@vincemakes/kiso-tui 0.11.0 → 0.12.0

package/dist/ask-panel.d.ts

@@ -27,7 +27,7 @@
  * durability would need a new durable mechanism), no "chat about this"
  * hand-off, no timeout and no countdown.
  */
-import { type AskAnswer, type AskOption, type AskQuestion, type AskResult, type AskRuntime, type AskSpec, type PanelPhase, type PanelSel, type PanelState, type PanelView, type PickRuntime } from "./approval-panel.js";
+import { type SaferRuntime, type AskAnswer, type AskOption, type AskQuestion, type AskResult, type AskRuntime, type AskSpec, type PanelPhase, type PanelState, type PanelView, type PickRuntime } from "./approval-panel.js";
 /** The schema's own bounds — the registry refuses anything outside them
  *  (extensions/ask validates; these are the numbers it validates to). */
 export declare const ASK_MAX_QUESTIONS = 4;
@@ -77,15 +77,39 @@ export declare function askStatus(view: PanelView, state: AskRuntime): string;
 /** The input row's lead: the digit lead while picking, the typing lead
  *  in the custom phase (the rule-input phase's shape, reused). */
 export declare function askLeadPlain(state: AskRuntime): string;
-export declare function panelBlockRows(view: PanelView, phase: PanelPhase, sel: PanelSel, W: number, maxRows: number, ask?: AskRuntime, pick?: PickRuntime): string[];
-export declare function panelLead(view: PanelView, phase: PanelPhase, sel: PanelSel, ask?: AskRuntime, pick?: PickRuntime): string;
-export declare function panelLeadPlain(view: PanelView, phase: PanelPhase, sel: PanelSel, ask?: AskRuntime, pick?: PickRuntime): string;
-export declare function panelStatus(view: PanelView, phase: PanelPhase, sel: PanelSel, ask?: AskRuntime, pick?: PickRuntime): string;
-export declare function panelAffordance(view: PanelView, phase: PanelPhase, sel: PanelSel, ask?: AskRuntime, pick?: PickRuntime): string;
+export declare function panelBlockRows(view: PanelView, phase: PanelPhase, cursor: number, W: number, maxRows: number, ask?: AskRuntime, pick?: PickRuntime, note?: string, safer?: SaferRuntime): string[];
+export declare function panelLead(view: PanelView, phase: PanelPhase, cursor: number, ask?: AskRuntime, pick?: PickRuntime): string;
+export declare function panelLeadPlain(view: PanelView, phase: PanelPhase, cursor: number, ask?: AskRuntime, pick?: PickRuntime): string;
+export declare function panelStatus(view: PanelView, phase: PanelPhase, cursor: number, ask?: AskRuntime, pick?: PickRuntime): string;
+export declare function panelAffordance(view: PanelView, phase: PanelPhase, cursor: number, ask?: AskRuntime, pick?: PickRuntime, safer?: SaferRuntime): string;
 /** The whole panel state in one call — the compositor's four reads share
  *  one source, so an ask can never render half as an approval (TUI2-R2
  *  ④: nor a pick as either). */
 export declare const panelRowsOf: (s: PanelState, W: number, maxRows: number) => string[];
+/**
+ * TUI2-R3v2 ② — the rows AND where the clickable ones are, from ONE
+ * call.
+ *
+ * The compositor needs both and must not compute the second from the
+ * first: the args cap, the note row and the option window all move the
+ * list, so a hit-test that re-derived the offset would drift from the
+ * picture exactly when the block is under pressure — which is when a
+ * misrouted click is most expensive.
+ *
+ * `options` is null for the ask and pick flavors: their rows are placed
+ * by their own renderers, and this round does not claim a click on them
+ * (the enable/disable invariant covers those surfaces; the gesture does
+ * not). A null here means every click is inert, which is the safe way
+ * to not-implement something.
+ */
+export declare const panelFrameOf: (s: PanelState, W: number, maxRows: number) => {
+    rows: string[];
+    options: {
+        offset: number;
+        count: number;
+        first: number;
+    } | null;
+};
 export declare const panelLeadOf: (s: PanelState) => string;
 export declare const panelStatusOf: (s: PanelState) => string;
 export declare const panelAffordanceOf: (s: PanelState) => string;

package/dist/ask-panel.js

@@ -27,7 +27,7 @@
  * durability would need a new durable mechanism), no "chat about this"
  * hand-off, no timeout and no countdown.
  */
-import { panelAffordance as basePanelAffordance, panelBlockRows as basePanelBlockRows, panelLead as basePanelLead, panelLeadPlain as basePanelLeadPlain, panelStatus as basePanelStatus, pickAffordance, pickBlockRows, pickLead, pickLeadPlain, pickStatus, } from "./approval-panel.js";
+import { panelBlockLayout, panelAffordance as basePanelAffordance, panelBlockRows as basePanelBlockRows, panelLead as basePanelLead, panelLeadPlain as basePanelLeadPlain, panelStatus as basePanelStatus, pickAffordance, pickBlockRows, pickLead, pickLeadPlain, pickStatus, } from "./approval-panel.js";
 import { cutLine } from "@vincemakes/kiso-tui-cells/components";
 import { escapeTerminal, palette } from "./render.js";
 /** The schema's own bounds — the registry refuses anything outside them
@@ -225,49 +225,74 @@ export function askLeadPlain(state) {
     return state.phase === "custom" ? "your answer: " : "1-4> ";
 }
 // ── the dispatchers: the panel slot, with the ask branch folded in ────
-export function panelBlockRows(view, phase, sel, W, maxRows, ask, pick) {
+export function panelBlockRows(view, phase, cursor, W, maxRows, ask, pick, note, safer) {
     if (view.pick !== undefined && pick !== undefined)
         return pickBlockRows(view, pick, W, maxRows);
     if (view.ask !== undefined && ask !== undefined)
         return askBlockRows(view, ask, W, maxRows);
-    return basePanelBlockRows(view, phase, sel, W, maxRows);
+    return basePanelBlockRows(view, phase, cursor, W, maxRows, note, safer);
 }
-export function panelLead(view, phase, sel, ask, pick) {
+export function panelLead(view, phase, cursor, ask, pick) {
     const p = palette();
     if (view.pick !== undefined && pick !== undefined)
         return pickLead(view, pick);
     if (view.ask !== undefined && ask !== undefined)
         return `${p.bold}${askLeadPlain(ask)}${p.reset}`;
-    return basePanelLead(view, phase, sel);
+    return basePanelLead(view, phase, cursor);
 }
-export function panelLeadPlain(view, phase, sel, ask, pick) {
+export function panelLeadPlain(view, phase, cursor, ask, pick) {
     if (view.pick !== undefined && pick !== undefined)
         return pickLeadPlain(view, pick);
     if (view.ask !== undefined && ask !== undefined)
         return askLeadPlain(ask);
-    return basePanelLeadPlain(view, phase, sel);
+    return basePanelLeadPlain(view, phase, cursor);
 }
-export function panelStatus(view, phase, sel, ask, pick) {
+export function panelStatus(view, phase, cursor, ask, pick) {
     if (view.pick !== undefined && pick !== undefined)
         return pickStatus(view);
     if (view.ask !== undefined && ask !== undefined)
         return askStatus(view, ask);
-    return basePanelStatus(view, phase, sel);
+    return basePanelStatus(view, phase, cursor);
 }
-export function panelAffordance(view, phase, sel, ask, pick) {
+export function panelAffordance(view, phase, cursor, ask, pick, safer) {
     if (view.pick !== undefined && pick !== undefined)
         return pickAffordance(pick);
     if (view.ask !== undefined && ask !== undefined)
         return askAffordance(ask);
-    return basePanelAffordance(view, phase, sel);
+    return basePanelAffordance(view, phase, cursor, safer);
 }
 /** The whole panel state in one call — the compositor's four reads share
  *  one source, so an ask can never render half as an approval (TUI2-R2
  *  ④: nor a pick as either). */
-export const panelRowsOf = (s, W, maxRows) => panelBlockRows(s.view, s.phase, s.sel, W, maxRows, s.ask, s.pick);
-export const panelLeadOf = (s) => panelLead(s.view, s.phase, s.sel, s.ask, s.pick);
-export const panelStatusOf = (s) => panelStatus(s.view, s.phase, s.sel, s.ask, s.pick);
-export const panelAffordanceOf = (s) => panelAffordance(s.view, s.phase, s.sel, s.ask, s.pick);
+export const panelRowsOf = (s, W, maxRows) => panelBlockRows(s.view, s.phase, s.cursor, W, maxRows, s.ask, s.pick, s.note, s.safer);
+/**
+ * TUI2-R3v2 ② — the rows AND where the clickable ones are, from ONE
+ * call.
+ *
+ * The compositor needs both and must not compute the second from the
+ * first: the args cap, the note row and the option window all move the
+ * list, so a hit-test that re-derived the offset would drift from the
+ * picture exactly when the block is under pressure — which is when a
+ * misrouted click is most expensive.
+ *
+ * `options` is null for the ask and pick flavors: their rows are placed
+ * by their own renderers, and this round does not claim a click on them
+ * (the enable/disable invariant covers those surfaces; the gesture does
+ * not). A null here means every click is inert, which is the safe way
+ * to not-implement something.
+ */
+export const panelFrameOf = (s, W, maxRows) => {
+    if (s.view.pick !== undefined || s.view.ask !== undefined)
+        return { rows: panelRowsOf(s, W, maxRows), options: null };
+    const layout = panelBlockLayout(s.view, s.phase, s.cursor, W, maxRows, s.note, s.safer);
+    return {
+        rows: layout.rows,
+        options: layout.count === 0 ? null : { offset: layout.offset, count: layout.count, first: layout.first },
+    };
+};
+export const panelLeadOf = (s) => panelLead(s.view, s.phase, s.cursor, s.ask, s.pick);
+export const panelStatusOf = (s) => panelStatus(s.view, s.phase, s.cursor, s.ask, s.pick);
+export const panelAffordanceOf = (s) => panelAffordance(s.view, s.phase, s.cursor, s.ask, s.pick, s.safer);
 // ── the view: what the human reads when the model asks ────────────────
 /** The ask's PanelView. The dock-less fallback question is HONEST: a
  *  terminal without a panel cannot walk options, so it says the ask is

package/dist/compositor.d.ts

@@ -193,6 +193,13 @@ export declare class Body {
     /** Teardown — CSI r (the "no broken terminal" contract byte), the
      *  chrome rows cleared, the cursor home at the input line. */
     exit(): void;
+    /** TUI2-R3v2 ②: the panel's option rows as this frame placed them —
+     *  absolute, 1-based. The click hit-test's single source. */
+    panelOptionRows(): {
+        top: number;
+        count: number;
+        first: number;
+    } | null;
     /** SIGWINCH: clear the OLD live area (recorded geometry, ED only —
      *  zero LF, zero \x1b[3J — the shell history untouched), then the
      *  full-redraw path at the NEW geometry (O(height), zero replay).
@@ -257,6 +264,14 @@ export declare class Dock {
     enter(): void;
     exit(): void;
     onResize(): void;
+    /** TUI2-R3v2 ②: where the last frame put the panel's clickable option
+     *  rows (absolute screen rows). The editor binds this and does no row
+     *  arithmetic of its own. */
+    panelOptionRows(): {
+        top: number;
+        count: number;
+        first: number;
+    } | null;
     setStatus(text: string, hint?: string | null): void;
     setTail(tail: string): void;
     /** W21: bind the editor's panel state — the PanelSelect slot

package/dist/compositor.js

@@ -47,7 +47,8 @@ import { displayWidth } from "./editor.js";
 import { leadWidth } from "./width.js"; // W23: the ONE width authority (the editor, #inputRow, and editCol share it)
 // KC3.5: the panel-slot reads come from the DISPATCHERS — one source
 // for four reads, so an ask can never render half as an approval.
-import { panelAffordanceOf, panelLeadOf, panelRowsOf, panelStatusOf } from "./ask-panel.js";
+import { panelAffordanceOf, panelFrameOf, panelLeadOf, panelRowsOf, panelStatusOf } from "./ask-panel.js";
+import { MOUSE_OFF } from "./editor.js";
 import { atPanelRows, bandHeader } from "./at-picker.js";
 // TUI2-R2 ②: the session picker's rows — the band's third occupant.
 import { sessionPickerRows } from "./session-picker.js";
@@ -117,6 +118,9 @@ export class Body {
     #rolledHeads = new Set();
     #write;
     #resizeHandler = null;
+    /** TUI2-R3v2 ②: the panel option rows' absolute screen span, as of the
+     *  last frame. Null whenever no clickable list is on screen. */
+    #panelRowSpan = null;
     // the chrome state (the Dock façade)
     #status = "";
     #statusHint = null;
@@ -772,6 +776,20 @@ export class Body {
     /** Teardown — CSI r (the "no broken terminal" contract byte), the
      *  chrome rows cleared, the cursor home at the input line. */
     exit() {
+        // TUI2-R3v2 ②: the mouse disable rides the SAME teardown as CSI r,
+        // and rides it BEFORE the docked guard — an un-docked compositor is
+        // exactly the state a superseded or half-torn-down one is in, and
+        // that is when a leak survives. The editor disables it too; this is
+        // the second belt on the one contract the round calls blocker-class.
+        //
+        // TTY-GATED, and the gate is not a nicety. A pipe has no mouse mode
+        // to reset, so the bytes would be pure noise there — and the pipe
+        // path is byte-identical by ruling. The unguarded version put
+        // "[?1000l[?1006l" into piped stdout and four gates caught it
+        // (compact-cli, tui-modes, tui-v7-planmode, tui2-r2-resume-picker):
+        // the invariant is about terminals, and a pipe is not one.
+        if (process.stdout.isTTY === true)
+            this.#write(MOUSE_OFF);
         if (!this.#docked) {
             // TUI2-R2pre ③: an un-docked compositor can still hold a listener
             // (it was superseded, or enter() ran and the dock was torn down by
@@ -793,6 +811,11 @@ export class Body {
         out.push(`\x1b[${Math.max(1, H - 1)};1H`);
         this.#write(out.join(""));
     }
+    /** TUI2-R3v2 ②: the panel's option rows as this frame placed them —
+     *  absolute, 1-based. The click hit-test's single source. */
+    panelOptionRows() {
+        return this.#panelRowSpan;
+    }
     /** SIGWINCH: clear the OLD live area (recorded geometry, ED only —
      *  zero LF, zero \x1b[3J — the shell history untouched), then the
      *  full-redraw path at the NEW geometry (O(height), zero replay).
@@ -1051,6 +1074,10 @@ export class Body {
         const inputExtra = editor.rows.length - 1;
         const chromeRows = CHROME_ROWS + inputExtra + menuRows.length + queueRows.length;
         let liveLines = [];
+        // TUI2-R3v2 ②: where this frame put the panel's option rows, relative
+        // to the live region's top. Resolved to ABSOLUTE screen rows once
+        // liveTop is known, below.
+        let panelSpan = null;
         const panel = this.#panelState?.() ?? null;
         // TUI2-R1.5 ⑦(a) (VD-8): the sheet is an OVERLAY, and the frame it
         // opens on — and the one it closes on — take the full-redraw path.
@@ -1077,7 +1104,12 @@ export class Body {
             // the W11 blank would separate it from the frozen content).
             // The cap is exact, so the force-commit loop never fires. W22:
             // the queue band sits below the panel — the cap shrinks by it.
-            liveLines = panelRowsOf(panel, W, Math.max(1, H - 4 - inputExtra - queueRows.length));
+            // TUI2-R3v2 ②: the rows and the CLICKABLE span come from one
+            // call, so the hit-test reads the arithmetic that placed the
+            // rows rather than a second copy of it.
+            const frame = panelFrameOf(panel, W, Math.max(1, H - 4 - inputExtra - queueRows.length));
+            liveLines = frame.rows;
+            panelSpan = frame.options;
         }
         else {
             // TUI2-R2 ⑤ (D, candidate 1): the FOCUS — the cell the next ctrl+r
@@ -1126,6 +1158,11 @@ export class Body {
         //    shows the bottom H rows; the live region anchors to the bottom.
         const liveRowsTotal = liveLines.length + chromeRows;
         const liveTop = Math.min(this.#committedLines, H - liveRowsTotal) + 1;
+        // TUI2-R3v2 ②: the option rows' ABSOLUTE screen rows, recorded per
+        // frame. A click is answered against the frame the human was looking
+        // at when they clicked, which is this one.
+        this.#panelRowSpan =
+            panelSpan === null ? null : { top: liveTop + panelSpan.offset, count: panelSpan.count, first: panelSpan.first };
         // 5. the frame bytes.
         const out = [];
         out.push("\x1b[?2026h"); // synchronized output ON (DEC 2026)
@@ -1995,6 +2032,12 @@ export class Dock {
     onResize() {
         compositorRef?.onResize();
     }
+    /** TUI2-R3v2 ②: where the last frame put the panel's clickable option
+     *  rows (absolute screen rows). The editor binds this and does no row
+     *  arithmetic of its own. */
+    panelOptionRows() {
+        return compositorRef?.panelOptionRows() ?? null;
+    }
     setStatus(text, hint) {
         compositorRef?.setStatus(text, hint ?? null);
     }

package/dist/editor.d.ts

@@ -23,9 +23,20 @@
  */
 import { charWidth, displayWidth, widthOf } from "./width.js";
 export { charWidth, displayWidth, widthOf };
-import { type PanelState, type PanelVerdict, type PanelView } from "./approval-panel.js";
+import { type PanelState, type PanelVerdict, type PanelView, type SaferOption } from "./approval-panel.js";
 import { type AtItem, type AtMatch } from "./at-picker.js";
 import { type SessionCardView, type SessionPickState } from "./session-picker.js";
+/**
+ * TUI2-R3v2 ② — the mouse-mode bytes, stated once.
+ *
+ * ?1000 is the button-event report and ?1006 is the SGR encoding that
+ * makes it parseable past column 95 (the legacy X10 encoding packs the
+ * coordinate into one byte and simply breaks on a wide terminal). Both
+ * go on together and come off together; a terminal left with either one
+ * set is a terminal that prints escape bytes at the shell prompt.
+ */
+export declare const MOUSE_ON = "\u001B[?1000h\u001B[?1006h";
+export declare const MOUSE_OFF = "\u001B[?1000l\u001B[?1006l";
 export declare const PROMPT = "\u258C ";
 export declare const PROMPT_WIDTH: number;
 /** v3 §04 — the slash-command menu's command table (English one-liners). */
@@ -116,7 +127,9 @@ export declare class Editor {
     /** W21: open the approval panel. The current buffer is stashed
      *  (restored at close — commit AND cancel), the panel takes the
      *  keys and the input row's lead, the menu closes. */
-    beginPanel(view: PanelView, onCommit: (v: PanelVerdict) => void): void;
+    beginPanel(view: PanelView, onCommit: (v: PanelVerdict) => void, opts?: {
+        safer?: () => Promise<readonly SaferOption[] | null>;
+    }): void;
     /** W21: cancel the panel — the SIGINT path's pair to beginPanel. */
     cancelPanel(): void;
     /** W21: the compositor's bound view — the phase/selection while the
@@ -130,4 +143,14 @@ export declare class Editor {
     selfRender(): void;
     /** Feed raw stdin bytes — the parser. Public for unit tests. */
     feed(raw: Uint8Array): void;
+    /** TUI2-R3v2 ②: the compositor reports where it PUT the option rows.
+     *  The editor does no row arithmetic of its own — the surface that
+     *  placed them is the only thing that can say where they are, and a
+     *  second copy of that sum is how a hit-test comes to disagree with
+     *  the picture. */
+    bindPanelRows(fn: (() => {
+        top: number;
+        count: number;
+        first?: number;
+    } | null) | null): void;
 }

package/dist/editor.js

@@ -26,7 +26,7 @@ import { charWidth, displayWidth, leadWidth, widthOf } from "./width.js";
 // authority) — re-exported so the editor's public surface is unchanged.
 export { charWidth, displayWidth, widthOf };
 import { palette } from "./render.js";
-import { PICK_MAX } from "./approval-panel.js";
+import { PICK_MAX, panelOptions, SAFER_DEGRADED, } from "./approval-panel.js";
 // KC3.5: the panel-slot dispatchers — the ask branch folded into the
 // W21 lead/rows, so this file keeps ONE panel and one key owner.
 import { askCommitCustom, askKey, askStart, panelLead } from "./ask-panel.js";
@@ -38,6 +38,17 @@ import { sessionFilter } from "./session-picker.js";
 // TUI v4 #16d: the input row is the blue brick + the edit area — the
 // "you>" text is gone (the brick IS the prompt; the pipe path's readline
 // prompt keeps its own "you> " — v2a line mode, byte-for-byte).
+/**
+ * TUI2-R3v2 ② — the mouse-mode bytes, stated once.
+ *
+ * ?1000 is the button-event report and ?1006 is the SGR encoding that
+ * makes it parseable past column 95 (the legacy X10 encoding packs the
+ * coordinate into one byte and simply breaks on a wide terminal). Both
+ * go on together and come off together; a terminal left with either one
+ * set is a terminal that prints escape bytes at the shell prompt.
+ */
+export const MOUSE_ON = "\x1b[?1000h\x1b[?1006h";
+export const MOUSE_OFF = "\x1b[?1000l\x1b[?1006l";
 export const PROMPT = "▌ ";
 export const PROMPT_WIDTH = displayWidth(PROMPT);
 export const MENU_ITEMS = [
@@ -96,6 +107,18 @@ export class Editor {
     // user's next turn.
     #panel = null;
     #pasting = false;
+    /** TUI2-R3v2 ①: one-shot — a panel that just closed swallows the
+     *  habitual trailing enter rather than submitting the restored draft. */
+    #swallowEnter = false;
+    /** TUI2-R3v2 ②: whether SGR 1006 reporting is currently enabled. */
+    #mouseOn = false;
+    /** TUI2-R3v2 ③: the safer ask's generation. A panel the human escaped
+     *  must not be resurrected by a promise nobody is waiting for. */
+    #saferToken = 0;
+    /** TUI2-R3v2 ②: where the compositor put the panel's option rows this
+     *  frame (absolute 1-based screen rows). The editor owns no geometry —
+     *  it asks the surface that placed them. */
+    #panelRows = null;
     #lineCb = null;
     #pendingLines = []; // submits before onLine is wired (startup) — never dropped
     #sigintCb = null;
@@ -423,11 +446,13 @@ export class Editor {
         this.#atOpen = true;
         this.#atSel = 0;
         this.#atList = this.#atItems(); // §5: listed per OPEN, never per keystroke
+        this.#syncMouse();
     }
     #atClose() {
         this.#atOpen = false;
         this.#atSel = 0;
         this.#atList = null;
+        this.#syncMouse();
     }
     /**
      * KC3 §3 — accept: the token becomes `@<path> `.
@@ -470,6 +495,7 @@ export class Editor {
         this.#pickCards = cards;
         this.#pickCommit = onPick;
         this.#pickSel = 0;
+        this.#syncMouse();
         this.#chars = [];
         this.#cursor = 0;
         this.#reflow();
@@ -507,6 +533,7 @@ export class Editor {
         this.#pickCards = null;
         this.#pickCommit = null;
         this.#pickSel = 0;
+        this.#syncMouse();
         this.#chars = [];
         this.#cursor = 0;
         this.#reflow();
@@ -538,16 +565,18 @@ export class Editor {
     /** W21: open the approval panel. The current buffer is stashed
      *  (restored at close — commit AND cancel), the panel takes the
      *  keys and the input row's lead, the menu closes. */
-    beginPanel(view, onCommit) {
+    beginPanel(view, onCommit, opts) {
         this.#panel = {
             view,
             phase: "options",
-            sel: 0,
+            cursor: 0,
+            note: null,
+            safer: opts?.safer,
+            saferRun: null,
             ask: view.ask === undefined ? null : askStart(view.ask),
             // TUI2-R2 ④: the pick's walk — present exactly when the view is
             // a pick, the same contract the ask's runtime has.
             pick: view.pick === undefined ? null : { cursor: 0, phase: "options" },
-            amend: "yes",
             onCommit,
             stash: { chars: this.#chars, cursor: this.#cursor, scroll: this.#scroll },
         };
@@ -559,6 +588,7 @@ export class Editor {
         this.#menuSel = 0;
         this.#queuePopMode = false; // W22: the panel owns the keys while up
         this.#atClose(); // KC3 §3: and the picker closes with everything else
+        this.#syncMouse();
         this.#onRender();
     }
     /** W21: cancel the panel — the SIGINT path's pair to beginPanel. */
@@ -574,7 +604,9 @@ export class Editor {
         return {
             view: panel.view,
             phase: panel.phase,
-            sel: panel.sel,
+            cursor: panel.cursor,
+            ...(panel.note === null ? {} : { note: panel.note }),
+            ...(panel.saferRun === null ? {} : { safer: panel.saferRun }),
             ...(panel.ask === null ? {} : { ask: panel.ask }),
             ...(panel.pick === null ? {} : { pick: panel.pick }),
         };
@@ -584,6 +616,15 @@ export class Editor {
             return;
         this.#entered = true;
         process.stdin.setRawMode(true);
+        // TUI2-R3v2 ②: the DEFENSIVE reset, first byte out.
+        //
+        // Mouse reporting is process state the terminal keeps, not state we
+        // keep, so a previous kiso that died with a panel open (kill -9, a
+        // panic, a closed laptop) left the terminal reporting clicks to
+        // whatever ran next — and nothing in that dead process can ever
+        // clean up after it. A fresh process is the only thing left that
+        // can, so it does, unconditionally, before it draws anything.
+        process.stdout.write(MOUSE_OFF);
         process.stdout.write("\x1b[?2004h"); // bracketed paste ON
         process.stdin.on("data", this.#onData);
         this.#onRender();
@@ -593,10 +634,43 @@ export class Editor {
             return;
         this.#entered = false;
         process.stdin.off("data", this.#onData);
+        // TUI2-R3v2 ②: unconditional, and BEFORE raw mode goes away — a
+        // terminal left reporting mouse events prints escape bytes at the
+        // shell prompt on every click and every scroll, and the user's only
+        // fix is `reset`. The flag is not consulted: exit() is the last
+        // chance this process gets, and emitting six harmless bytes twice
+        // is not a cost worth reasoning about.
+        process.stdout.write(MOUSE_OFF);
+        this.#mouseOn = false;
         process.stdout.write("\x1b[?2004l"); // bracketed paste OFF
         process.stdin.setRawMode(false);
         this.#closedResolve();
     }
+    /**
+     * TUI2-R3v2 ② — mouse reporting follows the SELECTION SURFACES and
+     * nothing else.
+     *
+     * While it is on, the terminal's own text selection changes behaviour
+     * (shift+drag still selects on every terminal that matters, but plain
+     * drag-to-copy does not), so leaving it on for the whole session would
+     * tax every copy-paste in the product to pay for a gesture that only
+     * means something while a list is up. It goes on when one opens and
+     * off when it closes — and both calls are idempotent, because the
+     * surfaces nest (a panel can open over a picker) and the bytes must
+     * not depend on the order they unwind in.
+     */
+    #setMouse(on) {
+        if (this.#mouseOn === on)
+            return;
+        this.#mouseOn = on;
+        if (this.#entered)
+            process.stdout.write(on ? MOUSE_ON : MOUSE_OFF);
+    }
+    /** The surfaces that own a selection — the approval/ask/pick panel, the
+     *  session picker and the @ picker. Any one of them up = reporting on. */
+    #syncMouse() {
+        this.#setMouse(this.#panel !== null || this.#pickCards !== null || this.#atUp());
+    }
     /** The row's own render when the dock is inactive (a TTY without a
      *  real size): \r + clear + blue brick prompt + visible + cursor
      *  column. */
@@ -607,7 +681,7 @@ export class Editor {
         // W21: the panel's lead owns the row while up (the brick returns
         // when the panel closes).
         const panel = this.#panel;
-        const lead = panel !== null ? panelLead(panel.view, panel.phase, panel.sel, panel.ask ?? undefined) : `${p.bold}${PROMPT}${p.reset}`;
+        const lead = panel !== null ? panelLead(panel.view, panel.phase, panel.cursor, panel.ask ?? undefined) : `${p.bold}${PROMPT}${p.reset}`;
         // W23: the ONE width authority — leadWidth(lead), the ANSI-stripped
         // visible width (the styled panel lead / the styled brick measure
         // the same as their plain text — a lead can never measure
@@ -635,15 +709,25 @@ export class Editor {
         let i = 0;
         while (i < text.length) {
             const c = text[i];
+            // TUI2-R3v2 ①: the one-shot enter guard a just-closed panel arms
+            // (see #panelClose). It sits at the very top of the loop because
+            // the byte it must not let through is the FIRST byte after the
+            // close, and it disarms on anything else in the same breath.
+            if (this.#swallowEnter) {
+                this.#swallowEnter = false;
+                if (this.#panel === null && (c === "\x0d" || c === "\x0a")) {
+                    i += 1;
+                    continue;
+                }
+            }
             if (this.#panel !== null) {
-                // W21: the panel owns the keys — the digits/y/n select in
-                // the options phase (digit 2 jumps to the rule input), tab
-                // opens the amend (approval only), esc backs out (rule/
-                // amend → options, selection → rest, rest → cancel), enter
-                // commits by phase. CSI/SS3 and the editing keys still ride
-                // the normal chain below (the rule/amend lines are free
-                // text); ctrl-c still rides the SIGINT handler (which
-                // cancels the panel).
+                // W21: the panel owns the keys — a digit CONFIRMS its row in
+                // the options phase, tab opens the amend (approval only), esc
+                // backs out (amend → options, options → cancel), enter takes
+                // the highlighted row. CSI/SS3 and the editing keys still ride
+                // the normal chain below (the amend line is free text);
+                // ctrl-c still rides the SIGINT handler (which cancels the
+                // panel).
                 const panel = this.#panel;
                 // KC3.5: an ASK panel routes its own keys — the digits pick
                 // (single-select advances, multi toggles), space toggles at
@@ -738,46 +822,76 @@ export class Editor {
                     i += 1;
                     continue;
                 }
-                // TUI2-R2 ⑧ — the shortcut keys belong to the OPTIONS phase and
-                // to it alone.
+                // TUI2-R3v2 ③: the safer list answers the SAME keys the approval
+                // list does — one interaction model means the new surface is not
+                // an exception to it. A digit takes its row (the way back
+                // included, as the last one).
+                if (panel.phase === "safer" && c !== undefined && c >= "1" && c <= "9") {
+                    this.#saferConfirm(Number(c) - 1);
+                    i += 1;
+                    continue;
+                }
+                // while the ask is in flight the panel owns every printable key
+                // and answers to none of them — esc (above) is the only gesture
+                // with a meaning, and a stray letter must not reach the composer.
+                if (panel.phase === "asking" && c !== undefined && c >= " " && c !== "\x7f") {
+                    i += 1;
+                    continue;
+                }
+                // TUI2-R3v2 ① — the digit CONFIRMS, and it confirms on the
+                // keypress.
+                //
+                // The retired model made a digit a selection and Enter the
+                // commit, which meant the fastest path through an approval was
+                // two keys and the hint line had to teach both. The list makes
+                // the digit redundant as a selector — the bar is already showing
+                // what is selected — so the digit becomes what a human pressing
+                // a number on a numbered list means by it: THAT one.
+                //
+                // A digit past the list is INERT (the R2 pick panel's rule,
+                // inherited whole): an option nobody has is never taken, and a
+                // mistyped 7 must not fall through to the composer underneath.
                 //
-                // `1`/`y` select yes and `3`/`n` select no, and they used to be
-                // applied in every phase of every flavour: the `i += 1;
-                // continue;` sat OUTSIDE the phase check, so a phase where the
-                // key meant nothing swallowed it anyway. A phase where a letter
-                // means nothing is exactly a phase where a human is typing
-                // prose — so every y, n, 1 and 3 vanished from the line,
-                // silently, with no error and no visible cause. "yes, run it
-                // now 13" committed as "es, ru it ow ".
+                // The guard is the options phase and nothing else. The typed
+                // phase is prose — that is the R2 slice-⑧ finding, and it is
+                // why this branch sits below the enter/esc/tab handlers and
+                // above nothing at all: "yes, run 13 of them" keeps its digits.
+                if (panel.phase === "options" && panel.ask === null && panel.pick === null && c !== undefined && c >= "1" && c <= "9") {
+                    this.#panelConfirm(Number(c) - 1);
+                    i += 1;
+                    continue;
+                }
+                // TUI2-R2 ⑧, carried forward — the shortcut keys belong to the
+                // OPTIONS phase and to it alone.
                 //
-                // Three typed phases were affected: the ask's custom answer,
-                // the approval panel's rule input, and its amend/feedback line.
-                // The rule input is the one that mattered most — it writes a
-                // DURABLE don't-ask-again rule, so a dropped character persists
-                // a rule the human never typed.
+                // `y`/`n` used to be applied in every phase of every flavour:
+                // the `i += 1; continue;` sat OUTSIDE the phase check, so a
+                // phase where the key meant nothing swallowed it anyway — and a
+                // phase where a letter means nothing is exactly a phase where a
+                // human is typing prose. Every y and n vanished from the line,
+                // silently. "yes, run it now" committed as "es, ru it ow".
                 //
-                // Slice ④ met the same mechanism on the new pick panel
-                // ("openai/deepseek-reasoner" -> "opeai/deepseek-reasoer") and
-                // guarded pick alone, because the rest was a behaviour change
-                // owed its own red. This is that guard, stated once for every
-                // flavour: the options phase keeps its keys, and every typed
-                // phase keeps its text.
+                // The guard survives the migration unchanged in spirit and
+                // simpler in fact: there is now ONE typed phase instead of
+                // three, and the letters reach only the list.
+                //
+                // The letters stay because they are the two answers this panel
+                // has always taken and a decade of muscle memory types them.
+                // They are ALIASES for rows, not a second model: `y` is the
+                // first option, `n` is the last, and on an approval the last
+                // option opens the composer — so the old "n then enter" still
+                // lands the same bare denial it always did.
                 const optionsPhase = panel.pick === null && // a pick has no yes and no no
-                    panel.phase === "options" && // the rule / amend lines are prose
+                    panel.phase === "options" && // the amend line is prose
                     (panel.ask === null || panel.ask.phase === "options"); // and so is a typed ask answer
-                if (optionsPhase) {
-                    if (c === "1" || c === "y" || c === "Y") {
-                        this.#panelSelect(1);
-                        i += 1;
-                        continue;
-                    }
-                    if (c === "2" && panel.view.flavor === "approval") {
-                        this.#panelRule();
+                if (optionsPhase && panel.ask === null) {
+                    if (c === "y" || c === "Y") {
+                        this.#panelConfirm(0);
                         i += 1;
                         continue;
                     }
-                    if (c === "3" || c === "n" || c === "N") {
-                        this.#panelSelect(3);
+                    if (c === "n" || c === "N") {
+                        this.#panelConfirm(panelOptions(panel.view).length - 1);
                         i += 1;
                         continue;
                     }
@@ -786,7 +900,17 @@ export class Editor {
             if (c === "\x1b") {
                 const rest = text.slice(i + 1);
                 if (rest.startsWith("[")) {
-                    const m = rest.match(/^\[([0-9;?]*)([A-Za-z~])/);
+                    // TUI2-R3v2 ②: `<` joins the parameter class.
+                    //
+                    // An SGR 1006 mouse report is `\x1b[<0;COL;ROWM`, and the
+                    // retired character class ([0-9;?]) did not contain `<`. The
+                    // match failed, the branch below PARKED the whole thing as an
+                    // incomplete CSI, and #pending grew forever: every keystroke
+                    // after the first click was appended to a sequence that could
+                    // never complete. The editor went deaf. It never happened
+                    // because nothing ever enabled reporting — which is exactly
+                    // the kind of latent break turning a feature on discovers.
+                    const m = rest.match(/^\[([0-9;?<]*)([A-Za-z~])/);
                     if (m === null) {
                         this.#pending = text.slice(i); // incomplete CSI — wait for more
                         break;
@@ -968,7 +1092,58 @@ export class Editor {
             }
         }
     }
+    /**
+     * TUI2-R3v2 ② — one gesture, and only one: a plain LEFT PRESS on an
+     * option row is that row's digit.
+     *
+     * Everything else is dropped, and the list of everything else is the
+     * point. A release (`m`) is not a second click. Button 64/65 is the
+     * wheel — scrolling past a panel must not answer it. Bit 32 is a
+     * motion report, so a drag over the list is a drag, not four
+     * approvals. Buttons 1 and 2 are middle and right, which mean paste
+     * and context-menu everywhere else and would mean "approve" here.
+     * The stakes are a side effect the human did not ask for, and an
+     * ambiguous mouse event is not consent.
+     */
+    #mouseEvent(params, press) {
+        if (!press)
+            return; // the press already decided; the release is noise
+        const [button, , row] = params.slice(1).split(";").map(Number);
+        if (button !== 0)
+            return; // wheel (64/65), motion (32+), middle/right
+        // TUI2-R3v2 ③: a click works on BOTH lists — one interaction model
+        // means the safer alternatives are clickable for the same reason the
+        // original choices are.
+        if (this.#panel === null || (this.#panel.phase !== "options" && this.#panel.phase !== "safer"))
+            return;
+        const span = this.#panelRows?.();
+        if (span == null || row === undefined || !Number.isFinite(row))
+            return;
+        const offset = row - span.top;
+        if (offset < 0 || offset >= span.count)
+            return; // outside the list — inert
+        if (this.#panel.phase === "safer")
+            this.#saferConfirm(offset);
+        else
+            this.#panelConfirm((span.first ?? 0) + offset);
+    }
+    /** TUI2-R3v2 ②: the compositor reports where it PUT the option rows.
+     *  The editor does no row arithmetic of its own — the surface that
+     *  placed them is the only thing that can say where they are, and a
+     *  second copy of that sum is how a hit-test comes to disagree with
+     *  the picture. */
+    bindPanelRows(fn) {
+        this.#panelRows = fn;
+    }
     #csi(params, final) {
+        // TUI2-R3v2 ②: an SGR 1006 report — `\x1b[<b;col;rowM` (press) or
+        // `...m` (release). It is routed FIRST because a `<` parameter is
+        // never anything else, and because a mouse byte must never fall
+        // through to a key handler.
+        if (params.startsWith("<")) {
+            this.#mouseEvent(params, final === "M");
+            return;
+        }
         // KC1 §4 — Shift+Enter WHERE THE TERMINAL ENCODES IT: kitty's
         // CSI-u (ESC [ 13;2 u) and xterm's modifyOtherKeys (ESC [ 27;2;13 ~).
         // Never claimed universal — Ctrl+J is the everywhere baseline; a
@@ -1020,6 +1195,16 @@ export class Editor {
                 }
                 else if (this.#panel.ask !== null && this.#panel.ask.phase === "options")
                     this.#askStep(final === "A" ? "up" : "down");
+                // TUI2-R3v2 ①: the approval/simple panel joins them. It was the
+                // one panel flavour with no ↑↓ role, because it had no cursor to
+                // move; it has one now, and the gesture is the same one the
+                // pick, the ask, the session picker and the @ picker already
+                // answer to. ONE interaction model is the round's acceptance
+                // criterion, and this branch is where it stops being four.
+                else if (this.#panel.phase === "safer")
+                    this.#saferMove(final === "A" ? -1 : 1);
+                else if (this.#panel.phase !== "asking")
+                    this.#panelMove(final === "A" ? -1 : 1);
             }
             else if (this.#pickUp()) {
                 // TUI2-R2 ②: the session picker owns ↑↓ while up — the
@@ -1103,35 +1288,159 @@ export class Editor {
         this.#reflow();
         this.#verticalGoalCol = goal; // the walk re-arms it (the reflow's reset is for every OTHER key)
     }
-    // ---- W21: the panel state machine ----
-    #panelSelect(sel) {
+    // ---- W21 / TUI2-R3v2 ①: the panel state machine ----
+    /** ↑↓ — the bar walks the list and STOPS at both ends. A list that
+     *  wraps makes the fastest gesture (hold ↓ to reach the bottom) into
+     *  a gamble about where you landed, and the bottom option here is the
+     *  denial. */
+    #panelMove(delta) {
         const panel = this.#panel;
-        if (panel === null)
+        if (panel === null || panel.phase !== "options")
             return;
-        panel.sel = sel;
+        const n = panelOptions(panel.view).length;
+        panel.cursor = Math.max(0, Math.min(n - 1, panel.cursor + delta));
         this.#onRender();
     }
-    /** digit 2 — the rule input: the buffer prefilled with the tool name
-     *  (the option-2 prefill; enter commits the rule). */
-    #panelRule() {
+    /**
+     * Take the option at `index` — the ONE place a panel choice resolves,
+     * whether the human pressed a digit, pressed ⏎ on the bar, typed the
+     * y/n alias, or clicked the row (slice ②). Four gestures, one branch:
+     * a click cannot mean something a digit does not.
+     *
+     * Every kind but `deny` on an approval resolves IMMEDIATELY. That is
+     * the round's whole claim — the durable rule included, because the
+     * rule the machinery supports is exactly "this tool", and asking the
+     * human to confirm a value they cannot change was the old model's
+     * ceremony, not a safeguard.
+     */
+    #panelConfirm(index) {
+        const panel = this.#panel;
+        if (panel === null || panel.phase !== "options")
+            return;
+        const options = panelOptions(panel.view);
+        const option = options[index];
+        if (option === undefined)
+            return; // a digit past the list is inert
+        panel.cursor = index;
+        switch (option.kind) {
+            case "allow":
+                this.#panelClose({ action: "allow", reason: "" });
+                return;
+            case "rule":
+                this.#panelClose({ action: "allow-rule", rule: panel.view.name });
+                return;
+            case "safer":
+                this.#panelSafer();
+                return;
+            case "deny":
+                // the approval flavor's denial is "let me tell it what to do
+                // instead", so it opens the composer; the simple flavors have
+                // nothing to tell anyone and resolve on the spot.
+                if (panel.view.flavor === "approval")
+                    this.#panelAmend();
+                else
+                    this.#panelClose({ action: "deny", reason: "" });
+                return;
+        }
+    }
+    /**
+     * Option 3 — "show me safer ways to do this".
+     *
+     * The round's ONE new model request, and every branch here exists to
+     * keep it honest.
+     *
+     * It fires ONLY from this method, which only this option reaches —
+     * that is the entire mechanism behind the zero-ambient-rent claim,
+     * and it is why the claim is checkable rather than asserted: a
+     * session that never presses 3 never enters this branch, and the
+     * trace shows no side-query line.
+     *
+     * The in-flight phase is VISIBLE because this is a network call: a
+     * button that goes quiet for two seconds reads as broken, and the
+     * human is standing in front of a paused run.
+     *
+     * Every failure — a throw, a null, an empty list, no provider bound
+     * at all — lands on the SAME honest line and puts back every original
+     * choice. There is deliberately no retry and no partial state: the
+     * alternative to "I could not get them" is either a lie or a spinner
+     * that never ends, and both are worse than the sentence.
+     *
+     * The generation token is the guard against a late answer: a panel
+     * the human escaped (or that a SIGINT cancelled) must not be
+     * resurrected two seconds later by a promise nobody is waiting for.
+     */
+    #panelSafer() {
         const panel = this.#panel;
         if (panel === null)
             return;
-        panel.phase = "rule";
-        panel.sel = 2;
-        this.#chars = [...panel.view.name].map((ch) => ch.codePointAt(0));
-        this.#cursor = this.#chars.length;
-        this.#scroll = 0;
-        this.#verticalGoalCol = null;
+        const ask = panel.safer;
+        panel.phase = "asking";
+        panel.note = null;
+        this.#onRender();
+        const token = ++this.#saferToken;
+        const settle = (options) => {
+            // the panel that asked must still be the panel on screen
+            if (this.#panel !== panel || token !== this.#saferToken)
+                return;
+            if (options === null || options.length === 0) {
+                panel.phase = "options";
+                panel.note = SAFER_DEGRADED;
+                panel.cursor = 0;
+                this.#onRender();
+                return;
+            }
+            panel.phase = "safer";
+            panel.saferRun = { options, cursor: 0 };
+            this.#onRender();
+        };
+        if (ask === undefined) {
+            settle(null); // no provider bound — the button says so rather than lying
+            return;
+        }
+        void Promise.resolve()
+            .then(ask)
+            .then(settle)
+            .catch(() => settle(null));
+    }
+    /** Take a row of the SAFER list. The alternatives route through the
+     *  EXISTING amend channel — choosing a safer command is a denial with
+     *  instructions, which is a verdict the product already has; the last
+     *  row is the way back and decides nothing. */
+    #saferConfirm(index) {
+        const panel = this.#panel;
+        if (panel === null || panel.saferRun === null)
+            return;
+        const { options } = panel.saferRun;
+        if (index === options.length) {
+            // "back to the original choices"
+            panel.phase = "options";
+            panel.saferRun = null;
+            panel.cursor = 0;
+            this.#onRender();
+            return;
+        }
+        const chosen = options[index];
+        if (chosen === undefined)
+            return; // past the list — inert
+        this.#panelClose({ action: "deny", reason: `run this instead: ${chosen.command}` });
+    }
+    /** ↑↓ inside the safer list — the way back is its last row, so the
+     *  bar reaches it like any other. */
+    #saferMove(delta) {
+        const panel = this.#panel;
+        if (panel === null || panel.saferRun === null)
+            return;
+        const last = panel.saferRun.options.length; // + the way-back row
+        panel.saferRun = { options: panel.saferRun.options, cursor: Math.max(0, Math.min(last, panel.saferRun.cursor + delta)) };
         this.#onRender();
     }
-    /** tab — the amend phase on the selected option (yes/deny); the
-     *  simple flavor never has it (options 1/3 only, no option 2). */
-    #panelTab() {
+    /** The typed phase — the one place the panel takes prose. The buffer
+     *  starts empty and the cursor stays where the human left it, so esc
+     *  can put the bar back exactly where it was. */
+    #panelAmend() {
         const panel = this.#panel;
-        if (panel === null || panel.view.flavor !== "approval")
+        if (panel === null)
             return;
-        panel.amend = panel.sel === 3 ? "no" : "yes";
         panel.phase = "amend";
         this.#chars = [];
         this.#cursor = 0;
@@ -1139,15 +1448,39 @@ export class Editor {
         this.#verticalGoalCol = null;
         this.#onRender();
     }
-    /** esc — back out of the rule/amend to the options (the buffer
-     *  clears), deselect, or cancel the panel at rest. */
+    /** tab — the amend alias, unchanged as a GESTURE: it opens the same
+     *  typed phase the last option does, from anywhere in the list. The
+     *  simple flavors never had it and still do not. */
+    #panelTab() {
+        const panel = this.#panel;
+        if (panel === null || panel.view.flavor !== "approval")
+            return;
+        panel.cursor = panelOptions(panel.view).length - 1;
+        this.#panelAmend();
+    }
+    /** esc — back out of the typed phase to the list (the buffer clears,
+     *  the bar stays on the option that opened it), or cancel the panel.
+     *  The old model had a third step, the deselect, because a selection
+     *  could be "none"; a list always has a selection, so esc from the
+     *  list means what it means everywhere else in the product. */
     #panelEsc() {
         const panel = this.#panel;
         if (panel === null)
             return;
+        // TUI2-R3v2 ③: esc out of the safer list — or out of the ask while
+        // it is still in flight — returns to the original choices, exactly
+        // as the way-back row does. The in-flight answer is orphaned by the
+        // generation token; nothing it does can reopen this list.
+        if (panel.phase === "safer" || panel.phase === "asking") {
+            this.#saferToken += 1;
+            panel.phase = "options";
+            panel.saferRun = null;
+            panel.cursor = 0;
+            this.#onRender();
+            return;
+        }
         if (panel.phase !== "options") {
             panel.phase = "options";
-            panel.sel = 0;
             this.#chars = [];
             this.#cursor = 0;
             this.#scroll = 0;
@@ -1155,36 +1488,40 @@ export class Editor {
             this.#onRender();
             return;
         }
-        if (panel.sel !== 0) {
-            panel.sel = 0;
-            this.#onRender();
-            return;
-        }
         this.#panelClose({ action: "cancel" });
     }
-    /** enter — commit by phase: the rule input (the tool name when
-     *  empty), the amend feedback (the bare verdict when empty), or the
-     *  selected option (nothing at rest — an accidental enter never
-     *  approves). Enter on the selected option 2 is the digit-2 key. */
+    /**
+     * enter — send the typed note, or TAKE THE HIGHLIGHTED OPTION.
+     *
+     * The second half is the round. The retired model's enter-at-rest did
+     * nothing at all, on the theory that an accidental return must never
+     * approve; what it actually produced was a panel that ignored the key
+     * every human presses first. The safeguard is real but it belongs on
+     * WHERE THE BAR STARTS, not on whether the key works: the bar opens on
+     * the option whose blast radius is one tool call the human is looking
+     * at, and every irreversible-er choice is a deliberate ↑↓ away.
+     *
+     * An empty note in the typed phase is the bare denial — the W21
+     * mapping, untouched: no words means the run aborts, words mean the
+     * model gets them and proposes a new call.
+     */
     #panelEnter() {
         const panel = this.#panel;
         if (panel === null)
             return;
-        const line = this.line();
-        if (panel.phase === "rule") {
-            this.#panelClose({ action: "allow-rule", rule: line === "" ? panel.view.name : line });
+        if (panel.phase === "amend") {
+            this.#panelClose({ action: "deny", reason: this.line() });
             return;
         }
-        if (panel.phase === "amend") {
-            this.#panelClose(panel.amend === "yes" ? { action: "allow", reason: line } : { action: "deny", reason: line });
+        // TUI2-R3v2 ③: in the safer list, enter takes the highlighted
+        // alternative — the same gesture, one surface over.
+        if (panel.phase === "safer" && panel.saferRun !== null) {
+            this.#saferConfirm(panel.saferRun.cursor);
             return;
         }
-        if (panel.sel === 1)
-            this.#panelClose({ action: "allow", reason: "" });
-        else if (panel.sel === 2)
-            this.#panelRule();
-        else if (panel.sel === 3)
-            this.#panelClose({ action: "deny", reason: "" });
+        if (panel.phase === "asking")
+            return; // nothing to confirm yet
+        this.#panelConfirm(panel.cursor);
     }
     /**
      * KC3.5 — one ask key: the pure reducer decides, this method applies.
@@ -1272,8 +1609,22 @@ export class Editor {
         if (panel === null)
             return;
         this.#panel = null;
-        // the pre-panel buffer returns — the panel's rule/feedback text
-        // never leaks into the user's next turn (commit AND cancel).
+        this.#syncMouse();
+        // TUI2-R3v2 ①: swallow ONE bare enter after the panel goes away.
+        //
+        // This is the hazard the instant confirm creates and it is not
+        // hypothetical: "y⏎" and "1⏎" are what a decade of y/n prompts
+        // taught everyone's fingers, and the panel used to need both bytes.
+        // It needs one now — so the second one lands in a composer that has
+        // just had the user's PRE-PANEL DRAFT restored into it, and submits
+        // it. Answering an approval would send a half-written message.
+        //
+        // The guard is one-shot and expires on any other key, so it can
+        // never eat an enter the user meant: by the time they have typed
+        // anything at all, it is gone.
+        this.#swallowEnter = true;
+        // the pre-panel buffer returns — the panel's amend text never leaks
+        // into the user's next turn (commit AND cancel).
         this.#chars = [...panel.stash.chars];
         this.#cursor = panel.stash.cursor;
         this.#scroll = panel.stash.scroll;
@@ -1523,7 +1874,7 @@ export class Editor {
         // W23: the ONE width authority — leadWidth(lead) — the cap follows
         // the lead the editor itself renders (the panel lead when the panel
         // owns the keys, the brick otherwise): maxW = W − walls − lead.
-        const lead = this.#panel !== null ? panelLead(this.#panel.view, this.#panel.phase, this.#panel.sel, this.#panel.ask ?? undefined) : PROMPT;
+        const lead = this.#panel !== null ? panelLead(this.#panel.view, this.#panel.phase, this.#panel.cursor, this.#panel.ask ?? undefined) : PROMPT;
         const leadW = leadWidth(lead);
         const maxW = Math.max(1, W - leadW - 4); // W6: the box's walls (2+2) — the visible line fits the box's inner width; the "…" rides inside
         // KC1: the scroll is the CURSOR LINE's own offset — a single-line

package/dist/index.d.ts

@@ -1,12 +1,13 @@
 /**
  * kiso-tui — the PURE terminal layer, extracted from the CLI (the
- * ADR-0041 escape hatch). Zero runtime dependencies: input is data,
+ * escape hatch of ADR-0043, which supersedes ADR-0041). Zero runtime
+ * dependencies: input is data,
  * output is bytes. TUI v6 (ADR-0046): the ONE compositor (the single
  * writer — body.ts + dock.ts retired), the component tree, the raw-mode
  * editor, the diff renderer, and the palette.
  */
 export { Body, Dock, CURSOR_MARKER, type BodyOptions } from "./compositor.js";
-export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, PICK_MAX, modelPickView, pickAffordance, pickBlockRows, pickLeadPlain, type PickOption, type PickResult, type PickRuntime, type PickSpec, type PanelArgs, type PanelFlavor, type PanelPhase, type PanelSel, type PanelState, type PanelVerdict, type PanelView, } from "./approval-panel.js";
+export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, PICK_MAX, modelPickView, pickAffordance, pickBlockRows, pickLeadPlain, type PickOption, type PickResult, type PickRuntime, type PickSpec, type PanelArgs, type PanelFlavor, type PanelPhase, deletionRiskHint, SAFER_BACK, SAFER_DEGRADED, type SaferOption, type SaferRuntime, panelOptions, type PanelOption, type PanelOptionKind, type PanelState, type PanelVerdict, type PanelView, } from "./approval-panel.js";
 export { Container, foldLine, foldWords, visibleWidth, SPINNER, type Component, type FrameCtx } from "./components.js";
 export { Editor, MENU_ITEMS, PROMPT, PROMPT_WIDTH, displayWidth, charWidth, widthOf, type MenuItem, } from "./editor.js";
 export { bannerLines, COLOR_OFF, COLOR_ON, escapeTerminal, foldResult, foldThinking, kUnit, palette, renderEvent, renderRecap, renderResumeList, renderSessionLine, renderStatusLine, relativeTime, renderTerminalGap, renderToolSummary, TAGLINE, toolTarget, truncateRow, type Palette, type PathResolver, type RecapStats, type ResumeMeta, type RenderInput, type RenderResult, type RunUsage, } from "./render.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 /**
  * kiso-tui — the PURE terminal layer, extracted from the CLI (the
- * ADR-0041 escape hatch). Zero runtime dependencies: input is data,
+ * escape hatch of ADR-0043, which supersedes ADR-0041). Zero runtime
+ * dependencies: input is data,
  * output is bytes. TUI v6 (ADR-0046): the ONE compositor (the single
  * writer — body.ts + dock.ts retired), the component tree, the raw-mode
  * editor, the diff renderer, and the palette.
@@ -11,7 +12,7 @@ export { Body, Dock, CURSOR_MARKER } from "./compositor.js";
 // approval is pending (the shape authority is the committed preview).
 export { panelAffordance, panelBlockRows, panelLead, panelLeadPlain, panelLeadWidth, panelStatus, 
 // TUI2-R2 ④: the pick payload — the panel slot's third occupant.
-PICK_MAX, modelPickView, pickAffordance, pickBlockRows, pickLeadPlain, } from "./approval-panel.js";
+PICK_MAX, modelPickView, pickAffordance, pickBlockRows, pickLeadPlain, deletionRiskHint, SAFER_BACK, SAFER_DEGRADED, panelOptions, } from "./approval-panel.js";
 export { Container, foldLine, foldWords, visibleWidth, SPINNER } from "./components.js";
 export { Editor, MENU_ITEMS, PROMPT, PROMPT_WIDTH, displayWidth, charWidth, widthOf, } from "./editor.js";
 export { bannerLines, COLOR_OFF, COLOR_ON, escapeTerminal, foldResult, foldThinking, kUnit, palette, renderEvent, renderRecap, renderResumeList, renderSessionLine, renderStatusLine, relativeTime, renderTerminalGap, renderToolSummary, TAGLINE, toolTarget, truncateRow, } from "./render.js";

package/dist/status.d.ts

@@ -1,6 +1,8 @@
 /**
  * KC2 §5 — the status line's FORMATTERS, extracted from the CLI (the
- * ADR-0041 escape hatch: extraction, never a fifth raise). The split is
+ * escape hatch of ADR-0043, which supersedes ADR-0041 — this comment
+ * cited the superseded ADR as current AND repeated its retired "never a
+ * fifth raise" promise; ADR-0043 governs the ceiling now). The split is
  * the one the ADR names: the CLI keeps the STATE (the rotating glyph,
  * the run's start instant, the live usage, whether the dock is up) and
  * the REPAINT; what a status row SAYS is presentation, and presentation

package/dist/status.js

@@ -1,6 +1,8 @@
 /**
  * KC2 §5 — the status line's FORMATTERS, extracted from the CLI (the
- * ADR-0041 escape hatch: extraction, never a fifth raise). The split is
+ * escape hatch of ADR-0043, which supersedes ADR-0041 — this comment
+ * cited the superseded ADR as current AND repeated its retired "never a
+ * fifth raise" promise; ADR-0043 governs the ceiling now). The split is
  * the one the ADR names: the CLI keeps the STATE (the rotating glyph,
  * the run's start instant, the live usage, whether the dock is up) and
  * the REPAINT; what a status row SAYS is presentation, and presentation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-tui",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "kiso tui — the pure terminal layer (cell renderer, dock, raw editor, diff, palette). Zero runtime dependencies: input is data, output is bytes.",
   "type": "module",
   "license": "MIT",
@@ -35,6 +35,6 @@
   },
   "homepage": "https://github.com/vincemakes/kiso/tree/main/packages/tui#readme",
   "dependencies": {
-    "@vincemakes/kiso-tui-cells": "0.11.0"
+    "@vincemakes/kiso-tui-cells": "0.12.0"
   }
 }