V48 Gate 3 (implementation-only): lock run config above telemetry in deposit detail

Once a synthesis run is submitted or selected, the page is run detail:
repository + Obfuscations configuration render above telemetry and freeze
(disabled/read-only). Back unlocks config for a new dispatch. Tests cover
layout order and locked controls.

Author: geraldarthurdavis

uapi/app/deposits/DepositPageClient.tsx

@@ -60,6 +60,11 @@ type DepositSourceSelectionProps = {
   repoEarningEstimateSats?: number | null;
   /** V48-Gate3-F17: previously anchored repositories, newest first. */
   repositoryAnchors?: DepositRepositoryAnchor[];
+  /**
+   * When true (run detail / post-submit), freeze repository·branch·commit
+   * selection — the configuration that produced the loaded run is read-only.
+   */
+  disabled?: boolean;
 };
 
 async function readJsonResponse(response: Response) {
@@ -119,6 +124,7 @@ export default function DepositSourceSelection({
   buildRouteHref,
   repoEarningEstimateSats,
   repositoryAnchors = [],
+  disabled = false,
 }: DepositSourceSelectionProps) {
   const router = useRouter();
   const searchParams = useSearchParams();
@@ -564,8 +570,13 @@ export default function DepositSourceSelection({
 
   return (
     <section
-      className="border border-white/10 bg-white/[0.035] px-4 py-4"
+      className={`border border-white/10 bg-white/[0.035] px-4 py-4 ${
+        disabled ? "opacity-80" : ""
+      }`}
       aria-label="Select deposit repository"
+      data-testid="deposit-source-selection"
+      data-locked={disabled ? "true" : "false"}
+      aria-disabled={disabled || undefined}
     >
       <div className="flex flex-wrap items-start justify-between gap-3">
         <div>
@@ -577,8 +588,9 @@ export default function DepositSourceSelection({
             <BitcodeInlineExplainer explainer={DEPOSIT_SECTION_EXPLAINERS.repository} />
           </h2>
           <p className="mt-2 max-w-3xl text-sm leading-6 text-neutral-400">
-            One connected repository, branch, and commit form the source package
-            the rest of the Deposit reads.
+            {disabled
+              ? "Source package that produced this run — locked while reviewing run detail."
+              : "One connected repository, branch, and commit form the source package the rest of the Deposit reads."}
           </p>
         </div>
         <div className="flex items-center gap-2">
@@ -596,7 +608,9 @@ export default function DepositSourceSelection({
                     : null,
                 }))}
                 value={null}
+                disabled={disabled}
                 onSelect={(key) => {
+                  if (disabled) return;
                   const anchor = repositoryAnchors.find((entry) => entry.id === key);
                   if (!anchor) return;
                   updateSourceParams((params) => {
@@ -627,7 +641,7 @@ export default function DepositSourceSelection({
             <button
               type="button"
               aria-label="Anchor repository to the activity ledger"
-              disabled={!selectedRepository || isRecording}
+              disabled={disabled || !selectedRepository || isRecording}
               onClick={() => {
                 void handleAnchorRepository();
               }}
@@ -682,7 +696,9 @@ export default function DepositSourceSelection({
                       : null,
                 }))}
                 value={provider}
+                disabled={disabled}
                 onSelect={(key) => {
+                  if (disabled) return;
                   const nextProvider = key ?? "github";
                   updateSourceParams((params) => {
                     params.set("provider", nextProvider);
@@ -702,6 +718,7 @@ export default function DepositSourceSelection({
             <SourceListRefreshButton
               ariaLabel="Refresh provider connection"
               explainer={DEPOSIT_SECTION_EXPLAINERS.refreshProviderConnection}
+              disabled={disabled}
               loading={isLoadingConnection}
               onRefresh={() =>
                 setConnectionRefreshNonce((nonce) => nonce + 1)
@@ -730,7 +747,9 @@ export default function DepositSourceSelection({
                 repositories={repositories}
                 loading={isLoadingRepositories && repositories.length === 0}
                 value={selectedRepository?.fullName}
-                onSelect={(repository) =>
+                disabled={disabled}
+                onSelect={(repository) => {
+                  if (disabled) return;
                   updateSourceParams((params) => {
                     if (repository) {
                       params.set("repo", repository.fullName);
@@ -741,8 +760,8 @@ export default function DepositSourceSelection({
                     params.delete("sourceCommit");
                     params.delete("branch");
                     params.delete("commit");
-                  })
-                }
+                  });
+                }}
                 placeholder={
                   connectionStatus?.connected
                     ? "Select repository supply..."
@@ -756,7 +775,7 @@ export default function DepositSourceSelection({
             <SourceListRefreshButton
               ariaLabel="Refresh repository inventory"
               explainer={DEPOSIT_SECTION_EXPLAINERS.refreshRepositoryInventory}
-              disabled={!connectionStatus?.connected}
+              disabled={disabled || !connectionStatus?.connected}
               loading={isLoadingRepositories}
               onRefresh={() => {
                 // Hard-refresh inventory next to the inventory select (resets
@@ -792,6 +811,7 @@ export default function DepositSourceSelection({
                 aria-label="Repository source branch"
                 value={selectedBranch || null}
                 disabled={
+                  disabled ||
                   !selectedRepository ||
                   connectionNeedsReconnect ||
                   (!isLoadingBranches && branches.length === 0)
@@ -810,7 +830,8 @@ export default function DepositSourceSelection({
                       ? "default"
                       : null,
                 }))}
-                onSelect={(branchName) =>
+                onSelect={(branchName) => {
+                  if (disabled) return;
                   updateSourceParams((params) => {
                     if (selectedRepository)
                       params.set("repo", selectedRepository.fullName);
@@ -819,15 +840,17 @@ export default function DepositSourceSelection({
                     params.delete("sourceCommit");
                     params.delete("branch");
                     params.delete("commit");
-                  })
-                }
+                  });
+                }}
                 className="h-9 border-white/10 bg-[rgba(10,15,30,0.88)] px-3 text-sm text-white hover:bg-[rgba(10,15,30,0.88)] focus:border-emerald-400/40"
               />
             </div>
             <SourceListRefreshButton
               ariaLabel="Refresh branches list"
               explainer={DEPOSIT_SECTION_EXPLAINERS.refreshBranches}
-              disabled={!selectedRepository || connectionNeedsReconnect}
+              disabled={
+                disabled || !selectedRepository || connectionNeedsReconnect
+              }
               loading={isLoadingBranches}
               onRefresh={() => setBranchesRefreshNonce((nonce) => nonce + 1)}
             />
@@ -860,6 +883,7 @@ export default function DepositSourceSelection({
                     : null
                 }
                 disabled={
+                  disabled ||
                   !selectedBranch ||
                   connectionNeedsReconnect ||
                   (!isLoadingCommits && commits.length === 0)
@@ -902,7 +926,8 @@ export default function DepositSourceSelection({
                     searchText: `${commit.sha} ${commit.message}`,
                   })),
                 ]}
-                onSelect={(commitKey) =>
+                onSelect={(commitKey) => {
+                  if (disabled) return;
                   updateSourceParams((params) => {
                     if (selectedRepository)
                       params.set("repo", selectedRepository.fullName);
@@ -915,15 +940,15 @@ export default function DepositSourceSelection({
                     }
                     params.delete("branch");
                     params.delete("commit");
-                  })
-                }
+                  });
+                }}
                 className="h-9 border-white/10 bg-[rgba(10,15,30,0.88)] px-3 text-sm text-white hover:bg-[rgba(10,15,30,0.88)] focus:border-emerald-400/40"
               />
             </div>
             <SourceListRefreshButton
               ariaLabel="Refresh commits list"
               explainer={DEPOSIT_SECTION_EXPLAINERS.refreshLatestCommit}
-              disabled={!selectedBranch || connectionNeedsReconnect}
+              disabled={disabled || !selectedBranch || connectionNeedsReconnect}
               loading={isLoadingCommits}
               onRefresh={() => setCommitsRefreshNonce((nonce) => nonce + 1)}
             />

uapi/app/deposits/DepositSourceSelection.tsx

@@ -32,6 +32,8 @@ interface VCSFileTreePickerProps {
   /** Why a conflicting row is disabled (e.g. 'Already a Forced Inclusion'). */
   conflictLabel?: string;
   emptyLabel?: string;
+  /** When true, selection is frozen (run-detail lock). Expand still works. */
+  disabled?: boolean;
   'aria-label'?: string;
 }
 
@@ -75,6 +77,7 @@ export function VCSFileTreePicker({
   conflictingPaths = [],
   conflictLabel = 'selected in the other picker',
   emptyLabel = 'Connect a repository to browse its files.',
+  disabled = false,
   'aria-label': ariaLabel,
 }: VCSFileTreePickerProps) {
   // Children by directory path ('' = repository root); null while loading.
@@ -291,13 +294,19 @@ export function VCSFileTreePicker({
             <button
               type="button"
               onClick={() => toggleSelected(selectionPath)}
-              disabled={isConflicting}
-              title={isConflicting ? conflictLabel : undefined}
+              disabled={disabled || isConflicting}
+              title={
+                disabled
+                  ? 'Configuration locked for this run'
+                  : isConflicting
+                    ? conflictLabel
+                    : undefined
+              }
               aria-pressed={isSelected}
               className={`flex min-w-0 flex-1 items-center gap-1.5 border px-1.5 py-0.5 text-left font-mono text-xs transition ${
                 isSelected
                   ? 'border-emerald-300/35 bg-emerald-300/10 text-emerald-100'
-                  : isConflicting
+                  : isConflicting || disabled
                     ? 'cursor-not-allowed border-transparent text-neutral-600 line-through'
                     : 'border-transparent text-neutral-200 hover:border-white/15 hover:bg-white/5'
               }`}
@@ -326,15 +335,15 @@ export function VCSFileTreePicker({
           <button
             type="button"
             onClick={handleSelectAll}
-            disabled={!canSelectAll}
+            disabled={disabled || !canSelectAll}
             className="border border-white/10 px-1.5 py-0.5 text-[0.62rem] uppercase tracking-[0.14em] text-neutral-300 transition hover:border-emerald-300/35 hover:text-emerald-100 disabled:cursor-not-allowed disabled:opacity-40"
           >
             Select all
           </button>
           <button
             type="button"
             onClick={handleClearAll}
-            disabled={selectedPaths.length === 0}
+            disabled={disabled || selectedPaths.length === 0}
             className="border border-white/10 px-1.5 py-0.5 text-[0.62rem] uppercase tracking-[0.14em] text-neutral-300 transition hover:border-rose-300/35 hover:text-rose-100 disabled:cursor-not-allowed disabled:opacity-40"
           >
             Clear all
@@ -347,8 +356,13 @@ export function VCSFileTreePicker({
             <button
               key={path}
               type="button"
-              onClick={() => onChange(selectedPaths.filter((entry) => entry !== path))}
-              className="border border-emerald-300/25 bg-emerald-300/10 px-1.5 py-0.5 font-mono text-[0.66rem] text-emerald-100 transition hover:border-emerald-200/45 hover:bg-emerald-300/15"
+              onClick={() =>
+                disabled
+                  ? undefined
+                  : onChange(selectedPaths.filter((entry) => entry !== path))
+              }
+              disabled={disabled}
+              className="border border-emerald-300/25 bg-emerald-300/10 px-1.5 py-0.5 font-mono text-[0.66rem] text-emerald-100 transition hover:border-emerald-200/45 hover:bg-emerald-300/15 disabled:cursor-not-allowed disabled:opacity-60"
               aria-label={`Remove ${path}`}
             >
               {path} ×

uapi/components/base/bitcode/vcs/VCSFileTreePicker.tsx

@@ -15,6 +15,8 @@ interface VCSRepositorySelectorProps {
   className?: string;
   repositories?: VCSRepository[] | null;
   loading?: boolean;
+  /** When true, the selector is non-interactive (run-detail lock). */
+  disabled?: boolean;
 }
 
 export function VCSRepositorySelector({
@@ -26,6 +28,7 @@ export function VCSRepositorySelector({
   className,
   repositories: providedRepositories,
   loading: providedLoading,
+  disabled = false,
 }: VCSRepositorySelectorProps) {
   const [open, setOpen] = useState(false);
   const [fetchedRepositories, setFetchedRepositories] = useState<VCSRepository[]>([]);
@@ -117,8 +120,9 @@ export function VCSRepositorySelector({
       loading={isLoading}
       loadingMessage="Loading repositories..."
       className={className}
-      open={open}
-      onOpenChange={setOpen}
+      open={disabled ? false : open}
+      onOpenChange={disabled ? undefined : setOpen}
+      disabled={disabled}
     />
   );
 }

uapi/components/base/bitcode/vcs/VCSRepositorySelector.tsx

@@ -95,10 +95,12 @@ jest.mock("@/app/deposits/DepositSourceSelection", () => ({
     onContextChange,
     routePath,
     repositoryAnchors,
+    disabled,
   }: {
     onContextChange: (value: unknown) => void;
     routePath?: string;
     repositoryAnchors?: Array<{ repositoryFullName: string }>;
+    disabled?: boolean;
   }) => {
     React.useEffect(() => {
       onContextChange({
@@ -123,7 +125,10 @@ jest.mock("@/app/deposits/DepositSourceSelection", () => ({
     return (
       <section
         aria-label="Deposit source selection"
+        data-testid="deposit-source-selection"
         data-route-path={routePath}
+        data-locked={disabled ? "true" : "false"}
+        aria-disabled={disabled || undefined}
       >
         Deposit source selection
         {/* Exposes the repositoryAnchors DERIVATION (DepositPageClient's
@@ -375,6 +380,24 @@ describe("DepositPageClient", () => {
       screen.getByTestId("deposit-obfuscations-run-loaded-note"),
     ).toBeInTheDocument();
 
+    // Run configuration is locked and lives above telemetry in run detail.
+    const configuration = screen.getByTestId("deposit-run-configuration");
+    expect(configuration).toHaveAttribute("data-locked", "true");
+    expect(screen.getByTestId("deposit-source-selection")).toHaveAttribute(
+      "data-locked",
+      "true",
+    );
+    expect(screen.getByLabelText("What to obfuscate or withhold")).toBeDisabled();
+    expect(
+      screen.getByRole("button", { name: "Clear obfuscations" }),
+    ).toBeDisabled();
+    // Configuration DOM precedes telemetry DOM (layout: config above telemetry).
+    expect(
+      configuration.compareDocumentPosition(
+        screen.getByTestId("deposit-synthesis-telemetry"),
+      ) & Node.DOCUMENT_POSITION_FOLLOWING,
+    ).toBeTruthy();
+
     // Back clears the selection; the button returns for a fresh dispatch.
     fireEvent.click(
       await screen.findByRole("button", { name: "Back to Deposit pipelines" }),
@@ -385,6 +408,17 @@ describe("DepositPageClient", () => {
     expect(
       screen.queryByTestId("deposit-obfuscations-run-loaded-note"),
     ).not.toBeInTheDocument();
+    expect(screen.getByTestId("deposit-run-configuration")).toHaveAttribute(
+      "data-locked",
+      "false",
+    );
+    expect(screen.getByTestId("deposit-source-selection")).toHaveAttribute(
+      "data-locked",
+      "false",
+    );
+    expect(
+      screen.getByLabelText("What to obfuscate or withhold"),
+    ).not.toBeDisabled();
   });
 
   it("resumes a completed synthesis run's results when its row is selected (master-detail)", async () => {
@@ -1100,6 +1134,8 @@ describe("DepositPageClient", () => {
 
   describe("V48 Gate 3 — repository and Obfuscations anchoring", () => {
     function withAnchorFixtures() {
+      // Config editing requires no adopted run (run detail locks configuration).
+      mockQuery = "depositStage=review-options";
       mockFetchPipelineExecutionHistory.mockResolvedValue([
         {
           id: "deposit-1",

uapi/tests/depositPageClient.test.tsx

@@ -250,6 +250,21 @@ describe("DepositSourceSelection — V48-Gate3-F17 repository anchoring", () =>
     expect(lastHref).not.toContain("sourceBranch=");
     expect(lastHref).not.toContain("sourceCommit=");
   });
+
+  it("locks provider/repository controls when disabled (run-detail freeze)", async () => {
+    mockVcsFetch();
+    render(
+      <DepositSourceSelection
+        routePath="/"
+        buildRouteHref={(params) => `/deposits?${params?.toString() ?? ""}`}
+        disabled
+      />,
+    );
+
+    const root = await screen.findByTestId("deposit-source-selection");
+    expect(root).toHaveAttribute("data-locked", "true");
+    expect(screen.getByLabelText("Repository provider")).toBeDisabled();
+  });
 });
 
 describe("DepositSourceSelection — stale connection surfaces a reconnect notice (repro: branch/commit silently stuck empty)", () => {