help palette: the wheel moves the cursor too, and a gate that meant it (C41)

[navbytes]

Follow-up to #158, from the design-supervisor audit C41 shipped without. Three findings, all fixed here; no rollback, nothing user-visible regressed.

D1 — the wheel scrolled past the row ↵ runs (high)

C41's contract is C27's verbatim: the view follows the cursor; the cursor does not follow the view. The keyboard path branched on filtering (app.rs); the wheel arm never got the same branch and kept calling help_scroll unconditionally. With the filter open, three notches put top=29 under cursor=0 — the overlay pointing at a row off screen, one ↵ from running it. Exactly the failure the clause forbids, and the roster's own wheel eight lines above does the right thing.

One notch = one command now, the arrow keys' step. Un-filtered the wheel still reads C15's poster on by the page.

Gated by the_wheel_moves_the_palette_cursor_rather_than_scrolling_past_it, mutation-checked: reverting the branch fails it (cursor: left 0, right 3).

D2 — the width gate passed by construction (med)

the_palette_cursor_marks_a_row_without_costing_it_a_column closed on assert_eq!(help_layout(body, &km, Some(q)).content, unmarked) — but help_layout takes no cursor, so that compared one pure call to an identical earlier one. Changing &prefix[1..] to &prefix[..] (the marker taking a column of its own — the precise thing the gate names) left it passing.

It now reads the claim off the drawn buffer: the marked row, with the glyph put back to the space it spent, must be byte-identical to the same row drawn unmarked. Mutation-checked — that edit now fails it on a one-column shift.

The property itself always held; only the gate was empty. The audit filed this as the ninth instance of DESIGN-ui.md §"On gates that pass by construction".

D3 — C39's wording table went stale (med)

C41 relabelled the filtering hints (read on → move, ↑↓ more → ↑↓ move, added ↵ run/↵ runs) without amending the table that documents them. Table updated to match the code, with a paragraph on why the wording changed. The two un-filtered rows are untouched.

Also

• C41 called ❯ its "third overlay"; it is the fourth — C20's feed uses it too.
• § C41 gains The wheel is a motion key too, and the mark-spends-no-width clause now describes the gate that actually measures it.

Verification

cargo test: 993 unit (+1) and all 36 suites green, 0 failures. cargo fmt clean; cargo +1.96.1 clippy --all-targets -- -D warnings clean.

Not fixed, deliberately

Two uncontracted gaps the audit logged, neither reachable on the default keymap: motion keys are fully inert when a query matches rows but no commands, and top is not re-followed on resize. Both want a contract before code.