@promptctl/cc-candybar 1.38.0 → 1.40.0

package/src/config/loader/menu-synth.ts

@@ -42,6 +42,7 @@ import {
   type MenuOptions,
 } from "../menu-keys.js";
 import {
+  cycleDisplayIssue,
   DISCLOSURE_CLOSED,
   disclosureCycleAction,
   disclosureStateVar,
@@ -60,13 +61,16 @@ import { reservedNamespaceCollisions } from "./reserved-namespace.js";
 const MENU_FUNC = "menu";
 
 // [LAW:types-are-the-program] The `{{ menu }}` surface, mirroring the render
-// helper's signature `menu "apply" [(dict …)]`: the apply name (identity member,
-// a required string literal) and ONE optional trailing options dict —
-// closeOnPick / paged / key, all statically readable via `staticDictEntries`.
-// The removed positional tail (page-action string, bare bools, 5th-arg key) is
-// detected and rejected with a migration-pointing error, never silently
+// helper's signature `menu "apply" display… [(dict …)]`: the apply name
+// (identity member, a required string literal), the trigger's authored display
+// text (one per state or one static — the arity is statically countable, so it
+// is checked here), and ONE optional trailing options dict — closeOnPick /
+// paged / key, all statically readable via `staticDictEntries`. Displays
+// themselves are NOT required to be literals; identity does not depend on
+// them, exactly as a cycle `{{ action }}`'s displays are free. Every removed
+// spelling is rejected with a migration-pointing error, never silently
 // reinterpreted [LAW:no-silent-failure].
-const MIGRATION = `the positional tail ("pageAction" closeOnPick paged "key") was removed: the page cursor is now synthesized from the menu's identity, and rare knobs are named options in ONE trailing dict — write {{ menu "applyTheme" }} or {{ menu "applyTheme" (dict "closeOnPick" true "paged" false "key" "pickers") }} (defaults: closeOnPick false, paged true, no key)`;
+const MIGRATION = `a menu binds its trigger text the way a cycle action binds a display — write {{ menu "applyTheme" "▸" "▾" }} (one per state) or {{ menu "insertHere" "+" }} (one static display for both), with the rare knobs in ONE trailing dict: {{ menu "applyTheme" "▸" "▾" (dict "closeOnPick" true "paged" false "key" "pickers") }} (defaults: closeOnPick false, paged true, no key). The renderer no longer appends ▸/▾ of its own (candybar-settings-ui-aok.4), and the older positional tail ("pageAction" closeOnPick paged "key") was removed — the page cursor is synthesized from the menu's identity`;
 
 // [LAW:dataflow-not-control-flow] One total analysis of a `{{ menu }}` call site:
 // every reachable argument shape lands in exactly one arm — a usable identity
@@ -80,33 +84,80 @@ type MenuAnalysis =
     }
   | { readonly kind: "issue"; readonly message: string };
 
+type ArgExpr = ReferencedCall["argExprs"][number];
+
+const isDictCall = (e: ArgExpr): boolean =>
+  e.kind === "call" && e.name === "dict";
+
+// [LAW:one-source-of-truth] The two sides split the tail on different evidence —
+// exprs here, evaluated values in `parseMenuArgs` — so the loader admits only
+// call sites where those two readings PROVABLY coincide. The renderer's split
+// asks one question of the last value, "is it an object", so a literal answers
+// it here: a parse-time constant evaluates to itself and can never become the
+// options dict. A literal `(dict …)` always does. Everything else in that slot
+// is classified by whatever it happens to evaluate to.
+const isNonObjectLiteral = (e: ArgExpr): boolean =>
+  e.kind === "literal" && typeof e.value !== "object";
+
+// The display-arity rule used as a predicate; the message is the caller's
+// business, so the subject never surfaces. [LAW:single-enforcer] — legality is
+// read off the disclosure primitive, never restated as a count comparison.
+const legalDisplayCount = (count: number): boolean =>
+  cycleDisplayIssue("", count, 2) === undefined;
+
 function analyzeMenuCall(call: ReferencedCall): MenuAnalysis {
   const issue = (message: string): MenuAnalysis => ({ kind: "issue", message });
-  const [applyArg, optsArg] = call.argExprs;
+  const [applyArg, ...tail] = call.argExprs;
   if (applyArg === undefined) {
     return issue(
-      `with no arguments — it takes an apply-action name (e.g. {{ menu "applyTheme" }})`,
+      `with no arguments — it takes an apply-action name and its trigger text (e.g. {{ menu "applyTheme" "▸" "▾" }})`,
     );
   }
-  if (call.argExprs.length > 2) {
-    return issue(`with more than two arguments — ${MIGRATION}`);
-  }
   if (applyArg.kind !== "literal" || typeof applyArg.value !== "string") {
     return issue(
-      `whose apply action is not a string literal — a menu's identity is its apply-action name, which must be a literal so it can be gated at load (e.g. {{ menu "applyTheme" }})`,
+      `whose apply action is not a string literal — a menu's identity is its apply-action name, which must be a literal so it can be gated at load (e.g. {{ menu "applyTheme" "▸" "▾" }})`,
+    );
+  }
+  // [LAW:types-are-the-program] The dict is the LAST argument when present;
+  // everything before it is a display. Splitting on that one position is the
+  // whole grammar, and it is the same split `parseMenuArgs` performs on the
+  // evaluated tail at render — one shape, read twice from the two things each
+  // side has (exprs here, values there).
+  const last = tail[tail.length - 1];
+  const optsArg = last !== undefined && isDictCall(last) ? last : undefined;
+  const displays = optsArg === undefined ? tail : tail.slice(0, -1);
+  if (displays.some(isDictCall)) {
+    return issue(
+      `whose options (dict …) is not its last argument — ${MIGRATION}`,
     );
   }
+  // [LAW:no-silent-failure] The last slot is the one both readings can claim.
+  // When the expr there is not provably one or the other AND dropping it still
+  // leaves a legal display count, the renderer's value-based split can land on
+  // a DIFFERENT reading than this one — same call, two shapes, no error either
+  // side: the options dict skips `staticDictEntries` (so a dynamic `key` derives
+  // a state key with no synthesized var behind it, and the menu never opens) or
+  // a display vanishes into the static form. Reject that call site; an explicit
+  // trailing `(dict …)` disambiguates it and keeps dynamic displays legal.
+  // Where the alternate reading is an ILLEGAL count the renderer throws instead
+  // of diverging, so it stays accepted — loudness, not refusal, is the bar.
   if (
-    optsArg !== undefined &&
-    (optsArg.kind !== "call" || optsArg.name !== "dict")
+    last !== undefined &&
+    optsArg === undefined &&
+    !isNonObjectLiteral(last) &&
+    legalDisplayCount(displays.length - 1)
   ) {
-    // A literal (the old page-action string / positional bool), a dynamic value,
-    // or a non-dict call: none is an options dict — one migration error covers
-    // the whole family [LAW:one-type-per-behavior].
     return issue(
-      `whose second argument is not an options (dict …) — ${MIGRATION}`,
+      `whose last argument is neither a literal nor a literal (dict …) — the renderer tells a display from the options dict by the value it evaluates to, so this call could be read as ${displays.length} displays or as ${displays.length - 1} plus options, and both are legal. Make the options explicit as a trailing (dict …) — {{ menu "${applyArg.value}" (printf "…") (printf "…") (dict) }} binds dynamic displays unambiguously — or bind the trigger text as literals`,
     );
   }
+  // [LAW:single-enforcer] The display-arity rule is the disclosure primitive's,
+  // the same one the renderer picks through — checked HERE too because the
+  // count is statically known, so an unauthored trigger is a load error naming
+  // the fix rather than a diagnostic glyph on the next render.
+  // "whose trigger …" completes the caller's `segment "X" has a {{ menu }} `.
+  const arity = cycleDisplayIssue("whose trigger", displays.length, 2);
+  if (arity !== undefined) return issue(`${arity} — ${MIGRATION}`);
   const entries = optsArg === undefined ? {} : staticDictEntries(optsArg);
   if (entries === null) {
     return issue(

package/src/config/loader/merge.ts

@@ -53,6 +53,12 @@ export function mergeWithDefault(
     // (incl. the "default" empty-fragment floor effectivePresetName collapses
     // to) survives every merge by construction, exactly as looks' "none" does.
     presets: { ...dflt.presets, ...(raw.presets ?? {}) },
+    // [LAW:one-source-of-truth] editGlobals merges FIELD by field — the
+    // `globals` cascade above, not the by-name cascades around it, because it
+    // IS a globals fragment: a user retuning edit mode's separator says nothing
+    // about its `style`, exactly as a user setting `globals.padding` says
+    // nothing about `globals.charset`.
+    editGlobals: { ...dflt.editGlobals, ...(raw.editGlobals ?? {}) },
     // [LAW:one-source-of-truth] helpers merge by name, same cascade — a user
     // overrides one formatter helper by re-declaring its name; the rest inherit
     // from the bundled default.

package/src/config/presets.ts

@@ -15,7 +15,7 @@
 // place it is written down:
 //
 //   bundled default  <  user config file  <  persisted overrides
-//                    <  ACTIVE PRESET  <  session pick
+//                    <  ACTIVE PRESET  <  session pick  <  EDIT MODE
 //
 // The preset's position is forced by its lifetime, not chosen. Everything to
 // its left is resolved once per RenderCache entry (an entry serves many
@@ -26,6 +26,18 @@
 // "compact" arrangement must actually change padding, even for a user who once
 // persisted a padding they liked) while a session's own click still wins over
 // the preset (a click is later still).
+//
+// The same rule places the last rung (candybar-settings-ui-aok.5): edit mode's
+// `editGlobals` fragment is decided later than ANY session pick — a user picks
+// a style, and only afterwards enters edit mode — so it is the new rightmost
+// layer, and a session pick of "capsule" cannot survive into a mode whose whole
+// job is to stop segments reading as one continuous strip. It differs from
+// every rung to its left in LIFETIME rather than in kind: nothing writes it to
+// SessionState or the overrides layer, so leaving edit mode restores the
+// previous look with no save/restore path — the session's own pick was never
+// overwritten, only out-ranked [LAW:dataflow-not-control-flow]. The rung itself
+// is the `staged` parameter of effectiveGlobal (themes/policy.ts); this comment
+// is the ONE place the order is written down.
 
 // [LAW:one-way-deps] Type-only, so nothing is emitted and option-domain.ts (a
 // leaf that deliberately never imports dsl-types.ts) can import PRESET_NAMES
@@ -87,7 +99,14 @@ export function effectivePresetName(
   globalsPreset: string | undefined,
   declaredPresets: Readonly<Record<string, PresetDecl>>,
 ): string {
+  // [LAW:types-are-the-program] No staged rung, and the absence is enforced
+  // rather than assumed: every globals fragment that could stage one — a
+  // preset's own `globals`, edit mode's `editGlobals` — has `preset` swapped for
+  // a rejection in its schema (loader/globals.ts), so "a fragment selected a
+  // preset" is unrepresentable and there is nothing here to resolve against.
+  // Which preset is active keeps exactly one authority.
   return effectiveMemberName(
+    undefined,
     sessionPreset,
     globalsPreset,
     PRESET_FLOOR,

package/src/config/settings-menu.ts

@@ -578,7 +578,8 @@ function declareSettingControls(artifacts: MenuArtifacts): void {
     artifacts.segments[seg] = {
       template:
         `${c.glyph} {{ .${c.effectiveVar} }} ` +
-        `{{ menu "${apply}" (dict "key" "${PICKER_KEY}" "closeOnPick" true) }} ` +
+        `{{ menu "${apply}" "${DISCLOSURE_GLYPH_CLOSED}" "${DISCLOSURE_GLYPH_OPEN}" ` +
+        `(dict "key" "${PICKER_KEY}" "closeOnPick" true) }} ` +
         `{{ action "${controlReset(c.name)}" "↺" }}`,
       bg: "surface",
       fg: "foreground",

package/src/daemon/render-payload.ts

@@ -20,7 +20,20 @@ import path from "node:path";
 import os from "node:os";
 import type { ClaudeHookData } from "../utils/claude.js";
 import type { ClientHints } from "./protocol.js";
-import type { DslConfig, VariableDecl } from "../config/dsl-types.js";
+import type { DslConfig, Globals, VariableDecl } from "../config/dsl-types.js";
+import { effectivePresetName, presetGlobals } from "../config/presets.js";
+import { EDIT_MODE_KEY, EDIT_MODE_OPEN } from "../config/loader/edit-mode.js";
+import {
+  DEFAULT_CHARSET,
+  DEFAULT_COLOR_COMPATIBILITY,
+} from "../render/strip.js";
+import {
+  effectiveAutoWrap,
+  effectiveLookName,
+  effectivePadding,
+  effectiveStripStyle,
+  effectiveThemeName,
+} from "../themes/policy.js";
 import { walkNodes } from "../config/dsl-types.js";
 import { extractTemplateRefs } from "../config/dsl-loader.js";
 import type { GitInfo, GitInfoOptions } from "../segments/git.js";
@@ -75,12 +88,96 @@ export interface EffectiveGlobals {
   // own comment.
   readonly presetCustomized: boolean;
   readonly style: StripStyle;
+  // [LAW:one-source-of-truth] The cell separator `plain` renders between
+  // segments (globals.default_separator). `string | undefined`, not a resolved
+  // string, precisely because its floor is NOT ours: PlainJoiner owns " | " and
+  // pickJoiner already reads undefined as "use the class default", so naming a
+  // floor here would be a second copy of a constant that lives in rich-js.
+  // Like charset it has no SessionState half — the config global (as staged by
+  // whatever fragment is on top) is its whole resolution.
+  readonly separator: string | undefined;
   readonly charset: Charset;
   readonly colorCompatibility: ColorCompatibility;
   readonly autoWrap: boolean;
   readonly padding: number;
 }
 
+// [LAW:one-source-of-truth] THE resolution — one function, so the precedence
+// chain has one implementation rather than one per caller. It previously stood
+// as two structurally identical struct literals (the daemon's, in server.ts,
+// and `cc-candybar check`'s), which is two clocks: the check command's job is
+// to render what the daemon would render, and a rung added to one copy is a
+// rung silently missing from the other. The callers differ only in WHERE a
+// session value comes from and whether an overrides log exists to be customized
+// by, so both arrive as parameters and nothing else forks
+// [LAW:dataflow-not-control-flow].
+//
+// `sessionPick` is the reader for one SessionState key. `check` passes a
+// function returning null for every key — a fresh session that has never
+// clicked — rather than a null store, so "no session" travels as a VALUE
+// through the same chain a real session travels [LAW:no-mode-explosion].
+export function resolveEffectiveGlobals(
+  config: DslConfig,
+  sessionPick: (key: string) => string | null,
+  presetCustomized: (preset: string) => boolean,
+): EffectiveGlobals {
+  // The preset resolves FIRST: every field below reads globals, and which
+  // globals is exactly what the preset decides.
+  const preset = effectivePresetName(
+    sessionPick("preset"),
+    config.globals.preset,
+    config.presets,
+  );
+  const globals = presetGlobals(config, preset);
+  // [LAW:dataflow-not-control-flow] The staged fragment is a VALUE, and "edit
+  // mode is off" is the EMPTY value — the identity fragment, exactly as
+  // PRESET_FLOOR's is. Every field below is resolved by the same expression
+  // whether or not edit mode is on; only the contents of `staged` differ. This
+  // is the whole of "no render-walk branch on edit mode": there is no branch
+  // here either, so there is none to leak downstream.
+  const staged: Partial<Globals> =
+    sessionPick(EDIT_MODE_KEY) === EDIT_MODE_OPEN ? config.editGlobals : {};
+  return {
+    preset,
+    presetCustomized: presetCustomized(preset),
+    theme: effectiveThemeName(
+      staged.palette,
+      sessionPick("theme"),
+      globals.palette,
+    ),
+    look: effectiveLookName(
+      staged.look,
+      sessionPick("look"),
+      globals.look,
+      config.looks,
+    ),
+    style: effectiveStripStyle(
+      staged.style,
+      sessionPick("style"),
+      globals.style,
+    ),
+    // [LAW:one-source-of-truth] The fields with no SessionState half resolve as
+    // `staged ?? config ?? floor` — the same chain minus the rung they do not
+    // have, spelled with the same `??` rather than a second mechanism.
+    separator: staged.default_separator ?? globals.default_separator,
+    autoWrap: effectiveAutoWrap(
+      staged.autoWrap,
+      sessionPick("autoWrap"),
+      globals.autoWrap,
+    ),
+    padding: effectivePadding(
+      staged.padding,
+      sessionPick("padding"),
+      globals.padding,
+    ),
+    charset: staged.charset ?? globals.charset ?? DEFAULT_CHARSET,
+    colorCompatibility:
+      staged.colorCompatibility ??
+      globals.colorCompatibility ??
+      DEFAULT_COLOR_COMPATIBILITY,
+  };
+}
+
 // ─── Augmented payload shape ─────────────────────────────────────────────────
 
 // [LAW:types-are-the-program] The RenderPayload extends ClaudeHookData with

package/src/daemon/server.ts

@@ -63,20 +63,8 @@ import { buildDebugSnapshot } from "./debug";
 import { DEBUG_WHATS, isDebugWhat } from "./debug-types";
 import { expandHome } from "../config/dsl-loader.js";
 import { renderDsl } from "../dsl/render.js";
-import {
-  effectiveStripStyle,
-  effectiveAutoWrap,
-  effectivePadding,
-  effectiveThemeName,
-  effectiveLookName,
-  lookKeyByName,
-  paletteForThemeName,
-} from "../themes/index.js";
-import {
-  effectivePresetName,
-  presetGlobals,
-  presetIsCustomized,
-} from "../config/presets.js";
+import { lookKeyByName, paletteForThemeName } from "../themes/index.js";
+import { presetIsCustomized } from "../config/presets.js";
 import {
   renderStripCells,
   DEFAULT_CHARSET,
@@ -90,7 +78,11 @@ import {
 } from "../render/strip.js";
 import { applyClaudeCodeReserve } from "../utils/terminal-width.js";
 import type { RichText } from "@promptctl/rich-js";
-import { buildRenderPayload, type EffectiveGlobals } from "./render-payload.js";
+import {
+  buildRenderPayload,
+  resolveEffectiveGlobals,
+  type EffectiveGlobals,
+} from "./render-payload.js";
 import { ContextProvider } from "../segments/context.js";
 import { MetricsProvider } from "../segments/metrics.js";
 import { TmuxService } from "../segments/tmux.js";
@@ -860,83 +852,28 @@ async function handleRequest(req: Request): Promise<HandledRequest> {
       // No special-case branches — same composition every render.
       let body = "";
       if (entry.state !== null) {
-        // [LAW:one-source-of-truth] Resolve the effective theme ONCE — the
-        // session's chosen theme (SessionState) over the config default. This
-        // single name drives BOTH the payload's `theme.effective` field (the
-        // trigger label reads it) AND the rendered basePalette below, so a label
-        // and the colors can never disagree. Resolved here, before the payload
-        // build, so it can be threaded into the sole payload assembler.
-        //
-        // [LAW:one-source-of-truth] Every globals field a menu/stepper can
-        // persist (candybar-config-engine-71o.3), resolved ONCE into one
-        // struct: theme/look/style/autoWrap/padding compose the session's click
-        // (SessionState) over the config default over a floor — a click
-        // recolors/reshapes the whole bar on the next render; charset and
-        // colorCompatibility describe the TERMINAL rather than a taste and so
-        // have no SessionState half at all, making the config global over its
-        // floor constant their whole resolution. This struct feeds
-        // BOTH the payload's `*.effective` fields (trigger labels) AND
-        // renderOpts below (the actual render) — one resolution, two readers,
-        // so a label can never disagree with what was rendered.
-        //
-        // [LAW:one-source-of-truth] The PRESET resolves FIRST, because every
-        // other field below reads globals — and which globals is exactly what
-        // the preset decides. `presetGlobals` is the config's globals with the
-        // active fragment's shallow-merged over them, so the preset sits at its
-        // one documented place in the precedence chain (bundled default < user
-        // file < persisted overrides < ACTIVE PRESET < session pick — see
-        // src/config/presets.ts and docs/interaction-authoring.md): later than
-        // everything read per cache ENTRY, earlier than every session click,
-        // which is the order the `??` chains below already enforce by reading
-        // SessionState first. There is no "does a preset apply?" branch — the
-        // floor preset's empty fragment merges as a no-op
-        // [LAW:dataflow-not-control-flow].
-        const preset = effectivePresetName(
-          sessionState.get(req.hookData.session_id, "preset"),
-          entry.state.config.globals.preset,
-          entry.state.config.presets,
-        );
-        const globals = presetGlobals(entry.state.config, preset);
-        const effective: EffectiveGlobals = {
-          preset,
+        // [LAW:one-source-of-truth] Every globals field resolved ONCE per
+        // render, here — before the payload build, so the same struct feeds
+        // BOTH the payload's `*.effective` fields (what a trigger label says)
+        // AND renderOpts below (what actually renders). One resolution, two
+        // readers, so a label can never disagree with the bar. The precedence
+        // the resolver applies, and why each rung sits where it does, lives
+        // with the chain (resolveEffectiveGlobals, and src/config/presets.ts).
+        // Read alongside the config, from the same entry, in one statement —
+        // which is exactly what the closure below claims about it.
+        const presetRootOps = entry.state.presetRootOps;
+        const effective: EffectiveGlobals = resolveEffectiveGlobals(
+          entry.state.config,
+          (key: string) => sessionState.get(req.hookData.session_id, key),
           // [LAW:one-source-of-truth] brandon-layout-edit-2gc.5 — read from
           // THIS entry's own presetRootOps (the record that fed the SAME
           // reload that produced entry.state.config), never a fresh
           // loadOverrides() here — a second read could race a concurrent
-          // write and disagree with the tree that actually rendered.
-          presetCustomized: presetIsCustomized(
-            entry.state.presetRootOps,
-            preset,
-          ),
-          theme: effectiveThemeName(
-            sessionState.get(req.hookData.session_id, "theme"),
-            globals.palette,
-          ),
-          look: effectiveLookName(
-            sessionState.get(req.hookData.session_id, "look"),
-            globals.look,
-            entry.state.config.looks,
-          ),
-          style: effectiveStripStyle(
-            sessionState.get(req.hookData.session_id, "style"),
-            globals.style,
-          ),
-          autoWrap: effectiveAutoWrap(
-            sessionState.get(req.hookData.session_id, "autoWrap"),
-            globals.autoWrap,
-          ),
-          padding: effectivePadding(
-            sessionState.get(req.hookData.session_id, "padding"),
-            globals.padding,
-          ),
-          // charset and colorCompatibility have no session half by design —
-          // they describe the terminal, not a taste (see CHARSETS in
-          // themes/policy.ts) — so the config global over its floor is their
-          // whole resolution.
-          charset: globals.charset ?? DEFAULT_CHARSET,
-          colorCompatibility:
-            globals.colorCompatibility ?? DEFAULT_COLOR_COMPATIBILITY,
-        };
+          // write and disagree with the tree that actually rendered. That is
+          // why it arrives as a closure over this entry rather than being
+          // looked up inside the resolver.
+          (preset: string) => presetIsCustomized(presetRootOps, preset),
+        );
         const payload = await buildRenderPayload(
           req.hookData,
           payloadDeps,
@@ -956,6 +893,10 @@ async function handleRequest(req: Request): Promise<HandledRequest> {
         // SAME `effective` struct the payload was just built from — no second
         // `?? DEFAULT_X` computation to drift from it.
         renderOpts.style = effective.style;
+        // The `plain` joiner's cell separator. Assigned unconditionally like
+        // every field around it: `undefined` is a value pickJoiner already
+        // reads as "PlainJoiner's own default", not an absence to branch on.
+        renderOpts.separator = effective.separator;
         renderOpts.wrap = effective.autoWrap;
         renderOpts.padding = effective.padding;
         renderOpts.charset = effective.charset;

package/src/demo/dsl.ts

@@ -30,21 +30,10 @@ import { VariableStore } from "../var-system/store.js";
 import { SourceRegistry } from "../var-system/sources.js";
 import { SessionState } from "../daemon/session-state.js";
 import { listResolvablePaletteNames } from "../themes/policy.js";
-import {
-  effectiveThemeName,
-  effectiveLookName,
-  effectiveAutoWrap,
-  effectivePadding,
-  lookKeyByName,
-  paletteForThemeName,
-} from "../themes/index.js";
-import { effectivePresetName, presetGlobals } from "../config/presets.js";
+import { lookKeyByName, paletteForThemeName } from "../themes/index.js";
+import { resolveEffectiveGlobals } from "../daemon/render-payload.js";
 import { registerDslConfig, renderDsl } from "../dsl/render.js";
-import {
-  DEFAULT_CHARSET,
-  DEFAULT_COLOR_COMPATIBILITY,
-  DEFAULT_TERMINAL_WIDTH,
-} from "../render/strip.js";
+import { DEFAULT_TERMINAL_WIDTH } from "../render/strip.js";
 import { applyClaudeCodeReserve } from "../utils/terminal-width.js";
 
 const FRAMES = 4;
@@ -83,18 +72,18 @@ const payload = {
 // globals every other option reads — the same preset-first order server.ts and
 // check.ts resolve in, so the demo prints the arrangement a fresh session opens
 // in.
-const preset = effectivePresetName(null, config.globals.preset, config.presets);
-const globals = presetGlobals(config, preset);
-const basePalette = paletteForThemeName(
-  effectiveThemeName(null, globals.palette),
-);
-// Same fresh-session resolution one dimension over: the config-default look
-// over the "none" identity floor — the exact mirror of the daemon's per-render
-// effectiveLookName → lookKeyByName chain.
-const lookKey = lookKeyByName(
-  config.looks,
-  effectiveLookName(null, globals.look, config.looks),
+// [LAW:one-source-of-truth] THE daemon's resolver, not a mirror of it — a
+// fresh-session pick reader (null for every key) and no overrides log to be
+// customized by. The demo previously restated this chain field by field and had
+// already drifted: it hardcoded `style: "powerline"` below and so ignored a
+// config's own `globals.style`.
+const effective = resolveEffectiveGlobals(
+  config,
+  () => null,
+  () => false,
 );
+const basePalette = paletteForThemeName(effective.theme);
+const lookKey = lookKeyByName(config.looks, effective.look);
 
 // A fresh store + registry for this run. (A hot-reloading daemon would
 // dispose() the old pair and build new ones — see registerDslConfig's docs.)
@@ -128,26 +117,21 @@ try {
       payload,
       basePalette,
       {
-        style: "powerline",
-        // Same resolution the daemon applies: the config global over the
-        // truecolor default floor.
-        colorCompatibility:
-          globals.colorCompatibility ?? DEFAULT_COLOR_COMPATIBILITY,
+        style: effective.style,
+        separator: effective.separator,
+        colorCompatibility: effective.colorCompatibility,
         // [LAW:one-source-of-truth] Demo applies the same Claude-Code-UI
         // reserve the daemon does so demo output matches the bytes a real
         // statusline would emit at the same terminal width.
         width: applyClaudeCodeReserve(
           process.stdout.columns ?? DEFAULT_TERMINAL_WIDTH,
         ),
-        // Same resolvers the daemon applies, with a null session pick — the
-        // demo has no SessionState, so both land on the config default over
-        // their floor.
-        wrap: effectiveAutoWrap(null, globals.autoWrap),
-        padding: effectivePadding(null, globals.padding),
-        charset: globals.charset ?? DEFAULT_CHARSET,
+        wrap: effective.autoWrap,
+        padding: effective.padding,
+        charset: effective.charset,
       },
       undefined,
-      { look: lookKey, preset },
+      { look: lookKey, preset: effective.preset },
     );
     process.stdout.write(`  ${line}\n`);
     if (frame < FRAMES - 1) await sleep(FRAME_INTERVAL_MS);

package/src/render/action.ts

@@ -32,6 +32,7 @@ import {
   type ActionDecl,
 } from "../config/action.js";
 import { resolveOptionDomain } from "../config/option-domain.js";
+import { pickCycleDisplay } from "../config/disclosure.js";
 import { encodeLayoutOp, type LayoutOp } from "../config/layout-ops.js";
 import { parseSessionBoolean, type StripStyle } from "../themes/policy.js";
 import {
@@ -800,15 +801,16 @@ function selectDisplay(
     throw new Error(`action "${name}" needs a display (the clickable text)`);
   }
   if (action.kind === "set-cycle" || action.kind === "persist-cycle") {
-    if (displays.length !== 1 && displays.length !== action.members.length) {
-      throw new Error(
-        `action "${name}" cycles ${action.members.length} members; bind one display per member (${action.members.length}) or one static display, got ${displays.length}`,
-      );
-    }
-    const display =
-      displays.length === 1
-        ? displays[0]!
-        : displays[cycleIndex(action, store)]!;
+    // [LAW:single-enforcer] The arity rule and the pick are the disclosure
+    // primitive's, not this file's — `{{ menu }}` resolves its own trigger
+    // through the same function over its `[closed, member]` cycle, so the two
+    // disclosure kinds cannot disagree about what a display binding means.
+    const display = pickCycleDisplay(
+      `action "${name}"`,
+      displays,
+      action.members.length,
+      cycleIndex(action, store),
+    );
     return { display, boundValue: undefined };
   }
   if (displays.length > 2) {