cli: a kill asks first, and lands on the row the cursor falls onto

Killing the attended aria from a listing ended the session even with living
arias one row away: the successor now prefers the neighbour the list already
knows, then the jumplist, then the parent, and only ends the session when
there is none of the three.

'x' and ':kill' put a y/n question up. It is a mode and a pit, so every key
that is not an answer is swallowed and the bar holds the sentence for exactly
as long as the question stands. 'X' on a row kills with no question, which
costs the hang-up-and-drop meaning of 'X' inside a pit only.

Author: gluck

internal/cli/command.go

@@ -376,14 +376,21 @@ func (in *interactiveInput) commandKill(ctx context.Context, args []string) (str
 	if id == "" {
 		return "", errors.New("kill: no aria named and none on screen")
 	}
+	return in.killAria(ctx, id, recursive, "")
+}
+
+// killAria is the body both doors share. prefer is where the caller would
+// like the pager to stand afterwards (the row under the cursor in a listing);
+// it is honoured only if it is alive and is not the aria being killed.
+func (in *interactiveInput) killAria(ctx context.Context, id string, recursive bool, prefer string) (string, error) {
 	acli, err := in.angelus()
 	if err != nil {
 		return "", err
 	}
 	onScreen := id == in.currentID()
 	successor := ""
 	if onScreen {
-		successor = in.successorFor(ctx, acli, id)
+		successor = in.successorFor(ctx, acli, id, prefer)
 	}
 	if err := acli.Kill(ctx, id, recursive); err != nil {
 		return "", fmt.Errorf("kill %s: %w", id, err)
@@ -405,6 +412,32 @@ func (in *interactiveInput) commandKill(ctx context.Context, args []string) (str
 	return "killed " + id + "; " + note, nil
 }
 
+// askKill puts the question up and runs the kill only on a yes. The question
+// is drawn by the pager, so this hops onto the render lock the way every
+// other pager mutation does.
+func (in *interactiveInput) askKill(args []string) {
+	spec, _, err := parseKillArgs(args)
+	if err != nil {
+		in.noteErr(err.Error())
+		return
+	}
+	target := spec
+	if target == "" {
+		target = in.currentID()
+	}
+	if target == "" {
+		in.noteErr("kill: no aria named and none on screen")
+		return
+	}
+	in.mu.Lock()
+	in.lt.tr.askConfirm(killPrompt(target), func() {
+		in.commandAsync(func(ctx context.Context) (string, error) {
+			return in.commandKill(ctx, args)
+		})
+	})
+	in.mu.Unlock()
+}
+
 // parseKillArgs reads kill's own flags off the ':' box's argv.
 func parseKillArgs(args []string) (spec string, recursive bool, err error) {
 	for i := 0; i < len(args); i++ {
@@ -428,11 +461,11 @@ func parseKillArgs(args []string) (spec string, recursive bool, err error) {
 	return spec, recursive, nil
 }
 
-// successorFor answers where the transcript stands once id is gone: the most
-// recent aria in this session's jumplist that is still alive, else the parent
-// id lists for it. An aria forked from nothing, in a session with no history,
-// has no answer and the caller ends the session.
-func (in *interactiveInput) successorFor(ctx context.Context, acli *sdk.Angelus, id string) string {
+// successorFor answers where the transcript stands once id is gone: the
+// caller's preferred neighbour, else the most recent living aria in this
+// session's jumplist, else the parent. An aria with none of the three, in a
+// session with no history, has no answer and the caller ends the session.
+func (in *interactiveInput) successorFor(ctx context.Context, acli *sdk.Angelus, id, prefer string) string {
 	resp, err := acli.List(ctx)
 	if err != nil {
 		return ""
@@ -449,6 +482,12 @@ func (in *interactiveInput) successorFor(ctx context.Context, acli *sdk.Angelus,
 			parent = f.Parent
 		}
 	}
+	// THE LIST THE READER IS IN WINS. Killing a row of `:ls` should leave the
+	// cursor's neighbour on screen, not send the session somewhere else and
+	// not end it while a living aria is one row away.
+	if prefer != "" && prefer != id && alive[prefer] {
+		return prefer
+	}
 	in.mu.Lock()
 	trail := in.jumps.trail()
 	in.mu.Unlock()
@@ -1008,13 +1047,13 @@ func (in *interactiveInput) seedSubject(gen uint64) {
 // dropPitRow is 'x' in a pit: what dropping means depends on which
 // pit. Today only the queue can be dropped from; the switch is here rather
 // than in the transcript because every arm of it is an RPC.
-func (in *interactiveInput) dropPitRow(name, id string) {
+func (in *interactiveInput) dropPitRow(name, id, next string) {
 	// A ROW THAT NAMES AN ARIA IS KILLED, wherever it was listed. Only the
 	// queue counts by something else, and its ids are numbers.
 	if name != "queue" {
 		if rpc.ValidateAriaID(id) == nil {
 			in.commandAsync(func(ctx context.Context) (string, error) {
-				return in.commandKill(ctx, []string{id})
+				return in.killAria(ctx, id, false, next)
 			})
 		}
 		return

internal/cli/command_router.go

@@ -220,9 +220,9 @@ func (in *interactiveInput) runOverlay(verb string, args []string) {
 			return in.switchSubject(ctx, spec, true)
 		})
 	case "kill":
-		in.commandAsync(func(ctx context.Context) (string, error) {
-			return in.commandKill(ctx, args)
-		})
+		// ASK FIRST, from the ':' box as from the 'x' key: one question, one
+		// wording, one place that spends it.
+		in.askKill(args)
 	case "send", "s":
 		in.commandAsync(func(ctx context.Context) (string, error) {
 			return in.commandSend(ctx, args)

internal/cli/confirm.go

@@ -0,0 +1,64 @@
+package cli
+
+import "strings"
+
+// A DESTRUCTIVE VERB ASKS FIRST. `x` on a row and `:kill` put a question on
+// the screen and hold the keyboard until it is answered; `X` on a row does
+// the same work with no question at all.
+//
+// The question is a pit (so the bar names it and every key that is not an
+// answer is swallowed) plus a pinned notice, which is the one alert that does
+// not retire on its own: it stands for exactly as long as the question does.
+
+// confirmAsk is the pending question: the sentence, and what a yes runs.
+type confirmAsk struct {
+	prompt string
+	yes    func()
+}
+
+// askConfirm puts the question up. The caller's action runs on the input
+// goroutine, so it must hand off anything that dials, exactly as every other
+// hook here does.
+func (t *transcript) askConfirm(prompt string, yes func()) {
+	t.confirm = &confirmAsk{prompt: prompt, yes: yes}
+	t.pit.showList(pitConfirm, "", []pitRow{staticRow("  " + prompt + "  [y/N]")})
+	t.status.pinNotice(prompt)
+	t.focused = focusPit
+	t.render()
+}
+
+// clearConfirm takes the question down and the notice with it, in that order:
+// the bar must not be left holding a sentence about a question nobody can see.
+func (t *transcript) clearConfirm() {
+	t.confirm = nil
+	if t.showing(pitConfirm) {
+		t.pit.close()
+	}
+	t.status.setNotice("")
+}
+
+func confirmYes(t *transcript) {
+	ask := t.confirm
+	t.clearConfirm()
+	if ask != nil && ask.yes != nil {
+		ask.yes()
+	}
+	t.render()
+}
+
+func confirmNo(t *transcript) {
+	t.clearConfirm()
+	t.note("")
+	t.render()
+}
+
+// confirmLines is the question as the drawer draws it.
+func (t *transcript) confirmLines() []string {
+	if t.confirm == nil {
+		return nil
+	}
+	return []string{pitGray(clipToWidth(t.confirm.prompt+"  [y/N]", t.w))}
+}
+
+// killPrompt is the sentence the two kill doors ask.
+func killPrompt(id string) string { return "kill " + strings.TrimSpace(id) + "?" }

internal/cli/confirm_test.go

@@ -0,0 +1,71 @@
+package cli
+
+import (
+	"strings"
+	"testing"
+)
+
+// x on a row that names an aria asks before it kills, and holds the keyboard
+// until it is answered: a stray letter is not consent. X asks nothing.
+func TestConfirm_XAsksAndCapitalXDoesNot(t *testing.T) {
+	for _, tc := range []struct {
+		key     byte
+		wantAsk bool
+	}{{'x', true}, {'X', false}} {
+		tr, _ := visualFixture(t)
+		var killed []string
+		tr.dropRow = func(pit, id, next string) { killed = append(killed, id) }
+		tr.pit.showList(pitOutput, ":ls", []pitRow{
+			{text: "  aria1234", id: "aria1234", yank: "aria1234"},
+			{text: "  aria5678", id: "aria5678", yank: "aria5678"},
+		})
+		tr.focused = focusPit
+		tr.key(tc.key)
+		if !tc.wantAsk {
+			if len(killed) != 1 || killed[0] != "aria1234" {
+				t.Fatalf("X must kill at once, killed %v", killed)
+			}
+			continue
+		}
+		if len(killed) != 0 {
+			t.Fatalf("x killed %v without asking", killed)
+		}
+		if tr.mode() != modeConfirm {
+			t.Fatalf("mode = %v, want the question to own the keyboard", tr.mode())
+		}
+		if got := strings.Join(tr.confirmLines(), ""); !strings.Contains(stripANSI(got), "kill aria1234?") {
+			t.Fatalf("question = %q", got)
+		}
+		// A key that is not an answer changes nothing.
+		tr.key('j')
+		if tr.mode() != modeConfirm || len(killed) != 0 {
+			t.Fatalf("a stray key answered the question: mode=%v killed=%v", tr.mode(), killed)
+		}
+		// n leaves it alone and takes the sentence off the bar with it.
+		tr.key('n')
+		if tr.mode() == modeConfirm || len(killed) != 0 {
+			t.Fatalf("n did not dismiss: mode=%v killed=%v", tr.mode(), killed)
+		}
+		if note := tr.status.noticeText(); note != "" {
+			t.Fatalf("the pinned notice outlived the question: %q", note)
+		}
+	}
+}
+
+// The question pins its sentence to the bar for as long as it is up: a notice
+// that retires mid-question leaves a dialog nobody can read.
+func TestConfirm_TheNoticeStandsWhileTheQuestionDoes(t *testing.T) {
+	tr, _ := visualFixture(t)
+	done := false
+	tr.askConfirm("kill aria1234?", func() { done = true })
+	if got := tr.status.noticeText(); !strings.Contains(got, "kill aria1234?") {
+		t.Fatalf("bar = %q, want the question", got)
+	}
+	tr.key('y')
+	if !done {
+		t.Fatal("y did not run the action")
+	}
+	if note := tr.status.noticeText(); note != "" {
+		t.Fatalf("the notice must clear with the question: %q", note)
+	}
+}

internal/cli/keymap.go

@@ -21,6 +21,7 @@ const (
 	modePanel                     // a '?'/'!'/'Q' panel is showing
 	modeVisual                    // v/V: a visual selection is up and owns the motions
 	modeFork                      // 'f' is down, waiting for the direction of the fork jump
+	modeConfirm                   // a y/n question owns the keyboard until it is answered
 	numKeyModes
 )
 
@@ -35,11 +36,12 @@ const (
 	inPanel      keyModeSet = 1 << modePanel
 	inVisual     keyModeSet = 1 << modeVisual
 	inFork       keyModeSet = 1 << modeFork
+	inConfirm    keyModeSet = 1 << modeConfirm
 
 	// inPager is every mode with the pager up. Note that a transcript-mode
 	// row is ALSO reachable while a panel is showing: the panel swallows only
 	// its own keys and every other key wipes it and acts (see dispatch).
-	inPager  = inTranscript | inSearchBox | inJumpBox | inPanel | inVisual | inFork
+	inPager  = inTranscript | inSearchBox | inJumpBox | inPanel | inVisual | inFork | inConfirm
 	inAnyBox = inIncipit | inPager
 )
 
@@ -288,6 +290,18 @@ var keymap = []keyBinding{
 		help: helpNone, pager: pagerForkCancel,
 	},
 
+	// -- confirm mode: a destructive verb asks first ------------------------
+	//
+	// THE QUESTION OWNS THE KEYBOARD. Every key that is not an answer is
+	// swallowed (see dispatch), because a stray letter must not be read as
+	// consent, and the notice stays on the bar for exactly as long as the
+	// question is up.
+	{chord: byteChord('y'), modes: inConfirm, open: staysInline, why: "only reachable with a question up", help: helpConfirm, pager: confirmYes},
+	{chord: byteChord('Y'), modes: inConfirm, open: staysInline, why: "only reachable with a question up", help: helpNone, pager: confirmYes},
+	{chord: byteChord('n'), modes: inConfirm, open: staysInline, why: "only reachable with a question up", help: helpNone, pager: confirmNo},
+	{chord: byteChord('N'), modes: inConfirm, open: staysInline, why: "only reachable with a question up", help: helpNone, pager: confirmNo},
+	{chord: byteChord(0x1b), modes: inConfirm, open: staysInline, why: "only reachable with a question up", help: helpNone, pager: confirmNo},
+
 	// -- pager level: attending what is on screen --------------------------
 	//
 	// 'a' is ATTEND, one verb with two subjects: in the transcript it is the
@@ -389,7 +403,9 @@ var keymap = []keyBinding{
 		// destructive one, and the two must not be neighbours. What it drops is
 		// printed into the pager's notice and reprinted to the shell on the way
 		// out, so a slip costs you the queue's PLACE, not its text.
-		chord: byteChord('X'), modes: inTranscript | inPanel | inVisual,
+		// NOT IN A PIT: there 'X' is the unasked drop of the selected row
+		// (below), because a reader inside a list means the list.
+		chord: byteChord('X'), modes: inTranscript | inVisual,
 		open: staysInline, why: "it addresses a turn that is streaming in the view you are already in",
 		help: helpHangUpDrop, input: inputHangUpDrop,
 	},
@@ -405,6 +421,11 @@ var keymap = []keyBinding{
 		open: staysInline, why: "it acts on a row in a pit that is already open",
 		help: helpPitDrop, pager: pagerPitDrop,
 	},
+	{
+		chord: byteChord('X'), modes: inPanel,
+		open: staysInline, why: "it acts on a row in a pit that is already open",
+		help: helpPitDrop, pager: pagerPitDropNow,
+	},
 
 	// -- pager level: selection --------------------------------------------
 	{chord: byteChord(0x0e), modes: inTranscript, open: opensPager, help: helpSelect, pager: pagerSelectNext},
@@ -725,6 +746,7 @@ const (
 	helpQueuedPanel
 	helpHelpPanel
 	helpListPit
+	helpConfirm
 	helpCmdHistory
 	helpCmdComplete
 	helpCmdEdit
@@ -777,7 +799,7 @@ var helpRows = []helpRow{
 	// shell user needs, which is that their fingers already know this box.
 	{helpCmdEdit, "(in :) ^A ^E ^W ^K ^Y", "emacs/readline editing, the whole set"},
 	{helpCmdAbort, "(in :) Esc / ^C / ^G", "abandon the line, close the box"},
-	{helpPitDrop, "(in a list) x", "drop the selected entry (queue)"},
+	{helpPitDrop, "(in a list) x / X", "drop or kill the selected row, asking first / at once"},
 	{helpYank, "y", "copy selection (or aria id if none)"},
 	{helpVerbose, "M-m", "toggle verbose tool output and the node addresses"},
 	{helpSticky, "s", "pin the question of the turn you are inside"},
@@ -803,6 +825,7 @@ var helpRows = []helpRow{
 	{helpFormPit, "S", "the form (state) in the pit"},
 	{helpFocus, "T", "read the conversation without closing the pit (again to go back)"},
 	{helpListPit, "l / L", "list this aria's tree / the home tree, in the pit (Enter attends, x kills)"},
+	{helpConfirm, "y / n", "answer a confirmation (Esc is no); X on a row kills with no question"},
 	{helpHelpPanel, "h", "close help"},
 }
 

internal/cli/keymap_equiv_test.go

@@ -168,6 +168,9 @@ var oracleStates = map[string]func(*transcript){
 	// only state here with no pre-refactor twin -- the mode did not exist --
 	// so its row was recorded from the behaviour it was built to have.
 	"fork": func(tr *transcript) { tr.key('f') },
+	// A y/n question up: the mode a destructive verb opens, where every key
+	// that is not an answer is swallowed.
+	"confirm": func(tr *transcript) { tr.askConfirm("kill aria1234?", func() {}) },
 }
 
 // REBASED A SECOND TIME, for the cold-selection seed (Ctrl-N/Ctrl-P). Two
@@ -255,6 +258,7 @@ var pagerOracle = []struct {
 		// session's business, off this oracle's stage.
 		"0x3f": "off:bottom fol=true srch=true q=\"\" mq=\"\" h=true s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x4c": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x58": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=true s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x5e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x61": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=true s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// VISUAL MODE, 2026-09-11: v/V close whatever pit is up, drop the node
@@ -440,6 +444,7 @@ var pagerOracle = []struct {
 		// session's business, off this oracle's stage.
 		"0x0a": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 		"0x0d": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
+		"0x58": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 		"0x61": "off:same fol=false srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=true exp=0 jmp=false jq=\"\" vis=none",
 		// VISUAL MODE, 2026-09-11: v/V close whatever pit is up, drop the node
 		// selection, detach from the tail and seed a visual selection on the
@@ -505,6 +510,7 @@ var pagerOracle = []struct {
 		// dismiss the pit. Nothing else here moves: the attend itself is the
 		// session's business, off this oracle's stage.
 		"0x4c": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x58": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=true g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x5e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x61": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=true g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// VISUAL MODE, 2026-09-11: v/V close whatever pit is up, drop the node
@@ -776,6 +782,7 @@ var pagerOracle = []struct {
 		// dismiss the pit. Nothing else here moves: the attend itself is the
 		// session's business, off this oracle's stage.
 		"0x4c": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x58": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x5e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x61": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=true Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		// VISUAL MODE, 2026-09-11: v/V close whatever pit is up, drop the node
@@ -1012,6 +1019,15 @@ var pagerOracle = []struct {
 	// transcript's own rows, which is why the rest of this row reads like
 	// the transcript's. Recorded from the behaviour the mode was built to
 	// have: it has no pre-refactor twin.
+	// The y/n question. Every key that is not an answer is swallowed, which
+	// is the whole point: consent is typed, never stumbled into.
+	{"confirm", "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none", map[string]string{
+		"0x1b": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x4e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x59": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x6e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+		"0x79": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
+	}},
 	{"fork", "off:same fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none", map[string]string{
 		"0x4c": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",
 		"0x5e": "off:bottom fol=true srch=false q=\"\" mq=\"\" h=false s=false Q=false g=false sel=false exp=0 jmp=false jq=\"\" vis=none",