Struct AppModel 

pub struct AppModel { /* private fields */ }

What one running yog holds of its own derivation (§15 Y11, §7.2 as rewritten by bl-ee0a): the roots, the durable ui.json, and an Arc<Snapshot> — the latest completed derivation. Everything that keeps it fresh belongs to Deriver on another thread.

It was what a frame owns until bl-7942, and the fields that left were all one seat’s: the focus, the optimistic echo folded over the derivation for paint, the window’s wire channels, its follow lane and its act path. What a seat is looking at, and what it has fired and not yet heard back about, are the seat’s own (REMOTE §7, §12) and cross the boundary as gestures.

Implementations

impl AppModel

pub fn identity(&self) -> String

The operator identity (§4.1): recorded identity_last_used else $USER else empty. Not a claim stamp — Z3’s start flow and Z4’s close/release/ assign/move all stamp --as <workspace name> (§3.2 ownership line), never the operator. Retained as the author identity for the standalone bl create/bl update verbs (§8.2 New ball / Update ball), where the operator — not a workspace — is the reporter.

pub fn last_failure(&self, origin: Origin) -> Option<SurfaceFailure>

One surface’s last-failure view-model (§5.3, §7.3): the most recent ops row origin attributed to that surface, iff it is a rendered failure ([OpRow::failed]), projected to its argv and stderr tail. None when that surface’s last attempted action succeeded, so the surface clears its ichor-red banner. Reads the already-derived tail, so the banner and the ops pane never diverge (both project the same durable ops line, §4.2). The shell paints it; nothing is held.

The banner’s lifetime now ends at an ack as well (bl-c417): the query runs over since_ack’s rows, so a dismissal quiets it even though nothing was retried. It is still not a stored flag — the watermark is the newest ack line, and a NEW failure of this origin lands after it and banners again.

The origin parameter is the whole fix for bl-48f8. Un-parameterised this asked one global question — “did the last op fail?” — which three surfaces then answered identically, so a failed ▶ Start painted itself on the balls fold, the composer and the bootstrap box at once, and any one surface’s clean run wiped the other two’s live banners. Per-origin it is the same rule with the general input: the last row of this surface, iff it failed. §6’s retirement therefore stays per-surface too — a clean re-run retires the banner it superseded and no one else’s.

pub fn empty_project_hint(&self) -> Option<EmptyHint>

The empty-project roster hint (STORIES S3-T5) as its two rendered lines. With zero projects in the world — no clone lists cleanly and none is orphaned — the roster shows the paved way to enter one, yog exec bl prime in a repo (v1 keeps bl prime out of the UI, §8.3). Since bl-44a5/bl-2930 that gesture works with only yog on PATH: the hatch seeds the world’s shims and the embedded bl runs prime with a plugin chain that is yog (§16.4). None once any project is present (clean or orphaned) — a project surface then exists to work with.

Two lines, not one sentence (bl-b491): the roster truncates every row rather than widening the panel (§11, bl-9669), and a single “No projects yet — add one with: yog exec bl prime” lost the command to the ellipsis at the default width — the one part of the hint that is the hint. The prose leads on its own elidable line; the command follows alone, so the width it must survive is its own.

pub fn after_bl_verb(&mut self, project: &Path)

A dispatched bl verb landed against project (§15 Y16): mark the project dirty so the worker re-fetches its live and closed balls (the delivered-row source, §5.1 #4), rebuilds the join and re-reads the ops tail on its next pass — the immediate convergence the operator sees, ahead of the watch.

The root named is the project’s own identity — its decoded invocation path (§5.1 #1) — which is the vocabulary every other project surface already speaks. yog never spells the percent-encoded clone dir: that encoding is balls’, and one fact has one owner.

pub fn after_litany_verb(&mut self)

A dispatched litany verb landed (message/stop/scan): it touches no ball, so only the ops tail changes — the yog-state root’s ordinary routing (§7.1).

pub fn balls_state_root(&self) -> PathBuf

The balls state root — the parent of the per-project clones dir (balls arch §1: clones/ always lives under it); the start flow’s work_worktree_path derives from it (§3.3).

pub fn boundary_deps(&self, litany: &Cli, bl: &Cli) -> Deps

The boundary Deps this instance answers with (§8.5): its roots, its composed world, its published snapshot, its verb binaries.

No gesture executes through it any more (REMOTE §9.8, bl-1747): the window posts every act over the wire and the engine builds the Deps the act runs in. What is left here is the §8.5 line’s query arm, which is answered in place, and the acceptance world’s stand-in for the transport — both reads.

The world it carries is the unlensed one (§16.2). A §9 config gesture folds brazen’s destinations out of deps.world and those live inside a workspace’s own wall, so the wall is layered on where the gesture names its workspace — at the consumer, which is the arm every act crosses. It was lensed on the focused workspace while a window held a focus in this process; a server holds none (REMOTE §7).

impl AppModel

pub fn boot( roots: Roots, clock: Arc<dyn Clock>, balls: Box<dyn BlRunner>, user: Option<String>, ) -> (Self, Deriver)

Build the model and the worker’s Deriver, taking the first derivation synchronously so the engine answers real content from its first gesture rather than an empty snapshot.

Returned as a pair rather than spawned here: the thread is the caller’s (Engine::boot hands it a wake hook; a test drives step() by hand), and a model that spawned its own thread could not be exercised deterministically. This is the same shape the watch bridge always had.

impl AppModel

pub fn take(&mut self) -> bool

Take the newest completed derivation, if the worker published one since the last take. Returns whether the read source moved.

It was refresh — one frame’s whole model duty — and everything else it did was the frame’s (bl-7942): the optimistic echo’s retirement, the window’s wire settle, the follow lane’s, the act path’s receipts, the §6 ack held while a conversation was on screen. Every one of those is a seat’s now, and what is left is the pointer swap.

pub fn snapshot_cell(&self) -> SnapshotCell

The published-snapshot cell this model reads (§7.2) — what the gesture consumer answers queries from (§8.5), shared by Arc.

pub fn ui_json_path(&self) -> PathBuf

The durable ui.json path (§4.1) — the consumer’s write-through copy opens the same file this instance adopts external changes from.

pub fn now_unix(&self) -> i64

Wall-clock unix seconds off this model’s injected clock (§7.2) — what a derivation dates its ages against, and the injected seam, so a test advances it like anything else.

pub fn cadence(&self) -> Cadence

The clock’s live periods off the published snapshot (bl-3381) — the §7.2 rhythms everything else is spelled in terms of, so an operator who re-tunes the sweeps re-tunes them all and no reader touches disk.

pub fn tree(&self, ws: &Path) -> Option<&GitTree>

The current snapshot for ws, if derived.

pub fn workspace_path(&self, name: &str) -> Option<PathBuf>

The one door from a §3.1 name to a path (bl-7407): name resolved against the enumeration, by the same by_leaf rule the engine resolves a gesture’s address by — a name nothing answers resolves to nothing rather than to a guess.

pub fn workspace_stats(&self, ws: &Path) -> (usize, usize, bool)

Per-workspace roster facts (§6 rollup): attention-bearing agent count, total agent count, and whether any agent is running (Live/InFlight). An unfetched workspace contributes zeros.

pub fn answer( &self, deps: &Deps, query: &Query, now_unix: i64, ) -> Result<Reply, String>

The in-process query chokepoint (§8.5): the same answer the deposit consumer runs, over deps — one derivation, two serializations (VISION §4.8). deps is the same boundary_deps every dispatch takes: the §9 config family’s three reads (bl-0164) ask the world through it exactly as their writes do.