tickmarkr 2.5.7 → 2.5.9

package/dist/tui/ink/fleet-app.js

@@ -3,6 +3,7 @@ import { Box, render, Text, useApp, useInput } from "ink";
 import { useRef, useState } from "react";
 import { MODEL_ID_RE } from "../../adapters/types.js";
 import { retiredModelReason } from "../../adapters/model-lints.js";
+import { DENY_SCOPES, denyBlockFrom, denyEntriesAt, initialDenyPropOf, stagedDenyKeyOf } from "../../config/config.js";
 import { fleetFirstTouchProvenance } from "../../config/fleet-overlay.js";
 import { exclusionReason } from "../../config/fleet-why.js";
 import { entryMatchesChannel, exclusionCollector } from "../../route/preference.js";
@@ -10,6 +11,11 @@ import { TIERS } from "../../graph/schema.js";
 import { windowRows } from "./components.js";
 import { clip, clipPathTail, ElisionMark, enterAltScreen, fmtCtx, fmtMs, fmtUsdPair, Glyph, INK, inkInput, inkOutput, KeyBar, OverlayPanel, padCell, padCellStart, Pointer, SearchRow, } from "./frame.js";
 const STEERING_KEYS = ["review", "consult"];
+/** every scope's staged list, empty — the "every policy scope open" probe the picker lifts against */
+export const openStagedDeny = () => ({
+    ...Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), []])),
+    allowOut: [],
+});
 const CHANNELS = ["sub", "api"];
 export function formatDoctorAge(ageMs) {
     if (ageMs === null)
@@ -25,9 +31,17 @@ function splitSeat(seat) {
     const at = seat.indexOf(":");
     return { adapter: seat.slice(0, at), model: seat.slice(at + 1) };
 }
-export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels, initialAllowOut = [], initialDenyWorkersAdapters = [], initialDenyWorkersModels = [], modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, }) {
+const REACH_CHOICES = [
+    { id: "in", label: "in", gloss: "every seat may route here" },
+    { id: "out-workers", label: "out · workers", gloss: "workers skip it; judge/review/consult unaffected" },
+    { id: "out-all", label: "out · all seats", gloss: "no seat routes here" },
+];
+export function FleetApp({ ageMs, agents, initialAllowOut = [], modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, ...initialDenyProps }) {
     const { exit } = useApp();
     const [, setRevision] = useState(0);
+    // the props are the fleet command's contract, one per schema-enumerated scope (initialDeny…),
+    // read by a loop so a scope the schema gains seeds its set without a hand field (OBS-1099 add.1)
+    const initialDeny = Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, initialDenyProps[initialDenyPropOf(scope)] ?? []]));
     const uiRef = useRef(null);
     uiRef.current ??= {
         focus: "list",
@@ -43,11 +57,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         presetsSeen: false,
         notice: "",
         lastEdit: null,
-        deny: new Set(initialDenyAdapters),
-        denyModels: new Set(initialDenyModels),
         allowOut: new Set(initialAllowOut),
-        denyWorkersAdapters: new Set(initialDenyWorkersAdapters),
-        denyWorkersModels: new Set(initialDenyWorkersModels),
+        ...Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, new Set(initialDeny[scope.key])])),
         classifications: [],
         selectedMode: initialMode,
         map: structuredClone(initialMap),
@@ -63,42 +74,23 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     const bump = () => setRevision((revision) => revision + 1);
     // OBS-521/OBS-522: one truth for "is there staged work" — the Esc/q loss guard, the header
     // chip, and the empty-`w` notice all read it. Counts staged EDITS, not diff hunks.
-    const initialDenySet = new Set(initialDenyAdapters);
-    const initialDenyModelSet = new Set(initialDenyModels);
     const initialAllowOutSet = new Set(initialAllowOut);
-    const initialDenyWorkersAdapterSet = new Set(initialDenyWorkersAdapters);
-    const initialDenyWorkersModelSet = new Set(initialDenyWorkersModels);
     const stagedCount = () => {
         let n = ui.classifications.length
             + (ui.selectedMode !== initialMode ? 1 : 0)
             + (ui.judgeSeat !== null ? 1 : 0);
-        for (const adapter of ui.deny)
-            if (!initialDenySet.has(adapter))
-                n += 1;
-        for (const adapter of initialDenySet)
-            if (!ui.deny.has(adapter))
-                n += 1;
-        for (const model of ui.denyModels)
-            if (!initialDenyModelSet.has(model))
-                n += 1;
-        for (const model of initialDenyModelSet)
-            if (!ui.denyModels.has(model))
-                n += 1;
+        for (const scope of DENY_SCOPES) {
+            const before = new Set(initialDeny[scope.key]);
+            for (const entry of ui[scope.key])
+                if (!before.has(entry))
+                    n += 1;
+            for (const entry of before)
+                if (!ui[scope.key].has(entry))
+                    n += 1;
+        }
         for (const key of initialAllowOutSet)
             if (!ui.allowOut.has(key))
                 n += 1;
-        for (const adapter of ui.denyWorkersAdapters)
-            if (!initialDenyWorkersAdapterSet.has(adapter))
-                n += 1;
-        for (const adapter of initialDenyWorkersAdapterSet)
-            if (!ui.denyWorkersAdapters.has(adapter))
-                n += 1;
-        for (const model of ui.denyWorkersModels)
-            if (!initialDenyWorkersModelSet.has(model))
-                n += 1;
-        for (const model of initialDenyWorkersModelSet)
-            if (!ui.denyWorkersModels.has(model))
-                n += 1;
         for (const shape of new Set([...Object.keys(initialMap), ...Object.keys(ui.map)])) {
             // {} ≡ absent: pin-then-auto leaves an empty entry that writes nothing — not staged work
             if (JSON.stringify(initialMap[shape] ?? {}) !== JSON.stringify(ui.map[shape] ?? {}))
@@ -133,18 +125,28 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 key,
                 policy: stagedRouting
                     ? stagedRouting(deny)
-                    : { ok: true, routing: { deny: { adapters: deny.adapters, models: deny.models, workers: { adapters: deny.workersAdapters, models: deny.workersModels } } } },
+                    : { ok: true, routing: { deny: denyBlockFrom(denyLists()) } },
             };
         }
         return routingMemo.policy;
     };
+    // OBS-1099 add.1: the browser's deny discovery ranges over the schema-enumerated scopes (the
+    // route collector names its four paths by hand, so a scope the schema gains would never render
+    // or lift here). A flat scope reaches every seat; a nested one only the seat its block names
+    // (workers → worker). The allow exclusion (by absence, never lifted) stays the collector's.
+    const scopeReaches = (scope, role) => scope.path.length === 3 || scope.path[2] === `${role}s`;
+    const exclusionsOf = (channel, routing, role) => [
+        ...DENY_SCOPES.filter((scope) => scopeReaches(scope, role)).flatMap((scope) => (denyEntriesAt(routing, scope) ?? []).filter((entry) => entryMatchesChannel(entry, channel, true))
+            .map((entry) => ({ scope: scope.dotted, path: scope.dotted, configPath: scope.dotted, entry, by: "deny" }))),
+        ...exclusionCollector(channel, routing, role).filter((found) => found.by === "allow"),
+    ];
     const reachFor = (adapter, model, identity) => {
         const policy = stagedPolicy();
         if (!policy.ok)
             return { reach: "unknown", reasons: [`preview unavailable (${policy.error})`], uncoveredAlias: false };
         const channel = { adapter, model, ...(identity !== undefined ? { identity } : {}) };
-        const worker = exclusionCollector(channel, policy.routing, "worker");
-        const allSeats = exclusionCollector(channel, policy.routing, "judge");
+        const worker = exclusionsOf(channel, policy.routing, "worker");
+        const allSeats = exclusionsOf(channel, policy.routing, "judge");
         const reach = allSeats.some((scope) => scope.by === "deny") ? "out-all"
             : allSeats.length ? "out-allow"
                 : worker.length ? "out-workers"
@@ -155,6 +157,109 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             uncoveredAlias: identity !== undefined && !worker.some((scope) => scope.by === "deny"),
         };
     };
+    // OBS-1099 review: a displayed row may fold several discovered gateway ids (foldedModels);
+    // each folded id is a real channel the policy matches on its own, so every one but a row's
+    // own id counts as a sibling — an entry covering a folded id is shared, never row-owned
+    const displayedChannels = () => modelGroups.flatMap((group) => group.rows
+        .flatMap((other) => (other.foldedModels?.length ? other.foldedModels : [other.model])
+        .map((model) => ({ adapter: group.adapter, model, identity: other.evidence?.identity }))));
+    const siblingsOf = (self) => displayedChannels()
+        .filter((other) => other.adapter !== self.adapter || other.model !== self.model);
+    // Judge c3 (R107): exactly ONE selected entry per act — the channel's adapter:model key when it
+    // is a candidate, else the first candidate in sorted order; only an entry no sibling matches
+    const selectOwn = (entries, self) => {
+        const others = siblingsOf(self);
+        const candidates = [...entries].filter((entry) => entryMatchesChannel(entry, self, true)
+            && !others.some((other) => entryMatchesChannel(entry, other, true)));
+        const id = `${self.adapter}:${self.model}`;
+        return candidates.includes(id) ? id : candidates.sort()[0];
+    };
+    // OBS-1099 add.1: the scope order every row edit ranks by — shallow scopes first, the models
+    // list before its adapters sibling (the row-edit order every prior round used) — derived from
+    // the schema enumeration, never listed by hand
+    const SCOPED = [...DENY_SCOPES].sort((a, b) => a.path.length - b.path.length
+        || Number(b.path[b.path.length - 1] === "models") - Number(a.path[a.path.length - 1] === "models"));
+    const scopeOf = (dotted) => DENY_SCOPES.find((scope) => scope.dotted === dotted);
+    const denySets = () => SCOPED.map((scope) => [ui[scope.key], scope.dotted]);
+    // D-233: adapter-wideness is a property of the ENTRY's grammar (a bare adapter id), never of
+    // the config PATH — both .adapters lists accept adapter, model and adapter:model entries alike
+    const isAdapterWide = (entry, self) => !entry.includes(":") && entry === self.adapter;
+    /** the one row-owned deny entry a picker lift may take — never an allow exclusion, and never an
+     * adapter-wide entry (review round 2: an adapter with one displayed channel would otherwise
+     * count as owning its whole adapter entry) */
+    const ownDeny = (self) => {
+        for (const [set, scope] of denySets()) {
+            const entry = selectOwn(new Set([...set].filter((e) => !isAdapterWide(e, self))), self);
+            if (entry !== undefined)
+                return { entry, scope };
+        }
+        return undefined;
+    };
+    const liftEntry = ({ entry, scope }) => {
+        const found = scopeOf(scope);
+        if (found)
+            ui[found.key] = new Set([...ui[found.key]].filter((staged) => staged !== entry));
+    };
+    // Review round 10: the ONE ordered selector both the detail line and the reach edit read — every
+    // deny entry this row owns alone (never adapter-wide, never one a displayed sibling matches),
+    // the row's own key first (judge c3), then scope order models → adapters → workers.models →
+    // workers.adapters, alphabetical within a scope (the row-edit order every prior round used).
+    const SCOPE_ORDER = SCOPED.map((scope) => scope.dotted);
+    // Read over the RAW staged sets, never the validated policy: the writer restates a flat deny
+    // in the allow form, and a row must still find the entry it authored a press ago.
+    const ownedDenies = (self) => {
+        const own = `${self.adapter}:${self.model}`;
+        const others = siblingsOf(self);
+        const routing = { deny: denyBlockFrom(denyLists()) };
+        return exclusionsOf(self, routing, "worker")
+            .filter((found) => found.by === "deny" && !isAdapterWide(found.entry, self)
+            && !others.some((other) => entryMatchesChannel(found.entry, other, true)))
+            .map((found) => ({ entry: found.entry, scope: found.configPath }))
+            .sort((a, b) => Number(b.entry === own) - Number(a.entry === own)
+            || SCOPE_ORDER.indexOf(a.scope) - SCOPE_ORDER.indexOf(b.scope) || a.entry.localeCompare(b.entry));
+    };
+    // a nested scope (routing.deny.workers.*) denies workers only; a flat one denies every seat
+    const WORKERS_SCOPES = SCOPED.filter((scope) => scope.path.length > 3).map((scope) => scope.dotted);
+    const FLAT_SCOPES = SCOPED.filter((scope) => scope.path.length === 3).map((scope) => scope.dotted);
+    // the adapter rail edits only the `adapters` leaves — its own adapter-id entries (D-233 grammar)
+    const FLAT_ADAPTER_SCOPES = SCOPED.filter((scope) => scope.path.length === 3 && scope.path[scope.path.length - 1] === "adapters");
+    const NESTED_ADAPTER_SCOPES = SCOPED.filter((scope) => scope.path.length > 3 && scope.path[scope.path.length - 1] === "adapters");
+    // review round 12: per reach choice, the entry the Space handler edits — in clears the head,
+    // out · workers demotes the first flat entry, out · all promotes the first workers entry
+    const reachEdits = (owned) => ({
+        clear: owned[0],
+        demote: owned.find((f) => FLAT_SCOPES.includes(f.scope)),
+        promote: owned.find((f) => WORKERS_SCOPES.includes(f.scope)),
+    });
+    // OBS-1099 item 2: the entry that covers a row OTHER than its own key (an explicit id reached
+    // through the doctor-recorded identity, a bare model, an adapter-wide entry) — named, with every
+    // displayed channel it covers. ponytail: O(rows²) over a fleet of dozens; index if it grows.
+    const coveringFor = (self) => {
+        const policy = stagedPolicy();
+        if (!policy.ok)
+            return undefined;
+        // review round 3: the row's own key is dropped only when it covers no displayed sibling —
+        // an explicit id whose alias folds into this row is one shared entry, so it stays here
+        // (Space already refuses it as shared) and the l control owns it
+        const own = `${self.adapter}:${self.model}`;
+        const ownShared = siblingsOf(self).some((other) => entryMatchesChannel(own, other, true));
+        // D-245 (review round 11): the named entry is the FIRST ownedDenies record other than the own
+        // key (or the own key itself when shared) — the very record Space edits, scope included, never
+        // re-ranked through the collector; only a row that owns nothing falls back to the collector's
+        // shared entries, adapter-wide last
+        const owned = ownedDenies(self);
+        const ownedPick = owned.find((f) => f.entry !== own || ownShared);
+        const scope = ownedPick ? { entry: ownedPick.entry, configPath: ownedPick.scope }
+            : exclusionsOf(self, policy.routing, "worker")
+                .filter((found) => found.by === "deny" && (found.entry !== own || ownShared))
+                .sort((a, b) => Number(isAdapterWide(a.entry, self)) - Number(isAdapterWide(b.entry, self)))[0];
+        if (!scope)
+            return undefined;
+        const covers = displayedChannels().filter((channel) => entryMatchesChannel(scope.entry, channel, true))
+            .map((channel) => `${channel.adapter}:${channel.model}${channel.identity ? ` (${channel.identity})` : ""}`);
+        const shared = isAdapterWide(scope.entry, self) || covers.length > 1;
+        return { entry: scope.entry, scope: scope.configPath, covers, shared, edits: reachEdits(owned) };
+    };
     const groupRows = (group) => {
         const rows = group.rows.map((row) => {
             const staged = ui.classifications.find((classification) => classification.adapter === group.adapter
@@ -174,6 +279,10 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 score: row.score,
                 denied: reach.reach !== "in",
                 ...reach,
+                // OBS-1099 item 2 (review round 2): every row is covered the same way — an alias through
+                // its identity, a plain row by a bare-model or adapter entry — so a shared bare-model
+                // entry across adapters has the one owning control too
+                covering: coveringFor({ adapter: group.adapter, model: row.model, identity: row.evidence?.identity }),
             };
         });
         const known = new Set(rows.flatMap((row) => row.classifyModel ? [row.model, row.classifyModel] : [row.model]));
@@ -218,11 +327,9 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     };
     // three preview callbacks share it in lockstep — the staged deny truth every preview ranks under.
     // LEG2-T3 finding 2: all four scopes travel distinct; the preview loads them as written.
+    const denyLists = () => Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, [...ui[scope.key]].sort()]));
     const stagedDeny = () => ({
-        adapters: [...ui.deny].sort(),
-        models: [...ui.denyModels].sort(),
-        workersAdapters: [...ui.denyWorkersAdapters].sort(),
-        workersModels: [...ui.denyWorkersModels].sort(),
+        ...Object.fromEntries(DENY_SCOPES.map((scope) => [stagedDenyKeyOf(scope), [...ui[scope.key]].sort()])),
         allowOut: [...ui.allowOut].sort(),
     });
     const shapeList = () => shapeRows(ui.selectedMode, ui.map, stagedDeny());
@@ -249,11 +356,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     ];
     // ── state transitions ──────────────────────────────────────────────────────
     const editorState = () => ({
-        denyAdapters: [...ui.deny].sort(),
-        denyModels: [...ui.denyModels].sort(),
+        ...denyLists(),
         allowOut: [...ui.allowOut].sort(),
-        denyWorkersAdapters: [...ui.denyWorkersAdapters].sort(),
-        denyWorkersModels: [...ui.denyWorkersModels].sort(),
         classifications: ui.classifications.map((classification) => classification.vendor && classification.channel
             ? {
                 ...classification,
@@ -382,6 +486,266 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     const capacity = Number.isFinite(viewRows) ? Math.max(4, viewRows) : Number.POSITIVE_INFINITY;
     /** review diff rows: overlay chrome is one row shorter than the browser's (no scope header) */
     const reviewCapacity = () => Number.isFinite(capacity) ? Math.min(Math.max(capacity + 1, 4), 400) : 400;
+    // OBS-1099 item 4 (D-199, D-205): an adapter row's reach and remaining reasons come from the
+    // exclusion collector over the STAGED policy for EVERY channel it serves — displayed rows and the
+    // gateway ids folded into them — never literal set membership, which misses model-scope entries
+    // that cover the whole adapter (a bare adapter id in routing.deny.models: preference.ts).
+    // D-205: reach is the MOST-excluded channel's reach — in only when every channel is in, out-all
+    // when any channel is out for all seats, else out-workers — and `partial` says the channels
+    // disagree, so a mixed rail is never shown or guarded as an adapter-wide selected state.
+    // Reasons are the UNION over the channels: one every channel shares is named once, a
+    // channel-specific one carries its channel, so a partial exclusion is never intersected away.
+    const adapterReach = (id) => {
+        const group = modelGroups.find((candidate) => candidate.adapter === id);
+        const channels = (group?.rows ?? []).flatMap((row) => (row.foldedModels?.length ? row.foldedModels : [row.model])
+            .map((model) => ({ model, ...reachFor(id, model, row.evidence?.identity) })));
+        if (channels.length === 0) {
+            // ponytail: a rail entry with no probed channels has only its own literal entries to show
+            const reasons = [
+                ...FLAT_ADAPTER_SCOPES.filter((scope) => ui[scope.key].has(id)).map((scope) => `${scope.dotted} (${id})`),
+                ui.allowOut.has(id) ? "routing.allow (not admitted)" : "",
+                ...NESTED_ADAPTER_SCOPES.filter((scope) => ui[scope.key].has(id)).map((scope) => `${scope.dotted} (${id})`),
+            ].filter(Boolean);
+            const reach = FLAT_ADAPTER_SCOPES.some((scope) => ui[scope.key].has(id)) ? "out-all"
+                : ui.allowOut.has(id) ? "out-allow"
+                    : NESTED_ADAPTER_SCOPES.some((scope) => ui[scope.key].has(id)) ? "out-workers" : "in";
+            return { reach, reasons, partial: false };
+        }
+        const unknown = channels.find((channel) => channel.reach === "unknown");
+        if (unknown)
+            return { reach: "unknown", reasons: unknown.reasons, partial: false };
+        // OBS-1099 review round 5: out-allow and out-all are ONE picker choice (out · all seats), so a
+        // deny-excluded channel beside an allow-excluded one is uniformly out-all, never partial
+        const picked = (reach) => reach === "out-allow" ? "out-all" : reach;
+        const rank = { unknown: -1, in: 0, "out-workers": 1, "out-allow": 2, "out-all": 2 };
+        const reach = channels.reduce((most, channel) => rank[channel.reach] > rank[most] ? picked(channel.reach) : most, picked(channels[0].reach));
+        const partial = channels.some((channel) => picked(channel.reach) !== reach);
+        const shared = channels[0].reasons.filter((reason) => channels.every((channel) => channel.reasons.includes(reason)));
+        const own = channels.flatMap((channel) => channel.reasons
+            .filter((reason) => !shared.includes(reason))
+            .map((reason) => `${channel.model}: ${reason}`));
+        return { reach, reasons: [...shared, ...own], partial };
+    };
+    const describeReach = (state) => state.partial ? `${state.reach} (partial: not every channel)` : state.reach;
+    // OBS-1099 items 1 and 4: one picker choice changes exactly ONE selected entry in ONE scope —
+    // added, cleared, or re-scoped between the workers list and the flat list — then the row's
+    // ACTUAL reach is recomputed and the remaining reasons named. The one-entry-per-press law
+    // (R107, LEG2-T3) stays: a shared or adapter-wide entry covering sibling channels is never
+    // edited from a channel row; the refusal names it. A row holding two reasons is never promised
+    // in after one act.
+    const applyReach = (target, choice) => {
+        const without = (set, entry) => new Set([...set].filter((staged) => staged !== entry));
+        const withEntry = (set, entry) => new Set([...set, entry]);
+        const label = REACH_CHOICES.find((option) => option.id === choice).label;
+        // the allow form is how the writer spells an all-seats exclusion — it IS out · all seats
+        const reached = (reach, wanted) => reach === wanted || (wanted === "out-all" && reach === "out-allow");
+        if (target.model === undefined) {
+            const id = target.adapter;
+            const { reach, reasons, partial } = adapterReach(id);
+            // the rail edits exactly ONE adapter-id entry: the authored deny before the allow complement
+            // before the workers deny (OBS-1046). Reach that comes only from channel-scope entries is not
+            // the rail's to clear — the refusal names those reasons.
+            // OBS-1099 add.1: the held entry is looked up over the schema-enumerated adapter scopes,
+            // flat before the allow complement before nested
+            const heldScope = FLAT_ADAPTER_SCOPES.find((scope) => ui[scope.key].has(id))
+                ?? (ui.allowOut.has(id) ? undefined : NESTED_ADAPTER_SCOPES.find((scope) => ui[scope.key].has(id)));
+            const held = heldScope?.dotted ?? (ui.allowOut.has(id) ? "routing.allow" : null);
+            const take = () => {
+                if (heldScope)
+                    ui[heldScope.key] = without(ui[heldScope.key], id);
+                else
+                    ui.allowOut = without(ui.allowOut, id);
+            };
+            let edit = "";
+            // OBS-1099 review: transitions are judged on ACTUAL reach, not only on the held entry — an
+            // adapter that is out only through channel-scope entries (a bare adapter id in
+            // routing.deny.models) has nothing the rail may move: a choice it already reaches says so,
+            // and a choice that would leave it out-all while staging a second reason is refused by name.
+            // D-205: a PARTIAL rail (channels disagree) is never "already" anything — the choice that
+            // widens every channel to the picked reach is one act, the others are refused by name
+            if (held === null && !partial && reached(reach, choice)) {
+                ui.notice = `${id} is already ${label}${reasons.length ? ` — ${reasons.join("; ")}` : ""}`;
+                return;
+            }
+            if (held === null && (choice === "in" || (choice === "out-workers" && reached(reach, "out-all")))) {
+                ui.notice = `${id} stays ${describeReach({ reach, partial })} — ${reasons.join("; ")} — the rail edits only ${id}'s own adapter entries; set reach on the channel rows`;
+                return;
+            }
+            if (choice === "in") {
+                take();
+                edit = `cleared ${id} from ${held}`;
+            }
+            else if (choice === "out-workers") {
+                if (held === "routing.deny.workers.adapters") {
+                    // OBS-1099 review round 3: the held workers entry is already the rail's whole say —
+                    // when actual reach is still out-all, the remaining all-seat reasons live on the
+                    // channel rows, and this choice cannot reach workers-only until they clear
+                    if (!partial && reached(reach, choice)) {
+                        ui.notice = `${id} is already ${label}`;
+                    }
+                    else {
+                        const remaining = reasons.filter((reason) => reason !== `routing.deny.workers.adapters (${id})`);
+                        ui.notice = `${id} stays ${describeReach({ reach, partial })} — ${remaining.join("; ")} — ${id} is already in routing.deny.workers.adapters; workers-only reach needs those all-seat reasons cleared on the channel rows`;
+                    }
+                    return;
+                }
+                if (held !== null)
+                    take();
+                ui.denyWorkersAdapters = withEntry(ui.denyWorkersAdapters, id);
+                edit = `${held === null ? "added" : "moved"} ${id} to routing.deny.workers.adapters`;
+            }
+            else {
+                if (held === "routing.deny.adapters" || held === "routing.allow") {
+                    ui.notice = `${id} is already ${label}`;
+                    return;
+                }
+                if (held !== null)
+                    take();
+                ui.denyAdapters = withEntry(ui.denyAdapters, id);
+                edit = `${held === null ? "added" : "moved"} ${id} to routing.deny.adapters`;
+            }
+            const after = adapterReach(id);
+            // a partially excluded adapter (one channel still out by its own entry) names what remains
+            const still = choice === "in" ? after.reasons.length > 0 : after.partial || !reached(after.reach, choice);
+            ui.notice = `space: ${edit}${still ? ` — still out: ${after.reasons.join("; ")}` : ""}`;
+            clampList();
+            return;
+        }
+        const row = modelRows().find((candidate) => candidate.adapter === target.adapter && candidate.model === target.model);
+        if (!row)
+            return;
+        const id = `${row.adapter}:${row.model}`;
+        const self = { adapter: row.adapter, model: row.model, identity: row.evidence?.identity };
+        // LEG2-T3 round 2 finding 1 / D-233 / D-235 (review round 10): ONE ordered selector —
+        // ownedDenies — feeds the detail line AND every Space edit, so the entry named is the entry
+        // edited: a clear takes its head (own key first, then collector order); a demotion takes its
+        // first flat entry, a promotion its first workers entry; a bare adapter id or a sibling's
+        // entry is never in it. OBS-1046: an allow exclusion is the LAST reason taken, never together
+        // with an authored deny.
+        const edits = reachEdits(ownedDenies(self));
+        const ownAllow = () => {
+            const fromAllow = selectOwn(ui.allowOut, self);
+            return fromAllow === undefined ? undefined : { entry: fromAllow, scope: "routing.allow" };
+        };
+        const ownFlat = () => edits.demote ?? ownAllow();
+        const ownWorkers = () => edits.promote;
+        const takeFlat = (found) => {
+            const scope = scopeOf(found.scope);
+            if (scope)
+                ui[scope.key] = without(ui[scope.key], found.entry);
+            else
+                ui.allowOut = without(ui.allowOut, found.entry);
+        };
+        const refuse = (reachLabel) => {
+            // OBS-1099 item 2: a covered row names the covering entry, every identity it covers, and
+            // the ONE control that lifts it — the T1 refusal wording stays in front of it
+            if (row.covering?.shared) {
+                // the notice clips at the browser width; the detail line and the l overlay list every identity
+                ui.notice = `${id} stays ${reachLabel} — ${row.covering.scope} (${row.covering.entry}) covers ${row.covering.covers.length} channels — Space edits only this channel's own entries; l lists and lifts it`;
+                return;
+            }
+            const shared = ui.denyAdapters.has(row.adapter) || ui.allowOut.has(row.adapter) || ui.denyWorkersAdapters.has(row.adapter)
+                ? `every ${row.adapter} channel is out together — set the adapter's reach on the rail`
+                : "a shared entry covers other channels too";
+            ui.notice = `${id} stays ${reachLabel} — ${row.reasons.join("; ")} — Space edits only this channel's own entries; ${shared}`;
+        };
+        const reach = row.reach;
+        const outAll = reach === "out-all" || reach === "out-allow";
+        let edit = "";
+        if (choice === "out-workers" && reach === "in") {
+            ui.denyWorkersModels = withEntry(ui.denyWorkersModels, id);
+            edit = `added ${id} to routing.deny.workers.models`;
+        }
+        else if (choice === "out-workers" && outAll) {
+            const found = ownFlat();
+            if (found === undefined)
+                return refuse("out");
+            takeFlat(found);
+            ui.denyWorkersModels = withEntry(ui.denyWorkersModels, found.entry);
+            edit = `moved ${found.entry} to routing.deny.workers.models`;
+        }
+        else if (choice === "out-all" && reach === "in") {
+            ui.denyModels = withEntry(ui.denyModels, id);
+            edit = `added ${id} to routing.deny.models`;
+        }
+        else if (choice === "out-all" && reach === "out-workers") {
+            // OBS-1099 review: a promotion, like a clear, takes only an entry no sibling row matches —
+            // a shared workers entry (adapter-wide or a bare id another row serves) is refused by name,
+            // never moved for its siblings and never doubled by a fresh flat deny
+            const found = ownWorkers();
+            if (found === undefined)
+                return refuse("out · workers");
+            takeFlat(found);
+            ui.denyModels = withEntry(ui.denyModels, found.entry);
+            edit = `moved ${found.entry} to routing.deny.models`;
+        }
+        else if (choice === "in" && reach !== "in") {
+            // D-205: in clears ONE row-owned reason from either the flat scopes or the workers scope —
+            // a shared flat reason (routing.deny.adapters covering every channel) never blocks clearing
+            // this row's own workers entry; the recomputed reach then names the shared reason that remains
+            const found = edits.clear ?? (outAll ? ownAllow() : undefined);
+            if (found !== undefined) {
+                takeFlat(found);
+                edit = `cleared ${found.entry} from ${found.scope}`;
+            }
+            else {
+                return refuse(outAll ? "out" : "out · workers");
+            }
+        }
+        else {
+            ui.notice = `${id} is already ${label}`;
+            return;
+        }
+        const after = reachFor(row.adapter, row.model, row.evidence?.identity);
+        const still = reached(after.reach, choice) ? "" : ` — still out: ${after.reasons.join("; ")}`;
+        ui.lastEdit = { id, text: `space: ${edit}${still}` };
+    };
+    // OBS-1065: Enter on a greyed picker row lifts exactly its row-owned covering entry, then the
+    // same picker reopens over the recomputed policy — a shared or adapter-wide entry is refused by
+    // name and the row stays greyed
+    const liftFromPicker = (overlay, line) => {
+        const head = line.split(" — ")[0];
+        const slash = head.indexOf("/");
+        const self = slash === -1 ? undefined
+            : displayedChannels().find((channel) => channel.adapter === head.slice(0, slash) && channel.model === head.slice(slash + 1));
+        if (!self) {
+            ui.notice = `nothing to lift on this row — ${line}`;
+            bump();
+            return;
+        }
+        const id = `${self.adapter}:${self.model}`;
+        // review round 2/4: only a channel that is otherwise eligible (tier floor, auth, pin/pool) may
+        // be lifted. Eligibility is read from the picker source itself, never the ledger strings: the
+        // channel must be OFFERED at or above the floor once every policy scope is open — a failed
+        // model probe (dropped by discovery), a pin or a pool keep it out of that list and a floor
+        // marks it belowFloor, so nothing here lifts it.
+        const eligible = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, openStagedDeny()).rows
+            .some((row) => row.id === id && !row.belowFloor);
+        if (!eligible) {
+            // the ledger line spells its reasons; drop the row label and the reach segment for the notice
+            const reasons = line.split(" — ").slice(1).filter((segment) => !segment.startsWith("reach: "));
+            ui.notice = `${id} stays out — ${reasons.join(" — ")} — nothing here to lift`;
+            bump();
+            return;
+        }
+        const found = ownDeny(self);
+        if (found === undefined) {
+            const covering = coveringFor(self);
+            ui.notice = covering
+                ? `${id} stays out — ${covering.scope} (${covering.entry}) covers ${covering.covers.join(", ")} — l on its models row lifts that one entry`
+                : `${id} stays out — ${reachFor(self.adapter, self.model, self.identity).reasons.join("; ") || "not a deny entry"} — nothing here to lift`;
+            bump();
+            return;
+        }
+        liftEntry(found);
+        const after = reachFor(self.adapter, self.model, self.identity);
+        const text = `lift: cleared ${found.entry} from ${found.scope}${after.reach === "in" ? "" : ` — still out: ${after.reasons.join("; ")}`}`;
+        ui.lastEdit = { id, text };
+        ui.notice = text;
+        const picked = candidatesForShape(overlay.shape, ui.selectedMode, ui.map, stagedDeny());
+        ui.overlay = { ...overlay, rows: picked.rows, excludedNote: picked.excludedNote, ledger: picked.ledger ?? [], at: 0 };
+        bump();
+    };
     const reviewWindow = (overlay) => {
         const lines = overlay.review.diff.split("\n");
         const cap = reviewCapacity();
@@ -706,6 +1070,11 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                     return;
                 }
                 if (key.return) {
+                    const greyed = ledger[overlay.at - rows.length];
+                    if (!rows[overlay.at] && greyed !== undefined) {
+                        liftFromPicker(overlay, greyed);
+                        return;
+                    }
                     if (overlay.chain.length) {
                         // a selection is a POOL, and its mode is a decision, not a default — the tiny
                         // poolmode overlay asks it; Esc there restores this picker with the chain intact
@@ -804,6 +1173,42 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 });
                 return;
             }
+            if (overlay.kind === "reach") {
+                if (key.escape) {
+                    setOverlay(null);
+                    return;
+                }
+                if (key.downArrow || input === "j") {
+                    overlay.at = Math.min(overlay.at + 1, REACH_CHOICES.length - 1);
+                    bump();
+                    return;
+                }
+                if (key.upArrow || input === "k") {
+                    overlay.at = Math.max(overlay.at - 1, 0);
+                    bump();
+                    return;
+                }
+                if (key.return) {
+                    const choice = REACH_CHOICES[overlay.at].id;
+                    setOverlay(null);
+                    applyReach(overlay.target, choice);
+                    bump();
+                }
+                return;
+            }
+            if (overlay.kind === "lift") {
+                if (key.escape) {
+                    setOverlay(null);
+                    return;
+                }
+                if (key.return) {
+                    liftEntry(overlay.covering);
+                    ui.lastEdit = { id: overlay.id, text: `lift: cleared ${overlay.covering.entry} from ${overlay.covering.scope} (covered ${overlay.covering.covers.join(", ")})` };
+                    setOverlay(null);
+                    bump();
+                }
+                return;
+            }
             // judge overlay
             const rows = [judgeKeepRow, ...judgeSeats].filter((row) => matches(row, ui.filter));
             if (key.escape) {
@@ -944,22 +1349,12 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 const id = modelGroups[row.index].adapter;
                 // membership can't fix auth — say so, or the ✗ reads as a toggle that refuses to move
                 // (operator field report, 2026-08-16: expired kimi token)
-                if (agents.find((agent) => agent.id === id)?.authed === false) {
-                    ui.notice = `${id} is not authed — Space only toggles fleet membership; re-auth the ${id} CLI, then run tickmarkr doctor`;
-                }
-                // OBS-1046: an adapter routing.allow leaves out comes back in by clearing THAT reason
-                if (ui.allowOut.has(id)) {
-                    ui.allowOut = new Set([...ui.allowOut].filter((key) => key !== id));
-                }
-                else {
-                    const next = new Set(ui.deny);
-                    if (next.has(id))
-                        next.delete(id);
-                    else
-                        next.add(id);
-                    ui.deny = next;
-                }
-                clampList();
+                const unauthed = agents.find((agent) => agent.id === id)?.authed === false
+                    ? `${id} is not authed — Space only sets fleet reach; re-auth the ${id} CLI, then run tickmarkr doctor`
+                    : "";
+                // OBS-1099 item 4: an adapter row gets the same three-way reach picker as a model row
+                setOverlay({ kind: "reach", target: { adapter: id }, at: 0 });
+                ui.notice = unauthed;
                 bump();
                 return;
             }
@@ -1021,70 +1416,13 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                     bump();
                     return;
                 }
-                const id = `${row.adapter}:${row.model}`;
-                // OBS-994/FL-1, LEG2-T3 finding 3: Space cycles in → out(workers) → out(all) → in by editing
-                // only THIS channel's own entries in the per-model scopes — its adapter:model key, or an
-                // identity/bare-model entry no other browser row matches. An adapter-wide or shared entry
-                // is never promoted or cleared from a channel row: that would move sibling channels and
-                // wipe reasons that are not this row's to clear. The row's detail line names the entry each
-                // press edited; a refused press names the shared entry in the notice instead.
-                const self = { adapter: row.adapter, model: row.model, identity: row.evidence?.identity };
-                const others = modelGroups.flatMap((group) => group.rows
-                    .filter((other) => group.adapter !== row.adapter || other.model !== row.model)
-                    .map((other) => ({ adapter: group.adapter, model: other.model, identity: other.evidence?.identity })));
-                // Judge c3 (R107): exactly ONE selected entry per press — the channel's adapter:model key when
-                // it is a candidate, else the first candidate in sorted order. The cycle is three states over
-                // two scopes, so the out-workers → out-all press re-scopes that one entry from
-                // routing.deny.workers.models to routing.deny.models; every other press adds or clears one
-                // entry in one scope. The channel's other entries keep their reasons for later presses.
-                // LEG2-T3 round 2 finding 1: promotion widens the selected ban as spelled — a bare model id
-                // then excludes every seat serving that model — while a CLEAR only takes an entry no other
-                // row matches, so no sibling is ever admitted by a channel toggle.
-                const select = (entries, ownOnly) => {
-                    const candidates = [...entries].filter((entry) => entryMatchesChannel(entry, self, true)
-                        && (!ownOnly || !others.some((other) => entryMatchesChannel(entry, other, true))));
-                    return candidates.includes(id) ? id : candidates.sort()[0];
-                };
                 if (row.reach === "unknown") {
-                    ui.notice = `${id} reach is unknown — Space does not toggle it until the staged overlay loads: ${row.reasons.join("; ")}`;
+                    ui.notice = `${row.adapter}:${row.model} reach is unknown — Space does not toggle it until the staged overlay loads: ${row.reasons.join("; ")}`;
                     bump();
                     return;
                 }
-                if (row.reach === "in") {
-                    ui.denyWorkersModels = new Set([...ui.denyWorkersModels, id]);
-                    ui.lastEdit = { id, text: `space: added ${id} to routing.deny.workers.models` };
-                }
-                else if (row.reach === "out-workers") {
-                    const entry = select(ui.denyWorkersModels, false) ?? id;
-                    ui.denyWorkersModels = new Set([...ui.denyWorkersModels].filter((staged) => staged !== entry));
-                    ui.denyModels = new Set([...ui.denyModels, entry]);
-                    ui.lastEdit = { id, text: `space: moved ${entry} to routing.deny.models` };
-                }
-                else {
-                    // round 2 finding 2: either flat list may carry this channel's own reason; OBS-1046: an
-                    // allow exclusion is the LAST reason cleared, and never together with an authored deny
-                    const fromModels = select(ui.denyModels, true);
-                    const fromAdapters = fromModels === undefined ? select(ui.deny, true) : undefined;
-                    const fromAllow = fromModels === undefined && fromAdapters === undefined ? select(ui.allowOut, true) : undefined;
-                    const entry = fromModels ?? fromAdapters ?? fromAllow;
-                    if (entry === undefined) {
-                        const shared = ui.deny.has(row.adapter) || ui.allowOut.has(row.adapter)
-                            ? `every ${row.adapter} channel is out together — take the adapter back in on the rail`
-                            : "a shared entry covers other channels too";
-                        ui.notice = `${id} stays out — ${row.reasons.join("; ")} — Space edits only this channel's own entries; ${shared}`;
-                        bump();
-                        return;
-                    }
-                    if (fromModels !== undefined)
-                        ui.denyModels = new Set([...ui.denyModels].filter((staged) => staged !== entry));
-                    else if (fromAdapters !== undefined)
-                        ui.deny = new Set([...ui.deny].filter((staged) => staged !== entry));
-                    else
-                        ui.allowOut = new Set([...ui.allowOut].filter((staged) => staged !== entry));
-                    const scope = fromModels !== undefined ? "routing.deny.models" : fromAdapters !== undefined ? "routing.deny.adapters" : "routing.allow";
-                    ui.lastEdit = { id, text: `space: cleared ${entry} from ${scope}` };
-                }
-                bump();
+                // OBS-1099 item 1: Space opens the reach picker; applyReach changes ONE selected reason
+                setOverlay({ kind: "reach", target: { adapter: row.adapter, model: row.model }, at: 0 });
                 return;
             }
             if (key.return && row) {
@@ -1092,7 +1430,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                     beginClassification(row.adapter, row.model);
                     return;
                 }
-                if (row.denied || ui.deny.has(row.adapter)) {
+                if (row.denied || ui.denyAdapters.has(row.adapter)) {
                     ui.notice = `${row.adapter}:${row.model} is out of the fleet — Space adds it before assigning`;
                     bump();
                     return;
@@ -1101,6 +1439,15 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 setOverlay({ kind: "assign", adapter: row.adapter, model: row.model, at: 0 });
                 return;
             }
+            if (hotkey === "l" && row) {
+                if (!row.covering) {
+                    ui.notice = `${row.adapter}:${row.model} — no covering entry to lift${row.reasons.length ? ` — ${row.reasons.join("; ")} — Space edits this row's own entries` : ""}`;
+                    bump();
+                    return;
+                }
+                setOverlay({ kind: "lift", id: `${row.adapter}:${row.model}`, covering: row.covering });
+                return;
+            }
             if (hotkey === "t" && row) {
                 if (row.tier) {
                     ui.notice = "tier reassignment on classified models is not supported in v1 — edit config directly";
@@ -1270,14 +1617,14 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             return "unauthed — re-probe with tickmarkr doctor (Space does not toggle reach)";
         const reasons = row.reasons.join("; ");
         if (row.reach === "out-all")
-            return `reach: out · all seats — ${reasons}`;
+            return `reach: out · all seats — ${reasons} — Space picks in or out · workers`;
         if (row.reach === "out-allow")
-            return `reach: out · all seats · allow — ${reasons}`;
+            return `reach: out · all seats · allow — ${reasons} — Space picks in or out · workers`;
         if (row.reach === "out-workers")
-            return `reach: out · workers only (judge/review/consult unaffected) — ${reasons}`;
+            return `reach: out · workers only (judge/review/consult unaffected) — ${reasons} — Space picks in or out · all seats`;
         if (row.reach === "unknown")
             return `reach: unknown — ${reasons}`;
-        return "reach: in — Space cycles to out · workers";
+        return "reach: in — Space picks out · workers or out · all seats";
     };
     const reachCell = (row) => row.reach === "in" || row.reach === "unknown" ? row.reach : `out ${row.reach === "out-workers" ? "workers" : row.reach.slice(4)}`;
     const identityDetail = (row) => {
@@ -1287,6 +1634,25 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             ? `resolved identity ${row.evidence.identity} — no deny entry covers it`
             : `resolved identity ${row.evidence.identity}`;
     };
+    // OBS-1099 item 2: a second detail line names the entry that covers this row other than by its
+    // own key, its scope, and which control edits it — the ONE lift control when it is shared
+    const coveringDetail = (row) => {
+        const covering = row.covering;
+        if (covering.shared)
+            return `covered by ${covering.scope} (${covering.entry}) — shared: covers ${covering.covers.join(", ")} — l lifts that one entry`;
+        // review round 12: name the entry each APPLICABLE reach choice edits, from the selector the
+        // handler reads; when every one is the covering entry itself the short form stands
+        const outAll = row.reach === "out-all" || row.reach === "out-allow";
+        const applicable = [
+            ["in clears", covering.edits.clear],
+            ...(outAll ? [["out · workers demotes", covering.edits.demote]] : []),
+            ...(row.reach === "out-workers" ? [["out · all promotes", covering.edits.promote]] : []),
+        ];
+        const named = applicable.filter((pair) => pair[1] !== undefined);
+        const same = named.every(([, o]) => o.entry === covering.entry && o.scope === covering.scope);
+        return `covered by ${covering.scope} (${covering.entry}) — ${same ? "Space edits that entry"
+            : `Space: ${named.map(([verb, o]) => `${verb} ${o.entry} (${o.scope})`).join("; ")}`}`;
+    };
     const modelDetail = (row) => {
         const parts = [
             `${row.adapter}:${row.model}`,
@@ -1351,7 +1717,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
     const railAdapter = (index, railIndex) => {
         const group = modelGroups[index];
         const agent = agents.find((candidate) => candidate.id === group.adapter);
-        const denied = ui.deny.has(group.adapter) || ui.allowOut.has(group.adapter);
+        const denied = ui.denyAdapters.has(group.adapter) || ui.allowOut.has(group.adapter);
         const active = ui.view === "models" && ui.adapterAt === index;
         const selected = ui.focus === "rail" && ui.railAt === railIndex;
         return (_jsxs(Text, { children: [selected ? _jsx(Text, { color: INK.brand, children: "❯ " }) : _jsx(Text, { children: "  " }), denied ? _jsx(Glyph, { kind: "off" }) : agent?.authed === false ? _jsx(Glyph, { kind: "fail" }) : _jsx(Glyph, { kind: "on" }), _jsx(Text, { children: " " }), _jsx(Text, { bold: active, color: active ? INK.brand : undefined, dimColor: denied, children: padCell(group.adapter, 12) }), _jsx(Text, { dimColor: true, children: padCellStart(String(visibleCount(index)), 4) })] }, group.adapter));
@@ -1427,6 +1793,20 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                         return (_jsxs(Text, { children: [_jsx(Pointer, { on: selected }), at === -1 ? _jsx(Text, { dimColor: true, children: "· " }) : _jsx(Text, { color: INK.brand, children: `${at + 1} ` }), _jsx(Text, { bold: selected, children: clip(option, bodyW - 10) })] }, option));
                     }), below > 0 && _jsx(ElisionMark, { count: below, side: "below" })] }));
         }
+        if (overlay.kind === "lift") {
+            return (_jsxs(OverlayPanel, { title: `lift · ${overlay.covering.scope} (${overlay.covering.entry})`, width: bodyW, children: [_jsx(Text, { dimColor: true, children: clip(`from ${overlay.id} — Enter lifts this ONE entry for every channel it covers · Esc keeps it`, bodyW - 4) }), _jsx(Text, { children: " " }), overlay.covering.covers.map((covered) => (_jsx(Text, { wrap: "truncate", children: clip(`  ${covered}`, bodyW - 4) }, covered)))] }));
+        }
+        if (overlay.kind === "reach") {
+            const id = overlay.target.model === undefined ? overlay.target.adapter : `${overlay.target.adapter}:${overlay.target.model}`;
+            const current = overlay.target.model === undefined
+                ? adapterReach(overlay.target.adapter)
+                : modelRows().find((row) => row.adapter === overlay.target.adapter && row.model === overlay.target.model) ?? { reach: "unknown", reasons: [] };
+            const partial = "partial" in current && current.partial;
+            // D-205: a partial rail marks no choice as selected — its channels disagree
+            const on = partial || current.reach === "unknown" ? null
+                : current.reach === "out-all" || current.reach === "out-allow" ? "out-all" : current.reach;
+            return (_jsxs(OverlayPanel, { title: `reach · ${id}`, width: bodyW, children: [_jsx(Text, { dimColor: true, children: clip(`now: ${describeReach({ reach: current.reach, partial })}${current.reasons.length ? ` — ${current.reasons.join("; ")}` : ""}`, bodyW - 4) }), _jsx(Text, { dimColor: true, children: "one choice edits one reason; a row with more reasons keeps the rest" }), _jsx(Text, { children: " " }), REACH_CHOICES.map((choice, index) => (_jsxs(Text, { children: [_jsx(Pointer, { on: overlay.at === index }), choice.id === on ? _jsx(Glyph, { kind: "on" }) : _jsx(Text, { children: " " }), _jsx(Text, { bold: overlay.at === index, children: ` ${padCell(choice.label, 16)}` }), _jsx(Text, { dimColor: true, children: clip(`— ${choice.gloss}`, bodyW - 24) })] }, choice.id)))] }));
+        }
         // judge
         const rows = [judgeKeepRow, ...judgeSeats].filter((row) => matches(row, ui.filter));
         const { visible, start, above, below } = windowRows(rows, overlay.at, capacity);
@@ -1485,6 +1865,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             const lines = [];
             if (row) {
                 lines.push(modelDetail(row));
+                if (row.covering)
+                    lines.push(coveringDetail(row));
                 if (!row.tier) {
                     lines.push(row.suggestion
                         ? `catalog suggests ${row.suggestion.tier} — Space/Enter classifies with the note pre-typed · s stages every visible suggestion`
@@ -1528,12 +1910,18 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             }
             if (overlay.kind === "candidates") {
                 return [
-                    { key: "Enter", label: overlay.chain.length ? "apply pool" : "pin" },
+                    { key: "Enter", label: overlay.chain.length ? "apply pool" : "pin · lift greyed" },
                     { key: "Space", label: "pool in order" },
                     { key: "type", label: "search" },
                     { key: "Esc", label: "cancel" },
                 ];
             }
+            if (overlay.kind === "reach") {
+                return [{ key: "Enter", label: "set reach" }, { key: "↑↓", label: "move" }, { key: "Esc", label: "cancel" }];
+            }
+            if (overlay.kind === "lift") {
+                return [{ key: "Enter", label: "lift entry" }, { key: "Esc", label: "keep" }];
+            }
             if (overlay.kind === "poolmode") {
                 return [
                     { key: "Enter", label: "apply pool" },
@@ -1556,7 +1944,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
             return [
                 { key: "Enter", label: "open" },
                 { key: "↑↓", label: "move" },
-                { key: "Space", label: "fleet in/out CLI" },
+                { key: "Space", label: "reach picker (CLI)" },
                 { key: "→", label: "list" },
                 { key: "w", label: "review + write" },
                 { key: "Esc", label: escLabel },
@@ -1565,7 +1953,8 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
         if (ui.view === "models") {
             return [
                 { key: "Enter", label: "assign/classify" },
-                { key: "Space", label: "fleet in/out" },
+                { key: "Space", label: "reach picker" },
+                { key: "l", label: "lift entry" },
                 { key: "m", label: "presets" },
                 { key: "w", label: "review + write" },
                 { key: "←", label: "rail" },
@@ -1596,7 +1985,7 @@ export function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels
                 ? _jsx(Text, { color: INK.warn, children: ` ! ${clip(ui.notice, width - 4)}` })
                 : details.map((line) => _jsx(Text, { dimColor: true, children: ` ${clip(line, width - 2)}` }, line)), _jsx(KeyBar, { binds: keyBinds() })] }));
 }
-export async function runFleetInkEditor({ ageMs, adapters, health, initialDenyAdapters, initialDenyModels, initialAllowOut = [], initialDenyWorkersAdapters = [], initialDenyWorkersModels = [], modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, }) {
+export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut = [], modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, ...initialDenyProps }) {
     const agents = adapters.flatMap((adapter) => {
         const state = health[adapter.id];
         if (!state?.installed)
@@ -1620,7 +2009,7 @@ export async function runFleetInkEditor({ ageMs, adapters, health, initialDenyAd
     // rebuilt from output.columns/rows so a pane resize re-renders at the new size. Same root
     // element type on every rerender ⇒ React keeps the component instance, so staged edits,
     // cursor, and overlays all survive the resize.
-    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, initialDenyAdapters: initialDenyAdapters, initialDenyModels: initialDenyModels, initialAllowOut: initialAllowOut, initialDenyWorkersAdapters: initialDenyWorkersAdapters, initialDenyWorkersModels: initialDenyWorkersModels, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewOverlay: reviewOverlay, reloadGuard: reloadGuard, stagedRouting: stagedRouting, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
+    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, ...initialDenyProps, initialAllowOut: initialAllowOut, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewOverlay: reviewOverlay, reloadGuard: reloadGuard, stagedRouting: stagedRouting, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
         // v1.90.9: cap every list to the terminal minus chrome so the cursor and header can
         // never scroll off-screen (omp's 218-model list did exactly that pre-cap).
         // OBS-523: chrome is ≤12 rows worst case (header, borders, padding, scope+search,