feat(seat): the seat pools and deposits, it never seals

[willows-bot]

Bite

Wave 3a of the CLI-seat redesign: rebuild grove/seat_cli.py to the seal model — check past seals at start, pool through the session, deposit + one seal ↗ offer at close-out; no inline seal. This ends the dead-end the first live drive hit (gap 83565764dda6: the seat stranded a lone human at seal ▶, offering an s that needed a pre-existing Nestor pair and a p <proof> key the seat never holds). The box-stream conversational rendering is the follow-up (3b).

What was done

• Removed the inline seal. Seat.seal() and both call sites (scope, proposals) are deleted. The seat prompts no seal ▶, calls neither seal_scope nor seal_proposal, and holds no key.
• Scope = silent start-check. scope() prints the stack + subject and returns; served() renders three_state — a populated serve means a past seal already matches this exact scope, empty (with its reason) is the honest no-match. No mint.
• Proposals pool, don't seal. proposals() shows each pass and a pooled: <subject> line; the rows persist on record via the chain / take_proposals; nothing is sealed mid-run.
• Close-out deposits, then offers once. checkout() prints the morning screen, then close_out() deposits the pool (api.pooled → the injected deposit) and makes a single seal ↗ http://127.0.0.1:8765 offer listing the deposited subjects, with any status:"error" pair shown verbatim. Operator decision: the seat deposits itself, so a lone human's drafts exist in Nestor when they go to seal.
• Deposit is injectable (like flower); the default willow_mcp_deposit() lazy-imports willow_mcp.db.Store + onescript_deposit.deposit (ProposeOnly, never seals). willow-mcp absent / a raising deposit / a refused pool read all render unreachable (never empty) and still list the pooled subjects.

Evidence

• Loki pre-merge audit (dispatch 19D01F9F): VERDICT VERIFIED — all five load-bearing claims hold (no seal reachable on any branch; pool-don't-seal; close-out ProposeOnly with three-state never collapsed; deposit cannot seal; lazy import can't crash; tests pin the claims).
• 6 mutants RED (re-add seal in scope/proposals ×2; checkout skips deposit; unreachable→empty; default-import→empty), control 40/40.
• Gate (ruff 0.16.7): format --check clean, check clean; pytest tests 829 passed / 14 skipped. Rebased clean onto master @ 6e3ac9e; pushed 944cfa1 (ahead 1, behind 0).

Out of scope

• 3b: the box-stream conversational rendering (boxes from the pile, local-model sentence, check chips, more?/repeat/small-talk, voice on glue words).
• record.py line-safety (willow-bot gap 6d5a986ce99f).
• Caveats carried forward: the grove-seat venv may need willow_mcp on its path for live deposits (desk deploy check); close_out() does not wrap api.pooled against a raised exception (latent; the api contract returns refusal dicts) — folded into 3b.

Next bite

3b: render the conversational box-stream in the terminal, mirroring web/demo/box-stream/box-stream-v1.3.html, and fold the api.pooled wrap.

Ratified-by: sean-campbell — "Ship wave 3a, push it"

🤖 Generated with Claude Code

https://claude.ai/code/session_01ELSWW4oHtDP66ekpNoPNku

[willows-bot]

willow-bot status for 9e0cd06df417

• audit: dispatched
• CI red: none filed
• last tick: 2026-10-09T15:14:22Z

[willows-bot]

0.1 hours, open to merged. Either very good or very lucky. The troll will find out which.