Beagle SCM

BRO-039: strict three-part O wire form — CTX: verb args, context MANDATORY, . = here, no silent fallback

RULING (gritzko, chat 2026-07-19): the arg-into-context bug was fixed twice (BE-053, BRO-038DONT→BE-053) and returned (WORK-013) — the part gets REWORKED, not patched. Every O token is three-part CTX: verb args with the context slot ALWAYS present: . = empty ("here", leaves the pager context), /… = absolute (REPLACES the context), anything else = relative (COMBINES with the context). Args pass to the verb VERBATIM. parseOspell becomes one strict regex; a non-matching token is NOT an O spell — loud error, never "context-less spell".

Input

Context

• The reinfection door: shared/spell.js parseOspell (:154-162) arms the split only on a leading //; every other token silently degrades to {context:"", spell:token} — so mis-baked mints keep working wrong, and the pager scavenges context from ARGS instead (_fillAuth graft pager.js:740, _ctxFrom(arg) reduction :744 — the audited leak list, 2026-07-19 bro-derivation inspection).
• BRO-025 iter-1 "context-less token = here" impl decision is hereby OVERTURNED by the ruling; BRO-025's three-part concept and the drive-in-own-context machinery (_actSpell/_runSpell ctxOverride → driveSpell, loop context-first RAW args) STAND and are reused.
• Audit facts (2026-07-19, both inspections): all current O mints conform (empty/absolute ctx, args literal); kind 3 (relative) is unrepresentable in the codec; two producers bypass mintOspell (views/todo/todo.js:260 raw done KEY, views/why/why.js:154 hand-baked #rgb commit ?hashlet); "//" is used as an empty-context alias (work.js:444/446); pager persists the NEXT context off the ARG, not the O context (pager.js:720 vs :744).
• O tokens exist only inside rendered TLV hunks, regenerated per paint — mint+parse switch in ONE commit is a safe flag-day, nothing persisted to migrate; view.call stores context and spell separately already.

Goals

• Wire form: CTX: verb args, CTX mandatory — .: todo BE-021, ///jab/dog/abc/: status, dog/abc: status. parseOspell = one regex ^(\S+): (.*)$ (context = the space-free token before the FIRST : ; contexts are URIs/paths, never contain spaces, so : inside args stays safe). Trailing / shed off the context as today.
• mintOspell always emits the context slot (. for empty); every O producer routes through mintOspell — the todo.js:260 and why.js:154 bypasses are converted (the #rgb tint becomes its own leading marker, not welded into the spell text).
• A token failing the regex is NOT an O spell: the pager rejects it loudly (plain-words error naming the token), never degrades. This is the anti-reinfection core.
• Pager context seam: ONE helper combine(current, ctx) — ./empty → current; leading / → replace; else → join — used BOTH for the drive context and the recorded next this.ctx; the _fillAuth graft and _ctxFrom(arg) reduction leave the O path; args are display-verbatim, never context donors.
• All three kinds round-trip mint→parse→combine; pty proof per kind.

Constraints

• U tokens untouched here: U-follow arg→context reduction is a separate pending ruling (BRO-024 $PWD model vs args-verbatim) — do not change U behavior in this ticket.
• Typed : spells (_applySpell/_driveApply) and slot-edits keep today's behavior; only the O token path reworks.
• Rulings in force: pager arg-blind, resolution via core/resolve_hash.js, errors in plain words; the regex splits the three parts ONLY — the context substring goes to the standard URI/resolve machinery, never regex-parsed as a URI.
• Overlaps in-flight WORK-013 (work.js U→O mints via mintOspell — its output re-bases onto the new mint form cleanly); land order: whichever first, expect a weave.
• test/bro/ospell (BRO-025's 15 checks) pins the OLD optional-context form — amending it to the strict form is AUTHORIZED; test/work/view, test/todo/view, test/done/buttons token pins likewise; no other test edits.

WIP

Design decisions

• (impl 2026-07-19) parseOspell = ONE regex ^(\S+): (.*)$; a non-match returns NULL (no silent {context:"",spell} degrade). Trailing dir / shed via ([^/])\/+$ so /// (main tree) is KEPT intact (coordinator: WORK-013 ///: status must not collapse to ""). mintOspell ALWAYS emits the slot; ""/"//" → ..
• (impl) pager seam: _combine(current,ctx) — ./empty keep, a leading / (//WT,///,///sub) REPLACES verbatim (resolve machinery owns URI→tree), else COMBINES (joinPath as a dir). Used for BOTH the drive context AND the recorded this.ctx in the O paths; _fillAuth/_ctxFrom(arg) stay ONLY on the U path.
• (impl) O-vs-U at the click: clickTargetAt returns {text,tag}; the O path strict-parses, the U/F/line path follows verbatim (U behavior untouched, per constraint). _uriAt string contract preserved (why/blame, commit/*, rowclick, sub/advput all read it).
• (impl, DEVIATION — RESOLVED iter 2) the drive-as-"here" softening is REMOVED: gritzko authorized the sweep 2026-07-20, both producers (status.js [put]/[del], why.js commit O) now mint via mintOspell, and a parse-NULL token is rejected loudly in mouse (not an action link: <token>, pager.js:1264, plain words). Authorized pin re-pins: test/why/blame, test/sub/advput, test/status/buttons (assertbuttons + click_refresh), test/why/range, plus 4 new loud-reject seam checks in bro/ospell.

TODOs

• red: ospell unit + real-click seam — strict round-trip all 3 kinds (., //WT////////sub, dog/abc), /// kept, old slotless token REJECTED (null pinned), quoted : safe; RED shown: old parse collapsed ///→"" and degraded slotless silently
• codec: parseOspell strict/null + mintOspell mandatory .; convert todo.js:260 (done KEY→mintOspell); ""/"//" alias route through mint. DEFERRED: why.js:154 — see Blockers
• pager: _combine drives AND persists; fillAuth/ctxFrom leave the O path; slotless-O reject softened to "here" (see decision)
• green: real-click seam per kind (leave/replace/combine) + WORK-013 arg-not-context proof; work/view+todo/view+done/buttons+graf green
• sweep (iter 2, authorized 2026-07-20): why.js + status.js → mintOspell (tint is its own leading marker); loud reject lands; 5 test pins re-pinned to strict form, no assertion weakened
• broad: in-wt ctest 307 tests, 1 FAIL = work/getctx (baseline, cure staged in //WORK-010); bro/color + bro/view now GREEN

Blockers and bummers

• why.js:154 conversion (RESOLVED iter 2): authorized 2026-07-20, mints .: commit ?hashlet with the #rgb tint as its own leading marker; why/blame + why/range re-pinned, both green.
• jab diff <big-file> in this wt dies hunk.render: out full — sibling of DIFF-010 (weave.fold grow-on-full landed, hunk.render's out buffer still fixed); proposed as its own ticket, small diffs render fine, ctest diff suites green.
• test/work/getctx STAYS red (baseline red, NOT my regression): its pty driver hardcodes the RETIRED [get]/[diff] labels (WORK-004/010 replaced them with [±]/[-N]), so its frames never paint. Green needs a getctx.py label update — outside the authorised edit set. The get→row-wt threading it targets DOES work now (proved headless in test/bro/ospell).
• pre-existing reds unrelated to BRO-039: bro/color, bro/view (readdir-order stale goldens, per BRO-025).

Outcome

• Suggested commit: BRO-039: strict 3-part O wire form CTX: verb
• iter 1 (this wt, UNCOMMITTED, per order): shared/spell.js (parseOspell strict+null, mintOspell mandatory ., /// kept), views/bro/pager.js (clickTargetAt tag, combine, O-path in runSpell/actSpell, tag-aware mouse), views/todo/todo.js:260 (mint the done O). Tests: test/bro/ospell NEW (codec + real _feed click seam, 55 checks), test/work/view + test/todo/view + test/done/buttons re-pinned to .-ctx. jab put staged all 8.
• WORK-013 weave: it mints work-view tree rows ///: status / ///vend/ext/: status in its OWN wt via mintOspell; my mint emits that exact form and my parse+combine keep /// intact and persist it — clean weave, both mint via the shared codec.
• green (JABC=~/bin/jab): bro/ospell, work/view, todo/view, done/buttons, graf/parity PASS. Broad regression 89 PASS / 10 SKIP / 3 FAIL — the 3 (bro/color, bro/view, work/getctx) all pre-existing, none my regression (sub/advput + why/blame stay green under the new pager).
• iter 2 (sweep, staged): views/why/why.js, views/status/status.js, views/bro/pager.js (loud reject), test pins why/blame, why/range, sub/advput, status/buttons ×2, bro/ospell +4 checks. 15 files staged total. In-wt ctest -LE big: 307 tests, 306 pass, sole red work/getctx (baseline, //WORK-010 owns the cure); orchestrator re-ran the 9 target suites independently — 10/10 pass.