) {
+    const cap = Math.max(0, args.rows - 2);
+    const fixed = STATUS_ROWS + INPUT_BORDER_ROWS + FOOTER_ROWS + Math.max(0, args.paletteRows);
+    return Math.max(1, cap - fixed - 1 - 1);
+}