shep 0.8.1

//! `draw`: one `App`, one `Frame`, six regions of arithmetic.
//!
//! No `Layout`, no `Constraint`, no widget. The upstream surface this whole
//! module touches is six items wide: `Frame::area`, `Frame::buffer_mut`,
//! `Buffer::set_line`, `Line`, `Span`, `Style`, which keeps the render path
//! both testable and cheap to keep working across a ratatui release.

pub mod bleats;
pub mod bleats_full;
pub mod cell;
pub mod detail;
pub mod flock;
pub mod host;
mod keymap;
pub mod link_panel;
mod overlay;
pub mod pane;
pub mod scroll;
pub mod secrets;
pub mod settings;
pub mod sheep;
pub mod status;

// `pub`, not private: a test in `super::super`'s own `mod tests` (it drives
// `run_ui`) needs `fixtures::sample()` from here. `#[cfg(test)]` still keeps
// every item out of the ordinary build.
#[cfg(test)]
pub mod fixtures;

use ratatui::Frame;
use ratatui::buffer::Buffer;
use ratatui::layout::Rect;
use ratatui::style::Style;
use ratatui::text::{Line, Span};

use self::flock::MIN_HEIGHT;
use super::app::{App, Body, Grouping, Link, RowKey};
use super::theme::Palette;
use crate::vocabulary::Role;

/// The narrowest terminal the dashboard draws into.
///
/// The table's own floor ([`flock::MIN_WIDTH`], 31) plus the selection
/// marker's gutter ([`flock::GUTTER`], 2). Below this the whole draw becomes
/// two short lines saying so.
pub const MIN_TERM_WIDTH: u16 = flock::MIN_WIDTH + flock::GUTTER;

/// Rows the chrome always takes: title, column header, rule, status bar.
///
/// The banner is not in this count: it is one row only when the link is
/// not live, and callers that need the worst case add it separately.
///
/// `#[cfg(test)]`: `draw` lays these out one `y += 1` at a time rather than
/// summing them, so this constant has no production call site.
#[cfg(test)]
const CHROME_ROWS: u16 = 4;

/// The host strip is one line.
/// The shortest terminal that gets the design's two blank chrome rows, one
/// under the title band and one under the rule.
///
/// Not a taste threshold. `the_flock_table_keeps_the_middle_of_the_screen`
/// pins the table at five data rows on a 24-row terminal, and at that height
/// there is exactly no slack: spending two rows on air there takes the table
/// to three, which is the pane stopping being the point of the screen. Six
/// rows above that floor is where the air costs nothing that matters.
const ROOMY_HEIGHT: u16 = 30;

const HOST_ROWS: u16 = 1;

/// The detail pane: one rule and four lines.
const DETAIL_ROWS: u16 = 5;

/// The bleats feed: one rule, one header, five lines.
const FEED_ROWS: u16 = 7;

/// Which optional panes a terminal of a given height gets.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct Panes {
    /// The host-usage strip, under the title.
    pub host: bool,
    /// The sheep detail pane, under the table.
    pub detail: bool,
    /// The bleats feed, under that.
    pub feed: bool,
}

impl Panes {
    /// The flock table alone, what every terminal shorter than
    /// [`PANE_TIERS`]' last threshold gets.
    pub const NONE: Self = Self {
        host: false,
        detail: false,
        feed: false,
    };

    /// How many rows these panes take together.
    ///
    /// `#[cfg(test)]`: `draw` claims each pane's rows off `floor` one
    /// constant at a time, so only
    /// `every_pane_tier_fits_the_height_it_claims` needs the sum.
    #[cfg(test)]
    #[must_use]
    pub const fn rows(self) -> u16 {
        let mut rows = 0;
        if self.host {
            rows += HOST_ROWS;
        }
        if self.detail {
            rows += DETAIL_ROWS;
        }
        if self.feed {
            rows += FEED_ROWS;
        }
        rows
    }
}

/// Height thresholds, tallest first. Each entry is the shortest terminal that
/// still gets that pane set.
///
/// The drop order is least-diagnostic first. 24 is the classic terminal
/// height, chosen so a plain 80x24 gets all three panes with a flock table
/// worth reading.
const PANE_TIERS: &[(u16, Panes)] = &[
    (
        24,
        Panes {
            host: true,
            detail: true,
            feed: true,
        },
    ),
    (
        18,
        Panes {
            host: true,
            detail: false,
            feed: true,
        },
    ),
    (
        14,
        Panes {
            host: true,
            detail: false,
            feed: false,
        },
    ),
    (MIN_HEIGHT, Panes::NONE),
];

/// The widest pane set that fits `height`.
#[must_use]
pub fn panes_for(height: u16) -> Panes {
    PANE_TIERS
        .iter()
        .find(|(threshold, _)| height >= *threshold)
        .map_or(Panes::NONE, |(_, panes)| *panes)
}

/// Renders the whole dashboard.
///
/// Synchronous, and every branch draws something except a zero-area frame,
/// which returns without drawing. A degenerate case draws a sentence rather
/// than nothing, since a blank pane cannot say whether the shepherd has
/// nothing to run or the dashboard is broken.
///
/// How tall the settings screen's body is for a terminal of `area`, between
/// the title line and the status bar. Zero for a terminal too small to draw
/// at all, so a caller that asks before checking size gets a viewport that
/// never scrolls rather than an underflowed height.
///
/// `run_ui` calls this before each draw, so [`App::note_body_rows`] always
/// reflects the terminal about to be drawn to. `draw` builds the same four
/// full-screen panes' own `Rect`s off [`title_gap_rows`], so a body that did
/// not know about the rows spent there would get a `Rect` taller than the
/// space actually left before the status bar, and its last row would be
/// drawn only to be overwritten.
#[must_use]
pub fn body_rows(area: Rect) -> u16 {
    if area.width < MIN_TERM_WIDTH || area.height < MIN_HEIGHT {
        return 0;
    }
    // The status bar's own row, plus everything `title_gap_rows` spends
    // before a full-screen pane's body starts.
    area.height - 1 - title_gap_rows(area.height)
}

/// Rows `draw` spends between the top of the frame and a full-screen pane's
/// body: the title band, plus a blank row under it on a roomy terminal
/// ([`ROOMY_HEIGHT`]).
///
/// The one function both `draw` and [`body_rows`] call for this, so the two
/// can't drift the way they once did: a row added here reaches both without
/// a second edit.
#[must_use]
fn title_gap_rows(height: u16) -> u16 {
    1 + u16::from(height >= ROOMY_HEIGHT)
}

/// The refusal a terminal under [`MIN_TERM_WIDTH`] or [`MIN_HEIGHT`] gets
/// instead of a body.
///
/// Two short lines, not one long sentence: `Buffer::set_line` truncates at
/// `max_width` in silence, and this exists for terminals narrower than
/// `MIN_TERM_WIDTH`.
fn draw_too_small(frame: &mut Frame<'_>, area: Rect) {
    if area.width == 0 || area.height == 0 {
        return;
    }
    let first = Line::from(Span::raw("too small"));
    frame
        .buffer_mut()
        .set_line(area.x, area.y, &first, area.width);
    if area.height >= 2 {
        let second = Line::from(Span::raw(format!("need {MIN_TERM_WIDTH}x{MIN_HEIGHT}")));
        frame
            .buffer_mut()
            .set_line(area.x, area.y + 1, &second, area.width);
    }
}

/// Real caller: `super::mod`'s `run_ui`, once per frame.
///
/// Three steps, so the overlay's own call is structural: a new `Body`
/// variant cannot skip it, since the call sits outside the match a new
/// arm would join. One call after whichever body drew, not a convention
/// repeated at each exit.
///
/// The refusal is the one path that gets no overlay: a terminal too
/// narrow for a body is too narrow for a box over it.
pub fn draw(app: &App, frame: &mut Frame<'_>) {
    let area = frame.area();
    let (width, height) = (area.width, area.height);

    if width < MIN_TERM_WIDTH || height < MIN_HEIGHT {
        draw_too_small(frame, area);
        return;
    }

    draw_body(app, frame);
    draw_keymap_overlay(app, area, frame.buffer_mut(), app.palette());
}

/// Whichever of the six [`Body`] variants is up, plus the title band and
/// the status bar around it. Never the keymap overlay: [`draw`] draws that
/// once, over whatever this left on the screen.
fn draw_body(app: &App, frame: &mut Frame<'_>) {
    let area = frame.area();
    let (width, height) = (area.width, area.height);
    let palette = app.palette();

    let panes = panes_for(height);
    let mut y = area.y;
    // The status bar's own row. Held once, up front: the bottom stack below
    // is laid out UPWARD from it, so nothing has to know the flock table's
    // length before deciding where the table ends.
    let bottom = area.y + height - 1;
    let buffer = frame.buffer_mut();

    buffer.set_line(area.x, y, &title_band(app, width), width);
    // The sheep pane owns the whole body between the title and the status
    // bar too, the same as the four below, but row 1 is its own identity
    // band rather than blank chrome, so it is checked here, ahead of the
    // roomy blank row the others are paid in: a tall terminal must not
    // push the band down to row 2 the way it pushes their body down. Its
    // own row, `y + 1`, rather than `title_gap_rows`, which is exactly the
    // gap it is skipping.
    if let Body::Sheep(pane) = app.body() {
        let top = y + 1;
        let body = Rect {
            x: area.x,
            y: top,
            width,
            height: bottom.saturating_sub(top),
        };
        sheep::draw(app, pane, body, buffer);
        buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
        return;
    }

    // `title_gap_rows` also covers the blank row under the title on a
    // roomy terminal; the rule further down spends a second one of its
    // own, both from the design's own row allocation. One function, read
    // by `body_rows` too, so the two cannot drift.
    y += title_gap_rows(height);
    let roomy = height >= ROOMY_HEIGHT;
    // Read four times below: the column header's own wording, and the three
    // panes the bottom stack chooses between.
    let frozen = matches!(app.link(), Link::Lost { .. });

    // The settings screen and the config pane each own the whole body
    // between the title and the status bar: a swap, not an overlay, so
    // nothing below draws while one is up. One `match` on `App::body`
    // rather than two sequential `if let`s, since the two can never both
    // be open at once. Still true of these four bodies; two overlays draw
    // over a body rather than swapping for it. The config pane's own close
    // dialog came first, inside `pane::draw_pane` rather than here, over
    // whichever body that pane already is. The keymap overlay came second
    // and is general: `draw` draws it after this function returns, over
    // whichever of the six bodies drew, so nothing here has to remember.
    match app.body() {
        Body::ConfigPane(pane) => {
            let body = Rect {
                x: area.x,
                y,
                width,
                height: body_rows(area),
            };
            pane::draw_pane(app, pane, body, buffer);
            buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
            return;
        }
        Body::Settings(settings) => {
            let body = Rect {
                x: area.x,
                y,
                width,
                height: body_rows(area),
            };
            settings::draw_settings(app, settings, body, buffer);
            buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
            return;
        }
        Body::Bleats(pane) => {
            let body = Rect {
                x: area.x,
                y,
                width,
                height: body_rows(area),
            };
            bleats_full::draw(app, pane, body, buffer);
            buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
            return;
        }
        Body::Secrets(pane) => {
            let body = Rect {
                x: area.x,
                y,
                width,
                height: body_rows(area),
            };
            secrets::draw(app, pane, body, buffer);
            buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
            return;
        }
        Body::Sheep(_) => unreachable!("handled above, ahead of the roomy blank row"),
        Body::FlockTable => {}
    }

    if let Some(banner) = status::banner_line(app, width) {
        buffer.set_line(area.x, y, &banner, width);
        y += 1;
    }

    if panes.host {
        buffer.set_line(area.x, y, &host::strip_line(app, width), width);
        y += HOST_ROWS;
    }

    // width >= MIN_TERM_WIDTH, checked above, so this never underflows.
    let table_width = width - flock::GUTTER;
    // Two column sets, one per `Grouping`: the flat table's own and the fold
    // view's own, never mixed. Whichever one supplies the header row below
    // must be the same one the rows drawn under it read, or a header lines
    // up with cells it did not describe.
    let flat_columns = flock::columns_for(table_width);
    let fold_columns = flock::fold_columns_for(table_width);
    // The rule sits between the host strip and the table, not between the
    // headers and their own rows: it separates two regions, and a rule
    // directly under the headers reads as underlining them instead.
    //
    // Full width, unlike the headers, which start after the gutter: it is
    // chrome, and a rule that stopped two columns short of the left edge
    // would look like a rendering bug.
    buffer.set_line(area.x, y, &status::rule_line(palette.line(), width), width);
    y += 1;
    if roomy {
        y += 1;
    }
    let header = match app.grouping() {
        Grouping::Flat => flock::header_line(flat_columns, table_width, palette.muted(), frozen),
        Grouping::ByFold => {
            flock::fold_columns_header_line(fold_columns, table_width, palette.muted())
        }
    };
    buffer.set_line(area.x + flock::GUTTER, y, &header, table_width);
    y += 1;

    // The bottom stack, laid out upward from the status bar: whichever of
    // the detail pane and the feed are up claim their rows off `bottom`
    // first, and the table gets whatever is left between `y` and `floor`.
    let mut floor = bottom;
    // One pane or two, never both shapes. A frozen dashboard's detail band
    // and feed are two more frozen readings, and neither answers the
    // question their operator is holding; the link panel is the only thing
    // on the screen that can. It claims the rows at the tier the feed
    // appears at, since that is the shorter of the two the pair need.
    let link_at = (frozen && panes.feed).then(|| {
        floor -= link_panel::LINK_ROWS;
        floor
    });
    let feed_at = (!frozen && panes.feed).then(|| {
        floor -= FEED_ROWS;
        floor
    });
    let detail_at = (!frozen && panes.detail).then(|| {
        floor -= DETAIL_ROWS;
        floor
    });

    // Everything from `y` up to `floor`: the viewport stops at `floor`
    // rather than at the status bar.
    let viewport = usize::from(floor - y);
    let keys = app.visible_rows();
    if keys.is_empty() {
        // Two sentences, because there are two reasons and an operator cannot
        // tell them apart from a blank table. `the flock is empty` stays for
        // the case it describes and no other.
        let text = if app.flock_len() == 0 {
            "the flock is empty".to_string()
        } else {
            format!("no sheep's name contains \"{}\"", app.filter())
        };
        let line = Line::from(Span::styled(text, palette.muted()));
        buffer.set_line(area.x, y, &line, width);
    } else {
        let offset = flock::scroll_offset(app.selected_index().unwrap_or(0), viewport, keys.len());
        let selected = app.selected();
        for (slot, key) in keys.iter().skip(offset).take(viewport).enumerate() {
            let slot = u16::try_from(slot).unwrap_or(0);
            let is_selected = selected.as_ref() == Some(key);
            let (gutter_text, gutter_style) = flock::gutter(is_selected, palette);
            buffer.set_line(
                area.x,
                y + slot,
                &Line::from(Span::styled(gutter_text, gutter_style)),
                1,
            );
            let line = if let RowKey::Section(label) = key {
                // The `Flock`/`Dogs` header becomes a band, drawn here
                // rather than through `flock::key_line`'s own
                // `RowKey::Section` arm: that arm's `section_line` stays,
                // muted rather than a band, but no current caller reaches
                // it, since this task's file list does not extend to
                // `flock.rs`.
                //
                // Meadow for the flock band, sky for the dogs band
                // (docs/lookout/design-files/README.md:149). `"Dogs"` and
                // `"no fold"` are the labels `RowKey::Section` carries, so
                // anything else stays meadow.
                let role = if *label == "Dogs" {
                    Role::Sky
                } else {
                    Role::Meadow
                };
                // The data palette, not the chrome one: this band sits
                // inside the table, and a meadow row in a dead-grey table
                // reads as the one thing on it that is still alive. Frozen,
                // meadow and sky both resolve to the muted ink and the two
                // bands are told apart by their own words, which is what
                // `NO_COLOR` already asks of them.
                section_band(
                    &label.to_ascii_uppercase(),
                    role,
                    &app.data_palette(),
                    table_width,
                )
            } else {
                match app.grouping() {
                    Grouping::Flat => {
                        flock::key_line(app, key, flat_columns, table_width, is_selected)
                    }
                    Grouping::ByFold => {
                        flock::fold_key_line(app, key, fold_columns, table_width, is_selected)
                    }
                }
            };
            buffer.set_line(area.x + flock::GUTTER, y + slot, &line, table_width);
        }
    }

    if let Some(top) = detail_at {
        buffer.set_line(
            area.x,
            top,
            &status::rule_line(palette.line(), width),
            width,
        );
        for (offset, line) in detail::detail_lines(app, width).iter().enumerate() {
            let offset = u16::try_from(offset).unwrap_or(0);
            buffer.set_line(area.x, top + 1 + offset, line, width);
        }
    }
    if let Some(top) = feed_at {
        buffer.set_line(
            area.x,
            top,
            &status::rule_line(palette.line(), width),
            width,
        );
        let rows = usize::from(FEED_ROWS - 1);
        for (offset, line) in bleats::feed_lines(app, width, rows).iter().enumerate() {
            let offset = u16::try_from(offset).unwrap_or(0);
            buffer.set_line(area.x, top + 1 + offset, line, width);
        }
    }
    if let Some(top) = link_at {
        buffer.set_line(
            area.x,
            top,
            &status::rule_line(palette.line(), width),
            width,
        );
        for (offset, line) in link_panel::panel_lines(app, width).iter().enumerate() {
            let offset = u16::try_from(offset).unwrap_or(0);
            buffer.set_line(area.x, top + 1 + offset, line, width);
        }
    }

    buffer.set_line(area.x, bottom, &status::status_line(app, width), width);
}

/// Last, over everything: the overlay covers whatever body is showing,
/// unlike 1g's dialog, which only ever covers the config pane and so draws
/// from inside `view::pane::draw_pane`.
///
/// [`App::keymap_open`]'s own doc says it is reached from every body's own
/// `Help` arm; [`draw`] calls this once, after [`draw_body`] returns from
/// whichever of the six it took.
fn draw_keymap_overlay(app: &App, area: Rect, buffer: &mut Buffer, palette: Palette) {
    if app.keymap_open() {
        overlay::mute(buffer, area, palette);
        keymap::draw(app, area, buffer);
    }
}

/// The title row: a full-width reverse-video band naming the mode.
///
/// Meadow while [`App::link`] is live, bark once it is [`Link::Lost`] — the
/// only two arms this pane needs; the editing and secrets bands belong to
/// panes this plan does not build. What this is, where it points, and how
/// big the flock is, padded to `width` before styling ([`band_line`]):
/// ratatui paints a span's background, and applies `Modifier::REVERSED`,
/// only under the cells its text occupies, so a band that stopped where its
/// text stopped would leave the rest of the row unpainted.
///
/// The bark arm says something else entirely. A dead shepherd's row spends
/// its whole width on what happened and when, since every other number on
/// the screen is now history and the flock count is one of them;
/// `status::banner_line` picks up the `$SHEP_HOME` this loses.
fn title_band(app: &App, width: u16) -> Line<'static> {
    let (left, right, role) = match app.link() {
        Link::Lost { at_local, .. } => (
            format!(" THE SHEPHERD HAS DIED  \u{2596}  these values are frozen as of {at_local}"),
            " nothing here is live  \u{2596}  q to quit ".to_string(),
            Role::Bark,
        ),
        Link::Live | Link::Retrying { .. } => {
            let visible = app.rows().len();
            let total = app.flock_len();
            let right = if app.filter().is_empty() {
                format!(" {total} in the flock")
            } else {
                format!(" {visible} of {total} in the flock")
            };
            (
                format!("shep lookout   {}", app.home()),
                right,
                Role::Meadow,
            )
        }
    };
    let budget = width.saturating_sub(u16::try_from(right.chars().count()).unwrap_or(0));
    let text = format!("{}{right}", flock::fit(&left, budget));
    band_line(text, width, app.palette().band(role))
}

/// A section header band: [`cell::band`]'s two-block marker and `label`,
/// reverse video in `role`.
///
/// `cell::band` already pads its result to `width`, so unlike [`title_band`]
/// this needs no separate padding step.
fn section_band(label: &str, role: Role, palette: &Palette, width: u16) -> Line<'static> {
    Line::from(Span::styled(
        cell::band(label, usize::from(width)),
        palette.band(role),
    ))
}

/// Pads `text` to `width` columns before wrapping it in one styled span.
///
/// Shared by callers that build their own text rather than going through
/// [`cell::band`], so a band's `REVERSED` modifier paints every cell of the
/// row rather than stopping where the text does.
fn band_line(text: String, width: u16, style: Style) -> Line<'static> {
    let drawn = text
        .chars()
        .map(crate::output::width::char_columns)
        .sum::<usize>();
    let mut padded = text;
    if drawn < usize::from(width) {
        padded.extend(std::iter::repeat_n(' ', usize::from(width) - drawn));
    }
    Line::from(Span::styled(padded, style))
}

#[cfg(test)]
mod tests {
    use std::time::Instant;

    use ratatui::Terminal;
    use ratatui::backend::TestBackend;
    use ratatui::style::{Color, Modifier};
    use shep_core::protocol::ProcessInfo;
    use shep_core::status::ProcStatus;

    use super::*;
    use crate::lookout::app::{App, Control, KeyPress, Msg};
    use crate::lookout::theme::Palette;

    #[test]
    fn the_title_band_is_reverse_video_across_the_whole_width() {
        let app = fixtures::app_with(Vec::new(), fixtures::coloured());
        let line = title_band(&app, 80);
        assert_eq!(
            line.spans
                .iter()
                .map(|s| s.content.chars().count())
                .sum::<usize>(),
            80,
            "a band that stops where its text stops leaves unpainted cells"
        );
        assert!(
            line.spans[0]
                .style
                .add_modifier
                .contains(Modifier::REVERSED)
        );
    }

    #[test]
    fn a_frozen_link_turns_the_title_band_bark() {
        let mut app = fixtures::app_with(Vec::new(), fixtures::coloured());
        app.update(Msg::Frozen {
            at_local: "2026-08-14 14:32:07".to_string(),
            why: fixtures::FROZEN_WHY.to_string(),
        });
        let line = title_band(&app, 80);
        assert_eq!(line.spans[0].style.fg, Some(Color::Indexed(166)));
    }

    #[test]
    fn the_title_band_counts_both_numbers_while_a_filter_is_on() {
        let app = fixtures::filtered_app("web");
        let title = fixtures::rendered(&title_band(&app, 120));
        assert!(title.contains("2 of 4 in the flock"), "got {title:?}");
    }

    #[test]
    fn the_unfiltered_title_band_is_unchanged() {
        let app = fixtures::filtered_app("");
        let title = fixtures::rendered(&title_band(&app, 120));
        assert!(title.contains("4 in the flock"), "got {title:?}");
        assert!(
            !title.contains(" of "),
            "no second number when nothing is hidden"
        );
    }

    #[test]
    fn the_flock_and_dogs_bands_carry_different_roles() {
        // Meadow for the flock band, sky for the dogs band
        // (docs/lookout/design-files/README.md:149).
        let flock = vec![
            ProcessInfo::builder(1, "web", ProcStatus::Online).build(),
            ProcessInfo::builder(90, "otel", ProcStatus::Online)
                .pid(Some(90_000))
                .dog(Some(shep_core::protocol::DogSource::BuiltIn))
                .build(),
        ];
        let app = fixtures::app_with(flock, fixtures::coloured());
        let width = 60;
        let mut terminal = Terminal::new(TestBackend::new(width, 12)).unwrap();
        terminal.draw(|frame| draw(&app, frame)).unwrap();
        let buffer = terminal.backend().buffer();
        let text = crate::lookout::frames::render_text(buffer);
        let lines: Vec<&str> = text.lines().collect();
        let flock_y = u16::try_from(
            lines
                .iter()
                .position(|l| l.contains("FLOCK"))
                .expect("a FLOCK band is drawn"),
        )
        .unwrap();
        let dogs_y = u16::try_from(
            lines
                .iter()
                .position(|l| l.contains("DOGS"))
                .expect("a DOGS band is drawn"),
        )
        .unwrap();
        let flock_fg = buffer.cell((flock::GUTTER, flock_y)).unwrap().fg;
        let dogs_fg = buffer.cell((flock::GUTTER, dogs_y)).unwrap().fg;
        assert_ne!(
            flock_fg, dogs_fg,
            "the flock and dogs bands must carry different roles"
        );
    }

    #[test]
    fn the_section_bands_name_their_section_in_words() {
        let flock = section_band(
            "FLOCK",
            crate::vocabulary::Role::Meadow,
            &fixtures::coloured(),
            40,
        );
        assert!(flock.spans.iter().any(|s| s.content.contains("FLOCK")));
    }

    fn draw_to(app: &App, width: u16, height: u16) -> String {
        let mut terminal = Terminal::new(TestBackend::new(width, height)).unwrap();
        terminal.draw(|frame| draw(app, frame)).unwrap();
        crate::lookout::frames::render_text(terminal.backend().buffer())
    }

    /// The refusal itself must fit the narrow terminal it is refusing
    /// about: `Buffer::set_line` truncates in silence, so a refusal written
    /// as one long sentence could lose its own numbers. Asserted on the
    /// whole line, trimmed, since `contains` passes on a truncated line as
    /// happily as a whole one.
    #[test]
    fn a_terminal_below_the_floor_says_so_instead_of_drawing() {
        let app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        let frame = draw_to(&app, 28, 8);
        let mut lines = frame.lines();
        assert_eq!(lines.next().unwrap().trim_end(), "too small");
        assert_eq!(lines.next().unwrap().trim_end(), "need 33x6");
        assert!(!frame.contains("STATUS"), "no header was drawn");

        // Narrower still, and taller than the floor in rows: the numbers
        // must survive here too, because a 12-column terminal is precisely
        // the case this message exists for.
        let cramped = draw_to(&app, 12, 8);
        assert!(
            cramped.lines().nth(1).unwrap().trim_end() == "need 33x6",
            "the dimensions were cut off in the terminal that needed them"
        );

        // One row to write into: the second line has nowhere to go, and the
        // draw must not reach past the buffer for it.
        let single = draw_to(&app, 20, 1);
        assert_eq!(single.lines().next().unwrap().trim_end(), "too small");
        assert_eq!(single.lines().count(), 1);
    }

    /// The refusal is the one screen the keymap overlay does not cover, and
    /// `draw`'s own doc says so, so something has to check it.
    ///
    /// It reads as free, since `draw` returns before the overlay call. It is
    /// not: that early return is the only thing holding it, and the whole
    /// point of moving the overlay call out of the six body exits was that
    /// a call made in one place is easy to move to another. Drawing a box
    /// over `too small` would bury the one sentence naming the fix.
    #[test]
    fn the_refusal_gets_no_keymap_overlay_over_it() {
        let mut app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        let _ = app.update(Msg::Key(KeyPress::Help));
        assert!(app.keymap_open(), "the overlay did not open");

        // Roomy enough for the box at 130 columns, three rows short of a
        // body: `MIN_HEIGHT` is what refuses here, not the width, so the
        // overlay would have had the room it needs.
        let frame = draw_to(&app, 130, 3);
        assert_eq!(frame.lines().next().unwrap().trim_end(), "too small");
        // `lookout::keymap`, not `lookout::view::keymap`. Two modules carry
        // that name: this one's sibling draws the overlay, and `Group` lives
        // in the parent's, beside the bindings it groups. Spelled out
        // rather than shortened, since the two are easy to conflate.
        for group in crate::lookout::keymap::Group::DRAWN {
            assert!(
                !frame.contains(group.heading()),
                "the overlay drew {} over the refusal: {frame}",
                group.heading()
            );
        }
    }

    /// A bare empty screen does not tell an operator whether the shepherd
    /// has nothing to run or the dashboard is broken.
    #[test]
    fn an_empty_flock_still_prints_the_header_and_says_it_is_empty() {
        let app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        let frame = draw_to(&app, 100, 12);
        assert!(frame.contains("STATUS"));
        assert!(frame.contains("the flock is empty"));
    }

    /// A filter matching nothing is not the same as an empty flock; that
    /// sentence belongs to the case it describes.
    #[test]
    fn a_filter_matching_nothing_does_not_say_the_flock_is_empty() {
        let app = fixtures::filtered_app("zzz");
        let frame = draw_to(&app, 120, 30);
        assert!(
            frame.contains("no sheep's name contains \"zzz\""),
            "the table body names the query: {frame:?}"
        );
        assert!(
            !frame.contains("the flock is empty"),
            "and does not claim the flock is: {frame:?}"
        );
        assert!(
            frame.contains("no sheep selected: no name contains \"zzz\""),
            "the detail pane says its own reason: {frame:?}"
        );
        assert!(
            frame.contains("BLEATS no sheep is selected"),
            "the feed's sentence is already true and is unchanged: {frame:?}"
        );
    }

    /// The mirror of the test above: swapped branches would still pass
    /// either test alone.
    #[test]
    fn an_empty_flock_still_says_the_flock_is_empty() {
        let app = fixtures::filtered_app_of(Vec::new(), "");
        let frame = draw_to(&app, 120, 30);
        assert!(frame.contains("the flock is empty"), "got {frame:?}");
        assert!(!frame.contains("no sheep's name contains"), "got {frame:?}");
    }

    /// Asserted on the whole line rather than with `contains`, since a `>`
    /// somewhere in a log path would satisfy `contains` and prove nothing.
    #[test]
    fn the_marker_sits_in_the_gutter_of_the_selected_row_and_nowhere_else() {
        let mut app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        app.update(Msg::Snapshot {
            rows: (0..4)
                .map(|id| {
                    ProcessInfo::builder(id, format!("sheep-{id}"), ProcStatus::Online).build()
                })
                .collect(),
            at: Instant::now(),
        });
        app.update(Msg::Key(KeyPress::SelectDown));

        let frame = draw_to(&app, 100, 12);
        let rows: Vec<&str> = frame.lines().skip(3).take(5).collect();
        assert!(
            rows[0].starts_with("   \u{2588}\u{2588} FLOCK "),
            "the section header keeps a blank gutter too: {:?}",
            rows[0]
        );
        assert!(
            rows[1].starts_with("  0 "),
            "unselected rows keep a blank gutter: {:?}",
            rows[1]
        );
        assert!(
            rows[2].starts_with("> 1 "),
            "the marker is on row 1: {:?}",
            rows[2]
        );
        assert!(
            rows[3].starts_with("  2 "),
            "and on no other row: {:?}",
            rows[3]
        );
        assert_eq!(
            frame.lines().filter(|line| line.starts_with('>')).count(),
            1,
            "exactly one marker on the frame"
        );
    }

    /// The regression the padding step in `row_line`/`group_line` guards
    /// against: a `Span`'s background only paints the cells under its own
    /// text, so a row styled only to the end of its content would leave a
    /// ragged, unpainted tail rather than a full row. Checked against the
    /// live `Buffer`'s own cells, not the rendered text, since a text-only
    /// assertion cannot see a background at all.
    #[test]
    fn the_selected_rows_ground_paints_every_column_of_the_table_not_just_its_text() {
        let mut app = App::new(
            Palette::detect(None, None, Some(std::ffi::OsStr::new("truecolor"))),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        app.update(Msg::Snapshot {
            rows: vec![
                ProcessInfo::builder(0, "web", ProcStatus::Online).build(),
                ProcessInfo::builder(1, "worker", ProcStatus::Online).build(),
            ],
            at: Instant::now(),
        });
        // Row 0 is selected by default. The gutter reads as a space either
        // way at this palette ([`flock::gutter`] paints rather than
        // switching glyphs), so the row is identified by content, not by
        // the marker character.
        let width = 100;
        let mut terminal = Terminal::new(TestBackend::new(width, 12)).unwrap();
        terminal.draw(|frame| draw(&app, frame)).unwrap();
        let buffer = terminal.backend().buffer();
        let text = crate::lookout::frames::render_text(buffer);
        let lines: Vec<&str> = text.lines().collect();
        // title, header, rule, "Flock" section: the selected sheep row is
        // the first one after them.
        let selected_y = 4;
        let unselected_y = 5;
        assert!(
            lines[selected_y].contains("web"),
            "row 0 is the selected one: {:?}",
            lines[selected_y]
        );
        assert!(
            lines[unselected_y].contains("worker"),
            "row 1 stays unselected: {:?}",
            lines[unselected_y]
        );

        let palette = app.palette();
        let ground = palette.ground().bg;
        assert!(
            ground.is_some(),
            "truecolor gets a real ground to paint with"
        );

        let table_width = width - flock::GUTTER;
        let painted = (flock::GUTTER..width)
            .filter(|&x| {
                buffer
                    .cell((x, u16::try_from(selected_y).unwrap()))
                    .is_some_and(|cell| Some(cell.bg) == ground)
            })
            .count();
        assert_eq!(
            painted,
            usize::from(table_width),
            "the ground must reach every column of the table, not just the text"
        );

        let unpainted = (flock::GUTTER..width)
            .filter(|&x| {
                buffer
                    .cell((x, u16::try_from(unselected_y).unwrap()))
                    .is_some_and(|cell| Some(cell.bg) == ground)
            })
            .count();
        assert_eq!(unpainted, 0, "an unselected row carries no ground at all");
    }

    /// Also found by capturing a real screen: at 90 columns the row under
    /// the band ran off the edge mid-word while the five lines below it all
    /// marked their own cuts, which reads as a rendering fault rather than
    /// as a narrow terminal.
    #[test]
    fn the_row_under_the_band_marks_its_own_truncation() {
        let mut app = fixtures::full_app();
        app.update(Msg::Frozen {
            at_local: "2026-08-14 14:32:07".to_string(),
            why: fixtures::FROZEN_WHY.to_string(),
        });
        let under = |width| {
            draw_to(&app, width, 24)
                .lines()
                .nth(1)
                .expect("a second line")
                .to_string()
        };
        assert!(under(90).trim_end().ends_with('…'), "{:?}", under(90));
        assert!(
            under(160).contains("it will not exit on its own"),
            "and the whole sentence survives where it fits: {:?}",
            under(160)
        );
    }

    /// Found by capturing a real dashboard rather than by any test here:
    /// killing the shepherd leaves `the shepherd is shutting down` as a
    /// notice, notices outrank the key hint, and the bar then spends the
    /// rest of the session on a sentence about a process that is gone
    /// instead of on the three keys that still work.
    #[test]
    fn a_freeze_clears_the_notice_that_would_sit_on_the_key_hint() {
        let mut app = fixtures::full_app();
        app.update(Msg::BusLagged { count: 4 });
        assert!(app.notice().is_some(), "a notice to be cleared");

        app.update(Msg::Frozen {
            at_local: "2026-08-14 14:32:07".to_string(),
            why: fixtures::FROZEN_WHY.to_string(),
        });
        assert!(app.notice().is_none());

        let bar = draw_to(&app, 160, 30)
            .lines()
            .next_back()
            .expect("a status bar")
            .to_string();
        assert!(bar.contains("j/k g/G move"), "{bar:?}");
        assert!(
            !bar.contains("   r "),
            "the bar must not offer a key a freeze has already refused: {bar:?}"
        );
        assert!(bar.contains("\u{2588} frozen"), "{bar:?}");
    }

    /// Last values stay on screen, under a band that says in words how
    /// stale they are.
    #[test]
    fn a_frozen_link_says_so_in_the_band_and_keeps_the_home_path_below_it() {
        let mut app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        app.update(Msg::Frozen {
            at_local: "2026-08-14 14:32:07".to_string(),
            why: fixtures::FROZEN_WHY.to_string(),
        });
        // 160, the design target: the row below the band carries three
        // clauses and a `$SHEP_HOME`, and a narrower terminal truncates the
        // tail rather than rewrapping it.
        let frame = draw_to(&app, 160, 12);
        let mut lines = frame.lines();

        let band = lines.next().expect("a title band");
        assert!(band.contains("THE SHEPHERD HAS DIED"), "{band:?}");
        assert!(band.contains("2026-08-14 14:32:07"), "{band:?}");
        assert!(
            !band.contains("in the flock"),
            "the flock count is one more frozen number: {band:?}"
        );

        // The row the band displaced. `$SHEP_HOME` is the one thing on the
        // title row an operator still needs, since it says which dashboard
        // they are looking at.
        let under = lines.next().expect("a second line");
        assert!(under.contains("/home/ada/.shep"), "{under:?}");
        assert!(under.contains("it will not exit on its own"), "{under:?}");
    }

    /// An operator who does not know the control state is one keystroke
    /// from finding out the wrong way.
    #[test]
    fn the_status_bar_always_says_which_control_state_is_in_force() {
        let now = Instant::now();
        let read_only = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            now,
        );
        assert!(draw_to(&read_only, 100, 12).contains("read-only"));

        let allowed = App::new(
            Palette::detect(None, None, None),
            Control::Allowed,
            "/home/ada/.shep".to_string(),
            now,
        );
        let frame = draw_to(&allowed, 100, 12);
        assert!(frame.contains("control enabled"));
        assert!(!frame.contains("read-only"));
    }

    /// The failure mode this catches is an arithmetic underflow on
    /// `height - 1` in a one-row terminal.
    #[test]
    fn drawing_never_panics_across_the_size_sweep() {
        let mut app = App::new(
            Palette::detect(None, None, None),
            Control::ReadOnly,
            "/home/ada/.shep".to_string(),
            Instant::now(),
        );
        app.update(Msg::Snapshot {
            rows: (0..200)
                .map(|id| {
                    ProcessInfo::builder(id, format!("sheep-{id}"), ProcStatus::Online).build()
                })
                .collect(),
            at: Instant::now(),
        });
        for (width, height) in [(1, 1), (20, 3), (31, 6), (80, 24), (250, 60), (400, 200)] {
            let _ = draw_to(&app, width, height);
        }
    }

    /// The settings screen's own twin of the sweep above. `Rect::height`
    /// is `bottom - y`, computed once per frame rather than checked, so
    /// this is what proves `MIN_HEIGHT` (6) actually keeps it from
    /// underflowing at the floor the guard claims to cover.
    #[test]
    fn drawing_the_settings_screen_never_panics_across_the_size_sweep() {
        let app = fixtures::app_in_settings();
        for (width, height) in [(1, 1), (20, 3), (33, 6), (80, 24), (250, 60), (400, 200)] {
            let _ = draw_to(&app, width, height);
        }
    }

    /// The pending confirm must survive even when the body is too short to
    /// show `content_lines`' own copy of it: `status_line`'s fixed row
    /// always draws, so an armed edit is never invisible.
    #[test]
    fn an_armed_settings_candidate_survives_a_body_too_short_to_hold_it() {
        let mut app = fixtures::app_in_settings_with_control();
        let _ = app.update(Msg::Key(KeyPress::Cycle));
        let text = app.settings().unwrap().pending().unwrap().text.to_string();

        // 10 rows, 8 of them body: nowhere near the ~20 rows
        // `settings_snapshot` needs, so the body's own echo of this line is
        // not on screen at this height.
        let rendered = draw_to(&app, 200, 10);
        let last_line = rendered.lines().last().expect("at least one row");
        assert!(
            last_line.contains(text.trim()),
            "the confirm must survive on the status bar's fixed row: {last_line:?}"
        );
    }

    #[test]
    fn every_pane_tier_fits_the_height_it_claims() {
        for height in flock::MIN_HEIGHT..=200 {
            let panes = panes_for(height);
            let fixed = CHROME_ROWS + 1 /* banner */ + panes.rows();
            // A tier that shows a pane must leave the table at least three
            // rows; the floor tier, which shows none, only has to leave one.
            let floor = if panes.rows() == 0 { 1 } else { 3 };
            assert!(
                fixed + floor <= height,
                "height {height} chose {panes:?}, needing {} rows",
                fixed + floor
            );
        }
    }

    /// `every_pane_tier_fits_the_height_it_claims` picks up `DETAIL_ROWS`
    /// automatically, so a failure there means the tier table is wrong, not
    /// this test.
    #[test]
    fn the_detail_pane_claims_the_rows_it_draws() {
        let app = fixtures::with_selection(fixtures::sheep_with_lambs());
        assert_eq!(
            detail::detail_lines(&app, 120).len(),
            usize::from(DETAIL_ROWS - 1),
            "one rule plus its content lines"
        );
    }

    /// Detail goes first, the most redundant pane on the screen. Feed goes
    /// second: its content exists nowhere else, but five lines of a busy
    /// log is thin. The host strip goes last, at one row.
    #[test]
    fn panes_drop_in_a_fixed_order_as_the_terminal_shortens() {
        assert_eq!(
            panes_for(60),
            Panes {
                host: true,
                detail: true,
                feed: true
            }
        );
        assert_eq!(
            panes_for(24),
            Panes {
                host: true,
                detail: true,
                feed: true
            }
        );
        assert_eq!(
            panes_for(23),
            Panes {
                host: true,
                detail: false,
                feed: true
            }
        );
        assert_eq!(
            panes_for(18),
            Panes {
                host: true,
                detail: false,
                feed: true
            }
        );
        assert_eq!(
            panes_for(17),
            Panes {
                host: true,
                detail: false,
                feed: false
            }
        );
        assert_eq!(
            panes_for(14),
            Panes {
                host: true,
                detail: false,
                feed: false
            }
        );
        assert_eq!(panes_for(13), Panes::NONE);
        assert_eq!(
            panes_for(flock::MIN_HEIGHT),
            Panes::NONE,
            "12a's frame, untouched"
        );
    }

    /// `Buffer::set_line` outside the area is a panic in debug and a silent
    /// no-op otherwise, and the arithmetic here has four moving parts.
    ///
    /// Swept in both link states, because they lay the bottom stack out
    /// differently: live gets the detail band and the feed, frozen gets the
    /// link panel in place of both.
    #[test]
    fn every_pane_lands_inside_its_own_rows_across_the_size_sweep() {
        let live = fixtures::full_app();
        let mut lost = fixtures::full_app();
        lost.update(Msg::Frozen {
            at_local: "2026-08-14 14:32:07".to_string(),
            why: fixtures::FROZEN_WHY.to_string(),
        });
        for (frozen, app) in [(false, &live), (true, &lost)] {
            for height in flock::MIN_HEIGHT..=60 {
                for width in [MIN_TERM_WIDTH, 40, 51, 80, 120, 200] {
                    let frame = draw_to(app, width, height);
                    let lines: Vec<&str> = frame.lines().collect();
                    let panes = panes_for(height);

                    // The table's own row band, recomputed independently of
                    // `draw`: title (1) + banner (1, both fixtures carry one) +
                    // host strip if up + header/rule (2) is where it starts;
                    // `floor`, walked the same way `draw` does, is where it ends.
                    let table_body_start = 2 + if panes.host { HOST_ROWS } else { 0 } + 2;
                    let mut floor = height - 1;
                    if frozen {
                        if panes.feed {
                            floor -= link_panel::LINK_ROWS;
                        }
                    } else {
                        if panes.feed {
                            floor -= FEED_ROWS;
                        }
                        if panes.detail {
                            floor -= DETAIL_ROWS;
                        }
                    }
                    let table_body_end = floor;
                    for (i, line) in lines.iter().enumerate() {
                        let i = u16::try_from(i).unwrap_or(u16::MAX);
                        if i < table_body_start || i >= table_body_end {
                            continue;
                        }
                        assert!(
                            !line.starts_with("bleats  "),
                            "the feed header sits inside the table's own rows at \
                         {width}x{height}, row {i}"
                        );
                        assert!(
                            !line.starts_with("out  /home/ada/.shep/logs/"),
                            "the detail pane's out path sits inside the table's \
                         own rows at {width}x{height}, row {i}"
                        );
                    }

                    // Not `lines.len() == height`: `frames::render_text` maps
                    // `(0..area.height)` by construction, so that holds even for
                    // a `draw` that drew nothing. It is a property of the
                    // renderer, not of this layout.
                    let last = lines.last().unwrap();
                    let mark = if frozen {
                        "\u{2588} frozen"
                    } else {
                        "read-only"
                    };
                    assert!(
                        last.contains(mark),
                        "the status bar survived at {width}x{height}: {last:?}"
                    );
                    // The row above the status bar belongs to the bottom-most
                    // pane that is up, so it is never blank: a blank one means
                    // the upward layout left a hole. One condition for both
                    // link states: `PANE_TIERS` never gives a terminal the
                    // detail band without the feed, and the link panel draws
                    // at the feed's own tier.
                    if panes.feed || panes.detail {
                        let above = lines[lines.len() - 2];
                        assert!(
                            !above.trim().is_empty(),
                            "a blank row above the status bar at {width}x{height}"
                        );
                    }
                    // Every pane that is up appears exactly once and sits in
                    // its own band.
                    if panes.host {
                        let positions: Vec<usize> = lines
                            .iter()
                            .enumerate()
                            .filter(|(_, l)| l.starts_with("host  "))
                            .map(|(i, _)| i)
                            .collect();
                        assert_eq!(positions.len(), 1, "the strip at {width}x{height}");
                        assert!(
                            u16::try_from(positions[0]).unwrap_or(u16::MAX) < table_body_start,
                            "the strip at {width}x{height} sits at row {}, at or below the table",
                            positions[0]
                        );
                    }
                    if panes.feed {
                        // `contains`, not `starts_with`: the chip leads the
                        // line, and nothing else on screen carries either word.
                        // A frozen frame's `BLEATS` is gone and `THE LINK` is
                        // in its slot.
                        let chip = if frozen { "THE LINK" } else { "BLEATS" };
                        let positions: Vec<usize> = lines
                            .iter()
                            .enumerate()
                            .filter(|(_, l)| l.contains(chip))
                            .map(|(i, _)| i)
                            .collect();
                        assert_eq!(positions.len(), 1, "the {chip} header at {width}x{height}");
                        assert!(
                            u16::try_from(positions[0]).unwrap_or(0) >= table_body_end,
                            "the {chip} header at {width}x{height} sits at row {}, inside or above the table",
                            positions[0]
                        );
                    }
                    if panes.detail && !frozen {
                        // The `\u{2502}` divider, not a bare `out  `: the feed's
                        // own body lines are tagged `out  ` too, and the merged
                        // log row's own path can truncate away at a narrow
                        // width, but its divider never does.
                        let positions: Vec<usize> = lines
                            .iter()
                            .enumerate()
                            .filter(|(_, l)| l.starts_with("out  ") && l.contains('\u{2502}'))
                            .map(|(i, _)| i)
                            .collect();
                        assert_eq!(
                            positions.len(),
                            1,
                            "the detail pane's out path at {width}x{height}"
                        );
                        assert!(
                            u16::try_from(positions[0]).unwrap_or(0) >= table_body_end,
                            "the detail pane's out path at {width}x{height} sits at row {}, inside or above the table",
                            positions[0]
                        );
                    }
                    // The two panes the link panel replaces are gone outright,
                    // not merely moved: both are readings a dead shepherd
                    // cannot refresh.
                    if frozen {
                        assert!(
                            !lines.iter().any(|l| l.contains("BLEATS")),
                            "the feed survived a freeze at {width}x{height}"
                        );
                        assert!(
                            !lines.iter().any(|l| l.starts_with("lambs  ")),
                            "the detail band survived a freeze at {width}x{height}"
                        );
                    }
                }
            }
        }
    }

    /// Whatever else is on screen, the table gets the remainder, and at the
    /// tier where all three panes are up it still has room for more than a
    /// couple of rows.
    /// The two blank chrome rows are spent only above [`ROOMY_HEIGHT`].
    ///
    /// Guards the trade the constant exists for: air on a tall terminal,
    /// none on a short one where every row is a sheep you cannot see.
    #[test]
    fn a_short_terminal_spends_no_rows_on_air() {
        let app = fixtures::full_app();
        let short = draw_to(&app, 120, ROOMY_HEIGHT - 1);
        let tall = draw_to(&app, 120, ROOMY_HEIGHT);

        let blanks = |frame: &str| {
            frame
                .lines()
                .take(6)
                .filter(|line| line.trim().is_empty())
                .count()
        };
        assert_eq!(blanks(&short), 0, "short:\n{short}");
        assert_eq!(blanks(&tall), 2, "tall:\n{tall}");
    }

    #[test]
    fn the_flock_table_keeps_the_middle_of_the_screen() {
        let app = fixtures::full_app(); // twelve sheep
        let frame = draw_to(&app, 120, 24);
        let data_rows = frame
            .lines()
            .filter(|line| line.starts_with("  ") || line.starts_with("> "))
            .filter(|line| line.trim_start().starts_with(|c: char| c.is_ascii_digit()))
            .count();
        assert!(data_rows >= 5, "the table got {data_rows} rows at 120x24");
    }

    /// `F` used to draw the flock's fourteen-column header over an eight-
    /// column fold table: `view::mod`'s draw loop called
    /// `flock::columns_for` unconditionally for both the header and the
    /// rows under it, never branching on `App::grouping`. This pins the fix:
    /// the STATUS label in the column header and the STATUS word in a
    /// fold's own member row must land at the same column.
    #[test]
    fn the_fold_views_header_and_its_rows_share_one_column_set() {
        let mut app = fixtures::app_with(
            vec![fixtures::sheep_in_fold(1, "api", Some("edge"))],
            fixtures::plain(),
        );
        let _ = app.update(Msg::Key(KeyPress::FoldView));
        let text = draw_to(&app, 120, 16);
        let lines: Vec<&str> = text.lines().collect();
        let header = lines
            .iter()
            .find(|line| line.contains("STATUS"))
            .expect("the column header row is drawn");
        // `api`'s own member row, not `edge`'s fold header row: the header
        // row always computes its own width from `fold_columns_for`
        // regardless of what it is passed, so it would pass this test even
        // with the flat table's columns wired in behind it. A member row
        // has no such fallback, so it is the row that actually exercises
        // the wiring this test means to pin.
        let member_row = lines
            .iter()
            .find(|line| line.contains("api"))
            .expect("the fold's one member row is drawn");
        // Character offsets, not `str::find`'s byte offsets: a name column
        // wide enough to carry `\u{d7}` shifts a byte offset out of step
        // with the display column this test means to compare.
        fn char_position(line: &str, needle: &str) -> Option<usize> {
            let byte = line.find(needle)?;
            Some(line[..byte].chars().count())
        }
        let header_status_at = char_position(header, "STATUS").expect("checked above");
        let row_status_at =
            char_position(member_row, "online").expect("the fold's one member is online");
        assert_eq!(
            header_status_at, row_status_at,
            "header:\n{header}\nrow:\n{member_row}"
        );
    }

    /// A fold header reads as one with every colour stripped, and says
    /// whether it is collapsed.
    ///
    /// Design rule 3 (`docs/lookout/design-files/README.md:47`): "Strip every
    /// glyph and colour and the frame still reads." Before the disclosure
    /// triangle, brightness was the only thing separating a fold header from
    /// the member row beneath it, and a collapsed fold was marked by nothing
    /// at all. Below the `FOLD_ALL` tier there is no Share or Notes cell to
    /// rescue either, and that tier needs 158 columns, so the common terminal
    /// was the one that lost the hierarchy.
    ///
    /// Drawn at 120 columns through `fixtures::plain`, which is
    /// `Palette::detect(None, None, None)` and carries no colour, so this
    /// fails the way a `NO_COLOR` terminal would.
    #[test]
    fn a_fold_header_reads_as_one_without_any_colour() {
        let mut app = fixtures::app_with(
            vec![
                fixtures::sheep_in_fold(1, "api", Some("edge")),
                fixtures::sheep_in_fold(2, "cdn", Some("edge")),
            ],
            fixtures::plain(),
        );
        let _ = app.update(Msg::Key(KeyPress::FoldView));

        let expanded = draw_to(&app, 120, 16);
        assert!(
            expanded.contains("\u{25be} edge"),
            "an expanded fold points down: {expanded}"
        );
        assert!(
            !expanded.contains("\u{25be} api"),
            "a member row carries no triangle: {expanded}"
        );

        app.select_fold_for_tests("edge");
        let _ = app.update(Msg::Key(KeyPress::Collapse));
        let collapsed = draw_to(&app, 120, 16);
        assert!(
            collapsed.contains("\u{25b8} edge"),
            "a collapsed fold points right: {collapsed}"
        );
        assert!(
            !collapsed.contains("\u{25be} edge"),
            "and never both ways at once: {collapsed}"
        );
    }
}