amicus 4.3.0 → 4.4.1

package/electron/workspace-ui/live-model.js

@@ -0,0 +1,112 @@
+/**
+ * Council Workspace — pure renderer-side view logic (poll cadence, seat row
+ * cells, blind default). No DOM here: node-tested via the module guard.
+ * TERMINAL_STATUSES mirrors src/workspace/run-detail.js (the renderer cannot
+ * require across the sandbox; keep the two lists in sync).
+ */
+(function () {
+  'use strict';
+
+  // ⚠️ DE-ROT (F26): was a 5-name list — missing 'crashed' and 'idle-timeout', so a crashed
+  // or idle-timed-out run would poll forever and never flip to its terminal rendering.
+  // Must stay byte-identical to src/workspace/run-detail.js TERMINAL_STATUSES, which itself
+  // mirrors the shipped src/observe/live-doc.js TERMINAL set. A drift pin asserts this.
+  // ⚠️ v4.4.1 A1: 'timed-out' added alongside 'timeout'. Both spellings are real and are written
+  // by different producers — see src/observe/live-doc.js:18. Inert for the workspace (a council
+  // run.json's status vocabulary is aborted|complete|error|partial), carried for byte-identity.
+  var TERMINAL_STATUSES = ['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'timed-out', 'idle-timeout'];
+
+  // ⚠️ DE-ROT (F41): STAGE_LABELS must be mirrored here too. The live loop labels stages that
+  // START AFTER the run was opened, and those names are absent from the frozen derived.stageRail,
+  // so without this table every post-open stage renders its raw name ("tally-final", "debate-revote").
+  var STAGE_LABELS = {
+    stage1: 'Stage 1 — independent review',
+    stage2: 'Stage 2 — peer cross-review',
+    'debate-defense': 'Debate — defense',
+    'debate-revote': 'Debate — re-vote',
+    'tally-provisional': 'Tally (provisional)',
+    tally: 'Tally',
+    'tally-final': 'Tally (final)',
+    chair: 'Chair synthesis',
+    verdict: 'Verdict',
+  };
+
+  /** Poll cadence per spec §4.3: 1.5s visible+focused, 5s otherwise, stop at terminal. */
+  function pollDelay(state) {
+    if (state.terminal) { return null; }
+    return (state.visible && state.focused) ? 1500 : 5000;
+  }
+
+  /** Blind default per spec resolved Q2: ON live, OFF terminal. */
+  function defaultBlind(status) {
+    return TERMINAL_STATUSES.indexOf(status) === -1;
+  }
+
+  function dash(v) {
+    return (v === null || v === undefined || v === '') ? '—' : String(v);
+  }
+
+  /**
+   * Display cells for one seat row, in the seats-table column order:
+   * [name, role, status, stage, msgs, tokens in/out, cost, last activity, stalled]
+   */
+  function seatCells(seat, blindOn, labelOf) {
+    // ⚠️ DE-ROT (F36): key the lookup on the council ALIAS, never on `seat.model`. labelMap's
+    // values are aliases; a LIVE leg's `model` is the resolved executable id, so labelOf(model)
+    // misses and Blind ON renders the real model. `modelInput` is the alias Task 0.5 stamps per
+    // leg (terminal rows from runStats are already alias-only, so the fallback is exact there).
+    var alias = seat.modelInput || seat.model;
+    var label = labelOf ? labelOf(alias) : null;
+    // ⚠️ v4.4.1 RN-9: this hand-rolled flip is LOAD-BEARING — do NOT "fix" it into
+    // AmicusRender.display({model: seat.model, label: label}, blindOn). The other two copies
+    // (workspace-panels.js's review/judge titles) were routed through display() because their
+    // pair's `model` IS the identity they must print. Here it is not: the seat's printable
+    // identity is the council ALIAS resolved on the line above (F36 — a live leg's `seat.model`
+    // is the RESOLVED executable id, e.g. `google/gemini-2.5-pro`, which labelMap never keys on),
+    // so display()'s blind-OFF arm would print the resolved id and undo F36. This module is also
+    // node-tested with NO DOM and no window.AmicusRender to call. Deliberate third copy.
+    var name = blindOn && label ? label : alias;
+    var tokens = (seat.tokensIn === null || seat.tokensIn === undefined) &&
+                 (seat.tokensOut === null || seat.tokensOut === undefined)
+      ? '—'
+      : dash(seat.tokensIn) + '/' + dash(seat.tokensOut);
+    return [
+      dash(name),
+      dash(seat.role),
+      dash(seat.status),
+      dash(seat.stage),
+      dash(seat.messages),
+      tokens,
+      dash(seat.costDisplay),
+      // ⚠️ DE-ROT (F35): pass-through of an ISO timestamp, NOT a relative string. renderSeats
+      // formats it with relTime() before calling in — live-model.js is node-tested and loads
+      // before workspace-render.js, so it cannot reach relTime itself.
+      dash(seat.lastActivity),
+      seat.stalled ? '⏳ stalled' : '',
+    ];
+  }
+
+  /** Terminal fallback: derive seat-shaped rows from tally runStats cost rows. */
+  function seatsFromRunStats(costRows) {
+    return (costRows || []).map(function (r) {
+      return {
+        // ⚠️ DE-ROT (F37): composite id — a v4.1 `--debate` run emits extra runStats rows for
+        // the SAME bench alias (role 'rebuttal'/'revote', src/council/debate.js:88-96). With no
+        // id, renderSeats keys on model and the re-vote row silently overwrites the seat row.
+        // (If the panel is meant to be bench-only, filter to seat/critic/lens:* instead and
+        // leave rebuttal/revote spend to the cost table — but say which; do not leave it implied.)
+        id: r.model + ':' + (r.role || 'seat'),
+        model: r.model, role: r.role || null, status: r.status || null,
+        stage: null, messages: null, tokensIn: null, tokensOut: null,
+        costDisplay: r.costDisplay || null, lastActivity: null, latestPreview: null,
+        stalled: false,
+      };
+    });
+  }
+
+  // ⚠️ DE-ROT (F41): STAGE_LABELS is exported so applyLive() can label post-open stages.
+  var api = { pollDelay: pollDelay, seatCells: seatCells, seatsFromRunStats: seatsFromRunStats,
+    defaultBlind: defaultBlind, dash: dash, TERMINAL_STATUSES: TERMINAL_STATUSES, STAGE_LABELS: STAGE_LABELS };
+  if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
+  if (typeof window !== 'undefined') { window.AmicusLive = api; }
+})();

package/electron/workspace-ui/md-lite.js

@@ -0,0 +1,163 @@
+/**
+ * markdown-lite — dependency-free renderer for untrusted model prose
+ * (v4.4 §4.2, resolved Q7). Supported: #–#### headings, - / * bullets,
+ * numbered items, ``` fences, `inline code`, paragraphs. EVERY string lands
+ * in the DOM via textContent / createTextNode — no HTML-string injection, no
+ * HTML passthrough, no links. (⚠️ DE-ROT F32: wording avoids the banned token —
+ * see the note above the block.) The parser is pure (node-tested); the applier takes
+ * an explicit document. Loaded as a plain script (window.AmicusMd) and as a
+ * CommonJS module (jest).
+ */
+(function () {
+  'use strict';
+
+  var H_RE = /^(#{1,4})\s+(.*)$/;
+  var UL_RE = /^\s*[-*]\s+/;
+  var OL_RE = /^\s*\d+[.)]\s+/;
+
+  /**
+   * Split one line into literal / inline-code segments in a SINGLE linear pass.
+   *
+   * ⚠️ v4.4.1 A1/D1 (Confirmed 4/4), with its SEVERITY CLAIM CORRECTED. The
+   * previous form re-`exec`ed a freshly sliced `rest` each iteration
+   * (`rest = rest.slice(...)`) — quadratic as WRITTEN, but not as it ran. V8's
+   * `String.prototype.slice` returns a SlicedString (parent pointer + offset),
+   * not a copy, so the old code measured ~8 ms at artifact-guard.js's 200 KB cap
+   * and scaled LINEARLY (~2x per doubling out to 2.4 MB). A deliberately-copying
+   * control took 78,232 ms at that same 200 KB — that is the freeze the finding
+   * described, and it is not what shipped. Numbers:
+   * `.superpowers/sdd/task-10-report.md:127-148`.
+   *
+   * What the rewrite removes is therefore a silent dependence on an undocumented
+   * engine optimisation that nothing here states or tests — a latent PORTABILITY
+   * hazard on any engine without sliced strings — and not a live performance
+   * defect or an exploitable-DoS-that-was. The `lastIndex` cursor walks the
+   * ORIGINAL string once and never copies a tail, so linearity is now a property
+   * of the algorithm rather than of the engine.
+   *
+   * Output is identical to the old function for every input: the pattern is
+   * context-free — no `^`, `\b`, lookaround or backreference — so a /g scan
+   * resuming at `lastIndex` lands on exactly the same match positions that
+   * re-`exec`ing the remainder did. The three boundary cases match too: no
+   * match at all yields one literal segment, a trailing match yields no empty
+   * tail segment, and empty input yields [].
+   *
+   * The regex is constructed per call and deliberately NOT hoisted to module
+   * scope: a /g regex carries mutable `lastIndex`, so one shared instance would
+   * leak cursor state between calls and silently drop spans.
+   */
+  function parseInline(text) {
+    var out = [];
+    var s = String(text);
+    var re = /`([^`\n]+)`/g;
+    var pos = 0;
+    var m;
+    while ((m = re.exec(s)) !== null) {
+      if (m.index > pos) { out.push({ code: false, text: s.slice(pos, m.index) }); }
+      out.push({ code: true, text: m[1] });
+      pos = re.lastIndex;
+    }
+    if (pos < s.length) { out.push({ code: false, text: s.slice(pos) }); }
+    return out;
+  }
+
+  function parseMdLite(text) {
+    var lines = String(text || '').replace(/\r\n/g, '\n').split('\n');
+    var blocks = [];
+    var i = 0;
+    while (i < lines.length) {
+      var line = lines[i];
+      if (/^```/.test(line)) {
+        var buf = [];
+        i += 1;
+        while (i < lines.length && !/^```/.test(lines[i])) { buf.push(lines[i]); i += 1; }
+        i += 1; // closing fence (or EOF)
+        blocks.push({ t: 'code', text: buf.join('\n') });
+        continue;
+      }
+      var h = H_RE.exec(line);
+      // ⚠️ v4.4.1 D3: trim the heading text. H_RE's `\s+` eats the run of
+      // whitespace after the hashes, but `(.*)$` keeps everything to end of
+      // line — so `# Title   ` rendered a heading with trailing blanks baked
+      // into its text node.
+      if (h) { blocks.push({ t: 'h', level: h[1].length, text: h[2].trim() }); i += 1; continue; }
+      if (UL_RE.test(line)) {
+        var ul = [];
+        while (i < lines.length && UL_RE.test(lines[i])) { ul.push(lines[i].replace(UL_RE, '')); i += 1; }
+        blocks.push({ t: 'ul', items: ul });
+        continue;
+      }
+      if (OL_RE.test(line)) {
+        var ol = [];
+        while (i < lines.length && OL_RE.test(lines[i])) { ol.push(lines[i].replace(OL_RE, '')); i += 1; }
+        blocks.push({ t: 'ol', items: ol });
+        continue;
+      }
+      if (!line.trim()) { i += 1; continue; }
+      var p = [line];
+      i += 1;
+      while (i < lines.length && lines[i].trim() &&
+             !/^```/.test(lines[i]) && !H_RE.test(lines[i]) &&
+             !UL_RE.test(lines[i]) && !OL_RE.test(lines[i])) {
+        p.push(lines[i]);
+        i += 1;
+      }
+      blocks.push({ t: 'p', text: p.join(' ') });
+    }
+    return blocks;
+  }
+
+  function applyInline(el, segs, doc) {
+    for (var i = 0; i < segs.length; i++) {
+      if (segs[i].code) {
+        var c = doc.createElement('code');
+        c.textContent = segs[i].text;
+        el.appendChild(c);
+      } else {
+        el.appendChild(doc.createTextNode(segs[i].text));
+      }
+    }
+  }
+
+  /** Render prose into container. Panels use h3–h6 so page structure wins. */
+  function renderMdLite(container, text, doc) {
+    var d = doc || document;
+    container.textContent = '';
+    var blocks = parseMdLite(text);
+    for (var i = 0; i < blocks.length; i++) {
+      var b = blocks[i];
+      var el;
+      if (b.t === 'h') {
+        // ⚠️ v4.4.1 D4: the `Math.min(6, …)` that used to wrap this was
+        // unreachable — H_RE's `#{1,4}` bounds level to 1–4, so the tag is
+        // always h3–h6 and the clamp could never fire. Dead defensive code is
+        // worse than none here: it made the h6 ceiling look enforced when the
+        // real guarantee lives in H_RE. If that `#{1,4}` is ever widened, THIS
+        // line must widen with it — h7 is not an element. The
+        // `'#'.repeat(4) + ' X'` → h6 test pins the true boundary.
+        el = d.createElement('h' + (b.level + 2));
+        applyInline(el, parseInline(b.text), d);
+      } else if (b.t === 'code') {
+        el = d.createElement('pre');
+        var code = d.createElement('code');
+        code.textContent = b.text;
+        el.appendChild(code);
+      } else if (b.t === 'ul' || b.t === 'ol') {
+        el = d.createElement(b.t);
+        for (var j = 0; j < b.items.length; j++) {
+          var li = d.createElement('li');
+          applyInline(li, parseInline(b.items[j]), d);
+          el.appendChild(li);
+        }
+      } else {
+        el = d.createElement('p');
+        applyInline(el, parseInline(b.text), d);
+      }
+      container.appendChild(el);
+    }
+  }
+
+  var api = { parseMdLite: parseMdLite, parseInline: parseInline, renderMdLite: renderMdLite };
+  if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
+  if (typeof window !== 'undefined') { window.AmicusMd = api; }
+})();

package/electron/workspace-ui/workspace-app.js

@@ -0,0 +1,240 @@
+/**
+ * Council Workspace — application state + wiring (v4.4 §5).
+ * Historical rendering in this task; Task 15 adds the live poll loop into
+ * the seams marked LIVE; Task 16/17 flip the Abort button + confirm dialog.
+ *
+ * ⚠️ DE-ROT (F05) / PRE-FLIGHT (P2): this file is the last of the three-way
+ * split (workspace-app.js / workspace-panels.js / workspace-verbs.js). It
+ * loads LAST (md-lite → live-model → workspace-render → workspace-matrix →
+ * workspace-panels → workspace-verbs → workspace-app), so panels/verbs
+ * already exist and may be captured once, here, at load time.
+ */
+(function () {
+  'use strict';
+
+  var P = window.AmicusPanels;
+  var V = window.AmicusVerbs;
+
+  var invoke = function (ch) {
+    var args = Array.prototype.slice.call(arguments, 1);
+    return window.amicusWorkspace.invoke.apply(null, [ch].concat(args));
+  };
+
+  var state = {
+    runId: null,
+    detail: null,
+    debate: null,   // ⚠️ DE-ROT (F38): parsed debate.json, fetched once per run-open; stays
+                     // null on a non-debate run, an aborted/skipped debate, or a parse failure —
+                     // drillIntoJudge's judge-*.md fallback covers all three.
+    blind: false,
+    labelByModel: {},
+    listTimer: null,
+    liveTimer: null, // LIVE (Task 15)
+    liveEpoch: 0,    // LIVE (Task 15): bumped by stopLiveLoop() to invalidate in-flight ticks
+  };
+
+  function labelOf(model) { return state.labelByModel[model] || null; }
+  function isBlind() { return state.blind; }
+
+  function $(id) { return document.getElementById(id); }
+
+  // ---- run list ----------------------------------------------------------
+  function refreshList() {
+    return invoke('workspace:list-runs').then(function (rows) {
+      // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): thread the
+      // CURRENTLY-open run's blind state + label lookup through. labelOf only resolves a
+      // label for models that belong to the currently open run, so other rows' chair chips
+      // degrade gracefully to the raw id — see renderRunList's own note in workspace-render.js.
+      window.AmicusRender.renderRunList($('run-list'), rows, state.runId, openRun, state.blind, labelOf);
+    });
+  }
+
+  function startListLoop() {
+    if (state.listTimer) { clearInterval(state.listTimer); }
+    state.listTimer = setInterval(refreshList, 5000); // spec §4.3
+    window.addEventListener('focus', refreshList);
+  }
+
+  // ---- run detail --------------------------------------------------------
+  function openRun(runId) {
+    state.runId = runId;
+    state.debate = null;
+    return invoke('workspace:get-run', runId).then(function (detail) {
+      state.detail = detail;
+      // ⚠️ DE-ROT (F38): debate.json is the re-vote index the matrix drill-in needs — fetched
+      // once per run-open (never per render), fire-and-forget. An aborted or cost-ceiling
+      // -skipped debate never writes it; a parse failure leaves state.debate null either way,
+      // which drillIntoJudge treats as "no re-vote for this (judge, id)" and falls back to
+      // today's judge-*.md path.
+      // ⚠️ CODE REVIEW (round 2, finding 1): this fire-and-forget fetch is exactly the F09
+      // class of bug if left unguarded — a stale response from a run the user has since
+      // navigated away from must never overwrite the run now open. Capture `runId` and check
+      // it's still `state.runId` before writing; a rejection (dead channel, closed window) is
+      // caught too, so it never surfaces as an unhandled rejection in the renderer.
+      if (detail && detail.run && detail.run.debate) {
+        invoke('workspace:read-artifact', runId, 'debate.json').then(function (res) {
+          if (state.runId !== runId) { return; }
+          try { state.debate = JSON.parse(res.text); } catch (err) { state.debate = null; }
+        }).catch(function () {
+          if (state.runId !== runId) { return; }
+          state.debate = null;
+        });
+      }
+      renderDetail();
+      refreshList();
+    });
+  }
+
+  function renderDetail() {
+    var d = state.detail;
+    $('empty-state').hidden = true;
+    $('run-view').hidden = false;
+    var R = window.AmicusRender;
+
+    if (!d || d.error || !d.derived) {
+      $('run-title').textContent = (d && d.runId) || 'run';
+      // ⚠️ Fix-wave item 1: an unreadable run has no derived model behind it, so the Abort
+      // button — otherwise left however the PREVIOUS (possibly live, non-terminal) run set it
+      // — must not stay enabled here pointed at a run whose detail can't back an abort.
+      $('abort-btn').hidden = true;
+      R.renderBanner($('banner'),
+        'Run unreadable: ' + ((d && d.error) || (d && d.run && d.run.parseError) || 'unknown') +
+        (d && d.runDir ? ' — ' + d.runDir : ''), '');
+      return;
+    }
+
+    // blind default: computed ONCE per run-open from status (resolution 9)
+    state.blind = window.AmicusLive.defaultBlind(d.run.status);
+    $('blind-toggle').checked = state.blind;
+    state.labelByModel = {};
+    d.derived.names.forEach(function (p) { state.labelByModel[p.model] = p.label; });
+
+    $('run-title').textContent = d.runId;
+    R.renderHeaderChips($('run-chips'), d.run, state.blind, labelOf);
+    // v4.4 §8: 6th arg = costExact. A run with an unpriced seat draws an
+    // indeterminate gauge and a `≥` readout instead of a confident percentage.
+    R.renderGauge($('cost-gauge-fill'), $('cost-gauge-text'),
+      d.derived.cost.costAmount, d.derived.cost.maxCost, d.derived.cost.totalDisplay,
+      d.derived.cost.costExact !== false);
+    R.renderStageRail($('stage-rail'), d.derived.stageRail);
+
+    renderBanners();
+    P.renderSeatsPanel();
+    P.renderMatrixPanel();
+    P.renderVerdictPanel();
+    R.renderCost($('cost-body'), d.derived.cost, state.blind, labelOf);
+    P.wireLazyPanels();
+    var isTerminal = window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1;
+    $('abort-btn').hidden = isTerminal;
+    V.startLiveLoop();
+  }
+
+  function renderBanners() {
+    var d = state.detail;
+    var R = window.AmicusRender;
+    if (!d.derived.schemaSupported) {
+      R.renderBanner($('banner'), 'This run was written by a different amicus version (schemaVersion ' +
+        d.run.schemaVersion + ') — artifacts: ' + d.runDir, 'warn');
+      return;
+    }
+    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): two distinct bench
+    // entries that sanitize to the same artifact name (src/workspace/artifact-guard.js's
+    // artifactAllowlist) mean this run directory cannot hold both models' review/judge files
+    // under distinct names — drillIntoJudge's artifact lookup would otherwise silently
+    // misattribute one model's prose to the other. This is a run-integrity defect the user
+    // must see, not a display quirk to smooth over — surfaced ahead of the run.error/reason
+    // banner below since it calls into question every judges-panel section's attribution.
+    if (d.derived.artifactCollisions && d.derived.artifactCollisions.length) {
+      var c = d.derived.artifactCollisions[0];
+      R.renderBanner($('banner'),
+        'Run integrity error: bench entries ' + c.models.join(' and ') + ' both sanitize to "' + c.sanitized +
+        '" — this run directory cannot distinguish their artifacts, so prose below may be misattributed.', '');
+      return;
+    }
+    // ⚠️ PRE-FLIGHT (P3), caught live by the CDP e2e (Task 18): gating on `d.run.error` ALONE
+    // never shows this banner for a `status:'partial'` run — `finalize()` only ever sets
+    // `run.error` on the exit-1 path (src/council/run.js:98-100); the exit-2 "degraded" path
+    // leaves it null (run-detail.js:83-91). `verdictPanel.reason` (degradedReason()) already
+    // covers BOTH cases — exit-1's {code, message} and the partial-run stage-failure/skip
+    // sentence — so check for either signal, not run.error alone.
+    if (d.run.error || d.derived.verdictPanel.reason) {
+      // ⚠️ Code review round 2, finding 2: `d.run.error` is a structured {code, message} object
+      // (never a string) — passing it straight to renderBanner set `textContent = <object>`,
+      // which coerces to the literal string "[object Object]". `d.derived.verdictPanel.reason`
+      // is already the correctly-formatted string (run-detail.js's degradedReason(): "CODE:
+      // message" on the exit-1 path, or a stage-failure/skip sentence otherwise) — reuse it
+      // rather than re-deriving the same formatting a second time here.
+      R.renderBanner($('banner'), d.derived.verdictPanel.reason || 'Run reported an error',
+        d.run.status === 'error' ? '' : 'warn');
+      return;
+    }
+    R.renderBanner($('banner'), null);
+  }
+
+  // ---- blind toggle + keyboard ------------------------------------------
+  $('blind-toggle').addEventListener('change', function (e) {
+    state.blind = !!e.target.checked;
+    renderDetail_preserveBlind();
+  });
+
+  function renderDetail_preserveBlind() {
+    var keep = state.blind;
+    // ⚠️ Fix-wave item 1: renderDetail() itself early-returns safely for an unreadable run
+    // (!d || d.error || !d.derived) — but this wrapper used to run past that guard
+    // unconditionally, dereferencing the (nonexistent) derived model via renderSeatsPanel()
+    // and again on the last line below. Reachable from a typo on the primary documented
+    // entry point: `amicus watch <badId> --ui` -> ?runId= boot -> getRunDetail -> error ->
+    // the error branch unhides #run-view before the derived-model guard, so the Blind
+    // checkbox is live with nothing behind it.
+    if (!state.detail || state.detail.error || !state.detail.derived) {
+      $('blind-toggle').checked = keep;
+      return;
+    }
+    renderDetail();
+    state.blind = keep;
+    $('blind-toggle').checked = keep;
+    // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): renderDetail() (just
+    // called above) resets state.blind to the run's DEFAULT before this function restores the
+    // user's chosen `keep` value — renderHeaderChips was painted during that inner call with
+    // the (temporarily wrong) default blind state and, unlike seats/matrix/verdict/cost below,
+    // was never repainted afterward. Re-render it here too, now that state.blind is correct.
+    window.AmicusRender.renderHeaderChips($('run-chips'), state.detail.run, state.blind, labelOf);
+    P.renderSeatsPanel();
+    P.renderMatrixPanel();
+    P.renderVerdictPanel();
+    window.AmicusRender.renderCost($('cost-body'), state.detail.derived.cost, state.blind, labelOf);
+  }
+
+  $('run-list').addEventListener('keydown', function (e) {
+    var items = Array.prototype.slice.call($('run-list').querySelectorAll('li[data-run-id]'));
+    if (!items.length) { return; }
+    var idx = items.findIndex(function (li) { return li.dataset.runId === state.runId; });
+    if (e.key === 'ArrowDown') { e.preventDefault(); openRun(items[Math.min(items.length - 1, idx + 1)].dataset.runId); }
+    if (e.key === 'ArrowUp') { e.preventDefault(); openRun(items[Math.max(0, idx - 1)].dataset.runId); }
+  });
+
+  document.addEventListener('keydown', function (e) {
+    if (e.key === 'Escape') { $('dialog-abort').hidden = true; }
+  });
+
+  // ---- boot --------------------------------------------------------------
+  // ⚠️ PRE-FLIGHT (P2): publish the namespace BEFORE anything can call into panels/verbs — they
+  // read `window.AmicusApp.*` at call time and this file loads last.
+  window.AmicusApp = {
+    state: state, invoke: invoke, $: $, labelOf: labelOf,
+    isBlind: isBlind, openRun: openRun, renderDetail: renderDetail, renderBanners: renderBanners,
+  };
+
+  // ⚠️ PRE-FLIGHT (P4) + DE-ROT (F09): register the three prose `toggle` listeners exactly ONCE,
+  // here at boot. wireLazyPanels() (called from renderDetail, on every run-open and blind-toggle)
+  // only rewrites the per-run `loaders` spec map from now on — it never adds a listener.
+  P.proseLoader('reviews-panel');
+  P.proseLoader('bundle-panel');
+  P.proseLoader('judges-panel');
+
+  var boot = new URLSearchParams(window.location.search).get('runId');
+  refreshList().then(function () {
+    if (boot) { openRun(boot); }
+  });
+  startListLoop();
+})();