Settings panel: Fleet & Versions — the view over doctor's JSON

[aarontrowbridge]

Important

Problem — The fleet's staleness state is CLI-only; the settings UI has no view of it, and headless SSH is currently the only first-class surface.
Approach — The Fleet & Versions settings section (spec D3): a pure view over doctor's JSON — surface rows (name, running version, source version, verdict chip), a refresh action re-invoking doctor, an upgrade button per surface with verdict stale OR integrity-failure. The extension host spawns the CLI (child_process, the amico-run pattern); long verbs stream by tailing the receipt JSONL; the flock is the concurrency guard; the receipt store is the exit state of record (the panel may die mid-flight — the extension verb replaces the extension hosting it — and the receipt still tells the truth).
Scope — in: the render function + settings section wiring + view-over-CLI tests · out: doctor, verbs, watchdog (siblings).

Acceptance Criteria

• Renders doctor's JSON: surface names, versions, verdict chips verbatim from the report — a fact the panel shows that doctor didn't say is a bug
• Upgrade control enabled for stale AND integrity-failure verdicts, disabled for current/unknown — asserted on the control's disabled DOM property, not a class name
• Committed doctor JSON fixtures (validating against the doctor schema) drive the tests: a current fixture (controls disabled), a stale fixture, an integrity-failure fixture (controls enabled)
• Upgrade invocation spawns the CLI verb (child_process) with the surface argument; receipt JSONL tailing wired for long verbs
• Zero version/staleness logic in the panel — every rendered fact traces to the doctor report object in the test

Testing Decisions

vitest unit tests on the render function (the extension package's established harness — same as the mode-cards and naming suites); the doctor fixtures are shared contract fixtures (schema-validated in the sibling slice's suite, consumed here).

Key Decisions

View-over-CLI is the load-bearing invariant: the panel is replaceable, doctor is the truth. The verdict chip → enabled-state derivation is view logic, not a parallel fact. The receipt store (not the panel's survival) is the upgrade's source of truth.

Constraints & Invariants

No version comparisons, no staleness predicates, no probe logic in the panel — ever.

Prior Art

The extension's settings surfaces; the amico-run child_process pattern; the spec's D3 + Measurement Protocol.

Source

Part of 524 · spec spec-20260823-094507-fleet-dev-tools.md (D3, Measurement Protocol) · Blocked by 525 (the JSON contract) — the upgrade buttons additionally need #S2's verbs at runtime, but the render tests only need the contract.