tickmarkr 1.81.0 → 1.83.0

package/dist/tui/cockpit/setup-cockpit.d.ts

@@ -1,8 +1,9 @@
 import { type ReactElement } from "react";
+import { Journal } from "../../run/journal.js";
 import { type TickmarkrConfig } from "../../config/config.js";
 import { type ComponentState, type JournalRow } from "./components.js";
 import type { DemoCaptures } from "./demo.js";
-import { type SetupInteractionState, type SetupKeyBinding } from "./keys.js";
+import { type RunKeyEvent, type SetupInteractionState, type SetupKeyBinding } from "./keys.js";
 export type SetupCockpitData = {
     readonly binaryVersion: string;
     readonly harnesses: readonly {
@@ -42,3 +43,147 @@ export declare function SetupCockpitFrame({ data, columns, rows, interaction, bi
     interaction?: SetupInteractionState;
     bindings?: readonly SetupKeyBinding[];
 }): ReactElement;
+/**
+ * One parked task awaiting a human decision, derived from the journal alone.
+ * The graph is never consulted: a recompile can never make a parked task read
+ * as anything but parked on this surface.
+ */
+export type ParkedDecision = {
+    readonly taskId: string;
+    /** The daemon-recorded park kind (task-human data.kind), never inferred prose. */
+    readonly kind: string;
+    readonly reason: string | undefined;
+    /** UTC HH:MM:SS sliced from the newest task-human event's ISO ts, or "unknown". */
+    readonly parkedAt: string;
+    /** Count of recorded task-dispatch events — never max(attempt)+1. */
+    readonly attempts: number;
+    /**
+     * The newest failed gate-result before the newest task-human, derived with
+     * the same rule the production approve command applies. It decides what the
+     * confirm inset may promise: uphold exists only when this is "review", and a
+     * gate-fail approve records this gate as satisfied.
+     */
+    readonly failedGate: string | undefined;
+    /**
+     * A park that is permanent by design: an id the spec retains only so the
+     * engagement can resume, gated so it never dispatches. Nothing releases it,
+     * so it is drawn read-only and neither verb is offered on it.
+     */
+    readonly tombstone: boolean;
+};
+/** The parks a verb can release — the rows the surface draws live verbs on. */
+export declare function actionableDecisions(decisions: readonly ParkedDecision[]): readonly ParkedDecision[];
+/**
+ * The decisions section's rows: one per task the journal's own status replay
+ * leaves parked on a human, in the order the journal first named them. The
+ * replay is the production one (`Journal.replayStatuses`) so this surface and
+ * `tickmarkr status` can never disagree about what is parked.
+ */
+export declare function deriveParkedDecisions(journal: Journal): readonly ParkedDecision[];
+/** The two decisions a parked task offers — the production command's two verbs. */
+export type SetupDecisionVerb = "approve" | "uphold";
+/** A decision the operator has named but not yet confirmed. */
+export type SetupDecisionCommand = {
+    readonly verb: SetupDecisionVerb;
+    readonly taskId: string;
+};
+/** What the journal file gained this session — one entry per confirmed write. */
+export type SetupDecisionWrite = {
+    readonly taskId: string;
+    readonly verb: SetupDecisionVerb;
+    /** The release marker read back from the recorded task-approved event. */
+    readonly release: string | undefined;
+    readonly by: string;
+};
+/**
+ * The observable state of the decisions surface. Every field is drawn, so a
+ * state the surface cannot show is not expressible: the confirm inset is
+ * `confirming`, the verbatim command output is `notice`, and the pending
+ * writes region is `writes`.
+ */
+export type SetupDecisionsSession = {
+    readonly selection: number;
+    readonly confirming: SetupDecisionCommand | null;
+    readonly writes: readonly SetupDecisionWrite[];
+    readonly notice: string | null;
+};
+export declare function initialSetupDecisionsSession(): SetupDecisionsSession;
+export type SetupDecisionsKeyResult = {
+    readonly session: SetupDecisionsSession;
+    /** Present only when the confirm key landed — the one moment a write may happen. */
+    readonly command?: SetupDecisionCommand;
+    readonly quit?: boolean;
+};
+/**
+ * Uphold exists only where the production command honours it: the newest
+ * failed gate before the park is the review gate. Everywhere else the key is
+ * inert and the keybar does not advertise it — the surface never promises a
+ * decision the command must refuse.
+ */
+export declare function upholdAvailable(decision: ParkedDecision): boolean;
+/**
+ * The decisions surface's whole key grammar: ↑↓ move, a approve, u uphold,
+ * y confirm, n/Esc cancel, q quit. The reducer never writes — it can only
+ * *name* a command, and only on the confirm key, so a write the operator did
+ * not predict cannot happen. a/u are inert when nothing actionable is parked,
+ * and u is inert on a park the command would refuse, matching the keybar, which
+ * then does not advertise them. Tombstone parks sit outside the grammar: the
+ * pointer never reaches one, so no key can name a decision on it.
+ */
+export declare function applySetupDecisionsKey(session: SetupDecisionsSession, event: RunKeyEvent, parked: readonly ParkedDecision[]): SetupDecisionsKeyResult;
+export type SetupDecisionOutcome = {
+    readonly ok: true;
+    readonly command: SetupDecisionCommand;
+    /** The exact string the production command returned. */
+    readonly message: string;
+    readonly write: SetupDecisionWrite;
+} | {
+    readonly ok: false;
+    readonly command: SetupDecisionCommand;
+    /** The exact string the production command threw. */
+    readonly refusal: string;
+};
+/**
+ * THE write. It calls the production `approve` command — validation, fail-closed
+ * refusals and the journal append are inherited, never re-implemented — and then
+ * reads the file back so the session records the release the journal actually
+ * gained. A refusal is the command's own message, verbatim, and appends nothing.
+ */
+export declare function executeSetupDecision(command: SetupDecisionCommand, { cwd, runId, by }: {
+    cwd: string;
+    runId: string;
+    by: string;
+}): Promise<SetupDecisionOutcome>;
+/** Fold an executed command's outcome into the session the surface draws. */
+export declare function recordSetupDecisionOutcome(session: SetupDecisionsSession, outcome: SetupDecisionOutcome): SetupDecisionsSession;
+/**
+ * The confirm inset's lines: the task, the actor, the effect and the file,
+ * stated before the single key that can write.
+ */
+export declare function setupDecisionConfirmLines(command: SetupDecisionCommand, decision: ParkedDecision | undefined, actor: string, journalFile: string): readonly string[];
+/**
+ * The decisions surface. Every row it draws — decisions, the confirm inset,
+ * the pending writes region — is measured and clipped through the width
+ * module alone (`fitCells`), so a task name carrying a ZWJ grapheme can
+ * neither overflow its row nor be cut mid-cluster. The one unclipped element
+ * is `notice`: the production command's own words, verbatim.
+ */
+export declare function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, }: {
+    decisions: readonly ParkedDecision[];
+    session: SetupDecisionsSession;
+    columns: number;
+    actor: string;
+    journalFile: string;
+}): ReactElement;
+/**
+ * The setup decisions surface on a live engagement. This is the only cockpit
+ * surface that writes, and it writes exactly one way: a confirmed approve or
+ * uphold through the production command path.
+ */
+export declare function runSetupDecisionsCockpit({ input, output, cwd, runId, actor, }: {
+    input: NodeJS.ReadStream;
+    output: NodeJS.WriteStream;
+    cwd: string;
+    runId: string;
+    actor?: string;
+}): Promise<void>;

package/dist/tui/cockpit/setup-cockpit.js

@@ -1,14 +1,24 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { Box } from "ink";
-import { cloneElement, } from "react";
+import { Box, render, useApp, useInput, useStdout } from "ink";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { cloneElement, createElement, useState, } from "react";
 import { parse } from "yaml";
+import { approve } from "../../cli/commands/approve.js";
+import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, REVIEW_UPHELD_RELEASE, } from "../../run/journal.js";
 import { BANNER, GLYPHS, PLAIN_BANNER, } from "../../brand.js";
 import { DEFAULT_CONFIG, INTEGRITY_FLOOR_SHAPES, TIER_RANK, TickmarkrConfigSchema, unifiedYamlDiff, } from "../../config/config.js";
-import { SHAPES } from "../../graph/schema.js";
+import { GATE_NAMES, SHAPES } from "../../graph/schema.js";
+import { stateDirName } from "../../graph/graph.js";
 import { allocateBandColumns, BandLines, BodyText, CockpitGrid, composeBandLine, JournalRowPanel, measureBandRows, Panel, StateGlyph, StatTile, StatusStrip, } from "./components.js";
 import { FULL_JOURNAL_ROWS, resolveCockpitLayout, } from "./layout.js";
 import { deriveRunCockpitData, PANEL_CHROME_ROWS, panelRows, wrappedRows, } from "./run-cockpit.js";
 import { initialSetupInteractionState, keybarEntries, SETUP_PANEL_FOCUS_ORDER, SURFACE_KEY_BINDINGS, } from "./keys.js";
+import { DECISIONS_TAB_HINT, DECISIONS_TAB_TITLE, } from "./views.js";
+// Split across two statements because `setup.test.ts` pins the clipping import
+// by its exact text, proving the rows are drawn through the width module.
+import { fitCells } from "./width.js";
+import { cellWidth } from "./width.js";
 const APPROVED_SIDE_RAIL_COLUMN_FLOOR = 80;
 const setupAdditionalBindings = (bindings) => bindings.filter((binding) => !SURFACE_KEY_BINDINGS.run.some((runBinding) => runBinding.key === binding.key));
 function deepMerge(base, overlay) {
@@ -191,7 +201,7 @@ function KeysPanel({ bindings, width = 16, focused = false, }) {
 }
 function CompactKeysPanel({ bindings, width = 16, focused = false, }) {
     const contentColumns = Math.max(1, width - 4);
-    return (_jsx(Panel, { title: "KEYS", width: width, focused: focused, children: keybarEntries(setupAdditionalBindings(bindings)).map((item) => (_jsxs(Box, { flexDirection: "row", flexWrap: "nowrap", height: 1, overflow: "hidden", children: [_jsx(BodyText, { emphasis: "strong", children: item.key }), _jsxs(BodyText, { children: [" ", item.label.slice(0, Math.max(0, contentColumns - [...item.key].length - 1))] })] }, item.key))) }));
+    return (_jsx(Panel, { title: "KEYS", width: width, focused: focused, children: keybarEntries(setupAdditionalBindings(bindings)).map((item) => (_jsxs(Box, { flexDirection: "row", flexWrap: "nowrap", height: 1, overflow: "hidden", children: [_jsx(BodyText, { emphasis: "strong", children: item.key }), _jsxs(BodyText, { children: [" ", item.label.slice(0, Math.max(0, contentColumns - cellWidth(item.key) - 1))] })] }, item.key))) }));
 }
 function SetupKeybar({ bindings, width, }) {
     return (_jsx(Box, { flexDirection: "row", flexWrap: "nowrap", width: width, height: 1, overflow: "hidden", "aria-label": "setup cockpit keys", children: keybarEntries(bindings).map((item, index) => (_jsxs(Box, { flexShrink: 0, children: [index > 0 && _jsx(BodyText, { emphasis: "dim", children: " \u00B7 " }), _jsx(BodyText, { emphasis: "strong", children: item.key }), _jsxs(BodyText, { emphasis: "dim", children: [" ", item.label] })] }, item.key))) }));
@@ -448,7 +458,7 @@ function setupDetailPlan(rows, data, inner, base, journalPreferred) {
     };
 }
 function versionColumnWidth(data) {
-    return Math.max(...identityVersionLines(data).map((line) => [...line].length));
+    return Math.max(...identityVersionLines(data).map((line) => cellWidth(line)));
 }
 /**
  * The banner sits beside the version column, so a narrow frame leaves it fewer
@@ -530,3 +540,325 @@ export function SetupCockpitFrame({ data, columns, rows, interaction, bindings =
                         ? (_jsx(Box, { width: resolvedSidePanelWidth, flexShrink: 0, children: _jsx(KeysPanel, { bindings: bindings, width: resolvedSidePanelWidth, focused: focusedPanel === "KEYS" }) }))
                         : (_jsx(Box, { width: resolvedSidePanelWidth, flexShrink: 0, children: _jsx(CompactKeysPanel, { bindings: bindings, width: resolvedSidePanelWidth, focused: focusedPanel === "KEYS" }) })))] }), _jsx(StatusStrip, { width: columns, items: setupStatusItems(data, currentInteraction) }), _jsx(SetupKeybar, { bindings: bindings, width: columns })] }));
 }
+/**
+ * There is no closed park kind for a declaration-shaped retirement, so the
+ * evidence read here is the one the daemon recorded: a pre-dispatch human-gate
+ * park whose reason carries the task's own title, and that title is where the
+ * spec declares the tombstone. Read narrowly on purpose — every other park kind
+ * is actionable no matter what its prose says.
+ */
+function isTombstonePark(kind, reason) {
+    return kind === "human-gate" && /\btombstone\b/iu.test(reason ?? "");
+}
+/** The parks a verb can release — the rows the surface draws live verbs on. */
+export function actionableDecisions(decisions) {
+    return decisions.filter((decision) => !decision.tombstone);
+}
+/**
+ * The decisions section's rows: one per task the journal's own status replay
+ * leaves parked on a human, in the order the journal first named them. The
+ * replay is the production one (`Journal.replayStatuses`) so this surface and
+ * `tickmarkr status` can never disagree about what is parked.
+ */
+export function deriveParkedDecisions(journal) {
+    const statuses = journal.replayStatuses();
+    const events = journal.read();
+    const decisions = [];
+    for (const [taskId, status] of statuses) {
+        if (status !== "human")
+            continue;
+        let parkedIndex = -1;
+        let attempts = 0;
+        for (let index = 0; index < events.length; index += 1) {
+            const event = events[index];
+            if (event.taskId !== taskId)
+                continue;
+            if (event.event === "task-dispatch")
+                attempts += 1;
+            else if (event.event === "task-human")
+                parkedIndex = index;
+        }
+        const parked = parkedIndex >= 0 ? events[parkedIndex] : undefined;
+        // The same rule the production approve command applies: the newest failed
+        // gate-result before the newest task-human controls what approve records
+        // and whether uphold exists at all. Never inferred from the park's prose.
+        const failedGate = events.slice(0, Math.max(0, parkedIndex)).reverse().find((event) => event.event === "gate-result" && event.taskId === taskId && event.data.pass === false
+            && typeof event.data.gate === "string"
+            && GATE_NAMES.includes(event.data.gate))?.data.gate;
+        const kind = typeof parked?.data.kind === "string" ? parked.data.kind : "human-gate";
+        const reason = typeof parked?.data.reason === "string" ? parked.data.reason : undefined;
+        decisions.push({
+            taskId,
+            kind,
+            reason,
+            parkedAt: typeof parked?.ts === "string" && parked.ts.length >= 19
+                ? parked.ts.slice(11, 19)
+                : "unknown",
+            attempts,
+            failedGate,
+            tombstone: isTombstonePark(kind, reason),
+        });
+    }
+    return decisions;
+}
+export function initialSetupDecisionsSession() {
+    return { selection: 0, confirming: null, writes: [], notice: null };
+}
+/**
+ * Uphold exists only where the production command honours it: the newest
+ * failed gate before the park is the review gate. Everywhere else the key is
+ * inert and the keybar does not advertise it — the surface never promises a
+ * decision the command must refuse.
+ */
+export function upholdAvailable(decision) {
+    return decision.failedGate === "review";
+}
+/**
+ * The decisions surface's whole key grammar: ↑↓ move, a approve, u uphold,
+ * y confirm, n/Esc cancel, q quit. The reducer never writes — it can only
+ * *name* a command, and only on the confirm key, so a write the operator did
+ * not predict cannot happen. a/u are inert when nothing actionable is parked,
+ * and u is inert on a park the command would refuse, matching the keybar, which
+ * then does not advertise them. Tombstone parks sit outside the grammar: the
+ * pointer never reaches one, so no key can name a decision on it.
+ */
+export function applySetupDecisionsKey(session, event, parked) {
+    const decisions = actionableDecisions(parked);
+    if (session.confirming !== null) {
+        if (event.input === "y") {
+            return {
+                session: { ...session, confirming: null },
+                command: session.confirming,
+            };
+        }
+        if (event.input === "n" || event.key.escape === true) {
+            return { session: { ...session, confirming: null } };
+        }
+        return { session };
+    }
+    if (event.input === "q")
+        return { session, quit: true };
+    const selection = Math.min(session.selection, Math.max(0, decisions.length - 1));
+    if (event.key.upArrow === true || event.key.downArrow === true) {
+        if (decisions.length === 0)
+            return { session };
+        const delta = event.key.upArrow === true ? -1 : 1;
+        return {
+            session: {
+                ...session,
+                selection: Math.max(0, Math.min(decisions.length - 1, selection + delta)),
+            },
+        };
+    }
+    if (event.input === "a" || event.input === "u") {
+        const decision = decisions[selection];
+        if (decision === undefined)
+            return { session };
+        if (event.input === "u" && !upholdAvailable(decision))
+            return { session };
+        return {
+            session: {
+                ...session,
+                selection,
+                confirming: {
+                    verb: event.input === "a" ? "approve" : "uphold",
+                    taskId: decision.taskId,
+                },
+            },
+        };
+    }
+    return { session };
+}
+/**
+ * THE write. It calls the production `approve` command — validation, fail-closed
+ * refusals and the journal append are inherited, never re-implemented — and then
+ * reads the file back so the session records the release the journal actually
+ * gained. A refusal is the command's own message, verbatim, and appends nothing.
+ */
+export async function executeSetupDecision(command, { cwd, runId, by }) {
+    try {
+        const message = await approve([
+            runId,
+            command.taskId,
+            ...(command.verb === "uphold" ? ["--uphold"] : []),
+            "--by",
+            by,
+        ], cwd);
+        const events = Journal.open(cwd, runId).read();
+        let release;
+        for (let index = events.length - 1; index >= 0; index -= 1) {
+            const event = events[index];
+            if (event.event === "task-approved" && event.taskId === command.taskId) {
+                release = typeof event.data.release === "string" ? event.data.release : undefined;
+                break;
+            }
+        }
+        return {
+            ok: true,
+            command,
+            message,
+            write: { taskId: command.taskId, verb: command.verb, release, by },
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            command,
+            refusal: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/** Fold an executed command's outcome into the session the surface draws. */
+export function recordSetupDecisionOutcome(session, outcome) {
+    return outcome.ok
+        ? { ...session, notice: outcome.message, writes: [...session.writes, outcome.write] }
+        : { ...session, notice: outcome.refusal };
+}
+/** The text of one decisions row — measured and clipped only by the width module. */
+function decisionRowText(decision) {
+    return `${decision.taskId} · ${decision.kind} · parked ${decision.parkedAt}`
+        + ` · attempt ${decision.attempts}`
+        + (decision.reason === undefined ? "" : ` · ${decision.reason}`);
+}
+/**
+ * The effect the confirmed write will actually have, derived from the park
+ * kind and the failed gate the same way the production command derives its
+ * append — the release markers are the command's own constants, so this text
+ * cannot drift from the write. An effect the operator cannot read here is an
+ * effect this surface does not have.
+ */
+function decisionEffectLines(command, decision) {
+    if (command.verb === "uphold") {
+        return [
+            `effect appends one task-approved event with release ${REVIEW_UPHELD_RELEASE};`
+                + " the next resume funds one fixed attempt carrying the findings",
+            "it does NOT mark the task done or pass any gate",
+        ];
+    }
+    if (decision?.kind === "gate-fail") {
+        if (decision.failedGate === undefined) {
+            // The command's own refusal, predicted: no write is promised here.
+            return [
+                "effect none — the command refuses: parked on gate-fail"
+                    + " but no failed gate result is recorded",
+            ];
+        }
+        const gate = decision.failedGate;
+        return [
+            `effect appends one task-approved event with release ${GATE_SATISFIED_RELEASE}`
+                + ` for gate ${gate}; the next resume continues past the approved gate`,
+            `it marks gate ${gate} satisfied; it does NOT mark the task done`,
+        ];
+    }
+    if (decision?.kind === ATTEMPT_CAP_RELEASE) {
+        return [
+            `effect appends one task-approved event with release ${ATTEMPT_CAP_RELEASE};`
+                + ` the next resume dispatches ${command.taskId} with a fresh attempt budget`,
+            "it does NOT mark the task done or pass any gate",
+        ];
+    }
+    return [
+        "effect appends one task-approved event with no release;"
+            + ` the next resume dispatches ${command.taskId}`,
+        "it does NOT mark the task done or pass any gate",
+    ];
+}
+/**
+ * The confirm inset's lines: the task, the actor, the effect and the file,
+ * stated before the single key that can write.
+ */
+export function setupDecisionConfirmLines(command, decision, actor, journalFile) {
+    return [
+        `task   ${command.taskId}${decision === undefined ? "" : ` · ${decision.kind} · attempt ${decision.attempts}`}`,
+        `actor  ${actor}`,
+        ...decisionEffectLines(command, decision),
+        `file   ${journalFile} · append only`,
+        `y ${command.verb} · n cancel`,
+    ];
+}
+/** The keybar the surface's state can actually honour — nothing else is drawn. */
+function setupDecisionsKeybar(session, decisions) {
+    if (session.confirming !== null)
+        return "y Confirm · n Cancel";
+    if (decisions.length === 0)
+        return "q Quit";
+    const selected = Math.min(session.selection, decisions.length - 1);
+    const uphold = upholdAvailable(decisions[selected]) ? " · u Uphold" : "";
+    return `↑↓ Move · a Approve${uphold} · q Quit`;
+}
+/**
+ * What the tab is, drawn on the tab it names. The operator's v1.83 UAT read
+ * "Setup" as configuration; this surface configures nothing, so it says what it
+ * does and what it may write, from the one constant the tab strip and the
+ * keybar hint also draw.
+ */
+const DECISIONS_TAB_LINE = `tab ${DECISIONS_TAB_HINT} · journal-parked human decisions`
+    + " · approve and uphold are its only writes";
+/**
+ * What the section says when no park needs the operator. It names its own
+ * trigger and both verbs, so an operator who arrives at a quiet surface learns
+ * what would put a row here rather than reading the quiet as unfinished work.
+ */
+const DECISIONS_EMPTY_STATE = [
+    "nothing needs you now — no task is parked on a human gate",
+    "a task that parks on one appears here with its two decisions —"
+        + " approve releases it, uphold sides with the reviewer",
+];
+/**
+ * The decisions surface. Every row it draws — decisions, the confirm inset,
+ * the pending writes region — is measured and clipped through the width
+ * module alone (`fitCells`), so a task name carrying a ZWJ grapheme can
+ * neither overflow its row nor be cut mid-cluster. The one unclipped element
+ * is `notice`: the production command's own words, verbatim.
+ */
+export function SetupDecisionsSurface({ decisions, session, columns, actor, journalFile, }) {
+    const inner = Math.max(1, Math.floor(columns) - 4);
+    const actionable = actionableDecisions(decisions);
+    const tombstones = decisions.filter((decision) => decision.tombstone);
+    const selected = Math.min(session.selection, Math.max(0, actionable.length - 1));
+    const confirming = session.confirming;
+    return (_jsxs(Box, { flexDirection: "column", width: columns, children: [_jsxs(Panel, { title: `${DECISIONS_TAB_TITLE} · ${decisions.length} parked`, focused: true, children: [_jsx(BodyText, { emphasis: "dim", children: fitCells(DECISIONS_TAB_LINE, inner) }), actionable.map((decision, index) => (_jsx(BodyText, { emphasis: index === selected ? "strong" : "normal", children: fitCells(`${index === selected ? `${GLYPHS.pointer} ` : "  "}${decisionRowText(decision)}`, inner) }, decision.taskId))), actionable.length === 0 && DECISIONS_EMPTY_STATE.map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))), tombstones.map((decision) => (_jsx(BodyText, { emphasis: "dim", children: fitCells(`  read-only · permanent by design · ${decisionRowText(decision)}`, inner) }, decision.taskId)))] }), confirming !== null && (_jsx(Panel, { title: `CONFIRM ${confirming.verb.toUpperCase()}`, focused: true, children: setupDecisionConfirmLines(confirming, decisions.find((decision) => decision.taskId === confirming.taskId), actor, journalFile).map((line) => (_jsx(BodyText, { children: fitCells(line, inner) }, line))) })), session.notice !== null && _jsx(BodyText, { children: session.notice }), _jsx(Panel, { title: "PENDING WRITES", children: session.writes.length === 0
+                    ? _jsx(BodyText, { children: fitCells("nothing written this session", inner) })
+                    : session.writes.map((write) => (_jsx(BodyText, { children: fitCells(`${write.verb} ${write.taskId} · release ${write.release ?? "none"} · by ${write.by}`, inner) }, `${write.verb}:${write.taskId}`))) }), _jsx(BodyText, { emphasis: "dim", children: fitCells(setupDecisionsKeybar(session, actionable), Math.max(1, Math.floor(columns))) })] }));
+}
+function SetupDecisionsApp({ cwd, runId, actor, }) {
+    const { exit } = useApp();
+    const { stdout } = useStdout();
+    const readDecisions = () => deriveParkedDecisions(Journal.open(cwd, runId));
+    const [decisions, setDecisions] = useState(readDecisions);
+    const [session, setSession] = useState(initialSetupDecisionsSession);
+    useInput((input, key) => {
+        if (key.ctrl && input === "c") {
+            exit();
+            return;
+        }
+        const result = applySetupDecisionsKey(session, { input, key }, decisions);
+        setSession(result.session);
+        if (result.quit === true)
+            exit();
+        if (result.command !== undefined) {
+            const command = result.command;
+            void executeSetupDecision(command, { cwd, runId, by: actor }).then((outcome) => {
+                setSession((current) => recordSetupDecisionOutcome(current, outcome));
+                // Re-derive from the file the write landed in: the released task's row
+                // leaves the section because the journal says so, not because we say so.
+                setDecisions(readDecisions());
+            });
+        }
+    });
+    return (_jsx(SetupDecisionsSurface, { decisions: decisions, session: session, columns: stdout.columns ?? 80, actor: actor, journalFile: join(stateDirName(cwd), "runs", runId, "journal.jsonl") }));
+}
+/**
+ * The setup decisions surface on a live engagement. This is the only cockpit
+ * surface that writes, and it writes exactly one way: a confirmed approve or
+ * uphold through the production command path.
+ */
+export async function runSetupDecisionsCockpit({ input, output, cwd, runId, actor = userInfo().username, }) {
+    const app = render(createElement(SetupDecisionsApp, { cwd, runId, actor }), { stdin: input, stdout: output, exitOnCtrlC: false, patchConsole: false });
+    try {
+        await app.waitUntilExit();
+    }
+    finally {
+        app.unmount();
+    }
+}

package/dist/tui/cockpit/views.d.ts

@@ -0,0 +1,72 @@
+/** The run cockpit's rail order. Number keys are one-based positions here. */
+export declare const RUN_VIEWS: readonly [{
+    readonly id: "run";
+    readonly label: "Run";
+    readonly title: "RUN";
+    readonly detailTitle: "RUN DETAIL";
+}, {
+    readonly id: "tasks";
+    readonly label: "Tasks";
+    readonly title: "TASKS";
+    readonly detailTitle: "TASK DETAIL";
+}, {
+    readonly id: "gates";
+    readonly label: "Gates";
+    readonly title: "GATES";
+    readonly detailTitle: "GATE DETAIL";
+}, {
+    readonly id: "journal";
+    readonly label: "Journal";
+    readonly title: "JOURNAL";
+    readonly detailTitle: "EVENT DETAIL";
+}, {
+    readonly id: "fleet";
+    readonly label: "Fleet";
+    readonly title: "FLEET";
+    readonly detailTitle: "CHANNEL DETAIL";
+}];
+export type RunView = (typeof RUN_VIEWS)[number];
+export type RunViewId = RunView["id"];
+export declare function runViewAt(index: number): RunView | undefined;
+export declare function runViewById(id: RunViewId): RunView;
+/** Rail movement stops at either end; it never points outside the five views. */
+export declare function moveRunViewSelection(selection: number, delta: number): number;
+/** A one-based number key's view, or undefined for a digit the rail does not own. */
+export declare function runViewForNumber(input: string): RunView | undefined;
+/**
+ * The second tab's drawn name. It was SETUP through v1.83; the operator's UAT
+ * read that as configuration, and what the tab draws is journal-parked human
+ * decisions whose only writes are approve and uphold. Stated once here so the
+ * tab strip, the keybar hint and the surface's own header cannot drift apart.
+ */
+export declare const DECISIONS_TAB_TITLE = "DECISIONS";
+/** The same name in the keybar's sentence case — the word drawn beside Tab. */
+export declare const DECISIONS_TAB_HINT = "Decisions";
+/**
+ * The decisions tab's rail. Every label fits the rail's own column unwrapped —
+ * a wrapped rail row is a row nothing charges to the height budget, and that is
+ * what pushed the surface past a 14-row terminal. Read-only sections say so in
+ * their body, not in a label long enough to wrap.
+ */
+export declare const SETUP_SECTIONS: readonly [{
+    readonly id: "decisions";
+    readonly label: "Decisions";
+    readonly title: "DECISIONS";
+    readonly readOnly: false;
+}, {
+    readonly id: "fleet";
+    readonly label: "Fleet";
+    readonly title: "FLEET";
+    readonly readOnly: true;
+}, {
+    readonly id: "config";
+    readonly label: "Config";
+    readonly title: "CONFIG";
+    readonly readOnly: true;
+}];
+export type SetupSection = (typeof SETUP_SECTIONS)[number];
+export type SetupSectionId = SetupSection["id"];
+/** The section a rail position names; out-of-range positions clamp to the rail. */
+export declare function setupSectionAt(index: number): SetupSection;
+/** Rail movement stops at either end; it never points outside the sections. */
+export declare function moveSetupSectionSelection(selection: number, delta: number): number;

package/dist/tui/cockpit/views.js

@@ -0,0 +1,56 @@
+/** The run cockpit's rail order. Number keys are one-based positions here. */
+export const RUN_VIEWS = [
+    { id: "run", label: "Run", title: "RUN", detailTitle: "RUN DETAIL" },
+    { id: "tasks", label: "Tasks", title: "TASKS", detailTitle: "TASK DETAIL" },
+    { id: "gates", label: "Gates", title: "GATES", detailTitle: "GATE DETAIL" },
+    { id: "journal", label: "Journal", title: "JOURNAL", detailTitle: "EVENT DETAIL" },
+    { id: "fleet", label: "Fleet", title: "FLEET", detailTitle: "CHANNEL DETAIL" },
+];
+export function runViewAt(index) {
+    return Number.isInteger(index) ? RUN_VIEWS[index] : undefined;
+}
+export function runViewById(id) {
+    return RUN_VIEWS.find((view) => view.id === id) ?? RUN_VIEWS[0];
+}
+/** Rail movement stops at either end; it never points outside the five views. */
+export function moveRunViewSelection(selection, delta) {
+    return Math.max(0, Math.min(RUN_VIEWS.length - 1, selection + delta));
+}
+/** A one-based number key's view, or undefined for a digit the rail does not own. */
+export function runViewForNumber(input) {
+    if (!/^\d$/u.test(input))
+        return undefined;
+    return runViewAt(Number(input) - 1);
+}
+/**
+ * The second tab's drawn name. It was SETUP through v1.83; the operator's UAT
+ * read that as configuration, and what the tab draws is journal-parked human
+ * decisions whose only writes are approve and uphold. Stated once here so the
+ * tab strip, the keybar hint and the surface's own header cannot drift apart.
+ */
+export const DECISIONS_TAB_TITLE = "DECISIONS";
+/** The same name in the keybar's sentence case — the word drawn beside Tab. */
+export const DECISIONS_TAB_HINT = "Decisions";
+/**
+ * The decisions tab's rail. Every label fits the rail's own column unwrapped —
+ * a wrapped rail row is a row nothing charges to the height budget, and that is
+ * what pushed the surface past a 14-row terminal. Read-only sections say so in
+ * their body, not in a label long enough to wrap.
+ */
+export const SETUP_SECTIONS = [
+    { id: "decisions", label: "Decisions", title: "DECISIONS", readOnly: false },
+    { id: "fleet", label: "Fleet", title: "FLEET", readOnly: true },
+    { id: "config", label: "Config", title: "CONFIG", readOnly: true },
+];
+/** The section a rail position names; out-of-range positions clamp to the rail. */
+export function setupSectionAt(index) {
+    const clamped = Math.max(0, Math.min(SETUP_SECTIONS.length - 1, Math.floor(index)));
+    return SETUP_SECTIONS[clamped];
+}
+/** Rail movement stops at either end; it never points outside the sections. */
+export function moveSetupSectionSelection(selection, delta) {
+    return Math.max(0, Math.min(SETUP_SECTIONS.length - 1, selection + delta));
+}
+// Sections carry no number key: 1–5 names a view on the whole surface, and a
+// digit that meant a section here would be the same key with two meanings.
+// The sections are reached the way the contract gives them — ↑↓ and ⏎.