amicus 4.3.0 → 4.4.1

package/electron/workspace-ui/workspace-render.js

@@ -0,0 +1,277 @@
+/**
+ * Council Workspace — DOM painters (run list, header, stage rail, seats,
+ * banner, cost). Every string lands via textContent/createTextNode; keyed
+ * updates for seat rows (no full re-render per tick, spec §5.2).
+ */
+(function () {
+  'use strict';
+
+  /** Element builder: children that are strings become TEXT nodes (never markup). */
+  function el(tag, attrs, children) {
+    var node = document.createElement(tag);
+    if (attrs) {
+      Object.keys(attrs).forEach(function (k) {
+        if (k === 'className') { node.className = attrs[k]; }
+        else if (k === 'dataset') {
+          Object.keys(attrs[k]).forEach(function (d) { node.dataset[d] = attrs[k][d]; });
+        } else if (k.indexOf('on') === 0 && typeof attrs[k] === 'function') {
+          node.addEventListener(k.slice(2), attrs[k]);
+        } else if (k.indexOf('on') === 0) {
+          // A non-function on* value must never fall through to setAttribute below — that
+          // would write a live inline event-handler attribute (a DOM-injection sink) from data.
+          /* skip */
+        } else if (attrs[k] === false || attrs[k] === null || attrs[k] === undefined) {
+          /* skip */
+        } else { node.setAttribute(k, String(attrs[k])); }
+      });
+    }
+    (children || []).forEach(function (c) {
+      if (c === null || c === undefined) { return; }
+      node.appendChild(typeof c === 'string' ? document.createTextNode(c) : c);
+    });
+    return node;
+  }
+
+  function chip(text, kind) {
+    return el('span', { className: 'chip ' + (kind || ''), title: text }, [text]);
+  }
+
+  /** Dual-name display flip (blind mode). pair = {model, label}. */
+  function display(pair, blind) {
+    if (!pair) { return '—'; }
+    return blind && pair.label ? pair.label : (pair.model || '—');
+  }
+
+  function relTime(iso) {
+    if (!iso) { return '—'; }
+    var ms = Date.now() - Date.parse(iso);
+    if (!isFinite(ms) || ms < 0) { return iso; }
+    var m = Math.floor(ms / 60000);
+    if (m < 1) { return 'just now'; }
+    if (m < 60) { return m + 'm ago'; }
+    var h = Math.floor(m / 60);
+    if (h < 48) { return h + 'h ago'; }
+    return Math.floor(h / 24) + 'd ago';
+  }
+
+  /** display() for a bare model id, tolerating a missing labelOf (defaults to no label known). */
+  function displayModel(model, blindOn, labelOf) {
+    return display({ model: model, label: labelOf ? labelOf(model) : null }, blindOn);
+  }
+
+  // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): renderRunList used to
+  // interpolate `row.chair` (a raw model id) directly into the run-row-sub line, bypassing
+  // display() — every other identity surface (seats, cost rows, revote titles) masks
+  // correctly through it. Christian has ruled blind mode DOES mask the roster (see
+  // docs/council.md and the v4.4 spec §6/resolved-Q2 amendment) — thread blind + labelOf
+  // through so the chair name masks here too. `labelOf` here is the CURRENTLY-OPEN run's
+  // labelByModel lookup (workspace-app.js), so it only resolves a label for the row that IS
+  // the open run; other rows' chairs have no label data available and degrade gracefully to
+  // the raw id — a reading aid, not a security control (§6.1), so best-effort is correct.
+  function renderRunList(container, rows, selectedId, onOpen, blindOn, labelOf) {
+    container.textContent = '';
+    rows.forEach(function (row) {
+      if (row.error) {
+        container.appendChild(el('li', { className: 'error-row', title: row.pointerPath || '' }, [
+          el('div', { className: 'run-row-top' }, [
+            el('span', { className: 'mono' }, [row.runId]),
+            el('span', {}, ['unreadable']),
+          ]),
+          el('div', { className: 'run-row-sub' }, [row.runDir || row.error]),
+        ]));
+        return;
+      }
+      var li = el('li', {
+        className: row.runId === selectedId ? 'selected' : '',
+        tabindex: '-1',
+        dataset: { runId: row.runId },
+        onclick: function () { onOpen(row.runId); },
+      }, [
+        el('div', { className: 'run-row-top' }, [
+          el('span', { className: 'mono' }, [row.runId]),
+          chip(row.status, row.status),
+        ]),
+        el('div', { className: 'run-row-sub' }, [
+          relTime(row.startedAt),
+          // ⚠️ v4.4.1 RN-12: `String(row.bench.length)` was unguarded. scanCouncilRuns is written
+          // to "never throw on bad input" and degrade to a row instead — but this painter draws
+          // EVERY row, so one row arriving without a `bench` array threw a TypeError that blanked
+          // the entire run list, killing the data layer's degrade-never-throw guarantee one layer
+          // up. (scanCouncilRuns' own error rows take the early return above; this guards the
+          // contract with any OTHER row source, which is what the guarantee is actually worth.)
+          (Array.isArray(row.bench) ? row.bench.length : 0) + ' seats',
+          'chair ' + displayModel(row.chair, blindOn, labelOf),
+          row.overallVerdict || '',
+          row.costDisplay || '',
+        ].filter(Boolean).map(function (t) { return el('span', {}, [t]); })),
+      ]);
+      container.appendChild(li);
+    });
+  }
+
+  // ⚠️ R4 COUNCIL REVIEW (fourth live paid council, major, unanimous): the bench/critic/chair
+  // chips interpolated raw model ids directly, bypassing display() — the seat table right
+  // below masks correctly, so a live blind run showed an unmasked roster in its own header.
+  // Lenses (`run.lenses`) are review-style slugs (e.g. 'skeptic'), never model identities —
+  // left unmasked, matching the raw display used elsewhere for non-identity chips.
+  function renderHeaderChips(container, run, blindOn, labelOf) {
+    container.textContent = '';
+    container.appendChild(chip(run.status || 'unknown', run.status));
+    (Array.isArray(run.bench) ? run.bench : []).forEach(function (m) {
+      container.appendChild(chip(displayModel(m, blindOn, labelOf), ''));
+    });
+    if (run.critic) { container.appendChild(chip('critic: ' + displayModel(run.critic, blindOn, labelOf), '')); }
+    (Array.isArray(run.lenses) ? run.lenses : []).forEach(function (s) {
+      container.appendChild(chip('lens: ' + s, ''));
+    });
+    container.appendChild(chip('chair: ' + displayModel(run.chair, blindOn, labelOf), ''));
+    if (run.options && run.options.gateway) { container.appendChild(chip('gw: ' + run.options.gateway, '')); }
+  }
+
+  /**
+   * v4.4 §8: `costExact` (optional, defaults TRUE so every pre-v4.4 5-arg call
+   * site is unchanged) says whether `costAmount` is the whole bill. When false —
+   * i.e. some seat reported no usage at all — a gauge reading "50% of budget" is
+   * affirmatively misleading, because the true figure can only be HIGHER. The
+   * bar still fills to the known fraction (that much is real), but the gauge is
+   * marked `unknown` for the hatched CSS treatment and the readout is prefixed
+   * `≥` so the number is never mistaken for a measurement.
+   */
+  function renderGauge(fillEl, textEl, costAmount, maxCost, totalDisplay, costExact) {
+    var gauge = fillEl.parentElement;
+    var exact = costExact === undefined ? true : !!costExact;
+    var prefix = exact ? '' : '≥ ';
+    gauge.classList.toggle('unknown', !exact);
+    if (maxCost === null || costAmount === null) {
+      fillEl.style.width = '0%';
+      gauge.classList.remove('over');
+      textEl.textContent = prefix + totalDisplay + (maxCost !== null ? ' / $' + maxCost.toFixed(2) : '');
+      return;
+    }
+    var pct = Math.min(100, (costAmount / maxCost) * 100);
+    fillEl.style.width = pct.toFixed(1) + '%';
+    gauge.classList.toggle('over', costAmount >= maxCost);
+    textEl.textContent = prefix + totalDisplay + ' / $' + maxCost.toFixed(2);
+  }
+
+  function renderStageRail(container, stageRail) {
+    container.textContent = '';
+    (stageRail || []).forEach(function (s) {
+      // Default once and reuse everywhere below — the aria-label used to interpolate the raw
+      // `s.status` while className defaulted it, so an entry with no status read "…: undefined".
+      var status = s.status || 'pending';
+      var mark = status === 'complete' ? '✓ ' : (status === 'running' ? '▶ ' : '· ');
+      container.appendChild(el('span', {
+        className: 'stage ' + status,
+        title: (s.startedAt || '') + (s.completedAt ? ' → ' + s.completedAt : ''),
+        'aria-label': s.label + ': ' + status,
+      }, [mark + s.label]));
+    });
+  }
+
+  /** Keyed seat rows: update in place per seat id/model; remove leavers. */
+  function renderSeats(tbody, seats, blindOn, labelOf) {
+    // Build a key -> row map from the existing children ONCE per call, instead of a CSS
+    // attribute-selector lookup per seat. `tr[data-key="..."]` requires escaping the key for
+    // CSS string-literal syntax; escaping only the query side (as the brief's original code
+    // did) while the stored `dataset.key` stays raw means a key containing `"` or `\` can
+    // never match its own row — the lookup misses every tick and the row is re-appended
+    // forever. A plain object lookup sidesteps the escaping problem entirely.
+    var existing = {};
+    Array.prototype.slice.call(tbody.children).forEach(function (row) {
+      existing[row.dataset.key] = row;
+    });
+    var seen = {};
+    seats.forEach(function (seat) {
+      // ⚠️ DE-ROT (F37): `seat.id` is now always set by seatsFromRunStats (`model:role`), so
+      // debate rebuttal/revote rows no longer collide with the seat row. The `|| seat.model`
+      // fallback covers live seats, whose taskId-derived id is already unique.
+      var key = String(seat.id || seat.model);
+      seen[key] = true;
+      var row = existing[key];
+      // ⚠️ DE-ROT (F35): seat.lastActivity is the ISO `leg.lastActivityAt`; format it HERE.
+      // seatCells lives in live-model.js, which loads first and has no access to relTime.
+      var view = Object.assign({}, seat, {
+        lastActivity: seat.lastActivity ? relTime(seat.lastActivity) : null,
+      });
+      var cells = window.AmicusLive.seatCells(view, blindOn, labelOf);
+      if (!row) {
+        row = el('tr', { dataset: { key: key } }, cells.map(function (c, i) {
+          return el('td', { className: i >= 4 && i <= 6 ? 'num' : (i === 8 ? 'stalled-flag' : '') }, [c]);
+        }));
+        tbody.appendChild(row);
+        return;
+      }
+      cells.forEach(function (c, i) {
+        var td = row.children[i];
+        if (td && td.textContent !== c) { td.textContent = c; }
+      });
+    });
+    Array.prototype.slice.call(tbody.children).forEach(function (row) {
+      if (!seen[row.dataset.key]) { row.remove(); }
+    });
+  }
+
+  function renderBanner(bannerEl, text, kind) {
+    if (!text) { bannerEl.hidden = true; bannerEl.textContent = ''; return; }
+    bannerEl.hidden = false;
+    bannerEl.className = 'banner ' + (kind || '');
+    bannerEl.textContent = text;
+  }
+
+  function renderCost(container, cost, blindOn, labelOf) {
+    container.textContent = '';
+    var head = el('tr', {}, ['Seat', 'Role', 'Status', 'Duration', 'Cost'].map(function (h, i) {
+      return el('th', { className: i >= 3 ? 'num' : '' }, [h]);
+    }));
+    var rows = (cost.rows || []).map(function (r) {
+      // Single definition of the blind-mode flip (`display()`, above) — this used to
+      // hand-duplicate seatCells' ternary, which meant seatCells' blind-mode test never
+      // protected this second surface.
+      var name = display({ model: r.model, label: labelOf ? labelOf(r.model) : null }, blindOn);
+      var dur = r.durationMs === null ? '—' : Math.round(r.durationMs / 1000) + 's';
+      return el('tr', {}, [
+        el('td', {}, [name]),
+        el('td', {}, [r.role || '—']),
+        el('td', {}, [r.status || '—']),
+        el('td', { className: 'num' }, [dur]),
+        el('td', { className: 'num' }, [r.costDisplay || '—']),
+      ]);
+    });
+    var total = el('tr', {}, [
+      el('td', {}, [el('strong', {}, ['Run total'])]),
+      el('td', {}, ['']), el('td', {}, ['']), el('td', {}, ['']),
+      el('td', { className: 'num' }, [cost.totalDisplay || '—']),
+    ]);
+    var table = el('table', { className: 'table' }, [el('thead', {}, [head]), el('tbody', {}, rows.concat([total]))]);
+    container.appendChild(table);
+  }
+
+  /** Prose panels: one titled section per artifact, markdown-lite rendered. */
+  function renderProseSections(container, sections) {
+    container.textContent = '';
+    sections.forEach(function (s) {
+      var host = el('div', { className: 'prose-section', dataset: { artifact: s.name } }, [
+        el('h3', {}, [s.title]),
+      ]);
+      var body = el('div', {}, []);
+      if (s.error) {
+        body.appendChild(el('p', { className: 'empty-note' }, [s.error]));
+      } else {
+        window.AmicusMd.renderMdLite(body, s.text, document);
+        if (s.truncated) {
+          body.appendChild(el('p', { className: 'truncate-note' }, ['Truncated at 200 KB — open the run folder for the full file.']));
+        }
+      }
+      host.appendChild(body);
+      container.appendChild(host);
+    });
+  }
+
+  window.AmicusRender = {
+    el: el, chip: chip, display: display, relTime: relTime, renderRunList: renderRunList,
+    renderHeaderChips: renderHeaderChips, renderGauge: renderGauge, renderStageRail: renderStageRail,
+    renderSeats: renderSeats, renderBanner: renderBanner, renderCost: renderCost,
+    renderProseSections: renderProseSections,
+  };
+})();

package/electron/workspace-ui/workspace-verbs.js

@@ -0,0 +1,293 @@
+/**
+ * Council Workspace — action verbs (v4.4 §5, ⚠️ DE-ROT F05 split of
+ * workspace-app.js). `doFold` is the only verb live in this task; Task 15
+ * adds the live poll loop (startLiveLoop/stopLiveLoop/applyLive) and Task 16
+ * adds the abort confirm dialog (openAbortDialog) into the seams below.
+ *
+ * Loads BEFORE workspace-app.js, so every function here reads
+ * `window.AmicusApp` at CALL time — never captured at this file's own load
+ * time, since AmicusApp does not exist until workspace-app.js (last in load
+ * order) publishes it.
+ */
+(function () {
+  'use strict';
+
+  // Task 16: a LOCAL `$` for the one-time, module-load-time abort-dialog wiring below —
+  // the DOM (unlike window.AmicusApp) already exists at this file's load time, since
+  // index.html's script tags sit after all the markup. Never used to read AmicusApp state.
+  function $(id) { return document.getElementById(id); }
+
+  function doFold() {
+    var A = window.AmicusApp;
+    var btn = A.$('fold-btn');
+    // ⚠️ v4.4.1 LC-8: this chain had NO rejection handler. workspace:fold's IPC handler catches
+    // its own errors and answers {ok:false, error}, so a REJECTION means the channel itself failed
+    // — and the user saw the Fold button sitting in its pre-click state with no explanation, while
+    // the renderer logged an unhandled rejection (which jest-circus fails the running test on).
+    // Two-argument .then(onFulfilled, onRejected), NOT .then().catch() — see the long note in
+    // startLiveLoop below: with a trailing .catch, a THROW inside onFulfilled would be routed here
+    // too and misreported as a channel failure.
+    A.invoke('workspace:fold', A.state.runId).then(function (res) {
+      if (res.ok) {
+        btn.textContent = 'Folded ✓';
+        btn.disabled = true;
+        btn.title = res.already ? 'Already folded this session' : 'Fold written to the launching terminal';
+      } else {
+        btn.title = res.error || 'fold failed';
+      }
+    }, function (err) {
+      console.error('workspace fold: workspace:fold failed', err);
+      btn.title = 'fold failed — the workspace channel is unavailable' + (err && err.message ? ': ' + err.message : '');
+    });
+  }
+
+  // ---- live loop (spec §4.3; Task 15) -----------------------------------
+  // ⚠️ DE-ROT (F42): stopLiveLoop can only clearTimeout a SCHEDULED tick — it cannot cancel an
+  // invoke() already in flight, and the visibilitychange/blur/focus listeners at the bottom of
+  // this file re-enter startLiveLoop freely. Without a generation guard those forked chains
+  // outlive stopLiveLoop, reassign state.liveTimer (orphaning the timer the event just
+  // scheduled), and paint run A's legs into run B after openRun() swaps state.detail underneath
+  // them. The epoch + PER-TICK runId pin below are mandatory, not optional hardening.
+  function stopLiveLoop() {
+    var A = window.AmicusApp;
+    A.state.liveEpoch = (A.state.liveEpoch || 0) + 1; // invalidates any in-flight tick
+    if (A.state.liveTimer) { clearTimeout(A.state.liveTimer); A.state.liveTimer = null; }
+  }
+
+  function liveState(terminal) {
+    return {
+      terminal: terminal,
+      visible: document.visibilityState === 'visible',
+      focused: document.hasFocus(),
+    };
+  }
+
+  function startLiveLoop() {
+    var A = window.AmicusApp;
+    stopLiveLoop();
+    var d = A.state.detail;
+    if (!d || !d.run || window.AmicusLive.TERMINAL_STATUSES.indexOf(d.run.status) !== -1) { return; }
+    var epoch = A.state.liveEpoch; // F42: stopLiveLoop() above just bumped it; this chain owns it
+    var tick = function () {
+      // F42: pin the id PER TICK and SEND the pinned id — matching the reply against
+      // state.runId while the request carried state.runId would still let a post-switch
+      // request hit run B.
+      var runId = A.state.runId;
+      // ⚠️ Code review round 2, finding 3: this MUST be `.then(onFulfilled, onRejected)`, not
+      // `.then(onFulfilled).catch(onRejected)`. The two look equivalent but are not: with a
+      // trailing `.catch`, a THROW inside onFulfilled (e.g. applyLive dereferencing a malformed
+      // payload, or a missing DOM id) is itself routed to the same catch and silently rescheduled
+      // — the loop keeps polling at full cadence, paints nothing, and logs nothing, indistinguishable
+      // from a healthy live view. With the two-argument form, onRejected only ever sees a
+      // REJECTED invoke() (a real IPC/network failure); a throw inside onFulfilled propagates as
+      // its own unhandled rejection instead, which surfaces (devtools/console) rather than being
+      // absorbed.
+      A.invoke('workspace:get-live', runId).then(function (live) {
+        if (epoch !== A.state.liveEpoch || runId !== A.state.runId) { return; } // stale chain
+        applyLive(live);
+        var terminal = !!(live && live.ok && live.terminal);
+        if (terminal) {
+          stopLiveLoop();
+          // ⚠️ Code review round 2, minor: openRun() is fire-and-forget here with no consumer —
+          // a rejected final refresh (e.g. the run folder vanished mid-read) must not strand the
+          // transient "refreshing…" banner forever, since the loop has already stopped and no
+          // later tick will ever repaint it.
+          A.openRun(runId).catch(function (err) {
+            console.error('workspace live loop: final get-run refresh failed', err);
+            window.AmicusRender.renderBanner(A.$('banner'),
+              'Run ended, but refreshing the final details failed — reopen the run to retry.', '');
+          });
+          return;
+        }
+        A.state.liveTimer = setTimeout(tick, window.AmicusLive.pollDelay(liveState(false)));
+      }, function (err) {
+        // A genuinely rejected invoke() (IPC/network failure) — reschedule unless superseded,
+        // but log it; silently retrying forever with no trace was the code-review finding.
+        if (epoch !== A.state.liveEpoch || runId !== A.state.runId) { return; }
+        console.error('workspace live loop: workspace:get-live failed', err);
+        A.state.liveTimer = setTimeout(tick, window.AmicusLive.pollDelay(liveState(false)));
+      });
+    };
+    A.state.liveTimer = setTimeout(tick, 0);
+  }
+
+  function applyLive(live) {
+    var A = window.AmicusApp;
+    var R = window.AmicusRender;
+    if (!live || !live.ok) {
+      // A1 failure: keep last-known panels; flag the live layer only (spec §9)
+      // 'live' (alongside 'info') is a marker class, not a style — see the clear-arm note below.
+      R.renderBanner(A.$('banner'), 'live data unavailable' + (live && live.error ? ' — ' + live.error : ''), 'info live');
+      return;
+    }
+    // ⚠️ Code review round 2, minor: was `if (live.seats.length)`, which skips renderSeats
+    // entirely for an empty array — so a roster that shrinks to zero between stages (the
+    // composed doc's `legs` is only populated while a stage is active) leaves the PREVIOUS
+    // stage's rows frozen on screen forever, since renderSeats' own leaver-removal never runs.
+    // `live.seats` is always an array per the LiveModel contract (never undefined/null) when
+    // `live.ok` is true, so this is simply "always paint," empty roster included.
+    if (live.seats) {
+      R.renderSeats(A.$('seats-body'), live.seats, A.state.blind, A.labelOf);
+    }
+    // F42: state.detail can be swapped/absent under a tick — never deref .derived unguarded.
+    var derived = A.state.detail && A.state.detail.derived ? A.state.detail.derived : null;
+    if (live.stages) {
+      // ⚠️ DE-ROT (F41): a raw-name fallback would show the RAW stage name for every stage that
+      // starts AFTER run-open (most of them — state.detail is a frozen run-open snapshot).
+      // STAGE_LABELS is mirrored onto window.AmicusLive (Task 12/14) for exactly this reason;
+      // label from the mirror, not the snapshot.
+      // ⚠️ DE-ROT (F40): live stage entries carry no startedAt/completedAt, so reading them off
+      // `s` wipes the durable times already on screen on the very first tick. Merge onto the
+      // run-open snapshot row instead (a stage that begins mid-session shows no times until the
+      // terminal openRun() refresh — status still updates every tick).
+      R.renderStageRail(A.$('stage-rail'), live.stages.map(function (s) {
+        var prior = (derived ? derived.stageRail.find(function (r) { return r.name === s.name; }) : null) || {};
+        return {
+          name: s.name,
+          label: window.AmicusLive.STAGE_LABELS[s.name] || s.name,
+          status: s.status || 'pending',
+          startedAt: prior.startedAt || null,
+          completedAt: prior.completedAt || null,
+        };
+      }));
+    }
+    // ⚠️ DE-ROT (F39): guard on costAmount ALONE. costDisplay is raw formatCost output and can be
+    // '?' (source 'unknown') or '—' (null cost); letting either string fall through would
+    // overwrite the durable total with a stage-scoped placeholder. The value is ACTIVE-STAGE
+    // spend, not a run total — labelled, never sold as one. The durable total returns on the
+    // terminal openRun() refresh.
+    if (live.costAmount !== null) {
+      // v4.4 §8: 6th arg = costExact. A stage carrying an unpriced leg draws the
+      // indeterminate gauge + `≥` readout rather than a confident percentage.
+      R.renderGauge(A.$('cost-gauge-fill'), A.$('cost-gauge-text'),
+        live.costAmount, derived ? derived.cost.maxCost : null,
+        (live.costDisplay || '—') + ' (this stage)',
+        live.costExact !== false);
+    }
+    // Dead-run banner: DATA-LAYER flags only (A4) — never GUI heuristics.
+    // ⚠️ Task 14 review: flags.crashed really means "errored with a reason" — finalize() maps
+    // ANY exit code 1 to status:'error' with run.error set, including a clean, zero-spend,
+    // no-legs-ever-launched validation failure. "No leg activity — may be dead, abort to
+    // reclaim it" is dishonest there on two counts: leg activity may be irrelevant to why it
+    // failed, and status:'error' is already TERMINAL — the process has already exited, so
+    // there is nothing left to abort. Give crashed its own, honest copy with no abort claim;
+    // it is terminal, so this same tick's terminal branch (above) immediately calls openRun(),
+    // which repaints the banner with the real run.error text via renderBanners() — one tick of
+    // blast radius. Only `stalled` (a still-running, no-activity heuristic) gets the abort
+    // remedy, since only a non-terminal run can plausibly still be aborted.
+    if (live.flags.crashed) {
+      R.renderBanner(A.$('banner'), 'Run reported an error — refreshing with the final result…', '');
+    } else if (live.flags.stalled) {
+      var mins = live.flags.stalledForSeconds ? Math.round(live.flags.stalledForSeconds / 60) : null;
+      // ⚠️ Code review round 2, finding 1: tagged 'live' (a marker class, no CSS of its own —
+      // see workspace.css, which styles only 'warn'/'info') so the clear arm below can find it.
+      // `stalled` is recomputed per read and simply omitted once activity resumes
+      // (src/mcp-council-awareness.js), so this banner is expected to be transient — but the OLD
+      // clear arm only ever matched the 'info' class, so a `''`-kind stalled banner painted here
+      // could never be cleared again: `renderBanner(el, text, '')` sets `className = 'banner '`,
+      // permanently failing `classList.contains('info')` from that point on, for the rest of the
+      // session, even once `flags.stalled` goes back to false on the very next tick.
+      R.renderBanner(A.$('banner'),
+        'No leg activity' + (mins ? ' for ' + mins + 'm' : '') + ' — the run may be dead. Abort to reclaim it; everything on disk stays browsable.',
+        'live');
+      // ⚠️ v4.4.1 RN-6 — ARBITRATED, and deliberately NOT fixed as the backlog proposed. RN-6
+      // asked for a matching `hidden = true` in the clearing arm below, believing this line is
+      // what puts the Abort button on screen. It is not: workspace-app.js's renderDetail already
+      // sets `$('abort-btn').hidden = isTerminal` on every run-open (:128), and startLiveLoop only
+      // runs on a non-terminal run — so the button is ALREADY visible for the whole life of a live
+      // run, by design, and this assignment is a no-op on every path that reaches it. The proposed
+      // clearing-arm write would HIDE the button the moment a momentary stall recovered, leaving a
+      // healthy, still-running council with no way to abort it: the inverse defect, and worse.
+      // Full reasoning + the regression pin: "the Abort button survives a stall -> recover cycle"
+      // in tests/workspace/live-loop.test.js.
+      //
+      // v4.4.1 M4: this line is NOT "the remedy" (that framing, from Task 16, is what this note
+      // corrects) — it is redundant on every path except one: a run that dies WHILE stalled,
+      // whose terminal openRun() refresh then rejects. On THAT path it leaves Abort visible on a
+      // run that is already dead — a false affordance, not a working safety net. Kept anyway
+      // because it is harmless: aborting a dead run is a no-op.
+      A.$('abort-btn').hidden = false;
+    } else if (A.$('banner').classList.contains('live')) {
+      // Restores whatever the DURABLE banner actually says (nothing, a schemaVersion mismatch,
+      // run.error, …) instead of just blanking it — a live-layer banner (info-unavailable or
+      // stalled) must hand back to the true state once neither condition holds, not stomp a
+      // real warning that predates it.
+      A.renderBanners();
+    }
+  }
+
+  // ---- abort (Task 16; spec §8) -----------------------------------------
+  // Confirm-gated: the dialog only ever shows/hides; workspace:abort-run is invoked
+  // solely from the confirm button below, never from opening the dialog itself.
+  function openAbortDialog() {
+    var A = window.AmicusApp;
+    A.$('dialog-abort').hidden = false;
+    A.$('dialog-abort-cancel').focus(); // Esc/Enter both land on Cancel — the safe default
+  }
+
+  $('abort-btn').addEventListener('click', openAbortDialog);
+  $('dialog-abort-cancel').addEventListener('click', function () {
+    $('dialog-abort').hidden = true;
+  });
+  $('dialog-abort-confirm').addEventListener('click', function () {
+    var A = window.AmicusApp;
+    var btn = $('dialog-abort-confirm');
+    if (btn.disabled) { return; } // a rapid second click while the first is in flight: no-op
+    btn.disabled = true;
+    A.invoke('workspace:abort-run', A.state.runId).then(function (res) {
+      btn.disabled = false;
+      $('dialog-abort').hidden = true;
+      if (!res.ok) {
+        window.AmicusRender.renderBanner(A.$('banner'), 'Abort failed: ' + (res.error || res.detail || 'unknown'), '');
+        return;
+      }
+      stopLiveLoop();
+      // ⚠️ v4.4.1 LC-8: the re-read was fire-and-forget (wsgate01 C5) — inconsistent with the
+      // live loop's terminal branch above, which was explicitly given this same handler for this
+      // same reason. If the re-read fails, the status chip never leaves 'running' and the UI shows
+      // a live run that isn't. `.catch` (not the two-argument form) is EXACTLY equivalent here and
+      // matches the sibling at the terminal branch above: there is no onFulfilled for a trailing
+      // .catch to swallow a throw out of, which is the only thing the two-argument form buys.
+      A.openRun(A.state.runId).catch(function (err) { // re-read: status flips to aborted, grey chip, no live poll
+        console.error('workspace abort: post-abort get-run refresh failed', err);
+        window.AmicusRender.renderBanner(A.$('banner'),
+          'Abort succeeded, but refreshing the run failed — reopen the run to see its final state.', '');
+      });
+    }, function (err) {
+      // ⚠️ v4.4.1 LC-8 (same handler, same class): a REJECTED invoke() left `btn.disabled = true`
+      // and the dialog open forever — the confirm button wedged with no way back — plus an
+      // unhandled rejection. workspace:abort-run's IPC handler answers {ok:false} on its own
+      // errors, so reaching here means the channel failed, not the abort.
+      console.error('workspace abort: workspace:abort-run failed', err);
+      btn.disabled = false;
+      $('dialog-abort').hidden = true;
+      window.AmicusRender.renderBanner(A.$('banner'),
+        'Abort failed: the workspace channel is unavailable' + (err && err.message ? ' — ' + err.message : ''), '');
+    });
+  });
+
+  // ⚠️ DE-ROT (F42): these three re-enter startLiveLoop on every focus/blur/visibility flip.
+  // That is only safe because startLiveLoop() calls stopLiveLoop() first, which bumps
+  // state.liveEpoch — any tick already awaiting invoke() sees the mismatch and drops instead of
+  // rescheduling itself. Without the epoch bump each flip forks a second poll chain that no stop
+  // can reach. Registered once at this file's load time (verbs.js loads before workspace-app.js,
+  // so window.AmicusApp does not exist yet — the callback bodies read it at call time via
+  // startLiveLoop/stopLiveLoop, never here).
+  document.addEventListener('visibilitychange', function () {
+    var A = window.AmicusApp;
+    if (A.state.liveTimer) { startLiveLoop(); }
+  });
+  window.addEventListener('blur', function () {
+    var A = window.AmicusApp;
+    if (A.state.liveTimer) { startLiveLoop(); }
+  });
+  window.addEventListener('focus', function () {
+    var A = window.AmicusApp;
+    if (A.state.liveTimer) { startLiveLoop(); }
+  });
+
+  window.AmicusVerbs = {
+    doFold: doFold, startLiveLoop: startLiveLoop, stopLiveLoop: stopLiveLoop, applyLive: applyLive,
+    openAbortDialog: openAbortDialog,
+  };
+})();