Match REPL colours, pane surfaces and drawers to the reference (#881, 1/3) (#885)

* 💄 Say what a row's characters are, and where a drawer stops (#881)

XMD source and JSON keep their own colours wherever this screen shows them
verbatim, panes and drawers have surfaces of their own, and a drawer says where
the reading behind it stops.

A row whose characters mean different things now carries immutable token runs:
plain view data, issued by the composition module, concatenating to exactly the
text the row draws. The ops builder emits one text operation per run inside the
one element the row was measured as, so a row reading as several things is still
one node, one bound and one pointer target.

A private `presentation-text.ts` says what the characters of the two readings
this screen shows verbatim are — executable Markdown source and a serialized
JSON value — one line at a time, classifying nothing it was not handed. It
validates nothing, evaluates nothing and rewrites nothing, and JSON is
classified from a value this product already parsed rather than from a guess
about arbitrary text.

Focus no longer repaints a row. It adds weight, and the cue in front of the row
is the one run the focus colour belongs to, so the row a keystroke reaches stays
readable as the thing it is while selection keeps its own surface.

The application paints its own uncovered area, a question or permission drawer is
named in the waiting accent, a field's name and the value in it are told apart,
and the contextual drawer is bounded by a rule along the top of its rectangle and
inset one cell on each side. Both belong to the measured rectangle: the content
window is measured at what they leave, which costs that window one row and two
columns at every profile and is why UI16 and UI17 now reach `[submit]` and the
validation row through one `[v later]`.

* 🐛 Draw a row as its own stretches only where the frame holds it whole

The engine wraps each text operation on its own, and a row is one cell tall:
several stretches whose total is wider than the element each show their own
first line and leave the cells their remainder went to blank. A 400-column
generated tag in a 118-column drawer came out with its quoted values missing —
found by capturing the gallery, which the focused tests could not reach because
every example in them fits.

A row carries its stretches only when the element it was measured in holds them
whole, read off the constraint the element was opened with. A row the engine
must wrap is drawn as the one thing it is, which is the reading this screen has
always shown. The regression commits a tag far wider than any supported drawer
and holds every written cell to being the next character of the source.

* 🐛 Keep the roles of the characters a row can show (#881 R1–R3)

Planner feedback on f0b8eb1: three frozen requirements were unmet.

**R1.** An overflowing row went through a single-colour fallback, so the Plan
preview read as ordinary source and, at 72×20, a populated field painted its
visible value as though it were the field's name. The fallback existed because
the engine wraps each text operation on its own. The stretches are now cut at
the room the element has instead: nothing wraps, every character the row can
show keeps the role it has and the order it was in, and the cue in front of a
focused row is still the one cyan thing. A row whose width the flow decides —
only the pass that is asking what the widths are draws one — is unchanged.

The overflow regression now asserts the delimiter, tag, attribute, quoted
value, reference and prose roles on the overflowing row itself, that no row is
one colour throughout, and that the narrow populated form keeps its field's
name and its value apart. The gallery audit no longer accepts a tag drawn as
one stretch.

**R2.** The new assertions read expected RGB from the production palette, which
would have stayed green through a palette drift. They now read a fixture
transcribed from the corrected Terminal Interface archive — its `S`, `C` and
`Y` constants, with the archive hash and the sources they came from — so the
two sides of every comparison are independent. Changing one palette entry by a
single bit now fails three rows.

**R3.** The frozen resize endpoints are taken with the populated project
question open, so the refusal and the recovery prove the editable question and
its values survive, rather than substituting the permission drawer.

Author: taras

architecture.md

@@ -5842,19 +5842,43 @@ surface. It is pure: no operation, no contextual Api, no Journal access, no
 mutable state and no export beyond this feature, so a role owns nothing that can
 outlive the frame that computed it. The palette lives there and nowhere else.
 
+**A row whose characters mean different things carries runs.** A run is plain
+immutable view data — a string and the name of a role — issued by the composition
+module and concatenating to exactly the text the row draws. The ops builder emits
+one text operation per run *inside the one element the row was measured as*, so a
+row reading as several things is still one node, one bound and one pointer target:
+a child per token would publish a hit box for every delimiter on the screen. Runs
+apply only when they spell the text being drawn; a row whose mounted node
+contributed something else is drawn as one stretch under the row's own role.
+
+A second private module says what the characters of the two readings this screen
+shows verbatim are: executable Markdown source, and a serialized JSON value. It
+classifies one line at a time, because a cell is a row and a classifier carrying
+state across rows would be answering about a document. It is pure and
+presentation-only — it validates nothing, evaluates nothing and rewrites nothing,
+and every run it returns concatenates back to the line it was given. JSON is
+classified from a value this product had already parsed or from a reading a caller
+knows is JSON, never from a guess that arbitrary provider or document text looks
+like JSON.
+
 **Keyboard focus is not a fact about the reading**, so it arrives later. After
 reconciliation the commit boundary passes the actual focused mounted node's id to
 the ops builder for that frame alone, matched by exact mounted identity and
-discarded with the ops it decorated. Focus changes a foreground and its attributes
-and never geometry; selection keeps an independent surface. Neither repairs,
-stores or grants focus.
+discarded with the ops it decorated. Focus adds weight and never geometry, and it
+takes no foreground away: a row's own roles say what its characters are, and the
+focus colour belongs to the marker in front of the row, which is a run of its own.
+Selection keeps an independent surface. Neither repairs, stores or grants focus.
 
 **One builder decorates both passes.** The measurement pass and the committed
 pass run through the same op builder, so pane edges, surfaces and headings
 participate in measurement and a measured region cannot disagree with the region
 drawn into it. A pane's own edges are not part of the room inside it: a bordered
 pane carries a border-free content box, and rows are built to the width the engine
-reports for that box rather than to the pane's outer bound. The renderer stays
+reports for that box rather than to the pane's outer bound. A drawer's own
+decoration is held to the same rule: the rule along the top of its rectangle and
+the one-cell inset on each side are elements of that rectangle, so the content
+window is measured at what they leave and admission answers from that measurement
+rather than from the undecorated rectangle. The renderer stays
 model-blind — it receives ops and geometry, classifies no row text, and no
 production string carries an escape sequence.