Struct AppModel 

pub struct AppModel { /* private fields */ }

What one running yog holds of its own derivation (§15 Y11, §7.2 as rewritten by bl-ee0a): the roots, the durable ui.json, and an Arc<Snapshot> — the latest completed derivation. Everything that keeps it fresh belongs to Deriver on another thread.

It was what a frame owns until bl-7942, and the fields that left were all one seat’s: the focus, the optimistic echo folded over the derivation for paint, the window’s wire channels, its follow lane and its act path. What a seat is looking at, and what it has fired and not yet heard back about, are the seat’s own (REMOTE §7, §12) and cross the boundary as gestures.

Implementations

impl AppModel

pub fn identity(&self) -> String

The operator identity (§4.1): the invoking $USER, else empty. It was ui.json’s identity_last_used else $USER, but nothing ever wrote that key — its writer was the frame’s and went with it — so the fallback was always the whole answer, and bl-f936 deleted the key rather than keeping a document field only a hand edit could reach. Not a claim stamp — Z3’s start flow and Z4’s close/release/ assign/move all stamp --as <workspace name> (§3.2 ownership line), never the operator. Retained as the author identity for the standalone bl create/bl update verbs (§8.2 New ball / Update ball), where the operator — not a workspace — is the reporter.

pub fn empty_project_hint(&self) -> Option<EmptyHint>

The empty-project roster hint (STORIES S3-T5) as its two rendered lines. With zero projects in the world — no clone lists cleanly and none is orphaned — the roster shows the paved way to enter one, yog exec bl prime in a repo (v1 keeps bl prime out of the UI, §8.3). Since bl-44a5/bl-2930 that gesture works with only yog on PATH: the hatch seeds the world’s shims and the embedded bl runs prime with a plugin chain that is yog (§16.4). None once any project is present (clean or orphaned) — a project surface then exists to work with.

Two lines, not one sentence (bl-b491): the roster truncates every row rather than widening the panel (§11, bl-9669), and a single “No projects yet — add one with: yog exec bl prime” lost the command to the ellipsis at the default width — the one part of the hint that is the hint. The prose leads on its own elidable line; the command follows alone, so the width it must survive is its own.

pub fn after_bl_verb(&mut self, project: &Path)

A dispatched bl verb landed against project (§15 Y16): mark the project dirty so the worker re-fetches its live and closed balls (the delivered-row source, §5.1 #4), rebuilds the join and re-reads the ops tail on its next pass — the immediate convergence the operator sees, ahead of the watch.

The root named is the project’s own identity — its decoded invocation path (§5.1 #1) — which is the vocabulary every other project surface already speaks. yog never spells the percent-encoded clone dir: that encoding is balls’, and one fact has one owner.

pub fn after_litany_verb(&mut self)

A dispatched litany verb landed (message/stop/scan): it touches no ball, so only the ops tail changes — the yog-state root’s ordinary routing (§7.1).

pub fn balls_state_root(&self) -> PathBuf

The balls state root — the parent of the per-project clones dir (balls arch §1: clones/ always lives under it); the start flow’s work_worktree_path derives from it (§3.3).

pub fn boundary_deps(&self, litany: &Cli, bl: &Cli) -> Deps

The boundary Deps this instance answers with (§8.5): its roots, its composed world, its addressable snapshot, its verb binaries.

Nothing in production calls it (bl-ab32). The window posted its acts over the wire from bl-1747, leaving only the §8.5 line’s query arm here; bl-7942 then deleted the window and that arm with it. What is left is the acceptance world’s stand-in for the transport — a story asking the engine’s own environment for a Deps because no seat lives in this process to post through.

So it asks disk for the addressable sets, exactly as the intake does (addressable, ConsumerCtx::deps). It was the one caller deliberately left on the cached derivation by bl-6c9e — lawfully, while its caller was inside the render pass and a frame does no IO (§7.2) — so a query naming a wall born this instant refused for one pass. There is no render pass any more: every caller of this door stands where the intake stands, and a stand-in that resolves names over a different set than the engine is a fixture asserting against a world production never builds. The residual dissolved with the frame; what remains is the alignment.

It stays the derivation, never the §7.2 fold: the enumeration is disk answering, and there is no optimistic copy left to confuse it with.

The world it carries is the unlensed one (§16.2). A §9 config gesture folds brazen’s destinations out of deps.world and those live inside a workspace’s own wall, so the wall is layered on where the gesture names its workspace — at the consumer, which is the arm every act crosses. It was lensed on the focused workspace while a window held a focus in this process; a server holds none (REMOTE §7).

impl AppModel

pub fn boot( roots: Roots, clock: Arc<dyn Clock>, balls: Box<dyn BlRunner>, user: Option<String>, ) -> (Self, Deriver)

Build the model and the worker’s Deriver, taking the first derivation synchronously so the engine answers real content from its first gesture rather than an empty snapshot.

Returned as a pair rather than spawned here: the thread is the caller’s (Engine::boot hands it a wake hook; a test drives step() by hand), and a model that spawned its own thread could not be exercised deterministically. This is the same shape the watch bridge always had.

impl AppModel

pub fn take(&mut self) -> bool

Take the newest completed derivation, if the worker published one since the last take. Returns whether the read source moved.

It was refresh — one frame’s whole model duty — and everything else it did was the frame’s (bl-7942): the optimistic echo’s retirement, the window’s wire settle, the follow lane’s, the act path’s receipts, the §6 ack held while a conversation was on screen. Every one of those is a seat’s now, and what is left is the pointer swap.

pub fn snapshot_cell(&self) -> SnapshotCell

The published-snapshot cell this model reads (§7.2) — what the gesture consumer answers queries from (§8.5), shared by Arc.

pub fn ui_json_path(&self) -> PathBuf

The durable ui.json path (§4.1) — the consumer’s write-through copy opens the same file this instance adopts external changes from.

pub fn now_unix(&self) -> i64

Wall-clock unix seconds off this model’s injected clock (§7.2) — what a derivation dates its ages against, and the injected seam, so a test advances it like anything else.

pub fn cadence(&self) -> Cadence

The clock’s live periods off the published snapshot (bl-3381) — the §7.2 rhythms everything else is spelled in terms of, so an operator who re-tunes the sweeps re-tunes them all and no reader touches disk.

pub fn tree(&self, ws: &Path) -> Option<&GitTree>

The current snapshot for ws, if derived.

pub fn workspace_path(&self, name: &str) -> Option<PathBuf>

The one door from a §3.1 name to a path (bl-7407): name resolved against the enumeration, by the same by_leaf rule the engine resolves a gesture’s address by — a name nothing answers resolves to nothing rather than to a guess.

pub fn workspace_stats(&self, ws: &Path) -> (usize, usize, bool)

Per-workspace roster facts (§6 rollup): attention-bearing agent count, total agent count, and whether any agent is running (Live/InFlight). An unfetched workspace contributes zeros.

pub fn answer( &self, deps: &Deps, query: &Query, now_unix: i64, ) -> Result<Reply, String>

The in-process query chokepoint (§8.5): the same answer the deposit consumer runs, over deps — one derivation, two serializations (VISION §4.8).

No production caller reaches it (bl-ab32): every read a seat takes crosses the wire and is answered by the intake. What is left is the acceptance world asking the same call the intake makes, over the same boundary_deps — which asks disk for its addressable sets exactly as the intake does, so a story cannot resolve a name against a set the engine would not.