831be5c9

feat: the picker lists a host's sessions; Enter adds one, c births, x ends with the daemon's two-step

a73x 2026-09-03 05:20

Commit message

feat: the picker lists a host's sessions; Enter adds one, c births, x ends with the daemon's two-step

The popup gains a second level. Enter on a host row opens that daemon's
own session list, with "on this wall" beside the ones the layout already
has and the holder count beside the ones a daemon new enough to say it
reports; Enter on a session row adds it as a pane, joined and never
created; `c` still births; `x` ends through `client.endSession`, a side
connection of its own because the session may have no pane here to ask
through. Esc backs out one level rather than closing the box.

Two carried items ride along. A pump now writes its `.detach` on the way
out of its loop, so a pane removed by `Ctrl-\ x` gives the daemon its
slot back with a goodbye rather than a closed fd. And the `# holds` doc
comment says what the count is: every holder, the asker included, a
number to read and never the verdict the daemon gives an `end_req`.

src/client/client.zig

@@ @@ -1207,6 +1207,50 @@ pub fn birthSession( @@
+    tr.writeFrame(.detach, "") catch {};
+/// What the daemon said about an `end_req`. The reason is COPIED rather
+/// than borrowed: the frame it arrived in is freed before this returns, and
+/// the picker builds its notice from the reason after the call.
+pub const EndOutcome = struct {
+    accepted: bool,
+    others: u8,
+    reason_buf: [proto.end_reply_max_len]u8 = undefined,
+    reason_len: usize = 0,
+    pub fn reason(self: *const EndOutcome) []const u8 {
+        return self.reason_buf[0..self.reason_len];
+    }
+};
+/// `end_req` on a side connection of its own: the picker ends a session
+/// that may have no pane on this wall, so there is no pump to ask
+/// through. The daemon owns the two-step; this only carries `force`.
+pub fn endSession(alloc: std.mem.Allocator, target: Target, name: []const u8, force: bool) !EndOutcome {
+    var tr = try Transport.open(alloc, target, null, -1, null);
+    defer tr.close();
+    var buf: [proto.end_req_max_len]u8 = undefined;
+    const req = proto.encodeEndReq(&buf, force, proto.wireName(name));
+    const deadline = std.time.milliTimestamp() + birth_budget_ms;
+    // `exit_status` is asked for as well because it ends the wait: a daemon
+    // that kills the session before it answers has already said everything
+    // it is going to, and waiting out the budget for a reply that is not
+    // coming would park the popup for three seconds.
+    const f = roundTrip(&tr, alloc, .end_req, req, &.{ .end_reply, .exit_status }, deadline) catch |e| return switch (e) {
+        error.Timeout => error.Timeout,
+        else => error.Transport,
+    };
+    defer f.deinit(alloc);
+    // An `exit_status` (or a daemon too old to have an `end_req` arm at all)
+    // is not a verdict this can report a count from.
+    if (f.type != .end_reply) return error.Refused;
+    const r = proto.parseEndReply(f.payload) orelse return error.Refused;
+    var out: EndOutcome = .{ .accepted = r.accepted, .others = r.others };
+    // The tail is a PEER's bytes and the buffer is this frame's size, not
+    // the peer's: a reason longer than any word the daemon owns is cut.
+    const n = @min(r.reason.len, out.reason_buf.len);
+    @memcpy(out.reason_buf[0..n], r.reason[0..n]);
+    out.reason_len = n;
+    return out;
+}
+/// Every way of not reaching a daemon, except running out of memory.
+fn oomOrTransport(e: anyerror) error{ OutOfMemory, Transport } {
+    // `mux hosts` prints `[unreachable]` for a Transport, so an allocation
+    try std.testing.expectEqual(@as(usize, 1), fake.n);
+/// A daemon stand-in for the end test. One connection per `endSession`, the
+/// same shape `BirthFake` stands in for a birth with — and for the same
+/// reason: the `client` module has no import edge to `daemon`, so a REAL
+/// daemon cannot be stood up in this test binary. The verdicts are scripted
+/// here because they are the DAEMON's to make; that half is pinned against a
+/// real daemon in `server_test_session.zig` ("end_req with another client
+/// attached is refused with the count"). What this file owns, and what this
+/// fake therefore records, is the request `endSession` puts on the wire and
+/// the outcome it makes of the reply.
+const EndFake = struct {
+    listener: std.net.Server,
+    /// One scripted answer per connection, in order.
+    replies: []const proto.EndReply,
+    /// What each request carried, so the client's half is assertable.
+    force: [4]bool = @splat(false),
+    names: [4][proto.session_name_max]u8 = undefined,
+    name_lens: [4]usize = @splat(0),
+    n: usize = 0,
+    fn serve(self: *EndFake) void {
+        const alloc = std.testing.allocator;
+        while (self.n < self.replies.len) {
+            const conn = self.listener.accept() catch return;
+            defer conn.stream.close();
+            const f = (proto.readFrame(alloc, conn.stream.handle) catch return) orelse return;
+            defer f.deinit(alloc);
+            if (f.type != .end_req or f.payload.len < proto.end_req_len) return;
+            const at = self.n;
+            self.force[at] = f.payload[0] != 0;
+            const name = f.payload[proto.end_req_len..];
+            @memcpy(self.names[at][0..name.len], name);
+            self.name_lens[at] = name.len;
+            self.n += 1;
+            const r = self.replies[at];
+            // The daemon's own encoder, so the bytes this test decodes are
+            // the bytes a daemon writes rather than a second spelling.
+            var buf: [proto.end_reply_max_len]u8 = undefined;
+            proto.writeFrame(
+                conn.stream.handle,
+                .end_reply,
+                proto.encodeEndReply(&buf, r.accepted, r.others, r.reason),
+            ) catch return;
+        }
+    }
+    fn nameOf(self: *const EndFake, i: usize) []const u8 {
+        return proto.resolveName(self.names[i][0..self.name_lens[i]]);
+    }
+};
+test "endSession: a held session refuses with the count, force ends it, and an unknown name is refused with the daemon's reason" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sp = try std.fmt.allocPrint(alloc, "{s}/end.sock", .{tmp.path()});
+    defer alloc.free(sp);
+    const addr = try std.net.Address.initUnix(sp);
+    var fake = EndFake{
+        .listener = try addr.listen(.{}),
+        .replies = &.{
+            .{ .accepted = false, .others = 1, .reason = proto.end_reason.others_attached },
+            .{ .accepted = true, .others = 0, .reason = proto.end_reason.accepted },
+            .{ .accepted = false, .others = 0, .reason = proto.end_reason.no_session },
+        },
+    };
+    defer fake.listener.deinit();
+    const th = try std.Thread.spawn(.{}, EndFake.serve, .{&fake});
+    const first = try endSession(alloc, .{ .sock = sp }, "0", false);
+    try std.testing.expect(!first.accepted);
+    try std.testing.expectEqual(@as(u8, 1), first.others);
+    // The picker's notice is built from this, so a refusal that lost its
+    // reason would read as an end that happened.
+    try std.testing.expectEqualStrings(proto.end_reason.others_attached, first.reason());
+    const forced = try endSession(alloc, .{ .sock = sp }, "0", true);
+    try std.testing.expect(forced.accepted);
+    try std.testing.expectEqualStrings("", forced.reason());
+    const missing = try endSession(alloc, .{ .sock = sp }, "nope", false);
+    try std.testing.expect(!missing.accepted);
+    try std.testing.expectEqualStrings(proto.end_reason.no_session, missing.reason());
+    th.join();
+    // Three connections, one question each: the picker ends a session with
+    // no pane on this wall, so there is no pump's link to ride.
+    try std.testing.expectEqual(@as(usize, 3), fake.n);
+    // `force` is the SECOND press and nothing else — the client never
+    // decides to force, it only remembers being told to ask twice.
+    try std.testing.expectEqual([3]bool{ false, true, false }, fake.force[0..3].*);
+    // The default session rides the wire as an empty tail; `endSession` must
+    // spell it that way or a daemon reads a session called "0" it has not got.
+    try std.testing.expectEqual(@as(usize, 0), fake.name_lens[0]);
+    try std.testing.expectEqualStrings("0", fake.nameOf(0));
+    try std.testing.expectEqualStrings("nope", fake.nameOf(2));
+}
+/// A daemon stand-in for the list test: accepts once and answers the first
+/// `sessions_req` with a fixed reply.
+const ListFake = struct {

src/engine/protocol.zig

Old		New
@@ -928,8 +928,12 @@ pub const sessions_meta_version_max = 32;
928	pub const sessions_meta_max =	928	pub const sessions_meta_max =
929	1 + sessions_meta_prefix.len + sessions_meta_version_max + sessions_meta_stale_word.len;	929	1 + sessions_meta_prefix.len + sessions_meta_version_max + sessions_meta_stale_word.len;
930	/// One `# holds NAME N` line per session, appended by a daemon that can	930	/// One `# holds NAME N` line per session, appended by a daemon that can
931	/// count: how many clients hold that session. The picker's session list	931	/// count: how many clients hold that session. The count is EVERY holder,
932	/// shows it, and the end key's first press is judged against it. Spelled	932	/// the asker included, so it is a number to READ and never a verdict: the
		933	/// picker's session row shows it as the total, and whether an `end_req`
		934	/// goes through is judged by the daemon against the OTHERS — the holders
		935	/// that are not the connection asking. A client that decided from this
		936	/// number would refuse to end a session only it is in. Spelled
933	/// as a `#` line so `sessionsIter`, which yields only valid session names,	937	/// as a `#` line so `sessionsIter`, which yields only valid session names,
934	/// skips it on a client that predates it — exactly as it skips the meta	938	/// skips it on a client that predates it — exactly as it skips the meta
935	/// line — and a daemon that predates it sends none, which	939	/// line — and a daemon that predates it sends none, which

src/tui/interact.zig

Old		New
@@ -66,6 +66,10 @@ pub const Highlight = struct {
66	pub const PrefixFilter = struct {	66	pub const PrefixFilter = struct {
67	pub const Dir = enum { left, down, up, right };	67	pub const Dir = enum { left, down, up, right };
68		68
		69	/// The picker's two lists: the hosts file's daemons, and one daemon's
		70	/// own sessions.
		71	pub const PickLevel = enum { hosts, sessions };
		72
69	/// Callers switch on it, so a new variant is additive.	73	/// Callers switch on it, so a new variant is additive.
70	pub const Action = union(enum) {	74	pub const Action = union(enum) {
71	none,	75	none,
@@ -100,6 +104,16 @@ pub const PrefixFilter = struct {
100	pick_forget,	104	pick_forget,
101	pick_add_open,	105	pick_add_open,
102	pick_close,	106	pick_close,
		107	/// Enter. At the host level it opens that host's session list; at
		108	/// the session level it chooses a session and closes the popup.
		109	/// One action, because the filter has already flipped `pick_level`
		110	/// by the time the caller reads it — the NEW level says which of
		111	/// the two just happened.
		112	pick_enter,
		113	/// Esc at the session level: back to the hosts, popup still up.
		114	pick_back,
		115	/// `x` at the session level: end that session on its daemon.
		116	pick_end,
103	/// ssh asked something and the user answered. Borrows the filter's	117	/// ssh asked something and the user answered. Borrows the filter's
104	/// buffer until the next feed, as `add_tile` does. An EMPTY answer	118	/// buffer until the next feed, as `add_tile` does. An EMPTY answer
105	/// is an answer: a key whose passphrase is empty is a real key.	119	/// is an answer: a key whose passphrase is empty is a real key.
@@ -146,6 +160,10 @@ pub const PrefixFilter = struct {
146	/// until it closes — so a `j` aimed at the rows can never reach a	160	/// until it closes — so a `j` aimed at the rows can never reach a
147	/// shell. The driver paints; this owns which key means what.	161	/// shell. The driver paints; this owns which key means what.
148	picking: bool = false,	162	picking: bool = false,
		163	/// Which list the popup shows. The filter owns it because Enter and Esc
		164	/// mean different things at each level, and a key must resolve to ONE
		165	/// action without the wall's help.
		166	pick_level: PickLevel = .hosts,
149		167
150	/// ssh is waiting on an answer. Over EVERYTHING, `picking` included: a	168	/// ssh is waiting on an answer. Over EVERYTHING, `picking` included: a
151	/// prompt is not a mode the user chose, it arrived. Every byte is the	169	/// prompt is not a mode the user chose, it arrived. Every byte is the
@@ -280,19 +298,48 @@ pub const PrefixFilter = struct {
280	// leaves too — its digits read as row selections.	298	// leaves too — its digits read as row selections.
281	if (tail.len > 0 and (tail[0] == '[' or tail[0] == 'O'))	299	if (tail.len > 0 and (tail[0] == '[' or tail[0] == 'O'))
282	return .{ .forward = buf[0..kept], .action = .none };	300	return .{ .forward = buf[0..kept], .action = .none };
		301	// One level at a time: the session list was reached
		302	// through the host list, and an Esc that closed the
		303	// whole popup would cost a reopen to change machine.
		304	if (self.pick_level == .sessions) {
		305	self.pick_level = .hosts;
		306	return .{ .forward = buf[0..kept], .action = .pick_back };
		307	}
283	self.picking = false;	308	self.picking = false;
284	return .{ .forward = buf[0..kept], .action = .pick_close };	309	return .{ .forward = buf[0..kept], .action = .pick_close };
285	},	310	},
286	'j' => return .{ .forward = buf[0..kept], .action = .{ .pick_move = 1 } },	311	'j' => return .{ .forward = buf[0..kept], .action = .{ .pick_move = 1 } },
287	'k' => return .{ .forward = buf[0..kept], .action = .{ .pick_move = -1 } },	312	'k' => return .{ .forward = buf[0..kept], .action = .{ .pick_move = -1 } },
288	'1'...'9' => return .{ .forward = buf[0..kept], .action = .{ .pick_select = @intCast(b - '0') } },	313	'1'...'9' => return .{ .forward = buf[0..kept], .action = .{ .pick_select = @intCast(b - '0') } },
289	'\r', '\n', 'c' => {	314	'\r', '\n' => {
		315	// Enter descends, then chooses. The level is flipped
		316	// BEFORE the caller sees the action, so `.sessions`
		317	// means "the list just opened" and `.hosts` means "a
		318	// session was picked and the popup is closing".
		319	if (self.pick_level == .hosts) {
		320	self.pick_level = .sessions;
		321	return .{ .forward = buf[0..kept], .action = .pick_enter };
		322	}
290	self.picking = false;	323	self.picking = false;
		324	self.pick_level = .hosts;
		325	return .{ .forward = buf[0..kept], .action = .pick_enter };
		326	},
		327	// A new session on the selected host, from either level:
		328	// the host is what a birth needs, and the session list
		329	// is exactly where a user decides none of them will do.
		330	'c' => {
		331	self.picking = false;
		332	self.pick_level = .hosts;
291	return .{ .forward = buf[0..kept], .action = .pick_birth };	333	return .{ .forward = buf[0..kept], .action = .pick_birth };
292	},	334	},
293	// Closed, like a birth: a forget takes the host's tiles
294	// off the wall, and the user is owed the wall that made.
295	'x' => {	335	'x' => {
		336	// An end leaves the popup up: the daemon's first
		337	// answer is a count to read, and the second press
		338	// that forces has to land on the same row.
		339	if (self.pick_level == .sessions)
		340	return .{ .forward = buf[0..kept], .action = .pick_end };
		341	// Closed, like a birth: a forget takes the host's tiles
		342	// off the wall, and the user is owed the wall that made.
296	self.picking = false;	343	self.picking = false;
297	return .{ .forward = buf[0..kept], .action = .pick_forget };	344	return .{ .forward = buf[0..kept], .action = .pick_forget };
298	},	345	},
@@ -304,6 +351,7 @@ pub const PrefixFilter = struct {
304	},	351	},
305	's', 0x03 => {	352	's', 0x03 => {
306	self.picking = false;	353	self.picking = false;
		354	self.pick_level = .hosts;
307	return .{ .forward = buf[0..kept], .action = .pick_close };	355	return .{ .forward = buf[0..kept], .action = .pick_close };
308	},	356	},
309	else => {},	357	else => {},
@@ -2272,18 +2320,77 @@ test "interact: a digit selects a picker row and leaves the picker open" {
2272	try std.testing.expect(f.picking);	2320	try std.testing.expect(f.picking);
2273	}	2321	}
2274		2322
2275	test "interact: Enter and c both birth on the selected host, and close the picker" {	2323	test "interact: c births on the selected host and closes the picker; Enter no longer does" {
2276	for ([_][]const u8{ "\r", "\n", "c" }) \|key\| {	2324	var f: PrefixFilter = .{};
2277	var f: PrefixFilter = .{};	2325	var open = "\x1cs".*;
2278	var open = "\x1cs".*;	2326	_ = f.feed(&open);
2279	_ = f.feed(&open);	2327	var key = "c".*;
		2328	try std.testing.expectEqual(PrefixFilter.Action.pick_birth, f.feed(&key).action);
		2329	try std.testing.expect(!f.picking);
		2330	// Enter is the descend key now: it opens the selected host's sessions
		2331	// and births nothing, so a birth is `c` and only `c`.
		2332	for ([_][]const u8{ "\r", "\n" }) \|ent\| {
		2333	var g: PrefixFilter = .{};
		2334	_ = g.feed(&open);
2280	var keys: [2]u8 = undefined;	2335	var keys: [2]u8 = undefined;
2281	@memcpy(keys[0..key.len], key);	2336	@memcpy(keys[0..ent.len], ent);
2282	try std.testing.expectEqual(PrefixFilter.Action.pick_birth, f.feed(keys[0..key.len]).action);	2337	try std.testing.expectEqual(PrefixFilter.Action.pick_enter, g.feed(keys[0..ent.len]).action);
2283	try std.testing.expect(!f.picking);	2338	try std.testing.expect(g.picking);
2284	}	2339	}
2285	}	2340	}
2286		2341
		2342	test "interact: picker levels: Enter on a host opens its sessions, Esc backs out a level, Enter on a session closes with pick_enter" {
		2343	var f = PrefixFilter{};
		2344	var open = [_]u8{ detach_key, 's' };
		2345	try std.testing.expectEqual(PrefixFilter.Action.pick_open, f.feed(&open).action);
		2346	try std.testing.expectEqual(PrefixFilter.PickLevel.hosts, f.pick_level);
		2347
		2348	var enter = [_]u8{'\r'};
		2349	try std.testing.expectEqual(PrefixFilter.Action.pick_enter, f.feed(&enter).action);
		2350	try std.testing.expect(f.picking);
		2351	try std.testing.expectEqual(PrefixFilter.PickLevel.sessions, f.pick_level);
		2352
		2353	// Esc at the session level backs out one level rather than closing:
		2354	// the list of machines is where the user came from.
		2355	var esc = [_]u8{0x1b};
		2356	try std.testing.expectEqual(PrefixFilter.Action.pick_back, f.feed(&esc).action);
		2357	try std.testing.expect(f.picking);
		2358	try std.testing.expectEqual(PrefixFilter.PickLevel.hosts, f.pick_level);
		2359
		2360	_ = f.feed(&enter);
		2361	try std.testing.expectEqual(PrefixFilter.Action.pick_enter, f.feed(&enter).action);
		2362	try std.testing.expect(!f.picking);
		2363	// The level goes home with the close, so the next open is a host list.
		2364	try std.testing.expectEqual(PrefixFilter.PickLevel.hosts, f.pick_level);
		2365
		2366	// ...and a second Esc, back at the host level, closes.
		2367	_ = f.feed(&open);
		2368	try std.testing.expectEqual(PrefixFilter.Action.pick_close, f.feed(&esc).action);
		2369	try std.testing.expect(!f.picking);
		2370	}
		2371
		2372	test "interact: picker levels: x forgets at the host level and ends at the session level; c births at either; every byte stays the popup's" {
		2373	var f = PrefixFilter{};
		2374	var open = [_]u8{ detach_key, 's' };
		2375	_ = f.feed(&open);
		2376	var x = [_]u8{'x'};
		2377	try std.testing.expectEqual(PrefixFilter.Action.pick_forget, f.feed(&x).action);
		2378	try std.testing.expect(!f.picking);
		2379
		2380	_ = f.feed(&open);
		2381	var enter = [_]u8{'\r'};
		2382	_ = f.feed(&enter);
		2383	const ended = f.feed(&x);
		2384	try std.testing.expectEqual(PrefixFilter.Action.pick_end, ended.action);
		2385	try std.testing.expectEqual(@as(usize, 0), ended.forward.len);
		2386	try std.testing.expect(f.picking); // the popup stays up to show the count or the end
		2387
		2388	var c = [_]u8{'c'};
		2389	try std.testing.expectEqual(PrefixFilter.Action.pick_birth, f.feed(&c).action);
		2390	try std.testing.expect(!f.picking);
		2391	try std.testing.expectEqual(PrefixFilter.PickLevel.hosts, f.pick_level);
		2392	}
		2393
2287	test "interact: x forgets the selected host and closes the picker" {	2394	test "interact: x forgets the selected host and closes the picker" {
2288	var f: PrefixFilter = .{};	2395	var f: PrefixFilter = .{};
2289	var open = "\x1cs".*;	2396	var open = "\x1cs".*;
@@ -2362,12 +2469,12 @@ test "interact: the picker eats prose, so a key never reaches a session" {
2362	const out = f.feed(&prose);	2469	const out = f.feed(&prose);
2363	try std.testing.expectEqualStrings("", out.forward);	2470	try std.testing.expectEqualStrings("", out.forward);
2364	try std.testing.expectEqual(PrefixFilter.Action.none, out.action);	2471	try std.testing.expectEqual(PrefixFilter.Action.none, out.action);
2365	// The `\n` behind it is the picker's own birth key, and the letters	2472	// The `\n` behind it is the picker's own descend key, and the letters
2366	// ahead of it went nowhere at all — no shell saw one.	2473	// ahead of it went nowhere at all — no shell saw one.
2367	var enter = "\n".*;	2474	var enter = "\n".*;
2368	const done = f.feed(&enter);	2475	const done = f.feed(&enter);
2369	try std.testing.expectEqualStrings("", done.forward);	2476	try std.testing.expectEqualStrings("", done.forward);
2370	try std.testing.expectEqual(PrefixFilter.Action.pick_birth, done.action);	2477	try std.testing.expectEqual(PrefixFilter.Action.pick_enter, done.action);
2371	}	2478	}
2372		2479
2373	test "interact: the colon chord is gone, the picker's a replaced it" {	2480	test "interact: the colon chord is gone, the picker's a replaced it" {

src/tui/wall_picker.zig

@@ @@ -1,7 +1,10 @@ @@
+//! `Ctrl-\ s`: the host picker's popup. A MODE of the wall's prefix filter, so
+//! every byte typed here is the popup's and none reaches a session. Rows are
+//! the hosts file's daemons in file order with the poller's last answer beside
+//! each; Enter opens that host's SESSIONS, `c` births, `x` forgets, `a` is the
+//! spelling editor. The session level is the second list: Enter adds one as a
+//! pane, `c` still births, `x` ends it through the daemon's two-step, and Esc
+//! goes back to the hosts rather than closing the box.
+const std = @import("std");
+const proto = @import("term").protocol;
+const client = @import("client");
@@ @@ -11,6 +14,7 @@ const interact = @import("interact.zig"); @@
+const askpass = @import("client").askpass;
+const wall_host = @import("wall_host.zig");
+const wall_layout = @import("wall_layout.zig");
+const wall_pump = @import("wall_pump.zig");
+const wv = @import("wallview.zig");
+const Host = wall_host.Host;
+const Shared = wv.Shared;
+        .pick_forget,
+        .pick_add_open,
+        .pick_close,
+        .pick_enter,
+        .pick_back,
+        .pick_end,
+        => true,
+        else => false,
+    };
+/// How many sessions a host's last answer named — the session level's row
+/// count, and what a row step and a digit are clamped against. Takes the
+/// table and an index rather than a host: `picker_sel` can name a slot the
+/// table does not have (an empty hosts file leaves it at 0), and a level
+/// that indexed that would fault on a keystroke.
+pub fn sessionCount(host_table: []Host, host: usize) usize {
+    if (host >= host_table.len) return 0;
+    var list_buf: [proto.sessions_reply_max]u8 = undefined;
+    var it = proto.sessionsIter(host_table[host].poll.snapshot(&list_buf));
+    var n: usize = 0;
+    while (it.next()) |_| n += 1;
+    return n;
+}
+/// The session row `d` away. WRAPPED, unlike `pickerStep`: a session list is
+/// short and every row on it is a session that already exists, so rolling
+/// round costs nothing — the key that acts is Enter, not the move.
+pub fn rowStep(row: usize, d: i8, n: usize) usize {
+    if (n == 0) return 0;
+    if (d < 0) return if (row == 0) n - 1 else row - 1;
+    return if (row + 1 >= n) 0 else row + 1;
+}
+/// The tile showing `name` on `host`, or null. Per HOST, because two daemons
+/// may each have a session called `work` and a lookup by name alone would
+/// mark the wrong one.
+fn paneOf(w: Wall, host: usize, name: []const u8) ?usize {
+    for (w.liveTiles(), w.livePresent(), 0..) |*t, p, i| {
+        if (p and wall_host.ownedBy(t, host) and
+            std.mem.eql(u8, proto.resolveName(t.r.session), name)) return i;
+    }
+    return null;
+}
+/// The name on a session row of a list already in hand, copied out: the
+/// list is a snapshot on some caller's stack and every caller outlives it.
+fn nameAt(list: []const u8, row: usize, out: *[proto.session_name_max]u8) ?[]const u8 {
+    var it = proto.sessionsIter(list);
+    var i: usize = 0;
+    while (it.next()) |name| : (i += 1) {
+        if (i != row) continue;
+        // `sessionsIter` yields only valid names, which are bounded by
+        // `session_name_max` — the guard is here so a peer that got past
+        // the iterator cannot smash this buffer.
+        if (name.len > out.len) return null;
+        @memcpy(out[0..name.len], name);
+        return out[0..name.len];
+    }
+    return null;
+}
+fn sessionAt(h: *Host, row: usize, out: *[proto.session_name_max]u8) ?[]const u8 {
+    var list_buf: [proto.sessions_reply_max]u8 = undefined;
+    return nameAt(h.poll.snapshot(&list_buf), row, out);
+}
+/// Whether this daemon counts holders at all — whether ANY row it listed
+/// carries a `# holds` line. The counting and the `end_req` arm arrived in
+/// the same release, so a daemon that says nothing about holders is one
+/// that will answer an `end_req` with silence.
+fn countsHolds(list: []const u8) bool {
+    var it = proto.sessionsIter(list);
+    while (it.next()) |name| {
+        if (proto.parseSessionsHolds(list, name) != null) return true;
+    }
+    return false;
+}
+/// The second level: one row per session the host's last answer named.
+/// "on this wall" when the layout already has it, and the holder count when
+/// the daemon is new enough to say (`proto.parseSessionsHolds`); an old
+/// daemon's rows carry no count rather than a zero that would read as "safe
+/// to end". The count is EVERY holder, this client included — what the end
+/// key gets is the DAEMON's verdict on who else is there, not this number.
+pub fn sessionRows(body: *PickerBody, w: Wall, host: usize, sel_row: usize, cols: u16) void {
+    body.n = 0;
+    if (host >= w.hosts.len) return;
+    const h = &w.hosts[host];
+    var list_buf: [proto.sessions_reply_max]u8 = undefined;
+    const list = h.poll.snapshot(&list_buf);
+    // Counted before anything is spelled, `pickerRows`' reason: the padding
+    // is the LIST's, and a row cannot know from its own number whether a 10
+    // is coming.
+    var count: usize = 0;
+    var counter = proto.sessionsIter(list);
+    while (counter.next()) |_| count += 1;
+    const wide = count >= 10;
+    var it = proto.sessionsIter(list);
+    var row: usize = 0;
+    while (it.next()) |name| : (row += 1) {
+        if (body.n >= wv.max_tiles) break;
+        var state_buf: [48]u8 = undefined;
+        var state: []const u8 = "";
+        const on_wall = paneOf(w, host, name) != null;
+        if (proto.parseSessionsHolds(list, name)) |n| {
+            state = std.fmt.bufPrint(&state_buf, "{s}{d} client{s}", .{
+                if (on_wall) "on this wall, " else "",
+                n,
+                if (n == 1) "" else "s",
+            }) catch "";
+        } else if (on_wall) state = "on this wall";
+        body.host[body.n] = host;
+        body.lens[body.n] = pickerRow(&body.text[body.n], body.n + 1, wide, name, state, row == sel_row, cols).len;
+        body.n += 1;
+    }
+}
+/// Enter on a session row: a pane for it, joined (never created), zoomed to.
+/// A session already on the wall is only zoomed to. The layout is written,
+/// because this is one of the three places a pane comes from.
+pub fn pickAdd(w: Wall, host: usize, row: usize) ?usize {
+    // A forgotten host's poller has exited, so a pane born on one could
+    // never be confirmed or vanished — `pickBirth`'s reason, and the same
+    // here because a joined pane is graded by that poller too.
+    if (host >= w.hosts.len or w.hosts[host].forgotten.load(.acquire)) {
+        wv.setNotice(w.shared, "[no host to add a session from - a adds one]");
+        return null;
+    }
+    const h = &w.hosts[host];
+    var name_buf: [proto.session_name_max]u8 = undefined;
+    const name = sessionAt(h, row, &name_buf) orelse {
+        // The list moved under the popup: a poll landed between the paint
+        // and the key, and the row the user chose is not there any more.
+        wv.setNotice(w.shared, "[no session on that row]");
+        return null;
+    };
+    if (paneOf(w, host, name)) |at| {
+        // Already on the wall: the answer is the pane they meant, not a
+        // second tile onto one session.
+        wv.setFocus(w.liveTiles(), w.shared, at);
+        return at;
+    }
+    // Enter IS the ask, `pickBirth`'s reason: the row may be the one the
+    // poller calls unreachable, and choosing it means starting that daemon.
+    var target = h.spec.target;
+    if (target == .hand) target.hand.asked = true;
+    const anchor = wall_layout.anchorTile(w.livePresent(), w.shared.sel);
+    const has_anchor = wv.presentCount(w.livePresent()) > 0;
+    const at = wv.birthTile(w, .{
+        // `name` is this stack's buffer until the wall takes the tile —
+        // see `Birth.borrowed`.
+        // No `-A`: the popup can cross to a host the user never offered an
+        // agent, and joining a session is not the place to hand one over.
+        .r = .{ .target = target, .label = "", .session = name, .agent = false },
+        .from = anchor,
+        .place = .beside_focus,
+        // JOINED: the daemon already has this session, and a create would
+        // ask for a name it has.
+        .creates = false,
+        .born_from = if (has_anchor) anchor else null,
+        // A refusal is one pane's, not the wall's: the popup put this here,
+        // and an empty wall must survive the daemon saying no.
+        .keeps_wall = true,
+        .host = host,
+        .borrowed = true,
+    }) orelse {
+        wv.setNotice(w.shared, "[no room on the wall for another pane]");
+        return null;
+    };
+    wv.spawnPump(&w.tiles[at]);
+    wv.setFocus(w.liveTiles(), w.shared, at);
+    wall_layout.persist(w);
+    return at;
+}
+/// `x` on a session row: the daemon's two-step, from a side connection of
+/// its own — the session may have no pane on this wall, so there is no pump
+/// to ask through. The first press on a session others hold is refused with
+/// the count and arms 3 s; a second press inside that window forces. Every
+/// other refusal arms NOTHING: only "others attached" is a question the
+/// user can answer by pressing again.
+pub fn pickEnd(w: Wall, host: usize, row: usize, now: i64) void {
+    if (host >= w.hosts.len) return;
+    const h = &w.hosts[host];
+    var list_buf: [proto.sessions_reply_max]u8 = undefined;
+    const list = h.poll.snapshot(&list_buf);
+    var name_buf: [proto.session_name_max]u8 = undefined;
+    const name = nameAt(list, row, &name_buf) orelse {
+        wv.setNotice(w.shared, "[no session on that row]");
+        return;
+    };
+    // Refused HERE and not on the wire: a daemon with no `end_req` arm
+    // answers nothing at all, so the press would spend the whole reply
+    // budget with the wall frozen before saying anything. Same sentence the
+    // pump's own chord uses, because it is the same fact about the box.
+    if (!countsHolds(list)) {
+        wv.setNotice(w.shared, "[daemon too old to end a session]");
+        return;
+    }
+    const armed = w.shared.pick_end.armedFor(host, name, now);
+    // The POLLER's recipe, never the row's own target: an end must not
+    // start a daemon and must not reach for a terminal. `poll_target`
+    // carries ssh's `BatchMode=yes` and a connect timeout and has `asked`
+    // false, so a dark host fails in seconds instead of parking the
+    // keyboard thread in the TCP retry schedule with a password prompt
+    // going to /dev/tty under the popup.
+    const out = client.endSession(w.alloc, h.spec.poll_target, name, armed) catch |e| {
+        var buf: [96]u8 = undefined;
+        wv.setNotice(w.shared, std.fmt.bufPrint(
+            &buf,
+            "[could not ask {s} to end {s}: {s}]",
+            .{ h.spec.spelling, name, @errorName(e) },
+        ) catch "[could not ask the daemon]");
+        return;
+    };
+    var buf: [96]u8 = undefined;
+    if (out.accepted) {
+        // An accepted end DISARMS: the window must not outlive its session,
+        // and the row's number is about to belong to something else.
+        w.shared.pick_end.clear();
+        wv.setNotice(w.shared, std.fmt.bufPrint(
+            &buf,
+            "[ending {s} on {s}]",
+            .{ name, h.spec.spelling },
+        ) catch "[ending the session]");
+    } else if (out.others > 0) {
+        w.shared.pick_end.arm(host, name, now + wv.end_arm_ms);
+        wv.setNotice(w.shared, std.fmt.bufPrint(&buf, "[{s}: {d} other{s} attached - x again to end]", .{
+            name, out.others, if (out.others == 1) "" else "s",
+        }) catch "[others attached - x again to end]");
+    } else {
+        // Not a two-step: the daemon has not got that session, or could not
+        // read the frame. Arming here would leave the next `x` forcing an
+        // end nobody said was blocked. Said in THIS client's words —
+        // `parseEndReply` hands back the peer's bytes unfiltered.
+        w.shared.pick_end.clear();
+        wv.setNotice(w.shared, std.fmt.bufPrint(
+            &buf,
+            "[{s}: {s}]",
+            .{ name, wall_pump.endRefusalWord(out.reason()) },
+        ) catch "[the daemon refused to end that session]");
+    }
+    // The row must leave the list without waiting out a poll: the end is
+    // the daemon's to carry out, and this is what asks it when.
+    h.poll.poke.store(true, .release);
+}
+/// Enter or `c`: a new session on the SELECTED host, tile or no tile.
+/// Null when nothing was made.
+pub fn pickBirth(w: Wall, sel: usize) ?usize {
+    wv.setNotice(w.shared, said);
+/// Which of the popup's two lists is on screen, and where its selection is.
+/// The host index is `sel`, which both levels use — the session level lists
+/// the sessions of the host `sel` names.
+pub const PickerView = struct {
+    level: interact.PrefixFilter.PickLevel = .hosts,
+    /// The selected SESSION row. Unread at the host level, where `sel` is
+    /// the selection.
+    row: usize = 0,
+};
+/// The popup, painted by the KEYBOARD thread — the only one that knows the
+/// picker exists — on open, on every key, and on every list that lands under
+/// it, so the state column is live while the user reads it.
+pub fn paintPicker(w: Wall, sel: usize, view: PickerView, line: ?[]const u8) void {
+    const shared = w.shared;
+    const host_table = w.hosts;
+    if (!shared.is_tty) return;
+    // The flag is set before the lock and READ under it (`tilePaintBegin`),
+    // which is what orders the two: a pump either takes `paint_mu` first and
+    defer shared.paint_mu.unlock();
+    const cols = shared.size.cols;
+    const rows = shared.size.rows;
+    const box_w: u16 = @min(cols, @as(u16, picker_row_max));
+    const left: u16 = (cols -| box_w) / 2;
+    var body: PickerBody = .{};
+    // The selected row differs by level: at the host level it is wherever
+    // the selected HOST landed in the list a forgotten one has left; at the
+    // session level the row IS the selection.
+    var sel_row: usize = 0;
+    var title_buf: [picker_row_max]u8 = undefined;
+    var title: []const u8 = " hosts";
+    if (view.level == .sessions) {
+        sessionRows(&body, w, sel, view.row, box_w);
+        sel_row = @min(view.row, body.n -| 1);
+        const spelling = if (sel < host_table.len) host_table[sel].spec.spelling else "";
+        title = std.fmt.bufPrint(&title_buf, " sessions on {s}", .{spelling}) catch " sessions";
+    } else {
+        pickerRows(&body, host_table, sel, box_w);
+        for (body.host[0..body.n], 0..) |hi, i| {
+            if (hi == sel) sel_row = i;
+        }
+    }
+    // Too small for a box is not too small for an answer: the header alone
+    // still says which popup has the keyboard.
+    const cramped = cols < picker_min_cols or rows < picker_min_rows;
+    // selection stays visible, because it is what every other key acts on.
+    const shown: usize = height -| 2;
+    var first: usize = 0;
+    if (shown > 0 and sel_row >= shown) first = sel_row - shown + 1;
+    // The notice wins the footer over the legend and the editor's line: a
+    // refusal just earned cannot wait for the next keystroke. PEEKED, because
+        notice
+    else if (line) |l|
+    else if (view.level == .sessions)
+        " Enter add to wall   c new session   x end   Esc back"
+    else
+        " Enter sessions   c new session   x forget   a add   Esc";
+    var out: [picker_frame_max]u8 = undefined;
+    var fbs = std.io.fixedBufferStream(&out);
+    // The cursor is hidden for as long as the popup owns the screen: a
+    // caret left blinking in a tile says the keys are going there.
+    wr.writeAll("\x1b[?25l") catch return;
+    pickerLine(wr, top, left, box_w, title);
+    if (!cramped) {
+        var r: u16 = 0;
+        while (r < shown and first + r < body.n) : (r += 1)
+            pickerLine(wr, top + 1 + r, left, box_w, body.row(first + r));
+        pickerLine(wr, top + height - 1, left, box_w, foot);
+    const frame = fbs.getWritten();
+    // Nothing changed, nothing written. The pollers report once a second

src/tui/wall_pump.zig

@@ @@ -839,6 +839,23 @@ pub fn pumpTile(t: *Tile) void { @@
+            painted_gen = snap.gen;
+    // The goodbye a removed pane is owed. `Ctrl-\ x` sets `detach_req` and
+    // then `removed`, and a busy pump usually leaves the loop on `removed`
+    // before it reaches the detach block inside it — so the frame is
+    // written HERE, on the way out, while `transport` is still open and
+    // this thread still owns it. Without it the daemon frees the slot on
+    // the close instead of on a goodbye, which costs a `mux` typed straight
+    // after the session it just gave back.
+    if (t.detach_req.swap(false, .acq_rel)) transport.writeFrame(.detach, "") catch {};
+}
+/// The same words with no brackets, for a caller that puts the session's
+/// name in front of them: the picker's notice is `[NAME: WORDS]`, one pair
+/// of brackets and not two. Off `endRefusal` rather than a second table, so
+/// the tile's banner and the popup's footer cannot drift apart.
+pub fn endRefusalWord(reason: []const u8) []const u8 {
+    const said = endRefusal(reason);
+    return said[1 .. said.len - 1];
+/// A refusal in THIS client's words: `parseEndReply` hands back the frame's

src/tui/wall_test_harness.zig

Old		New
@@ -120,10 +120,36 @@ pub fn setList(h: *Host, list: []const u8) void {
120	h.poll.reachable.store(true, .release);	120	h.poll.reachable.store(true, .release);
121	}	121	}
122		122
		123	/// A wall of hosts and no tiles: what a test about the BOX rather than the
		124	/// panes under it paints from. `hostWall`'s own cell, not `standing_live`,
		125	/// so a test that already stood a wall up does not have its count zeroed by
		126	/// painting a popup over it.
		127	var host_wall_live: usize = 0;
		128	var no_tiles: [0]Tile = .{};
		129	var no_present: [0]bool = .{};
		130
		131	pub fn hostWall(shared: *Shared, host_table: []Host) wv.Wall {
		132	host_wall_live = 0;
		133	return wallOf(std.testing.allocator, &no_tiles, &no_present, &host_wall_live, shared, host_table);
		134	}
		135
123	// A picker painted into a pipe, drained. Non-blocking on both ends so a	136	// A picker painted into a pipe, drained. Non-blocking on both ends so a
124	// frame that outgrew the pipe FAILS here rather than parking the suite.	137	// frame that outgrew the pipe FAILS here rather than parking the suite.
125	pub fn pickerFrame(shared: *Shared, r: std.posix.fd_t, host_table: []Host, sel: usize, out: []u8) []const u8 {	138	pub fn pickerFrame(shared: *Shared, r: std.posix.fd_t, host_table: []Host, sel: usize, out: []u8) []const u8 {
126	wall_picker.paintPicker(shared, host_table, sel, null);	139	return pickerFrameAt(shared, r, host_table, sel, .{}, out);
		140	}
		141
		142	/// `pickerFrame` at a stated level and row: the session list is a second
		143	/// body out of the same box, and the paint is what a test can judge.
		144	pub fn pickerFrameAt(
		145	shared: *Shared,
		146	r: std.posix.fd_t,
		147	host_table: []Host,
		148	sel: usize,
		149	view: wall_picker.PickerView,
		150	out: []u8,
		151	) []const u8 {
		152	wall_picker.paintPicker(hostWall(shared, host_table), sel, view, null);
127	const n = std.posix.read(r, out) catch 0;	153	const n = std.posix.read(r, out) catch 0;
128	return out[0..n];	154	return out[0..n];
129	}	155	}

src/tui/wall_test_picker.zig

@@ @@ -13,6 +13,7 @@ const PickerAuto = wall_picker.PickerAuto; @@
+const PickerBody = wall_picker.PickerBody;
+const Shared = wv.Shared;
+const Tile = wv.Tile;
+const TmpDir = @import("testtmp").TmpDir;
+const WallScreen = fixture.WallScreen;
+test "paintPicker: the box is centred on the terminal, not pinned to the origin" {
+    var table = [_]Host{fixture.testHost(&shared, "--sock /tmp/a.sock", "/tmp/a.sock")};
+    fixture.setList(&table[0], "");
+    table[0].applied = true;
+    wall_picker.paintPicker(fixture.hostWall(&shared, &table), 0, .{}, null);
+    // A notice whose footer is byte-for-byte the legend already on the
+    // screen: the stamp refuses the write, and taking the notice ahead of
+    // that check is a sentence consumed by a frame nobody was sent.
+    wv.setNotice(&shared, " Enter sessions   c new session   x forget   a add   Esc");
+    wall_picker.paintPicker(fixture.hostWall(&shared, &table), 0, .{}, null);
+    var buf: [96]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        " Enter sessions   c new session   x forget   a add   Esc",
+        wv.takeNotice(&shared, &buf),
+    );
+        fixture.setList(h, "");
+        h.applied = true;
+    wall_picker.paintPicker(fixture.hostWall(&shared, &table), 1, .{}, null);
+    screen.drain();
+    const dump = try screen.eng.dumpPlain(alloc);
+    defer alloc.free(dump);
+    shared.ask_open.store(true, .release);
+    screen.drain();
+    wv.closeAsk(w, &shared, &prefix, 0, 0);
+    screen.drain();
+    const dump = try screen.eng.dumpPlain(alloc);
+    defer alloc.free(dump);
+    shared.ask_open.store(true, .release);
+    wall_picker.paintAsk(&shared, "box's password: ", &prefix);
+    screen.drain();
+    wv.closeAsk(w, &shared, &prefix, 0, 0);
+    screen.drain();
+    const after = try screen.eng.dumpPlain(alloc);
+    defer alloc.free(after);
+    try std.testing.expect(std.mem.indexOf(u8, after, "/tmp/b.sock") == null);
+    try std.testing.expect(std.mem.indexOf(u8, after, "password") == null);
+test "sessionRows: a host's sessions, marked when already on this wall, with the holder count when the daemon says" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var hosts_table = [_]Host{fixture.testHost(&shared, "box", "/b")};
+    fixture.setList(&hosts_table[0], "0\nwork\n# holds 0 2\n# holds work 1\n# mux 0.0.1-18");
+    // Two panes, because a fixture with one is blind to a lookup that
+    // aliased every session onto the first tile it walked.
+    var tiles = [_]Tile{ fixture.claimBench(&shared, 0), fixture.claimBench(&shared, 1) };
+    tiles[0].host = 0;
+    tiles[0].r.session = "work";
+    tiles[1].host = 0;
+    tiles[1].r.session = "elsewhere";
+    var present = [_]bool{ true, true };
+    var live: usize = 2;
+    const w = fixture.wallOf(std.testing.allocator, &tiles, &present, &live, &shared, &hosts_table);
+    var body = wall_picker.PickerBody{};
+    wall_picker.sessionRows(&body, w, 0, 1, 80);
+    try std.testing.expectEqual(@as(usize, 2), body.n);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), " 0 ") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "2 clients") != null);
+    // Session 0 has no pane, so it is not marked; `work` does.
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "on this wall") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(1), "work") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(1), "on this wall") != null);
+    // One holder is singular: the count is read as a number of people.
+    try std.testing.expect(std.mem.indexOf(u8, body.row(1), "1 client,") == null);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(1), "1 client") != null);
+    // `sel_row` marks the row, not the host: the second one is selected.
+    try std.testing.expect(std.mem.indexOf(u8, body.row(1), "> ") != null);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "> ") == null);
+}
+test "sessionRows: a pane on ANOTHER host does not mark this host's same-named session" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var hosts_table = [_]Host{
+        fixture.testHost(&shared, "box", "/b"),
+        fixture.testHost(&shared, "other", "/o"),
+    };
+    fixture.setList(&hosts_table[0], "work\n");
+    fixture.setList(&hosts_table[1], "work\n");
+    var tiles = [_]Tile{fixture.claimBench(&shared, 0)};
+    tiles[0].host = 1;
+    tiles[0].r.session = "work";
+    var present = [_]bool{true};
+    var live: usize = 1;
+    const w = fixture.wallOf(std.testing.allocator, &tiles, &present, &live, &shared, &hosts_table);
+    var body = wall_picker.PickerBody{};
+    wall_picker.sessionRows(&body, w, 0, 0, 80);
+    try std.testing.expectEqual(@as(usize, 1), body.n);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "on this wall") == null);
+    wall_picker.sessionRows(&body, w, 1, 0, 80);
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "on this wall") != null);
+}
+test "sessionRows: an old daemon's list shows no count rather than zero" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var hosts_table = [_]Host{fixture.testHost(&shared, "box", "/b")};
+    fixture.setList(&hosts_table[0], "0\n");
+    const w = fixture.hostWall(&shared, &hosts_table);
+    var body = wall_picker.PickerBody{};
+    wall_picker.sessionRows(&body, w, 0, 0, 80);
+    try std.testing.expectEqual(@as(usize, 1), body.n);
+    // Never "0 clients": a daemon that cannot count said nothing, and a
+    // zero would read as a session nobody is in.
+    try std.testing.expect(std.mem.indexOf(u8, body.row(0), "client") == null);
+}
+test "sessionCount and rowStep: the row walks the host's own list and wraps" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var hosts_table = [_]Host{fixture.testHost(&shared, "box", "/b")};
+    fixture.setList(&hosts_table[0], "0\na\nb\n# holds 0 1");
+    try std.testing.expectEqual(@as(usize, 3), wall_picker.sessionCount(&hosts_table, 0));
+    // A selection with no host under it — an empty hosts file leaves one —
+    // counts zero rather than faulting.
+    try std.testing.expectEqual(@as(usize, 0), wall_picker.sessionCount(&hosts_table, 7));
+    try std.testing.expectEqual(@as(usize, 1), wall_picker.rowStep(0, 1, 3));
+    try std.testing.expectEqual(@as(usize, 0), wall_picker.rowStep(2, 1, 3));
+    try std.testing.expectEqual(@as(usize, 2), wall_picker.rowStep(0, -1, 3));
+    // An empty list has no row to rest on.
+    try std.testing.expectEqual(@as(usize, 0), wall_picker.rowStep(4, 1, 0));
+}
+test "pickAdd: a listed session becomes a pane once; a second add zooms to it" {
+    var arena = std.heap.ArenaAllocator.init(std.testing.allocator);
+    defer arena.deinit();
+    const alloc = arena.allocator();
+    var shared: Shared = undefined;
+    fixture.stoppedWall(alloc, &shared);
+    shared.size = .{ .cols = 120, .rows = 40 };
+    var hosts_table = [_]Host{fixture.testHost(&shared, "--sock /a", "/a")};
+    fixture.setList(&hosts_table[0], "0\nwork\n");
+    var tiles: [wv.max_tiles]Tile = undefined;
+    var present = [_]bool{false} ** wv.max_tiles;
+    var live: usize = 0;
+    defer fixture.endPumps(tiles[0..live]);
+    const w = fixture.wallOf(alloc, &tiles, &present, &live, &shared, &hosts_table);
+    const first = wall_picker.pickAdd(w, 0, 1).?;
+    try std.testing.expectEqualStrings("work", tiles[first].r.session);
+    // JOINED, never created: the session is already on that daemon, and a
+    // create would take a name the daemon has.
+    try std.testing.expect(!tiles[first].creates);
+    try std.testing.expectEqual(@as(?usize, 0), tiles[first].host);
+    try std.testing.expectEqual(@as(usize, 1), wv.presentCount(w.livePresent()));
+    const again = wall_picker.pickAdd(w, 0, 1).?;
+    try std.testing.expectEqual(first, again);
+    try std.testing.expectEqual(@as(usize, 1), wv.presentCount(w.livePresent()));
+    try std.testing.expectEqual(first, shared.sel);
+    // A row the list does not have adds nothing, and says so.
+    try std.testing.expectEqual(@as(?usize, null), wall_picker.pickAdd(w, 0, 9));
+    var buf: [96]u8 = undefined;
+    try std.testing.expect(std.mem.indexOf(u8, wv.takeNotice(&shared, &buf), "no session") != null);
+}
+test "paintPicker: the session level names the host and lists its sessions" {
+    const pipe = try std.posix.pipe2(.{ .NONBLOCK = true });
+    defer std.posix.close(pipe[0]);
+    defer std.posix.close(pipe[1]);
+    var shared = Shared{ .out_fd = pipe[1], .size = .{ .cols = 100, .rows = 40 }, .is_tty = true };
+    defer shared.tree.deinit();
+    var table = [_]Host{
+        fixture.testHost(&shared, "box", "/tmp/a.sock"),
+        fixture.testHost(&shared, "other", "/tmp/b.sock"),
+    };
+    for (&table) |*h| h.applied = true;
+    fixture.setList(&table[1], "0\nwork\n# holds 0 1");
+    fixture.setList(&table[0], "only\n");
+    var buf: [8192]u8 = undefined;
+    // Host 1, not host 0: an off-origin selection is the baseline, so a
+    // paint that read the FIRST host's list would be caught.
+    const frame = fixture.pickerFrameAt(&shared, pipe[0], &table, 1, .{ .level = .sessions, .row = 1 }, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "sessions on other") != null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "work") != null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "1 client") != null);
+    // The other host's session is not in this box.
+    try std.testing.expect(std.mem.indexOf(u8, frame, "only") == null);
+    // The footer is the session level's keys, not the host level's.
+    try std.testing.expect(std.mem.indexOf(u8, frame, "x end") != null);
+    try std.testing.expect(std.mem.indexOf(u8, frame, "x forget") == null);
+}
+test "Shared.PickEnd: the second x forces only on the same host and row, inside the window" {
+    var end: wv.PickEnd = .{};
+    try std.testing.expect(!end.armedFor(0, "work", 1000));
+    end.arm(0, "work", 1000 + wv.end_arm_ms);
+    try std.testing.expect(end.armedFor(0, "work", 1500));
+    // A different row is a FIRST press: the count the user read was about
+    // another session.
+    try std.testing.expect(!end.armedFor(0, "other", 1500));
+    // ...and so is the same name on another daemon.
+    try std.testing.expect(!end.armedFor(1, "work", 1500));
+    // The window closes on the clock.
+    try std.testing.expect(!end.armedFor(0, "work", 1000 + wv.end_arm_ms + 1));
+    // An accepted end disarms: the window must not outlive its session.
+    end.arm(0, "work", 1000 + wv.end_arm_ms);
+    end.clear();
+    try std.testing.expect(!end.armedFor(0, "work", 1500));
+}
+/// A daemon stand-in for `pickEnd`: one connection per press, each answering
+/// one `end_req` with a scripted verdict and recording the `force` bit that
+/// arrived. A REAL socket, because `pickEnd`'s whole job is the side
+/// connection — the verdicts are the daemon's to make and are pinned against
+/// a real one in `server_test_session.zig`.
+const EndFake = struct {
+    listener: std.net.Server,
+    replies: []const proto.EndReply,
+    force: [4]bool = @splat(false),
+    n: usize = 0,
+    fn serve(self: *EndFake) void {
+        const alloc = std.testing.allocator;
+        while (self.n < self.replies.len) {
+            const conn = self.listener.accept() catch return;
+            defer conn.stream.close();
+            const f = (proto.readFrame(alloc, conn.stream.handle) catch return) orelse return;
+            defer f.deinit(alloc);
+            if (f.type != .end_req or f.payload.len < proto.end_req_len) return;
+            const at = self.n;
+            self.force[at] = f.payload[0] != 0;
+            self.n += 1;
+            const r = self.replies[at];
+            var buf: [proto.end_reply_max_len]u8 = undefined;
+            proto.writeFrame(
+                conn.stream.handle,
+                .end_reply,
+                proto.encodeEndReply(&buf, r.accepted, r.others, r.reason),
+            ) catch return;
+        }
+    }
+};
+test "pickEnd: the first x arms with the count, the second forces, and a refusal that is not others-attached arms nothing" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sp = try std.fmt.allocPrint(alloc, "{s}/end.sock", .{tmp.path()});
+    defer alloc.free(sp);
+    const addr = try std.net.Address.initUnix(sp);
+    var fake = EndFake{
+        .listener = try addr.listen(.{}),
+        .replies = &.{
+            .{ .accepted = false, .others = 2, .reason = proto.end_reason.others_attached },
+            .{ .accepted = true, .others = 0, .reason = proto.end_reason.accepted },
+            .{ .accepted = false, .others = 0, .reason = proto.end_reason.no_session },
+        },
+    };
+    defer fake.listener.deinit();
+    const th = try std.Thread.spawn(.{}, EndFake.serve, .{&fake});
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    // TWO hosts, and the daemon on the SECOND: a one-host fixture cannot
+    // see a press that reached for the wrong row's machine. Host 0's socket
+    // has nothing on it, so a misdirected press fails loudly.
+    var table = [_]Host{
+        fixture.testHost(&shared, "nowhere", "/tmp/mux-no-such-socket"),
+        fixture.testHost(&shared, "box", sp),
+    };
+    // The two recipes deliberately DIFFER, and only the poller's reaches the
+    // fake: an end must ride the batch recipe (`BatchMode`, a connect
+    // timeout, `asked` false) and never the interactive one that would
+    // prompt on /dev/tty under the popup and start a daemon.
+    table[1].spec.target = .{ .sock = "/tmp/mux-no-such-socket-entry" };
+    // The holds lines are what say this daemon is new enough to be asked.
+    fixture.setList(&table[1], "0\nwork\n# holds 0 1\n# holds work 3");
+    const w = fixture.hostWall(&shared, &table);
+    var buf: [96]u8 = undefined;
+    // First press: refused with the count, and the window is armed on THIS
+    // host and THIS name.
+    wall_picker.pickEnd(w, 1, 1, 1000);
+    try std.testing.expect(shared.pick_end.armedFor(1, "work", 1500));
+    try std.testing.expect(!shared.pick_end.armedFor(1, "0", 1500));
+    try std.testing.expect(!shared.pick_end.armedFor(0, "work", 1500));
+    const first = wv.takeNotice(&shared, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, first, "work") != null);
+    // The DAEMON's verdict (2 others), not the row's holder count (3): the
+    // `# holds` line counts every holder including the asker, and the two
+    // numbers are deliberately different in this fixture so a notice built
+    // from the wrong one would be caught.
+    try std.testing.expect(std.mem.indexOf(u8, first, "2 others attached") != null);
+    try std.testing.expect(std.mem.indexOf(u8, first, "3 other") == null);
+    try std.testing.expect(std.mem.indexOf(u8, first, "x again to end") != null);
+    // Second press inside the window: forced, accepted, and disarmed.
+    wall_picker.pickEnd(w, 1, 1, 1500);
+    try std.testing.expect(!shared.pick_end.armedFor(1, "work", 1600));
+    const second = wv.takeNotice(&shared, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, second, "ending work on box") != null);
+    // A refusal that is NOT others-attached: the daemon's reason, in this
+    // client's words, and no arm — a next `x` must not force an end on a
+    // session the daemon just said it has not got.
+    wall_picker.pickEnd(w, 1, 1, 5000);
+    try std.testing.expect(!shared.pick_end.armedFor(1, "work", 5100));
+    const third = wv.takeNotice(&shared, &buf);
+    try std.testing.expect(std.mem.indexOf(u8, third, "work") != null);
+    try std.testing.expect(std.mem.indexOf(u8, third, "no such session") != null);
+    try std.testing.expect(std.mem.indexOf(u8, third, "x again") == null);
+    th.join();
+    // Three presses, three connections — and the force bit is the SECOND
+    // press and nothing else.
+    try std.testing.expectEqual(@as(usize, 3), fake.n);
+    try std.testing.expectEqual([3]bool{ false, true, false }, fake.force[0..3].*);
+}
+test "pickEnd: a daemon that counts no holders is too old to end a session, and is not dialled" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var table = [_]Host{
+        fixture.testHost(&shared, "new", "/tmp/mux-no-such-socket-a"),
+        fixture.testHost(&shared, "old", "/tmp/mux-no-such-socket-b"),
+    };
+    fixture.setList(&table[0], "0\n# holds 0 1");
+    // No `# holds` line anywhere: the counting and the `end_req` arm shipped
+    // together, so this daemon would answer the press with silence.
+    fixture.setList(&table[1], "0\nwork\n");
+    const w = fixture.hostWall(&shared, &table);
+    var buf: [96]u8 = undefined;
+    wall_picker.pickEnd(w, 1, 0, 1000);
+    // The pump's own wording for the same fact about the box, and no arm:
+    // nothing was asked, so there is nothing to press again for.
+    try std.testing.expectEqualStrings("[daemon too old to end a session]", wv.takeNotice(&shared, &buf));
+    try std.testing.expect(!shared.pick_end.armedFor(1, "0", 1500));
+}
+test "pickEnd: a row the list does not have asks nothing" {
+    var shared = Shared{ .out_fd = -1, .size = .{ .cols = 80, .rows = 24 }, .is_tty = false };
+    defer shared.tree.deinit();
+    var table = [_]Host{fixture.testHost(&shared, "box", "/tmp/mux-no-such-socket-c")};
+    fixture.setList(&table[0], "0\n# holds 0 1");
+    const w = fixture.hostWall(&shared, &table);
+    var buf: [96]u8 = undefined;
+    wall_picker.pickEnd(w, 0, 4, 1000);
+    try std.testing.expectEqualStrings("[no session on that row]", wv.takeNotice(&shared, &buf));
+}

src/tui/wallview.zig

Old		New
@@ -167,6 +167,10 @@ pub const Shared = struct {
167	/// The popup's last frame, so an unchanged one is not rewritten.	167	/// The popup's last frame, so an unchanged one is not rewritten.
168	/// Keyboard-thread only, like the picker itself.	168	/// Keyboard-thread only, like the picker itself.
169	picker_stamp: u64 = 0,	169	picker_stamp: u64 = 0,
		170	/// The picker's end two-step, per host and name: a second `x` on the SAME
		171	/// row inside the window forces, any other row is a first press.
		172	/// Keyboard-thread only, like the picker itself.
		173	pick_end: PickEnd = .{},
170	/// True while ssh's prompt box is on the terminal. `picker_open`'s	174	/// True while ssh's prompt box is on the terminal. `picker_open`'s
171	/// twin, for its reason and at the same gates — and a second flag	175	/// twin, for its reason and at the same gates — and a second flag
172	/// rather than a mode of the first, because a prompt ARRIVES and can	176	/// rather than a mode of the first, because a prompt ARRIVES and can
@@ -191,6 +195,29 @@ pub const Shared = struct {
191	}	195	}
192	};	196	};
193		197
		198	/// The picker's `x`, which is a two-step the client only REMEMBERS: the
		199	/// daemon refuses the first press with a count, and the second inside the
		200	/// window says the user meant it. Keyed by host AND name because the same
		201	/// session name lives on two daemons, and because a press that moved to
		202	/// another row is a question about another session — it must be a first
		203	/// press, not a force inherited from the row above.
		204	pub const PickEnd = struct {
		205	host: usize = 0,
		206	name: client.SessionName = .{},
		207	until: i64 = 0,
		208	pub fn armedFor(self: *const PickEnd, host: usize, name: []const u8, now: i64) bool {
		209	return now < self.until and self.host == host and std.mem.eql(u8, self.name.slice(), name);
		210	}
		211	pub fn arm(self: *PickEnd, host: usize, name: []const u8, until: i64) void {
		212	self.host = host;
		213	self.name = client.SessionName.of(name);
		214	self.until = until;
		215	}
		216	pub fn clear(self: *PickEnd) void {
		217	self.until = 0;
		218	}
		219	};
		220
194	/// Opens the prompt box on whatever ssh is asking, if anything is. False	221	/// Opens the prompt box on whatever ssh is asking, if anything is. False
195	/// when there is nothing to show or a box is already up: `take` is the	222	/// when there is nothing to show or a box is already up: `take` is the
196	/// transition, so a doorbell rung twice opens one popup.	223	/// transition, so a doorbell rung twice opens one popup.
@@ -208,6 +235,7 @@ pub fn closeAsk(
208	shared: *Shared,	235	shared: *Shared,
209	prefix: *interact.PrefixFilter,	236	prefix: *interact.PrefixFilter,
210	picker_sel: usize,	237	picker_sel: usize,
		238	picker_row: usize,
211	) void {	239	) void {
212	// ONE function: `relayout` CLEARS the screen, so a picker still open	240	// ONE function: `relayout` CLEARS the screen, so a picker still open
213	// under the box owes a repaint. The answer buffer is zeroed here and	241	// under the box owes a repaint. The answer buffer is zeroed here and
@@ -220,7 +248,7 @@ pub fn closeAsk(
220	if (!prefix.picking) return;	248	if (!prefix.picking) return;
221	var foot: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;	249	var foot: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;
222	const back = wall_picker.pickerRepaint(&foot, prefix, true);	250	const back = wall_picker.pickerRepaint(&foot, prefix, true);
223	wall_picker.paintPicker(shared, w.hosts, picker_sel, back.line);	251	wall_picker.paintPicker(w, picker_sel, .{ .level = prefix.pick_level, .row = picker_row }, back.line);
224	}	252	}
225		253
226	/// The host picker gives the terminal back — the key that closed it, or the	254	/// The host picker gives the terminal back — the key that closed it, or the
@@ -238,6 +266,10 @@ fn closePicker(
238	// popup was painted over and bumps `repaint_gen` — the only thing that	266	// popup was painted over and bumps `repaint_gen` — the only thing that
239	// redraws a tile whose session said nothing while the box was up.	267	// redraws a tile whose session said nothing while the box was up.
240	prefix.picking = false;	268	prefix.picking = false;
		269	// The level goes home with the box, whichever end closed it: a popup
		270	// reopened after an auto-close must be a HOST list, and only the keys
		271	// that close it themselves put the level back.
		272	prefix.pick_level = .hosts;
241	shown.* = false;	273	shown.* = false;
242	w.shared.picker_open.store(false, .release);	274	w.shared.picker_open.store(false, .release);
243	// The screen under the box is about to be redrawn, so the next open owes	275	// The screen under the box is about to be redrawn, so the next open owes
@@ -895,8 +927,11 @@ pub fn vanishTile(tiles: []Tile, present: []bool, shared: *Shared, i: usize, to:
895	/// `Ctrl-\ x`: this pane leaves THIS wall. The session is the daemon's and	927	/// `Ctrl-\ x`: this pane leaves THIS wall. The session is the daemon's and
896	/// keeps running for whoever else holds it; ending one is the picker's	928	/// keeps running for whoever else holds it; ending one is the picker's
897	/// job, beside the count of who else is there. The pump is told to say	929	/// job, beside the count of who else is there. The pump is told to say
898	/// goodbye (`detach_req`) so the daemon frees the slot now rather than at	930	/// goodbye (`detach_req`): it writes `.detach` on its way out — the last
899	/// a timeout, then the tile is vanished and the layout written without it.	931	/// thing `pumpTile` does past its loop — so the daemon frees the slot on a
		932	/// goodbye rather than at a timeout, and the transport close behind it is
		933	/// the fallback for a pump that ended some other way. Then the tile is
		934	/// vanished and the layout written without it.
900	pub fn removePane(w: Wall, z: usize) void {	935	pub fn removePane(w: Wall, z: usize) void {
901	if (z >= w.live.* or !w.present[z]) return;	936	if (z >= w.live.* or !w.present[z]) return;
902	const t = &w.tiles[z];	937	const t = &w.tiles[z];
@@ -1892,6 +1927,11 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
1892	// popup reopened by reflex is where it was left. Keyboard-thread	1927	// popup reopened by reflex is where it was left. Keyboard-thread
1893	// state, like the focus.	1928	// state, like the focus.
1894	var picker_sel: usize = 0;	1929	var picker_sel: usize = 0;
		1930	// Which SESSION row the picker's second level rests on, as an index into
		1931	// `picker_sel`'s host list. Reset on every level change rather than kept
		1932	// like `picker_sel`: a row number means nothing on another host's list,
		1933	// and the daemons answer while the box is open.
		1934	var picker_row: usize = 0;
1895	// The prompt on screen, kept because the box is repainted on every	1935	// The prompt on screen, kept because the box is repainted on every
1896	// keystroke and the question does not come round again.	1936	// keystroke and the question does not come round again.
1897	var ask_prompt: askpass.Prompt = .{};	1937	var ask_prompt: askpass.Prompt = .{};
@@ -2037,7 +2077,7 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2037	// nobody waits on. Dismissing it by key would decline a live dial.	2077	// nobody waits on. Dismissing it by key would decline a live dial.
2038	if (input.prefix.asking) {	2078	if (input.prefix.asking) {
2039	if (shared.prompts) \|l\| {	2079	if (shared.prompts) \|l\| {
2040	if (!l.showing()) closeAsk(w, &shared, &input.prefix, picker_sel);	2080	if (!l.showing()) closeAsk(w, &shared, &input.prefix, picker_sel, picker_row);
2041	}	2081	}
2042	}	2082	}
2043	// Every pass, not only on the bell: `endedTile`'s reason twice	2083	// Every pass, not only on the bell: `endedTile`'s reason twice
@@ -2086,6 +2126,10 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2086	picker_opened = true;	2126	picker_opened = true;
2087	picker_shown = true;	2127	picker_shown = true;
2088	input.prefix.picking = true;	2128	input.prefix.picking = true;
		2129	// The wall's own open is a HOST list: the level is the
		2130	// filter's, and nothing else here would put it back.
		2131	input.prefix.pick_level = .hosts;
		2132	picker_row = 0;
2089	picker_sel = wall_picker.pickerNearest(w.hosts, picker_sel);	2133	picker_sel = wall_picker.pickerNearest(w.hosts, picker_sel);
2090	},	2134	},
2091	.close => closePicker(w, &input.prefix, &picker_shown, null),	2135	.close => closePicker(w, &input.prefix, &picker_shown, null),
@@ -2095,10 +2139,16 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2095	// popup is open, but a repaint every 100ms rewrites an unchanged	2139	// popup is open, but a repaint every 100ms rewrites an unchanged
2096	// screen. A zeroed stamp is a screen the box is no longer on —	2140	// screen. A zeroed stamp is a screen the box is no longer on —
2097	// `relayout` cleared it, and nothing else would repaint the popup.	2141	// `relayout` cleared it, and nothing else would repaint the popup.
		2142	// The lists move under the box: a poll that ended a session while
		2143	// the popup was open leaves the selection past the last row, and
		2144	// the highlight would be on nothing.
		2145	if (input.prefix.pick_level == .sessions)
		2146	picker_row = @min(picker_row, wall_picker.sessionCount(w.hosts, picker_sel) -\| 1);
2098	var foot_buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;	2147	var foot_buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;
2099	const repair = wall_picker.pickerRepaint(&foot_buf, &input.prefix, picker_opened or host_news or	2148	const repair = wall_picker.pickerRepaint(&foot_buf, &input.prefix, picker_opened or host_news or
2100	winch or fds[1].revents != 0 or shared.picker_stamp == 0);	2149	winch or fds[1].revents != 0 or shared.picker_stamp == 0);
2101	if (repair.due) wall_picker.paintPicker(&shared, w.hosts, picker_sel, repair.line);	2150	if (repair.due)
		2151	wall_picker.paintPicker(w, picker_sel, .{ .level = input.prefix.pick_level, .row = picker_row }, repair.line);
2102	if (fds[0].revents == 0) continue;	2152	if (fds[0].revents == 0) continue;
2103		2153
2104	const n = std.posix.read(stdin_fd, &b) catch break;	2154	const n = std.posix.read(stdin_fd, &b) catch break;
@@ -2141,7 +2191,7 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2141	wall_picker.paintAsk(&shared, ask_prompt.slice(), &input.prefix);	2191	wall_picker.paintAsk(&shared, ask_prompt.slice(), &input.prefix);
2142	continue;	2192	continue;
2143	}	2193	}
2144	closeAsk(w, &shared, &input.prefix, picker_sel);	2194	closeAsk(w, &shared, &input.prefix, picker_sel, picker_row);
2145	continue;	2195	continue;
2146	}	2196	}
2147	// The picker is a MODE: while it is open every key is the popup's,	2197	// The picker is a MODE: while it is open every key is the popup's,
@@ -2161,15 +2211,51 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2161	if (tiles[z].host) \|hi\| picker_sel = hi;	2211	if (tiles[z].host) \|hi\| picker_sel = hi;
2162	}	2212	}
2163	picker_sel = wall_picker.pickerNearest(w.hosts, picker_sel);	2213	picker_sel = wall_picker.pickerNearest(w.hosts, picker_sel);
		2214	picker_row = 0;
2164	}	2215	}
		2216	// The level the FILTER left, not the one the key arrived at: it
		2217	// flips `pick_level` before returning, so `.sessions` on a
		2218	// `.pick_enter` means the list just opened and `.hosts` means a
		2219	// session was chosen and the popup is closing.
		2220	const level = input.prefix.pick_level;
2165	switch (cmd.action) {	2221	switch (cmd.action) {
2166	.pick_move => \|d\| picker_sel = wall_picker.pickerStep(w.hosts, picker_sel, d),	2222	.pick_move => \|d\| if (level == .sessions) {
2167	.pick_select => \|row\| {	2223	picker_row = wall_picker.rowStep(picker_row, d, wall_picker.sessionCount(w.hosts, picker_sel));
		2224	} else {
		2225	picker_sel = wall_picker.pickerStep(w.hosts, picker_sel, d);
		2226	},
		2227	.pick_select => \|row\| if (level == .sessions) {
		2228	picker_row = @min(row - 1, wall_picker.sessionCount(w.hosts, picker_sel) -\| 1);
		2229	} else {
2168	if (wall_picker.pickerAt(w.hosts, row - 1)) \|hi\| picker_sel = hi;	2230	if (wall_picker.pickerAt(w.hosts, row - 1)) \|hi\| picker_sel = hi;
2169	},	2231	},
		2232	.pick_enter => if (level == .sessions) {
		2233	// Enter at the host level: the session list just opened,
		2234	// and there is nothing to do but paint it from the top.
		2235	picker_row = 0;
		2236	// ...unless there is no host under the selection at all.
		2237	// An empty hosts file leaves `picker_sel` at 0 with no
		2238	// row there, and a level with nothing in it is a box the
		2239	// user has to Esc back out of for nothing.
		2240	if (picker_sel >= w.hosts.len or w.hosts[picker_sel].forgotten.load(.acquire)) {
		2241	input.prefix.pick_level = .hosts;
		2242	setNotice(&shared, "[no host to list sessions on - a adds one]");
		2243	}
		2244	} else {
		2245	// Enter at the session level: the popup closed on a
		2246	// choice, and that session becomes a pane.
		2247	birth_at = wall_picker.pickAdd(w, picker_sel, picker_row);
		2248	},
		2249	// Back at the hosts, so the row means nothing any more.
		2250	.pick_back => picker_row = 0,
		2251	.pick_end => wall_picker.pickEnd(w, picker_sel, picker_row, std.time.milliTimestamp()),
2170	.pick_birth => birth_at = wall_picker.pickBirth(w, picker_sel),	2252	.pick_birth => birth_at = wall_picker.pickBirth(w, picker_sel),
2171	.pick_forget => wall_picker.pickForget(w, picker_sel, hosts_path),	2253	.pick_forget => wall_picker.pickForget(w, picker_sel, hosts_path),
2172	.add_tile => \|spelling\| {	2254	.add_tile => \|spelling\| {
		2255	// The editor adds a HOST, so its answer belongs on the
		2256	// host list — whichever level the `a` was typed at.
		2257	input.prefix.pick_level = .hosts;
		2258	picker_row = 0;
2173	switch (wall_host.addHost(	2259	switch (wall_host.addHost(
2174	alloc,	2260	alloc,
2175	&shared,	2261	&shared,
@@ -2188,10 +2274,14 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2188	if (th) \|handle\| handle.detach();	2274	if (th) \|handle\| handle.detach();
2189	// The row the user just made is the row they meant.	2275	// The row the user just made is the row they meant.
2190	picker_sel = hi;	2276	picker_sel = hi;
		2277	picker_row = 0;
2191	},	2278	},
2192	// The row it is already on is the row they meant too:	2279	// The row it is already on is the row they meant too:
2193	// an unchanged popup is the prompt saying nothing.	2280	// an unchanged popup is the prompt saying nothing.
2194	.listed => \|hi\| picker_sel = hi,	2281	.listed => \|hi\| {
		2282	picker_sel = hi;
		2283	picker_row = 0;
		2284	},
2195	.refused => {},	2285	.refused => {},
2196	}	2286	}
2197	},	2287	},
@@ -2201,7 +2291,7 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2201	if (input.prefix.picking) {	2291	if (input.prefix.picking) {
2202	var line_buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;	2292	var line_buf: [interact.PrefixFilter.prompt_max + 4]u8 = undefined;
2203	const keyed = wall_picker.pickerRepaint(&line_buf, &input.prefix, true);	2293	const keyed = wall_picker.pickerRepaint(&line_buf, &input.prefix, true);
2204	wall_picker.paintPicker(&shared, w.hosts, picker_sel, keyed.line);	2294	wall_picker.paintPicker(w, picker_sel, .{ .level = input.prefix.pick_level, .row = picker_row }, keyed.line);
2205	} else {	2295	} else {
2206	// A close the USER asked for: the auto-open no longer owns	2296	// A close the USER asked for: the auto-open no longer owns
2207	// this popup, so the next tile to arrive cannot force-close	2297	// this popup, so the next tile to arrive cannot force-close
@@ -2285,6 +2375,9 @@ pub fn run(alloc: std.mem.Allocator, host_specs: []const HostSpec, entry: Entry)
2285	.pick_forget,	2375	.pick_forget,
2286	.pick_add_open,	2376	.pick_add_open,
2287	.pick_close,	2377	.pick_close,
		2378	.pick_enter,
		2379	.pick_back,
		2380	.pick_end,
2288	=> {},	2381	=> {},
2289	// ssh's own keys, answered above this switch for the reason	2382	// ssh's own keys, answered above this switch for the reason
2290	// the picker's are: the box is the only thing on the screen	2383	// the picker's are: the box is the only thing on the screen