merge: the notifications pit and the :models pit (#35)

Two pits, integrated on feat/pits and validated together.

NOTIFICATIONS (#34, plans/notifications.md). Everything the pager said
went through one slot of the status bar and was gone ten seconds later:
a turn that failed while you were reading something else left one string
in memory and a line in a log nobody opens mid-conversation. Now every
alert is POSTED to a 500-entry history first, and the bar and the pit are
two views of it: the alert as before, a "N unread" mark that outlives it
while warnings or errors are unread, and `space n` / `:notifications` for
the list. Repeats coalesce with digits folded, so a poller failing every
tick is one row that counts. The CLI's own WARN and ERROR records tee in.
Enter spells a row out the way the state pit opens a value, and the
picker paints errors red and warnings yellow.

:MODELS (#33). The model is a pit you choose in, and Enter sets it.

Found and fixed on the way: `[cli] notice_ttl` was documented and never
applied, so every alert held the bar for the built-in ten seconds.

The notifications pit was exercised in a real pty
(scripts/notifications-pty.sh) as well as in the suite.

Author: gluck

internal/cli/command.go

@@ -94,6 +94,13 @@ func (in *interactiveInput) note(msg string) {
 	in.mu.Unlock()
 }
 
+// progress is note for "under way": the bar, never the notification history.
+func (in *interactiveInput) progress(msg string) {
+	in.mu.Lock()
+	in.lt.tr.setProgressNote(msg)
+	in.mu.Unlock()
+}
+
 // noteLocked is note for a caller that already holds the render lock.
 func (in *interactiveInput) noteLocked(msg string) { in.lt.tr.setCommandNote(msg) }
 

internal/cli/command_router.go

@@ -20,7 +20,9 @@ package cli
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"github.com/jack-work/figaro/api/form"
 	"github.com/jack-work/figaro/internal/cmdkit"
 	"strings"
 	"sync"
@@ -96,13 +98,17 @@ func tokenize(line string) []string {
 // Everything else -- ls, status, doctor, state, set, unset, queue,
 // promote, gc, models, show... -- falls through to the real router untouched.
 var overlayVerbs = map[string]bool{
+	"notifications": true, "no": true, // the pager's own history (notifications.go)
 	"listen": true,
 	"attend": true, "at": true,
 	"send": true, "s": true,
 	"new": true, "replay": true, "fork": true,
 	"kill":   true, // it can kill the aria on screen, and must then move
 	"import": true, // reads os.Stdin for `-` (portable.go)
 	"login":  true, // an interactive OAuth flow with its own prompts
+	// models is a PIT, not a table: a list you choose the subject's model
+	// in (models_view.go). As a routed verb it printed to os.Stdout.
+	"models": true,
 }
 
 // terminalSubverbs are verb+subverb pairs that take the terminal, which a bare
@@ -232,11 +238,95 @@ func (in *interactiveInput) runOverlay(verb string, args []string) {
 		in.commandAsync(func(ctx context.Context) (string, error) {
 			return in.commandFork(ctx, args)
 		})
+	case "notifications", "no":
+		in.mu.Lock()
+		if len(args) > 0 && args[0] == "clear" {
+			// Vim's `:messages clear`: the pager's copy, and only it.
+			in.lt.tr.notes.clear()
+			in.lt.tr.setCommandNote("notifications cleared")
+		} else {
+			in.lt.tr.closePanels()
+			in.lt.tr.openNotificationsPit()
+			in.lt.tr.render()
+		}
+		in.mu.Unlock()
+	case "models":
+		in.openModels()
 	default:
 		in.note(fmt.Sprintf("%s: not available inside the pager (it opens a view of its own)", verb))
 	}
 }
 
+// openModels hosts the models pit. Asking every provider dials, so the list is
+// fetched off the input goroutine and installed under the render lock, as a
+// live form view is (openLive).
+func (in *interactiveInput) openModels() {
+	in.progress("…models")
+	go func() {
+		models, warnings := fetchModels(in.loaded)
+		current := in.subjectModel()
+		view := newModelsView(models, current, in.chooseModel)
+		in.mu.Lock()
+		in.lt.tr.showLivePit("models", view, false)
+		in.mu.Unlock()
+		if len(models) == 0 && len(warnings) > 0 {
+			in.note("models: " + strings.Join(warnings, "; "))
+		}
+	}()
+}
+
+// subjectModel is the aria on screen's system.model, or "" when it cannot be
+// read: the ● in the list is a courtesy, not a precondition.
+func (in *interactiveInput) subjectModel() string {
+	cli := in.aria()
+	if cli == nil {
+		return ""
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+	resp, err := cli.Form(ctx)
+	if err != nil {
+		return ""
+	}
+	raw, ok := resp.Snapshot.Get("system.model")
+	if !ok {
+		return ""
+	}
+	return valueSummary(raw)
+}
+
+// chooseModel is Enter in the models pit: the subject's system.model becomes
+// the chosen id, and system.provider the provider that listed it, in ONE
+// patch. A model is only meaningful to its own provider; choosing copilot's
+// gpt-5 while the board still said anthropic would send a name Anthropic has
+// never heard of on the next turn. When the provider already matches, the
+// write lands only the model (the store drops an unchanged key), which is
+// exactly `figaro set system.model <id>`. It runs on its own goroutine.
+func (in *interactiveInput) chooseModel(c modelChoice) {
+	cli := in.aria()
+	id := in.currentID()
+	if cli == nil {
+		in.noteErr("models: no aria on screen to set")
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+	set := map[string]json.RawMessage{"system.model": mustJSON(c.model)}
+	if c.provider != "" {
+		set["system.provider"] = mustJSON(c.provider)
+	}
+	if _, err := cli.Set(ctx, form.Build(form.Snapshot{}, set, nil), 0); err != nil {
+		in.noteErr("models: " + wireErrorText(err))
+		return
+	}
+	in.note(fmt.Sprintf("model: %s (%s) on %s", c.model, c.provider, id))
+}
+
+func mustJSON(s string) json.RawMessage {
+	b, _ := json.Marshal(s)
+	return b
+}
+
 // ---------------------------------------------------------------------------
 // The router, run in-process.
 // ---------------------------------------------------------------------------
@@ -320,7 +410,7 @@ func pagerUncapped(argv []string) []string {
 
 func (in *interactiveInput) runThroughRouter(argv []string) {
 	argv = in.withSubject(pagerUncapped(argv))
-	in.note("…" + strings.Join(argv, " "))
+	in.progress("…" + strings.Join(argv, " "))
 	go func() {
 		out, code := in.routeCaptured(argv)
 		lines := splitOutputLines(out.text)
@@ -472,7 +562,8 @@ func (in *interactiveInput) complete(line string) []string {
 		// Completing the VERB itself: the router's own names, plus the overlay
 		// aliases that exist only here.
 		verbs := append(buildRouter("figaro", in.loaded).CommandCandidates(),
-			cmdkit.Candidate("at", "jump to a turn or node: at <turn>[.<node>]"))
+			cmdkit.Candidate("at", "jump to a turn or node: at <turn>[.<node>]"),
+			cmdkit.Candidate("notifications", "what figaro said, and what went wrong (space n)"))
 		return matchPrefix(verbs, current)
 	}
 	req := append([]string{"__complete", argv[0], "--describe", "--current", current, "--"}, argv[1:]...)
@@ -553,7 +644,7 @@ func (in *interactiveInput) openLive(name, spec string, full bool) {
 	}
 	// A pit that opens fullscreen is its own announcement.
 	if !full {
-		in.note("…" + name + " " + spec)
+		in.progress("…" + name + " " + spec)
 	}
 	go func() {
 		view, closeView, err := openFormView(spec, in.loaded, in.renderLocked)

internal/cli/forkjump.go

@@ -202,12 +202,17 @@ func pagerAttendRow(t *transcript) {
 	}
 	// A pit row's id is whatever that pit counts by: a queue row's is a
 	// queue number, and attending it would be an error message where a
-	// no-op belongs.
-	if rpc.ValidateAriaID(row.id) != nil {
+	// no-op belongs. A view whose rows are ABOUT arias without being them
+	// (a notification) says which one.
+	id := row.id
+	if av, ok := t.pit.live.(interface{ AriaOf(string) string }); ok {
+		id = av.AriaOf(row.id)
+	}
+	if rpc.ValidateAriaID(id) != nil {
 		t.note("that row is not an aria")
 		return
 	}
-	t.attendAria(row.id)
+	t.attendAria(id)
 }
 
 func pagerAriaBack(t *transcript)    { t.hopAria(-1) }

internal/cli/keymap.go

@@ -380,6 +380,10 @@ var keymap = []keyBinding{
 	{chord: byteChord('h'), modes: inTranscript, open: opensPager, help: helpHelpPanel, pager: pagerHelpPanel},
 	{chord: byteChord('!'), modes: inTranscript, open: opensPager, help: helpStatusPanel, pager: pagerStatusPanel},
 	{chord: byteChord('Q'), modes: inTranscript, open: opensPager, help: helpQueuedPanel, pager: pagerQueuedPanel},
+	// SPACE IS THE LEADER: `space n` is notifications, as `<leader>n` is in
+	// Gluck's Neovim. n alone stays search-repeat. The second key is taken in
+	// dispatch (transcript.leaderChord), before the mode's own rows.
+	{chord: byteChord(' '), modes: inTranscript | inPanel, open: opensPager, help: helpNotifications, pager: pagerLeader},
 	// 'l' is the listing and 'L' is the home listing: `:ls` and `:ls -H` under
 	// a keystroke, uncapped because the pager scrolls (pagerUncapped).
 	{chord: byteChord('l'), modes: inTranscript | inPanel, open: opensPager, help: helpListPit, pager: pagerListPit},
@@ -753,6 +757,7 @@ const (
 	helpDetach
 	helpStatusPanel
 	helpQueuedPanel
+	helpNotifications
 	helpHelpPanel
 	helpListPit
 	helpConfirm
@@ -825,7 +830,7 @@ var helpRows = []helpRow{
 	{helpSelectExtend, "^N/^P + Shift", "travel between questions (Alt+^N/^P extends a selection)"},
 	{helpExpand, "Enter", "open tool bodies and form deltas within the selection"},
 	{helpToolBody, "e", "open the tool bodies within the selection"},
-	{helpPitEnter, "(in a list) Enter", "the row's own action: open a form value, attend an aria"},
+	{helpPitEnter, "(in a list) Enter", "the row's own action: open a form value or a notification, attend an aria"},
 	{helpVisualSelect, "(in v) Enter", "select the node under the cursor (then e expands it)"},
 	{helpVisualAttend, "(in v) a", "attend the highlighted id, or the word under the cursor; a path opens in your editor"},
 	{helpEscape, "Esc", "clear selection / close panel"},
@@ -837,6 +842,7 @@ var helpRows = []helpRow{
 	{helpListen, "^L", "open the transcript (stays open until you close it)"},
 	{helpStatusPanel, "!", "figaro status panel"},
 	{helpQueuedPanel, "Q", "queued prompts panel"},
+	{helpNotifications, "space n", "notifications: what figaro said, and what went wrong"},
 	{helpFormPit, "S", "the form (state) in the pit"},
 	{helpFocus, "T", "read the conversation without closing the pit (again to go back)"},
 	{helpListPit, "l / L", "list this aria's tree / the home tree, in the pit (Enter attends, x kills)"},

internal/cli/keymap_equiv_test.go

@@ -244,6 +244,12 @@ var pagerOracle = []struct {
 	keys  map[string]string
 }{
 	{"help", "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=true s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x09": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// ^O AND TAB ARE THE JUMPLIST, 2026-09-12, and 'a' is attend. Both
 		// report when there is no session behind them to attend WITH, which
@@ -438,6 +444,12 @@ var pagerOracle = []struct {
 		"0x7f": "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=true jq=\"1\" vis=none",
 	}},
 	{"panel+sel", "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 		// 'a' IS ATTEND, 2026-09-12: in a pit it acts on the selected row
 		// (the aria a `:ls` line names), so it is a pit key and does not
 		// dismiss the pit. Nothing else here moves: the attend itself is the
@@ -495,6 +507,12 @@ var pagerOracle = []struct {
 		"0x78": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 	}},
 	{"queued", "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=true g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x09": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// ^O AND TAB ARE THE JUMPLIST, 2026-09-12, and 'a' is attend. Both
 		// report when there is no session behind them to attend WITH, which
@@ -767,6 +785,12 @@ var pagerOracle = []struct {
 		"0x7f": "off:same fol=false srch=true q=\"\" mq=\"\" h=false s=false Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 	}},
 	{"status", "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x09": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// ^O AND TAB ARE THE JUMPLIST, 2026-09-12, and 'a' is attend. Both
 		// report when there is no session behind them to attend WITH, which

internal/cli/keymap_input_equiv_test.go

@@ -391,6 +391,12 @@ var inputOracle = []struct {
 	keys  map[string]string
 }{
 	{"incipit", "stop=false rest=\"\" act=false off:same fol=false srch=false q=\"\" h=false s=false Q=false g=false sel=false verb=false disc=0 canc=false clip=\"\" cpfail=false cping=false jmp=false jq=\"\"", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "stop=false rest=\"\" act=true off:bottom fol=true srch=false q=\"\" h=false s=false Q=false g=false sel=false verb=false disc=0 canc=false clip=\"\" cpfail=false cping=false jmp=false jq=\"\"",
 		// M-m IS VERBOSE TOOL OUTPUT, 2026-09-12, which ^O used to be: the
 		// chord went to the jumplist, Ctrl+M could not take the job (that byte
 		// is Enter), and a plain letter cannot be live in incipit. In the ':'
@@ -594,6 +600,12 @@ var inputOracle = []struct {
 		"csiu ^p+alt": "stop=false rest=\"\" act=true off:same fol=true srch=false q=\"\" h=false s=false Q=false g=false sel=false verb=false disc=0 canc=false clip=\"\" cpfail=false cping=false jmp=true jq=\"12\"",
 	}},
 	{"panel", "stop=false rest=\"\" act=true off:same fol=true srch=false q=\"\" h=false s=false Q=false g=false sel=false verb=false disc=0 canc=false clip=\"\" cpfail=false cping=false jmp=false jq=\"\"", map[string]string{
+		// SPACE IS THE LEADER, 2026-09-30: `space n` is notifications (as
+		// `<leader>n` is in Gluck's Neovim). A leader arms and waits, so it no
+		// longer falls through to the any-key dismissal: the panel stays open,
+		// which is what lets `space n` switch pits, and the offset moves only
+		// because an open pit keeps its rows.
+		"0x20": "stop=false rest=\"\" act=true off:bottom fol=true srch=false q=\"\" h=true s=false Q=false g=false sel=false verb=false disc=0 canc=false clip=\"\" cpfail=false cping=false jmp=false jq=\"\"",
 		// M-m IS VERBOSE TOOL OUTPUT, 2026-09-12, which ^O used to be: the
 		// chord went to the jumplist, Ctrl+M could not take the job (that byte
 		// is Enter), and a plain letter cannot be live in incipit. In the ':'

internal/cli/keymap_test.go

@@ -241,6 +241,7 @@ func TestOpensTranscript_MatchesTheHandKeptList(t *testing.T) {
 		0x0d, 0x0a, // Enter: open tool bodies and form deltas
 		'e',      // the tool body alone; it was 't' until 2026-09-17
 		'v', 'V', // visual selection: a gesture about rows, which only the pager has
+		' ', // the leader, 2026-09-30: `space n` opens notifications, a pit
 	} {
 		old[b] = true
 	}
@@ -350,7 +351,7 @@ func TestHelpBody_MatchesTheOldHandWrittenPanel(t *testing.T) {
 		"  ^N/^P + Shift       travel between questions (Alt+^N/^P extends a selection)",
 		"  Enter               open tool bodies and form deltas within the selection",
 		"  e                   open the tool bodies within the selection",
-		"  (in a list) Enter   the row's own action: open a form value, attend an aria",
+		"  (in a list) Enter   the row's own action: open a form value or a notification, attend an aria",
 		"  (in v) Enter        select the node under the cursor (then e expands it)",
 		"  (in v) a            attend the highlighted id, or the word under the cursor; a path opens in your editor",
 		"  Esc                 clear selection / close panel",
@@ -362,6 +363,7 @@ func TestHelpBody_MatchesTheOldHandWrittenPanel(t *testing.T) {
 		"  ^L                  open the transcript (stays open until you close it)",
 		"  !                   figaro status panel",
 		"  Q                   queued prompts panel",
+		"  space n             notifications: what figaro said, and what went wrong",
 		"  S                   the form (state) in the pit",
 		"  T                   read the conversation without closing the pit (again to go back)",
 		"  l / L               list this aria's tree / the home tree, in the pit (Enter attends, x kills)",

internal/cli/livelog_bridge.go

@@ -125,9 +125,7 @@ func newLivelogTurn(out io.Writer, w, h int, settings *renderSettings, figaroID
 	t := &livelogTurn{in: in, term: term, client: aria.NewClient(), view: view, status: status}
 	in.Queued = t.queuedRows // the queue is live chrome in the inline view too
 	t.tr = newTranscript(audited, w, h, view, t.client, figaroID, startedAt)
-	if status != nil {
-		t.tr.status = status
-	}
+	t.tr.setStatus(status)
 	t.wireClient()
 	return t
 }
@@ -679,6 +677,9 @@ func (t *livelogTurn) reportAt(text string, level alertLevel) {
 		return
 	}
 	slog.Warn("figaro session", "report", text)
+	// The news concerns the aria on screen, which is what the pit shows as
+	// its source and what `a` attends from it.
+	t.tr.notes.post(level, t.status.figaroID, text)
 	t.status.setNoticeAt(text, level)
 	if t.tr.active {
 		t.tr.render()