@vincemakes/kiso-tui-cells 0.11.0 → 0.13.0

package/dist/approval-panel.d.ts

@@ -25,8 +25,136 @@
  * FOLD (a bounded block's body — content folds, metadata cuts).
  */
 export type PanelFlavor = "approval" | "simple";
-export type PanelPhase = "options" | "rule" | "amend";
-export type PanelSel = 0 | 1 | 2 | 3;
+/**
+ * TUI2-R3v2 ① — two phases, not three.
+ *
+ * The "rule" phase is gone. It existed because option 2 used to hand the
+ * human a prefilled text box to edit the rule in, which implied the rule
+ * could be anything they typed. It could not: the generated extension
+ * matches on `call.name` and nothing else, so every character typed
+ * beyond the tool name either did nothing or silently produced a rule
+ * that never fired. Option 2 now grants exactly what the machinery
+ * supports, on the keypress, and the copy says exactly that.
+ */
+export type PanelPhase = "options" | "amend" | "asking" | "safer";
+/**
+ * TUI2-R3v2 ③ — one safer alternative the model proposed.
+ *
+ * Two fields and no more. The command is what would actually run, so it
+ * is the row's subject; `why` is the one-line plain-language reason,
+ * because a list of three shell commands with no explanation asks the
+ * human to diff them in their head — which is the work the feature
+ * exists to remove.
+ */
+export interface SaferOption {
+    readonly command: string;
+    readonly why: string;
+}
+/** TUI2-R3v2 ③: the safer list's own walk — the options the model gave
+ *  and the bar's place in them. The LAST row (the way back) is not an
+ *  option and is not in this array; it is rendered after them and its
+ *  index is `options.length`. */
+export interface SaferRuntime {
+    readonly options: readonly SaferOption[];
+    readonly cursor: number;
+}
+/** The copy a failed ask owes the human. One line, dim, and it says what
+ *  is still true rather than what went wrong: the original choices are
+ *  all still there, which is the only thing they need to know to keep
+ *  going. */
+export declare const SAFER_DEGRADED = "couldn't get safer options \u2014 the original choices stand";
+/**
+ * R3v2-F1 — the same sentence, for the one failure the reply's own text
+ * can PROVE.
+ *
+ * The unqualified line is true of every failure the ask has, which is
+ * exactly why it explains nothing when the cause was knowable. A reply
+ * the token budget cut in half is knowable: the JSON opens and never
+ * closes. So that case gets the cause in a parenthesis and keeps
+ * everything else — one line, dim, still leading with what is still
+ * true — because the human is mid-approval and the shape of the sentence
+ * is what they have already learned to read.
+ */
+export declare const SAFER_DEGRADED_TRUNCATED = "couldn't get safer options (the reply was cut short) \u2014 the original choices stand";
+/**
+ * R3v2-F1 — a failure that knows why it failed.
+ *
+ * `truncated` is the only cause the caller can demonstrate from the
+ * text, and it is deliberately the only member: a diagnosis the product
+ * cannot prove is worse than no diagnosis, so every other failure stays
+ * the unqualified line rather than growing a guess.
+ */
+export interface SaferFailure {
+    readonly reason: "truncated";
+}
+/**
+ * R3v2-F1 — what the safer-options provider hands back.
+ *
+ * A list is the answer. `null` is a failure with nothing to add, and is
+ * still the whole contract for any caller that has nothing to add — the
+ * widening is additive, so an existing provider's behaviour is
+ * byte-identical. A SaferFailure is a failure that can name its cause.
+ */
+export type SaferAnswer = readonly SaferOption[] | SaferFailure | null;
+/** R3v2-F1: the line a failed ask owes the human — the unqualified one,
+ *  unless the answer named a cause. The panel asks this instead of
+ *  reaching for a constant, so the choice of sentence lives with the
+ *  sentences. */
+export declare function saferDegradedNote(answer: SaferAnswer): string;
+/** The row that returns to state 1. Rendered last, always present — an
+ *  alternatives list you cannot back out of would be a trap. */
+export declare const SAFER_BACK = "back to the original choices";
+/** What an option DOES — the verdict channel it commits to. The label is
+ *  what the human reads; the kind is what the editor routes on, so the
+ *  copy can change without touching a single branch. */
+export type PanelOptionKind = "allow" | "rule" | "safer" | "deny";
+export interface PanelOption {
+    readonly kind: PanelOptionKind;
+    readonly label: string;
+}
+/**
+ * The options a view offers, IN ROW ORDER — and the order is the whole
+ * contract: the index is the digit, the digit is the row, and the row is
+ * what a mouse click lands on. One list, read by the renderer, the key
+ * router and the hit-test, so those three can never disagree about what
+ * option 3 is.
+ *
+ * The approval flavor's copy is the v4 frames', with ONE correction.
+ * The frame said "don't ask again for <tool> this session"; the rule
+ * machinery (addDontAskAgainRule) writes a generated extension file that
+ * outlives the process and matches on the TOOL NAME. "This session"
+ * would have understated a durable grant — the one direction a
+ * permission prompt must never be wrong in — so the scope claim is
+ * dropped rather than invented. The revocation path is the file itself,
+ * which the generated header documents.
+ */
+export declare function panelOptions(view: PanelView): readonly PanelOption[];
+/**
+ * TUI2-R3v2 ④ — the deletion-risk hint: four patterns, and nothing else.
+ *
+ * The owner's ruling narrowed this to commands where UNDO DOES NOT
+ * EXIST. That is the whole selection criterion, and it is what makes the
+ * line worth reading: a warning on every dangerous command teaches the
+ * eye to skip warnings, and the eye is the only thing standing between
+ * the human and the side effect.
+ *
+ * So `dd if=/dev/zero of=/dev/sda` gets nothing. It is more destructive
+ * than anything in this table and it is not in it, because the moment
+ * the rules start guessing they start being wrong in both directions —
+ * missing the real ones and crying wolf on `git checkout main`. Four
+ * shapes, matched exactly, no inference.
+ *
+ * The rm case NAMES ITS TARGETS. "This deletes files" is a sentence
+ * about the command's category; "(node_modules, dist)" is the thing the
+ * human is actually deciding about, and it is the difference between a
+ * hint and a label.
+ *
+ * Local string rules: zero requests, zero rent, and it never blocks —
+ * the hint is a sentence beside the command, never a gate in front of
+ * it. The mode moat and the safe-defaults moat are the teeth; this is
+ * the eyes.
+ */
+export declare function deletionRiskHint(command: string): string | null;
 /** One option of a question: the label the human picks, plus an
  *  optional one-line description (the model's own words). */
 export interface AskOption {
@@ -144,6 +272,23 @@ export interface PanelView {
     /** The fallback question — the y/n text for the dock-less path
      *  (a TTY without a dock, or a pipe). */
     readonly fallbackQuestion: string;
+    /** TUI2-R3v2 ③: this call is the model's answer to a refusal — the v4
+     *  frame's "(amended)" marker. It says WHY the call looks different
+     *  from the one just refused; without it a second approval for the same
+     *  tool reads as the product asking twice. */
+    readonly amended?: boolean;
+    /** TUI2-R3v2 ④: the deletion-risk line, when the command matches one
+     *  of the four irreversible patterns. Composed by the CLI (which owns
+     *  the tool input) from deletionRiskHint; absent for every other
+     *  command, which is most of them. */
+    readonly riskHint?: string;
+    /** TUI2-R3v2 ①: the SIMPLE flavor's two labels. A trust gate answers
+     *  "Yes / No", but an uncertain execution answers "rerun / abandon"
+     *  and an unanswered ask "re-ask / drop" — those callers used to
+     *  smuggle their labels into the rule line as "— 1 rerun · 3 abandon",
+     *  which stated the digits as well, and the digits have moved. The
+     *  labels belong on the rows that carry them. */
+    readonly simpleOptions?: readonly [string, string];
     /** KC3.5: the questions, when this view is an ASK. Present = the
      *  panel renders the ask block and the editor routes the ask keys;
      *  absent = the approval/simple panel, unchanged. */
@@ -184,34 +329,78 @@ export type PanelVerdict = {
 export interface PanelState {
     readonly view: PanelView;
     readonly phase: PanelPhase;
-    readonly sel: PanelSel;
+    /** TUI2-R3v2 ①: the highlighted row, 0-based into panelOptions(view).
+     *  There is no "nothing selected" value any more — the bar opens on
+     *  the first option, which is what makes a bare ⏎ an approval. */
+    readonly cursor: number;
+    /** TUI2-R3v2 ①: the one dim line a failed gesture owes the human (the
+     *  safer-options degradation). Absent when there is nothing to say. */
+    readonly note?: string;
+    /** TUI2-R3v2 ③: the safer list's walk — present exactly in the
+     *  "safer" phase. */
+    readonly safer?: SaferRuntime;
     /** KC3.5: the ask's walk — present exactly when `view.ask` is. */
     readonly ask?: AskRuntime;
     /** TUI2-R2 \u2463: the pick's walk — present exactly when `view.pick` is. */
     readonly pick?: PickRuntime;
 }
+/**
+ * TUI2-R3v2 ② — the block's rows AND where its option rows landed.
+ *
+ * The click hit-test needs to answer "which option is at screen row N",
+ * and the only honest source for that is the arithmetic that placed the
+ * rows. Computing it a second time — in the compositor, or in a helper
+ * that mirrors the budget — is how a hit-test comes to disagree with the
+ * picture: the args cap, the note row and the option window all move the
+ * list, and a mirror that misses one sends the click to the wrong
+ * verdict. So the renderer reports it, and there is exactly one copy of
+ * the sum.
+ *
+ * `offset` is the index of the first option row INSIDE the returned
+ * rows; `first` is which option that row shows (the window's start, non-
+ * zero only on a short block).
+ */
+export interface PanelBlockLayout {
+    readonly rows: readonly string[];
+    readonly offset: number;
+    readonly count: number;
+    readonly first: number;
+}
 /** The block's rows — EXACTLY the preview's frame shape, the gutter at
  *  the left edge (the preview's two-space mock indent is its own
  *  styling; the real rows sit at column 1, like every tool cell).
  *  maxRows caps the TOTAL (the args fold; the single-row lines cut). */
-export declare function panelBlockRows(view: PanelView, phase: PanelPhase, sel: PanelSel, W: number, maxRows: number): string[];
-/** The input row's lead for the panel's phase (the preview's chrome
- *  rows): the digit leads bold, the rule/feedback leads dim. The rule
- *  lead names the tool (the option-2 prefill), the amend lead the
- *  denial/allowance feedback ("the words ride the verdict"). */
-export declare function panelLead(view: PanelView, phase: PanelPhase, sel: PanelSel): string;
+export declare function panelBlockRows(view: PanelView, phase: PanelPhase, cursor: number, W: number, maxRows: number, note?: string, safer?: SaferRuntime): string[];
+export declare function panelBlockLayout(view: PanelView, phase: PanelPhase, cursor: number, W: number, maxRows: number, note?: string, safer?: SaferRuntime): PanelBlockLayout;
+/**
+ * The input row's lead. In the options phase there is NOTHING to type,
+ * so the lead stops pretending there is.
+ *
+ * "1-3> " was a prompt: it told the human to enter something and press
+ * return, which is exactly the interaction this round removed. The row
+ * keeps the composer's own quiet lead while the list is up (the keys are
+ * on the list and in the hint line), and the typed phase — the one place
+ * a human really is writing — leads with the word for what they are
+ * writing.
+ */
+export declare function panelLead(view: PanelView, phase: PanelPhase, cursor: number): string;
 /** The lead's plain text — the editor's reflow width (the line must
  *  fit the lead + the box's walls). */
-export declare function panelLeadPlain(view: PanelView, phase: PanelPhase, sel: PanelSel): string;
-export declare function panelLeadWidth(view: PanelView, phase: PanelPhase, sel: PanelSel): number;
+export declare function panelLeadPlain(view: PanelView, phase: PanelPhase, cursor: number): string;
+export declare function panelLeadWidth(view: PanelView, phase: PanelPhase, cursor: number): number;
 /** The status row's left text while the panel is up — the phase, not
  *  the CLI's painting status (the compositor derives it from the panel
  *  state; the "▸ run paused" etc. ride the options phase). */
-export declare function panelStatus(view: PanelView, phase: PanelPhase, sel: PanelSel): string;
-/** The status row's right-aligned hint while the panel is up — the
- *  phase's keys. The approval flavor gains the tab-amend path; the
- *  simple flavor (the trust/uncertain gates) never does. */
-export declare function panelAffordance(view: PanelView, phase: PanelPhase, sel: PanelSel): string;
+export declare function panelStatus(view: PanelView, phase: PanelPhase, cursor: number): string;
+/**
+ * The status row's right-aligned hint — the v4 frame's line, verbatim.
+ *
+ * It names all four gestures because all four now exist at once and the
+ * digit range is the only part that varies: "1-4" on an approval, "1-2"
+ * on the simple flavors. The click is advertised for the same reason the
+ * arrows are — an affordance nobody is told about is one nobody uses.
+ */
+export declare function panelAffordance(view: PanelView, phase: PanelPhase, cursor: number, safer?: SaferRuntime): string;
 /**
  * The pick block's rows — the prototype's C frame.
  *

package/dist/approval-panel.js

@@ -25,11 +25,145 @@
  * FOLD (a bounded block's body — content folds, metadata cuts).
  */
 import { displayWidth } from "./width.js";
-import { cutLine, diffBody, gutterFold, visibleWidth, widthCut } from "./components.js";
+import { cutLine, diffBody, gutterFold, selectionBar, visibleWidth, widthCut } from "./components.js";
 // TUI2-R2pre ④: strings.js takes only a TYPE from this module, so the
 // import is erased at compile time and no runtime cycle exists.
 import { displayVerb } from "./strings.js";
 import { escapeTerminal, palette } from "./render.js";
+/** The copy a failed ask owes the human. One line, dim, and it says what
+ *  is still true rather than what went wrong: the original choices are
+ *  all still there, which is the only thing they need to know to keep
+ *  going. */
+export const SAFER_DEGRADED = "couldn't get safer options — the original choices stand";
+/**
+ * R3v2-F1 — the same sentence, for the one failure the reply's own text
+ * can PROVE.
+ *
+ * The unqualified line is true of every failure the ask has, which is
+ * exactly why it explains nothing when the cause was knowable. A reply
+ * the token budget cut in half is knowable: the JSON opens and never
+ * closes. So that case gets the cause in a parenthesis and keeps
+ * everything else — one line, dim, still leading with what is still
+ * true — because the human is mid-approval and the shape of the sentence
+ * is what they have already learned to read.
+ */
+export const SAFER_DEGRADED_TRUNCATED = "couldn't get safer options (the reply was cut short) — the original choices stand";
+/** R3v2-F1: the line a failed ask owes the human — the unqualified one,
+ *  unless the answer named a cause. The panel asks this instead of
+ *  reaching for a constant, so the choice of sentence lives with the
+ *  sentences. */
+export function saferDegradedNote(answer) {
+    const failure = answer === null || Array.isArray(answer) ? null : answer;
+    return failure?.reason === "truncated" ? SAFER_DEGRADED_TRUNCATED : SAFER_DEGRADED;
+}
+/** The row that returns to state 1. Rendered last, always present — an
+ *  alternatives list you cannot back out of would be a trap. */
+export const SAFER_BACK = "back to the original choices";
+/**
+ * The options a view offers, IN ROW ORDER — and the order is the whole
+ * contract: the index is the digit, the digit is the row, and the row is
+ * what a mouse click lands on. One list, read by the renderer, the key
+ * router and the hit-test, so those three can never disagree about what
+ * option 3 is.
+ *
+ * The approval flavor's copy is the v4 frames', with ONE correction.
+ * The frame said "don't ask again for <tool> this session"; the rule
+ * machinery (addDontAskAgainRule) writes a generated extension file that
+ * outlives the process and matches on the TOOL NAME. "This session"
+ * would have understated a durable grant — the one direction a
+ * permission prompt must never be wrong in — so the scope claim is
+ * dropped rather than invented. The revocation path is the file itself,
+ * which the generated header documents.
+ */
+export function panelOptions(view) {
+    if (view.flavor === "simple") {
+        const [yes, no] = view.simpleOptions ?? ["Yes", "No"];
+        return [
+            { kind: "allow", label: yes },
+            { kind: "deny", label: no },
+        ];
+    }
+    return [
+        { kind: "allow", label: "Yes, run it" },
+        { kind: "rule", label: `Yes, and don't ask again for ${displayVerb(view.name)}` },
+        { kind: "safer", label: "Show me safer ways to do this" },
+        { kind: "deny", label: "No — let me tell it what to do instead" },
+    ];
+}
+/**
+ * TUI2-R3v2 ④ — the deletion-risk hint: four patterns, and nothing else.
+ *
+ * The owner's ruling narrowed this to commands where UNDO DOES NOT
+ * EXIST. That is the whole selection criterion, and it is what makes the
+ * line worth reading: a warning on every dangerous command teaches the
+ * eye to skip warnings, and the eye is the only thing standing between
+ * the human and the side effect.
+ *
+ * So `dd if=/dev/zero of=/dev/sda` gets nothing. It is more destructive
+ * than anything in this table and it is not in it, because the moment
+ * the rules start guessing they start being wrong in both directions —
+ * missing the real ones and crying wolf on `git checkout main`. Four
+ * shapes, matched exactly, no inference.
+ *
+ * The rm case NAMES ITS TARGETS. "This deletes files" is a sentence
+ * about the command's category; "(node_modules, dist)" is the thing the
+ * human is actually deciding about, and it is the difference between a
+ * hint and a label.
+ *
+ * Local string rules: zero requests, zero rent, and it never blocks —
+ * the hint is a sentence beside the command, never a gate in front of
+ * it. The mode moat and the safe-defaults moat are the teeth; this is
+ * the eyes.
+ */
+export function deletionRiskHint(command) {
+    // a compound command's risk can be its SECOND half ("npm run clean &&
+    // git clean -fd"), so the segments are scanned in order and the FIRST
+    // match wins: one line, never a stack of them.
+    for (const raw of command.split(/&&|\|\||[;|]/)) {
+        const segment = raw.trim();
+        if (segment === "")
+            continue;
+        const hint = segmentRisk(segment);
+        if (hint !== null)
+            return hint;
+    }
+    return null;
+}
+function segmentRisk(segment) {
+    const words = segment.split(/\s+/);
+    const verb = words[0];
+    if (verb === "rm") {
+        // -rf in any spelling or order (-rf, -fr, -r -f), because the shell
+        // accepts all of them and the human meant the same thing by each.
+        const flags = words.slice(1).filter((w) => /^-[a-zA-Z]+$/.test(w));
+        const letters = flags.join("");
+        if (!letters.includes("r") || !letters.includes("f"))
+            return null;
+        const targets = words.slice(1).filter((w) => !/^-/.test(w));
+        return targets.length === 0 ? "⚠ deletes files permanently" : `⚠ deletes files permanently (${targets.join(", ")})`;
+    }
+    if (verb !== "git")
+        return null;
+    const sub = words[1];
+    // `git checkout -- <paths>` discards; `git checkout <branch>` does not,
+    // and conflating them would put a red line on the most ordinary command
+    // in the product.
+    if (sub === "checkout" && words.includes("--"))
+        return "⚠ discards your uncommitted changes — unrecoverable";
+    if (sub === "reset" && words.includes("--hard"))
+        return "⚠ throws away commits and working changes";
+    // `git clean -n` is a DRY RUN and is the reason this checks for the f
+    // rather than for the command.
+    if (sub === "clean") {
+        const letters = words
+            .slice(2)
+            .filter((w) => /^-[a-zA-Z]+$/.test(w))
+            .join("");
+        if (letters.includes("f"))
+            return "⚠ deletes untracked files permanently";
+    }
+    return null;
+}
 /** The rule line's text — the why-asked line (the R3 chain): the tool
  *  name, the first non-abstain speaker, the fix hint (the §3.5 table,
  *  code-accented). The simple flavor carries the CLI's own question
@@ -44,53 +178,55 @@ function panelRuleText(view) {
     // ("edit needs approval"). view.name keeps the RAW tool name, which is
     // what the option-2 rule prefill and the fallbackQuestion (the
     // dock-less/pipe path — byte-identical by ruling) still read.
-    const base = `${p.bold}${escapeTerminal(displayVerb(view.name))}${p.reset} ${p.dim}needs approval — asked by${p.reset} ${p.bold}${escapeTerminal(view.speaker)}${p.reset}`;
+    // TUI2-R3v2 ③: the marker is SPLICED, and the un-amended line's bytes
+    // are left exactly as they were.
+    //
+    // The first version composed one template for both cases, closing and
+    // reopening the dim run around the marker slot. That is invisible on
+    // screen and it broke the RAW BYTE run "needs approval — asked by",
+    // which four PTY gates use as a frame needle — the driver matches on
+    // the byte stream, so the needle stopped matching, the approval was
+    // never answered, and the panel hung. An ordinary approval must be
+    // byte-identical to what it was; only the amended one differs.
+    const head = `${p.bold}${escapeTerminal(displayVerb(view.name))}${p.reset} `;
+    const tail = ` ${p.bold}${escapeTerminal(view.speaker)}${p.reset}`;
+    const base = view.amended === true
+        ? `${head}${p.dim}needs approval · (amended) — asked by${p.reset}${tail}`
+        : `${head}${p.dim}needs approval — asked by${p.reset}${tail}`;
     return hint ? `${base}${p.dim} ·${p.reset} ${p.code}${escapeTerminal(hint)}${p.reset}` : base;
 }
-/** The numbered options row — "1 Yes  2 Yes, don't ask again for
- *  <rule>  3 No" (approval) or "1 Yes  3 No" (simple). The row is a
- *  pure SPAN: the block prepends the gutter (the invariant ① test
- *  caught the double-gutter — the block and the row both emitted it).
- *  The option-2 rule name is the ONLY cuttable span: the row's fixed
- *  part (the 1/3 options + the separators + the option-2 prefix) is 45
- *  cells, so the name fits W−45 and cuts with a "…" at W−46 (the
- *  single-row discipline — the row never folds). */
-function panelOptionsRow(view, sel, W) {
+/**
+ * TUI2-R3v2 ① — ONE ROW PER OPTION, and the cursor's row is a bar.
+ *
+ * The retired form packed every option onto one line and, below W=47,
+ * DROPPED the middle one to make the line fit — a narrow terminal
+ * silently lost the ability to grant a durable rule. A list has no such
+ * trade to make: each option owns a row, a narrow window cuts LABELS,
+ * and every choice stays reachable at every width the product survives.
+ *
+ * The unselected row carries the block's gutter and a two-space indent;
+ * the selected row is the shared selectionBar, which spends its own two
+ * cells of frame. Both build their span against W−2, so the digit column
+ * does not shift as the bar walks — a column that moves per row reads as
+ * damage, which is the R2 picker's finding, inherited.
+ */
+function panelOptionRow(option, n, selected, W) {
     const p = palette();
-    // TUI2-R1.5 ⑪ (VD-13): ONE separator grammar. The options were
-    // two-space separated while every other metadata group in the product
-    // uses `·`, and at 80 columns that put `3 No` far enough from its
-    // neighbours to read as detached rather than as the third option.
-    const o1 = sel === 1 ? `${p.bold} 1 Yes${p.reset}` : ` 1 Yes`;
-    const o3 = sel === 3 ? `${p.bold}3 No${p.reset}` : `3 No`;
-    if (view.flavor === "simple")
-        return `${o1} · ${o3}`;
-    // the option-2 span: " 2 Yes, don't ask again for <name>" — the
-    // fixed part is 45 (the gutter + the 1/3 options + the separators +
-    // the 28-cell prefix); the name cuts to W−46 + "…". The "…" needs
-    // its own cell, so the span fits only when W − 46 ≥ 1; below that
-    // (W < 47 — incl. the 0.1.42 release-smoke's 40-col winch) the span
-    // DROPS: the rule name is the cuttable span, the 1/3 options are
-    // the semantics — the approval decision must survive a narrow
-    // winch, and invariant ① must never fire on the options row.
-    // TUI2-R1.5 ⑪: option 2 states what it DOES; the tool it would do it
-    // for is the panel's title, one row above, and repeating it here was
-    // what made this row the widest thing in the block. The fixed part is
-    // now 33 cells, so the whole row survives far narrower windows than the
-    // 47 the rule name used to demand.
-    const o2 = sel === 2 ? `${p.bold}2 Yes, don't ask again${p.reset}` : `2 Yes, don't ask again`;
-    const full = `${o1} · ${o2} · ${o3}`;
-    if (visibleWidth(full) <= W - 2)
-        return full;
-    // too narrow for the middle option: the 1/3 decision is the semantics
-    // and must survive any winch (invariant ① never fires on this row).
-    return cutLine(`${o1} · ${o3}`, Math.max(1, W - 2));
+    const room = Math.max(1, W - 2);
+    const plain = ` ${n} ${option.label}`;
+    const text = cutLine(`${selected ? p.bold : ""}${escapeTerminal(plain)}${p.reset}`, room);
+    if (!selected)
+        return `${p.dim}│${p.reset} ${text}`;
+    return selectionBar(text, visibleWidth(text), W);
 }
 /** The block's rows — EXACTLY the preview's frame shape, the gutter at
  *  the left edge (the preview's two-space mock indent is its own
  *  styling; the real rows sit at column 1, like every tool cell).
  *  maxRows caps the TOTAL (the args fold; the single-row lines cut). */
-export function panelBlockRows(view, phase, sel, W, maxRows) {
+export function panelBlockRows(view, phase, cursor, W, maxRows, note, safer) {
+    return panelBlockLayout(view, phase, cursor, W, maxRows, note, safer).rows;
+}
+export function panelBlockLayout(view, phase, cursor, W, maxRows, note, safer) {
     const p = palette();
     const gutter = `${p.dim}│${p.reset} `;
     const rows = [];
@@ -107,7 +243,23 @@ export function panelBlockRows(view, phase, sel, W, maxRows) {
     const args = view.args.kind === "diff"
         ? diffBody(view.args.diff, W, true) // the expanded path — never the tool cell's capped copy
         : view.args.lines.flatMap((line) => gutterFold(`${p.dim}│${p.reset} `, escapeTerminal(line), W));
-    const argsBudget = Math.max(1, maxRows - 6);
+    // TUI2-R3v2 ①: the block now spends N rows on options instead of one,
+    // so the args and the list SHARE what is left after the chrome (the
+    // rule, the title, the divider, the affordance, the corner — five
+    // rows, plus the note when there is one). The list wins the tie: a
+    // human at an approval is choosing, and one more line of a command
+    // they can also read in the event log is worth less than the row that
+    // carries the choice. The args keep a floor of one row so the block
+    // never claims to show what it is asking about and then shows nothing.
+    const chrome = 5 +
+        (phase === "options" && note !== undefined ? 1 : 0) +
+        (view.riskHint !== undefined && view.riskHint !== "" ? 1 : 0) +
+        (phase === "asking" ? 1 : 0) +
+        // the safer list's rows + its way-back row
+        (phase === "safer" && safer !== undefined ? safer.options.length + 1 : 0);
+    const optionCount = phase === "options" ? panelOptions(view).length : 0;
+    const optionsShown = Math.min(optionCount, Math.max(1, maxRows - chrome - 1));
+    const argsBudget = Math.max(1, maxRows - chrome - optionsShown);
     let shown;
     if (args.length > argsBudget) {
         const kept = Math.max(0, argsBudget - 1);
@@ -118,8 +270,63 @@ export function panelBlockRows(view, phase, sel, W, maxRows) {
         shown = args;
     }
     rows.push(...shown);
-    rows.push(`${gutter}${panelOptionsRow(view, sel, W)}`);
-    rows.push(`${gutter}${p.dim}${panelAffordance(view, phase, sel)}${p.reset}`);
+    // TUI2-R3v2 ④: the risk hint sits directly under the args, because it
+    // is a sentence ABOUT those args — the v4 frame's placement. The warn
+    // tint is the palette's existing functional yellow (no new colour),
+    // and under NO_COLOR the ⚠ still carries it.
+    const risk = view.riskHint;
+    if (risk !== undefined && risk !== "")
+        rows.push(`${gutter}${cutLine(`${p.warn}${escapeTerminal(risk)}${p.reset}`, Math.max(1, W - 2))}`);
+    // TUI2-R3v2 ①: the option LIST. While the typed phase is open the list
+    // stands down — the human is writing prose to the model, and a bar
+    // hovering over "Yes, run it" while they do it claims a choice is still
+    // live that their next keystroke is not addressing.
+    let offset = 0;
+    let first = 0;
+    // TUI2-R3v2 ③: the in-flight line. A button that goes quiet for two
+    // seconds reads as broken, and this one is making a network call —
+    // so the panel says what it is doing, and says that esc still works.
+    if (phase === "asking") {
+        rows.push(`${gutter}${cutLine(`${p.dim}asking the model for safer options…${p.reset}`, Math.max(1, W - 2))}`);
+    }
+    // TUI2-R3v2 ③: the alternatives, as a list in the SAME shape as the
+    // approval's own — the round's one interaction model, applied to the
+    // one new surface rather than excepted from it. The way back is the
+    // last row and is always present: an alternatives list you cannot back
+    // out of would be a trap.
+    if (phase === "safer" && safer !== undefined) {
+        offset = rows.length;
+        for (let i = 0; i < safer.options.length; i += 1) {
+            const o = safer.options[i];
+            rows.push(panelOptionRow({ kind: "allow", label: `${o.command}  — ${o.why}` }, i + 1, i === safer.cursor, W));
+        }
+        rows.push(panelOptionRow({ kind: "deny", label: SAFER_BACK }, safer.options.length + 1, safer.cursor === safer.options.length, W));
+    }
+    if (phase === "options") {
+        if (note !== undefined)
+            rows.push(`${gutter}${cutLine(`${p.dim}${escapeTerminal(note)}${p.reset}`, Math.max(1, W - 2))}`);
+        offset = rows.length;
+        const options = panelOptions(view);
+        // A window, never a truncation. On a screen too short for the whole
+        // list the options SCROLL under the bar — the cursor's row is always
+        // in view, ↑↓ still reach every option and the digits still address
+        // the full list (the affordance says "1-4" whether four rows fit or
+        // two do). Dropping the tail instead would make an option that the
+        // key still takes invisible, which is the one failure a permission
+        // list must not have.
+        first = Math.max(0, Math.min(cursor - optionsShown + 1, options.length - optionsShown));
+        for (let i = first; i < first + optionsShown; i += 1)
+            rows.push(panelOptionRow(options[i], i + 1, i === cursor, W));
+    }
+    const layout = {
+        offset,
+        // the safer list is clickable by the same rule the option list is —
+        // one interaction model means the click works on every list, and its
+        // rows include the way back (hence +1)
+        count: phase === "options" ? optionsShown : phase === "safer" && safer !== undefined ? safer.options.length + 1 : 0,
+        first,
+    };
+    rows.push(`${gutter}${p.dim}${cutLine(panelAffordance(view, phase, cursor, safer), Math.max(1, W - 2))}${p.reset}`);
     // TUI2-R1.5 11 (VD-13): a real bottom RULE, in the block's own edge
     // vocabulary — the same box-drawing run its divider already uses —
     // anchored at the gutter column. It used to be `\u2514 `: a two-cell stub
@@ -129,53 +336,75 @@ export function panelBlockRows(view, phase, sel, W, maxRows) {
     // row meaning entirely different things. The rule reads as an edge,
     // and the cut notice above it reads as a notice.
     rows.push(`${p.dim}\u2514${"\u2500".repeat(Math.max(0, W - 1))}${p.reset}`);
-    return rows;
+    return { rows, ...layout };
 }
-/** The input row's lead for the panel's phase (the preview's chrome
- *  rows): the digit leads bold, the rule/feedback leads dim. The rule
- *  lead names the tool (the option-2 prefill), the amend lead the
- *  denial/allowance feedback ("the words ride the verdict"). */
-export function panelLead(view, phase, sel) {
+/**
+ * The input row's lead. In the options phase there is NOTHING to type,
+ * so the lead stops pretending there is.
+ *
+ * "1-3> " was a prompt: it told the human to enter something and press
+ * return, which is exactly the interaction this round removed. The row
+ * keeps the composer's own quiet lead while the list is up (the keys are
+ * on the list and in the hint line), and the typed phase — the one place
+ * a human really is writing — leads with the word for what they are
+ * writing.
+ */
+export function panelLead(view, phase, cursor) {
     const p = palette();
-    if (phase === "rule")
-        return `${p.dim}2 Yes, don't ask again for ${p.reset}`;
     if (phase === "amend")
-        return `${p.dim}${sel === 3 ? "feedback (deny): " : "feedback (amend): "}${p.reset}`;
-    return `${p.bold}${view.flavor === "approval" ? "1-3> " : "1/3> "}${p.reset}`;
+        return `${p.dim}amend› ${p.reset}`;
+    return `${p.dim}${PANEL_IDLE_LEAD}${p.reset}`;
 }
+/** The composer's lead while a selection list owns the keys — the quiet
+ *  chevron, not a prompt for input that is not being asked for. */
+const PANEL_IDLE_LEAD = "› ";
 /** The lead's plain text — the editor's reflow width (the line must
  *  fit the lead + the box's walls). */
-export function panelLeadPlain(view, phase, sel) {
-    if (phase === "rule")
-        return "2 Yes, don't ask again for ";
-    if (phase === "amend")
-        return sel === 3 ? "feedback (deny): " : "feedback (amend): ";
-    return view.flavor === "approval" ? "1-3> " : "1/3> ";
+export function panelLeadPlain(view, phase, cursor) {
+    return phase === "amend" ? "amend› " : PANEL_IDLE_LEAD;
 }
-export function panelLeadWidth(view, phase, sel) {
-    return displayWidth(panelLeadPlain(view, phase, sel));
+export function panelLeadWidth(view, phase, cursor) {
+    return displayWidth(panelLeadPlain(view, phase, cursor));
 }
 /** The status row's left text while the panel is up — the phase, not
  *  the CLI's painting status (the compositor derives it from the panel
  *  state; the "▸ run paused" etc. ride the options phase). */
-export function panelStatus(view, phase, sel) {
-    if (phase === "rule")
-        return "▸ rule input";
+export function panelStatus(view, phase, cursor) {
+    // TUI2-R3v2 ③: the frames' own words — what the panel is doing, and
+    // (in the safer list) what it did.
+    if (phase === "asking")
+        return "\u25b8 asked the model for safer options";
+    if (phase === "safer")
+        return "\u25b8 asked the model for safer options";
+    // TUI2-R3v2 ①: the typed phase says where the words GO. "the words ride
+    // the verdict" described the plumbing to whoever wrote it; the human
+    // typing needs to know the model will read this and answer with a new
+    // call — which is what the v4 frame says, in those words.
     if (phase === "amend")
-        return sel === 3 ? "▸ deny · the words become the tool_result" : "▸ amend · the words ride the verdict";
+        return "▸ your note goes to the model — it will propose a new call";
     return view.statusText;
 }
-/** The status row's right-aligned hint while the panel is up — the
- *  phase's keys. The approval flavor gains the tab-amend path; the
- *  simple flavor (the trust/uncertain gates) never does. */
-export function panelAffordance(view, phase, sel) {
-    if (phase === "rule")
-        return "enter commits · esc backs out";
+/**
+ * The status row's right-aligned hint — the v4 frame's line, verbatim.
+ *
+ * It names all four gestures because all four now exist at once and the
+ * digit range is the only part that varies: "1-4" on an approval, "1-2"
+ * on the simple flavors. The click is advertised for the same reason the
+ * arrows are — an affordance nobody is told about is one nobody uses.
+ */
+export function panelAffordance(view, phase, cursor, safer) {
     if (phase === "amend")
-        return "enter sends";
-    if (view.flavor === "approval")
-        return sel === 0 ? "tab amend · esc cancel" : "enter sends · esc backs out";
-    return sel === 0 ? "esc cancel" : "enter sends";
+        return "⏎ send · esc back";
+    // TUI2-R3v2 ③: the ask is in flight — the ONE key that still means
+    // something is the one that gets you out of it.
+    if (phase === "asking")
+        return "esc cancels";
+    // the same sentence the approval list carries, counting the rows THIS
+    // list has (the alternatives plus the way back)
+    if (phase === "safer" && safer !== undefined) {
+        return `↑↓ move · ⏎ or click confirms · 1-${safer.options.length + 1} instant · esc`;
+    }
+    return `↑↓ move · ⏎ or click confirms · 1-${panelOptions(view).length} instant · esc`;
 }
 // ── TUI2-R2 ④: the pick block, its lead, its status, its affordance ──
 /**

package/dist/components.d.ts

@@ -350,6 +350,34 @@ export declare function statusLine(status: string, tail: string, W: number, hint
 /** The display-width prefix of a plain (SGR-free) text. W21: exported
  *  for the approval panel's option-2 rule-name cut. */
 export declare function widthCut(text: string, max: number): string;
+/**
+ * TUI2-R3v2 ① — THE selection bar. One engine, every selection surface.
+ *
+ * The R1.5 ⑧ ruling settled the shape (a full-row reverse bar, not a
+ * two-cell marker you have to hunt for in eighty columns) and the @
+ * picker, the user chip and the R2 session picker each grew their own
+ * copy of the composition. The approval panel would have been the
+ * fourth, so the composition moves HERE and the surfaces call it.
+ *
+ * Two details are the whole reason this is a function and not four
+ * inlined string templates:
+ *
+ *  - the inner `reset`s are rewritten to reset-then-reverse. A plain SGR
+ *    0 inside the bar punches a hole in it: the row goes back to normal
+ *    video mid-span and the bar reads as two bars with a gap. The close
+ *    is SGR 27 (rvEnd), never SGR 0, for the same reason — the bar
+ *    composes INSIDE whatever span surrounds it.
+ *  - the pad is computed from the caller's measured VISIBLE width, never
+ *    from the styled string's length. A bar that stops short is not a
+ *    bar, and one that runs past W crashes the compositor's invariant ①
+ *    rather than truncating quietly — so the arithmetic is stated once,
+ *    here, and proven once, in the sweep gates.
+ *
+ * The bar spends one cell of frame at each end, so callers build their
+ * spans against W−2 whether the row is selected or not — which is what
+ * keeps the columns from moving as the bar walks the list.
+ */
+export declare function selectionBar(styled: string, visible: number, W: number): string;
 /** W6 — the box: the chrome's top rail. The two ╌ dotted rows become
  *  a rounded box (the box already says "input lives here"); the rails
  *  stay dim, the width is still the full W (the box is a rail with

package/dist/components.js

@@ -1411,6 +1411,38 @@ export function widthCut(text, max) {
     }
     return text.slice(0, i);
 }
+/**
+ * TUI2-R3v2 ① — THE selection bar. One engine, every selection surface.
+ *
+ * The R1.5 ⑧ ruling settled the shape (a full-row reverse bar, not a
+ * two-cell marker you have to hunt for in eighty columns) and the @
+ * picker, the user chip and the R2 session picker each grew their own
+ * copy of the composition. The approval panel would have been the
+ * fourth, so the composition moves HERE and the surfaces call it.
+ *
+ * Two details are the whole reason this is a function and not four
+ * inlined string templates:
+ *
+ *  - the inner `reset`s are rewritten to reset-then-reverse. A plain SGR
+ *    0 inside the bar punches a hole in it: the row goes back to normal
+ *    video mid-span and the bar reads as two bars with a gap. The close
+ *    is SGR 27 (rvEnd), never SGR 0, for the same reason — the bar
+ *    composes INSIDE whatever span surrounds it.
+ *  - the pad is computed from the caller's measured VISIBLE width, never
+ *    from the styled string's length. A bar that stops short is not a
+ *    bar, and one that runs past W crashes the compositor's invariant ①
+ *    rather than truncating quietly — so the arithmetic is stated once,
+ *    here, and proven once, in the sweep gates.
+ *
+ * The bar spends one cell of frame at each end, so callers build their
+ * spans against W−2 whether the row is selected or not — which is what
+ * keeps the columns from moving as the bar walks the list.
+ */
+export function selectionBar(styled, visible, W) {
+    const p = palette();
+    const inner = styled.replaceAll(p.reset, `${p.reset}${p.rv}`);
+    return `${p.rv} ${inner}${" ".repeat(Math.max(0, W - visible - 2))} ${p.rvEnd}`;
+}
 /** W6 — the box: the chrome's top rail. The two ╌ dotted rows become
  *  a rounded box (the box already says "input lives here"); the rails
  *  stay dim, the width is still the full W (the box is a rail with

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export { SPINNER, foldLine, foldWords, visibleWidth, bodySpacing, Container, cel
 export { editFileDiff, truncateDiff, writeFileDiff, type DiffLine, type DiffResult } from "./diff.js";
 export { pendingQueueRows } from "./components.js";
 export { charWidth, displayWidth, leadWidth, widthOf } from "./width.js";
-export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, type PanelArgs, type PanelFlavor, type PanelPhase, type PanelSel, type PanelState, type PanelVerdict, type PanelView, type AskAnswer, type AskOption, type AskQuestion, type AskResult, type AskRuntime, type AskSpec, } from "./approval-panel.js";
+export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, type PanelArgs, type PanelFlavor, type PanelPhase, deletionRiskHint, SAFER_BACK, SAFER_DEGRADED, type SaferOption, type SaferRuntime, panelOptions, type PanelOption, type PanelOptionKind, type PanelState, type PanelVerdict, type PanelView, type AskAnswer, type AskOption, type AskQuestion, type AskResult, type AskRuntime, type AskSpec, } from "./approval-panel.js";
 export { interactivePrompt, projectTrustRows, projectTrustView, projectUntrustedNote, uncertainView, type TrustArtifact, } from "./strings.js";
 export { extensionsBannerText, helpRows, unansweredAskView, type BannerExtension } from "./strings.js";
 export { displayVerb } from "./strings.js";

package/dist/index.js

@@ -17,7 +17,7 @@ export { charWidth, displayWidth, leadWidth, widthOf } from "./width.js";
 // that replaces the running tool's live window while a human-chain
 // approval is pending. Types + the row/lead/status renderers; the
 // verdict mapping lives in the cli, never here.
-export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, } from "./approval-panel.js";
+export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, deletionRiskHint, SAFER_BACK, SAFER_DEGRADED, panelOptions, } from "./approval-panel.js";
 // KC3 slice 1 (the extraction): the human-facing strings the CLI's
 // trust-ui.ts used to build inline — the prompt, the project-trust
 // listing/view/note, the uncertain execution's view. The flow stays in

package/dist/strings.d.ts

@@ -1,6 +1,6 @@
 /**
- * tui-cells — the human-facing STRINGS (KC3 slice 1, the ADR-0041
- * escape hatch: extraction, never a raise): the readline prompt, the
+ * tui-cells — the human-facing STRINGS (KC3 slice 1, the escape hatch
+ * of ADR-0043, which supersedes ADR-0041): the readline prompt, the
  * project-trust listing rows and its panel view, the uncertain
  * execution's panel view, and the non-TTY not-trusted note. All five
  * were built inline in the CLI's trust-ui.ts before the move.
@@ -53,10 +53,14 @@ export declare function projectTrustView(root: string, files: readonly TrustArti
  *  stderr by the caller; never silent. */
 export declare function projectUntrustedNote(count: number, root: string): string;
 /** rounds 8/10 — the uncertain execution's panel: the SIMPLE flavor
- *  again, with the options re-labelled in the rule line (1 rerun · 3
- *  abandon). The tool name is escaped for the dock-less fallback
- *  question because it reaches the terminal as raw text there; the
- *  panel's own rows are escaped by the panel renderer. */
+ *  again. TUI2-R3v2 ①: the option labels used to be smuggled into the
+ *  rule line ("— 1 rerun · 3 abandon") because the panel only ever
+ *  rendered "Yes" and "No"; they ride `simpleOptions` now and land on the
+ *  rows themselves, which is both where they belong and the only way they
+ *  stay true — the digits moved, and copy naming a digit it does not own
+ *  goes stale silently. The tool name is escaped for the dock-less
+ *  fallback question because it reaches the terminal as raw text there;
+ *  the panel's own rows are escaped by the panel renderer. */
 export declare function uncertainView(name: string, executionId: string): PanelView;
 /**
  * KC3.5 — the SAME uncertainty gate, said honestly for an ask_user call.
@@ -70,7 +74,7 @@ export declare function uncertainView(name: string, executionId: string): PanelV
  * (The round's ① probe pinned why this surface exists at all: the
  * shipped recovery blocks on a started-unreported execution regardless
  * of idempotency, so an interrupted ask meets this gate on the way
- * back. Re-asking is safe — that is what "1 re-ask" says out loud.)
+ * back. Re-asking is safe — that is what the first option says out loud.)
  */
 export declare function unansweredAskView(executionId: string): PanelView;
 /** An extension as the banner names it — the live `connecting` flag is
@@ -119,24 +123,20 @@ export declare function displayVerb(name: string): string;
  *  one dim line rather than four table rows, because they apply only
  *  while a panel is up. */
 /**
- * TUI2-R1.5 pin 6 — this row has to be true of BOTH panel flavors, and
- * "digits select" was wrong in both directions at once.
+ * TUI2-R1.5 pin 6 — this row has to be true of BOTH panel flavors.
  *
- * On an APPROVAL a digit only moves the selection (editor's #panelSelect
- * sets `sel` and renders); ENTER is what resolves it. A reader who
- * pressed 1 and walked away had approved nothing — the worst kind of
- * false affordance, on the surface where the stakes are a side effect.
+ * The R1.5 wording ("digits pick · ⏎ confirms") was the sentence that
+ * covered an approval where a digit only SELECTED and an ask where a
+ * digit ANSWERED. TUI2-R3v2 ① removed the disagreement it was papering
+ * over: every panel is a list with a bar on it, ↑↓ move the bar, ⏎ (or a
+ * click) takes the row under it, and a digit takes its row outright.
+ * One sentence, now true of every flavor for the same reason rather than
+ * by careful omission.
  *
- * On an ASK the opposite: a digit on a SINGLE-choice question answers it
- * and advances the walk (ask-panel's askKey → advance), so "select"
- * undersold it. A multi-select question toggles and waits for enter,
- * like the approval.
- *
- * "digits pick · ⏎ confirms" is the sentence both flavors satisfy. The
- * single-choice fast path — where the confirm is implicit — is the one
- * thing a single row cannot also carry; it is an omission, never a lie.
+ * The two ask-only gestures keep their clauses because the ask is the
+ * only flavor with a set to build and an answer to write.
  */
-export declare const PANEL_KEYS_ROW = "panels: digits pick \u00B7 \u23CE confirms \u00B7 space toggles \u00B7 t types an answer";
+export declare const PANEL_KEYS_ROW = "panels: \u2191\u2193 move \u00B7 \u23CE or click confirms \u00B7 1-4 instant \u00B7 space toggles \u00B7 t types";
 /**
  * TUI2-R1 (D) — the sheet, one screen, static.
  *

package/dist/strings.js

@@ -1,6 +1,6 @@
 /**
- * tui-cells — the human-facing STRINGS (KC3 slice 1, the ADR-0041
- * escape hatch: extraction, never a raise): the readline prompt, the
+ * tui-cells — the human-facing STRINGS (KC3 slice 1, the escape hatch
+ * of ADR-0043, which supersedes ADR-0041): the readline prompt, the
  * project-trust listing rows and its panel view, the uncertain
  * execution's panel view, and the non-TTY not-trusted note. All five
  * were built inline in the CLI's trust-ui.ts before the move.
@@ -64,10 +64,14 @@ export function projectUntrustedNote(count, root) {
     return `[project .kiso] found ${count} artifact(s) in ${root} — not trusted, not loaded (run kiso interactively once to decide)`;
 }
 /** rounds 8/10 — the uncertain execution's panel: the SIMPLE flavor
- *  again, with the options re-labelled in the rule line (1 rerun · 3
- *  abandon). The tool name is escaped for the dock-less fallback
- *  question because it reaches the terminal as raw text there; the
- *  panel's own rows are escaped by the panel renderer. */
+ *  again. TUI2-R3v2 ①: the option labels used to be smuggled into the
+ *  rule line ("— 1 rerun · 3 abandon") because the panel only ever
+ *  rendered "Yes" and "No"; they ride `simpleOptions` now and land on the
+ *  rows themselves, which is both where they belong and the only way they
+ *  stay true — the digits moved, and copy naming a digit it does not own
+ *  goes stale silently. The tool name is escaped for the dock-less
+ *  fallback question because it reaches the terminal as raw text there;
+ *  the panel's own rows are escaped by the panel renderer. */
 export function uncertainView(name, executionId) {
     return {
         flavor: "simple",
@@ -76,7 +80,8 @@ export function uncertainView(name, executionId) {
         speaker: "kiso",
         statusText: "▸ uncertain execution",
         args: { kind: "text", lines: [executionId] },
-        ruleOverride: "did the interrupted execution apply? — 1 rerun · 3 abandon",
+        ruleOverride: "did the interrupted execution apply?",
+        simpleOptions: ["rerun it", "abandon it"],
         fallbackQuestion: `⚠ interrupted execution: ${escapeTerminal(name)} (${executionId}) — did it apply? (y)es / (n)o `,
     };
 }
@@ -92,7 +97,7 @@ export function uncertainView(name, executionId) {
  * (The round's ① probe pinned why this surface exists at all: the
  * shipped recovery blocks on a started-unreported execution regardless
  * of idempotency, so an interrupted ask meets this gate on the way
- * back. Re-asking is safe — that is what "1 re-ask" says out loud.)
+ * back. Re-asking is safe — that is what the first option says out loud.)
  */
 export function unansweredAskView(executionId) {
     return {
@@ -102,7 +107,8 @@ export function unansweredAskView(executionId) {
         speaker: "kiso",
         statusText: "▸ unanswered question",
         args: { kind: "text", lines: [executionId] },
-        ruleOverride: "an unanswered question was interrupted — ask it again? — 1 re-ask · 3 drop",
+        ruleOverride: "an unanswered question was interrupted — ask it again?",
+        simpleOptions: ["ask it again", "drop it"],
         fallbackQuestion: `⚠ an unanswered question was interrupted (${executionId}) — ask it again? (y)es / (n)o `,
     };
 }
@@ -193,24 +199,20 @@ export function displayVerb(name) {
  *  one dim line rather than four table rows, because they apply only
  *  while a panel is up. */
 /**
- * TUI2-R1.5 pin 6 — this row has to be true of BOTH panel flavors, and
- * "digits select" was wrong in both directions at once.
+ * TUI2-R1.5 pin 6 — this row has to be true of BOTH panel flavors.
  *
- * On an APPROVAL a digit only moves the selection (editor's #panelSelect
- * sets `sel` and renders); ENTER is what resolves it. A reader who
- * pressed 1 and walked away had approved nothing — the worst kind of
- * false affordance, on the surface where the stakes are a side effect.
+ * The R1.5 wording ("digits pick · ⏎ confirms") was the sentence that
+ * covered an approval where a digit only SELECTED and an ask where a
+ * digit ANSWERED. TUI2-R3v2 ① removed the disagreement it was papering
+ * over: every panel is a list with a bar on it, ↑↓ move the bar, ⏎ (or a
+ * click) takes the row under it, and a digit takes its row outright.
+ * One sentence, now true of every flavor for the same reason rather than
+ * by careful omission.
  *
- * On an ASK the opposite: a digit on a SINGLE-choice question answers it
- * and advances the walk (ask-panel's askKey → advance), so "select"
- * undersold it. A multi-select question toggles and waits for enter,
- * like the approval.
- *
- * "digits pick · ⏎ confirms" is the sentence both flavors satisfy. The
- * single-choice fast path — where the confirm is implicit — is the one
- * thing a single row cannot also carry; it is an omission, never a lie.
+ * The two ask-only gestures keep their clauses because the ask is the
+ * only flavor with a set to build and an answer to write.
  */
-export const PANEL_KEYS_ROW = "panels: digits pick · ⏎ confirms · space toggles · t types an answer";
+export const PANEL_KEYS_ROW = "panels: ↑↓ move · ⏎ or click confirms · 1-4 instant · space toggles · t types";
 /** The sheet's grid: the first six bindings in two 3-column rows, the
  *  last four in two 2-column rows (the wide entries get the room). The
  *  COLUMN STOPS are the prototype's absolute positions, floored by the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-tui-cells",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "kiso tui-cells — the components cell renderer (components, diff, width, the render slice). Zero runtime dependencies: input is data, output is bytes.",
   "type": "module",
   "license": "MIT",