fix(tui): Esc stops the flow, and the card and ident hold ground [spec 10]

[wine-fall]

Implements specs/spec10/10-tui.md (§2.3, §3.2-B, §3.3, §3.4) and specs/spec03/03-03-guide-harness.md (§7).

Three user reports from one real guided-install session:

1. The wordmark scrolled away the moment the guide's tool narration flooded the log. In the wide composition the station ident is now pinned between the scene band and the log (identPinned in tui/src/logo.ts) whenever the log region can spare its rows (≥ 2× the ident's six); narrow and cramped layouts keep the classic in-log ident.

2. A running setup flow could not be stopped without quitting. Esc (with no menu/pane open) now rides the wire as interrupt; runSetup registers a flow-scoped stop latch on the new optional Host.onInterrupt seam for its whole duration — opening probes included. Reads decline through as '', the guide's SDK session is cut via its interrupt promise, the closing re-probe is skipped, pending ask cards drop on both sides (askDrop, deliberately outside the replay backlog), and write_voice_config aborts instead of validating/persisting on a declined secret read. With no flow registered (first-run seeds, the broadcast) the interrupt is noise and the cards stand.

3. The per-turn reply prompt opened a contentless spotlight card ("murmur is asking" over "your reply"). It is an info line now; the modal card stays reserved for the onboarding decisions (consent checklist, first-run seeds, the secret paste).

Rider: the murmur-ship closing review pins gpt-5.6-sol (the Team seat's spend cap killed gpt-5.5 runs; user picked the 5.6 flagship).

Verification

• pnpm test green (all suites, incl. new regressions: stop-latch reads, Esc at offer/probes/mid-conversation, askDrop routing + no-flow noise, aborted secret write, wire round-trip, identPinned); tsc + oxlint clean.
• Real-TUI pty smoke (pyte, 180×48, stub brain): after 25 typed lines flood the log, the wordmark stands pinned above the scrolling tail, and Esc reaches the engine (interrupt received with no flow to stop; ignored in dev.log) without crashing.
• Peer review: codex (gpt-5.6-sol, xhigh): 3 findings, 3 applied (abort seam for the secret tool, Esc armed before the probes, comment date-stamps stripped); code-review skill (high): 3 findings, 3 applied (same two + a one-line closure for Esc at the offer). First codex attempt on the Team seat died on its spend cap — mechanical skip, rerun on the Pro login.

AI coding brief

• Original request: Two screenshots from a live guided-install: the murmur wordmark vanished when execution started; the flow could not be stopped with Esc like a coding agent's; and a "murmur is asking" card popped with no question in it — modal dialogs should be onboarding-only, everything after consent should live in the input line.
• Manual interventions: User interrupted the first review round to fix codex (Team workspace spend cap → re-login on the personal Pro plan) and rejected the pinned gpt-5.5 in favor of gpt-5.6-sol.
• Retro: The report arrived as three symptoms with the desired UX spelled out, which made scoping immediate. The review round would have been one pass instead of two if the codex account health had been checked before launching the fallback reviewer.

🤖 Generated with Claude Code