@promptctl/cc-candybar 1.40.0 → 1.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -91,9 +91,9 @@
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.40.0",
-    "@promptctl/cc-candybar-darwin-x64": "1.40.0",
-    "@promptctl/cc-candybar-linux-x64": "1.40.0",
-    "@promptctl/cc-candybar-linux-arm64": "1.40.0"
+    "@promptctl/cc-candybar-darwin-arm64": "1.41.0",
+    "@promptctl/cc-candybar-darwin-x64": "1.41.0",
+    "@promptctl/cc-candybar-linux-x64": "1.41.0",
+    "@promptctl/cc-candybar-linux-arm64": "1.41.0"
   }
 }

package/src/config/disclosure.ts

@@ -89,6 +89,67 @@ export function pickCycleDisplay(
   return displays.length === 1 ? displays[0]! : displays[index]!;
 }
 
+// [LAW:one-source-of-truth] Go-template string-literal escaping for any DISPLAY
+// text a synthesis splices INSIDE a quoted `{{ }}` argument of a template it
+// emits — a group's label, a preset name in the reset banner, a `(?)` trigger's
+// closed/open glyphs. NOT for a template's own body text, which is source rather
+// than a splice: a help line is assigned verbatim (help.ts) because escaping one
+// would put a backslash on the bar. It lives here, beside the two splices
+// that need it most, because it was already two verbatim copies (loader/layout.ts
+// and edit-chrome.ts, whose comment deferred the merge until "one small rule"
+// earned its own home). The `(?)` affordance was the third caller, so it did.
+export function escapeTemplateLiteral(s: string): string {
+  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+// [LAW:types-are-the-program] One open disclosure, named by the two strings that
+// decide it: the VARIABLE a body reads and the MEMBER value that means "this one
+// is open". They are distinct because a group's variable is per-group
+// (`groups.<name>`) while its state KEY may be shared with accordion siblings —
+// so the pair, never a lone key, is what identifies an open state.
+export interface DisclosureRef {
+  readonly variable: string;
+  readonly member: string;
+}
+
+// [LAW:single-enforcer] THE body predicate a disclosure implies. Variadic
+// because nesting is conjunction and nothing else: a row inside two disclosures
+// is open when both are, which is one list, not a compound spelling. Callers
+// that used to hand-write `{{ eq .x "open" }}` beside `{{ and (eq .x "open")
+// (eq .y "open") }}` now pass one ref or two to one function — the shape stops
+// varying with the depth [LAW:dataflow-not-control-flow].
+//
+// `and` is variadic in Go templates and returns its sole argument when given
+// one, so the single-disclosure case needs no separate spelling.
+//
+// [LAW:types-are-the-program] The first ref is a separate parameter so a gate
+// over ZERO disclosures — which would emit an argument-less `{{ and }}` and gate
+// on nothing — is unrepresentable, with no runtime guard to state it.
+export function disclosureGate(
+  first: DisclosureRef,
+  ...rest: readonly DisclosureRef[]
+): string {
+  const terms = [first, ...rest]
+    .map((o) => `(eq .${o.variable} "${escapeTemplateLiteral(o.member)}")`)
+    .join(" ");
+  return `{{ and ${terms} }}`;
+}
+
+// [LAW:single-enforcer] THE trigger template a disclosure's toggle segment
+// carries: one `{{ action }}` over the cycle action, binding the author's text
+// per state — closed first, matching the cycle's own closed-first member order
+// so the display index and the member index are the same number. Since .4 every
+// trigger authors its own text (the runtime appends no glyph), which makes this
+// the one place the binding is spelled; before it, five sites spelled it and the
+// `+▸` double-glyph bug lived in the gap between two of them.
+export function disclosureTrigger(
+  action: string,
+  closed: string,
+  open: string,
+): string {
+  return `{{ action "${action}" "${escapeTemplateLiteral(closed)}" "${escapeTemplateLiteral(open)}" }}`;
+}
+
 // [LAW:single-enforcer] THE backing `state` variable a disclosure key implies:
 // it holds the open member's name and defaults to `def` (the CLOSED sentinel for
 // an independent disclosure, or an initially-open member for a group's

package/src/config/edit-chrome.ts

@@ -36,9 +36,12 @@ import { presetRootOpsKey } from "./loader/persist-target.js";
 import { ident } from "./ident.js";
 import {
   EDIT_MODE_GATE,
+  EDIT_MODE_REF,
   EDIT_NS,
   EDIT_TOGGLE_ACTION,
 } from "./loader/edit-mode.js";
+import { declareHelp, type HelpDisclosure } from "./help.js";
+import { EDIT_MODE_HELP } from "../help-text.js";
 import { GROUP_NS } from "./loader/layout.js";
 import { SETTINGS_NS } from "./settings-menu.js";
 import {
@@ -51,6 +54,7 @@ import {
 import {
   DISCLOSURE_CLOSED,
   DISCLOSURE_GLYPH_CLOSE,
+  escapeTemplateLiteral,
   disclosureCycleAction,
   disclosureStateVar,
 } from "./disclosure.js";
@@ -88,17 +92,6 @@ function isChromeExempt(name: string): boolean {
   );
 }
 
-// [LAW:no-silent-failure] Go-template string-literal escaping for a preset
-// NAME spliced into DISPLAY text (prependCustomizedBanner) rather than an
-// identifier — the same hazard loader/layout.ts's group `label` synthesis
-// already guards against, reimplemented here since that copy is
-// module-private and this one small rule doesn't warrant its own shared
-// module the way `ident` (checked for agreement across three sites —
-// see ./ident.ts) did.
-function escapeTemplateLiteral(s: string): string {
-  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-
 // [LAW:one-source-of-truth] Every synthesized decl this pass produces, keyed
 // by its final name — one accumulator threaded through every preset's splice
 // so cross-preset names (disambiguated by `presetIdent`) can never collide.
@@ -312,17 +305,23 @@ function spliceContainer(
 // synthesized the SAME way (one reset action targeting this preset's exact
 // `persist` key, one segment hosting `{{ action }}`), UNCONDITIONALLY, with
 // visibility carried entirely by PRESET_CUSTOMIZED_GATE
-// [LAW:dataflow-not-control-flow]. Prepended as an extra ROW (not spliced
-// into the row-interleaved chrome spliceContainer builds) because it is not
-// bound to any one segment gap — it is a fact about the whole tree — so it
-// gets its own line above it, visible or not by the SAME `when` every other
-// synthesized affordance here already uses.
-function prependCustomizedBanner(
+// [LAW:dataflow-not-control-flow]. It gets its own ROW (not a slot in the
+// row-interleaved chrome spliceContainer builds) because it is not bound to any
+// one segment gap — it is a fact about the whole tree — visible or not by the
+// SAME `when` every other synthesized affordance here already uses.
+//
+// candybar-settings-ui-aok.6 hangs edit mode's `(?)` off the same content — its
+// BODY is a per-preset row on the same footing as the banner, so this function
+// now brackets the content rather than only preceding it, which is what its name
+// says and why it is no longer "prepend". Its TRIGGER is not a row; see
+// withTrailingCell.
+function wrapWithPresetRows(
   splicedRoot: LayoutNode,
   presetName: string,
   presetIdent: string,
   rootOpsKey: string,
   artifacts: ChromeArtifacts,
+  help: HelpDisclosure,
 ): LayoutNode {
   const actionName = `${EDIT_NS}${presetIdent}.resetLayout`;
   const chromeSegName = `${EDIT_NS}${presetIdent}.customized`;
@@ -365,11 +364,85 @@ function prependCustomizedBanner(
   return {
     kind: "container",
     direction: "vertical",
-    children: [{ kind: "segment", name: chromeSegName }, splicedRoot],
+    children: [
+      { kind: "segment", name: chromeSegName },
+      withTrailingCell(splicedRoot, help.trigger),
+      // The body is a ROW of its own, and only while the disclosure is open —
+      // dropping BELOW the row that revealed it, like every other disclosure
+      // body in this codebase.
+      help.body,
+    ],
     ...(splicedRoot.when !== undefined && { when: splicedRoot.when }),
   };
 }
 
+// [LAW:one-source-of-truth] `HelpDisclosure.trigger` is a CELL, and its contract
+// is that the caller joins it to a row it ALREADY HAS — the settings menu pushes
+// it into the row holding `persist?`. Edit mode's rows are the ones
+// spliceContainer just built, so the trigger joins the last of them. Two
+// constraints pin that placement and nothing else satisfies both:
+//
+//  - Closed help must cost no LINE. A trigger given its own vertical slot is a
+//    permanent row for the whole time edit mode is on, since a trigger's `when`
+//    is its host surface's, never its own open state (a trigger you must open in
+//    order to see could never be opened).
+//  - Closed help must cost no COLOUR. The hue cursor (src/dsl/render.ts:696)
+//    advances in pre-order over every segment leaf — VISIBLE OR NOT, so that
+//    toggling a disclosure never recolours the bar — which means a leaf inserted
+//    AHEAD of the content shifts the hue index of everything after it. An
+//    earlier draft put the `(?)` first and recoloured every cell of the bundled
+//    default (status row 33;41;59 → 49;36;52) with edit mode still OFF. Trailing
+//    the last row is the one position that moves no other leaf.
+//
+// Those two together disqualify the reset-banner row, which sits above the
+// content.
+//
+// A THIRD requirement decides how far the descent may go, and it outranks the
+// other two: the trigger must be visible exactly when EDIT MODE is, since a
+// trigger you must already have opened something else to reach is not a trigger.
+// A container's `when` reaches every descendant, so descending into a
+// `when`-bearing container would silently make its gate the trigger's gate.
+// `kind: "group"` is the shape that makes this concrete rather than theoretical:
+// lowerGroup emits `{vertical, children: [toggle, {…, when: groupGate}]}`, so a
+// preset root ending in a group — ordinary authoring the A-grammar endorses —
+// would otherwise put the `(?)` INSIDE that group's collapsible body, gated on
+// edit mode AND a disclosure most groups default closed. Pairing beside a gated
+// SEGMENT is a different act and stays allowed: `{h: [gatedSeg, cell]}` puts the
+// cell beside the gate rather than under it.
+//
+// For a root whose last row is gated the three requirements are jointly
+// unsatisfiable, so the priority is stated rather than left to whichever branch
+// the recursion happens to reach: visible (always) > no recolour (always, since
+// appending is still after every existing leaf) > no extra line (surrendered
+// here, in exactly the configs where riding a row was never possible).
+//
+// [LAW:dataflow-not-control-flow] Total over the node shapes with no guard: a
+// segment is a row of one that cannot hold a second cell, so it pairs into one;
+// a vertical container's rows are its children, so it descends into the last one
+// it may; anything else appends. An empty container has no last child and
+// appends, which is the same answer.
+function withTrailingCell(node: LayoutNode, cell: LayoutNode): LayoutNode {
+  if (node.kind === "segment") {
+    return {
+      kind: "container",
+      direction: "horizontal",
+      children: [node, cell],
+    };
+  }
+  const last = node.children.at(-1);
+  if (
+    node.direction === "vertical" &&
+    last !== undefined &&
+    (last.kind === "segment" || last.when === undefined)
+  ) {
+    return {
+      ...node,
+      children: [...node.children.slice(0, -1), withTrailingCell(last, cell)],
+    };
+  }
+  return { ...node, children: [...node.children, cell] };
+}
+
 // One preset's chrome-spliced root. A bare-segment root (the A-grammar
 // collapses a single top-level segment ref to `{ kind: "segment", name }`
 // with no enclosing container) is wrapped in a synthetic horizontal
@@ -379,6 +452,7 @@ function spliceEditChromeForPreset(
   config: DslConfig,
   presetName: string,
   artifacts: ChromeArtifacts,
+  help: HelpDisclosure,
 ): LayoutNode {
   const { node } = presetRoot(config, presetName);
   const rootOpsKey = presetRootOpsKey(presetName);
@@ -387,7 +461,7 @@ function spliceEditChromeForPreset(
   const posCounter = { n: 0 };
   // [LAW:no-silent-failure] The bare-segment-root case (the A-grammar's
   // `{ seg, when }` shorthand is a legal PresetDecl.root) carries its OWN
-  // `when` onto this synthetic wrapper too — prependCustomizedBanner's own
+  // `when` onto this synthetic wrapper too — wrapWithPresetRows's own
   // when-carry-up reads `splicedRoot.when`, which is this wrapper's `when`
   // once spliceContainer's `{...node, children}` passes it through
   // unchanged; without copying it here, a bare-segment preset root's own
@@ -410,12 +484,13 @@ function spliceEditChromeForPreset(
     artifacts,
     posCounter,
   );
-  return prependCustomizedBanner(
+  return wrapWithPresetRows(
     spliced,
     presetName,
     presetIdent,
     rootOpsKey,
     artifacts,
+    help,
   );
 }
 
@@ -444,9 +519,27 @@ export function synthesizeEditChrome(config: DslConfig): DslConfig {
     actions: {},
     segments: {},
   };
+  // [LAW:one-source-of-truth] Edit mode's `(?)` is minted ONCE and merely
+  // REFERENCED from every preset root — the same move the settings menu makes
+  // with its anchor, and for the same reason: one disclosure means one open
+  // state, so switching presets cannot land you beside a second `(?)` that
+  // disagrees about whether help is showing. The text is identical for every
+  // preset because what `+` and `-` do is a fact about edit mode, not about a
+  // layout.
+  const help = declareHelp(
+    `${EDIT_NS}help`,
+    EDIT_MODE_HELP,
+    [EDIT_MODE_REF],
+    artifacts,
+  );
   const presets: Record<string, PresetDecl> = { ...config.presets };
   for (const name of presetNames(config.presets)) {
-    const splicedRoot = spliceEditChromeForPreset(config, name, artifacts);
+    const splicedRoot = spliceEditChromeForPreset(
+      config,
+      name,
+      artifacts,
+      help,
+    );
     presets[name] = {
       ...presetByName(config.presets, name),
       root: splicedRoot,

package/src/config/help.ts

@@ -0,0 +1,151 @@
+// [LAW:one-type-per-behavior] candybar-settings-ui-aok.6 — the `(?)` affordance.
+// It is NOT a fourth kind of disclosure. A `(?)` is the SAME binary toggle
+// `kind: "group"`, `{{ menu }}`, edit mode's trigger and the global settings menu
+// all are; it differs from a group in exactly two VALUES — the text its trigger
+// binds (`(?)`/`✕` rather than `label ▸`/`label ▾`) and what its body contains
+// (help lines rather than arbitrary layout). So every artifact below comes out
+// of `disclosure.ts`, and this module contributes no state, no gate, and no
+// glyph rule of its own — only the two values and the shape they fill.
+//
+// The ticket that asked for this predicted the alternative: "if it arrives as
+// another hand-rolled set of four artifacts, the finding to report is that the
+// disclosure itself wants to be one thing". It did. `disclosure.ts` had
+// single-sourced only the two artifacts that are DATA (the state var, the cycle
+// action) and left the two that are STRINGS — the trigger template and the body
+// gate — hand-written at five sites, which is where the `+▸` double-glyph bug of
+// .4 lived. `disclosureTrigger`/`disclosureGate` finish that extraction, and
+// this file is the first caller that never had a copy to begin with.
+//
+// [LAW:one-way-deps] Content is a PARAMETER, never an import: this module knows
+// how to mint a help disclosure and nothing about what any particular one says.
+// The bundled sentences live in `src/help-text.ts` — the corpus `--help` prints
+// — and the two synthesis passes that place a `(?)` pass them in. That is what
+// keeps the bar's help and the CLI's help one set of strings rather than two
+// hand-maintained copies [LAW:one-source-of-truth].
+
+import type { ActionDecl } from "./action.js";
+import type { LayoutNode, SegmentDecl, VariableDecl } from "./dsl-types.js";
+import {
+  DISCLOSURE_CLOSED,
+  DISCLOSURE_GLYPH_CLOSE,
+  disclosureCycleAction,
+  disclosureGate,
+  disclosureStateVar,
+  disclosureTrigger,
+  type DisclosureRef,
+} from "./disclosure.js";
+
+// [LAW:one-source-of-truth] The trigger's closed text, one spelling for the
+// whole bar so a reader learns the affordance once. Its OPEN text is the shared
+// `DISCLOSURE_GLYPH_CLOSE` — the same ✕ a picker's close cell and edit mode's
+// opened `+` wear, because it is the same meaning: click to close what this
+// opened.
+//
+// [LAW:no-silent-failure] Deliberately per-state rather than one static `(?)`.
+// Several `(?)` triggers can be visible at once (edit mode's and the config
+// menu's, whenever both surfaces are open), and the tint that distinguishes
+// other open disclosures — node-registry's `drops.length > 0` — recolours a
+// segment's RESOLVED BACKGROUND, so it is a no-op on any segment declaring no
+// bg. .5 gave edit mode a look at the GLOBALS level only, which left its insert
+// chrome without one; the trigger's own text is therefore the only place the
+// open state can be read, exactly as it is for the `+` beside it.
+export const HELP_GLYPH_CLOSED = "(?)";
+
+// The open member of a help disclosure's binary key: it holds this or the shared
+// CLOSED sentinel, like every other binary disclosure in the bar.
+const HELP_OPEN = "open";
+
+// [LAW:one-source-of-truth] The declarations a `(?)` contributes, keyed by final
+// name — the same accumulator shape `ChromeArtifacts`/`MenuArtifacts` already
+// thread through their synthesis passes, so a caller merges one more set of
+// artifacts the way it already merges its own.
+export interface HelpArtifacts {
+  readonly variables: Record<string, VariableDecl>;
+  readonly actions: Record<string, ActionDecl>;
+  readonly segments: Record<string, SegmentDecl>;
+}
+
+// [LAW:types-are-the-program] The two nodes a caller must place, returned
+// separately because they belong in different rows and only the caller knows
+// which: the trigger is a CELL that joins a row the caller already has (so
+// opening help never widens the bar and closed help costs no row), and the body
+// is a ROW of its own that exists only while the disclosure is open.
+export interface HelpDisclosure {
+  readonly trigger: LayoutNode;
+  readonly body: LayoutNode;
+}
+
+// Mint one `(?)` and its body.
+//
+// `name` is the reserved-namespace base every artifact derives from — the
+// trigger segment, the state variable and the cycle action all take it
+// verbatim, the same one-name-four-artifacts convention `groups.<name>` and
+// `settings.menu` already use, so the toggle's click and the body's gate cannot
+// address different keys [LAW:one-source-of-truth].
+//
+// `within` names the disclosures this help sits INSIDE (edit mode, the settings
+// menu). Both nodes inherit those gates, so a `(?)` opened inside a surface that
+// is then closed cannot leave its body stranded on the bar — the body's gate is
+// its own ref AND every enclosing one, which is what "open" actually means for a
+// nested disclosure [LAW:dataflow-not-control-flow].
+export function declareHelp(
+  name: string,
+  lines: readonly string[],
+  within: readonly DisclosureRef[],
+  out: HelpArtifacts,
+  surface?: { readonly bg: string; readonly fg: string },
+): HelpDisclosure {
+  const self: DisclosureRef = { variable: name, member: HELP_OPEN };
+  out.variables[name] = disclosureStateVar(name, DISCLOSURE_CLOSED);
+  out.actions[name] = disclosureCycleAction(name, HELP_OPEN);
+  out.segments[name] = {
+    template: disclosureTrigger(
+      name,
+      HELP_GLYPH_CLOSED,
+      DISCLOSURE_GLYPH_CLOSE,
+    ),
+    ...surface,
+    // The trigger is visible wherever its host surface is. An unnested `(?)`
+    // (`within` empty) is always visible, and declares no `when` at all.
+    ...gateOf(within),
+  };
+
+  // [LAW:one-source-of-truth] One line is one SEGMENT whose template is that
+  // line VERBATIM — no wrapper text, no joining, no reformatting, and no
+  // escaping. A `template` IS template source, so its static runs reach the bar
+  // unchanged; escaping belongs to text spliced INSIDE a quoted `{{ }}` argument
+  // (what `disclosureTrigger` above does, and this is not), and applying it here
+  // would put backslashes on the bar the moment a sentence used a quote. That is
+  // what makes "the bar's help IS the corpus" checkable as identity rather than
+  // as string similarity: the declaration a test reads and the sentence
+  // `src/help-text.ts` exports are one value, byte for byte.
+  const bodyGate = disclosureGate(self, ...within);
+  const children = lines.map((line, i): LayoutNode => {
+    const lineName = `${name}.${i}`;
+    // [LAW:single-enforcer] The gate lives on the body container below and
+    // nowhere else — the render walk ANDs an ancestor's `when` into every
+    // descendant (src/dsl/render.ts:764), so a copy here would be a second
+    // enforcer of one predicate with nothing keeping the two equal.
+    out.segments[lineName] = { template: line, ...surface };
+    return { kind: "segment", name: lineName };
+  });
+
+  return {
+    trigger: { kind: "segment", name },
+    body: {
+      kind: "container",
+      direction: "horizontal",
+      children,
+      when: bodyGate,
+    },
+  };
+}
+
+// The enclosing gate as an optional `when` field — the codebase's standard
+// spelling for "this field exists only when there is something to put in it",
+// keeping `disclosureGate`'s first argument required so a gate over nothing
+// stays unrepresentable.
+function gateOf(within: readonly DisclosureRef[]): { when?: string } {
+  const [first, ...rest] = within;
+  return first === undefined ? {} : { when: disclosureGate(first, ...rest) };
+}

package/src/config/loader/edit-mode.ts

@@ -51,7 +51,9 @@ import type { ActionDecl } from "../action.js";
 import {
   DISCLOSURE_CLOSED,
   disclosureCycleAction,
+  disclosureGate,
   disclosureStateVar,
+  type DisclosureRef,
 } from "../disclosure.js";
 import { reservedNamespaceCollisions } from "./reserved-namespace.js";
 
@@ -71,10 +73,20 @@ export const EDIT_MODE_KEY = "edit.mode";
 export const EDIT_TOGGLE_ACTION = "edit.toggle";
 export const EDIT_MODE_OPEN = "open";
 
+// [LAW:one-source-of-truth] Edit mode AS a disclosure, which is what it has
+// always been: a binary toggle over one SessionState key. Naming it as a ref
+// lets anything nested inside edit mode (a `(?)` and its body) derive its own
+// gate by conjunction with this one, instead of concatenating gate strings.
+export const EDIT_MODE_REF: DisclosureRef = {
+  variable: EDIT_MODE_KEY,
+  member: EDIT_MODE_OPEN,
+};
+
 // [LAW:one-source-of-truth] The predicate every synthesized +/- chrome
-// segment gates on — spelled once here so edit-chrome.ts never hand-rolls
-// the template string a second time.
-export const EDIT_MODE_GATE = `{{ eq .${EDIT_MODE_KEY} "${EDIT_MODE_OPEN}" }}`;
+// segment gates on — derived from the ref above through the same function
+// every other disclosure's gate comes from, so edit-mode chrome and a group
+// body are gated by one rule rather than by two spellings that agree today.
+export const EDIT_MODE_GATE = disclosureGate(EDIT_MODE_REF);
 
 // [LAW:single-enforcer] The ONE detector for "does this file want edit mode":
 // a literal `{{ action "edit.toggle" … }}` call somewhere a segment's

package/src/config/loader/layout.ts

@@ -35,7 +35,9 @@ import {
   DISCLOSURE_GLYPH_CLOSED,
   DISCLOSURE_GLYPH_OPEN,
   disclosureCycleAction,
+  disclosureGate,
   disclosureStateVar,
+  disclosureTrigger,
 } from "../disclosure.js";
 import { findKeyLine } from "./diagnostics.js";
 import { reservedNamespaceCollisions } from "./reserved-namespace.js";
@@ -535,20 +537,13 @@ function lowerGroup(g: GroupNodeInput): LayoutNode {
         kind: "container",
         direction: g.direction ?? "vertical",
         children: g.children,
-        when: `{{ eq .${ref} "${g.name}" }}`,
+        when: disclosureGate({ variable: ref, member: g.name }),
       },
     ],
     ...(g.when !== undefined && { when: g.when }),
   };
 }
 
-// Go-template string-literal escaping for the synthesized toggle template — the
-// label is a plain display string (dynamic labels are raw-grammar territory),
-// so backslashes and quotes are the only characters that could break the splice.
-function escapeTemplateLiteral(s: string): string {
-  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-
 function groupIssue(ctx: ValidateCtx, path: string, message: string): void {
   ctx.issues.push({
     path,
@@ -641,7 +636,6 @@ export function synthesizeGroupDecls(
   for (const g of groups) {
     const name = GROUP_NS + g.name;
     const key = groupStateKey(g);
-    const label = escapeTemplateLiteral(g.label);
     // [LAW:dataflow-not-control-flow] Depth is a value derivable from the paths
     // already in ctx.groups — no extra threading. Strict-prefix count gives
     // nesting depth; the indent embeds as a string constant in the template.
@@ -662,7 +656,11 @@ export function synthesizeGroupDecls(
     // structural left-margin (nesting depth) and stays leading; the glyph is a
     // trailing affordance on the label, never a prefix.
     segments[name] = {
-      template: `{{ action "${name}" "${indent}${label} ${DISCLOSURE_GLYPH_CLOSED}" "${indent}${label} ${DISCLOSURE_GLYPH_OPEN}" }}`,
+      template: disclosureTrigger(
+        name,
+        `${indent}${g.label} ${DISCLOSURE_GLYPH_CLOSED}`,
+        `${indent}${g.label} ${DISCLOSURE_GLYPH_OPEN}`,
+      ),
       ...(g.bg !== undefined && { bg: g.bg }),
       ...(g.fg !== undefined && { fg: g.fg }),
     };