@vibelord/lanes 1.1.0 → 1.2.0

package/payload/lanes/libexec/view.sh

@@ -4,12 +4,23 @@
 # loops forever and shows a status screen instead of dying.
 # usage: view.sh <device> <workspace> [slot]
 #   switch lane: write the lane id to $STATE/views/<device>/<workspace>.<slot>.target, then `kill -USR1` this pid.
+#   new tree (cockpit v3 U5): `kill -USR2` this pid after an update flipped ~/.local/share/lanes/current. The view
+#   re-executes itself (`exec "$0" …`: the same pid, the path it was started by — a `current` path runs the new tree) at
+#   the NEXT NATURAL EXIT of its child: an attached lane's viewer detaching or a USR1 switch, the end of a status
+#   screen's wait. USR2 itself never signals the child, so it never drops an attached tmux client.
 set -u
+# Trapped first, before this view's pid file names it: a USR2 must never find the default action (terminate).
+reexec=0
+on_reexec() { reexec=1; }
+trap on_reexec USR2
 device=${1:?device} ws=${2:?workspace} slot=${3:-main}
 mobile=0; [ "${4:-}" != --mobile ] || mobile=1
 case "$device$ws$slot" in *[!A-Za-z0-9_.-]*) echo 'invalid view name'; exit 64 ;; esac
 state=${LANES_STATE:-$HOME/.local/state/lanes}
-repo=$(cd "$(dirname "$0")/.." && pwd)
+# -P: the PHYSICAL tree. A layout names this script through the `current` link (W9 U1); resolving it once pins every
+# holder and connection.py this loop runs to the tree the view started from, so an update that flips the link never
+# mixes an old view.sh with new holders. The view moves to the new tree when it is started again.
+repo=$(cd "$(dirname "$0")/.." && pwd -P)
 dir=$state/views/$device
 mkdir -p "$dir"
 target_file=$dir/$ws.$slot.target
@@ -50,6 +61,13 @@ run() {
     # A trapped signal interrupts wait; make sure the child is really gone before moving on.
     while kill -0 "$child" 2>/dev/null; do wait "$child" 2>/dev/null || :; done
     child=
+    # A USR2 came while the child ran (or before it): it has ended by itself now, so run the tree `current` names. A
+    # failed exec ends a non-interactive shell, so a script that is gone (a pruned tree) is not exec'd: this one goes on.
+    if [ "$reexec" = 1 ]; then
+        reexec=0
+        if [ -x "$0" ] && [ "$mobile" = 1 ]; then exec "$0" "$device" "$ws" "$slot" --mobile; fi
+        if [ -x "$0" ]; then exec "$0" "$device" "$ws" "$slot"; fi
+    fi
     return "$rc"
 }
 
@@ -58,20 +76,30 @@ reset_terminal() {
     printf '\033[?1049l\033[?1000l\033[?1002l\033[?1003l\033[?1006l\033[?2004l\033[<u\033[0m\033[?25h\033[2J\033[3J\033[H'
 }
 
-# The 16-colour SGR literals of the design tokens (libexec/tokens.py --sh): sourced once, printf only, no fork.
+# The SGR literals of the design tokens (libexec/tokens.py --sh): sourced once, printf only, no fork. A plain source
+# assigns the 16-colour set; `lz_tones` re-points them to another set (assignments and a `case`, no fork either).
 # They hold `\033[…m` as text, so they go into printf's FORMAT (which turns `\033` into ESC), never into a %s argument.
 # shellcheck source=libexec/tokens.sh
 . "$repo/libexec/tokens.sh"
 
 # status_screen <title> <text> <dim line> [<lead>]: a lead, when given, is the bold headline above the title.
-# The lead glyph follows the sidebar's published glyph mode ($STATE/clients/<device>.glyphs, written by sidebar.py from
-# devices/<device>.json) and is read on EVERY call with the builtin read, no fork: this runs exactly when the host may be
-# too slow for one, and `lanes attach DEVICE --ascii` against a live session must reach the next screen without a restart.
+# The look follows the stamps the sidebar publishes for this device from its resolved modes (devices/<device>.json
+# first): $STATE/clients/<device>.glyphs, .color and .theme, read on EVERY call with the builtin read, no fork: this
+# runs exactly when the host may be too slow for one, and `lanes attach DEVICE --ascii|--color C|--theme T` against a
+# live session must reach the next screen without a restart. The lead glyph is `!` in ascii. `.color` and `.theme`
+# pick the colour set (cockpit v3 P3): truecolor or 256 of dark or light, none (NO_COLOR: bold only), and anything
+# else — no stamp, a vivid mode with no known variant yet — the 16-colour set, the user's own palette, never a guess.
+# In the vivid sets (LZ_VIVID: the colours Lanes defines) the lead takes the warning mark's tone, attention, as the
+# sidebar's banner does; 16 and none keep v1's bytes, as the sidebar's rows do.
 status_screen() {
     reset_terminal
     glyphs=unicode; { IFS= read -r glyphs < "$state/clients/$device.glyphs"; } 2>/dev/null || :
+    color=16; { IFS= read -r color < "$state/clients/$device.color"; } 2>/dev/null || :
+    theme=; { IFS= read -r theme < "$state/clients/$device.theme"; } 2>/dev/null || :
+    lz_tones "$color" "$theme"
     lead_glyph='⚠'; [ "$glyphs" != ascii ] || lead_glyph='!'
-    if [ -n "${4:-}" ]; then printf "\n  ${LZ_BOLD}%s %s${LZ_RESET}\n\n  %s\n" "$lead_glyph" "$4" "$1"
+    lead_tone=; [ -z "${LZ_VIVID:-}" ] || lead_tone=$LZ_ATTENTION
+    if [ -n "${4:-}" ]; then printf "\n  ${LZ_BOLD}${lead_tone}%s %s${LZ_RESET}\n\n  %s\n" "$lead_glyph" "$4" "$1"
     else printf "\n  ${LZ_BOLD}%s${LZ_RESET}\n" "$1"; fi
     printf "\n  %s\n\n  ${LZ_DIM}%s${LZ_RESET}\n" "$2" "$3"
 }

package/payload/lanes/systemd/lanes-ensure.service

@@ -3,5 +3,8 @@ Description=lanes: recreate any missing device view session (agents are never to
 
 [Service]
 Type=oneshot
+# No After=/Conflicts= with lanes-update.service: `lanes ensure` holds the view-session lock (locks/sessions.lock,
+# DEF-1792) itself, as the update's `ensure --if-layout-changed`, `lanes rebuild` and every view create do. A tick that
+# finds it held waits 10 s, then skips (exit 0). Conflicts= would stop a running update; After= orders queued jobs only.
 ExecStart="@REPO@/bin/lanes" ensure
 Slice=lanes.slice

package/payload/lanes/systemd/lanes-gc.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=lanes housekeeping (zmx logs never rotate; stale dynamic resolve files)
+Description=lanes housekeeping (zmx logs never rotate; stale dynamic resolve files; old staged trees)
 
 [Service]
 Type=oneshot

package/payload/lanes/systemd/lanes-update.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=lanes: install the newest npm release when there is one (lanes update --timer)
+Documentation=https://github.com/bwllaming/bw-tools/blob/main/lanes/docs/USERGUIDE.md#update
+
+[Service]
+Type=oneshot
+# Asks the npm registry for the release @vibelord/lanes's dist-tag names (`latest`, or `lanes-stable` with channel=stable
+# in ~/.config/lanes/update.conf) and, when it is newer than the installed one, runs the npx the npm wrapper recorded at
+# install (~/.local/state/lanes/update/npx): `npx --yes @vibelord/lanes@<release> --server --update-only`. A last run
+# that ended `partial` gets its post-commit again first (once per release from here). A checkout install, an update
+# already running and an older or rolled-back release are a line in the journal and exit 0 (plan W9 U3, LNS-91).
+ExecStart="@REPO@/bin/lanes" update --timer
+# A oneshot has no start timeout by default. The update's own bounds are npx (50 min) and each post-commit step (300 s);
+# this one stops a run wedged anywhere else. A stop is SIGTERM to every process of the run: the installer records it.
+TimeoutStartSec=1h
+Nice=5
+Slice=lanes.slice

package/payload/lanes/systemd/lanes-update.timer

@@ -0,0 +1,17 @@
+[Unit]
+Description=lanes: look for a newer npm release 15 min after boot, then every 30 min (enabled by the server install)
+
+[Timer]
+# Enabled by every full server install (install/host-install.sh) with the other timers. OnBootSec= is already in the
+# past on a running host, so enabling it starts one check at once — refused while that install still holds the run lock
+# (~/.local/state/lanes/update/.lock), harmless after it (the release just installed is the newest, or the next one is).
+OnBootSec=15min
+OnUnitActiveSec=30min
+RandomizedDelaySec=5min
+# Persistent= acts only on OnCalendar= timers (systemd.timer(5)): a host that was off misses no check here because
+# OnBootSec= checks 15 min after every boot. Kept as the plan sets it; `lanes update` itself skips a check made less than
+# 20 min before (update.INTERVAL).
+Persistent=true
+
+[Install]
+WantedBy=timers.target

package/payload/lanes/web/README.md

@@ -17,9 +17,11 @@ undoes the client's per-load single-pane start once
 (`laneFullRender`, the client's own `SetMobileRenderPreferences {single_pane: false, fit: true}`), so a desktop
 view's sidebar shows beside its lanes. `tests/web/activation.test.mjs` (`node --test`) pins the activation matrix,
 the picker model and that render preference; `tests/unit/test_web_view.py` pins the size budgets and runs that
-suite when node is installed. After an upgrade,
-check that `__zjMobileUi`, `__zjSendControl`, `__zjSoftKbdCapture`, `__zjSyncInactiveCursorStyle` and `window.term`
-still exist in the served `app.js`.
+suite when node is installed; `tests/web/phone.test.mjs` boots `mobile.js` as a phone against a fake page and
+client and records every frame it sends (input v2's bytes, keyboard, clipboard, dock and menu; cockpit v3 S5's filter
+Esc and prompt quick row; `test_web_view.PhoneKeys` names S5's tests and counts the file's). After an upgrade,
+check that `__zjMobileUi`, `__zjSendControl`, `__zjSoftKbdCapture` (with `sendFn` = `websockets.sendAnsiKey`),
+`__zjSyncInactiveCursorStyle` and `window.term` still exist in the served `app.js`.
 
 The phone keyboard opens through a native tap on an input field. The bottom **Type here** field contains
 Zellij's original capture input in its closed shadow root, preserving its keyboard/IME handling. The client
@@ -30,7 +32,11 @@ The guard is installed before Zellij's first terminal or login modal: otherwise
 touchstart, touchend, click and server `SetSoftKeyboard` messages. The **Type here** field keeps the original input
 and its event handlers inside the closed shadow root (including its protection from password-manager extensions) and
 makes it a real, tappable field instead of a 1 px invisible focus target; keystrokes appear in the terminal and its
-internal padding/history stays invisible. Upstream cancels `pointerdown` on the extra keys, which also suppresses
+internal padding/history stays invisible. Upstream creates that input as `type="password" autocomplete="new-password"`
+(to switch off prediction); shown to the user, that gave iOS a secure-entry keyboard and the strong-password bar
+(DEF-1734), so the shell makes it `type="text" autocomplete="off" autocapitalize="none"` and keeps upstream's
+`autocorrect="off"`, `spellcheck="false"`, `inputmode="text"` and the `data-*ignore` attributes. Upstream cancels
+`pointerdown` on the extra keys, which also suppresses
 their touch click in Safari, so the shell cancels `mousedown` instead: typing focus is kept while the native click
 still activates CTRL, the arrows and the other keys. The shell attaches only once server state has arrived — resizing
 before the control socket opens makes 0.45.1 throw `InvalidStateError` and leaves the server with the old size.
@@ -46,7 +52,9 @@ Run `lanes web <device> --token` on the server (it also adds that Tailscale Serv
 `lanes-launch web phone|laptop` from an installed client, or `sh install/enable-phone.sh --host lanes` (`--local` on
 the server).
 The [installation guide](../docs/INSTALL.md) covers Caddy, Tailscale operator permission and the selected SSH key.
-Service registration supplies `LANES_REPO` so Caddy serves the actual checkout from any installation path.
+Service registration supplies `LANES_REPO` — the `~/.local/share/lanes/current` link, which names the installed
+tree (W9 U1) — so Caddy serves that tree from any installation path, and the files an update brings as soon as
+the link moves; the routes of a new Caddyfile take a restart of `lanes-mobile` (the server installer does it).
 
 `index.html` keeps the upstream asset integrity hashes. When upgrading Zellij, compare the HTML and
 window hooks against the new version before changing the pinned binary. The mobile JS and CSS have
@@ -60,12 +68,112 @@ is stored locally. Minimum touch targets are 44 px (workspace cards are 74 px).
 `tests/mobile_view.py` verifies the touch-to-lane path with isolated holders; sidebar unit tests cover the
 complete touch target.
 
-Every byte the shell sends to a terminal goes through `__zjSendControl({type: 'Write', bytes})`
-(`sendToTerminal`); there is no focus-and-type fallback, since the focus guard above would make it type nowhere.
-The lane filter bar sends `Esc /` and the query as UTF-8 (`TextEncoder`), dropping control bytes and DEL.
+### Input, keys and clipboard (phone shell input v2, CAP-142)
+
+Every byte the shell sends to a terminal goes through `send()` to `__zjSoftKbdCapture.sendFn`, which is upstream's
+`websockets.sendAnsiKey`: a text frame on the terminal WebSocket, the path the client's own capture input, ESC/arrow
+bar and xterm `onData` use (an armed CTRL/ALT on the modifier bar therefore applies to a one-character key, through
+upstream's `__zjMobileMergeKey`). Until 2026-10-07 the shell posted `__zjSendControl({type: 'Write', bytes})` on the
+control socket, whose message enum has no `Write` variant: the server logged "Ignoring unknown control message type"
+and dropped every quick key and filter keystroke (DEF-1733). The quick keys send `\r`, `y`, `n`, `\x1b`, `\x03`,
+`\x1b[A`, `\x1b[B` — upstream's own arrow bytes (CSI, never SS3; Zellij re-encodes a key for its pane). With no
+`sendFn` the text is queued and sent by the next `refresh()` (no timer); the pinned client installs `sendFn` together
+with the capture element the shell waits for, so the queue only covers an upstream reordering. A key the socket
+refuses (it throws while not open) is dropped, never replayed later into whatever lane is focused then. There is no
+focus-and-type fallback: the focus guard above would make it type nowhere (DEF-1529).
+
+The lane filter bar never puts an Esc and other bytes in one frame. The server parses each text frame with termwiz,
+which holds a leading ESC while more bytes follow: `\x1b/abc` became one Alt-`/` key whose raw bytes are the whole
+frame, then `a`, `b`, `c` again as keys of their own, so the picker sidebar got `\x1b/abc` + `abc` and filtered on
+`abcabc` — on every keystroke, since the one-frame filter re-sent the whole query each time (DEF-1751, INFERRED from
+the independent review's reading of the Zellij 0.45.1 source; `tests/web/phone.test.mjs` models it). The filter now
+sends only what changed. When the field goes from empty to text: a lone `Esc` frame (it leaves whatever the sidebar is
+in — an open filter, a rename, a close prompt, the key sheet), then, no sooner than 60 ms later, `/` alone and the
+text. After that, one DEL (`\x7f`, which the sidebar's filter takes as backspace, as it does `\x08`) for each
+character of the old query after its common prefix with the new one, then the new query's characters after that
+prefix; an emptied field or the Esc key sends a lone `Esc`. The text is the `TextEncoder` bytes with control bytes and
+DEL dropped, decoded back to text. There is no `setTimeout`: `send()` keeps a pause marker in its queue after a lone
+`Esc` and re-arms the one interval, whose next tick sends what follows once 60 ms have passed. The phone keeps the
+last query it sent (`laneFilterPrev`) and the picker it was typed on (`filterTab`, cockpit v3 S5); once a refresh
+finds another tab current — a lane, or another workspace's picker by the Workspaces sheet — it forgets the query,
+empties the field and drops a filter tail still waiting in the queue, without sending anything: the lane now has the
+focus, and an `Esc` there can interrupt an agent (DEF-1752 here, DEF-1817 on S5's line; the sidebar clears its own
+filter when it opens a lane), and another workspace's picker starts with an empty bar instead of the first one's
+query, whose next letter the deltas would have sent there as a bare key (DEF-1820). The lone `Esc` of an emptied
+field or of the Esc key, and the one a picker left filtered is owed, go through one debt (`owed`, picker tab names):
+`updateLaneFilterBar` sends it only while the picker it is owed to is the current tab, so a picker left filtered shows
+its whole list again on its next visit, and an Escape that arrives once the client has already moved on is held,
+never sent into the lane or another picker. Limits: the deltas assume the
+sidebar holds what the phone sent, which each new query's leading `Esc` restores — another client typing into the same
+picker pane, or a character the sidebar does not print (a no-break space, a zero-width joiner), puts them out of step
+until the field is cleared; and an `Esc` while the sidebar's upload strip is armed (`U`) returns the focus to the
+lane, so the `/` and text after it could reach the lane unless the tab change arrives within the pause.
+
+Typing in **Type here**: one character at a time flows through upstream's `input` handler unchanged (a diff of the
+field against its no-break-space padding, with an 8 ms duplicate filter for the two `deleteContentBackward` events one
+backspace fires). A text field brings back QuickType, whose multi-character inserts would lose a repeated letter to
+that filter (`hello` → `helo`). The shell therefore cancels two cancelable `beforeinput` types and sends their text
+whole: `insertText` longer than one character, and `insertReplacementText` of any length. The text is `data`, or
+`dataTransfer.getData('text')` where an engine leaves `data` null. A replacement first sends one DEL per character it
+replaces: the length of `getTargetRanges()[0]` (its `endOffset − startOffset` in the field) — iOS accepts a QuickType
+suggestion over a partial word with a caret, not a selection, and names the replaced range there — else the field's
+selection, else nothing (DEF-1753; before, only the selection was read, so a caret replacement sent `hehello`). Every
+other type stays upstream's or another handler's: a composition (`insertCompositionText`, which the Input Events spec
+makes uncancelable, and `insertFromComposition`) is upstream's diff, a paste is the `paste` handler's, a delete is a
+key. Caveat, unverified on a device: an engine that names neither the range nor a selection gives the terminal the
+partial word and then the suggestion (`hehello`); delete by hand or type without the suggestion bar.
+
+Paste: a `paste` on the field is cancelled and its `text/plain` sent as ONE bracketed paste — `\x1b[200~`, the text
+with `\r?\n` as `\r` and every end marker neutralised, `\x1b[201~` — so upstream's per-character path, which collapsed
+`ll` to `l` and stripped the newlines (DEF-1735), never sees it. Only the end marker is touched: each run of ESCs
+directly before `[201~` is removed (a run, so `\x1b\x1b[201~` or `\x1b[20\x1b[201~1~` cannot reassemble one), so the
+clipboard cannot end the bracket early and run the rest as typed keys, while a deliberate ANSI paste keeps its other
+escape sequences (until DEF-1755 every ESC was removed). On a picker tab there is no paste: the picker sidebar turns
+on bracketed paste to take file drops and reads any paste as one (text says `that was not a file drop`; a pasted path
+becomes an upload attempt), so the header's **Paste** is hidden there and a paste into **Type here** is cancelled,
+sends nothing and says `Open a lane to paste` (DEF-1754). Explicit markers rather than xterm's `term.paste` (also
+reachable, as `window.term`): `term.paste` brackets only when the server has turned on xterm's bracketed-paste mode,
+which nothing in this tree shows; Zellij reads the markers as a paste and removes them for a pane that has not asked
+for bracketed paste.
+
+**Copy** and **Paste** sit in the header beside **More** (nine 44 px quick keys do not fit a 390 px phone, so the row
+keeps its seven). Copy writes the terminal's selection when xterm has one, else the visible rows of
+`window.term.buffer.active` (`translateToString(true)` per row, trailing blank rows dropped), with
+`navigator.clipboard.writeText` called inside the tap: Safari refuses a write outside a user gesture, which is why the
+client's clipboard add-on (OSC 52) and copy-on-select never reached the phone — upstream cancels `touchstart`, a drag
+scrolls and a long press is a right click (DEF-1736). The buffer is the only text source: `initTerminal` loads xterm's
+WebGL renderer (`addon-webgl`), so the DOM holds no row text. The copy is the whole visible screen, Zellij's frames
+and bars included. Paste calls `navigator.clipboard.readText()` inside the tap (iOS shows its own Paste confirmation)
+and sends the text through the bracketed path above; it is hidden on a picker tab. Both cancel `mousedown`, so an open
+keyboard stays open. The header subtitle says `Copied`, `Pasted` or `Clipboard blocked` (no clipboard API, or a
+refusal).
+
+Hints (`Hold to send` and the clipboard results) hold the header subtitle for eight ticks of the one 200 ms interval:
+`hint()` re-arms it, `tick()` counts down, restores the subtitle through `refresh()` and clears the interval again,
+and `refresh()` leaves the subtitle alone while a hint is up (before, the next `MobileState` refresh overwrote it at
+once, DEF-1739). **More** toggles: upstream's capture-phase `pointerdown` hook closes an open menu before the button's
+click, which then reopened it (DEF-1738), so a window capture-phase `pointerdown` listener records whether the menu was
+open and the click then leaves it closed. On a picker tab the dock shows the filter bar and hides **Panes** (a picker
+tab has one pane, and upstream's pane list duplicates the picker): four items for the four grid columns, where five
+wrapped **Type here** below the fixed-height dock (DEF-1737).
+
+The pinned `app.js` facts this section relies on (`sendFn` = `sendAnsiKey`, the capture input's attributes and
+handlers, the menu dismiss hook, `window.term`, the WebGL addon) were read on 2026-10-07 from the asset embedded in
+the zellij 0.45.1 release binary: the bytes between the `app.js` and `auth.js` names in its asset table hash to this
+`index.html`'s SRI pin (sha384 `zEYVY/2Dhk…`). `tests/web/phone.test.mjs` runs `mobile.js` against a fake page shaped
+on those facts (`node --test`, no jsdom).
+
 Attention counts come from the picker sidebar's pane title (`WS · ◆1 ◇2 ▸6`, written by the sidebar as OSC 2):
 `parseCounts` (also `window.__lanesParseCounts`) feeds the picker subtitle, `document.title`, the Lanes button's
 `data-count` and the workspace cards, inside the existing `refresh()` / `renderCards()` — no fetch, file or timer.
+The shell makes one request (W9 V3, LNS-85): once per page load, when it builds, `installFontControls()` asks
+`/enrol/site` on the same origin (the `/enrol/*` route above; the enrolment service's `GET /site` answers
+`{alias, host_name, host_key, version, request_mode, caller, source}`) and shows its `version` as the first row of
+the client's **More** menu, **Lanes v1.2.0**, above **Text size** — the same `.lanes-font-controls` row, so no CSS.
+Only a release is shown (`^\d[\w.+-]{0,31}$`, as text): `dev`, anything else, an error answer, a non-JSON 502 while
+the service is down, or no network shows nothing and throws nothing. The version is the enrolment service's tree
+(the server installer restarts it on every install). `tests/web/version.test.mjs` boots `mobile.js` against a fake
+logged-in page to pin this; `test_web_view` pins one fetch, inside `installFontControls()`, which `build()` runs once.
 Until plan Task 26 (2026-10-04) this reader was inert (DEF-1531): `bin/lanes` `mobile_workspace_tab` gave the
 picker pane a fixed `name="Lanes"`, and Zellij reports a pane's layout name instead of its OSC 2 title, so
 `pickerTitle()` read `Lanes`, `parseCounts` returned null and the shell showed no counts ("Choose a lane to continue").
@@ -74,9 +182,15 @@ phone device keeps the old picker pane until `lanes rebuild <device>` (`upgrade-
 `lanes doctor` names such a device). Whether the OSC 2 title now reaches
 `panes[].title` is still unchecked in a browser (no WebKit pass has run; fallback: the counts stay in the
 sidebar header). The quick-key row (`⏎ y n Esc ^C ↑ ↓`, `.lanes-quick`) shows on view
-tabs only; `refresh()` sets `--lanes-quick` (48 px or 0), which the terminal height subtracts. `n` and `^C` send
-only when `pointerup.timeStamp − pointerdown.timeStamp ≥ 400` (no `setTimeout`); the buttons cancel `mousedown`
-so a tap never moves focus.
+tabs; on the picker tab it shows only while the sidebar asks for a key (a close, the Register confirmation or Add to
+workspace, which the sidebar announces by ending its pane title with ` · › <verb>`, ` · > <verb>` under ASCII glyphs;
+DM-LANES-SIDEBAR-TITLE), and then only `⏎ y Esc` (cockpit v3 S5) — `^C`, `n` and the arrows have no use in a prompt.
+A name field (Rename, Register as) is never announced: there `y` is a letter of the name (DEF-1819). `refresh()` sets
+`--lanes-quick` (48 px or 0), which the terminal height subtracts. `n` and `^C` send
+only when `pointerup.timeStamp − pointerdown.timeStamp ≥ 400` (no `setTimeout`); `pointercancel` and `pointerleave`
+disarm a key, and a `pointerup` without the key's own `pointerdown` sends nothing (before, a cancelled hold stayed
+armed, so a pointer released over `^C` later sent it, DEF-1739). The buttons cancel `mousedown` so a tap never moves
+focus.
 
 Colour (spec §6.3; the operator legend, token table and phone mockup are in [`docs/DESIGN.md`](../docs/DESIGN.md)):
 `mobile.css` uses only the generated `--lanes-*` tokens (legacy names such as `--lanes-bg` stay
@@ -90,46 +204,114 @@ chaining `window.__zjSyncInactiveCursorStyle`, which the pinned `app.js` calls i
 assigning the server theme wholesale (`SetConfig` is sent on each config-file reload). The handler then runs
 `applyTerminalBackground`, which writes the dark background inline on `<body>` and `#terminal`; the stylesheet's
 `!important` `--lanes-surface` rule for those two elements outranks it in either variant. An SRI bump of `app.js`
-re-opens this contract: re-read `startWsControl` and `installSoftKeyboardCapture` before accepting it.
-`index.html` carries one `theme-color` per colour scheme. Bundle budget (spec §8, `test_web.test_bundle_growth`):
-`mobile.css` ≤ 18 982 B and `mobile.js` ≤ 22 174 B; the caps are never raised — the rules sit one per line and the
-explanations live here rather than in the shipped files. MEASURED 2026-10-04 with `wc -c` after LNS-31 (plan Task
-31) met Tasks 13/28: `mobile.js` 21 964 B (23 268 B before its comments moved to Code notes below) and `mobile.css`
-18 945 B. A laptop or tablet also fetches `browser.js` (3 641 B) and `browser.css` (1 947 B); `test_web_view` pins
-that download at `LAPTOP_TABLET_JS_RATCHET` and `LAPTOP_TABLET_CSS_CAP` (DEF-1569).
+re-opens this contract: re-read `startWsControl`, `installSoftKeyboardCapture`, `initWebSockets` (`sendAnsiKey`) and
+`installMenuDismissHook` before accepting it.
+`index.html` carries one `theme-color` per colour scheme, each that variant's `surface` token, and the manifest's
+`background_color` and `theme_color` are the dark `surface`; they are hand-written, so `test_tokens.GeneratedSurfaces`
+holds them to the table (cockpit v3 P5). The icon (`icon.svg`, `icon-192.png`, a raster with anti-aliased edges) is
+the brand mark, drawn before the token table and not generated: palette v2 did not recolour it, and its bars keep
+v1's dark accent. Bundle budget (spec §8, `test_web.test_bundle_growth`):
+`mobile.css` ≤ 18 982 B and `mobile.js` ≤ 24 612 B; the rules sit one per line and the explanations live here rather
+than in the shipped files. MEASURED 2026-10-04 with `wc -c` after LNS-31 (plan Task 31) met Tasks 13/28: `mobile.js`
+21 964 B (23 268 B before its comments moved to Code notes below) and `mobile.css` 18 945 B. A laptop or tablet also
+fetches `browser.js` and `browser.css` (1 947 B); `test_web_view` pins that download at `LAPTOP_TABLET_JS_RATCHET` and
+`LAPTOP_TABLET_CSS_CAP` (DEF-1569).
+
+The two lines that met at the cockpit v3 main sync (D2, LNS-99, 2026-10-07). On `wave/lanes-cockpit-v3`: after
+cockpit v3 S5 (the filter's Esc, the prompt quick row) `mobile.js` 22 164 B, and `browser.js` 3 334 B (3 641 B before
+its comments moved to Code notes below, to keep that download inside the ratchet, then pinned at 25 498 B); after S5
+fix cycle 1 (the Esc owed to the picker it was typed on) `mobile.js` 22 162 B and the ratchet 25 496 B. W9 V3's
+release row (+257 B of code; `mobile.js`'s line-1 pointer comment moved here first) measured 22 164 B on its own
+track; the fan-in of the two tracks measured 22 362 B, over §8's 22 174 B, and paid for it inside `mobile.js` with
+equivalent code — the four viewport properties through one setter, one `fill` style shared by the typing field's
+host and capture, the Workspaces icon's four squares drawn from their corners: 22 153 B, the download 25 487 B. On
+`bwtools/main`: the JS cap was spec §8's 22 174 B until phone shell input v2 (2026-10-07, DEF-1733): the working send
+path, the text keyboard, paste, Copy and Paste, the dock, More and hint fixes grew `mobile.js` to 23 456 B MEASURED
+after the dead `Write` path, the redundant focus/blur `is-typing` listeners and the file's header comment were
+removed and the new code was written compactly (`kbd()`, `aria()`), so the cap rose by exactly 1 282 B to that size
+(`mobile.css` unchanged); the independent review's fixes the same day (the filter's Esc-free frames and deltas,
+replacement ranges, no paste on a picker, only the paste end marker neutralised; DEF-1751..DEF-1755) grew it to
+24 258 B MEASURED, and the cap and the ratchet (27 899 B: 25 605 B plus the same 1 492 + 802 B) rose by exactly those
+802 B again. The composed file — input v2's frames, deltas, Copy/Paste and dock, plus S5's per-picker Esc debt and
+prompt quick row and W9 V3's release row, the branch's equivalent rewrites applied to the code both kept —
+MEASURED `mobile.js` 24 612 B (+354 B over input v2) and the download 24 612 + 3 334 = 27 946 B: the phone cap rose by
+those 354 B and the ratchet by 47 B (354 less the 307 B `browser.js` had already shed), each to the measured size
+(`test_web_view.JS_COCKPIT_V3`, `LAPTOP_TABLET_JS_RATCHET`), and all four cap assertions red on one byte more.
 
 ## Code notes
 
 `mobile.js` carries no explanations (the spec §8 budget above); each note is keyed to the code it explains, in file
 order.
 
-- The file: the Lanes browser shell (phone, tablet, desktop) over the pinned Zellij 0.45.1 client's window hooks.
+- The file: the Lanes browser shell (phone, tablet, desktop) over the pinned Zellij 0.45.1 client's window hooks. Its
+  explanations are these notes (the file's line-1 pointer to them moved here too, W9 V3).
 - `root.dataset.lanesShell = mode`: read by `browser.js` for the desktop bar and the tablet's full rendering.
 - `if (mode !== 'phone')`: appends the laptop/tablet extras (`browser.css`, `browser.js`); a phone never fetches them.
 - `if (mode === 'tablet')`: iPad Safari's user agent is a desktop one, so the shell asks for the client's mobile UI
   (`zellij:mobile-ui` set to `on`); a stored `off` stays.
 - The `HTMLElement.prototype.focus` guard: only a native tap on an input may open the keyboard; it is installed before
   upstream's first terminal or modal.
+- `kbd()` / `aria()`: `window.__zjSoftKbdCapture` and an `aria-label` setter, shared to keep the phone budget.
 - `viewport()`: browser toolbars alone must not mean keyboard mode (`occluded` needs more than 120 px hidden). Zellij's
   input is in a closed shadow root, so `document.activeElement` is its host; `__zjSoftKbdCapture.isFocused` is read
   first.
-- `buildTypingField()`: upstream's capture input stays in its closed shadow root and becomes the real, tappable field.
+- `setKeyboard()`: also the one place **Type here** gets `is-typing`, driven by upstream's own focus/blur listeners
+  (they set `isFocused` and fire `zellij:soft-keyboard-visibility`); the field's own focus/blur listeners were redundant.
+- `buildTypingField()`: upstream's capture input stays in its closed shadow root and becomes the real, tappable field:
+  a text input (DEF-1734); `beforeinput` sends a multi-character `insertText` or any `insertReplacementText` whole,
+  after one DEL per character of `getTargetRanges()[0]` or else the selection (DEF-1753); `paste` sends one bracketed
+  paste (DEF-1735). See Input, keys and clipboard above.
 - `GLYPHS` / `parseCounts()`: counts from the picker sidebar's OSC 2 pane title (spec §6.4).
+- `build()`, the header: the window capture-phase `pointerdown` listener records `menuWas` before upstream's dismiss
+  hook runs, so **More** closes an open menu instead of reopening it (DEF-1738); **Copy** and **Paste** (DEF-1736).
 - `build()`, the `.zj-mobile-modbar` keys: cancel `mousedown`, not `pointerdown` (upstream's `pointerdown` cancel kills
   Safari's touch click on the extra keys).
+- `send()`: the terminal socket through `sendFn` (DEF-1733); queued only while `sendFn` is absent, never after a throw.
+  A `null` in the queue is a pause: what follows waits until 60 ms after the last frame sent (`sentAt`), and `send()`
+  re-arms the one interval to come back (DEF-1751).
+- `paste`: the bracketed paste through `send()`, its end markers neutralised (DEF-1755); nothing on a picker tab, where
+  the sidebar reads a paste as a file drop (DEF-1754).
+- `applyLaneFilter()`: the filter's UTF-8 query as deltas against `laneFilterPrev` — a lone Esc, a pause, `/` and the
+  text for a new query; DELs and the added text for an edit; a lone Esc and a pause to clear (DEF-1751).
+- `clip()`: calls the clipboard API synchronously inside the tap (Safari's user-gesture rule) and hints the result.
+- `screen()`: xterm's selection, else the visible rows of `term.buffer.active` (the WebGL renderer leaves no DOM text).
+- `hint()`: holds the subtitle for eight ticks of the one interval (DEF-1739).
 - `buildQuickRow()` (spec §6.5): `n` and `^C` send after a 400 ms hold, measured from event timestamps with no timer;
-  nothing takes focus.
-- `clearLaneFilter()`: the lone `Esc` leaves the sidebar's filter mode.
+  a cancelled or left key is disarmed and a release needs the key's own press (DEF-1739); nothing takes focus.
+- `clearLaneFilter()`: forgets the query and owes its picker (`filterTab`) the lone `Esc` that leaves the sidebar's
+  filter mode (`owed`, a set of picker tab names). `updateLaneFilterBar(tab, isPicker)`, on every refresh: once the
+  current tab is not the one the query was typed on, a filter tail still waiting in the queue is dropped and the query
+  cleared, sending nothing (the lane may have the focus now, DEF-1752); the lone `Esc` and its pause are sent only when
+  the current tab is an owed picker; then `filterTab` becomes the current tab if it is a picker. Escape in the bar and
+  an emptied field clear and call `refresh()`, so the `Esc` goes out at once while that picker is still current.
 - `lanesTheme()`: the shell's own terminal palette for both variants (spec §6.3, DEF-1413).
+- `refresh()`: leaves the subtitle to a live hint, hides **Panes** (and **Paste**, DEF-1754) on a picker tab so the
+  dock's four columns hold its four items (DEF-1737), and flushes the `send()` queue after `updateLaneFilterBar()`, so a
+  filter tail is dropped before it could reach a lane; `quick` is `true` on a view tab (every key), `2` on the picker
+  while its title ends ` · › <verb>` (only `⏎ y Esc`), else none.
+- `menuRow()` / `installFontControls()`: a row of the client's **More** menu, prepended (Text size, then the release
+  above it once `/enrol/site` answers). The one `fetch` is there because `build()` runs once per page load.
 - `connect()`: waits for server state, because an earlier resize throws `InvalidStateError` in 0.45.1. `applyTheme` is
   re-applied after every `SetConfig` (the client calls the chained `__zjSyncInactiveCursorStyle` hook) and on the theme
   toggle.
 - The `zellij:soft-keyboard-visibility` listener: rotation also shrinks the viewport, so the shell sends
   `SoftKeyboardVisibilityChanged` itself to correct upstream's height-only keyboard heuristic.
-- `awaitingClient` (the one `setInterval`, 200 ms, cleared once attached): upstream installs its window hooks just after
-  appending its mobile root.
+- `tick()` / `arm()` (the one `setInterval`, 200 ms): polls `connect()` until attached, because upstream installs its
+  window hooks just after appending its mobile root; `hint()` and a paused `send()` re-arm it; each tick flushes the
+  queue, and it clears itself once attached, with no hint up and no pause waiting.
+
+`browser.js` (laptop/tablet extras) carries none either, since cockpit v3 S5:
+
+- `laneFullRender()`: the client starts a tablet in single pane on every load; once, it sends the client's own
+  switch-to-desktop preference.
+- `desktop()`: the chip toggles an overlay bar (no refit); a pick sends the phone picker's `FocusPane`. The chip
+  cancels `mousedown`, so the terminal keeps the keys.
+- `ui()`: `window.__zjMobileUi` is set synchronously after the client appends its mobile root, which the
+  `MutationObserver` on `<body>` waits for.
 
 Validate on Safari/WebKit at 440 × 763 (iPhone 17 Pro Max with browser chrome), 440 × 956 (Home Screen),
 838 × 390 (landscape Safari), and smaller phone widths. Check login, workspace search and switching,
-lane selection, pane navigation, font controls, rotation and the visible viewport while the keyboard opens.
+lane selection, pane navigation, font controls and the release row in **More**, rotation and the visible viewport
+while the keyboard opens, and the input checklist in the [runbook](../docs/RUNBOOK.md) (text keyboard, quick keys,
+paste, Copy and Paste, the picker's filter and prompt row).
 Use disposable view sessions and revoke any temporary test token afterward.

package/payload/lanes/web/browser.js

@@ -1,4 +1,4 @@
-/* LNS-31 laptop/tablet extras; see docs/ARCHITECTURE.md (Web and phone). */
+/* Lanes laptop/tablet extras; see web/README.md, Code notes */
 function laneBarModel(d) {
   const panes = (d?.panes || []).filter(p => !p.is_plugin), at = d?.active_pane || {}, ws = new Map();
   const first = t => t && panes.find(p => p.tab_position === t.position);
@@ -14,7 +14,6 @@ function laneBarModel(d) {
       .map(p => item(p.title || `Pane ${p.pane_id}`, p))].filter(Boolean),
   };
 }
-// Tablet: upstream starts single pane on every load; once, send its own switch-to-desktop prefs.
 function laneFullRender(api, send) {
   let done;
   return () => {
@@ -41,7 +40,6 @@ if (typeof module === 'object') module.exports = {laneBarModel, laneFullRender};
     const full = laneFullRender(api, send);
     return () => full() && dispatchEvent(new Event('zellij:rendering-resize'));
   };
-  // Desktop: the chip toggles an overlay bar (no refit); picks send the phone picker's FocusPane.
   const desktop = api => {
     let last;
     const picks = ['Workspace', 'Lane'].map(title => make('select', {title, onchange() {
@@ -61,13 +59,13 @@ if (typeof module === 'object') module.exports = {laneBarModel, laneFullRender};
       render();
       window.term?.focus();
     }});
-    chip.addEventListener('mousedown', ev => ev.preventDefault());   // the terminal keeps the keys
+    chip.addEventListener('mousedown', ev => ev.preventDefault());
     bar.addEventListener('keydown', ev => ev.key === 'Escape' && focus());
     bar.append(...picks);
     document.body.append(bar, chip);
     return render;
   };
-  const ui = () => window.__zjMobileUi;   // set synchronously after the client appends its mobile root
+  const ui = () => window.__zjMobileUi;
   if (ui()) return ready(ui());
   new MutationObserver((_, o) => ui() && (o.disconnect(), ready(ui()))).observe(document.body, {childList: true});
 })();

package/payload/lanes/web/mobile.css

@@ -3,20 +3,20 @@ html.lanes-mobile {
   --lanes-surface: #101318;
   --lanes-surface-raised: #191e25;
   --lanes-line: #2c333d;
-  --lanes-accent-wash: #1a2721;
+  --lanes-accent-wash: #1c3326;
   --lanes-accent-line: #4b6955;
   --lanes-press: #26332c;
   --lanes-chip: #ffffff0f;
-  --lanes-ink: #edf1f5;
-  --lanes-ink-dim: #9ca7b5;
-  --lanes-ink-faint: #6b7683;
-  --lanes-accent: #b4e3bf;
+  --lanes-ink: #f2f5f8;
+  --lanes-ink-dim: #a6b1be;
+  --lanes-ink-faint: #6f7a87;
+  --lanes-accent: #8fe3a6;
   --lanes-on-accent: #101318;
   --lanes-on-accent-urgent: #7a1a12;
-  --lanes-tone-urgent: #f28b7d;
-  --lanes-tone-attention: #e5b84a;
-  --lanes-tone-working: #7fb3f2;
-  --lanes-tone-done: #6fd39a;
+  --lanes-tone-urgent: #ff7b6e;
+  --lanes-tone-attention: #ffc233;
+  --lanes-tone-working: #6fb6ff;
+  --lanes-tone-done: #5fdc8a;
   --lanes-scrim: #000000a6;
   --lanes-shadow: 0 -16px 80px #0007;
   color-scheme: dark;
@@ -29,16 +29,16 @@ html.lanes-mobile:root[data-zj-theme="light"] {
   --lanes-accent-line: #acc9b4;
   --lanes-press: #d8e9db;
   --lanes-chip: #edf3ec;
-  --lanes-ink: #17241b;
-  --lanes-ink-dim: #56616d;
-  --lanes-ink-faint: #7f8a96;
-  --lanes-accent: #2f6b45;
+  --lanes-ink: #111a14;
+  --lanes-ink-dim: #4a5661;
+  --lanes-ink-faint: #6f7b87;
+  --lanes-accent: #1f6f3f;
   --lanes-on-accent: #ffffff;
   --lanes-on-accent-urgent: #ffd3cc;
-  --lanes-tone-urgent: #b7322a;
-  --lanes-tone-attention: #8a5a00;
-  --lanes-tone-working: #2456a8;
-  --lanes-tone-done: #1b7142;
+  --lanes-tone-urgent: #c41c1c;
+  --lanes-tone-attention: #a04d00;
+  --lanes-tone-working: #1a56c4;
+  --lanes-tone-done: #0d7338;
   --lanes-scrim: #1a222b80;
   --lanes-shadow: 0 -16px 80px #0003;
   color-scheme: light;