@vibelord/lanes 1.1.1 → 1.2.0

package/payload/lanes/libexec/sidebar.py

@@ -5,12 +5,43 @@ Shows one workspace's lanes with color, icon and live status. Selecting a lane w
 target file and signals the viewport supervisor; the zellij layout is never touched.
 Fully usable from the keyboard (touch/mouse is a bonus):
   ↑/↓ j/k move · Enter/→/Space open · J/K open next/previous lane · / filter · Esc clear · g/G · r reload
-  2 / 3 open the lane under the cursor in the 2nd / 3rd viewport (wide view sessions) · x / × close (asks y/n)
+  2 / 3 open the lane under the cursor in the 2nd / 3rd viewport (wide view sessions) · x / × close (y, then Enter)
+  u unregister a session added with a (z within 10 s undoes it; a declared lane says which file to edit)
   ? shows every key in the body until the next key · Tab / Shift-Tab open the next / previous lane that needs you
-Attention first: lanes whose agent needs you, is working, or finished unseen sort into sections above the rest; the
-agent glyph sits in column 2, and every row carries an age (agent `since`, else last output). The cursor is a LANE:
-when a lane changes section the cursor goes with it. The pane title (OSC 2) carries the header counts, and a lane that
+The keyboard goes back to the lane after every action (cockpit v3 S3): the sidebar and the lane share one keyboard, so
+an action that ends — a close, a rename, a register, a cancel, Esc, r, closing the key sheet, a click that opened
+nothing — moves the focus to this pane's viewport once, and the rest of that read was typed for the lane (dropped).
+A prompt, the filter and the armed upload strip keep it; the wheel and a mouse release never move it.
+While the keyboard is here the footer legend says so (cockpit v3 S4): ` ▌ keys go to sidebar · Esc → lane`, from
+Zellij's focus reports (`?1004h`), else for 3 s after a key. Ctrl-Alt-/ and Ctrl-Alt-u (from anywhere in the tab)
+type nothing: they move the focus here and `lanes sidebar-key` leaves views/<device>/<ws>.sidebar.cmd, which starts
+the filter / arms the upload strip (reload()'s stamp, and before the next read of keys). Ctrl-Alt-l only focuses.
+One prompt at a time (cockpit v3 S6): `self.prompt = {verb, entry, stage, value, armed}` — a name field (` › Rename:
+value█`) or a confirmation (` › close ‘sh’ — y⏎ confirm · Esc cancel`) — and ONE footer_text() for the desktop and
+the phone. No prompt outlives the keyboard (S6 fix cycle 1): a click on the list ends it before it acts, a name field
+types nothing for an arrow / Tab / Shift-Tab / PageUp / PageDown, and hand_off() closes one still open.
+What an action says in the footer lasts 3 s, or until the next action begins; never just until a key.
+Attention first: lanes whose agent needs you, is working, or finished unseen sort into sections above the rest, each in
+the order its lanes entered it (statusd's `stable_since`); the agent glyph sits in column 2, and every row carries an
+age (agent `since`, else last output). The cursor is a LANE: when a lane changes section the cursor goes with it and
+the list itself does not scroll. The pane title (OSC 2) carries the header counts, and a lane that
 starts needing you raises one desktop notification (OSC 9), both inside the frame's one write — no fork.
+Per person (cockpit v3 R3): on a device with an owner the look and the opened-lane marks are that person's, shared by
+every device they own through users/<login>.json — the profile's mtime is the stamp's seventh field, so a Done lane
+opened on the phone leaves Done here, and a look recorded there repaints here, on the next tick. Only the look keys a
+device file marks as its own (`--device-only`, its `device_only` list) win for that device; a key from before the
+profile paints only where the profile sets none. A device nobody owns never touches a profile.
+Pins and hidden lanes (cockpit v3 R5): the profile's `lanes{pins, hidden}`. A hidden registry lane leaves the list, the
+header counts and the notifications (never a divider, never a session listed under Unregistered: nothing alive is
+ever hidden), until `o` shows the hidden ones again, faint; a pinned lane leads its section with the ▲ mark and the body
+never lets it fall below `⋮ N more`. `p` pins / unpins, `h` hides (or shows again), `H` hides this workspace (y, then
+Enter: `lanes upgrade-session` closes its tab on every device of the person), `o` toggles the hidden lanes.
+Which lanes (cockpit v3 V2): the `?` sheet's first row is `  lanes <installed> · view <this tree>`; while an update has
+flipped `current` to another tree than the one this sidebar runs, the footer's rung below the health banner says
+` server 1.2.0 · view 1.1.0 — press ?`. `current/VERSION` is read at start and every 30 s inside reload(), never per tick.
+Self-swap (cockpit v3 U5): a sidebar started through `current` that finds the installed version changed swaps onto it
+as soon as it is idle — it saves views/<device>/<ws>.<slot>.sidebar.state {cursor_id, top, seen, filter} and exits 75;
+the wrapper re-executes itself from `current` at once and the new sidebar takes the state (a ~100 ms repaint).
 Upload strip (one row above the footer): click it or press U (Ctrl-Alt-u from anywhere), then DROP FILES anywhere
 on the window. A terminal delivers a drop as a paste of the LOCAL path into the focused pane, so the strip must have
 focus first; the file itself is then sent by the upload helper on your machine (it only reads folders you allowed
@@ -19,10 +50,13 @@ there). Below it, when there is room, the strip row: the fleet economy line from
 one tail cell by priority: stale `?` > starving ⚠ > downgraded ↓ > mostly paid `$`.
 Truthful under load: a lane statusd could not observe keeps its last glyph, dimmed, with a `?`; the footer line warns
 when the host is under pressure or statusd has fallen behind (age of $STATE/health, measured with our own clock).
+Never frozen by an action (cockpit v3 S9): a close, `P`'s write and a new shell run on one worker thread (Worker); the
+row they act on carries the dim `pending` mark and takes no key until run()'s tick takes the answer (finish_actions).
 Run via libexec/sidebar (a loop), so it never leaves its pane empty.
 """
 import json
 import os
+import queue
 import re
 import select
 import shlex
@@ -30,6 +64,7 @@ import signal
 import subprocess
 import sys
 import termios
+import threading
 import time
 from operator import itemgetter
 from pathlib import Path
@@ -38,9 +73,11 @@ import unicodedata
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import lanes_lib as L  # noqa: E402
+import agent_state as AS  # noqa: E402
 import session_actions as A  # noqa: E402
 import registrations as R  # noqa: E402
 import tokens  # noqa: E402
+import users  # noqa: E402
 
 STATE = os.environ.get('LANES_STATE') or os.path.expanduser('~/.local/state/lanes')
 # What the harness in a lane is doing (statusd's additive `agent{}`, Task 4/5 vocabulary): `key -> (unicode, ascii,
@@ -51,8 +88,23 @@ AGENT_GLYPHS = tokens.AGENT_GLYPHS
 ATTENTION = (('needs', 'Needs you', 'needs_approval', ('needs_approval', 'errored', 'needs_input')),
              ('working', 'Working', 'working', ('working',)),
              ('done', 'Done', 'done', ('done',)))
+# The section headers drawn even while empty (`── ▸ Working (0)`), once the workspace has an agent (cockpit v3 S2): a
+# lane entering or leaving one of them then never adds or removes a header row above the lanes below it. Done is drawn
+# only with a member — it sits below both, so its header coming and going moves no attention row.
+ALWAYS_DRAWN = ('needs', 'working')
+# How the sidebar spends palette v2 (cockpit v3 P2, LNS-70). In the VIVID modes — truecolor and the 256 set, colours
+# Lanes defines — a section's words take the section's tone (its count stays ink-dim), lane names are ink (an identity
+# colour still wins), the age is ink-dim only outside the attention sections, the stream glyph keeps its tone beside an
+# agent (ink-dim only when stale), and the cursor row lies on the `selected` band. 16 colours are the user's own
+# palette, whose slot 3 may be a yellow no light background carries: they keep v1's restraint byte for byte, and
+# `none` has no colour to spend. The section tone is the one the Needs you age has always had (spec §2.3): attention.
+COLOR_MODES = ('truecolor', '256', '16', 'none')
+VIVID = tokens.VIVID   # truecolor, 256 — one definition, shared with view.sh's LZ_VIVID (cockpit v3 P3)
+SECTION_TONE = {'needs': 'tone-attention', 'working': 'tone-working', 'done': 'tone-done'}
 HEADER_COUNTS = ('needs_approval', 'needs_input', 'working', 'done')   # the header's glyph counts (spec §4.3)
-SECTION_OF = {status: key for key, _title, _glyph, members in ATTENTION for status in members}
+# status -> section key (None = the rest): statusd's table (`agent_state.SECTION`, with `RANK` and the `settle` debounce
+# that publishes the statuses this reads, cockpit v3 S1), never a second copy. ATTENTION above draws it in RANK order.
+SECTION_OF = AS.SECTION
 NEEDS_RANK = {status: rank for rank, status in enumerate(ATTENTION[0][3])}
 INF = float('inf')
 # Tones by role name. Each Sidebar resolves its own table per device (`apply_look`, spec §2.4); this 16-colour table
@@ -70,6 +122,75 @@ NEEDS_YOU = ATTENTION[0][3]
 OSC_UNSAFE = re.compile(r'[\x00-\x1f\x7f-\x9f]')
 OSC_TEXT_MAX = 200   # characters of one title / notification payload
 OSC11_PREFIX = re.compile(r'\033\](?:1(?:1(?:;(?:r(?:g(?:b(?::[0-9A-Fa-f/]{0,14})?)?)?)?)?)?)?(?:\033)?$')
+# Focus reports (cockpit v3 S4): start_bytes() asks for them (`?1004h`) and Zellij 0.45.1 forwards them to the pane —
+# `ESC [ I` when this pane gains the focus, `ESC [ O` when it loses it (measured 2026-10-06). handle() takes them out
+# of every read before the keys: a report is never a key.
+FOCUS_REPORT = re.compile(r'\033\[([IO])')
+# While Zellij has sent no report, the footer says the keyboard is here for this long after a key (a key reaches only
+# the focused pane); once one has arrived the reports decide.
+FOCUS_LEGEND_S = 3.0
+# A footer message (` Closed sh`, ` Cancelled`, why a close failed) lasts this long, measured on run()'s 1 s tick
+# (expire_message), or until the next action begins (begin_action) — never just until the next key (cockpit v3 S6).
+MESSAGE_S = 3.0
+# `u` on a session added with `a` unregisters it at once (cockpit v3 S7): the row moves to Unregistered, the footer
+# offers ` Unregistered ‘name’ · z undo`, and `z` registers it again for this long after (expire_undo, on the 1 s tick).
+UNDO_S = 10.0
+# `P` (cockpit v3 S8) writes terminals.json and starts `lanes sync`; the row stays listed with the `pending` mark until
+# the registry lists its lane (settle_pending). One the registry has not listed PENDING_S after `P`, once the sync the
+# sidebar started has ended, lets go (expire_pending, on the 1 s tick). PENDING_S is the latest a sync can still list
+# it, from the bounds where they are enforced (S8 fix cycle 1, DEF-1762; it was 30 s, and a slow docker daemon made a
+# sync on its way look like none): the sidebar's own sync can find the lock held — the 2-minute timer's sync, on a
+# slow docker — and end having published nothing; statusd then starts one on the changed terminals.json at its first
+# post-cycle check the hot-sync rate limit admits — at most HOT_SYNC_EVERY_S, its slowest pause (INTERVAL 3 s ×
+# SLOWDOWN['critical'] 4) and one cycle, which can hold a docker inspect and a probe round (PROBE_TIMEOUT 5 s +
+# PROBE_GRACE 2 s) — and that sync waits for the lock and for docker inspect again. A sync the sidebar started that
+# is STILL running past PENDING_S holds the row too: it is a sync on its way.
+SYNC_S = L.REGISTRY_LOCK_S + L.DOCKER_INSPECT_S                     # 25 s: one `lanes sync`, the lock + docker inspect
+HOT_SYNC_START_S = 10 + 3 * 4 + L.DOCKER_INSPECT_S + 5 + 2          # 49 s: statusd starts it (statusd's constants)
+PENDING_S = HOT_SYNC_START_S + SYNC_S + 6.0                         # 80 s: + the files a sync reads and publishes
+# The slow verbs run on the sidebar's one worker thread (cockpit v3 S9, LNS-67; Worker): until S9 each ran inside the
+# key's handle() and the frame froze for as long as it took — a close waits up to REGISTRY_LOCK_S for the registry lock
+# (statusd's hot sync, the timer's sync, another device) and then up to three tmux answers of 5 s each, a new shell up
+# to 15 s for `docker exec` (plan context item 5, DEF-1763). The row an action is on carries the `pending` mark and
+# refuses every verb until run()'s tick takes the answer (finish_actions); the word that refusal says, by verb:
+PENDING_WORDS = {'close': 'closing', 'promote': 'registering', 'new-shell': 'creating'}
+LANES_BIN = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'bin', 'lanes')
+# The tree this sidebar runs (cockpit v3 V2, LNS-84) is lanes_lib.REPO, resolved — an npm install's
+# ~/.local/share/lanes/pkg/<version>/, whatever `current` pointed at when the process started; the installed release is
+# read through lanes_lib.installed_tree() (the `current` link, whatever it names now) with lanes_lib.tree_version (W9
+# U0's helpers: one reader of a tree's release for the CLI, doctor and the sidebar). The 30 s is how stale the footer's
+# version note may be (plan V2: never per tick).
+VERSION_RECHECK_S = 30.0
+# The tree this process was STARTED through, unresolved (cockpit v3 U5, LNS-93): the wrapper runs "$here/sidebar.py"
+# with its logical directory, so a layout's `…/current/libexec/sidebar` gives `…/current` here. Its realpath differs
+# from lanes_lib.REPO once an update has flipped `current`: only then would the wrapper's re-exec run another tree, and
+# only then does the sidebar exit SWAP_EXIT (a `pkg/<version>` start would re-exec the same tree for ever).
+LAUNCH_TREE = Path(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+SWAP_EXIT = 75                  # EX_TEMPFAIL: libexec/sidebar re-executes itself at once, no pause
+STATE_FRESH_S = 60.0            # a .sidebar.state older than this (by its own `at`) is no swap's: dropped unread
+# The one prompt (cockpit v3 S6): `self.prompt = {verb, entry, stage, value, armed}`. A `name` stage is a text field
+# (` › Rename: value█`); a `confirm` stage is ` › <word> ‘name’ — y⏎ confirm · Esc cancel`. The verb is what the phone
+# title announces (DM-LANES-SIDEBAR-TITLE); the word is what the footer says it does — `P` registers the session.
+PROMPT_FIELDS = {'rename': 'Rename', 'promote': 'Register as'}
+PROMPT_WORDS = {'close': 'close', 'promote': 'register', 'hide': 'hide'}
+# The owner's profile (cockpit v3 R3, LNS-76): users/<login>.json (libexec/users.py) of the person this device belongs
+# to. Opening a lane writes its mark there through users.update, which holds the profile's lock; the CLI waits up to
+# users.LOCK_S (1 s) for it, a sidebar only PROFILE_LOCK_S — every writer holds it for milliseconds (read, merge, one
+# atomic write), so a wait this long means a stuck writer, and the keyboard must not stall behind one. A write that
+# did not get the lock is DROPPED (the mark is already this device's: in memory and in clients/<device>.seen.json) and
+# written again by run()'s tick every PROFILE_RETRY_S until the profile takes it (poll_profile): at most 0.2 s of
+# blocking per 5 s while a writer is stuck, none at all otherwise.
+PROFILE_LOCK_S = 0.2
+PROFILE_RETRY_S = 5.0
+# What `p`, `h` and `H` say on a device nobody owns (cockpit v3 R5): pins and hidden lanes live in the owner's profile.
+NO_PROFILE = 'no owner: lanes device claim'
+
+
+def shown_version(path):
+    """A tree's release as the sidebar paints it (cockpit v3 V2, LNS-84): lanes_lib.tree_version's first line, control
+    characters dropped (a VERSION file never writes an escape into the terminal), at most 32 characters; '' when there
+    is none to read."""
+    return OSC_UNSAFE.sub('', (L.tree_version(path) or '').split('\n')[0])[:32]
 
 
 def age3(seconds):
@@ -168,18 +289,24 @@ MOBILE_LABELS = {'active': 'Active', 'quiet': 'Quiet', 'missing': 'Container off
 
 def resolve_modes(env, meta):
     """(color, theme, glyphs) from the device file first, then the environment, then the defaults of spec §2.4.
-    Pure; an unknown value falls back to the default rather than raising (a hand-edited file must not kill a pane)."""
+    Pure; an unknown value falls back to the default rather than raising (a hand-edited file must not kill a pane).
+    Colour (cockpit v3 P2): truecolor when COLORTERM says `truecolor`/`24bit`, else 256 when TERM says `256color`
+    (xterm-256color, screen-256color, tmux-256color), else 16."""
     meta = meta if isinstance(meta, dict) else {}
     if env.get('NO_COLOR'):
         color = 'none'
+    elif env.get('LANES_COLOR'):
+        color = env['LANES_COLOR']
+    elif env.get('COLORTERM') in ('truecolor', '24bit'):
+        color = 'truecolor'
     else:
-        color = env.get('LANES_COLOR') or ('truecolor' if env.get('COLORTERM') in ('truecolor', '24bit') else '16')
+        color = '256' if '256color' in (env.get('TERM') or '') else '16'
     color = meta.get('color') or color
     theme = meta.get('theme') or env.get('LANES_THEME') or 'auto'
     locale = [env.get(k) or '' for k in ('LC_ALL', 'LC_CTYPE', 'LANG')]
     utf8 = any('UTF-8' in value.upper() or 'UTF8' in value.upper() for value in locale)
     glyphs = meta.get('glyphs') or env.get('LANES_GLYPHS') or ('unicode' if utf8 or not any(locale) else 'ascii')
-    if color not in ('truecolor', '16', 'none'):
+    if color not in COLOR_MODES:
         color = '16'
     if theme not in ('dark', 'light', 'auto'):
         theme = 'auto'
@@ -188,6 +315,44 @@ def resolve_modes(env, meta):
     return color, theme, glyphs
 
 
+def layered_look(profile_look, meta):
+    """devices/<device>.json as resolve_modes and resolve_dim_notify read it on a device with an owner (cockpit v3 R3,
+    LNS-76): the person's profile look over the device file's, except where the device keeps a key for itself. Per key
+    of `theme`, `color` and `glyphs`: the device file's value when its `device_only` list names that key and the value
+    is valid (`lanes attach --device-only`: users.device_only), else the profile's, else whatever the device file holds
+    — an unmarked key from before the profile (a look recorded before the device had an owner, or by a release before
+    R2; `lanes user show` names it and `lanes device claim` folds it into the profile), so it paints only where the
+    profile sets none (R3 review fix, DEF-1782: it used to win over the profile for good). Every other key (`mobile`,
+    `notify`, `dim`, …) is the device file's alone. resolve_modes then puts the environment and the defaults below:
+    device (--device-only) → profile → device (from before) → environment → defaults. Pure. A device nobody owns
+    never comes here (apply_look gets its file unchanged)."""
+    layered = dict(meta) if isinstance(meta, dict) else {}
+    own = users.device_only(layered)
+    for key, allowed in users.LOOK.items():
+        value = (profile_look or {}).get(key)
+        if key not in own and value in allowed:
+            layered[key] = value
+    return layered
+
+
+# The two switches beside the look (cockpit v3 P4, LNS-72, DEF-1577), in the variables' own words: `dim` is the SGR of
+# the 16-colour dim (90, or 2 for a palette whose colour 8 is near the background), `notify` 0 silences OSC 9.
+DIM_VALUES, NOTIFY_VALUES = ('90', '2'), ('1', '0')
+DIM16 = {'90': '\033[90m', '2': '\033[2m'}
+
+
+def resolve_dim_notify(env, meta):
+    """(dim, notify) from the device file's `dim`/`notify` (`lanes attach DEVICE --dim D --notify N`), then LANES_DIM /
+    LANES_NOTIFY (which reach a sidebar through the view server's environment, bin/lanes clean_env), then `90` / `1`.
+    Pure; a value outside the vocabulary is skipped, layer by layer, so the environment keeps its old rule — only `2`
+    dims with SGR 2, only `0` silences — and a hand-edited device file never kills a pane."""
+    meta = meta if isinstance(meta, dict) else {}
+    picked = []
+    for key, variable, values in (('dim', 'LANES_DIM', DIM_VALUES), ('notify', 'LANES_NOTIFY', NOTIFY_VALUES)):
+        picked.append(next((value for value in (meta.get(key), env.get(variable)) if value in values), values[0]))
+    return tuple(picked)
+
+
 def parse_osc11(body):
     """'11;rgb:RRRR/GGGG/BBBB' (1- to 4-digit hex components) -> 'dark'|'light' by relative luminance (< 0.5 dark);
     anything else -> None."""
@@ -275,18 +440,38 @@ def health_banner(health, written, now, warning='⚠', sep=' · '):
 
 
 SLOTS = ['main', 'b', 'c']
+# The target that points a viewport at nothing (cockpit v3 S9 fix cycle 1, DEF-1767): view.sh reads a target outside the
+# lane-id grammar as `No lane selected`, and that screen's wait (connection.py wait_screen) reads keys and discards them.
+# session_actions.clear_viewers writes the same target into every view of a session it has killed; close_lane writes it
+# FIRST into this view's own viewports, before the keyboard moves (empty_views).
+EMPTY_VIEW = '!empty'
 BOX_ROWS = 1    # the upload strip (spec §4.6(d)); it was a four-row box
-# The `?` key sheet (spec §4.7): (key, its seven-bit twin, action), one line per key handle() accepts. A line is
-# `  {key:<10}{action}`: the key field is 10 cells and an action at most 23, so a line is at most 35 cells — the
-# sidebar's row width with column 36 never written. `Tab`/`Shift-Tab` are Task 25's keys.
+# The `?` key sheet (spec §4.7): (key, its seven-bit twin, action). A line is `  {key:<9} {action}`: the key field is 9
+# cells and a blank (10 cells, as `{key:<10}` was, for every key of at most 9 cells; the 10-cell `Ctrl-Alt-l` keeps a
+# blank before its action) and an action at most 23 cells (22 after a 10-cell key), so a line is at most 35 cells, the
+# sidebar's row width with column 36 never written. The sheet is the SHORT form of the user guide's "Sidebar keys"
+# table (cockpit v3 S10, LNS-68): companion keys share a line (`J K`, `Tab S-Tab`, `+ U`, `r ?`), PageUp / PageDown
+# are only in the table, and the last line is the one chord that brings the keyboard here from a lane (`Ctrl-Alt-l`,
+# config.kdl's shared block; lane chords such as Ctrl-Alt-m are no sidebar keys and stay off). 18 lines below the
+# dynamic version row (cockpit v3 V2, LNS-84: `  lanes <current> · view <tree>`, key_sheet) — exactly the 19-row body
+# of a 24-row pane with the strip row; R5's `p h` / `H o` (LNS-78) took the two rows S10 left, and V2's row the line
+# `u z` now share.
+# test_sidebar.DocumentedKeys holds the sheet, the table and handle() to the same keys.
 KEY_SHEET = (('↑ ↓ j k', 'Up Dn j k', 'move'), ('⏎ → Space', 'Enter Spc', 'open the cursor lane'),
-             ('J K', 'J K', 'open next / prev lane'), ('Tab', 'Tab', 'next lane needing you'),
-             ('Shift-Tab', 'Shift-Tab', 'prev lane needing you'), ('2 3', '2 3', 'show in viewport 2 / 3'),
-             ('/', '/', 'find a lane'), ('Esc', 'Esc', 'clear / cancel'), ('g G', 'g G', 'first / last'),
-             ('+', '+', 'new shell'), ('a', 'a', 'add to a workspace'), ('x', 'x', 'close (asks y/n)'),
-             ('R', 'R', 'rename'), ('P', 'P', 'register a session'), ('U', 'U', 'arm the upload strip'),
-             ('r', 'r', 'reload'), ('?', '?', 'this sheet'))
+             ('J K', 'J K', 'open next / prev lane'), ('Tab S-Tab', 'Tab S-Tab', 'next / prev needing you'),
+             ('2 3', '2 3', 'show in viewport 2 / 3'), ('/', '/', 'find a lane'),
+             ('Esc', 'Esc', 'cancel, back to lane'), ('g G', 'g G', 'first / last'),
+             ('+ U', '+ U', 'new shell / upload'), ('a', 'a', 'add to a workspace'),
+             ('x', 'x', 'close (y, then Enter)'), ('u z', 'u z', 'unregister / undo 10 s'),
+             ('R', 'R', 'rename'), ('P', 'P', 'register a session'), ('p h', 'p h', 'pin / hide lane'),
+             ('H o', 'H o', 'hide tab / hidden lanes'), ('r ?', 'r ?', 'reload / this sheet'),
+             ('Ctrl-Alt-l', 'Ctrl-Alt-l', 'focus the sidebar'))
 PASTE_START, PASTE_END = '\033[200~', '\033[201~'
+# A paste typed into a footer field (Sidebar.pasted): a run of line breaks / tabs is one space, never an Enter.
+PASTE_BREAKS = re.compile(r'[\t\n\v\f\r]+')
+# W9 U6 (LNS-94): how often the sidebar looks for clients/<device>.update-ready — one stat per UPDATE_POLL seconds,
+# never one per tick (spec §8's tick budget counts reload/poll_health/poll_upload; this look is outside the tick).
+UPDATE_POLL = 30
 
 
 def key_length(data, i):
@@ -308,19 +493,121 @@ def key_length(data, i):
     return len(data) - i if end < 0 else end + 2
 
 
+def moves_focus(key):
+    """Whether ONE key (as key_length() cuts it) proves this pane has the keyboard, so an action it ends may hand the
+    keyboard back (cockpit v3 S3): a typed key and a mouse PRESS do — zellij delivers keys only to the focused pane,
+    and a click focuses the pane it lands on. A wheel tick, motion, a mouse release and an incomplete report do not:
+    zellij delivers those to the pane under the pointer, focused or not, and focus_lane()'s `move-focus right` from
+    the lane would carry the focus away from it."""
+    if not key.startswith('\033[<'):
+        return True
+    if key[-1:] != 'M':
+        return False              # a release (`m`), or a report cut at the end of the read
+    try:
+        button = int(key[3:-1].split(';')[0])
+    except ValueError:
+        return False
+    return not button & (32 | 64)
+
+
+def proves_focus(data):
+    """Whether any key of `data` (cut as key_length() cuts it) proves this pane has the keyboard (moves_focus)."""
+    i = 0
+    while i < len(data):
+        n = key_length(data, i)
+        if moves_focus(data[i:i + n]):
+            return True
+        i += n
+    return False
+
+
+class Worker:
+    """The sidebar's one action thread (cockpit v3 S9, LNS-67): the slow verbs — a close, `P`'s write, a new shell — run
+    here, one at a time in the order they were asked for, and the UI thread (run(): keys, ticks, frames) never waits for
+    them. A job's answer goes to `results`, which run()'s tick drains with get_nowait (Sidebar.finish_actions): no
+    timer, no second select, no lock the UI thread waits on. The thread starts with the first job and is a daemon.
+
+    The two threads share nothing but the two queues: a job gets its backend and arguments when the key is pressed
+    (submit, on the UI thread) and never touches the Sidebar; only the UI thread applies an answer. Serial on purpose:
+    two closes never contend for the registry lock inside one process. The lock waits a job meets — statusd's hot
+    sync, the timer's sync, another device's sidebar holding `registry.lock` — are bounded where the lock is taken
+    (lanes_lib.registry_lock, REGISTRY_LOCK_S) and happen here, never on the UI thread."""
+
+    def __init__(self):
+        self.jobs, self.results = queue.Queue(), queue.Queue()
+        self.thread = None
+
+    def submit(self, key, call, *args):
+        """Queue `call(*args)`; its answer is filed under `key`."""
+        self.jobs.put((key, call, args))
+        if self.thread is None:
+            self.thread = threading.Thread(target=self.serve, name='lanes-sidebar-actions', daemon=True)
+            self.thread.start()
+
+    def serve(self):
+        while True:
+            key, call, args = self.jobs.get()
+            try:
+                answer = (key, True, call(*args))
+            except Exception as error:   # every failure is an answer: one that escaped would end the thread, and the
+                answer = (key, False, error)   # row would wait for an answer for ever
+            self.results.put(answer)
+
+    def answers(self):
+        """Every answer filed since the last call, oldest first: [(key, ok, value or the exception)]. Never blocks."""
+        out = []
+        while True:
+            try:
+                out.append(self.results.get_nowait())
+            except queue.Empty:
+                return out
+
+
+def failure_text(error):
+    """What the footer says about a job that raised: its own words, else its type (a bare exception says nothing)."""
+    return str(error) or type(error).__name__
+
+
+def promote_job(promote, spawn, workspace, entry, registry_path, name):
+    """`P`'s write, on the worker: declare the session under `name` (session_actions.promote_to_registered, against the
+    registry as published now), then start `lanes sync` -> (the id sync is expected to give the lane, or None; the sync's
+    handle, or None when it could not be started — statusd's hot sync starts one on the changed terminals.json)."""
+    new_id = promote(workspace, entry, read_json(registry_path) or {}, name=name)
+    try:
+        sync = spawn([LANES_BIN, 'sync'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    except OSError:
+        sync = None
+    return (new_id if isinstance(new_id, str) else None), sync
+
+
 class Sidebar:
     # Class-level defaults for the registration state, so a Sidebar built without `__init__` (the
     # alignment gate constructs one with `__new__` and sets only the fields its rule needs) reads the
     # 'no registration in progress' shape rather than raising; `__init__` assigns the live values.
     registration, registration_choices, workspaces = None, (), ()
-    renaming, rename_value, rename_entry = False, '', None
-    promoting, promote_entry = False, None
-    attach_only = False
-    confirming = None           # the entry `x` / `×` asked to close; `y` closes it, any other key cancels
+    # The one prompt the footer asks (cockpit v3 S6): None, or {'verb': 'close'|'rename'|'promote', 'entry': the row it
+    # acts on, 'stage': 'name'|'confirm', 'value': the name typed / confirmed, 'armed': `y` pressed at a confirmation}.
+    # It replaced S3's confirming / renaming / promoting fields; those names remain as read-only views (compat block).
+    prompt = None
+    _message, message_at = '', 0.0   # the `message` property's text and its time.monotonic() stamp (cockpit v3 S6)
+    undo = None                  # {'record': what registrations.unregister returned, 'at': monotonic} for UNDO_S (S7)
+    # `P` on its way (cockpit v3 S8; read-only defaults, every write assigns fresh dicts): `pending` maps the session's
+    # old id to the id lanes sync is expected to give its lane (session_actions.promoted_id); `pending_rows` holds, by
+    # the same old id, {'row': the row as shown — its new name, `pending: 'promote'` — 'at': monotonic}.
+    pending, pending_rows = {}, {}
+    # The slow verbs on their way (cockpit v3 S9; read-only defaults, every write assigns a fresh dict): `worker` is the
+    # Worker (started by the first one), `actions` maps a job's key — the row's id, or `<ws>--new-shell` — to
+    # {'verb': 'close'|'promote'|'new-shell', 'entry': the row asked about, …} until run()'s tick takes its answer.
+    worker, actions = None, {}
+    registration_return = (0, 0)  # (cursor, top) when the Add to workspace picker opened: cancel_registration (S8)
+    attach_only = False          # handle(): an action gave the keyboard back to the lane during this read (S3)
+    mobile, filtering, armed = False, False, False
     seen = {}                   # read-only default; mark_seen() always assigns a fresh dict
     tone = TONE16
     glyphs = tokens.glyph_set('unicode')
     color, glyph_mode, variant = '16', 'unicode', 'dark'
+    vivid = False               # color in VIVID (apply_look): the modes whose colours Lanes defines (cockpit v3 P2)
+    dim, notify = '90', True    # the 16-colour dim's SGR and OSC 9 on/off (apply_look, resolve_dim_notify; P4)
     theme_pending, theme_deadline, osc_buffer = False, 0.0, ''
     last_visible = ()           # the list visible() last returned: the one `self.cursor` indexes
     economy = {}                # read-only default; reload() assigns the loaded economy.json (load_economy)
@@ -331,7 +618,37 @@ class Sidebar:
     board_titles = {}           # workspace id -> title, from the registry (reload)
     strip_row = False           # render(): the strip row (economy or fleet attention) is drawn this frame
     last_counts = ''            # the header counts the last OSC 2 title carried ('' = none sent; spec §4.9)
-    notified = {}               # read-only default; __init__ assigns: lane id -> the needs-you status already notified
+    last_asking = None          # the prompt verb the last OSC 2 title carried (a phone only; cockpit v3 S5)
+    notified = {}               # read-only default; __init__ assigns: lane id -> the needs-you entry already notified
+    focused = False             # this pane has the keyboard: a focus report or a key said so (cockpit v3 S4)
+    focus_reported = False      # Zellij has sent a focus report: from then on `focused` decides, not the 3 s timer
+    legend_until = 0.0          # time.monotonic() at which the no-report focus legend ends (handle())
+    legend_shown = False        # render(): the frame on screen carries the focus legend
+    command_path = ''           # views/<device>/<ws>.sidebar.cmd (__init__; DM-LANES-SIDEBAR-CMD)
+    # The owner's profile (cockpit v3 R3, LNS-76; read-only defaults, every write assigns fresh values): `login` and
+    # `profile_path` (users/<login>.json) of the person this device belongs to, None for a device nobody owns — which
+    # never stats, reads or writes a profile. `profile_look` is the profile's look (layered_look), `device_meta` the
+    # device file as last read, `profile_marks` {lane: when} and `last_open` the opened-lane marks the profile has not
+    # taken yet (its lock was busy), written again by poll_profile at `profile_retry_at` (time.monotonic()).
+    login, profile_path = None, None
+    profile_look, device_meta = {}, {}
+    profile_workspaces = {}     # the profile's `workspaces{order, hidden}` (R4, LNS-77): the phone's owner board
+    # The profile's `lanes{pins, hidden}` (cockpit v3 R5, LNS-78; read-only defaults, take_arrangement assigns fresh
+    # sets) and `o`'s toggle: hidden lanes shown again, faint.
+    lane_pins, lane_hidden, show_hidden = frozenset(), frozenset(), False
+    body_map = None             # render(): the entry index each desktop body row shows (a click's row), None = top + row
+    # Which lanes (cockpit v3 V2, LNS-84): the version of the tree this process runs (lanes_lib.REPO, read once) and of
+    # the installed one (lanes_lib.installed_tree()/VERSION, re-read by reload() every VERSION_RECHECK_S at `version_at`).
+    tree_version = current_version = ''
+    current_path, version_at = '', 0.0
+    # The self-swap (cockpit v3 U5): `swappable` is set by recheck_version (a re-exec would run another tree; never in
+    # the first VERSION_RECHECK_S of a process), `restored` when __init__ took a predecessor's .sidebar.state, whose
+    # cursor lane `restore_id` the first reload puts the cursor on.
+    swappable, restored, restore_id = False, False, None
+    profile_marks, last_open, profile_retry_at = {}, None, 0.0
+    # W9 U6: whether clients/<device>.update-ready existed at the last look (poll_update), when to look next, and until
+    # when a rebuild `r` started counts as on its way (monotonic seconds)
+    update_ready, update_poll_at, rebuild_until = False, 0.0, 0.0
 
     def __init__(self, device, workspace, slot='main', viewports='1'):
         self.device, self.workspace, self.slot = device, workspace, slot
@@ -349,6 +666,10 @@ class Sidebar:
         self.view_dir = os.path.join(STATE, 'views', device)
         self.target_file = self.slot_file(slot, 'target')
         self.pid_file = self.slot_file(slot, 'pid')
+        # Ctrl-Alt-/ and Ctrl-Alt-u hand their key over as this file (`lanes sidebar-key`, cockpit v3 S4): reload()'s
+        # sixth stamp field, and poll_command() before every read of keys.
+        self.command_path = L.sidebar_key_path(self.view_dir, workspace)
+        self.focused, self.focus_reported, self.legend_until, self.legend_shown = False, False, 0.0, False
         self.registry_path = os.path.join(STATE, 'registry.json')
         self.status_path = os.path.join(STATE, 'status.json')
         self.economy_path = os.path.join(STATE, 'economy.json')   # the opt-in poller's projection (Task 11)
@@ -360,9 +681,11 @@ class Sidebar:
         self.status, self.unregistered, self.zmx = {}, [], []
         self.cursor, self.top = 0, 0
         self.filter, self.filtering = '', False
-        self.renaming, self.rename_value, self.rename_entry = False, '', None
-        self.promoting, self.promote_entry = False, None
-        self.confirming = None
+        self.prompt = None
+        self.undo = None
+        self.pending, self.pending_rows, self.registration_return = {}, {}, (0, 0)
+        self.worker, self.actions = None, {}
+        self.handed_off = False
         self.dirty = True
         self.color, self.glyph_mode, self.variant = None, None, None
         self.theme_pending, self.theme_deadline, self.osc_buffer = False, 0.0, ''
@@ -372,14 +695,24 @@ class Sidebar:
         self.economy_frozen = False                # economy_aged() at the last poll_economy(): a flip repaints
         self.showing_keys, self.strip_row = False, False
         self.fleet, self.board_titles = {}, {}
-        self.last_counts, self.notified = '', {}   # '' not None: an agent-less workspace never emits a title
-        self.apply_look(meta)
-        # `done` is sticky until the lane is opened from this device: lane id -> the time it was last opened. Read
-        # once here and again only when a target file changes (never per tick: spec §8's stat budget), written by
+        self.last_counts, self.last_asking, self.notified = '', None, {}   # '' not None: no agents, no title
+        # The person this device belongs to (cockpit v3 R3, LNS-76): their profile's look is painted beneath the device
+        # file's --device-only keys (layered_look) and their opened-lane marks join this device's. None for a device
+        # nobody owns: today's sidebar.
+        self.device_meta = meta
+        self.login, self.profile_path = self.profile_of(meta)
+        self.profile_marks, self.last_open, self.profile_retry_at = {}, None, 0.0
+        profile = self.read_profile()
+        self.apply_look(self.look_of(meta))
+        # `done` is sticky until the lane is opened: lane id -> the time it was last opened, from this device's file
+        # and — on a device with an owner — from the person's profile, the later mark per lane. Read once here and
+        # again only when a target file or the profile changes (never per tick: spec §8's stat budget), written by
         # mark_seen() and by `lanes next|prev`.
         self.seen_path = os.path.join(STATE, 'clients', device + '.seen.json')
         self.seen = L.clean_seen(read_json(self.seen_path))
-        self.stamp = (0, 0, 0, 0, 0)   # registry, status, targets, device look, economy
+        self.merge_seen(profile)
+        # registry, status, targets, device look, economy, sidebar.cmd, profile (0 and never stat()ed when ownerless)
+        self.stamp = (0, 0, 0, 0, 0, 0, 0)
         self.size = (0, 0)
         self.dirty = True
         self.message = ''
@@ -388,6 +721,14 @@ class Sidebar:
         self.armed, self.paste_buffer = False, None
         self.upload = None          # {'id', 'spool', 'names', 'at'} while a request is in flight
         self.upload_note, self.upload_note_at = '', 0
+        # Which lanes (cockpit v3 V2): this tree's version once; the installed one now and every 30 s (recheck_version).
+        self.tree_version, self.current_path = shown_version(L.REPO), str(L.installed_tree(L.REPO))
+        self.current_version = (self.tree_version if self.current_path == str(L.REPO)
+                                else shown_version(self.current_path))
+        self.version_at = time.monotonic()
+        # A predecessor that swapped itself out left its cursor, scroll, seen marks and filter (cockpit v3 U5).
+        self.swappable, self.restore_id = False, None
+        self.restored = self.take_state()
 
     def slot_file(self, slot, kind):
         return os.path.join(self.view_dir, f'{self.workspace}.{slot}.{kind}')
@@ -401,21 +742,24 @@ class Sidebar:
 
     # ---------------------------------------------------------------- data
     def reload(self, force=False):
+        self.recheck_version()
+        if not force and self.swap_due():   # run()'s tick only: a forced reload is an action's, never cut short
+            self.self_swap()
         stamp = (mtime(self.registry_path), mtime(self.status_path),
                  sum(mtime(self.slot_file(slot, 'target')) for slot in SLOTS[:self.viewports]),
-                 mtime(self.look_path), mtime(self.economy_path))
+                 mtime(self.look_path), mtime(self.economy_path), mtime(self.command_path), self.profile_stamp())
         if stamp == self.stamp and not force:
             return
         if force:
             self.row_cache.clear()     # `r` and every forced reload repaint every row from scratch (spec §4.11)
         # The cursor follows the LANE, not the index (spec §4.5, §10): a lane that changes section moves rows above
-        # the cursor, so remember which lane it is on and re-find it after the reload.
-        cursor_id = self.cursor_id
+        # the cursor, so remember which lane it is on and re-find it after the reload — or, on the first reload after
+        # a self-swap (U5), the lane the predecessor's cursor was on.
+        cursor_id, self.restore_id = self.restore_id or self.cursor_id, None
         if stamp[0] != self.stamp[0] or force:
             registry = read_json(self.registry_path) or {}
             boards = registry.get('workspaces', [])
             self.workspaces = boards
-            self.mobile_owner = self.mobile and bool(boards) and boards[0]['id'] == self.workspace
             self.mobile_titles = {w.get('title') or w['id']: w['id'] for w in boards}
             self.board_titles = {w['id']: w.get('title') or w['id'] for w in boards}
             self.mobile_titles.update({tool['tab']: tool['view'] for tool in registry.get('tools', [])})
@@ -431,16 +775,44 @@ class Sidebar:
             self.status = status.get('lanes', {})
             self.unregistered = (status.get('unregistered') or {}).get(self.workspace, [])
             self.zmx = (status.get('zmx') or {}).get(self.workspace, [])
+            self.keep_moved_row()
         if stamp[0] != self.stamp[0] or stamp[1] != self.stamp[1] or force:
             self.fleet = self.fleet_counts()
-        if stamp[3] != self.stamp[3] or force:
-            self.apply_look(read_json(self.look_path) or {})
+        look = stamp[3] != self.stamp[3] or force
+        profile = stamp[6] != self.stamp[6] or force
+        if look:
+            meta = read_json(self.look_path)
+            self.device_meta = meta if isinstance(meta, dict) else {}
+            # The device file is where its owner is recorded (`lanes device claim`, create_session, record_base): a
+            # change may hand the device to someone, or to no one. Then the marks and the look are the new owner's.
+            owner = self.profile_of(self.device_meta)
+            if owner != (self.login, self.profile_path):
+                self.login, self.profile_path = owner
+                self.profile_marks, self.last_open = {}, None        # unwritten marks were for the previous profile
+                self.seen = L.clean_seen(read_json(self.seen_path))   # this device's own; the new profile's below
+                stamp = stamp[:6] + (self.profile_stamp(),)
+                profile = True
+        before = self.profile_look
+        if profile:
+            # The person's profile changed — another device opened a lane, `lanes attach` recorded a look there: its
+            # marks join this device's (the later one per lane) and its look is painted beneath the device file's
+            # --device-only keys.
+            self.merge_seen(self.read_profile())
+        if look or self.profile_look != before:   # a profile change that moved only `seen` re-resolves no look
+            self.apply_look(self.look_of(self.device_meta))
+        if profile:
+            self.fleet = self.fleet_counts()    # hidden lanes and boards leave the fleet strip too (R5)
+        if stamp[0] != self.stamp[0] or profile:
+            # The phone's owner board (poll_mobile_view's one watcher): the first board the person sees (R4) — a
+            # hidden board has no tab to watch from.
+            first = users.arrange(self.workspaces, {'workspaces': self.profile_workspaces})
+            self.mobile_owner = self.mobile and bool(first) and first[0].get('id') == self.workspace
         if stamp[4] != self.stamp[4] or force:
             # The seventh stat() of a tick at one viewport (spec §8): re-read only when the poller replaced the file.
             # A missing file (no poller: the default) is {} — no economy tail on any row, the strip row yields.
             self.economy = load_economy(read_json(self.economy_path)) if stamp[4] else {}
             self.economy_tiers = self.tier_mix()
-        if stamp[2] != self.stamp[2] and self.stamp != (0, 0, 0, 0, 0):   # not the first reload: __init__ read it
+        if stamp[2] != self.stamp[2] and any(self.stamp[:5]):   # not the first reload: __init__ read it
             # A viewport was pointed at a lane — by this sidebar, or by `lanes next|prev` (Ctrl-Alt-Down/Up, plan
             # Task 19), which marks the lane seen in the device's file as open_lane does. Merge the file once per
             # such change (never per tick: spec §8), so a `done` lane opened that way leaves Done here too.
@@ -448,62 +820,241 @@ class Sidebar:
             for key, value in self.seen.items():
                 merged[key] = max(value, merged.get(key, value))
             self.seen = merged                     # a fresh dict, never the class default mutated in place
+        command = stamp[5] != self.stamp[5]        # never `or force`: `r` must not replay the last chord
         self.stamp = stamp
         self.dirty = True
-        # `top` is kept (no reset when the list length changes) and shifted by the rows inserted above the cursor, so
-        # the cursor's lane stays on its screen row; render() still clamps both on every draw.
+        # A promoted session whose lane the registry now lists: the cursor on its row goes to the lane (cockpit v3 S8).
+        cursor_id = self.settle_pending(cursor_id)
+        # `top` is pinned (cockpit v3 S2): the cursor goes with its lane, the list does not move under it; render()
+        # scrolls only when the cursor's lane would leave the body, and bounds `top` by the list.
         self.resolve_cursor(self.visible(), cursor_id)
+        if command:
+            self.take_command(stamp[5])            # after the cursor is placed: a filter puts it on the top match
+
+    def recheck_version(self, now=None):
+        """reload()'s version check (cockpit v3 V2): once VERSION_RECHECK_S has passed since the last one, read the
+        installed tree's VERSION (one open, no stat; a checkout, whose current tree is its own, reads nothing) -> True
+        when it changed (one repaint: the footer's version note and the `?` row). Every other tick costs a clock read."""
+        now = time.monotonic() if now is None else now
+        if now - self.version_at < VERSION_RECHECK_S:
+            return False
+        self.version_at = now
+        if self.current_path == str(L.REPO):
+            return False
+        version = shown_version(self.current_path)
+        # U5: a swap is possible only when the path this process started through now resolves to another tree — a
+        # realpath (a few lstat, never a stat), only on this 30 s tick and only while the versions differ.
+        self.swappable = (bool(version) and version != self.tree_version
+                          and os.path.realpath(LAUNCH_TREE) != os.path.realpath(L.REPO))
+        if version == self.current_version:
+            return False
+        self.current_version, self.dirty = version, True
+        return True
+
+    # ------------------------------------------------------------- the self-swap (cockpit v3 U5)
+    def idle(self):
+        """Nothing would be lost by replacing this process now: no prompt, no filter being typed, no armed strip, no
+        Add to workspace picker or key sheet, no paste half read, no action on the worker (a close mid-kill), no
+        promotion held (S8), no undo offer (S7), no upload in flight, no profile mark waiting for its retry (R3), and no
+        rebuild `r` started (W9 U6, rebuild_view): that rebuild ends this process with its view, so swapping first
+        would only repaint once for nothing."""
+        return not (self.prompt or self.filtering or self.armed or self.registration or self.showing_keys
+                    or self.paste_buffer is not None or self.actions or self.pending_rows or self.undo or self.upload
+                    or self.profile_marks or self.last_open or time.monotonic() < self.rebuild_until)
+
+    def swap_due(self):
+        """reload()'s tick: the installed version differs from this tree's, a re-exec would run it (`swappable`), and
+        the sidebar is idle. In-memory flags only: no I/O."""
+        return (self.swappable and bool(self.current_version) and self.current_version != self.tree_version
+                and self.idle())
+
+    def state_path(self):
+        return self.slot_file(self.slot, 'sidebar.state')
+
+    def self_swap(self):
+        """Hand this view to the installed tree (DM-LANES-SIDEBAR-STATE): write {version 1, cursor_id, top, seen, filter,
+        at, from, to} atomically (0600) and exit SWAP_EXIT — run()'s `finally` writes stop_bytes and restores the
+        terminal's termios, and the wrapper re-executes itself from `current` at once. A state that cannot be written
+        (a full disk) exits nothing: the swap waits for the next recheck, as `swappable` is cleared."""
+        state = {'version': 1, 'cursor_id': self.cursor_id, 'top': self.top, 'seen': self.seen, 'filter': self.filter,
+                 'at': time.time(), 'from': self.tree_version, 'to': self.current_version}
+        try:
+            L.atomic_write(Path(self.state_path()), json.dumps(state, sort_keys=True) + '\n')
+        except OSError:
+            self.swappable = False
+            return
+        sys.exit(SWAP_EXIT)
+
+    def take_state(self):
+        """__init__: take a predecessor's .sidebar.state and delete it -> True when one was taken. Read leniently, each
+        field on its own: a lane id (at most 256 characters) the first reload puts the cursor on, a non-negative `top`, the
+        seen marks (merged, the later per lane), a printable filter of at most 200 characters. A file that is not a v1
+        object, or whose `at` is more than STATE_FRESH_S from now, is no swap's: deleted unread."""
+        path = self.state_path()
+        document = read_json(path)
+        try:
+            os.unlink(path)
+        except OSError:
+            pass
+        if not isinstance(document, dict) or document.get('version') != 1:
+            return False
+        at = number(document.get('at'))
+        if at is None or abs(time.time() - at) > STATE_FRESH_S:
+            return False
+        cursor_id, top, text = document.get('cursor_id'), document.get('top'), document.get('filter')
+        if isinstance(cursor_id, str) and 0 < len(cursor_id) <= 256:
+            self.restore_id = cursor_id
+        if isinstance(top, int) and not isinstance(top, bool) and top >= 0:
+            self.top = top
+        if isinstance(text, str) and len(text) <= OSC_TEXT_MAX and text.isprintable():
+            self.filter = text
+        seen = dict(self.seen)
+        for lane, mark in L.clean_seen(document.get('seen')).items():
+            seen[lane] = max(mark, seen.get(lane, mark))
+        self.seen = seen
+        return True
+
+    def start_cursor(self):
+        """run()'s start, after the first reload: the cursor on the lane this pane's viewport shows — unless a
+        predecessor's state put it where it was before the swap."""
+        if self.restored:
+            return
+        target = self.current_target()
+        for index, entry in enumerate(self.visible()):
+            if entry['id'] == target:
+                self.cursor = index
+
+    def version_note(self, cols):
+        """The footer's version rung (cockpit v3 V2), '' while this sidebar runs the installed tree (or either version
+        is unknown, or an update is ready — footer_text's `update ready · reload (r)` says it then): ` server 1.2.0 · view 1.1.0 — press ?`; at the sidebar's 36 columns `press` gives way (` — ?`),
+        then the hint; a longer pair is clipped by footer_text. Every separator is a mark: seven-bit in ASCII."""
+        current, tree = self.current_version, self.tree_version
+        # A pending rebuild (W9 U6's update ready, poll_update) is the rung that says what to do: `r` brings this view
+        # onto the installed release, so the note gives way to it rather than hiding it above the message.
+        if not current or not tree or current == tree or self.update_ready:
+            return ''
+        g = self.glyphs['marks']
+        head = f' server {current} {g["sep"]} view {tree}'
+        for tail in (f' {g["dash"]} press ?', f' {g["dash"]} ?', ''):
+            if cell_width(head + tail) <= cols - 1:
+                return head + tail
+        return head
 
     # ------------------------------------------------------------------ look
+    def profile_of(self, meta):
+        """(login, users/<login>.json) of the person this device belongs to (cockpit v3 R3, LNS-76), or (None, None).
+        The owner is users.login_for over this device and the base its file records (`meta`) — exactly what `lanes
+        attach` writes a look for (bin/lanes profile_for, R2), so the profile painted is the one written: a member
+        record of the device or of the machine it is a window of whenever one exists, else the owner the file records.
+        members/ and users/ are the ones beside this sidebar's STATE. A login too long for a profile file name has no
+        profile (users.path refuses it): today's sidebar. Reads at most two small members/ files, only at start and
+        when the device file changes — never per tick."""
+        login = users.login_for(self.device, meta, members_dir=os.path.join(STATE, 'members'))
+        if not login:
+            return None, None
+        try:
+            return login, str(users.path(login, os.path.join(STATE, 'users')))
+        except L.LanesError:
+            return None, None
+
+    def profile_stamp(self):
+        """reload()'s seventh stamp field: the profile's mtime — 0, with no stat at all, on a device nobody owns."""
+        return mtime(self.profile_path) if self.profile_path else 0
+
+    def read_profile(self):
+        """The person's profile as users.read normalizes it (None: no owner, no file yet, or a file this release does
+        not read), keeping its look for layered_look."""
+        profile = users.read(self.login, os.path.dirname(self.profile_path)) if self.profile_path else None
+        self.profile_look = dict(profile['look']) if profile else {}
+        self.take_arrangement(profile)
+        return profile
+
+    def take_arrangement(self, profile):
+        """The profile's arrangement into this sidebar: `workspaces{order, hidden}` (R4) and `lanes{pins, hidden}` (R5);
+        none without a profile. Fresh values, never mutated in place."""
+        self.profile_workspaces = dict(profile['workspaces']) if profile else {}
+        self.lane_pins = frozenset(profile['lanes']['pins']) if profile else frozenset()
+        self.lane_hidden = frozenset(profile['lanes']['hidden']) if profile else frozenset()
+
+    def merge_seen(self, profile):
+        """The profile's opened-lane marks into this sidebar's: the later mark per lane wins (users.merge's rule), so a
+        reload never re-shows a lane this device opened after the profile's mark. A fresh dict, never mutated in place."""
+        if not profile or not profile['seen']:
+            return
+        seen = dict(self.seen)
+        for lane, at in profile['seen'].items():
+            seen[lane] = max(at, seen.get(lane, at))
+        self.seen = seen
+
+    def look_of(self, meta):
+        """What apply_look resolves: the device file alone on a device nobody owns (byte for byte today's input), the
+        profile's look layered over it on one with an owner (layered_look: only --device-only keys win over it)."""
+        return layered_look(self.profile_look, meta) if self.profile_path else meta
+
     def apply_look(self, meta):
         """Resolve colour / theme / glyph modes from the device file and the environment (spec §2.4). Runs at start and
         whenever devices/<device>.json changes, so `lanes attach DEVICE --ascii|--theme|--color` against a LIVE session
         reaches every sidebar of that device within one tick (Zellij panes keep the server's environment from session
-        creation: an environment variable can never reach a running sidebar). Publishes the glyph mode for view.sh."""
+        creation: an environment variable can never reach a running sidebar). Publishes the glyph mode and the colour
+        mode for view.sh (clients/<device>.glyphs and .color, beside .theme). The 16-colour dim and OSC 9 resolve here
+        too, from the same file's `dim`/`notify` (`--dim`, `--notify`; cockpit v3 P4, DEF-1577), never per frame.
+        On a device with an owner `meta` is layered_look's (cockpit v3 R3): the owner's profile beneath the device
+        file's --device-only keys, and this runs when either changes — a look recorded on another of the person's
+        devices included."""
         color, theme, glyphs = resolve_modes(os.environ, meta)
-        changed = (color, glyphs) != (self.color, self.glyph_mode)
-        self.color, self.glyph_mode = color, glyphs
-        variant_changed = False
+        dim, notify = resolve_dim_notify(os.environ, meta)
+        changed = (color, glyphs, dim) != (self.color, self.glyph_mode, self.dim)
+        self.color, self.glyph_mode, self.vivid = color, glyphs, color in VIVID
+        self.dim, self.notify = dim, notify == '1'
         if theme != 'auto':
-            variant_changed = theme != self.variant
+            changed = changed or theme != self.variant
             self.variant, self.theme_pending = theme, False
         elif self.variant is None:                 # first resolution under `auto`: paint dark, ask the terminal once
             self.variant, self.theme_pending, self.theme_deadline = 'dark', True, time.monotonic() + THEME_GRACE
-        changed = changed or variant_changed
-        self.tone = tokens.sgr_table(self.color, self.variant)
+        self.tone = self.tone_table(self.variant)
         self.glyphs = tokens.glyph_set(self.glyph_mode)
-        glyphs_file = os.path.join(STATE, 'clients', self.device + '.glyphs')
-        if changed or not os.path.exists(glyphs_file):
-            try:
-                L.atomic_write(Path(glyphs_file), self.glyph_mode + '\n')
-            except OSError:
-                pass   # view.sh then keeps its default; the sidebar itself is unaffected
+        self.publish_stamp('glyphs', self.glyph_mode)
+        self.publish_stamp('color', self.color)
         if theme != 'auto':
-            self.publish_theme(variant_changed)
+            self.publish_stamp('theme', self.variant)
         if changed:
             self.row_cache.clear()
             self.dirty = True
 
     def apply_theme(self, variant):
-        """The OSC 11 answer (or the grace expiry, with the current variant): repaint on a change and publish it."""
+        """The OSC 11 answer (or the grace expiry, with the current variant): repaint on a change, and publish what is
+        painted whether or not it changed — the stamp may be an earlier attach's (DEF-1775)."""
         self.theme_pending = False
         if not variant:
             return
-        changed = variant != self.variant
-        if changed:
-            self.variant, self.tone, self.dirty = variant, tokens.sgr_table(self.color, variant), True
+        if variant != self.variant:
+            self.variant, self.tone, self.dirty = variant, self.tone_table(variant), True
             self.row_cache.clear()
-        self.publish_theme(changed)
+        self.publish_stamp('theme', self.variant)
+
+    def tone_table(self, variant):
+        """The escapes this sidebar paints with: tokens.sgr_table for its colour mode and `variant`, the 16-colour dim
+        from the resolved `dim` (P4) — never sgr_table's own LANES_DIM fallback, which the device file must win over."""
+        return tokens.sgr_table(self.color, variant, dim16=DIM16[self.dim])
+
+    def expire_theme(self, now=None):
+        """No OSC 11 answer within THEME_GRACE: the pending variant (dark, spec §2.4) is the resolution, and it is
+        published. run() calls this on its tick as well as render() on a frame (DEF-1775): run() paints only a dirty
+        frame, and a quiet board whose start frame came before the grace ran out may paint none for minutes, while a
+        status screen beside it would read an earlier attach's stamp."""
+        if self.theme_pending and (time.monotonic() if now is None else now) >= self.theme_deadline:
+            self.apply_theme(self.variant)
 
-    def publish_theme(self, changed):
-        """clients/<device>.theme (`dark`/`light` + newline) for `glow`: written on change or when absent, never per
-        render."""
-        theme_file = os.path.join(STATE, 'clients', self.device + '.theme')
-        if changed or not os.path.exists(theme_file):
-            try:
-                L.atomic_write(Path(theme_file), self.variant + '\n')
-            except OSError:
-                pass
+    def publish_stamp(self, kind, value):
+        """clients/<device>.<kind> (`glyphs`, `color`, `theme`: the value + newline) for view.sh and `glow`. Compared by
+        CONTENT, never gated on an in-memory change flag (DEF-1775): the file outlives the sidebar that wrote it, so an
+        earlier session's stamp — another terminal's theme answer, another look — is replaced the first time this
+        sidebar resolves, and a stamp that already says the same is left alone. Called on a resolution (start, a device
+        file change, the OSC 11 answer or its grace), never per render."""
+        try:
+            L.atomic_write_if_changed(Path(STATE) / 'clients' / f'{self.device}.{kind}', value + '\n')
+        except OSError:
+            pass   # view.sh then keeps its default; the sidebar itself is unaffected
 
     def strip_osc(self, data):
         """Remove complete OSC sequences from `data`, apply OSC 11 answers, hold an incomplete OSC 11 tail for the next
@@ -562,6 +1113,45 @@ class Sidebar:
         if banner != self.banner:
             self.banner, self.dirty = banner, True
 
+    # ---------------------------------------------------- update ready (W9 U6)
+    def update_stamp(self):
+        return os.path.join(STATE, 'clients', self.device + '.update-ready')
+
+    def poll_update(self):
+        """Keep `update_ready` — whether `lanes ensure --if-layout-changed` left clients/<device>.update-ready because
+        the release installed lays this view out differently and a client was attached — at most UPDATE_POLL seconds
+        old: one stat per UPDATE_POLL, never one per tick. A change repaints the footer."""
+        now = time.monotonic()
+        if now < self.update_poll_at:
+            return
+        self.update_poll_at = now + UPDATE_POLL
+        ready = os.path.exists(self.update_stamp())
+        if ready != self.update_ready:
+            self.update_ready, self.dirty = ready, True
+
+    def rebuild_view(self):
+        """`r` while the footer offers the update: `lanes rebuild <device>` from this tree's `bin/lanes` — the installed
+        release's, as the layout names the tree through `current` — in a session of its own, so it outlives this
+        sidebar, which ends with the view it rebuilds (the client reconnects: `lanes rebuilt`). A stamp gone since the
+        last look (a rollback made the layout current again) makes it a plain reload; a second `r` while one rebuild is
+        on its way starts none."""
+        self.dirty = True
+        if not os.path.exists(self.update_stamp()):
+            self.update_ready = False
+            self.reload(force=True)
+            return
+        if time.monotonic() < self.rebuild_until:
+            self.message = 'Reloading the view'
+            return
+        try:
+            subprocess.Popen([LANES_BIN, 'rebuild', self.device], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                             stderr=subprocess.DEVNULL, start_new_session=True)
+        except OSError as error:
+            self.message = f'reload failed: {error.strerror or error}'
+            return
+        self.rebuild_until = time.monotonic() + UPDATE_POLL
+        self.message = 'Reloading the view'
+
     def economy_aged(self, now):
         """True when the loaded economy.json is older than ECONOMY_STALE by its own `at` against `now` (our clock):
         the poller stopped, so every figure in it is frozen (DEF-1528). False without a document or without a numeric
@@ -576,6 +1166,45 @@ class Sidebar:
         if frozen != self.economy_frozen:
             self.economy_frozen, self.dirty = frozen, True
 
+    def poll_command(self):
+        """One stat() of views/<device>/<ws>.sidebar.cmd before a read's keys are handled (on_read). Zellij hands the
+        keyboard back to this pane the moment the chord's floating pane exits, which is after `lanes sidebar-key` wrote
+        the file but possibly before the next 1 s tick: the first letter typed after Ctrl-Alt-/ must already go into
+        the filter, never become a sidebar key. Shares reload()'s sixth stamp field, so a command acts once; the other
+        fields (the seventh, the profile, included) are left for reload() to compare."""
+        stamp = mtime(self.command_path)
+        if stamp != self.stamp[5]:
+            self.stamp = self.stamp[:5] + (stamp,) + self.stamp[6:]
+            self.take_command(stamp)
+
+    def take_command(self, stamp):
+        """Act on a new sidebar command (DM-LANES-SIDEBAR-CMD, cockpit v3 S4): `filter` is the `/` key, `upload` the
+        `U` key, pressed on an idle sidebar — whatever is open (a prompt, the picker, the key sheet, the other mode) is
+        cancelled first, as Esc cancels it, and never typed into, so a chord can neither rename nor close anything. A
+        stale, malformed or foreign file is ignored (lanes_lib.read_sidebar_key). The focus is already here (the chord
+        moved it): nothing is handed back, and the footer legend says where the keyboard is."""
+        key = L.read_sidebar_key(self.command_path) if stamp else None
+        if not key:
+            return
+        self.begin_action()
+        if self.prompt:
+            self.cancel_prompt()
+        if self.registration:
+            self.cancel_registration()
+        self.showing_keys = False
+        if key == 'filter':
+            self.armed = False
+            self.filtering, self.filter = True, ''
+            self.set_cursor(0)
+        elif self.attach_only:   # a remote workspace has no upload strip (render: `self.box`)
+            self.filter, self.filtering = '', False
+            self.message = 'no uploads in a remote workspace'
+        else:
+            self.filter, self.filtering = '', False
+            self.armed = True
+        self.legend_until = time.monotonic() + FOCUS_LEGEND_S
+        self.dirty = True
+
     def current_target(self):
         try:
             with open(self.target_file) as handle:
@@ -604,13 +1233,63 @@ class Sidebar:
         the lanes status.json knows, so a restarted sidebar does not resurrect what was already looked at.
         Every workspace tab of a device runs its own sidebar over the SAME file, so a write merges what is on disk
         (the later mark per lane wins) instead of replacing it with this process's view — `lanes_lib.record_seen`,
-        which `lanes next|prev` (Ctrl-Alt-Down/Up) call too."""
+        which `lanes next|prev` (Ctrl-Alt-Down/Up) call too.
+        On a device with an owner (cockpit v3 R3, LNS-76) the device file keeps only what THIS device opened — its own
+        record, which notify's desk presence and an older release read — and the mark, with `last_opened` {lane,
+        device, at}, goes to the person's profile (save_profile), from which every other device of theirs takes it on
+        its next tick. A profile write that does not get the lock within PROFILE_LOCK_S is retried by run()'s tick."""
         since = self.agent_of(lane_id).get('since')
-        self.seen = L.record_seen(self.seen_path, lane_id, since, self.status, self.seen)
+        if not self.profile_path:
+            self.seen = L.record_seen(self.seen_path, lane_id, since, self.status, self.seen)
+            return
+        mine = L.record_seen(self.seen_path, lane_id, since, self.status)
+        seen = dict(self.seen)
+        for lane, at in mine.items():
+            seen[lane] = max(at, seen.get(lane, at))
+        self.seen = seen
+        at = mine[lane_id]
+        marks = dict(self.profile_marks)
+        marks[lane_id] = max(at, marks.get(lane_id, at))
+        self.profile_marks, self.last_open = marks, {'lane': lane_id, 'device': self.device, 'at': at}
+        self.save_profile()
+
+    def save_profile(self):
+        """Write the marks the profile has not taken (profile_marks, last_open) through users.update as this device,
+        waiting at most PROFILE_LOCK_S for its lock. -> True when the profile holds them (they are forgotten here);
+        False when the write was dropped — they stay, and poll_profile writes them again PROFILE_RETRY_S later. The
+        merge in users.update keeps the later mark per lane and the later `last_opened`, so a retry never lowers one."""
+        marks, opened = dict(self.profile_marks), self.last_open
+        if not self.profile_path or not (marks or opened):
+            return False
+
+        def mark(profile):
+            for lane, at in marks.items():
+                profile['seen'][lane] = max(at, profile['seen'].get(lane, at))
+            if opened:
+                profile['last_opened'] = dict(opened)
+        if users.update(self.login, self.device, mark, directory=os.path.dirname(self.profile_path),
+                        timeout=PROFILE_LOCK_S):
+            self.profile_marks, self.last_open = {}, None
+            return True
+        self.profile_retry_at = time.monotonic() + PROFILE_RETRY_S
+        return False
+
+    def poll_profile(self, now=None):
+        """run()'s tick (cockpit v3 R3): marks a busy profile dropped are written again once PROFILE_RETRY_S has passed.
+        Nothing waiting — every tick but those — is no stat, no read, no write. -> True when the profile took them."""
+        if not (self.profile_marks or self.last_open):
+            return False
+        if (time.monotonic() if now is None else now) < self.profile_retry_at:
+            return False
+        return self.save_profile()
 
     def agent_rows(self, lanes):
-        """[(entry, agent status or None, since or None, attention key or None)] in ONE pass over status.json — the
-        sections, the counts and the header all read this, so a render looks each lane up once (spec §4.11)."""
+        """[(entry, agent status or None, section entry stamp or None, attention key or None)] in ONE pass over
+        status.json — the sections, the counts and the header all read this, so a render looks each lane up once (spec
+        §4.11). The stamp is statusd's `agent.stable_since` — when the lane entered the section it is published in
+        (`agent_state.settle`, cockpit v3 S1) — or, from a statusd older than S1 that publishes none, `since`. It is
+        what a section is ordered by. The Done seen check keeps comparing `since`: that marks the TURN (a later turn
+        finishing is news again), and `stable_since` would only mark when it reached the section."""
         if not lanes:
             return []
         status_of, seen, out = self.status, self.seen, []
@@ -622,21 +1301,27 @@ class Sidebar:
                 continue
             since = agent.get('since')
             since = since if isinstance(since, (int, float)) else None
+            entered = number(agent.get('stable_since'))
             key = SECTION_OF.get(status)
             if key == 'done' and entry['id'] in seen and (since or 0) <= seen[entry['id']]:
                 key = None                              # opened since it finished: not news (seen_done)
-            out.append((entry, status, since, key))
+            out.append((entry, status, since if entered is None else entered, key))
         return out
 
     def fleet_counts(self):
         """{other workspace's title: {needs_approval: n, needs_input: n}} from the status.json already loaded — one pass
         over its lanes, zero extra reads (spec §4.6(c)); this workspace is never in it. Ordered as the registry lists the
-        workspaces, so the strip does not reshuffle when status.json does."""
+        workspaces, so the strip does not reshuffle when status.json does. A lane the owner hid, and every lane of a
+        workspace the owner hid, is not counted (cockpit v3 R5): the person chose not to see it."""
         found = {}
+        shown = ({board.get('id') for board in users.arrange(self.workspaces, {'workspaces': self.profile_workspaces})}
+                 if self.profile_workspaces.get('hidden') else None)
         for lane_id, entry in self.status.items():
             board = lane_id.split('--', 1)[0]
             agent = entry.get('agent') if isinstance(entry, dict) else None
             status = agent.get('status') if isinstance(agent, dict) else None
+            if lane_id in self.lane_hidden or (shown is not None and board not in shown):
+                continue
             if board != self.workspace and status in ('needs_approval', 'needs_input'):
                 counts = found.setdefault(board, {})
                 counts[status] = counts.get(status, 0) + 1
@@ -741,17 +1426,32 @@ class Sidebar:
         """{needs, working, agents, shells} over this workspace's registry lanes: `needs` and `working` are the
         sizes of those sections, `agents` the lanes running a harness (any status but `shell`), `shells` the rest."""
         needs = working = agents = 0
-        for _entry, status, _since, key in self.agent_rows(self.entries):
+        lanes = self.shown_lanes()
+        for _entry, status, _entered, key in self.agent_rows(lanes):
             needs += key == 'needs'
             working += key == 'working'
             agents += status is not None and status != 'shell'
-        return {'needs': needs, 'working': working, 'agents': agents, 'shells': len(self.entries) - agents}
+        return {'needs': needs, 'working': working, 'agents': agents, 'shells': len(lanes) - agents}
+
+    def shown_lanes(self):
+        """This workspace's registry lanes the list shows (cockpit v3 R5): without the ones the owner hid, unless `o`
+        shows them. The header counts, the notifications and the list all read this; `self.entries` itself when
+        nothing is hidden (no copy)."""
+        if not self.lane_hidden or self.show_hidden:
+            return self.entries
+        return [entry for entry in self.entries if entry.get('id') not in self.lane_hidden]
+
+    def registry_lane(self, entry):
+        """Whether `entry` is one of this workspace's registry lanes — what `p` pins and `h` hides. Never a divider, an
+        action row, a zmx lane or a session listed under Unregistered (nothing alive is ever hidden)."""
+        lane_id = entry.get('id')
+        return bool(lane_id) and not entry.get('divider') and any(e.get('id') == lane_id for e in self.entries)
 
     def header_tally(self):
         """[(agent status, 'glyph+count')] for the header, in `HEADER_COUNTS` order, zeros omitted; a seen `done`
         is not counted (it left the Done section)."""
         counts = {}
-        for _entry, status, _since, key in self.agent_rows(self.entries):
+        for _entry, status, _entered, key in self.agent_rows(self.shown_lanes()):
             if status in HEADER_COUNTS and (status != 'done' or key):
                 counts[status] = counts.get(status, 0) + 1
         agent = self.glyphs['agent']
@@ -798,19 +1498,26 @@ class Sidebar:
         since = agent.get('since') if status else observed.get('activity')
         age = age3(int(now - since) if isinstance(since, (int, float)) and since > 0 else None)
         is_cursor, is_viewing = index == self.cursor, entry['id'] == target
-        mark = ' '
+        # Column 3: a row `P` is registering says so first (cockpit v3 S8, the dim `pending` mark), then the viewports.
+        pending = bool(entry.get('pending'))
+        mark, mark_role = (self.glyphs['marks']['pending'], MARKS['pending'][2]) if pending else (' ', 'accent')
         for slot, name in zip(SLOTS[1:self.viewports], ('viewport-b', 'viewport-c')):
-            if others.get(slot) == entry['id']:
+            if others.get(slot) == entry['id'] and not pending:
                 mark = self.glyphs['marks'][name]
         if mark == ' ' and is_viewing and not is_cursor:
             mark = self.glyphs['marks']['viewing']
+        # The owner's pin (cockpit v3 R5): column 3's lowest mark — pending, the viewports and the viewing mark win.
+        pinned = entry['id'] in self.lane_pins
+        if mark == ' ' and pinned:
+            mark, mark_role = self.glyphs['marks']['pinned'], MARKS['pinned'][2]
+        hidden = entry['id'] in self.lane_hidden          # drawn only while `o` shows the hidden lanes: faint
         # A lane statusd never observed already shows `?` as its stream glyph: one `?`, not two.
         tail, tail_role = self.tail_for(observed if key_state != 'unknown' else {}, econ, now)
         viewers = viewer_mark(observed).replace('·', self.glyphs['marks']['viewer'])
-        closable = bool(entry.get('closable'))
+        closable = bool(entry.get('closable')) and not pending   # a row being registered offers neither control
         can_register = closable and R.eligible(entry)
         key = (entry.get('name'), entry.get('color'), entry.get('icon'), closable, can_register, key_state, stale,
-               viewers, status, age, tail, tail_role, is_cursor, is_viewing, mark, cols, section_tone)
+               viewers, status, age, tail, tail_role, is_cursor, is_viewing, mark, mark_role, cols, section_tone, hidden)
         cached = self.row_cache.get(entry['id'])
         if cached and cached[0] == key:
             self.row_hits += 1
@@ -837,10 +1544,13 @@ class Sidebar:
         if status:
             agent_role = 'ink-dim' if stale else tokens.tone_of(AGENT_GLYPHS, status)
             agent_cell = f'{tone[agent_role]}{g["agent"][status]}{reset}'
-        mark_cell = f'{tone["accent"]}{mark}{reset}' if mark != ' ' else ' '
+        mark_cell = f'{tone[mark_role]}{mark}{reset}' if mark != ' ' else ' '
         color = entry.get('color')
-        # The lane's identity colour (38;5;N) is a colour: under NO_COLOR (`none`) the name is plain ink.
-        fg = f'\033[38;5;{color}m' if isinstance(color, int) and self.color != 'none' else ''
+        # The lane's identity colour (38;5;N) is a colour: under NO_COLOR (`none`) the name is plain ink. Without one
+        # the name is painted ink in the vivid modes (cockpit v3 P2): the terminal's own foreground is not the token's.
+        # In 16 colours ink IS the default foreground (`39`), so nothing is written there.
+        fg = (tone['ink-faint'] if hidden else f'\033[38;5;{color}m' if isinstance(color, int) and self.color != 'none'
+              else tone['ink'] if self.vivid else '')
         lead = (tone['bold'] if is_viewing else '') + fg
         name_cell = f'{lead}{clipped}{reset}' if lead else clipped
         if viewers:
@@ -850,40 +1560,77 @@ class Sidebar:
         # are POSITIONED (CHA): a name whose terminal width disagrees with `cell_width` cannot push either control
         # off its hit box.
         spacer = f'\033[{max(1, cols - 8)}G{tone["tone-done"]}{g["marks"]["new"]}{reset}' if can_register else ' '
-        stream_role = 'ink-dim' if (stale or status) else tokens.tone_of(GLYPHS, key_state)
+        # Beside an agent the stream glyph used to be ink-dim (spec §4.2 col 33); in the vivid modes it keeps its own
+        # tone and only a stale row dims it (cockpit v3 P2) — shell `_`, idle `·`, quiet `○` are ink-dim by token.
+        stream_role = 'ink-dim' if (stale or (status and not self.vivid)) else tokens.tone_of(GLYPHS, key_state)
         stream = f'{tone[stream_role]}{g["stream"][key_state]}{reset}'
         tail_cell = f'{tone[tail_role]}{tail}{reset}' if tail != ' ' else ' '
         close = f'\033[{max(1, cols - 1)}G{tone["tone-urgent"]}{g["marks"]["close"]}{reset}' if closable else ' '
         age_role = section_tone or 'ink-dim'
         text = (f'{cursor}{agent_cell}{mark_cell}{icon}{name_cell}{pad}{spacer}{tone[age_role]}{age}{reset} '
                 f'{stream}{tail_cell}{close}')
+        if is_cursor:
+            text = self.on_band(text)
         self.row_cache[entry['id']] = (key, text)
         return text
 
+    def on_band(self, text):
+        """A painted row on the `selected` background, the cursor row (cockpit v3 P2): the band first and again after
+        every reset inside, and a PLAIN reset last — the caller's `\\033[K` paints the current background, so column
+        36 stays the terminal's own. 16 colours and none have no band (`selected` is ''): the row is returned as is
+        and the bold `▌` in column 1 is the cursor, as it always was; in the vivid modes the `▌` stays too, so the band
+        is never the only cue (the light wash is a whisper on a white terminal)."""
+        band, reset = self.tone['selected'], self.tone['reset']
+        if not band:
+            return text
+        text = text.removesuffix(reset)
+        return f'{band}{text.replace(reset, reset + band)}{reset}'
+
     def sectioned(self, lanes):
-        """Registry lanes in attention order (spec §4.4): Needs you (by urgency, oldest first), Working (oldest
-        first), Done (newest first, unseen only), then the rest in registry order under a workspace header — drawn
-        only when an attention section exists, so a workspace without agents looks exactly as before."""
-        buckets, rest = {key: [] for key, *_ in ATTENTION}, []
-        for entry, status, since, key in self.agent_rows(lanes):
+        """Registry lanes in attention order (spec §4.4, cockpit v3 S2): Needs you (by urgency, then in the order the
+        lanes ENTERED the section), Working (entry order), Done (newest entry first, unseen only), then the rest in
+        registry order under a workspace header. Shared by the desktop and the phone (render_mobile draws this list).
+
+        The entry stamp is statusd's `agent.stable_since` (agent_rows; `since` from a statusd older than S1). It moves
+        only when a lane changes SECTION. `since` was the key until S2 and moved the rows: it restarts on every status
+        change inside one section (needs_input -> needs_approval -> needs_input put a lane that had waited longest
+        below the others) and, for a lane demoted out of Needs you, is when its turn STARTED, up to 8 s before it
+        entered Working — so it slid in above lanes already working (DEF-1811). Ties (one statusd cycle) go by the
+        lane's position in the registry. Once the workspace has an agent (a lane whose status is not None or `shell`,
+        as counts() says), the Needs you and Working headers are always drawn, `(0)` included, so a lane moving
+        between them never adds or removes a header row above the others; Done only with a member. A workspace
+        without agents is exactly the single list it always was.
+        A lane the owner pinned (cockpit v3 R5) leads its section — the pinned ones in registry order, then the others
+        in the order above — in the remainder and the single list alike."""
+        buckets, rest, agents, pins = {key: [] for key, *_ in ATTENTION}, [], False, self.lane_pins
+        for index, (entry, status, entered, key) in enumerate(self.agent_rows(lanes)):
+            agents = agents or status not in (None, 'shell')
             if key is None:
                 rest.append(entry)
-            elif key == 'needs':     # urgency, then the oldest `since` first; an unknown `since` sorts last
-                buckets[key].append(((NEEDS_RANK[status], INF if since is None else since), status, entry))
+                continue
+            stamp = INF if entered is None else entered          # an unknown stamp sorts last
+            if pins and entry.get('id') in pins:
+                order = (0, index)
+            elif key == 'needs':
+                order = (1, NEEDS_RANK[status], stamp, index)
             elif key == 'working':
-                buckets[key].append((INF if since is None else since, status, entry))
-            else:                    # done: newest first
-                buckets[key].append((INF if since is None else -since, status, entry))
-        if not any(buckets.values()):
+                order = (1, stamp, index)
+            else:                                                 # done: the newest entry first
+                order = (1, INF if entered is None else -entered, index)
+            buckets[key].append((order, status, entry))
+        if pins:
+            rest = [e for e in rest if e.get('id') in pins] + [e for e in rest if e.get('id') not in pins]
+        if not agents:
             return rest
         out = []
         for key, title, _glyph, _members in ATTENTION:
-            if buckets[key]:
-                bucket = sorted(buckets[key], key=itemgetter(0))
-                # `status`: the most urgent member's, whose glyph heads the section (`── ◆ Needs you (3)`, spec §4.4)
+            bucket = sorted(buckets[key], key=itemgetter(0))
+            if bucket or key in ALWAYS_DRAWN:
+                # `status`: the most urgent member's, whose glyph heads the section (`── ◆ Needs you (3)`, spec §4.4);
+                # None for an empty section (divider_line draws its glyph ink-dim: a placeholder is not an alarm)
                 out.append({'id': '', 'divider': True, 'name': f'{title} ({len(bucket)})', 'section': key,
-                            'status': bucket[0][1]})
-                out += [entry for _rank, _status, entry in bucket]
+                            'status': bucket[0][1] if bucket else None})
+                out += [entry for _order, _status, entry in bucket]
         if rest:
             out.append({'id': '', 'divider': True, 'name': f'{self.title} ({len(rest)})', 'section': 'rest'})
         return out + rest
@@ -904,13 +1651,13 @@ class Sidebar:
 
     def resolve_cursor(self, entries, cursor_id):
         """The cursor is a LANE (spec §4.5). `entries` is a freshly computed list, `cursor_id` the lane the cursor was
-        on before it: the index is re-found from the id, and `top` shifts by the rows that appeared above it, so a lane
-        that moves between sections never moves the operator's eye. Then the index is clamped. render() and
-        render_mobile() bound the shifted `top` by the list (DEF-1514): a list that fits the body is never scrolled."""
+        on before it: the index is re-found from the id, then clamped. `top` is NOT touched (cockpit v3 S2): until S2
+        it shifted by the cursor lane's delta, which scrolled the whole list every time a lane changed section above
+        the cursor (plan context item 4). Now the list stays put and the cursor moves with its lane; render() and
+        render_mobile() scroll only when that lane would leave the body, and bound `top` by the list (DEF-1514)."""
         if cursor_id:
             index = next((i for i, e in enumerate(entries) if e.get('id') == cursor_id), None)
-            if index is not None and index != self.cursor:
-                self.top = max(0, self.top + (index - self.cursor))
+            if index is not None:
                 self.cursor = index
         self.cursor = max(0, min(self.cursor, len(entries) - 1))
 
@@ -942,6 +1689,7 @@ class Sidebar:
         (the target file); relative to the cursor lane when the shown one is not in the list (nothing shown yet, or it
         does not need you); from the first / last only when neither is — so two Tabs always visit two lanes, also
         before open_lane has moved the target (spec §4.5)."""
+        self.begin_action()
         lanes = self.needs_you()
         if not lanes:
             self.message = 'nothing needs you'
@@ -959,23 +1707,38 @@ class Sidebar:
         self.open_lane(entry)
 
     def osc_bytes(self, target):
-        """The pane title when the header counts changed since the last frame, and one OSC 9 per lane per transition
-        into needs-you — never for `target` (the lane this view shows), never on a phone, never under LANES_NOTIFY=0
-        (spec §4.9). Strings only: they ride the frame's single write, after the footer."""
+        """The pane title when the header counts changed since the last frame, and one OSC 9 per lane per ENTRY into
+        needs-you — never for `target` (the lane this view shows), never on a phone, never when `notify` resolved off
+        (spec §4.9; the device file's `notify: "0"`, else LANES_NOTIFY=0 — cockpit v3 P4, DEF-1577). An entry is
+        statusd's `agent.stable_since` (cockpit v3 S2), so a lane whose word moves inside the
+        section (needs_input -> needs_approval -> needs_input, a busy blip held by the 8 s dwell) is announced once,
+        however often status.json is rewritten; until S2 each status change was a new notification (DEF-1811). From a
+        statusd older than S1 (no `stable_since`) the status itself is the key: one per status, as before. Strings
+        only: they ride the frame's single write, after the footer.
+
+        On a phone the title also ends ` · › <verb>` while a prompt that KEYS answer is open (cockpit v3 S5,
+        DM-LANES-SIDEBAR-TITLE): `close`, `promote` at its y/n confirmation, `register` (Add to workspace). The phone
+        shell reads it to show its reduced quick row (⏎ y Esc) on the picker tab, so those prompts can be answered
+        without the keyboard. Never while a name field is open (`R`, `P`'s name stage): the row's `y` would be typed
+        into the name (S5 fix cycle 1, DEF-1819). A desktop title stays counts-only (nothing reads a verb there)."""
         out = ''
         counts = self.header_counts()
-        if counts != self.last_counts:
-            self.last_counts = counts
-            out += f'\033]2;{osc_text(self.title + (" · " + counts if counts else ""))}\033\\'
-        quiet = self.mobile or os.environ.get('LANES_NOTIFY') == '0'
+        field = bool(self.prompt) and self.prompt['stage'] == 'name'   # a caret: keys are text here
+        asking = self.asking if self.mobile and not field else None
+        if (counts, asking) != (self.last_counts, self.last_asking):
+            self.last_counts, self.last_asking = counts, asking
+            tail = [part for part in (counts, asking and f'{self.glyphs["marks"]["lead"]} {asking}') if part]
+            out += f'\033]2;{osc_text(" · ".join([self.title, *tail]))}\033\\'
+        quiet = self.mobile or not self.notify
         notified, now = self.notified, {}
-        for entry in self.entries:
+        for entry in self.shown_lanes():           # a lane the owner hid announces nothing (cockpit v3 R5)
             agent = (self.status.get(entry.get('id', '')) or {}).get('agent')
             status = agent.get('status') if isinstance(agent, dict) else None
             if status not in NEEDS_YOU:
                 continue
-            now[entry['id']] = status
-            if not quiet and notified.get(entry['id']) != status and entry['id'] != target:
+            entered = number(agent.get('stable_since'))
+            now[entry['id']] = status if entered is None else entered
+            if not quiet and notified.get(entry['id']) != now[entry['id']] and entry['id'] != target:
                 text = osc_text(f'{entry.get("name", entry["id"])}: {agent.get("name") or status}')
                 out += f'\033]9;{text}\033\\'
         self.notified = now        # a lane that left needs-you is forgotten: its next entry is news again
@@ -984,8 +1747,11 @@ class Sidebar:
     def _visible(self):
         if self.registration:
             return self.registration_choices + [{'id': '', 'name': 'Cancel', 'action': 'cancel-registration'}]
-        # Filter mode flattens the sections exactly as before (dividers are dropped below); the agent glyph stays.
-        entries = list(self.entries) if self.filter else self.sectioned(self.entries)
+        # Filter mode flattens the sections exactly as before (dividers are dropped below); the agent glyph stays. A
+        # lane the owner hid is in neither (cockpit v3 R5) until `o` shows it; the filter keeps its match order (pins
+        # lead a section, never the matches).
+        lanes = self.shown_lanes()
+        entries = list(lanes) if self.filter else self.sectioned(lanes)
         if self.zmx:
             entries.append({'id': '', 'divider': True, 'name': f'zmx lanes ({len(self.zmx)})'})
             entries += self.zmx
@@ -993,10 +1759,14 @@ class Sidebar:
         # those are orphaned or operator-made sessions that are ALIVE, and nothing alive is ever hidden —
         # except a session that IS registered (it is listed under its workspace instead, never twice).
         registered = {R.key(lane) for w in self.workspaces for lane in w.get('lanes', []) if lane.get('holder') == 'tmux'}
-        unregistered = [e for e in self.unregistered if not R.eligible(e) or R.key(e) not in registered]
+        unregistered = [e for e in self.closing_rows(self.promoted_rows(self.unregistered))
+                        if not R.eligible(e) or R.key(e) not in registered]
         if not self.attach_only:
             entries.append({'id': '', 'divider': True, 'name': f'Unregistered ({len(unregistered)})'})
-            entries.append({'id': self.workspace + '--new-shell', 'name': 'New +', 'action': 'new-shell', 'icon': '＋'})
+            new = {'id': self.workspace + '--new-shell', 'name': 'New +', 'action': 'new-shell', 'icon': '＋'}
+            if new['id'] in self.actions:   # a shell on its way (cockpit v3 S9): the row says so and makes no second
+                new['pending'] = 'new-shell'
+            entries.append(new)
             entries += unregistered
         if not self.filter:
             return entries
@@ -1026,11 +1796,23 @@ class Sidebar:
         return max(1, score)
 
     # -------------------------------------------------------------- actions
+    def begin_action(self):
+        """An action begins (cockpit v3 S6): the last action's message goes, so the footer never shows what an EARLIER
+        action said beside what this one does. Called first by every verb — open (⏎ Space → J K 2 3, Tab, a click on a
+        row), `x`/`×`, `R`, `P`, `a`/`+`, `/`, `U` (and a click on the strip), `+`, `r`, `?`, `u`, `z`, a sidebar-key
+        chord. A cursor move, a typed letter, Esc, the wheel, a report begin nothing: a message outlives them for
+        MESSAGE_S. An undo offer (`u`, cockpit v3 S7) is not a message: only `z`, the next `u` or UNDO_S end it."""
+        self.message = ''
+
     def open_lane(self, entry, slot=None):
         if entry.get('divider'):
             return
+        self.begin_action()
+        if entry.get('pending') == 'close' and self.still_pending(entry):
+            return   # a session being ended is no lane to look at: a view of it would be cleared under the person
         if entry.get('action') == 'cancel-registration':
             self.cancel_registration()
+            self.release_focus()
             return
         if entry.get('action') == 'register-workspace':
             self.register_lane(entry['workspace'])
@@ -1046,71 +1828,268 @@ class Sidebar:
         if self.agent_of(entry['id']):
             self.mark_seen(entry['id'])     # the one caller (spec §10): opening a lane is looking at it
         if self.slot_target(slot) == entry['id']:
-            self.focus_lane(slot)
+            self.hand_off(slot)
             self.filter, self.filtering, self.dirty = '', False, True
             return
         # The one "write the target, wake that view.sh" (lanes_lib.show_lane), shared with `lanes next|prev`.
         if not L.show_lane(self.view_dir, self.workspace, slot, entry['id']):
             self.message = 'view not running yet'
-        self.focus_lane(slot)
+        self.hand_off(slot)
         self.filter, self.filtering = '', False
         self.dirty = True
 
     def new_shell(self, slot=None):
-        self.message = 'Creating shell…'
-        self.render()
-        try:
-            entry = A.new_shell(self.workspace)
-            self.unregistered.append(entry)
-            self.status[entry['id']] = {'state': 'quiet'}
-            self.open_lane(entry, slot)
-            self.message = 'Created ' + entry['name']
-        except (L.LanesError, OSError, ValueError) as error:
-            self.message = str(error)
+        """`+` or the New shell row: start a persistent shell on the worker (cockpit v3 S9; until S9 `docker exec` held
+        the frame for up to 15 s). The New shell row carries the `pending` mark meanwhile and a second `+` makes no second
+        shell; the keyboard stays here — the action has not ended — and shell_created() opens the shell where it was
+        asked for, as before S9, unless the person has moved on."""
+        self.begin_action()
+        key = self.workspace + '--new-shell'
+        if key in self.actions:
+            self.still_pending({'pending': 'new-shell'})
+            return
+        slot = slot or self.slot
+        self.message = 'Creating a shell'
+        self.start_action(key, {'verb': 'new-shell', 'slot': slot, 'shown': self.slot_target(slot)},
+                          A.new_shell, self.workspace)
+
+    # ------------------------------------------------------ actions on the worker (cockpit v3 S9)
+    def start_action(self, key, action, call, *args):
+        """Hand `call(*args)` to the worker under `key` (Worker.submit) and remember `action` until its answer. The
+        backend is the one bound now, on the UI thread, when the key is pressed. The row the job is on shows the
+        `pending` mark from this frame on (closing_rows, promoted_rows, the New shell row)."""
+        self.actions = {**self.actions, key: action}
+        if self.worker is None:
+            self.worker = Worker()
+        self.worker.submit(key, call, *args)
+        self.dirty = True
+
+    def finish_actions(self):
+        """run()'s tick: apply every answer the worker has filed since the last tick, in order -> True when one came (one
+        repaint). A drain, never a wait: an action still running stays `pending` until a later tick."""
+        answers = self.worker.answers() if self.worker else []
+        for key, ok, value in answers:
+            action = self.actions.get(key)
+            self.actions = {k: v for k, v in self.actions.items() if k != key}
+            if action is None:
+                continue
+            if action['verb'] == 'close':
+                self.closed(action, ok, value)
+            elif action['verb'] == 'promote':
+                self.promoted(action, ok, value)
+            else:
+                self.shell_created(action, ok, value)
+        if answers:
+            self.dirty = True
+        return bool(answers)
+
+    def closing_rows(self, rows):
+        """statusd's unregistered `rows` while closes are on their way: the row being closed carries `pending: 'close'`
+        (column 3's mark, neither control, no verb: still_pending) and stays listed when a status.json does not list it
+        — the session is ending, it is not gone until the close says so. Matched by id: statusd lists one session under
+        one id, and a closable row need not have a tmux binding. Pure; `rows` is not modified."""
+        closing = {key: action['entry'] for key, action in self.actions.items() if action['verb'] == 'close'}
+        if not closing:
+            return rows
+        out = [dict(row, pending='close') if row.get('id') in closing else row for row in rows]
+        listed = {row.get('id') for row in rows}
+        return out + [dict(entry, pending='close') for key, entry in closing.items() if key not in listed]
+
+    def closed(self, action, ok, value):
+        """A close answered: the row goes (statusd's next listing agrees) and the footer says ` Closed name`; a refusal
+        or a failure puts the row back as statusd lists it, every verb with it, and says why. The viewports close_lane
+        emptied stay empty on a close; on a refusal each one that still shows nothing gets the session back — before S9 a
+        refusal never touched the view — and one the person pointed elsewhere meanwhile keeps what they chose."""
+        entry = action['entry']
+        if not ok:
+            self.give_back(action.get('emptied', ()), entry['id'])
+            self.message = failure_text(value)
+            return
+        self.unregistered = [e for e in self.unregistered if e['id'] != entry['id']]
+        self.status.pop(entry['id'], None)
+        self.message = 'Closed ' + entry['name']
+
+    def promoted(self, action, ok, value):
+        """`P`'s write answered. Done: the held row (hold_promoted, at the Enter) learns the id sync is expected to give
+        the lane and the handle of the sync the job started — S8's watch (settle_pending, expire_pending) takes it from
+        there; a hold the registry already settled meanwhile needs neither. Refused or failed: the hold goes — the row is
+        statusd's again, its name as listed, every verb back — and the footer says why (` Already declared as …`)."""
+        old = action['entry']['id']
+        if not ok:
+            self.pending = {k: v for k, v in self.pending.items() if k != old}
+            self.pending_rows = {k: v for k, v in self.pending_rows.items() if k != old}
+            self.message = failure_text(value)
+            return
+        new_id, sync = value
+        if old in self.pending_rows:
+            self.pending = {**self.pending, old: new_id}
+            self.pending_rows = {**self.pending_rows, old: dict(self.pending_rows[old], sync=sync)}
+
+    def shell_created(self, action, ok, value):
+        """A new shell answered. It is listed under Unregistered at once (statusd lists it on its next cycle) and opened
+        in the viewport `+` asked for — the view shows it and the keyboard goes to it, as before S9 — only while nothing
+        has moved on: the keyboard is still here (keys_here: Zellij's focus report, else a key within FOCUS_LEGEND_S),
+        nothing is open on the sidebar, and that viewport still shows what it showed at `+`. An answer arrives on the
+        tick, not on a key, so it never moves a view or the keyboard from under a person who went elsewhere; then the
+        cursor, if it is still on the New shell row, goes to the shell (Enter opens it — on the New shell row it would
+        make a second one). A failure says why and keeps the keyboard, as a refusal does.
+
+        statusd may have listed the session already (S9 fix cycle 1, DEF-1767): the tick's reload() runs before this,
+        and statusd's cycle can observe a session the worker made a moment ago. Then that row IS the shell — one
+        session, one row (listed_row) — and its observation stands; until the fix a second identical row was appended
+        and the observation overwritten with `quiet` until statusd's next rewrite."""
+        if not ok:
+            self.message = failure_text(value)
+            return
+        entry = self.listed_row(value)
+        if entry is None:
+            entry = value
+            self.unregistered = self.unregistered + [entry]
+            self.status.setdefault(entry['id'], {'state': 'quiet'})
+        idle = not (self.asking or self.filtering or self.armed or self.showing_keys)
+        if idle and self.keys_here() and self.slot_target(action['slot']) == action['shown']:
+            self.open_lane(entry, action['slot'])
+        elif self.cursor_id == self.workspace + '--new-shell':
+            self.resolve_cursor(self.visible(), entry['id'])
+        self.message = 'Created ' + entry['name']
+
+    def listed_row(self, entry):
+        """The row statusd's listing (self.unregistered) already has for `entry`'s session, or None. A tmux row is matched
+        by its binding, as keep_moved_row and promoted_rows match; any other by id. statusd and new_shell name a session
+        alike (session_actions.make_entry: the id is the binding's digest), so either way it is one session."""
+        for row in self.unregistered:
+            if row.get('id') == entry.get('id') or (
+                    R.eligible(entry) and R.eligible(row) and R.key(row) == R.key(entry)):
+                return row
+        return None
+
+    # ------------------------------------------------------------- the prompt
+    def open_prompt(self, verb, entry, stage, value):
+        """Open THE prompt (cockpit v3 S6): one footer question at a time — a new one replaces any other — answered by
+        handle_keys() (`name`: typed, ⏎ accepts; `confirm`: `y` arms, ⏎ acts, any other key cancels) and drawn by
+        footer_text() on the desktop and the phone alike."""
+        self.prompt = {'verb': verb, 'entry': entry, 'stage': stage, 'value': value, 'armed': False}
         self.dirty = True
 
+    def close_prompt(self):
+        """End the prompt -> the one that was open ({} when none was): its caller acts on it, or says why not."""
+        prompt, self.prompt, self.dirty = self.prompt or {}, None, True
+        return prompt
+
+    def cancel_prompt(self):
+        """End the prompt unanswered: the footer says ` Cancelled` (an Esc, any other key at a confirmation, an emptied
+        name, a sidebar-key chord)."""
+        self.close_prompt()
+        self.message = 'Cancelled'
+
     def request_close(self, entry):
-        """`x` or a click on `×`: ask first (spec §4.6(a)); handle() closes on `y` and cancels on anything else."""
+        """`x` or a click on `×`: ask first (spec §4.6(a)); handle() arms on `y`, closes on the Enter after it and cancels
+        on anything else (cockpit v3 S3). A lane that cannot be closed asks nothing and keeps the keyboard: the `y` typed
+        next must land here, not in the lane (an agent's approval prompt). A registered lane — added with `a`, or
+        declared — says what comes first (cockpit v3 S7; until then `x` there was a silent no-op)."""
+        self.begin_action()
+        if self.still_pending(entry):
+            return
         if entry.get('closable'):
-            self.confirming, self.dirty = entry, True
+            self.open_prompt('close', entry, 'confirm', entry.get('name', ''))
+        elif entry.get('registered_session') or A.declared_in(entry):
+            self.message, self.dirty = 'registered: u to unregister first', True
+
+    def still_pending(self, entry):
+        """A row an action is on takes no other verb until it has answered (cockpit v3 S9 generalised S8's rule): the row
+        `x` is closing (`pending: 'close'`), the session `P` is registering (`'promote'`, until the registry lists its
+        lane: a close, an add, a rename, a second promote or an unregister would act on a session terminals.json already
+        declares — an add would register its binding twice, DEF-1555's shape), the New shell row while a shell is on its
+        way (`'new-shell'`). Says so and keeps the keyboard, as every refusal does -> True when refused. Opening a row
+        being registered is no verb (the session is the same one); a row being closed refuses that too (open_lane)."""
+        verb = entry.get('pending')
+        if not verb:
+            return False
+        g = self.glyphs['marks']
+        what = 'a shell' if verb == 'new-shell' else f'{g["quote-open"]}{entry.get("name", "")}{g["quote-close"]}'
+        self.message = f'{PENDING_WORDS.get(verb, PENDING_WORDS["promote"])} {what} {g["dash"]} a moment'
+        self.dirty = True
+        return True
 
     def close_lane(self, entry):
+        """The armed confirmation's Enter: the close runs on the worker (cockpit v3 S9; until S9 it held the frame through
+        the registry lock and three tmux answers) and the keyboard goes back to the lane at once — the action has ended
+        for the keyboard (S3). The row stays, `pending`, until closed() takes the answer.
+
+        The session lives until the worker's kill, up to a 5 s lock wait and three 5 s tmux answers later, so every
+        viewport of this view that shows it is emptied FIRST (empty_views; S9 fix cycle 1, DEF-1767): the keyboard then
+        lands on view.sh's `No lane selected` screen, which discards keys, never in the shell being killed. Before S9,
+        close_session's clear_viewers emptied the view before release_focus; it still empties other devices' views after
+        the kill. closed() gives an emptied viewport the session back if the close is refused."""
         if not entry.get('closable'):
             return
-        self.message = 'Closing ' + entry['name'] + '…'
-        self.render()
         try:
-            A.close_session(self.workspace, entry)
-            self.unregistered = [e for e in self.unregistered if e['id'] != entry['id']]
-            self.status.pop(entry['id'], None)
-            self.message = 'Closed ' + entry['name']
-        except (L.LanesError, OSError, ValueError) as error:
-            self.message = str(error)
-        self.dirty = True
+            emptied = self.empty_views(entry['id'])
+        except OSError as error:   # a view still on the session would take the keys: close nothing, keep the keyboard
+            self.message = f'Could not clear the view: {error.strerror or failure_text(error)}; nothing was closed'
+            self.dirty = True
+            return
+        g = self.glyphs['marks']
+        self.message = f'Closing {g["quote-open"]}{entry["name"]}{g["quote-close"]}'
+        self.start_action(entry['id'], {'verb': 'close', 'entry': entry, 'emptied': emptied},
+                          A.close_session, self.workspace, entry)
+        self.release_focus()
+
+    def empty_views(self, lane_id):
+        """Point every viewport of this view that shows `lane_id` at nothing (EMPTY_VIEW; lanes_lib.show_lane writes the
+        target and wakes its view.sh, as an open does) -> the slots emptied, for closed() to give back on a refusal.
+        A viewport showing another lane is left alone. A target that cannot be written (a full disk) raises OSError
+        after the slots already emptied are given back: close_lane then closes nothing."""
+        emptied = []
+        try:
+            for slot in SLOTS[:self.viewports]:
+                if self.slot_target(slot) == lane_id:
+                    L.show_lane(self.view_dir, self.workspace, slot, EMPTY_VIEW)
+                    emptied.append(slot)
+        except OSError:
+            self.give_back(emptied, lane_id)
+            raise
+        return tuple(emptied)
+
+    def give_back(self, slots, lane_id):
+        """Point each of `slots` that still shows nothing (EMPTY_VIEW) back at `lane_id`; one pointed elsewhere since
+        keeps the person's choice. Runs on run()'s tick (closed()), so a target that cannot be written is no crash: that
+        view stays on `No lane selected`, and Enter on the row opens it again."""
+        for slot in slots:
+            if self.slot_target(slot) == EMPTY_VIEW:
+                try:
+                    L.show_lane(self.view_dir, self.workspace, slot, lane_id)
+                except OSError:
+                    pass
 
     def start_rename(self, entry):
-        """Begin inline rename of the lane under the cursor."""
-        if entry.get('divider') or entry.get('action'):
+        """Begin inline rename of the lane under the cursor: the `rename` prompt's name field, prefilled."""
+        self.begin_action()
+        if entry.get('divider') or entry.get('action') or self.still_pending(entry):
             return
-        self.renaming = True
-        self.rename_entry = entry
-        self.rename_value = entry.get('name', '')
-        self.dirty = True
+        self.open_prompt('rename', entry, 'name', entry.get('name', ''))
 
     def commit_rename(self):
-        """Confirm the in-progress rename."""
-        entry = self.rename_entry
-        new_name = self.rename_value.strip()
-        self.renaming, self.rename_entry, self.rename_value = False, None, ''
-        if not new_name or not entry:
-            self.dirty = True
+        """Confirm the in-progress rename; the keyboard then goes back to the lane (cockpit v3 S3). An emptied name, or
+        the name the lane already has, changes nothing and says so (cockpit v3 S8: until then a silent no-op)."""
+        prompt = self.close_prompt()
+        entry, new_name = prompt.get('entry'), prompt.get('value', '').strip()
+        if not entry:
+            self.release_focus()
+            return
+        if not new_name or new_name == entry.get('name'):
+            self.message = 'name unchanged'
+            self.release_focus()
             return
         try:
             # Routed by the registry SHAPE, never by the id's spelling: an adopted session keeps its `--x-` id
             # but its name authority is registered-sessions.json, not user-sessions/ (DEF-1556).
             if entry.get('registered_session'):
-                R.rename(entry['id'], new_name)
-                self.message = f'Renamed → {new_name}'
+                try:
+                    R.rename(entry['id'], new_name)
+                    self.message = f'Renamed → {new_name}'
+                except L.ProjectionRefused as error:   # saved and published; a container refused its own copy
+                    self.message = f'Renamed → {new_name}; {error.pending}'
                 self.reload(force=True)
             elif entry.get('closable'):
                 # Unregistered session
@@ -1122,10 +2101,12 @@ class Sidebar:
             else:
                 # Registered lane: a repositories[i].displayNames override in the board manifest + sync.
                 # The lane id never changes, so the cursor, view targets and `lane open <id>` keep working.
+                # `declared_display` (the container's terminals.json name, LNS-33) is what "back to the default" means.
                 registry_name = entry.get('registry_name') or entry.get('name', '')
                 if not entry.get('repo'):
                     raise L.LanesError('No repository for this lane; edit the workspace manifest directly')
-                A.rename_registered(L.manifest_path(self.workspace), entry['repo'], registry_name, new_name)
+                A.rename_registered(L.manifest_path(self.workspace), entry['repo'], registry_name, new_name,
+                                    declared_display=entry.get('declared_display'))
                 # Trigger a registry rebuild
                 import subprocess as _sp
                 _sp.Popen([os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
@@ -1135,10 +2116,14 @@ class Sidebar:
         except (L.LanesError, OSError, ValueError) as error:
             self.message = str(error)
         self.dirty = True
+        self.release_focus()
 
     def start_promote(self, entry):
-        """Begin promotion confirmation for an unregistered session."""
-        if entry.get('divider') or entry.get('action'):
+        """Begin promotion of an unregistered session: the `promote` prompt's name stage, prefilled with the session's
+        name (Enter accepts it), then its confirmation — `y` arms, Enter registers (cockpit v3 S3). A refusal asks
+        nothing and keeps the keyboard, as `x` on a lane that cannot be closed does."""
+        self.begin_action()
+        if entry.get('divider') or entry.get('action') or self.still_pending(entry):
             return
         # Gated the way `start_registration` is: only an UNREGISTERED, reconnectable tmux session. A repository
         # lane or an adopted (`registered_session`) lane is already registered; promoting it would append a
@@ -1151,34 +2136,249 @@ class Sidebar:
             self.message = 'Only unregistered tmux sessions can be promoted'
             self.dirty = True
             return
-        self.promoting = True
-        self.promote_entry = entry
+        self.open_prompt('promote', entry, 'name', entry.get('name', ''))
+
+    def accept_promote_name(self):
+        """Enter on the name stage: an empty name registers nothing (cancelled); otherwise the confirmation."""
+        name = self.prompt['value'].strip()
+        if not name:
+            self.cancel_prompt()
+            self.release_focus()
+            return
+        self.prompt.update(stage='confirm', value=name, armed=False)
         self.dirty = True
 
     def commit_promote(self):
-        """Confirm the in-progress promotion (caller has already checked 'y')."""
-        entry = self.promote_entry
-        self.promoting, self.promote_entry = False, None
+        """Register the session under the accepted name (the caller has seen `y` then Enter); the keyboard then goes back
+        to the lane. The name is the terminal's title in terminals.json, so it is checked as every lane name is, here,
+        before anything is written, and it reaches the writer as `name=` (cockpit v3 S8). The write and the `lanes sync`
+        it starts run on the worker (promote_job, cockpit v3 S9), and the row is held from this Enter on: it STAYS where
+        it is, under its old id, with the new name and the `pending` mark (hold_promoted) — promoted() then gives the
+        hold the expected id and the sync's handle (expire_pending never lets go while that job or that sync runs), or
+        lets it go with the writer's refusal — until the registry lists its lane, where settle_pending moves the cursor
+        onto it. A sync that cannot be started holds the row all the same: terminals.json already declares the session,
+        and statusd's hot sync starts one on the change. No reload: until S8 the row was dropped and a forced reload read
+        the status.json statusd had written before the sync, which put it back under its old name before the sync moved
+        it (DEF-1827)."""
+        prompt = self.close_prompt()
+        entry, name = prompt.get('entry'), prompt.get('value', '')
         if not entry:
-            self.dirty = True
+            self.release_focus()
             return
         try:
-            registry = read_json(self.registry_path) or {}
-            A.promote_to_registered(self.workspace, entry, registry)
-            # Trigger a registry rebuild so the lane moves from unregistered → registered
-            import subprocess as _sp
-            _sp.Popen([os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
-                                    'bin', 'lanes'), 'sync'],
-                      stdout=_sp.DEVNULL, stderr=_sp.DEVNULL)
-            self.unregistered = [e for e in self.unregistered if e['id'] != entry['id']]
-            self.message = f'Promoted — reload in a moment'
-            self.reload(force=True)
-        except (L.LanesError, OSError, ValueError) as error:
-            self.message = str(error)
+            L._title(name)
+        except L.LanesError as error:
+            self.message, self.dirty = str(error), True
+            self.release_focus()
+            return
+        self.hold_promoted(entry, name, None)
+        self.start_action(entry['id'], {'verb': 'promote', 'entry': entry, 'name': name}, promote_job,
+                          A.promote_to_registered, subprocess.Popen, self.workspace, entry, self.registry_path, name)
+        g = self.glyphs['marks']
+        self.message = f'Registering {g["quote-open"]}{name}{g["quote-close"]}'
+        self.release_focus()
+
+    # ------------------------------------------------------- a promotion on its way (cockpit v3 S8)
+    def hold_promoted(self, entry, name, new_id, sync=None):
+        """Keep the promoted session's row (promoted_rows) until the registry lists its lane (settle_pending) or
+        PENDING_S passes with no job or sync of ours running (expire_pending). `new_id` is the id lanes sync is expected
+        to give it (None: not known — commit_promote holds the row before the worker's write says it, promoted() fills it
+        in); `sync` the `lanes sync` this sidebar started for it (None: none started yet, or none could be)."""
+        row = dict(entry, name=name, pending='promote')
+        self.pending = {**self.pending, entry['id']: new_id}
+        self.pending_rows = {**self.pending_rows, entry['id']: {'row': row, 'at': time.monotonic(), 'sync': sync}}
+
+    def promoted_rows(self, rows):
+        """statusd's unregistered `rows` as this sidebar shows them while a promotion is on its way: the session's row
+        carries its new name and `pending: 'promote'` (column 3's mark; no verb but open, still_pending), and it stays
+        listed when a status.json does not list it (a probe cut at statusd's deadline) — the session is listed exactly
+        once from `P` until the registry lists its lane, where _visible() hides the row (its binding is registered).
+        Matched by binding, as keep_moved_row matches. Pure; `rows` is not modified."""
+        if not self.pending_rows:
+            return rows
+        held = {R.key(h['row']): h['row'] for h in self.pending_rows.values()}
+        out, seen = [], set()
+        for row in rows:
+            mine = held.get(R.key(row)) if R.eligible(row) else None
+            if mine is None:
+                out.append(row)
+            else:
+                out.append(dict(row, name=mine['name'], pending='promote'))
+                seen.add(R.key(row))
+        return out + [row for key, row in held.items() if key not in seen]
+
+    def settle_pending(self, cursor_id):
+        """reload(): a promotion whose lane the registry now lists is done -> `cursor_id`, mapped onto that lane when it
+        was the promoted row: the cursor lands on the new id. The lane is the one holding the session's binding —
+        `self.pending`'s id when the registry lists it for that binding, else whichever id it lists for it. The binding
+        decides because the predicted id is only a prediction: sync suffixes an id the board already has (`-2`), and
+        then the predicted id is ANOTHER lane's, which the cursor must never land on."""
+        if not self.pending:
+            return cursor_id
+        lanes = [e for e in self.entries if e.get('holder') == 'tmux' and e.get('id')]
+        by_key = {}
+        for lane in lanes:
+            by_key.setdefault(R.key(lane), lane['id'])
+        by_id = {lane['id']: R.key(lane) for lane in lanes}
+        pending, rows = dict(self.pending), dict(self.pending_rows)
+        for old_id, new_id in self.pending.items():
+            key = R.key(rows[old_id]['row'])
+            lane_id = new_id if new_id and by_id.get(new_id) == key else by_key.get(key)
+            if lane_id is None:
+                continue
+            del pending[old_id], rows[old_id]
+            if cursor_id == old_id:
+                cursor_id = lane_id
+        self.pending, self.pending_rows = pending, rows
+        return cursor_id
+
+    def expire_pending(self, now=None):
+        """run()'s tick: a promotion the registry has not listed PENDING_S after `P` lets go — the row is statusd's again
+        (its name as listed, no mark, every verb back) and the footer says the registry has not listed it; a failed sync
+        shows its own ` ⚠ registry: …` line. Never while the `lanes sync` this sidebar started for it still runs (S8 fix
+        cycle 1, DEF-1762): that is a sync on its way, and the footer would send the operator to start another. Nor while
+        the worker has not answered its write (cockpit v3 S9: a job queued behind a slow close). Each tick `poll()`s the
+        sync, which also reaps one that has ended. -> True when one went (one repaint)."""
+        now = time.monotonic() if now is None else now
+
+        def syncing(old, held):
+            sync = held.get('sync')
+            return old in self.actions or (sync is not None and sync.poll() is None)
+
+        gone = [old for old, held in self.pending_rows.items()
+                if not syncing(old, held) and now - held['at'] >= PENDING_S]
+        if not gone:
+            return False
+        g = self.glyphs['marks']
+        name = self.pending_rows[gone[-1]]['row'].get('name', '')
+        self.pending = {k: v for k, v in self.pending.items() if k not in gone}
+        self.pending_rows = {k: v for k, v in self.pending_rows.items() if k not in gone}
+        self.message = f'{g["quote-open"]}{name}{g["quote-close"]} not listed yet {g["dash"]} lanes sync'
+        self.dirty = True
+        return True
+
+    def answer_prompt(self, ch):
+        """One typed key at a `confirm` stage — `close` and `promote` alike (cockpit v3 S6). `y` arms; Enter, once armed,
+        acts; anything else cancels, is consumed and hands the keyboard back. An escape sequence never gets here:
+        prompt_sequence() answers those, at either stage, before any (until S6 the register confirmation was read
+        after the escape sequences, so an arrow or a click under it moved the cursor or opened a lane and left it
+        open, DEF-1823)."""
+        prompt = self.prompt
         self.dirty = True
+        if ch in 'yY' and not prompt['armed']:
+            prompt['armed'] = True
+            return
+        if ch in '\r\n' and prompt['armed']:
+            if prompt['verb'] == 'close':
+                self.close_lane(self.close_prompt()['entry'])   # hands the keyboard back when it is done
+            elif prompt['verb'] == 'hide':
+                self.commit_hide_workspace()
+            else:
+                self.commit_promote()
+            return
+        self.cancel_prompt()
+        self.release_focus()
+
+    def prompt_sequence(self, key):
+        """ONE escape sequence (as key_length() cuts it) while the prompt is open, at either stage (cockpit v3 S6 fix
+        cycle 1, DEF-1824: S6 gave a rule to the confirmation only, and under a name field → or a click on a row opened
+        the lane — the keyboard went to it — and left the field open in the footer, so the next key typed on the
+        sidebar went into a name nobody was editing any more). -> True when the caller handles the sequence as usual —
+        the prompt cancelled first (` Cancelled`): a click on a row then opens that lane, on `×` asks to close it —;
+        False when the sequence is consumed and the prompt stays.
+        Both stages: what does not prove the keyboard is here (moves_focus) is no answer — a mouse release (one follows
+        every press, the `×` click that opened a confirmation included), a wheel tick, motion, a report cut at the end
+        of the read; the list does not scroll under a prompt. A press answers: a click is aimed at the list.
+        A confirmation has no text to lose: every other sequence answers too (Esc, an arrow, Shift-Tab, PageDown).
+        A name field keeps the keyboard: Enter, Space, `j` `k` `J` `K` and Tab already type into it or nothing, so
+        their twins → ↑ ↓ PageUp PageDown Shift-Tab ← Home End Delete type nothing in it either — they never open a
+        lane, move the cursor or throw away a half-typed name, and what is typed after them still lands in the field
+        on screen. Only Esc (and Enter, or an emptied name) ends it from the keyboard. A click on the upload strip arms
+        the strip beside the field, which keeps its text and the keyboard (S3 review: the armed strip takes the next
+        paste as the drop, then Enter still saves the name)."""
+        if not moves_focus(key):
+            return False
+        if self.prompt['stage'] == 'name':
+            if not key.startswith('\033[<'):
+                if key != '\033':
+                    return False
+            elif self.strip_press(key):
+                return True
+        self.cancel_prompt()
+        return True
+
+    def strip_press(self, key):
+        """Whether ONE SGR mouse report is the press handle_keys arms the upload strip with: the left button, at or below
+        `box_top`, while the strip is drawn (`box`)."""
+        try:
+            button, _x, y = (int(v) for v in key[3:-1].split(';'))
+        except ValueError:
+            return False
+        return key[-1:] == 'M' and button == 0 and bool(self.box) and y >= self.box_top
+
+    # ------------------------------------------------- the prompt, S3's names (compat)
+    # Read-only views of the one prompt object under the field names S3 used, so code and tests written against them
+    # keep reading the same truth; `rename_value` / `promote_value` may also be assigned while their prompt is open.
+    def prompt_for(self, verb):
+        """The open prompt when its verb is `verb`, else None."""
+        return self.prompt if self.prompt and self.prompt['verb'] == verb else None
+
+    @property
+    def confirming(self):
+        """The entry `x` / `×` asked to close, or None."""
+        return (self.prompt_for('close') or {}).get('entry')
+
+    @property
+    def confirm_armed(self):
+        """`y` armed the open confirmation (close or register): the footer names Enter."""
+        return bool(self.prompt and self.prompt['armed'])
+
+    @property
+    def renaming(self):
+        return self.prompt_for('rename') is not None
+
+    @property
+    def rename_entry(self):
+        return (self.prompt_for('rename') or {}).get('entry')
+
+    @property
+    def rename_value(self):
+        return (self.prompt_for('rename') or {}).get('value', '')
+
+    @rename_value.setter
+    def rename_value(self, value):
+        self.field_of('rename')['value'] = value
+
+    @property
+    def promoting(self):
+        return self.prompt_for('promote') is not None
+
+    @property
+    def promote_entry(self):
+        return (self.prompt_for('promote') or {}).get('entry')
+
+    @property
+    def promote_stage(self):
+        return (self.prompt_for('promote') or {}).get('stage', 'name')
+
+    @property
+    def promote_value(self):
+        return (self.prompt_for('promote') or {}).get('value', '')
+
+    @promote_value.setter
+    def promote_value(self, value):
+        self.field_of('promote')['value'] = value
+
+    def field_of(self, verb):
+        """The open `verb` prompt, to be written: assigning a value with no such prompt open is a bug, never a no-op."""
+        prompt = self.prompt_for(verb)
+        if prompt is None:
+            raise AttributeError(f'no {verb} prompt is open')
+        return prompt
 
     def start_registration(self, entry):
-        if not entry.get('closable') or not R.eligible(entry):
+        self.begin_action()
+        if self.still_pending(entry) or not entry.get('closable') or not R.eligible(entry):
             return
         choices = R.destinations({'workspaces': self.workspaces}, entry)
         choices.sort(key=lambda w: w['id'] != self.workspace)
@@ -1186,32 +2386,280 @@ class Sidebar:
             self.message, self.dirty = 'No workspace uses this session’s container', True
             return
         self.registration = entry
-        self.message = ''
+        self.registration_return = (self.cursor, self.top)   # where cancel_registration puts the list back (S8)
         self.armed = False
         self.registration_choices = [{'id': w['id'], 'workspace': w['id'], 'name': w.get('title') or w['id'],
                                       'action': 'register-workspace'} for w in choices]
         self.filter, self.filtering, self.top, self.dirty = '', False, 0, True
         self.set_cursor(0)
 
-    def cancel_registration(self):
+    def cancel_registration(self, cursor_id=None):
+        """Close the Add to workspace picker and put the list back as it was (cockpit v3 S8): `top` where it was, the
+        cursor on `cursor_id` — the lane `a` just registered — else on the session the picker was opened for (Esc,
+        Cancel, a sidebar-key chord), wherever its row now is; on the row it had when neither is listed (the session
+        went to another workspace). Until S8 the cursor went to row 0 — the first lane — every time, and the `x` or `R`
+        typed next acted on a lane nobody chose (DEF-1827)."""
+        entry = self.registration or {}
+        self.cursor, self.top = self.registration_return
         self.registration, self.registration_choices = None, []
-        self.top, self.dirty = 0, True
-        self.set_cursor(0)
+        self.dirty = True
+        self.resolve_cursor(self.visible(), cursor_id or entry.get('id'))
 
     def register_lane(self, workspace):
         entry = self.registration
         if not entry:
             return
         try:
-            lane = R.register(self.workspace, entry, workspace)
+            pending = ''
+            try:
+                lane = R.register(self.workspace, entry, workspace)
+            except L.ProjectionRefused as error:
+                # Saved and in registry.json, so the lane IS added: finish like a success (the picker closes; a
+                # second Enter would only say "Already registered"), but say which container's `lane open` still
+                # reads the old projection (DEF-1796) instead of leaving that to the timer sync's journal.
+                lane, pending = error.result, '; ' + error.pending
             self.unregistered = [e for e in self.unregistered if e['id'] != lane['id']]
             title = next((w.get('title') or w['id'] for w in self.workspaces if w['id'] == workspace), workspace)
-            self.cancel_registration()
-            self.reload(force=True)
-            self.message = 'Added to ' + title
+            self.reload(force=True)                # R.register published registry.json: the lane is listed now
+            self.cancel_registration(lane['id'])   # and the cursor goes with the session into the list (S8)
+            self.message = 'Added to ' + title + pending
         except (L.LanesError, OSError, ValueError) as error:
             self.message = str(error)
         self.dirty = True
+        self.release_focus()   # a refusal keeps the picker open, and the picker keeps the keyboard
+
+    # ------------------------------------------------------- pins and hidden lanes (cockpit v3 R5)
+    def write_arrangement(self, change):
+        """Write `change` into the owner's profile (users.update as this device, waiting at most PROFILE_LOCK_S) and
+        take the stored arrangement at once — the list changes on this key, not at the next tick (whose reload reads the
+        same profile again). -> True when the profile holds it; False (said in the footer) when the lock was busy or the
+        profile is not one this release writes. An L.LanesError `change` raises (a refusal) propagates, nothing written."""
+        directory = os.path.dirname(self.profile_path)
+        if not users.update(self.login, self.device, change, directory=directory, timeout=PROFILE_LOCK_S):
+            self.message = f'profile busy or unreadable {self.glyphs["marks"]["sep"]} try again'
+            return False
+        self.take_arrangement(users.read(self.login, directory))
+        self.fleet = self.fleet_counts()
+        self.dirty = True
+        return True
+
+    def arrangeable(self, entry, verb):
+        """Whether `p` / `h` may act on `entry`: a registry lane of this workspace, on a device with an owner, no action
+        on its way. Says why not, keeping the keyboard, as every refusal does."""
+        if entry.get('divider') or entry.get('action') or self.still_pending(entry):
+            return False
+        if not self.registry_lane(entry):
+            self.message = f'only a registered lane {verb}'
+            return False
+        if not self.profile_path:
+            self.message = NO_PROFILE
+            return False
+        return True
+
+    def pin_lane(self, entry):
+        """`p`: pin the cursor lane — it leads its section with the ▲ mark on every device of the owner — or unpin it.
+        The cursor goes with the lane; then the keyboard goes back to the lane (cockpit v3 S3)."""
+        self.begin_action()
+        self.dirty = True
+        if not self.arrangeable(entry, 'pins'):
+            return
+        lane_id, pinned = entry['id'], entry['id'] in self.lane_pins
+
+        def change(profile):
+            pins = [ident for ident in profile['lanes']['pins'] if ident != lane_id]
+            profile['lanes']['pins'] = pins if pinned else pins + [lane_id]
+        if self.write_arrangement(change):
+            g = self.glyphs['marks']
+            self.message = f'{"Unpinned" if pinned else "Pinned"} {g["quote-open"]}{entry.get("name", lane_id)}{g["quote-close"]}'
+            self.resolve_cursor(self.visible(), lane_id)
+            self.release_focus()
+
+    def hide_lane(self, entry):
+        """`h`: hide the cursor lane on every device of the owner — it leaves the list, the counts and the notifications,
+        the cursor stays on its row (the next lane) — or, while `o` shows the hidden lanes, show a hidden one again. A
+        session listed under Unregistered is never hidden (nothing alive is), a divider neither."""
+        self.begin_action()
+        self.dirty = True
+        if not self.arrangeable(entry, 'hides'):
+            return
+        lane_id, hidden = entry['id'], entry['id'] in self.lane_hidden
+
+        def change(profile):
+            rest = [ident for ident in profile['lanes']['hidden'] if ident != lane_id]
+            profile['lanes']['hidden'] = rest if hidden else rest + [lane_id]
+        if self.write_arrangement(change):
+            g = self.glyphs['marks']
+            name = f'{g["quote-open"]}{entry.get("name", lane_id)}{g["quote-close"]}'
+            self.message = f'Shown {name}' if hidden else f'Hid {name} {g["sep"]} o shows it'
+            self.release_focus()
+
+    def toggle_hidden(self):
+        """`o`: show the lanes the owner hid (faint, in their places; `h` there shows one for good) or hide them again.
+        The footer says how many; then the keyboard goes back to the lane."""
+        self.begin_action()
+        self.show_hidden, self.dirty = not self.show_hidden, True
+        count = sum(1 for entry in self.entries if entry.get('id') in self.lane_hidden)
+        g = self.glyphs['marks']
+        if not count:
+            self.message = 'no hidden lanes'
+        elif self.show_hidden:
+            self.message = f'showing {count} hidden {g["sep"]} o hides {"it" if count == 1 else "them"}'
+        else:
+            self.message = f'{count} hidden {g["sep"]} o shows {"it" if count == 1 else "them"}'
+        self.release_focus()
+
+    def request_hide_workspace(self):
+        """`H`: ask to hide this workspace for the owner (` › hide ‘title’ — y⏎ confirm`, the one prompt); `y` and Enter
+        hide it (commit_hide_workspace). Refused, keeping the keyboard, on a device nobody owns and for the last
+        workspace the person still sees (users.arrange never leaves a view without one)."""
+        self.begin_action()
+        self.dirty = True
+        if not self.profile_path:
+            self.message = NO_PROFILE
+            return
+        shown = [board.get('id') for board in users.arrange(self.workspaces, {'workspaces': self.profile_workspaces})]
+        if shown == [self.workspace] or not shown:
+            self.message = 'the last workspace shown stays'
+            return
+        self.open_prompt('hide', {'id': self.workspace, 'name': self.title}, 'confirm', self.title)
+
+    def commit_hide_workspace(self):
+        """The armed `H`'s Enter: add this workspace to the profile's `workspaces.hidden` (refused when no other board
+        would be left — the profile may have changed since `H`), then start `lanes upgrade-session` in its own session:
+        it closes this workspace's tab on every live view of the owner (device_sync.reconcile, R4) — this pane's tab
+        included, which is why the child must not die with it. The lanes keep running in their containers."""
+        prompt, workspace = self.close_prompt(), self.workspace
+        boards = [board.get('id') for board in self.workspaces]
+
+        def change(profile):
+            hidden = [ident for ident in profile['workspaces']['hidden'] if ident != workspace] + [workspace]
+            if not [ident for ident in boards if ident not in hidden]:
+                raise L.LanesError('the last workspace shown stays')
+            profile['workspaces']['hidden'] = hidden
+        try:
+            written = self.write_arrangement(change)
+        except L.LanesError as error:
+            self.message, written = str(error), False
+        if written:
+            g = self.glyphs['marks']
+            self.message = f'Hiding workspace {g["quote-open"]}{prompt.get("value", workspace)}{g["quote-close"]}'
+            try:
+                subprocess.Popen([LANES_BIN, 'upgrade-session'], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                 stderr=subprocess.DEVNULL, start_new_session=True)
+            except OSError:
+                pass   # the next `lanes sync` (2 min) or `lanes ensure` (1 min) closes the tab instead
+        self.release_focus()
+
+    # ------------------------------------------------------- unregister and its undo (cockpit v3 S7)
+    def unregister_lane(self, entry):
+        """`u`: take a session added with `a` (`registered_session`) out of registered-sessions.json at once — no
+        confirmation, `z` undoes it for UNDO_S. registrations.unregister publishes the registry without it; the row is
+        put back under Unregistered with the SAME id (keep_moved_row), so the cursor that was on the lane follows it
+        there, and statusd's next cycle lists the session under that id. A session that no longer runs leaves the list
+        (nothing will be listed) and the cursor keeps its row. Then the keyboard goes back to the lane, as after every
+        action that ends (S3) — `z` is pressed on the sidebar (Ctrl-Alt-l; on a phone the picker keeps the keyboard).
+        A lane a repository's terminals.json declares is taken out of that file (session_actions.unregister_lane, the
+        Agent API's minimal-text editor, M4 — wired at the fan-in): its terminal goes, the session keeps running and
+        `lanes sync`, started here, lists it under Unregistered; there is no `z` for it (the file's
+        `<file>.bak-<UTC>` keeps what was there). Refused with a word, keeping the keyboard: the editor's refusals
+        (the last terminal, an adopted lane, a link at or above the file, a file that is gone …), a lane of an SSH
+        workspace (catalog.json, which no editor of ours writes: `declared in … — edit the file`), an unregistered
+        session (`a` adds it), and tmux giving no usable answer about the session. The undo offer lives in
+        `self.undo`, never in the message: the footer draws it below a message. A record out of the file whose hand-back
+        or publication then failed (`R.Unpublished`) keeps its undo: the message says `lanes sync` finishes it, and `z`
+        puts the record back and publishes (fix cycle 1, DEF-1826)."""
+        self.begin_action()
+        if entry.get('divider') or entry.get('action') or self.still_pending(entry):
+            return
+        self.dirty = True
+        dash = self.glyphs['marks']['dash']
+        if entry.get('registered_session'):
+            try:
+                record = R.unregister(entry['id'])
+            except R.Unpublished as error:   # out of the file, not yet published: the undo still stands
+                record, self.message = error.record, str(error)
+            except (L.LanesError, OSError, ValueError) as error:
+                self.message = str(error)
+                return
+            self.undo = {'record': record, 'at': time.monotonic()}
+            self.reload(force=True)          # registry.json is published without it; keep_moved_row puts the row back
+            self.resolve_cursor(self.visible(), entry['id'])
+            self.release_focus()
+        elif entry.get('closable'):
+            self.message = f'not registered {dash} a adds it to a workspace'
+        elif A.declared_in(entry):
+            if not entry.get('source'):      # an SSH workspace's lane: catalog.json, which no editor of ours writes
+                self.message = A.declared_text(entry, dash)
+                return
+            try:
+                done = A.unregister_lane(entry['id'])
+            except (L.LanesError, OSError, ValueError) as error:   # A.DeclaredRefused says why in its own words
+                self.message = str(error)
+                return
+            if done.get('changed'):
+                try:   # statusd's hot-sync would start one within ~15 s; this lists it under Unregistered sooner
+                    subprocess.Popen([LANES_BIN, 'sync'], stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                     stderr=subprocess.DEVNULL, start_new_session=True)
+                except OSError:
+                    pass
+            self.message = 'Unregistered ' + entry.get('name', entry['id'])
+            self.reload(force=True)
+            self.release_focus()
+
+    def keep_moved_row(self):
+        """While `z` can still undo an unregister, the row `u` moved stays under Unregistered until statusd lists the
+        session itself: a status.json from a cycle that began before the unregister would drop it for a cycle, and
+        the cursor on it with it. reload() calls this after every status.json it reads. The row is
+        registrations.ghost — statusd's own shape and id — so the listing replaces it without a second row. While
+        registry.json still lists the lane (its publication failed, R.Unpublished) _visible() shows the lane, not this."""
+        ghost = R.ghost(self.undo['record']) if self.undo else None
+        if ghost and ghost['workspace'] == self.workspace and not any(
+                R.key(e) == R.key(ghost) for e in self.unregistered):
+            self.unregistered = self.unregistered + [ghost]
+
+    def undo_unregister(self):
+        """`z`: within UNDO_S of `u`, register the session again — the record `u` took out, byte for byte, after the
+        identity check `register` makes (registrations.reregister: a session closed and re-created in the window is
+        refused). The cursor follows it back to its workspace's list and the keyboard goes back to the lane. A refusal
+        says why and keeps the offer and the keyboard (a busy registry lock may let a second `z` through). A record
+        saved whose publication failed (`R.Unpublished`) is the undo done: the offer goes and the message says
+        `lanes sync` finishes it."""
+        self.begin_action()
+        self.dirty = True
+        if not self.undo or time.monotonic() - self.undo['at'] >= UNDO_S:
+            self.undo, self.message = None, 'nothing to undo'
+            return
+        record = self.undo['record']
+        message = 'Restored ' + record['name']
+        try:
+            R.reregister(record)
+        except R.Unpublished as error:       # saved, not yet published: undone all the same
+            message = str(error)
+        except (L.LanesError, OSError, ValueError) as error:
+            self.message = str(error)
+            return
+        self.undo = None
+        self.reload(force=True)              # the cursor's id is in the registry again: it follows the row back
+        self.message = message
+        self.release_focus()
+
+    def expire_undo(self, now=None):
+        """run()'s tick: the undo offer UNDO_S old goes -> True when it went (one repaint: the footer loses it)."""
+        if self.undo and (time.monotonic() if now is None else now) - self.undo['at'] >= UNDO_S:
+            self.undo = None
+            return True
+        return False
+
+    def undo_text(self, cols):
+        """The undo offer in the footer: ` Unregistered ‘name’ · z undo`, at most `cols − 1` cells — a long name is
+        clipped with the `truncation` mark before the key would be. Every glyph is a mark: seven-bit in ASCII."""
+        g = self.glyphs['marks']
+        head, tail = f' Unregistered {g["quote-open"]}', f'{g["quote-close"]} {g["sep"]} z undo'
+        name = self.undo['record'].get('name', '')
+        room = cols - 1 - cell_width(head) - cell_width(tail)
+        if cell_width(name) > room:
+            name = clip(name, max(0, room - 1))[0] + g['truncation']
+        return head + name + tail
 
     def spools(self):
         """Where an upload request may be spooled, best first. A suffixed view (mac-2, mac-w2) belongs to the machine
@@ -1225,9 +2673,34 @@ class Sidebar:
             return [os.path.join(STATE, 'upload-requests', base), own]
         return [own]
 
+    def pasted(self, text):
+        """A bracketed paste, routed by what is open (cockpit v3 S3 review). Armed, the upload strip is waiting for exactly
+        this: it is the drop. Otherwise, into the open text field — the ` › Rename: ` or ` › Register as: ` name, the
+        filter — it is typed, as its characters would be: a run of line breaks or tabs is one space (the edges' are
+        dropped), so a copied line never acts as Enter; other control characters are dropped; the field keeps the
+        keyboard. With no field open — a confirmation has none — it is a drop (dropped()): a terminal delivers a file
+        dropped on the pane as a paste of its path."""
+        if not self.armed:
+            typed = ''.join(ch for ch in PASTE_BREAKS.sub(' ', text.strip('\t\n\v\f\r')) if ch.isprintable())
+            if self.prompt and self.prompt['stage'] == 'name':
+                self.prompt['value'] += typed
+                return
+            if self.filtering:
+                self.filter += typed
+                if typed:
+                    self.set_cursor(0)   # the top match, as a typed letter puts it
+                return
+        self.dropped(text)
+
     def dropped(self, text):
-        """A drop arrives as a paste of local path(s). Ask this device's upload helper to send them."""
+        """A drop arrives as a paste of local path(s). Ask this device's upload helper to send them, then hand the
+        keyboard back to the lane (cockpit v3 S3): the drop is the action the armed strip held the keyboard for, and
+        the path is typed into the lane when the upload lands. A paste that is not a drop ends it the same way."""
         self.armed = False
+        self.spool_drop(text)
+        self.release_focus()
+
+    def spool_drop(self, text):
         try:
             tokens = shlex.split(text.strip())
         except ValueError:
@@ -1259,7 +2732,9 @@ class Sidebar:
 
     def poll_upload(self):
         """Follow the request in flight. The strip repaints only when this changes something — a new `.progress`
-        mtime or the end of the upload (spec §4.6(d)): no spinner, no fast tick."""
+        mtime or the end of the upload (spec §4.6(d)): no spinner, no fast tick. It never moves the focus: dropped()
+        handed the keyboard back when the request was spooled, and by the end of an upload the person may be typing
+        in the lane or anywhere else — a `move-focus right` from there would carry the focus away (cockpit v3 S3)."""
         if not self.upload:
             return
         base = os.path.join(self.upload['spool'], self.upload['id'])   # the results land where the request went
@@ -1272,7 +2747,6 @@ class Sidebar:
         note = None
         if os.path.exists(base + '.done'):
             note = ok + ', '.join(self.upload['names'])[:60]
-            self.focus_lane()
         elif os.path.exists(base + '.err'):
             try:
                 with open(base + '.err') as handle:
@@ -1289,6 +2763,73 @@ class Sidebar:
                     pass
             self.upload, self.upload_note, self.upload_note_at, self.dirty = None, note, time.time(), True
 
+    @property
+    def asking(self):
+        """The verb of what the footer is asking — the prompt's (`close` x / ×, `rename` R, `promote` P) or `register`
+        while the Add to workspace picker is open — or None. release_focus() reads it (an open question needs the next
+        key) and a phone's title announces it (osc_bytes). Until cockpit v3 S6 this was the `prompt` property."""
+        if self.prompt:
+            return self.prompt['verb']
+        return 'register' if self.registration else None
+
+    def release_focus(self):
+        """Give the keyboard back to this pane's viewport after an action ends (cockpit v3 S3, plan context item 6). The
+        sidebar and the lane share one keyboard; left on the sidebar, the next sentence a person types becomes `R`ename,
+        `P` or `x` + `y`. Not while a prompt, the filter or the armed upload strip still needs keys, and never on a
+        phone, whose sidebar is a whole tab — going to the lane tab would hide the list the action was on. -> True when
+        the keyboard moved; handle() then drops the rest of the read (it was typed for the lane). Called only for a key
+        or a mouse press (moves_focus): those reach the sidebar only while it has the focus, so the relative
+        `move-focus right` lands on the viewport."""
+        if self.mobile or self.asking or self.filtering or self.armed:
+            return False
+        self.hand_off(self.slot)
+        return True
+
+    def hand_off(self, slot=None):
+        """The one focus move per action (focus_lane), and the mark that the rest of this read is not the sidebar's.
+        The focus legend goes at once (cockpit v3 S4): the keyboard is the lane's before Zellij's `out` report says so.
+        No prompt outlives the keyboard (cockpit v3 S6 fix cycle 1, DEF-1824): one still open here — a path that did
+        not end it first (prompt_sequence ends it before a click opens a lane) — is closed without a word of its own,
+        so the action that moved the keyboard says what it says (` view not running yet`). Left open, its field or
+        question stayed in the footer while the keys went to the lane, and the next key typed on the sidebar answered
+        it. release_focus() never gets here with one open (an open question keeps the keyboard)."""
+        if self.prompt:
+            self.close_prompt()
+        self.focus_lane(slot)
+        self.handed_off = True
+        self.focused, self.legend_until = False, 0.0
+
+    def keys_here(self, now=None):
+        """Whether the footer legend says the keyboard is on this sidebar (cockpit v3 S4). Once Zellij has sent a
+        focus report, `focused` is the truth (reports, keys, hand-offs keep it); before that, a key is the only proof,
+        and the legend stays FOCUS_LEGEND_S after it."""
+        if self.focus_reported:
+            return self.focused
+        return (time.monotonic() if now is None else now) < self.legend_until
+
+    def legend_stale(self, now=None):
+        """run(): the frame on screen says the opposite of keys_here() — the no-report legend ran out — so one repaint.
+        Never on a phone, whose footer has no focus legend (its sidebar is a whole tab)."""
+        return not self.mobile and self.keys_here(now) != self.legend_shown
+
+    @property
+    def message(self):
+        """What the last action said in the footer (` Closed sh`, ` Cancelled`, why a close failed), or ''."""
+        return self._message
+
+    @message.setter
+    def message(self, text):
+        # Every assignment is stamped (cockpit v3 S6): the message lasts MESSAGE_S from when it was SAID.
+        self._message, self.message_at = text, time.monotonic()
+
+    def expire_message(self, now=None):
+        """run()'s tick (cockpit v3 S6): a message MESSAGE_S old goes -> True when it went (one repaint). Otherwise only
+        the next action's begin_action() clears it — never a key, a report, the wheel or a release."""
+        if self._message and (time.monotonic() if now is None else now) - self.message_at >= MESSAGE_S:
+            self._message = ''
+            return True
+        return False
+
     def focus_lane(self, slot=None):
         if os.environ.get('ZELLIJ'):
             actions = ([['go-to-tab-name', self.title]] if self.mobile else
@@ -1320,19 +2861,116 @@ class Sidebar:
         text, _used = clip(text, cols - 1)
         return f'{style}{text}{tone["reset"]}'
 
+    def footer_text(self, cols, entries=(), legend=False):
+        """The footer row -> (text, style, caret): ONE ladder for the desktop and the phone (cockpit v3 S6; until S6 the
+        phone had its own and showed no rename, Register as or register confirmation — DEF-1821). `text` is at most
+        `cols − 1` cells, `cols − 2` when `caret` (a text field's caret takes the last one); `entries` is the list
+        on screen (the filter counts its matches); `legend` that the desktop's keyboard is here (keys_here). Highest
+        first: the prompt (prompt_text) › the Add to workspace picker › the filter › the health banner (a frozen
+        picture must never look live) › the version note (version_note, cockpit v3 V2; not while an update is ready)
+        › a registry error › the last message › the undo offer (undo_text, cockpit v3 S7) › `update ready · reload
+        (r)` (W9 U6: the installed release lays this view out differently; `r` rebuilds it — the desktop's rung and
+        the phone's, in the accent) › the focus legend (desktop) › the idle hint. Only the picker's way out, the
+        legend and the idle hint are a device's own. Every glyph, separator and quote is a mark, so the ASCII footer
+        is seven-bit."""
+        tone, g = self.tone, self.glyphs['marks']
+        sep = f' {g["sep"]} '
+        if self.prompt:
+            return self.prompt_text(cols)
+        if self.registration:
+            way_out = 'Tap Cancel' if self.mobile else 'Esc cancels'
+            text, style = ' ' + (self.message or f'Choose a workspace{sep}{way_out}'), tone['ink-dim']
+        elif self.filtering or self.filter:
+            n = sum(1 for e in entries if not e.get('divider'))
+            text, style = f' /{self.filter}{sep}{n} match{"es" if n != 1 else ""}', tone['ink']
+        elif self.banner:
+            text = ' ' + self.banner
+            style = tone['tone-urgent'] if 'sockets' in self.banner else tone['tone-attention']
+        elif self.version_note(cols):   # cockpit v3 V2: this view runs an older (or newer) tree than the installed one
+            text, style = self.version_note(cols), tone['tone-attention']
+        elif self.errors:
+            text, style = f' {g["warning"]} registry: ' + self.errors[0], tone['tone-urgent']
+        elif self.message:
+            text, style = ' ' + self.message, tone['ink-dim']
+        elif self.undo:          # cockpit v3 S7: the `u` it undoes, until `z` or UNDO_S
+            text, style = self.undo_text(cols), tone['ink-dim']
+        elif self.update_ready:  # W9 U6: the installed release lays this view out differently; `r` rebuilds it
+            text, style = f' update ready{sep}reload (r)', tone['accent']
+        elif self.mobile:
+            text, style = f' Swipe to scroll{sep}Tap to open', tone['ink-dim']
+        elif legend:   # 34 cells (35 in ASCII): the plan's ` ▌ keys go to the sidebar · …` is 38
+            text, style = f' {g["cursor"]} keys go to sidebar{sep}Esc {g["arrow"]} lane', tone['accent']
+        elif self.attach_only:   # a remote workspace: nothing to close, no upload strip
+            text, style = f' {g["enter"]} open{sep}/ find{sep}? keys', tone['ink-dim']
+        else:
+            text, style = f' {g["enter"]} open{sep}/ find{sep}x close{sep}? keys', tone['ink-dim']
+        return clip(text, max(1, cols - 1))[0], style, False
+
+    def prompt_text(self, cols):
+        """The open prompt's footer -> (text, style, caret), one shape per stage (cockpit v3 S6):
+        a `name` stage is the field ` › Rename: value█` / ` › Register as: value█` (ink; a value longer than the field
+        shows its END after the `truncation` mark, so what is typed and the caret stay in view); a `confirm` stage is
+        ` › <word> ‘name’ — y⏎ confirm · Esc cancel` (close tone-urgent, register tone-attention), `⏎ confirm` once `y`
+        armed it — so typed text whose `y` is followed by a letter closes or registers nothing (S3). The instruction
+        always survives: ` cancel` gives way first, then ` · Esc`, then the name is clipped with the `truncation` mark.
+        Under ASCII glyphs `⏎` is the word `Enter`, so `y` and it are joined by `+`."""
+        prompt, tone, g = self.prompt, self.tone, self.glyphs['marks']
+        if prompt['stage'] == 'name':
+            head = f' {g["lead"]} {PROMPT_FIELDS[prompt["verb"]]}: '
+            room, value = max(1, cols - 2) - cell_width(head), prompt['value']
+            if cell_width(value) > room > 1:      # the end of the name, as a one-line editor scrolls
+                tail, used = [], 0
+                for ch in reversed(value):
+                    if used + cell_width(ch) > room - 1:
+                        break
+                    tail.append(ch)
+                    used += cell_width(ch)
+                value = g['truncation'] + ''.join(reversed(tail))
+            return clip(head + value, max(1, cols - 2))[0], tone['ink'], True
+        enter = g['enter']
+        keys = enter if prompt['armed'] else f'y{enter}' if cell_width(enter) == 1 else f'y+{enter}'
+        head = f' {g["lead"]} {PROMPT_WORDS[prompt["verb"]]} {g["quote-open"]}'
+        act = f'{g["quote-close"]} {g["dash"]} {keys} confirm'
+        name = prompt['value']
+        style = tone['tone-urgent'] if prompt['verb'] == 'close' else tone['tone-attention']
+        for tail in (f'{act} {g["sep"]} Esc cancel', f'{act} {g["sep"]} Esc', act):
+            room = cols - 1 - cell_width(head) - cell_width(tail)
+            if cell_width(name) <= room:
+                return head + name + tail, style, False
+        shown = clip(name, room - 1)[0] + g['truncation'] if room > 1 else clip(name, max(1, room))[0]
+        return clip(head + shown + tail, max(1, cols - 1))[0], style, False
+
+    def footer_row(self, cols, entries=(), legend=False):
+        """footer_text() painted: the words in their style, then the caret in tone-working when a field is open. The
+        caller ends the row (`\\033[K\\033[J`); the bytes are the ones render() wrote before cockpit v3 S6."""
+        text, style, caret = self.footer_text(cols, entries, legend)
+        reset = self.tone['reset']
+        painted = f'{reset}{self.tone["tone-working"]}{self.glyphs["marks"]["caret"]}{reset}' if caret else ''
+        return f'{style}{text}{painted}{reset}'
+
     def divider_line(self, entry, cols):
         """`── ◆ Needs you (3) ───` (spec §4.4), shared by the desktop and the phone (§4.10 "section headers as
         desktop"): the rule ink-faint, the words ink-dim, the glyph of the section's most urgent member in its tone,
         filled to cols − 1 with the `rule` mark (never a literal: the ASCII frame is seven-bit). Column 36 is never
-        written; the caller adds `\\033[K`."""
+        written; the caller adds `\\033[K`. An EMPTY section (`── ▸ Working (0)`, drawn since cockpit v3 S2) has no
+        member to lend a tone: its own glyph is ink-dim, so a placeholder never reads as an alarm. In the vivid modes
+        (cockpit v3 P2) a section WITH members says its words in its tone (SECTION_TONE) and its `(n)` ink-dim:
+        `── ◇ Needs you (3)` reads attention, not grey; an empty one stays the dim placeholder, 16 colours v1's bytes."""
         tone, marks, reset = self.tone, self.glyphs['marks'], self.tone['reset']
         attention = next((s for s in ATTENTION if s[0] == entry.get('section')), None)
         rule, dim, faint = marks['rule'], tone['ink-dim'], tone['ink-faint']
-        status = (entry.get('status') if entry.get('status') in AGENT_GLYPHS else attention[2]) if attention else None
+        member = entry.get('status') if entry.get('status') in AGENT_GLYPHS else None
+        status = (member or attention[2]) if attention else None
         glyph = f'{self.glyphs["agent"][status]} ' if status else ''
         label, used_cols = clip(f'{glyph}{entry["name"]}', max(1, cols - 5))
-        if status and label.startswith(glyph):
-            painted = f'{tone[AGENT_GLYPHS[status][2]]}{glyph[:-1]}{reset}{dim} {label[len(glyph):]} {reset}'
+        if status and label.startswith(glyph) and member and self.vivid:
+            words, paren, count = label[len(glyph):].rpartition(' (')
+            words, count = (words, paren + count) if paren else (count, '')   # a clipped label keeps its words
+            painted = (f'{tone[AGENT_GLYPHS[status][2]]}{glyph[:-1]}{reset} {tone[SECTION_TONE[attention[0]]]}{words}'
+                       f'{reset}{dim}{count} {reset}')
+        elif status and label.startswith(glyph):
+            role = AGENT_GLYPHS[status][2] if member else 'ink-dim'
+            painted = f'{tone[role]}{glyph[:-1]}{reset}{dim} {label[len(glyph):]} {reset}'
         else:
             painted = f'{dim}{label} {reset}'
         fill = rule * max(0, cols - 1 - 4 - used_cols)
@@ -1349,15 +2987,21 @@ class Sidebar:
         return ' ' + sep.join(f'{text} {MOBILE_COUNT_WORDS[status]}' for status, text in tally)
 
     def key_sheet(self, cols, body):
-        """`body` lines: the key sheet `?` shows (spec §4.7), `  {key:<10}{action}`, the key ink-dim; padded with
-        blank lines, cut to the body. The seven-bit twins under LANES_GLYPHS=ascii."""
+        """`body` lines: the key sheet `?` shows (spec §4.7) — first `  lanes <current> · view <tree>` (cockpit v3 V2),
+        then `  {key:<9} {action}`, the key ink-dim; padded with blank lines, cut to the body. The seven-bit twins under LANES_GLYPHS=ascii. The action is clipped to what the
+        row has left after its key field (cols − 13 after a key of at most 9 cells, one less after `Ctrl-Alt-l`)."""
         index = 1 if self.glyph_mode == 'ascii' else 0
         dim, reset = self.tone['ink-dim'], self.tone['reset']
-        lines = []
+        # The first row says which lanes (cockpit v3 V2): the installed tree's version, then this view's — in the
+        # attention tone while they differ (the footer's version note says so too).
+        sep = self.glyphs['marks']['sep']
+        version, _ = clip(f'  lanes {self.current_version or "?"} {sep} view {self.tree_version or "?"}', max(0, cols - 1))
+        style = self.tone['tone-attention'] if self.current_version != self.tree_version else dim
+        lines = [f'{style}{version}{reset}']
         for row in KEY_SHEET:
-            key = row[index]
-            action, _ = clip(row[2], max(0, cols - 13))
-            lines.append(f'{dim}  {key:<10}{reset}{action}')
+            key = f'{row[index]:<9} '
+            action, _ = clip(row[2], max(0, cols - 3 - cell_width(key)))
+            lines.append(f'{dim}  {key}{reset}{action}')
         return (lines + [''] * body)[:body]
 
     @staticmethod
@@ -1366,6 +3010,56 @@ class Sidebar:
         return 1.0
 
     # ------------------------------------------------------------ rendering
+    def place_body(self, entries, body):
+        """The desktop body (render): -> ([entry index of each row but `⋮ N more`'s], how many entries that row hides —
+        0 when the rest of the list fits). Sets `self.top`.
+        `top` is pinned (resolve_cursor never moves it, cockpit v3 S2) and changes here only to keep the cursor's lane in
+        the body — the minimal scroll — or because the list got shorter: a list that ends inside the body is never
+        scrolled past its first rows (nothing above would say they are hidden; `⋮` only marks rows below). While the
+        list continues past the body its last row says `⋮ N more` (spec §4.7), so it never carries the cursor.
+        A lane the owner pinned (cockpit v3 R5) never falls below `⋮ N more`: the rows above it are RESERVED for every
+        pinned lane the window would hide below — the window from `top` gets that many rows fewer, the pinned lanes
+        follow it in list order, then `⋮ N more` (at most body − 2 of them; the window keeps a row). A cursor on such a
+        row needs no scroll. Without pins this is the scroll render() always did, row for row."""
+        count = len(entries)
+        self.top = max(0, min(self.top, count - body))
+        if self.cursor < self.top:
+            self.top = self.cursor
+        pinned = ([i for i, e in enumerate(entries) if e.get('id') in self.lane_pins and not e.get('divider')]
+                  if self.lane_pins else [])
+        for _ in range(count + 2):             # each pass moves `top` down towards the cursor: it ends
+            if body <= 1 or self.top + body >= count:
+                if self.cursor >= self.top + body:
+                    self.top = min(self.cursor - body + 1, max(0, count - body))
+                    continue
+                return list(range(self.top, self.top + body)), 0
+            reserved = []
+            while True:                        # fewer window rows can only reserve more pins: this settles
+                below = [i for i in pinned if i >= self.top + body - 1 - len(reserved)][:max(0, body - 2)]
+                if len(below) == len(reserved):
+                    break
+                reserved = below
+            window = body - 1 - len(reserved)
+            if self.top <= self.cursor < self.top + window or self.cursor in reserved:
+                rows = list(range(self.top, self.top + window)) + reserved
+                return rows, count - self.top - window - len(reserved)
+            self.top = min(self.cursor - window + 1, count - body)
+        return list(range(self.top, self.top + body)), 0
+
+    @staticmethod
+    def sections_at(entries, rows):
+        """{entry index: the attention section it sits in} for the body's `rows` — the last divider at or above it, as
+        a reserved pinned row (place_body) is not below the row before it. One pass up to the last row."""
+        wanted, found, section = set(rows), {}, None
+        for index in range(max(rows) + 1 if rows else 0):
+            if index >= len(entries):
+                break
+            if entries[index].get('divider'):
+                section = entries[index].get('section')
+            if index in wanted:
+                found[index] = section
+        return found
+
     def render(self):
         try:
             cols, rows = os.get_terminal_size(sys.stdout.fileno())
@@ -1376,8 +3070,7 @@ class Sidebar:
             self.render_mobile(cols, rows)
             return
         entries = self.follow()      # the cursor re-resolved onto its lane, clamped (spec §4.5)
-        if self.theme_pending and time.monotonic() >= self.theme_deadline:
-            self.apply_theme(self.variant)          # no OSC 11 answer within the grace: dark it is (spec §2.4)
+        self.expire_theme()          # no OSC 11 answer within the grace: dark it is (spec §2.4)
         now = time.time()
         # Frame order (spec §4.6): header, body, upload strip (rows ≥ 14), strip row (rows ≥ 18, economy or fleet
         # attention to show), rule, footer. `box_top` is the upload strip's 1-based row; a click at or below it arms.
@@ -1387,18 +3080,9 @@ class Sidebar:
         self.strip_row = rows >= 18 and (bool(economy_line) or bool(self.fleet))
         body = max(1, rows - 3 - (BOX_ROWS if self.box else 0) - (1 if self.strip_row else 0))
         self.box_top = 2 + body
-        # resolve_cursor()'s eye-preserving shift is bounded by the list: a list that ends inside the body is never
-        # scrolled past its first rows (nothing above would say they are hidden; `⋮` only marks rows below).
-        self.top = max(0, min(self.top, len(entries) - body))
-        if self.cursor < self.top:
-            self.top = self.cursor
-        if self.cursor >= self.top + body:
-            self.top = self.cursor - body + 1
-        # The last body row says `⋮ N more` while the list continues (spec §4.7), so it never carries the cursor:
-        # a cursor that would sit under it scrolls the list one row further.
-        if body > 1 and self.top + body < len(entries) and self.cursor >= self.top + body - 1:
-            self.top = self.cursor - body + 2
-        self.more_row = 1 + body if body > 1 and self.top + body < len(entries) else 0   # 1-based screen row, 0 = none
+        rows, hidden_below = self.place_body(entries, body)
+        self.body_map = rows + ([next(i for i in range(self.top, len(entries)) if i not in rows)] if hidden_below else [])
+        self.more_row = 1 + body if hidden_below else 0   # 1-based screen row of `⋮ N more`, 0 = none
         target = self.current_target()
         others = {slot: self.slot_target(slot) for slot in SLOTS[1:self.viewports]}
         out = ['\033[?25l\033[H']
@@ -1408,7 +3092,7 @@ class Sidebar:
         # its tone — the same glyphs as column 2, so they are the legend. No agents: `{n} lanes`, ink-dim. While the
         # health banner is up the counts are ink-dim too: a frozen status.json is not live.
         tally = self.header_tally()
-        right = ' '.join(text for _status, text in tally) or f'{len(self.entries)} lanes'
+        right = ' '.join(text for _status, text in tally) or f'{len(self.shown_lanes())} lanes'
         right_width = cell_width(right)
         header, used = clip(' Add to workspace' if self.registration else f' {self.title}', max(1, cols - right_width - 2))
         if tally and not self.banner:
@@ -1418,86 +3102,69 @@ class Sidebar:
         # Column 36 is never written, not even with a blank (the budget gate's cell walk, DEF-1417): `\033[K` clears it.
         out.append(f'{tone["bold"]}{header}{reset}{" " * max(1, cols - 1 - used - right_width)}{painted}\033[K\r\n')
         more = bool(self.more_row) and not self.showing_keys
-        section = None
-        for index in range(self.top):          # the section the first visible row sits in (dividers above `top`)
-            if entries[index].get('divider'):
-                section = entries[index].get('section')
         g = marks
         sep, q0, q1 = f' {g["sep"]} ', g['quote-open'], g['quote-close']
         if self.showing_keys:                  # spec §4.7: `?` replaces the body with the key sheet until any key
             out.extend(f'{line}\033[K\r\n' for line in self.key_sheet(cols, body))
+        sections = self.sections_at(entries, rows) if rows else {}
         for row in range(0 if self.showing_keys else body):
-            index = self.top + row
+            index = rows[row] if row < len(rows) else len(entries)
             if row == 0 and self.filter and not entries:   # spec §4.7: filter with no hits
                 label, _ = clip(f' no lane matches {q0}{self.filter}{q1}{sep}Esc', cols - 1)
                 out.append(f'{tone["ink-dim"]}{label}{reset}\033[K\r\n')
                 continue
-            if index >= len(entries):
-                out.append('\033[K\r\n')
-                continue
             if more and row == body - 1:       # spec §4.7: the list continues — `  ⋮ N more`, the hidden rows counted
-                label, _ = clip(f'  {marks["more"]} {len(entries) - index} more', cols - 1)
+                label, _ = clip(f'  {marks["more"]} {hidden_below} more', cols - 1)
                 out.append(f'{tone["ink-dim"]}{label}{reset}\033[K\r\n')
                 continue
+            if index >= len(entries):
+                out.append('\033[K\r\n')
+                continue
             entry = entries[index]
+            section = sections.get(index)
             if entry.get('divider'):
-                section = entry.get('section')
                 out.append(self.divider_line(entry, cols) + '\033[K\r\n')
                 continue
             is_cursor = index == self.cursor
+            band = self.on_band if is_cursor else str        # the cursor row lies on the `selected` band (P2)
             cursor = f'{tone["accent"]}{marks["cursor"]}{reset}' if is_cursor else ' '
+            # A shell on its way (cockpit v3 S9): the `pending` mark, dim, in the New shell row's blank column — the
+            # empty workspace's column 2, else column 3 (a lane row's mark column). Same cells, same width.
+            waiting = f'{tone[MARKS["pending"][2]]}{marks["pending"]}{reset}' if entry.get('pending') else ''
             if entry.get('action') == 'new-shell' and not self.entries and not self.filter:
                 # spec §4.7: an empty workspace says so on the New shell row itself (still the row that creates one)
                 label, used_cols = clip(f' no lanes declared{sep}{g["new"]} New shell', max(1, cols - 2))
-                out.append(f'{cursor}{tone["ink-dim"]}{label}{reset}{" " * max(0, cols - 2 - used_cols)}\033[K\r\n')
+                if waiting:
+                    label = label[1:]
+                out.append(band(f'{cursor}{waiting}{tone["ink-dim"]}{label}{reset}{" " * max(0, cols - 2 - used_cols)}')
+                           + '\033[K\r\n')
                 continue
             if entry.get('action') == 'new-shell':
                 # ` +  New shell` (spec §4.8): the `new` mark in column 2 (tone-done), the label ink-dim, padded to 35.
                 used_cols = 4 + cell_width('New shell')
-                out.append(f'{cursor}{tone["tone-done"]}{marks["new"]}{reset}  {tone["ink-dim"]}New shell{reset}'
-                           f'{" " * max(0, cols - 1 - used_cols)}\033[K\r\n')
+                out.append(band(f'{cursor}{tone["tone-done"]}{marks["new"]}{reset}{waiting or " "} '
+                                f'{tone["ink-dim"]}New shell{reset}{" " * max(0, cols - 1 - used_cols)}') + '\033[K\r\n')
                 continue
             if entry.get('action'):            # the Add-to-workspace picker's choices and its Cancel
                 label, used_cols = clip(entry['name'], max(1, cols - 4))
-                out.append(f'{cursor}  {tone["tone-done"]}{label}{reset}{" " * max(0, cols - 4 - used_cols)}\033[K\r\n')
+                out.append(band(f'{cursor}  {tone["tone-done"]}{label}{reset}{" " * max(0, cols - 4 - used_cols)}')
+                           + '\033[K\r\n')
                 continue
-            out.append(self.row(entry, index, target, others, cols, now,
-                                'tone-attention' if section == 'needs' else None) + '\033[K\r\n')
-        # The footer ladder (spec §4.6(a)): confirm › rename › promote › (picker) › filter › banner › registry error ›
-        # message › legend. Every prompt has one shape — the `lead` mark, a sentence, `y/n` or the caret — and every
-        # separator, quote, `⏎`, `›` and `⚠` is a mark lookup, so the ASCII footer is seven-bit.
-        lead, caret = g['lead'], ''
-        if self.confirming:
-            footer, footer_style = f" {lead} close {q0}{self.confirming.get('name', '')}{q1}? y/n", tone['tone-urgent']
-        elif self.renaming:
-            footer, footer_style = f' {lead} Rename: {self.rename_value}', tone['ink']
-            caret = f'{tone["tone-working"]}{g["caret"]}{reset}'
-        elif self.promoting:
-            name = (self.promote_entry or {}).get('name', '')
-            footer, footer_style = f" {lead} Register {q0}{name}{q1}? y/n", tone['tone-attention']
-        elif self.registration:
-            footer, footer_style = ' ' + (self.message or f'Choose a workspace{sep}Esc cancels'), tone['ink-dim']
-        elif self.filtering or self.filter:
-            n = sum(1 for e in entries if not e.get('divider'))
-            footer, footer_style = f' /{self.filter}{sep}{n} match{"es" if n != 1 else ""}', tone['ink']
-        elif self.banner:   # above everything but a prompt and the filter: a frozen picture must never look live
-            footer = ' ' + self.banner
-            footer_style = tone['tone-urgent'] if 'sockets' in self.banner else tone['tone-attention']
-        elif self.errors:
-            footer, footer_style = f' {g["warning"]} registry: ' + self.errors[0], tone['tone-urgent']
-        elif self.message:
-            footer, footer_style = ' ' + self.message, tone['ink-dim']
-        elif self.attach_only:   # a remote workspace: nothing to close, no upload strip
-            footer, footer_style = f' {g["enter"]} open{sep}/ find{sep}? keys', tone['ink-dim']
-        else:
-            footer, footer_style = f' {g["enter"]} open{sep}/ find{sep}x close{sep}? keys', tone['ink-dim']
-        footer, _ = clip(footer, cols - (2 if caret else 1))   # the caret takes the last of the 35 cells
-        footer += f'{reset}{caret}' if caret else ''
+            # The age's tone (spec §4.2 col 29–31): attention inside Needs you; in the vivid modes each attention
+            # section's own tone, ink-dim only outside them (cockpit v3 P2). 16 colours keep the one exception.
+            age_tone = SECTION_TONE.get(section) if self.vivid else 'tone-attention' if section == 'needs' else None
+            out.append(self.row(entry, index, target, others, cols, now, age_tone) + '\033[K\r\n')
+        # The footer (spec §4.6(a)): ONE ladder, footer_text(), shared with the phone since cockpit v3 S6 — the prompt ›
+        # the picker › the filter › banner › registry error › message › legend. While the keyboard is on the sidebar the
+        # legend rung itself says so, in the accent (keys_here, cockpit v3 S4): ` ▌ keys go to sidebar · Esc → lane` —
+        # no extra row, every rung above it unchanged.
+        self.legend_shown = self.keys_here()
         if self.box:
             out.append(self.strip_line(cols) + '\033[K\r\n')
         if self.strip_row:   # spec §4.6(c): the fleet economy line first; without one, fleet attention
             out.append((economy_line or self.fleet_attention(cols - 2)) + '\033[K\r\n')
-        out.append(f'{tone["ink-faint"]}{g["rule"] * cols}{reset}\r\n{footer_style}{footer}{reset}\033[K\033[J')
+        out.append(f'{tone["ink-faint"]}{g["rule"] * cols}{reset}\r\n'
+                   f'{self.footer_row(cols, entries, self.legend_shown)}\033[K\033[J')
         out.append(self.osc_bytes(target))      # title / notification strings: after the footer, same write (§4.9)
         sys.stdout.write(''.join(out))
         sys.stdout.flush()
@@ -1507,6 +3174,7 @@ class Sidebar:
         """Three terminal rows per lane make the entire row a finger-sized touch target (spec §4.10): the name with
         its agent glyph, then `label · age · harness`, then the agent's task."""
         entries = self.follow()
+        self.body_map = None   # the phone's rows are `top + row` (three terminal rows each); place_body is the desktop's
         self.box = False  # the Mac file-drop helper is not available in a phone browser
         self.entry_top, self.entry_height = 3, 3 if rows >= 8 else 1
         body = max(1, (rows - 3) // self.entry_height)
@@ -1515,17 +3183,14 @@ class Sidebar:
         if self.cursor >= self.top + body:
             self.top = self.cursor - body + 1
         target = self.current_target()
-        if self.theme_pending and time.monotonic() >= self.theme_deadline:
-            self.apply_theme(self.variant)
+        self.expire_theme()
         out = ['\033[?25l\033[H']
         tone, marks = self.tone, self.glyphs['marks']
         reset = tone['reset']
 
-        def line(value='', style='', closable=False, can_register=False):
-            value, _ = clip(value, max(1, cols - (9 if can_register else 5 if closable else 1)))
-            close = f'\033[{max(1, cols - 2)}G{tone["tone-urgent"]}{marks["close"]}{reset}' if closable else ''
-            add = f'\033[{max(1, cols - 6)}G{tone["tone-done"]}{marks["new"]}{reset}' if can_register else ''
-            out.append(f'{reset}{style}{value}{reset}{add}{close}\033[K\r\n')
+        def line(value='', style=''):
+            value, _ = clip(value, max(1, cols - 1))
+            out.append(f'{reset}{style}{value}{reset}\033[K\r\n')
 
         # Header (spec §4.10): the agent counts in words, bold ink — no cyan, no `LANES` banner: the phone shell's own
         # header carries identity. No agents: ` {n} lanes`, ink-dim, as on the desktop (§4.3).
@@ -1533,7 +3198,7 @@ class Sidebar:
         if self.registration:
             line('  ADD TO WORKSPACE', tone['bold'])
         else:
-            line(counts or f' {len(self.entries)} lanes', tone['ink-dim'] if self.banner or not counts else tone['bold'])
+            line(counts or f' {len(self.shown_lanes())} lanes', tone['ink-dim'] if self.banner or not counts else tone['bold'])
         line()
         now, sep = time.time(), f' {marks["sep"]} '   # every ` · ` is the sep mark: the ASCII frame stays seven-bit
         for index in range(self.top, self.top + body):
@@ -1549,6 +3214,10 @@ class Sidebar:
             stale = bool(observed.get('stale'))
             if entry.get('divider'):            # section headers as desktop (§4.4), three rows tall: the touch grid
                 out.append(self.divider_line(entry, cols) + '\033[K\r\n')
+            elif entry.get('action') == 'new-shell' and entry.get('pending'):
+                # a shell on its way (cockpit v3 S9): the dim `pending` mark in the blank cell after the `+`
+                waiting = f'{reset}{tone[MARKS["pending"][2]]}{marks["pending"]}{reset}{tone["tone-done"]}'
+                out.append(f'{reset}{tone["tone-done"]}   {marks["new"]}{waiting} New shell{reset}\033[K\r\n')
             elif entry.get('action') == 'new-shell':
                 line(f'   {marks["new"]}  New shell', tone['tone-done'])
             elif entry.get('action'):           # the Add-to-workspace picker's choices and its Cancel
@@ -1557,10 +3226,18 @@ class Sidebar:
                 # Row A: column 2 the viewing mark (accent), column 3 the agent glyph in its tone (ink-dim while the
                 # status is stale), the name bold in its identity colour. The `›` touch cursor is gone (the cursor
                 # still moves with J/K). The viewer dots are the sidebar's rule, not the desktop render's: the phone
-                # is the one surface where the operator cannot also see the Studio tab (DEF-983).
-                closable = bool(entry.get('closable'))
+                # is the one surface where the operator cannot also see the Studio tab (DEF-983). `+` and `×` sit at
+                # the desktop row's columns, `cols − 8` and `cols − 1` (cockpit v3 S5; `cols − 6` / `cols − 2` until
+                # then), inside the hit boxes handle() shares with it; the name still ends left of the `+`. A row `P`
+                # is registering (cockpit v3 S8) has the dim `pending` mark in column 2 and neither control.
+                pending = bool(entry.get('pending'))
+                closable = bool(entry.get('closable')) and not pending
                 can_register = closable and R.eligible(entry)
                 mark = f'{tone["accent"]}{marks["viewing"]}{reset}' if entry['id'] == target else ' '
+                if mark == ' ' and entry['id'] in self.lane_pins:      # the owner's pin, below viewing (R5)
+                    mark = f'{tone[MARKS["pinned"][2]]}{marks["pinned"]}{reset}'
+                if pending:
+                    mark = f'{tone[MARKS["pending"][2]]}{marks["pending"]}{reset}'
                 glyph = ' '
                 if status:
                     role = 'ink-dim' if stale else tokens.tone_of(AGENT_GLYPHS, status)
@@ -1570,8 +3247,10 @@ class Sidebar:
                 name, _ = clip(entry.get('name', entry['id']), width)
                 color = entry.get('color')
                 fg = f'\033[38;5;{color}m' if isinstance(color, int) and self.color != 'none' else ''
-                close = f'\033[{max(1, cols - 2)}G{tone["tone-urgent"]}{marks["close"]}{reset}' if closable else ''
-                add = f'\033[{max(1, cols - 6)}G{tone["tone-done"]}{marks["new"]}{reset}' if can_register else ''
+                if entry['id'] in self.lane_hidden:   # shown by `o` (R5): faint
+                    fg = tone['ink-faint']
+                close = f'\033[{max(1, cols - 1)}G{tone["tone-urgent"]}{marks["close"]}{reset}' if closable else ''
+                add = f'\033[{max(1, cols - 8)}G{tone["tone-done"]}{marks["new"]}{reset}' if can_register else ''
                 dots = f'{tone["ink-dim"]}{viewers}{reset}' if viewers else ''
                 out.append(f'{reset} {mark}{glyph} {tone["bold"]}{fg}{name}{reset}{dots}{add}{close}\033[K\r\n')
             if self.entry_height == 1:
@@ -1602,15 +3281,9 @@ class Sidebar:
             line('     ' + task if task else '', tone['ink-dim'])
         for _ in range(max(0, rows - (2 + body * self.entry_height + 1))):
             line()
-        q0, q1 = marks['quote-open'], marks['quote-close']
-        footer = (f" {marks['lead']} close {q0}{self.confirming.get('name', '')}{q1}? y/n" if self.confirming else
-                  ' ' + (self.message or f'Choose a workspace{sep}Tap Cancel') if self.registration else
-                  ' /' + self.filter if self.filtering or self.filter else
-                  ' ' + self.banner if self.banner else
-                  ' ' + self.errors[0] if self.errors else
-                  ' ' + self.message if self.message else f' Swipe to scroll{sep}Tap to open')
-        footer, _ = clip(footer, max(1, cols - 1))
-        out.append(f'{tone["tone-urgent"] if self.confirming else tone["ink-dim"]}{footer}{reset}\033[K\033[J')
+        # The footer the desktop draws (footer_text, cockpit v3 S6): every prompt, the filter, the banner, the message;
+        # only the picker's way out (`Tap Cancel`) and the idle hint (`Swipe to scroll · Tap to open`) are the phone's.
+        out.append(self.footer_row(cols, entries) + '\033[K\033[J')
         out.append(self.osc_bytes(target))      # the phone reads the counts from this pane's title; no OSC 9 here
         sys.stdout.write(''.join(out))
         sys.stdout.flush()
@@ -1618,63 +3291,107 @@ class Sidebar:
 
     # ---------------------------------------------------------------- input
     def handle(self, data):
+        """One raw read: the reports out first (take_reports), then the input (handle_input)."""
+        self.handle_input(self.take_reports(data))
+
+    def take_reports(self, data):
+        """What in a raw read is no input -> the rest (keys, mouse reports, a paste). An OSC 11 answer (`\\033]11;rgb:…`
+        ST/BEL, possibly split across reads) is a theme, never an Esc: it is taken out before anything reads the keys,
+        so it cannot cancel a filter or a prompt (spec §2.4, Review Focus 6). A focus report is noted and taken out
+        (note_focus, cockpit v3 S4)."""
         if isinstance(data, bytes):   # the raw read, as run() gets it from the pty
             data = data.decode('utf-8', 'replace')
-        # An OSC 11 answer (`\033]11;rgb:…` ST/BEL, possibly split across reads) is a theme, never an Esc: it is taken
-        # out before anything reads the keys, so it cannot cancel a filter or a prompt (spec §2.4, Review Focus 6).
-        data = self.strip_osc(data)
-        # Bracketed paste (a drop, or a real paste) can span several reads: buffer until its end marker.
-        if self.paste_buffer is not None:
-            self.paste_buffer += data
-            data = ''
-        elif PASTE_START in data:
-            before, _, after = data.partition(PASTE_START)
-            self.paste_buffer, data = after, before
-        if self.paste_buffer is not None and PASTE_END in self.paste_buffer:
-            pasted, _, tail = self.paste_buffer.partition(PASTE_END)
-            self.paste_buffer = None
-            self.dropped(pasted)
+        return self.note_focus(self.strip_osc(data))
+
+    def handle_input(self, data):
+        """The input of one read, its reports already taken out (take_reports)."""
+        self.handed_off = False       # cockpit v3 S3: set when an action of THIS read gives the keyboard back
+        # Bracketed paste (a drop, or a real paste) can span several reads: buffered until its end marker. It is taken at
+        # its place in the read (S3 review): the keys before it act first — `P`, Backspace, then the paste fills the
+        # emptied name — and pasted() routes it by what is open then. Once an action hands the keyboard back, the rest
+        # of the read, a paste included, was typed for the lane.
+        while data and not self.handed_off:
+            if self.paste_buffer is not None:
+                self.paste_buffer += data
+                if PASTE_END not in self.paste_buffer:
+                    return
+                pasted, _, data = self.paste_buffer.partition(PASTE_END)
+                self.paste_buffer = None
+                self.pasted(pasted)
+                self.dirty = True
+                continue
+            keys, start, data = data.partition(PASTE_START)
+            self.handle_keys(keys)
+            if not start or self.handed_off:
+                return
+            self.paste_buffer = ''
+
+    def note_focus(self, data):
+        """Take the focus reports out of a read (cockpit v3 S4) and note where the keyboard is -> the read without them.
+        A report is never a key: left in, `ESC [ I` would cancel a confirmation, close the key sheet or hand the
+        keyboard back. What came LAST decides: the last report, unless a key that proves the focus (moves_focus: a
+        typed key, a paste, a mouse press — never the wheel or a release) follows it. Without any report, such a key
+        shows the legend for FOCUS_LEGEND_S. Taken from the whole read, as strip_osc() does: nothing the sidebar takes
+        from a paste (a path, a name, filter text) carries a raw ESC."""
+        before, after = self.focused, data
+        last = None
+        for last in FOCUS_REPORT.finditer(data):
+            pass
+        if last:
+            self.focus_reported, self.focused = True, last.group(1) == 'I'
+            after = data[last.end():]
+            data = FOCUS_REPORT.sub('', data)
+        proof = proves_focus(after)
+        if proof:
+            self.focused, self.legend_until = True, time.monotonic() + FOCUS_LEGEND_S
+        if proof or self.focused != before:
             self.dirty = True
-            data += tail
+        return data
+
+    def handle_keys(self, data):
+        """The keys and mouse reports of one read, or of the part of it before / after a paste (handle())."""
+        if not data:
+            return
         entries = self.follow()
         i = 0
         while i < len(data):
+            if self.handed_off:
+                # cockpit v3 S3: an action ended and gave the keyboard back to the lane. What else this read carries was
+                # typed before that focus move landed — for the lane, not for us: consumed, never acted on (`x y ⏎`
+                # followed by a sentence renames, filters and closes nothing). Dropped, not forwarded: the sidebar
+                # never types into a lane (an agent's input) on its own.
+                break
             if self.showing_keys:
                 # spec §4.7: any key closes the key sheet and is consumed, never acted on. Checked per key, not per
                 # read: one read can carry several keys (key repeat, fast typing), so `?j` opens and closes the sheet
                 # with the j consumed, and `?xy` consumes the x — exactly one key or one whole escape sequence each.
+                # Closing it ends an action: a key or a click hands the keyboard back; a wheel tick or a release
+                # closes it in place (moves_focus).
+                n = key_length(data, i)
                 self.showing_keys, self.dirty = False, True
-                i += key_length(data, i)
+                if moves_focus(data[i:i + n]):
+                    self.release_focus()
+                i += n
                 continue
             entries = self.follow()   # per key: an action may have changed the list (spec §4.5)
             ch = data[i]
-            if self.confirming is not None:
-                # `y` closes the entry that asked; anything else cancels. A key is consumed by the cancel; an escape
-                # sequence (Esc, an arrow, a click) cancels and is then handled as usual. Only a key or a mouse PRESS
-                # answers: under ?1000h/?1006h the terminal reports the RELEASE that follows every press (the very
-                # release of the `×` click that opened this prompt), and wheel/motion reports are no answer either,
-                # so those are consumed and the prompt stays up.
-                if ch == '\033' and data[i + 1:].startswith('[<'):
-                    rest = data[i + 1:]
-                    end = next((k for k, c in enumerate(rest) if c in 'Mm'), -1)
-                    if end < 0:
-                        break   # an incomplete report is no answer
-                    try:
-                        button = int(rest[2:end].split(';')[0])
-                    except ValueError:
-                        button = -1
-                    if rest[end] == 'm' or (button >= 0 and button & (32 | 64)):
-                        i += end + 2
-                        continue
-                entry, self.confirming, self.dirty = self.confirming, None, True
-                if ch in 'yY':
-                    self.close_lane(entry)
-                    i += 1
-                    continue
-                self.message = 'Cancelled'
-                if ch != '\033':
-                    i += 1
+            if self.prompt and ch == '\033':
+                # ONE escape sequence under the prompt, a name field or a confirmation (cockpit v3 S6 fix cycle 1,
+                # DEF-1824): consumed while the prompt stays, or handled as usual below — with the prompt cancelled
+                # first, save a click on the upload strip beside a name field (prompt_sequence).
+                n = key_length(data, i)
+                if not self.prompt_sequence(data[i:i + n]):
+                    i += n
                     continue
+            elif self.prompt and self.prompt['stage'] == 'confirm':
+                # Two keys (cockpit v3 S3), for a close and a register alike (one prompt, cockpit v3 S6): `y` ARMS it
+                # and the footer names Enter, Enter then acts on the entry that asked; anything else — at either stage,
+                # a second `y` included — cancels (answer_prompt). Typed text closes nothing unless it holds `x`, `y`,
+                # Enter in a row: the letter after a typed `y` cancels. A key is consumed by the cancel, which hands the
+                # keyboard back.
+                self.answer_prompt(ch)
+                i += 1
+                continue
             if ch == '\033':
                 rest = data[i + 1:]
                 if rest.startswith('[<'):  # SGR mouse
@@ -1686,25 +3403,38 @@ class Sidebar:
                     except ValueError:
                         button, y = -1, 0
                     pressed = rest[end] == 'M'
+                    # The wheel moves the cursor and never the focus (moves_focus); a release answers nothing.
                     if button == 64:
                         self.cursor -= 3
                     elif button == 65:
                         self.cursor += 3
                     elif button == 0 and pressed and self.box and y >= self.box_top:
+                        self.begin_action()
                         self.armed = True   # the click also gave this pane the focus: the next drop lands here
                     elif button == 0 and pressed:
-                        index = self.top + (y - self.entry_top) // self.entry_height
+                        # A click that opens nothing — a section header, `⋮ N more`, the header row, an empty row —
+                        # ends there: the keyboard goes back to the lane (cockpit v3 S3). `×` and `+` open a prompt,
+                        # which keeps it; a lane row opens the lane, which hands it off itself.
+                        row = (y - self.entry_top) // self.entry_height
+                        index = self.top + row
+                        if self.body_map is not None and 0 <= row < len(self.body_map):
+                            index = self.body_map[row]        # the desktop body as render() laid it out (R5)
                         if 0 <= index < len(entries) and self.entry_top <= y < self.box_top:
                             self.cursor = index
                             if y == self.more_row and not self.mobile:
-                                pass   # `⋮ N more` hides this entry: the click scrolls it into view, never opens it
+                                # `⋮ N more` hides this entry: the click scrolls it into view, never opens it
+                                self.release_focus()
                             elif entries[index].get('closable') and _x >= max(1, self.size[0] - 4):
                                 self.request_close(entries[index])
                             elif (entries[index].get('closable') and R.eligible(entries[index])
                                   and _x >= max(1, self.size[0] - 8)):
                                 self.start_registration(entries[index])
+                            elif entries[index].get('divider'):
+                                self.release_focus()
                             else:
                                 self.open_lane(entries[index])
+                        else:
+                            self.release_focus()
                     i += end + 2
                     self.dirty = True
                     continue
@@ -1716,48 +3446,43 @@ class Sidebar:
                     if entries:
                         self.open_lane(entries[self.cursor])
                     i += 3
-                elif rest[:2] == '[Z':      # Shift-Tab: the previous lane that needs you (a prompt keeps it)
-                    if not (self.renaming or self.promoting):
-                        self.jump_needs_you(-1)
+                elif rest[:2] == '[Z':      # Shift-Tab: the previous lane that needs you (a name field took it above)
+                    self.jump_needs_you(-1)
                     i += 3
                 elif rest[:2] == '[5':
                     self.cursor -= 10; i += 4
                 elif rest[:2] == '[6':
                     self.cursor += 10; i += 4
+                elif rest[:1] == 'O' and len(rest) > 1:
+                    # Any other SS3 key — F1–F4 (`ESC O P`…`S` on xterm), application-mode Home / End / ← — is ONE key
+                    # (key_length) that does nothing here, like its CSI form below. It used to fall through to the bare
+                    # Esc: the keyboard went back to the lane and an open filter was cleared (cockpit v3 S10, DEF-1770).
+                    i += 3
                 elif rest[:1] == '[':  # any other CSI: skip to its final byte
                     end = next((k for k, c in enumerate(rest[1:], 1) if '@' <= c <= '~'), len(rest) - 1)
                     i += end + 2
                 else:
+                    # A bare Esc: cancel whatever is open, clear the filter, and give the keyboard back (S3). A cancel,
+                    # not an action (begin_action): ` Cancelled` stays; a message it finds lasts its MESSAGE_S. An open
+                    # prompt was cancelled above (prompt_sequence).
                     if self.registration:
                         self.cancel_registration()
-                    if self.armed:
-                        self.armed = False
-                        self.focus_lane()
-                    if self.renaming:
-                        self.renaming, self.rename_entry, self.rename_value = False, None, ''
-                        self.message = 'Cancelled'
-                    elif self.promoting:
-                        self.promoting, self.promote_entry = False, None
-                        self.message = 'Cancelled'
+                    self.armed = False
                     self.filter, self.filtering = '', False
+                    self.release_focus()
                     i += 1
                 self.dirty = True
                 continue
-            if self.renaming:
-                if ch in '\r\n':
+            if self.prompt:           # a name field (a confirmation was answered above): `R`, `P`'s first stage
+                prompt = self.prompt
+                if ch in '\r\n' and prompt['verb'] == 'rename':
                     self.commit_rename()
+                elif ch in '\r\n':
+                    self.accept_promote_name()
                 elif ch in '\x7f\x08':
-                    self.rename_value = self.rename_value[:-1]
-                elif ch == '\x1b':   # handled above; here for completeness
-                    pass
+                    prompt['value'] = prompt['value'][:-1]
                 elif ch.isprintable():
-                    self.rename_value += ch
-            elif self.promoting:
-                if ch in 'yY':
-                    self.commit_promote()
-                else:
-                    self.promoting, self.promote_entry = False, None
-                    self.message = 'Cancelled'
+                    prompt['value'] += ch
             elif self.filtering:
                 if ch in '\r\n':
                     self.filtering = False
@@ -1794,9 +3519,11 @@ class Sidebar:
             elif ch == 'G':
                 self.cursor = len(entries) - 1
             elif ch == '/':
+                self.begin_action()
                 self.filtering, self.filter = True, ''
                 self.set_cursor(0)
             elif ch == 'U' and not self.attach_only:
+                self.begin_action()
                 self.armed = True
             elif ch == '+' and not self.registration and not self.attach_only:
                 self.new_shell()
@@ -1804,28 +3531,63 @@ class Sidebar:
                 self.start_registration(entries[self.cursor])
             elif ch == 'x' and entries:
                 self.request_close(entries[min(self.cursor, len(entries) - 1)])
+            elif ch == 'u' and entries:
+                self.unregister_lane(entries[min(self.cursor, len(entries) - 1)])
+            elif ch == 'z':
+                self.undo_unregister()
             elif ch == 'R' and entries:
                 entry = entries[min(self.cursor, len(entries) - 1)]
                 self.start_rename(entry)
+            elif ch == 'p' and entries:       # cockpit v3 R5: pins and hidden lanes, the owner's profile
+                self.pin_lane(entries[min(self.cursor, len(entries) - 1)])
+            elif ch == 'h' and entries:
+                self.hide_lane(entries[min(self.cursor, len(entries) - 1)])
+            elif ch == 'H':
+                self.request_hide_workspace()
+            elif ch == 'o':
+                self.toggle_hidden()
             elif ch == 'P' and entries:
                 entry = entries[min(self.cursor, len(entries) - 1)]
                 self.start_promote(entry)
             elif ch == 'r':
-                self.reload(force=True)
+                self.begin_action()
+                if self.update_ready:    # the footer offers the update (W9 U6): rebuild this view on its release
+                    self.rebuild_view()
+                else:
+                    self.reload(force=True)
+                self.release_focus()
             elif ch == '?':
+                self.begin_action()
                 self.showing_keys = True
             self.dirty = True
             i += 1
 
     def start_bytes(self):
-        """What run() writes once at start: alternate screen, mouse, bracketed paste — and, under LANES_THEME=auto, the
-        ONE OSC 11 background query (spec §2.4: no re-ask; handle() parses the answer, the grace starts now)."""
-        out = '\033[?1049h\033[?1000h\033[?1006h\033[?2004h\033[2J'
+        """What run() writes once at start: alternate screen, mouse, bracketed paste, focus reports (`?1004h`, cockpit
+        v3 S4) — and, under LANES_THEME=auto, the ONE OSC 11 background query (spec §2.4: no re-ask; handle() parses
+        the answer, the grace starts now)."""
+        out = '\033[?1049h\033[?1000h\033[?1006h\033[?2004h\033[?1004h\033[2J'
         if self.theme_pending:
             out += OSC11_QUERY
             self.theme_deadline = time.monotonic() + THEME_GRACE
         return out
 
+    @staticmethod
+    def stop_bytes():
+        """What run() writes on the way out: every mode start_bytes() turned on, off again, and the cursor back."""
+        return '\033[?1004l\033[?2004l\033[?1006l\033[?1000l\033[?1049l\033[?25h'
+
+    def on_read(self, data):
+        """One read of input in run(). The reports come out first (take_reports), then a sidebar command written since
+        the last tick is taken (poll_command: the chord's floating pane has exited by the time a key gets here), then
+        the keys. A read clears no footer message (cockpit v3 S6): it lasts MESSAGE_S (expire_message, on run()'s
+        tick) or until the next action begins (begin_action). Until S6 the next read that proved the focus cleared it
+        (S4 review, DEF-1815), so a cursor move wiped the reason a close failed (DEF-1822); before S4 every read did,
+        and Zellij's `ESC [ O` after each hand_off() wiped ` Closed sh` as soon as it was painted."""
+        data = self.take_reports(data)
+        self.poll_command()
+        self.handle_input(data)
+
     def run(self):
         fd = sys.stdin.fileno()
         saved = termios.tcgetattr(fd)
@@ -1833,14 +3595,15 @@ class Sidebar:
             tty.setraw(fd)
             sys.stdout.write(self.start_bytes())
             self.reload(force=True)
-            target = self.current_target()
-            for index, entry in enumerate(self.visible()):
-                if entry['id'] == target:
-                    self.cursor = index
+            self.start_cursor()
             last_size = None
             while True:
                 self.reload()
                 self.poll_mobile_view()
+                # The worker's answers (cockpit v3 S9): a drain, never a wait — taken after reload(), so an answer is
+                # applied to the listing it changes, and before expire_pending(), which holds a `P` whose write is out.
+                if self.finish_actions():
+                    self.dirty = True
                 try:
                     size = tuple(os.get_terminal_size(sys.stdout.fileno()))
                 except OSError:
@@ -1849,10 +3612,21 @@ class Sidebar:
                     last_size, self.dirty = size, True
                 self.poll_upload()
                 self.poll_health()
+                self.poll_update()
                 self.poll_economy()
                 # An upload in flight no longer forces a frame: poll_upload() dirties on progress and on the end.
                 if self.armed or (self.upload_note and time.time() - self.upload_note_at < 9):
                     self.dirty = True
+                if self.legend_stale():   # the no-report focus legend ran out (cockpit v3 S4)
+                    self.dirty = True
+                if self.expire_message():   # the last message is MESSAGE_S old (cockpit v3 S6)
+                    self.dirty = True
+                if self.expire_undo():      # the undo offer is UNDO_S old (cockpit v3 S7)
+                    self.dirty = True
+                if self.expire_pending():   # a `P` the registry has not listed PENDING_S on (cockpit v3 S8)
+                    self.dirty = True
+                self.expire_theme()         # the OSC 11 grace ran out: resolve and publish, frame or not (DEF-1775)
+                self.poll_profile()         # a mark the owner's busy profile dropped, every PROFILE_RETRY_S (R3)
                 if self.dirty:
                     self.render()
                 ready, _, _ = select.select([fd], [], [], self.tick_timeout())
@@ -1861,10 +3635,9 @@ class Sidebar:
                     if not data:
                         time.sleep(1)  # pty closed: let the wrapper loop decide
                         return
-                    self.message = ''
-                    self.handle(data.decode('utf-8', 'replace'))
+                    self.on_read(data.decode('utf-8', 'replace'))
         finally:
-            sys.stdout.write('\033[?2004l\033[?1006l\033[?1000l\033[?1049l\033[?25h')
+            sys.stdout.write(self.stop_bytes())
             sys.stdout.flush()
             termios.tcsetattr(fd, termios.TCSADRAIN, saved)
 
@@ -1872,5 +3645,6 @@ class Sidebar:
 if __name__ == '__main__':
     if len(sys.argv) < 3:
         sys.exit('usage: sidebar.py <device> <workspace> [slot]')
+    L.record_tree('sidebar')   # W9 U0: the tree the most recently started sidebar runs (`lanes version`, doctor)
     signal.signal(signal.SIGINT, signal.SIG_IGN)
     Sidebar(*sys.argv[1:5]).run()