max / makenotwork

Add the viewer: one surface over every status.json source Tabs per source plus a rollup showing every source at once, worst first. The rollup is the product: without it this is N tabs you still have to visit one at a time, which is the situation it replaces with extra steps. The viewer knows nothing about tiers, gates, apps or targets. It renders ops-status and nothing else, so a new daemon gets a UI by emitting a payload and adding four lines of config. The moment a source needs a special case in here, the shell has started learning domain vocabulary. Read-only for now. The declared actions are shown by name and the payload carries everything needed to fire them, but no key issues a request. The actions on the sando tab include promote-b and rollback-b, which move production; a surface that can fire those from a keystroke deserves its own deliberate pass rather than arriving as a side effect of building the display. Wiring it is a confirm modal and a POST. Three things the contract's design paid for here: Render is a pure function of (model, now), with the clock threaded through every call rather than read ambiently. That is what lets the whole surface be snapshot-tested against fixture payloads through TestBackend with no daemon running and no terminal attached. Staleness is the viewer's job, not the producer's. A source cannot mark itself stale because the case that matters is the one where it stopped answering entirely. A source that answers with something old reads as degraded however green its contents, which is the 40-day backup that every check called healthy. Source reachability is a status. A source never polled is unknown and sorts above degraded, and an unreachable one keeps its last payload on screen next to the reason it could not be refreshed, rather than going blank. Tokens are named, never pasted: token_env points at the same environment variable the daemon already reads, so the config file describing topology stays readable without holding a prod token. ratatui 0.30.2, using its own crossterm re-export so the two cannot drift into a version mismatch. Both TUIs' pending 0.29-to-0.30 upgrade tasks were closed as superseded; they are being deleted, not upgraded. sando/tui and bento/tui are still in the tree. They should go once this has been run against live daemons. The product also has no name yet -- ops-viewer is a placeholder. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>