v0.7.0: char-width + status bar fix — TDD (RED→GREEN)

char-width: contract 5, 4 tests (6 assertions), 100% pass
  ASCII=1, CJK/Hangul/Kana/halfwidth=2, combining marks=0, tab=8
  Pure Lisp, ~25 lines, no deps. Used by word-wrap for unicode.

status bar: contract 6, timestamp right-aligned at (- w 12)
  Fixes overlap where focus map and timestamp both drew at :y 2 :x 1

docs/ROADMAP.org

@@ -1371,6 +1371,34 @@ The ~/context~ command (above) shows what the model sees. Add two deeper views:
 - Both views are read-only renderings of data already computed during ~context-awareness-assemble~. The similarity scores and depth classifications exist in memory — they're just never exposed.
 ~60 lines of rendering on existing data.
 
+*** TODO Tool execution hardening — timeouts + write verification
+:PROPERTIES:
+:ID:       id-v062-tool-hardening
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Existing tools are thin wrappers with no error recovery. Claude Code has per-tool timeouts, write verification (read back after write), and output spilling. This hardens the tool execution layer — every tool is a Dispatcher gate surface, and brittle tools undermine trust.
+
+- ~*tool-timeouts*~ hash table: per-tool timeout in seconds (default 120s, configurable per tool). ~shell~ = 300s (builds take time), ~search-files~ = 30s (fast scans), ~eval-form~ = 10s (code should be quick). Enforced via ~with-timeout~ macro wrapping tool body execution.
+- Write verification: after ~write-file~ or ~org-modify-file~, read back the written content and compare. On mismatch, log a warning and re-attempt once. Catches filesystem failures and partial writes. ~20 lines in ~programming-tools.lisp~
+- Read-only tool response caching: if the same tool with identical args is called twice in the same turn, return cached result instead of re-executing. ~15 lines.
+~60 lines total.
+
+*** TODO Tag stack — categories + severity tiers
+:PROPERTIES:
+:ID:       id-v062-tag-stack
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+The privacy tag filter (~dispatcher-check-privacy-tags~) is binary: a tag matches or it doesn't. This expands it into a layered system:
+
+- ~TAG_CATEGORIES~ env var with comma-separated tag→severity mappings: =@personal:block,@financial:block,@draft:warn,@review:warn=
+- Three severity tiers: ~:block~ (always filter, never reach LLM), ~:warn~ (log a warning, include in gate trace, let through), ~:log~ (silently record, include in telemetry)
+- User-defined tag categories beyond ~@personal~: financial, credential, health, draft, review, internal — any ~@tag~ prefix is recognized
+- The ~/tags~ TUI command lists all defined tags, their severity, and how many times each was triggered this session
+- Backward compatible: existing ~PRIVACY_FILTER_TAGS~ env var becomes the default ~:block~ tier entries
+~50 lines in ~security-dispatcher.lisp~ + ~20 lines TUI command.
+
 ** v0.8.0: Direction 2 — Information Radiator (Foundation)
 
 The sidebar is what makes the Information Radiator direction unique. No competitor can render gate traces, focus maps, or rule counters because none has deterministic gates, foveal-peripheral context, or rule synthesis. The sidebar makes this data permanently visible. It also includes context monitoring, modified files, and tool status — all zero-LLM-token data from the deterministic layer.