@jxsuite/studio 5.6.0 → 6.0.0

package/src/services/tool-executor.ts

@@ -1,60 +1,40 @@
 /**
- * Tool-executor.js — Agentic loop driver for the document AI assistant
+ * Tool-executor.js — the agent loop, as Studio runs it.
  *
- * Streams a chat round, executes any tool calls the model makes (via a ToolRegistry backed by
- * `transactDoc()`), feeds the results back as `tool` messages, and re-streams — up to a capped
- * number of rounds (specs/ai.md §3.2 to §3.4).
+ * The loop itself is the turn engine in `@jxsuite/ai/harness` (specs/ai.md §3.8): it streams each
+ * round, runs the calls the model made, feeds their results back, and decides how the turn ends.
+ * What stays here is Studio's side of a turn, which no other host shares:
  *
- * Two `ai.md` §3.2 honesty rules live here rather than in the panel, because they are properties of
- * the RUN and a panel can only render what the run recorded:
- *
- * - **A partial success is not a failure.** Running out of rounds called `setError`, which paints
- *   the turn red and — in `chat-state.ts` — DELETES the streaming message, so a turn that applied
- *   four edits and then hit the cap reported as an error that had also erased its own account of
- *   the four edits. The cap is now an ordinary assistant message whenever anything was applied, and
- *   an error only when nothing was. **Applied means it wrote**: a call counts when it succeeded with
- *   a summary AND the write ledger grew by an `ok` write while it ran, not merely when it returned a
- *   summary, because a read returns a summary too, and a turn that only looked around was reported
- *   as having changed things.
- * - **A turn that drew nothing says so.** A model that answered with neither text nor a tool call
- *   left the author's message sitting there with no reply at all. That turn ends on an error row,
- *   with Retry, instead.
- * - **A batch belongs to the tab it edits.** `beginBatch(getTab())` ran once, against whichever tab
- *   happened to be active when the loop started. A turn that then moved to a second document closed
- *   its batch against the FIRST tab, so the second document's edits got neither a history snapshot
- *   nor a collab publish. The loop re-anchors the batch whenever the active tab changes under it.
+ * - **The chat store is the transcript of record.** The engine's events are applied to it as they
+ *   happen (`services/harness/chat-reducer.ts`), and each round's request is projected from it, as
+ *   it always was, so the provider sees the conversation the panel shows, with whatever the send
+ *   path trimmed or sealed before the turn began.
+ * - **A batch belongs to the tab it edits** (§3.3). The undo batch opens on the active tab and is
+ *   re-anchored after every call whose tools moved to another document, so a turn that edits two
+ *   documents gives each its own history step and collab publish.
+ * - **The ledger is filed under the last message the turn drew** (§3.2), in this module's `finally`,
+ *   so the transcript draws the turn's changed-files summary under it.
  *
  * @license MIT
  */
 
 import type { createChatState } from "@jxsuite/ai/chat-state";
+import { DEFAULT_TURN_POLICY, runTurn } from "@jxsuite/ai/harness";
+import type { TurnRun } from "@jxsuite/ai/harness";
+import { toChatMessages, toOpenAITools } from "@jxsuite/ai/messages";
 import type { StreamingClient } from "@jxsuite/ai/streaming-client";
-import { createSessionFacts, createToolContext, linkCallSignal } from "@jxsuite/ai/tools";
-import type { Actor, SessionFacts, ToolRegistry } from "@jxsuite/ai/tools";
+import { createSessionFacts } from "@jxsuite/ai/tools";
+import type { SessionFacts, ToolRegistry } from "@jxsuite/ai/tools";
 
 import type { Tab } from "../tabs/tab";
-import type { ImportProgressEvent } from "../types";
 import { batchTab, beginBatch, endBatch } from "../tabs/transact";
-import { ensureProxyProbe, resetModelCache } from "./ai-models";
 import { estimatePromptTokens } from "./context-manager";
 import { fileTurn, openTurnLedger, turnAnchor } from "./ai-writes";
-import { recordImportProgress } from "./import-run";
-
-const MAX_ROUNDS = 5;
+import { applyHarnessEvent } from "./harness/chat-reducer";
+import { studioTurnHooks } from "./harness/turn-hooks";
 
 /** What a turn that drew nothing says: the model answered with neither text nor a tool call. */
-export const EMPTY_TURN_TEXT = "The model sent back an empty reply.";
-
-/**
- * Hard ceiling on rounds of every kind, so the loop terminates whatever the model does.
- *
- * {@link MAX_ROUNDS} bounds AUTONOMOUS work, and a round that ends by blocking on a person is the
- * opposite of runaway — it cannot advance without them, which is the property the cap was ever a
- * proxy for. So an interactive round does not spend that budget. This one is the backstop that
- * keeps `runAgentLoop` provably terminating anyway; a human answering ten questions will have
- * stopped it long before.
- */
-const MAX_TOTAL_ROUNDS = 25;
+export const EMPTY_TURN_TEXT = DEFAULT_TURN_POLICY.emptyText;
 
 interface RunAgentLoopOptions {
   chatState: ReturnType<typeof createChatState>;
@@ -80,35 +60,15 @@ export async function runAgentLoop({
   getTab,
   session = createSessionFacts(),
 }: RunAgentLoopOptions): Promise<void> {
-  const allErrors: string[] = [];
-  const appliedSummaries: string[] = [];
-
   /* The ledger is filed under the turn's last DRAWN assistant message (see services/ai-writes), so
      the scan starts at the message this turn answers. */
   const turnUserId = chatState.messages.findLast((m) => m.role === "user")?.id;
-  /* What every call's context carries (specs/ai.md §3.7): this turn's ledger, the conversation's
-     facts, and who the calls act as. The signal and the call id are the call's own, below. */
   const ledger = openTurnLedger(`turn:${chatState.messages.length}`);
-  const actor: Actor = {
-    id: `assistant:${session.sessionId ?? "local"}:${ledger.turnId}`,
-    kind: "assistant",
-    model: chatState.model,
-    sessionId: session.sessionId,
-    turnId: ledger.turnId,
-  };
 
   // Batch all tool-call mutations into a single undo step, anchored on the tab being edited.
   if (getTab) {
     beginBatch(getTab());
   }
-
-  /**
-   * Close the batch and re-open it when the tools have moved to a different document.
-   *
-   * Runs after every tool execution rather than only inside `open_document`, because a tool is not
-   * the only thing that can change the active tab: project adoption replaces every tab in the
-   * workspace, and the user is free to click another tab while the model is still streaming.
-   */
   const reanchorBatch = () => {
     if (!getTab) {
       return;
@@ -120,237 +80,58 @@ export async function runAgentLoop({
     }
   };
 
+  /* The placeholder `sendMessage` pushed is round one's message, so the turn answers into it; the
+     conversation the turn continues is everything before it. */
+  const last = chatState.messages.at(-1);
+  const placeholder =
+    chatState.status === "streaming" && last?.role === "assistant" ? last : undefined;
+  const history = toChatMessages(
+    placeholder ? chatState.messages.slice(0, -1) : chatState.messages,
+  );
+
+  /* Once another chat has replaced the one this turn answers, nothing more of the turn is written
+     into the transcript: its events belong to a conversation that is no longer on screen. */
+  let superseded = false;
+  let run: TurnRun | undefined;
   try {
-    /* Rounds that DID something, which is what MAX_ROUNDS bounds — see MAX_TOTAL_ROUNDS. */
-    let workRounds = 0;
-    for (let round = 1; round <= MAX_TOTAL_ROUNDS && workRounds < MAX_ROUNDS; round++) {
-      const messages = chatState.toMessagesArray();
-      const tools = toolRegistry.listForLLM();
-
-      const toolCalls = new Map<string, { name: string; arguments: string }>();
-      let stopReason = "stop";
-      let streamError = null;
-      let streamErrorCode: string | undefined;
-
-      for await (const event of streamingClient.streamChat(
-        messages,
-        tools,
-        systemPrompt,
-        signal as AbortSignal,
-      )) {
-        switch (event.type) {
-          case "delta": {
-            chatState.appendDelta(event.content);
-            break;
-          }
-          case "reasoning": {
-            /* Kept on the turn, not shown as answer text — the next round has to replay it (see
-               chat-state's toMessagesArray). */
-            chatState.appendReasoning(event.content);
-            break;
-          }
-          case "tool_call_start": {
-            chatState.appendToolCallStart(event.id, event.name);
-            toolCalls.set(event.id, { name: event.name, arguments: "" });
-            break;
-          }
-          case "tool_call_delta": {
-            chatState.appendToolCallDelta(event.id, event.args);
-            const tc = toolCalls.get(event.id);
-            if (tc) {
-              tc.arguments += event.args;
-            }
-            break;
-          }
-          case "tool_call_end": {
-            chatState.appendToolCallEnd(event.id);
-            break;
-          }
-          case "usage": {
-            /* The provider's own count replaces the four-characters-per-token estimate. The prompt
-               it covered is recorded with it, because the next send rebuilds the prompt. */
-            chatState.recordUsage(event, { systemTokens: estimatePromptTokens(systemPrompt) });
-            break;
-          }
-          case "done": {
-            ({ stopReason } = event);
-            break;
-          }
-          case "error": {
-            streamError = event.message;
-            streamErrorCode = event.code;
-            break;
-          }
-          default: {
-            break;
-          }
-        }
-      }
-
-      if (streamError) {
-        /* A lapsed hosted grant is the one stream error that makes the app's OWN reading wrong.
-           The probe settles once at boot, so without this every gate keeps offering an assistant
-           that cannot answer, and the send that just failed is the only evidence anyone has. Drop
-           the reading and re-probe, so the next paint carries the Reconnect CTA instead. */
-        if (streamErrorCode === "cf_reconnect_required") {
-          resetModelCache();
-          ensureProxyProbe();
-        }
-        /* `setError` alone, never after `finishStream`: it removes the round's partial message,
-           and only while that message is still the streaming one. Finishing first let go of it, so
-           the partial (a tool call cut off mid-arguments, as often as not) stayed in the
-           transcript and went out on the next send. */
-        chatState.setError(streamError);
-        return;
-      }
-
-      /* A turn that has drawn nothing by the end of a round with no calls ends here, as an error
-         the author can see and retry, rather than as silence under their message. `setError`
-         before `finishStream`, so it removes the empty reply. A stopped round is not empty: the
-         author ended it. */
-      const stopped = stopReason === "cancelled" || signal?.aborted === true;
-      if (toolCalls.size === 0 && !stopped && turnAnchor(chatState.messages, turnUserId) === null) {
-        chatState.setError(EMPTY_TURN_TEXT);
-        return;
-      }
-
-      chatState.finishStream(stopReason);
-
-      /* The calls the model streamed decide whether tools run, not the finish reason the provider
-         reported beside them. Some OpenAI-compatible backends (Workers AI among them) end a
-         tool-calling turn with `finish_reason: "stop"`, and gating on `tool_calls` dropped those
-         calls unrun — the turn ended looking finished, and the next send sealed them as failures.
-         A call cut off by `length` still runs: its arguments fail to parse, and the model reads
-         that as a tool error it can correct.
-
-         Cancellation is the exception, and it is not a finish reason at all: it is the author
-         pressing Stop. A stopped round runs nothing it streamed, including calls whose arguments
-         were already complete, because Stop is the one control that must not be outrun. */
-      if (toolCalls.size === 0 || stopReason === "cancelled" || signal?.aborted) {
-        return;
-      }
-
-      let didWork = false;
-      for (const [id, call] of toolCalls) {
-        /* A Stop that lands between calls (while `ask_user` waits, or during a long import) stops
-           the calls after it too. They stay unanswered, and the send path seals them. */
-        if (signal?.aborted) {
-          return;
+    run = runTurn({
+      history,
+      system: [{ text: systemPrompt }],
+      /* Projected from the chat store, the transcript of record. The streaming client is read on
+         every round, and the turn's own signal is the host's, so a request is the one it was. */
+      model: (request) =>
+        streamingClient.streamChat(
+          chatState.toMessagesArray(),
+          toOpenAITools(request.tools),
+          systemPrompt,
+          signal as AbortSignal,
+        ),
+      modelInfo: { family: "openai-compat", model: chatState.model },
+      tools: toolRegistry,
+      ...(signal ? { signal } : {}),
+      turnId: ledger.turnId,
+      ...(placeholder ? { firstMessageId: placeholder.id } : {}),
+      policy: { estimateTokens: estimatePromptTokens },
+      hooks: studioTurnHooks({
+        superseded: () =>
+          turnUserId !== undefined && !chatState.messages.some((m) => m.id === turnUserId),
+        onSuperseded: () => {
+          superseded = true;
+          run?.cancel("superseded");
+        },
+        reanchor: reanchorBatch,
+      }),
+      session,
+      ledger,
+      onEvent: (event) => {
+        if (!superseded) {
+          applyHarnessEvent(chatState, event);
         }
-        let result;
-        // The ledger's length before the call, so the call can be judged by what it recorded.
-        const writesBefore = ledger.writes.length;
-        /* The call's own signal: it aborts with the turn, so a tool waiting on a person or a crawl
-           learns of a Stop, and it is unlinked once the call settles, so a Stop later in the turn
-           reaches nothing that has already finished. */
-        const link = signal ? linkCallSignal(signal) : null;
-        const ctx = createToolContext({
-          actor,
-          callId: id,
-          ledger,
-          progress: (event) => {
-            recordImportProgress(id, event as unknown as ImportProgressEvent);
-          },
-          session,
-          ...(link ? { signal: link.signal } : {}),
-        });
-        try {
-          result = await toolRegistry.execute(call.name, parseToolArguments(call.arguments), ctx);
-        } catch (error) {
-          result = {
-            success: false,
-            error: `Failed to parse arguments: ${(error as Error).message}`,
-          };
-        } finally {
-          link?.release();
-        }
-        /* The transcript was replaced while the call ran: another chat was opened from Chat
-           History, which stops the turn. The reply belongs to a request that is no longer there,
-           so writing it would land a stray `tool` message in the other conversation, and could
-           overwrite a restored record's result where a provider reuses call ids. */
-        if (turnUserId !== undefined && !chatState.messages.some((m) => m.id === turnUserId)) {
-          return;
-        }
-        // A call that suspends the turn on a person does not spend its work budget.
-        if (toolRegistry.getDefinition(call.name)?.interactive !== true) {
-          didWork = true;
-        }
-        reanchorBatch();
-        if (!result.success && result.error) {
-          allErrors.push(result.error);
-        }
-        const wrote = ledger.writes.slice(writesBefore).some((write) => write.ok);
-        if (result.success && result.summary && wrote) {
-          appliedSummaries.push(result.summary);
-        }
-        chatState.appendToolResult(id, result);
-        chatState.pushToolResultMessage(id, JSON.stringify(result));
-      }
-
-      if (didWork) {
-        workRounds += 1;
-      }
-      /* A Stop that landed during the round's last call. Nothing is left to stop in this round, so
-         without this the loop opened the next one: a placeholder pushed after the author stopped,
-         and a request streamed on the aborted signal. */
-      if (signal?.aborted) {
-        return;
-      }
-      if (workRounds < MAX_ROUNDS && round < MAX_TOTAL_ROUNDS) {
-        chatState.beginAssistantTurn();
-      }
-    }
-
-    /*
-     * The round cap. Surface the actual errors so the user knows what went wrong, not just a
-     * generic "I couldn't do it" — and, when anything was applied, say it as the ASSISTANT rather
-     * than as a failure (`ai.md` §3.2). A partial success is not a failure.
-     */
-    const uniqueErrors = [...new Set(allErrors)];
-    const applied =
-      appliedSummaries.length > 0
-        ? `\n\nChanges applied so far:\n${appliedSummaries.map((s) => `- ${s}`).join("\n")}`
-        : "";
-    const errors =
-      uniqueErrors.length > 0
-        ? `\n\nErrors encountered:\n${uniqueErrors.map((e) => `- ${e}`).join("\n")}`
-        : "";
-    const tail =
-      `I ran out of tool-call rounds (${MAX_ROUNDS}) before finishing.${applied}${errors}` +
-      `\n\nYou can continue by sending another message, or try a more specific request.`;
-    if (appliedSummaries.length > 0) {
-      chatState.beginAssistantTurn();
-      chatState.appendDelta(tail);
-      chatState.finishStream("length");
-      return;
-    }
-    chatState.setError(tail);
+      },
+    });
+    await run.outcome;
   } finally {
     endBatch();
     fileTurn(turnAnchor(chatState.messages, turnUserId) ?? "", ledger.writes);
   }
 }
-
-/**
- * A call's arguments as the object a tool takes.
- *
- * An empty string is no arguments. JSON that parses to something other than an object (`null`, an
- * array, a number) is refused here with its own sentence, rather than reaching the registry, where
- * a validator reading a property of `null` threw a message about the validator. The prefix is the
- * one a JSON syntax error already carries, so the model reads both as one kind of mistake.
- *
- * @param {string} text - The call's accumulated argument text
- * @returns {object}
- * @throws {SyntaxError | TypeError} Caught by the loop and returned to the model as a tool error
- */
-function parseToolArguments(text: string): object {
-  if (!text) {
-    return {};
-  }
-  const parsed = JSON.parse(text) as unknown;
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    const type = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
-    throw new TypeError(`arguments must be a JSON object, got ${type}`);
-  }
-  return parsed;
-}

package/src/services/tool-outcomes.ts

@@ -4,27 +4,29 @@
  * A tool call's outcome is recorded twice while a turn runs: as the `result` on its
  * `ToolCallRecord`, which the chip renders, and as the `tool` message that answers it, which the
  * provider reads. The second is the one that must survive, because it is the one the wire carries,
- * and it is the one that always did: until the turn became accountable (specs/ai.md §3.2) the first was never populated for a
- * finished call (the loop looked for the record after closing the stream), so every persisted
- * `result` was `null`: every restored chip rendered as still pending, and an answered question as
- * one still open (specs/ai.md §3.4).
+ * and it is the one that always did: until the turn became accountable (specs/ai.md §3.2) the first
+ * was never populated for a finished call (the loop looked for the record after closing the
+ * stream), so every persisted `result` was `null`: every restored chip rendered as still pending,
+ * and an answered question as one still open (specs/ai.md §3.4).
  *
  * So the tool message is the single source. A save strips `result` from every record, which keeps
  * the payload free of a second, disagreeing copy; a restore backfills each record from the reply
- * that answers it. A question nothing answered keeps no result, which is what makes it render
- * inert rather than as one still waiting; an ordinary call nothing answered never completed, and
- * says so.
+ * that answers it. A question nothing answered keeps no result, which is what makes it render inert
+ * rather than as one still waiting; an ordinary call nothing answered never completed, and says
+ * so.
  *
  * **A seal is not an answer.** When a question was left open, the send path seals its request with
  * a synthesized failure so the wire stays well-formed (`pruneOrphanToolMessages`). For an ordinary
  * call that failure IS the outcome to show: it never completed. For a question it is the absence of
  * an answer, so a restore leaves it without a result, and the chip draws the inert "still open when
- * the session was reloaded" card rather than a failure.
+ * the session was reloaded" card rather than a failure. Either seal counts, the one for a call that
+ * was cut off mid-arguments as well (`isSealContent`).
  *
- * @docs studio/ai/chat
  * @license MIT
+ * @docs studio/ai/chat
  */
 
+import { isSealContent } from "@jxsuite/ai/messages";
 import type { ToolResult } from "@jxsuite/ai/tools";
 import type { PersistedMessage } from "./ai-session-store";
 import { UNANSWERED_TOOL_RESULT } from "./context-manager";
@@ -114,7 +116,7 @@ export function backfillToolResults(messages: readonly PersistedMessage[]): Pers
       const result = parseToolResult(reply.content);
       if (typeof reply.toolCallId === "string" && result && !replies.has(reply.toolCallId)) {
         replies.set(reply.toolCallId, result);
-        if (reply.content === UNANSWERED_TOOL_RESULT) {
+        if (isSealContent(reply.content)) {
           sealed.add(reply.toolCallId);
         }
       }

package/src/studio.ts

@@ -94,7 +94,6 @@ import { runInsertZoneAction } from "./editor/insert-zone-action";
 import { canvasSlashHandler } from "./editor/canvas-slash-bridge";
 import { makeCanvasContextMenuHandler } from "./editor/canvas-context-menu";
 import { mountStatusbar, renderStatusbar } from "./surfaces/statusbar";
-import { mountJumpBar } from "./panels/jump-bar";
 import { cellForPane, paneGridReady } from "./panels/pane-grid";
 import { notify } from "./services/notify";
 import { createLiveSurfaceSaver } from "./services/live-surfaces";
@@ -916,11 +915,9 @@ registerRenderer("seoModal", renderSeoModal);
 registerRenderer("chatPanel", () => chatPanelMod.render());
 registerRenderer("overlays", () => overlaysPanel.render());
 renderStatusbar();
+// The status bar mounts the jump bar too: the focused pane's breadcrumb trail is its DOCUMENT
+// Field, and the only breadcrumb in the shell.
 mountStatusbar();
-// The jump bar, in the pane's own grid cell above the context bar. It renders the whole address
-// — project › file › node › node — and it is the only breadcrumb in the shell: the pane context
-// Bar drew a second one, and it named a sub-document stack nothing could push onto.
-mountJumpBar(primaryCell?.jump ?? document.createElement("div"));
 mountActivityBar();
 
 /* The background-click deselect moved into `editor/shortcuts.ts`'s `installStageGestures`, beside

package/src/surfaces/block-action-bar.json

@@ -423,7 +423,12 @@
                           "body": [
                             {
                               "stopPropagation": true
-                            },
+                            }
+                          ]
+                        },
+                        "onchange": {
+                          "$prototype": "Function",
+                          "body": [
                             {
                               "operator": "call",
                               "target": {

package/src/surfaces/jump-bar.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://jxsuite.com/schema/v1",
   "$id": "StudioJumpBar",
-  "$description": "The jump bar: one pane's address, outermost step first, every step a command the adapter has already resolved against the registry. A step is a button when its command can run and a readout when it cannot — an address with a hole in it is a lie about containment, so a step never disappears. A step with more than one place to go carries the chevron that opens its siblings; one alternative is not a choice and draws no control. Nothing here decides what the bar says, which step is where you are, or what a chevron opens.",
+  "$description": "The jump bar: the focused pane's address as a breadcrumb trail, the document first and the selected element last, every step a command the adapter has already resolved against the registry. It is the status bar's DOCUMENT field, mounted into the slot `surfaces/statusbar.json` leaves for it. A step is a button when its command can run and a readout when it cannot — an address with a hole in it is a lie about containment, so a step never disappears. A step with more than one place to go carries the chevron that opens its siblings, upward, because the bar is the window's floor; one alternative is not a choice and draws no control. Nothing here decides what the bar says, which step is where you are, or what a chevron opens.",
   "tagName": "nav",
   "attributes": {
     "part": "bar",
@@ -10,22 +10,18 @@
     "hidden": "${state.empty ? '' : null}"
   },
   "style": {
-    "$description": "The `.jump-bar` rules the bar used to take from `styles/shell.css`, brought here and re-valued onto the kit's own layer. It scrolls rather than wraps — a deep selection must not push the stage down by a second line — and the overflow is taken at the START, because the leaf is the part being read. The height is the one number this file shares with its adapter: the stage's `--jump-bar-h` offset must be the box this rule draws.",
+    "$description": "A field of the status bar, so it takes the bar's own row, font and colour rather than drawing a band of its own. It scrolls rather than wraps, because a deep selection must not grow the status bar a second line.",
     "display": "flex",
     "alignItems": "center",
     "gap": "1px",
-    "height": "24px",
-    "padding": "0 var(--jx-space-3)",
+    "flex": "1",
+    "height": "100%",
+    "padding": "0 var(--jx-space-2)",
     "minWidth": "0",
     "overflowX": "auto",
     "scrollbarWidth": "none",
     "whiteSpace": "nowrap",
     "boxSizing": "border-box",
-    "fontFamily": "var(--jx-font-sans)",
-    "fontSize": "var(--jx-text-xs)",
-    "color": "var(--jx-fg-dim)",
-    "background": "var(--jx-bg-panel)",
-    "borderBottom": "1px solid var(--jx-border)",
     "&[hidden]": {
       "display": "none"
     },
@@ -44,7 +40,7 @@
       "opacity": "0.6"
     },
     "& [part=\"crumb\"]": {
-      "maxWidth": "28ch",
+      "maxWidth": "32ch",
       "overflow": "hidden",
       "margin": "0",
       "padding": "0 var(--jx-space-2)",
@@ -74,7 +70,8 @@
     },
     "& [part=\"crumb\"][aria-current]": {
       "$description": "Where you ARE is stated by weight, not by taking the control away: the leaf still selects, which is how a stray click in the canvas is undone without leaving the bar.",
-      "color": "var(--jx-fg)"
+      "color": "var(--jx-fg)",
+      "fontWeight": "600"
     },
     "& span[part=\"crumb\"]": {
       "$description": "A step with no runnable command is a readout, not a dead button. No hover, no pointer, no promise.",
@@ -213,7 +210,7 @@
                   "aria-label": "${$map.item.altsLabel}",
                   "title": "${$map.item.altsLabel}"
                 },
-                "textContent": "⌄",
+                "textContent": "⌃",
                 "onclick": {
                   "$prototype": "Function",
                   "body": [

package/src/surfaces/jump-bar.ts

@@ -4,19 +4,18 @@
  *
  * `jump-bar.json` is the markup, the ARIA and the style; `panels/jump-bar.ts` is the flow — which
  * pane this bar is about, what its address is, which of its steps the registry can actually run,
- * and what a chevron opens. This module is the seam between them: one scope per pane, one document
- * mounted into that pane's cell, and an `update()` that ASSIGNS rather than re-mounts.
+ * and what a chevron opens. This module is the seam between them: one scope, one document mounted
+ * into the slot the status bar leaves for it, and an `update()` that ASSIGNS rather than
+ * re-mounts.
  *
- * **One mount per pane, not one per bar.** Two cells draw two addresses, so `attachJumpBarHost`
- * hands this module a host per pane and gets a handle back. The scope is reactive, so a repaint is
- * an assignment to `segments` and the keyed `$map` reconciles: a step whose key survives keeps its
- * node, and the chevron the reader is aiming at does not move under them.
+ * The scope is reactive, so a repaint is an assignment to `segments` and the keyed `$map`
+ * reconciles: a step whose key survives keeps its node, and the chevron the reader is aiming at
+ * does not move under them.
  *
- * **The bar hides rather than un-mounts when a pane has no address.** A pane with no tab open has
- * no address to print, and the document's own `hidden` is what takes it off the screen — the mount
- * stays, because the next tab open is one assignment away and re-mounting would cost a frame of
- * blank chrome. The stage's `--jump-bar-h` offset is written by the flow, which is the one number
- * this surface and its stylesheet-free document share.
+ * **The bar hides rather than un-mounts when there is no address.** With no tab open there is
+ * nothing to print, and the document's own `hidden` takes it off the screen — the mount stays,
+ * because the next tab open is one assignment away and re-mounting would cost a frame of blank
+ * chrome.
  *
  * @docs studio/interface
  */
@@ -81,13 +80,13 @@ interface JumpBarScope extends Record<string, unknown>, JumpBarActions {
 }
 
 /**
- * Mount one pane's bar into the host its cell built for it.
+ * Mount the bar into the slot the status bar built for it.
  *
- * The host is CLEARED first: a cell hands the bar a slot of its own, and whatever was in it belongs
- * to a pane this bar is no longer drawing.
+ * The host is CLEARED first: the slot is the bar's own, and whatever was in it belongs to a mount
+ * this bar is no longer drawing.
  *
- * @param {HTMLElement} host The cell's slot for the bar.
- * @param {string} region The `data-jx-region` the bar stamps on itself — `pane.<id>/jump`.
+ * @param {HTMLElement} host The status bar's slot for the bar.
+ * @param {string} region The `data-jx-region` the bar stamps on itself — `statusbar/document`.
  * @param {JumpBarActions} actions What a press does. Read once, when the scope is made.
  * @returns {JumpBarSurface}
  */

package/src/surfaces/pane-context.json

@@ -497,7 +497,7 @@
                                       "$ref": "#/state/previewHint"
                                     }
                                   },
-                                  "onclick": {
+                                  "onchange": {
                                     "$prototype": "Function",
                                     "body": [
                                       {
@@ -1227,7 +1227,7 @@
                                 "$ref": "$map/item/hint"
                               }
                             },
-                            "onclick": {
+                            "onchange": {
                               "$prototype": "Function",
                               "body": [
                                 {