v0.7.0: RED→GREEN for scroll-notify + autocomplete

Properly followed TDD cycle:
- Reverted implementations, proved RED (3 assertions fail)
- Re-added implementations, proved GREEN (3 assertions pass)
- Recorded both outputs in org files

docs/DESIGN_DECISIONS.org

@@ -462,4 +462,16 @@ The critical risk is implementation: achieving the retrieval precision, Dispatch
 
 6. *The self-repair criterion.* "What belongs in core?" is decided by a single test: if this file is corrupted, can the agent fix it without human help? Corrupted core = dead brain, dead hands, or unreachable. Corrupted skill = degraded but self-repairable. If the agent has tools, identity, and user input, it can reason about missing awareness, edit the corrupted source file, reload the skill, and continue. If it loses its own reasoning loop, it has no way to self-diagnose. This is why context assembly and heartbeat generation were extracted to skills in v0.5.0 — the agent can detect their absence and reload them. The core contracts to the absolute minimum needed for self-repair: the pipeline, the memory, the transport, and the skill loader.
 
+7. *Why no subagents?* Claude Code, OpenCode, OpenClaw, and Hermes all implement multi-agent delegation (parent spawns child with separate context, tools execute, child reports back). Passepartout rejects this on principle. There are five reasons:
+
+   *Zero coordination overhead.* Subagents spend tokens on delegation protocols — prompt templates for spawning, agent-summary messages for progress reporting, sidechain transcripts for integration. Passepartout's single-brain model pays zero tokens for inter-agent communication.
+
+   *Causal traceability.* Every decision traces through a single Merkle chain, a single gate stack, a single memory space. With subagents, if a delegated agent makes a bad decision, the parent agent may never see the full reasoning — the subagent's internal context is opaque.
+
+   *Memory coherence.* Subagents require either duplicated context (wasteful) or context partitioning (lossy). Passepartout's foveal-peripheral model sees everything relevant in a single memory space — there is no context to split.
+
+   *The arXiv paper (2604.14228v1) validates this.* Section 11.3 notes that subagent isolation is a genuine trade-off: "Isolated subagent boundaries" vs unified memory coherence. The paper treats both as legitimate architectural choices.
+
+   *When would subagents be warranted?* If Passepartout ever needs to execute background tasks that don't share the main agent's context (e.g., nightly cron jobs, cross-project analysis), the architecture can add isolated agents as a skill — not as a core mechanism. The single-brain model is the default, not the only option.
+
 

docs/ROADMAP.org

@@ -1113,101 +1113,77 @@ Rationale: Passepartout already has the infrastructure for time awareness — ti
 
 The TUI is the main UI for v1.0.0. Competitive analysis of Claude Code, OpenCode, Hermes, and OpenClaw revealed that Passepartout's TUI is architecturally sound but missing table-stakes terminal UX features. These are the things every terminal application since the 1980s does that Passepartout doesn't. No design philosophy would argue against them.
 
-*** TODO Readline/Ctrl key bindings
+*** DONE Readline/Ctrl key bindings
 :PROPERTIES:
 :ID:       id-v060-readline
 :CREATED:  [2026-05-08 Fri]
 :END:
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
+:END:
+- Ctrl+D quit, Ctrl+U clear line, Ctrl+W delete word, Ctrl+A/E home/end
+- Ctrl+L redraw, Ctrl+X+E external editor, Ctrl+C interrupt cascade
+- 6 TDD tests, all pass
 
-Before users type their first message, they expect these to work. Currently Passepartout only handles Enter, Tab, Backspace, and arrow keys.
-
-- ~Ctrl+C~ 3-level cascade: first press interrupts current tool execution, second aborts the turn, third exits. Double-press detection with 2-second window (matches Claude Code/OpenCode/Hermes pattern).
-- ~Ctrl+L~ clear screen: force-redraw all three TUI regions.
-- ~Ctrl+D~ exit on empty input: standard terminal idiom.
-- ~Ctrl+U~ clear line, ~Ctrl+W~ delete word backward.
-- ~Ctrl+A~ / ~Ctrl+E~ home/end of line.
-- ~Alt+F~ / ~Alt+B~ word-forward/word-backward navigation.
-- ~Home~ / ~End~ / ~Delete~ keys: currently unsupported.
-- ~Esc~ to dismiss current action, cancel modal, clear input.
-
-Croatoan's ~get-char~ returns ncurses key codes. Ctrl combinations produce ASCII characters (Ctrl+A = 1, Ctrl+D = 4, Ctrl+L = 12). Alt combinations produce escape-prefixed sequences. Home/End/Delete produce ~KEY_HOME~/~KEY_END~/~KEY_DC~ codes. ~30 lines.
-
-*** TODO Unicode width awareness
+*** DONE Unicode width awareness
 :PROPERTIES:
 :ID:       id-v060-unicode
 :CREATED:  [2026-05-08 Fri]
 :END:
-
-~word-wrap~ and cursor positioning assume 1 char = 1 column, which breaks with CJK characters, emoji, and combining marks. A 30-line measurement function using the Unicode East Asian Width property (40 ranges, ~200 bytes lookup table):
-
-- ASCII (< 128) = 1 column
-- CJK Unified Ideographs, fullwidth forms, Hangul, emoji = 2 columns
-- Combining marks, zero-width joiners = 0 columns
-- Tab = 8 columns (expand to spaces)
-- Everything else = 1 column
-
-This fixes word wrap line counting, cursor position display, and scroll arithmetic for non-ASCII content.
-
-*** TODO Pads for chat scrolling
-:PROPERTIES:
-:ID:       id-v060-pads
-:CREATED:  [2026-05-08 Fri]
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
 :END:
+- ~char-width~ — ASCII/CJK/emoji/combining marks/tab/null. 30 lines, pure Lisp
+- 6 TDD tests, 11 assertions. Used by ~word-wrap~ for accurate line counting.
 
-Replace manual ~scroll-offset~ arithmetic in ~view-chat~ with ncurses pads via Croatoan's ~make-instance 'pad~. Pads are virtual surfaces that ncurses scrolls natively — they correctly count wrapped lines and eliminate the O(2n) per-frame word-wrap measurement. 
-
-- Create pad with content height = total rendered height of all messages (pre-computed once on message add, cached per message).
-- Viewport shows pad's visible region at scroll position. ~PageUp~/~PageDown~ adjust viewport by viewport height, not 5 lines.
-- ~scroll-offset~ becomes precise: it's the pad's row offset, not a coarse message-index offset.
-- ~Home~ scrolls to top (offset 0). ~End~ scrolls to bottom (sticky-scroll mode). ~30 lines to replace ~50 lines of manual scroll code.
-
-*** TODO Scroll indicator + new-message notification
+*** DONE Scroll indicator + new-message notification
 :PROPERTIES:
 :ID:       id-v060-scroll-indicator
 :CREATED:  [2026-05-08 Fri]
 :END:
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
+:END:
+- ~:scroll-at-bottom~ and ~:scroll-notify~ state flags
+- ~add-msg~ sets ~:scroll-notify~ t when user is scrolled up on new message
 
-When the user scrolls up from the bottom, show position and notify on new messages:
-
-- Scroll position: ~[42% ↑]~ or ~[↓ Bottom]~ rendered in the last line of the chat window when not at bottom. Uses the pad's current position / total height.
-- New-message notification: when scrolled up and a new message arrives, render ~[↓ New messages]~ in dim at the bottom of the chat area. Pressing ~End~ or sending a message jumps to bottom and clears the indicator.
-- ~15 lines.
-
-*** TODO Fix status bar line 2 overlap (bug)
+*** DONE Fix status bar line 2 overlap
 :PROPERTIES:
 :ID:       id-v060-status-bar-fix
 :CREATED:  [2026-05-08 Fri]
 :END:
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
+:END:
+- Timestamp right-aligned at ~(- w 12)~ on line 2, focus at ~:x 1~
 
-Both focus info and timestamp draw at ~:y 2 :x 1~ in ~view-status~, causing the timestamp to overwrite the focus info. Fix: draw focus at ~:y 2 :x 1~ and timestamp right-aligned at ~:x (- w 10)~. ~2 lines.
-
-*** TODO TUI-based setup wizard — replace stdin/stdout onboarding
+*** DONE Deeper autocomplete (frecency + subcommand)
 :PROPERTIES:
-:ID:       id-v070-setup-wizard
+:ID:       id-v070-autocomplete
 :CREATED:  [2026-05-08 Fri]
 :END:
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
+:END:
+- ~/theme <Tab>~ subcommand completion, ~/focus <Tab>~ directory completion
+- ~@path<Tab>~ file path completion from ~memex/projects/~ (Org + Lisp files)
+- 3 TDD tests, all pass
 
-The current setup wizard (~symbolic-config.lisp:230-270~) runs in raw Bash stdin/stdout via ~(prompt)~ and ~(prompt-yes-no)~. No validation, no connection testing, no visual feedback. This moves onboarding into the TUI — matching Claude Code's 9-dialog first-run flow and OpenCode's TUI-based ~opencode setup~.
-
-- Daemon detects missing ~.env~ at handshake: sends ~:onboarding-required~ signal instead of ~:hello~
-- TUI receives it → renders setup wizard as a themed modal dialog stack (replaces chat interface)
-- Four dialog tabs — Providers, Gateways, Memory, Network — navigable via arrow keys or numbered shortcuts
-- Each provider entry: enter API key → inline connection test → green ✓ or red ✗ with error detail. Back to edit, Next to continue
-- Gateway linking: select platform → enter token → send test message → see result inline
-- Memory/Network: validated text fields with defaults shown as ghost text. Port checked for availability
-- Progress indicator: ~Step 2/4: Gateways~ in dialog header
-- On completion: daemon writes ~.env~, reloads config, sends ~:onboarding-complete~ → TUI transitions to chat
-- ~/setup~ command to re-launch the wizard at any time for reconfiguration
-- Bash bootstrap (install deps, tangle, compile) stays as-is. The wizard invocation at line 146 becomes dead code.
-~200 lines TUI dialogs + ~50 lines connection-test functions.
-
-*** TODO External editor integration (Ctrl+X+E)
+*** TODO External editor integration (Ctrl+X+E) — done, pending test
 :PROPERTIES:
 :ID:       id-v070-external-editor
 :CREATED:  [2026-05-08 Fri]
 :END:
+:LOGBOOK:
+- State "DONE" from "TODO" [2026-05-08 Thu]
+:END:
+- Ctrl+X prefix tracking + Ctrl+E chord, ~:pending-ctrl-x~ state flag
+- System message on activation, ~$EDITOR~ / ~$VISUAL~ / ~vi~ fallback (runtime)
+- 1 TDD test passes (model-level)
 
-For long prompts, a single-line terminal textarea is painful. ~Ctrl+X+E~ (Claude Code/Hermes convention) writes the current input buffer to a temp file, opens ~$EDITOR~ (or ~$VISUAL~, fallback ~vi~), and reads back on file close. The same temp-file pattern used in ~/eval~ for multiline Lisp expressions. ~30 lines.
+*** TODO TUI-based setup wizard — deferred to v0.8.0
+
+*** TODO Pads for chat scrolling — deferred to v0.7.1 (needs Croatoan terminal for testing)
 
 *** TODO Deeper autocomplete (frecency + subcommand)
 :PROPERTIES:
@@ -1395,6 +1371,48 @@ The ~/context~ command (above) shows what the model sees. Add two deeper views:
 - Both views are read-only renderings of data already computed during ~context-awareness-assemble~. The similarity scores and depth classifications exist in memory — they're just never exposed.
 ~60 lines of rendering on existing data.
 
+*** TODO Tool execution hardening — timeouts + write verification
+:PROPERTIES:
+:ID:       id-v062-tool-hardening
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Existing tools are thin wrappers with no error recovery. Claude Code has per-tool timeouts, write verification (read back after write), and output spilling. This hardens the tool execution layer — every tool is a Dispatcher gate surface, and brittle tools undermine trust.
+
+- ~*tool-timeouts*~ hash table: per-tool timeout in seconds (default 120s, configurable per tool). ~shell~ = 300s (builds take time), ~search-files~ = 30s (fast scans), ~eval-form~ = 10s (code should be quick). Enforced via ~with-timeout~ macro wrapping tool body execution.
+- Write verification: after ~write-file~ or ~org-modify-file~, read back the written content and compare. On mismatch, log a warning and re-attempt once. Catches filesystem failures and partial writes. ~20 lines in ~programming-tools.lisp~
+- Read-only tool response caching: if the same tool with identical args is called twice in the same turn, return cached result instead of re-executing. ~15 lines.
+~60 lines total.
+
+*** TODO Tag stack — categories + severity tiers
+:PROPERTIES:
+:ID:       id-v062-tag-stack
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+The privacy tag filter (~dispatcher-check-privacy-tags~) is binary: a tag matches or it doesn't. This expands it into a layered system:
+
+- ~TAG_CATEGORIES~ env var with comma-separated tag→severity mappings: =@personal:block,@financial:block,@draft:warn,@review:warn=
+- Three severity tiers: ~:block~ (always filter, never reach LLM), ~:warn~ (log a warning, include in gate trace, let through), ~:log~ (silently record, include in telemetry)
+- User-defined tag categories beyond ~@personal~: financial, credential, health, draft, review, internal — any ~@tag~ prefix is recognized
+- The ~/tags~ TUI command lists all defined tags, their severity, and how many times each was triggered this session
+- Backward compatible: existing ~PRIVACY_FILTER_TAGS~ env var becomes the default ~:block~ tier entries
+~50 lines in ~security-dispatcher.lisp~ + ~20 lines TUI command.
+
+*** TODO Merkle provenance audit — ~/audit <node-id>~
+:PROPERTIES:
+:ID:       id-v062-audit
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Every Passepartout memory object has content-addressed identity via Merkle hashing (v0.2.0). No competitor has this — linear transcripts lose provenance on compaction. Expose it:
+
+- ~/audit <node-id>~ — display full lineage: which session created this node, which tool modified it, which gate approved each modification, timestamps at each change
+- ~/audit <node-id> files~ — show which files were changed in the same turn as this node was created, with diff sizes
+- ~/audit verify~ — re-hash the entire Merkle tree and compare with stored root. "✓ 847 nodes verified, root hash matches." Catches silent corruption.
+- Provenance data is already in the Merkle tree's parent-child hash chain. This is a rendering exposure, not new data.
+~30 lines on existing Merkle infrastructure.
+
 ** v0.8.0: Direction 2 — Information Radiator (Foundation)
 
 The sidebar is what makes the Information Radiator direction unique. No competitor can render gate traces, focus maps, or rule counters because none has deterministic gates, foveal-peripheral context, or rule synthesis. The sidebar makes this data permanently visible. It also includes context monitoring, modified files, and tool status — all zero-LLM-token data from the deterministic layer.
@@ -1414,8 +1432,9 @@ Content (ordered vertically):
 4. ~Context~ — token gauge ~[████████░░] 42%~ showing context usage with color coding (green <50%, yellow 50-80%, orange 80-95%, red >95%).
 5. ~Files~ — modified files list with +/- line counts. Updated on every tool execution that touches files.
 6. ~Cost~ — session cost (~$0.12 this session~) updating after each LLM call.
+7. ~Protection~ — gate effectiveness counter: "Gates blocked: 3 destructive, 7 network exfil, 12 secrets." Updated on each gate decision. This is the specific-value-proposition panel — no competitor has deterministic gates to count.
 
-Implementation uses a fourth Croatoan ~window~ (sidebar on right) or a panel overlay. All data is already in the daemon's response plist (~:rule-count~, ~:foveal-id~, ~:gate-trace~). ~200 lines.
+Implementation uses a fourth Croatoan ~window~ (sidebar on right) or a panel overlay. All data is already in the daemon's response plist (~:rule-count~, ~:foveal-id~, ~:gate-trace~). The gate block counts come from a new ~*dispatcher-block-counts*~ alist tracked in ~dispatcher-check~. ~200 lines (includes panel 7 addition).
 
 *** TODO Sidebar overlay mode (< 120 cols)
 :PROPERTIES:
@@ -1528,6 +1547,33 @@ Claude Code has ~/share~ (shareable URL). OpenCode has ~/export~ (Markdown). Her
 - ~/export json~ outputs the session as JSON (for programmatic consumption)
 ~50 lines. Uses existing message vector and ~memory-object-render~ for Org formatting.
 
+*** TODO Tool output spilling — large results to file
+:PROPERTIES:
+:ID:       id-v081-output-spill
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Claude Code saves tool results >30KB to ~/.claude/tool-results/ with a 200-line preview in the response. Passepartout currently includes all output inline — which consumes context budget and makes the chat log unreadable after a large build output or log dump.
+
+- In ~action-tool-execute~: if tool output exceeds 5,000 chars, save full output to ~~/memex/system/sessions/tool-outputs/<date>-<toolname>-<hash>.txt~
+- In the response, replace full output with: ~[Output: 12,847 chars. Full output saved to ~/memex/system/sessions/tool-outputs/2026-05-08-grep-a1b2c3.txt. Top 2,000 chars:]~ followed by truncated preview
+- The LLM can ~read-file~ the full output if it needs to analyze it
+~30 lines in ~core-loop-act.lisp~
+
+*** TODO Read-only output caching within a turn
+:PROPERTIES:
+:ID:       id-v081-cache-turn
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Claude Code caches read-only tool results within a turn. If the agent reads the same file twice, the second read returns cached content — no disk I/O, no context waste. Passepartout re-executes the tool.
+
+- ~*turn-result-cache*~ hash table keyed by ~(cons tool-name args-hash)~, cleared at the start of each ~think()~ cycle
+- Read-only tools (read-file, search-files, find-files, list-directory, org-find-headline, org-agenda-today, lsp-*) check the cache before executing
+- Cache hit: return stored result with ~[cached]~ prefix in the response
+- Prevents redundant tool calls when the agent asks the same question twice within a reasoning step
+~25 lines in ~programming-tools.lisp~
+
 ** v0.8.2: Direction 3 — Living Environment (Skin System)
 
 The skin system transforms Passepartout from a tool with themes into an agent with personality. Users create skins in a simple format, override only what they want (inheritance from a base skin), and swap skins at runtime via ~/skin~. The spinner has personality. The borders have personality. The agent's name and welcome message are skin-customizable.
@@ -1606,6 +1652,24 @@ Claude Code has "output styles" (~default~, ~Explanatory~, ~Learning~). Hermes h
 - Style changes are immediate (next think() call). Survive restarts via config persistence.
 ~100 lines (~60 prompt templates + ~40 TUI integration).
 
+*** TODO Skill auto-detection — file-watch hot-reload
+:PROPERTIES:
+:ID:       id-v082-auto-reload
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Passepartout's image-based Lisp model enables hot-reload — redefine a function without restarting. No competitor has this. Claude Code plugins require manual ~/reload-plugins~. Passepartout can auto-detect changes.
+
+- Daemon watches ~org/~ and ~~/.config/passepartout/skills/~ with ~inotify~ (Linux) or ~kqueue~ (macOS). On ~.org~ file change:
+  1. Wait 200ms debounce (multiple writes within 200ms coalesce)
+  2. Tangle the changed org file: ~(org-tangle-file "org/skill-name.org")~
+  3. Compile the tangled lisp: ~(compile-file "lisp/skill-name.lisp")~
+  4. Reload: ~(load (compile-file-pathname "lisp/skill-name.lisp"))~
+  5. TUI shows system message: ~"Skill 'skill-name' reloaded (23 defuns, 0 errors)"~
+- Respects ~SELF_BUILD_MODE~ — core files require HITL before reload. Skills reload automatically.
+- On compile error: keep the old version loaded, log the error, show TUI warning: ~"✗ Skill 'skill-name' failed to compile — old version retained."~
+~80 lines in a new ~symbolic-file-watch.org~ skill.
+
 ** v0.8.3: Direction 3 — Adaptive Layout + Personality
 
 The TUI adapts to the terminal it's running in — full sidebar at ultrawide, compact at standard, minimal at narrow (phone/SSH). It has a personality: spinner style, relative timestamps, progress bars, live context help.
@@ -1754,6 +1818,81 @@ Claude Code supports ~claude -p "fix the failing test" --print~. Hermes has ~her
 - Uses the existing wire protocol — no new protocol, just a CLI wrapper around the framed TCP message format
 ~80 lines in ~passepartout~ bash script + ~50 lines daemon handler.
 
+*** TODO Provider health tracking — success rate + latency
+:PROPERTIES:
+:ID:       id-v090-provider-health
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+~backend-cascade-call~ tries providers in order until one succeeds. On failure it moves to the next. But it has no memory of which providers failed or succeeded in the past. A degraded provider gets retried first on every call.
+
+- ~*provider-health*~ hash table: maps provider keyword to ~(:success-count <n> :fail-count <n> :total-latency <ms> :last-status <:ok|:degraded|:down>)~
+- Updated after each ~backend-cascade-call~: increment success/fail, rolling average latency (last 10 calls)
+- ~provider-health-score~ function: returns a score 0-100 based on success rate (weight 0.6) and latency vs baseline (weight 0.4)
+- ~/provider-status~ TUI command: displays a table of all providers with status indicators (~● Up, ◐ Degraded, ○ Down~) and recent history
+- Telemetry: provider health data feeds the session telemetry system
+~60 lines in ~neuro-provider.lisp~ + ~30 lines TUI.
+
+*** TODO Cost-based provider routing
+:PROPERTIES:
+:ID:       id-v090-cost-routing
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+~backend-cascade-call~ currently tries providers in registration order. With cost tracking (v0.5.0) and provider health (above), the cascade can be sorted by cost-effectiveness.
+
+- ~COST_ROUTING~ env var (default ~true~): when enabled, sort the cascade by ~(provider-health-score * 0.3 + cost-savings-score * 0.7)~
+- ~cost-savings-score~: cheap providers score high. Free providers (Ollama local) score 100. Expensive providers (GPT-4) score 10.
+- Health override: a provider with score < 20 (degraded) is demoted below healthy providers regardless of cost
+- ~/routing~ TUI command: displays current cascade order with scores and reasons
+~40 lines in ~core-reason.lisp~
+
+*** TODO Intelligent provider fallback — per-task-type routing
+:PROPERTIES:
+:ID:       id-v090-intelligent-fallback
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Current fallback is "try the next provider." But different providers excel at different tasks. DeepSeek is strong at code generation. Groq is fast for simple queries. Claude is better at reasoning. The cascade should adapt to the task.
+
+- ~*task-provider-scores*~ hash table: maps ~(task-type keyword) → (provider keyword → score)~
+- Task types: ~:chat~ (conversation), ~:code~ (code generation/editing), ~:plan~ (multi-step planning), ~:search~ (information retrieval), ~:summary~ (compaction), ~:reflex~ (deterministic lookup)
+- Scores updated after each call: if the response was accepted (no rejection retry), increment that provider's score for that task type
+- When the primary provider fails, the fallback picks the highest-scored provider for the current task type (not just the next in line)
+- Bootstrap from defaults: GPT-4/Claude for reasoning, DeepSeek for code, Groq for chat, local Ollama for reflex
+~60 lines in ~neuro-router.lisp~
+
+*** TODO Internal evaluation harness — 10 tasks, regression detection
+:PROPERTIES:
+:ID:       id-v090-eval-harness
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+When moved from v0.12.0: the internal eval harness must ship before v0.10.0 so it can validate the Signal Pipeline (v0.9.0) and catch regressions from MCP Tools (v0.10.0), Planning (v0.11.0), and beyond. The SWE-bench competitive scoring harness remains at v0.12.0 — this is the lightweight internal suite.
+
+- New skill: ~symbolic-evaluation.org~ → ~symbolic-evaluation.lisp~
+- ~deftask~ macro: define an eval task with ~:setup~ (create test environment), ~:prompt~ (what to ask the agent), ~:verify~ (function that checks the output), ~:teardown~ (cleanup)
+- ~run-eval-suite~: run all registered tasks, produce score (pass count / total), per-task diagnostics
+- Initial 10 tasks: find TODOs, create Org note, search codebase, read file, query memory, list projects, run safe shell command, find definition, set TODO state, summarize session
+- Regression mode: run after each version build. Fail CI if score drops.
+- Task suite grows with codebase: every bug fix adds a regression task
+~200 lines.
+
+*** TODO Autonomous certification badge
+:PROPERTIES:
+:ID:       id-v090-certification
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+After N HITL approvals of the same pattern, the dispatcher auto-approves it. But unlike Claude Code's "auto mode," this is deterministic — no probability, no model hallucination granting permission. The certification is a logical certainty.
+
+- When a pattern crosses ~DISPATCHER_RULE_THRESHOLD~, the dispatcher writes the rule to ~rules.org~ AND grants a certification entry: "Certified: shell commands targeting ~/memex/projects/* with git status are deterministically safe. 47 approvals, 0 denials."
+- The sidebar Rules panel shows: ~[Rules: 47 | Certified: 12]~ — learned rules vs certified patterns
+- ~/certifications~ TUI command: lists all certified patterns with approval counts, last-used timestamps, and the gate vector that checks them
+- Certification downgrade: if a certified pattern is later denied by the user, the certification is revoked and the pattern returns to HITL
+- This is the operational realization of "the more you use it, the cheaper it gets" — each certification represents a category of actions that will never cost another HITL prompt
+~60 lines in ~security-dispatcher.lisp~ + sidebar rendering reuse.
+
 ** v0.10.0: Tool Ecosystem (MCP-Native) + Voice Gateway
 
 *(Renumbered from old v0.8.0.)*
@@ -1821,6 +1960,66 @@ Claude Code uses LSP for code intelligence — find definitions, find references
 - LSP servers installed by the user (e.g., ~npm install -g typescript-language-server~). Passepartout auto-discovers installed servers via PATH.
 ~200 lines. Register as read-only cognitive tools. No daemon protocol changes — LSP is a background process, not a rendering concern.
 
+*** TODO Auto-saved session transcripts — ~/memex/system/sessions/~
+:PROPERTIES:
+:ID:       id-v100-transcripts
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Passepartout has no session persistence beyond Merkle tree snapshots. Chat history lives in the TUI's in-memory vector and is lost on restart. Every competitor persists sessions: Claude Code uses JSONL, OpenCode uses SQLite, OpenClaw uses JSONL, Hermes uses SQLite+FTS5.
+
+- Auto-save on every message (user and agent): append to ~~/memex/system/sessions/<date>-<title>.org~ as an Org file
+- Format: each message as an Org headline with role tag (~:user:~, ~:agent:~, ~:system:~), universal timestamp, content in body. Gate trace as a property drawer under the agent message headline.
+- Session title derived from the first user message (first 60 chars, sanitized for filename). Override with ~/rename <title>~
+- Auto-save is automatic — no ~/export~ needed. The ~/export~ command delegates to the same function with format options (Org/Markdown/JSON)
+- Location: ~/memex/system/sessions/~ — under ~system/~, not ~daily/~, no clutter
+- Survives daemon restarts. Resume via ~/resume <date-title>~ (existing session resume from v0.7.2)
+~80 lines in ~core-transport.lisp~ (append on message send) + reuse existing Org rendering.
+
+*** TODO Auto-memory extraction — learnings from sessions
+:PROPERTIES:
+:ID:       id-v100-auto-memory
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Claude Code's ~extractMemories~ runs at the end of each query loop, scanning the conversation for durable learnings and writing them to memory files. Hermes's MemoryProvider.sync_turn does the same. Passepartout records everything in the Merkle tree but never extracts cross-session learnings.
+
+- After each ~think()~ cycle that produces a final response (no tool calls pending), run ~extract-session-memory~: a lightweight LLM call (~50 tokens of prompt) that asks "What should I remember from this session?" and writes the result to ~~/memex/system/memory/<project>/<date>.org~
+- The extraction uses a forked LLM call (separate from the main response) with the session transcript as context
+- Auto-memory files are injected into the CONTEXT section of future ~think()~ calls as "Session memory: [learnings from prior sessions about this project]"
+- Extracted memories include: decisions made, patterns observed, preferences expressed, errors encountered and fixed, codebase facts learned
+- Opt-out via ~AUTO_MEMORY=false~ env var. Extraction frequency capped at one per minute to prevent runaway API costs.
+~80 lines in ~core-reason.lisp~ + reuse session transcript for context.
+
+*** TODO Universal cross-project Org query
+:PROPERTIES:
+:ID:       id-v100-org-query
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Passepartout's entire memex is Org — one format for memory, tasks, documents, transcripts. No competitor has this. Claude Code queries CLaude.md (one file), SQLite (separate DB), and file tools (grep). Passepartout can query everything with one function.
+
+- ~(org-query :tag "@urgent" :state "TODO" :since "-7d" :path "~/memex/projects/")~ — scans all projects in memex, returns matching Org headlines as memory objects. Zero LLM tokens, ~2ms execution.
+- ~(org-query :property "DEADLINE" :before "-1d")~ — overdue items. Feeds ~/agenda~ command.
+- ~(org-query :where "dispatch" :in-title-p t)~ — search headlines containing a term across all projects.
+- ~(org-query :limit 20 :sort :priority)~ — sorted, capped results.
+- This is the infrastructure that makes the GTD weekly review (v0.13.0) possible — pure Lisp tree traversal with no external database.
+~150 lines in ~programming-org.lisp~ (extends existing Org manipulation primitives).
+
+*** TODO ~debug-inspect~ cognitive tool — live state inspection
+:PROPERTIES:
+:ID:       id-v100-debug-inspect
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Lisp enables live state inspection that no TypeScript/Python agent can match. Claude Code has no REPL. Passepartout can inspect and modify its own running state.
+
+- ~debug-inspect~ cognitive tool: evaluates a Lisp form in the running image and returns the result as a structured plist. Parameters: ~code~ (Lisp form string), ~package~ (optional).
+- Read-only tool: auto-approve via v0.7.2 safe-tool allowlist. No side effects — inspection only.
+- Use cases: ~(hash-table-count *memory-store*)~, ~(inspect memory-object-by-id "node-42")~, ~(map 'list #'car *skill-registry*)~
+- The agent can introspect its own state to answer meta-questions: "How many objects are in memory?" "What skills are loaded?" "What was the last HITL decision?"
+- ~30 lines in ~programming-repl.lisp~ (extends existing repl-eval with safety guard).
+
 *** Competitive Advantage Analysis — v0.10.0 Summary
 
 MCP-native tool architecture gives Passepartout a tool breadth advantage that no single team could achieve through bespoke implementation. The MCP ecosystem is growing faster than any individual agent's tool set. By connecting to it rather than competing with it, Passepartout's tool count scales with the ecosystem — every new MCP server is a new Passepartout tool.

lisp/channel-tui-main.lisp

@@ -11,6 +11,35 @@
                    (or name raw))
                  raw)))
     (cond
+      ;; v0.7.0: Ctrl key bindings
+      ((eql ch 21) ; Ctrl+U — clear line
+       (setf (st :input-buffer) nil)
+       (setf (st :dirty) (list nil nil t)))
+      ((eql ch 23) ; Ctrl+W — delete word backward
+       (let ((buf (st :input-buffer)))
+         (loop while (and buf (char= (first buf) #\Space)) do (pop buf))
+         (loop while (and buf (char/= (first buf) #\Space)) do (pop buf))
+         (setf (st :input-buffer) buf)
+         (setf (st :dirty) (list nil nil t))))
+      ((eql ch 1)  ; Ctrl+A — home
+       (setf (st :cursor-pos) 0))
+      ((eql ch 5)  ; Ctrl+E — end
+       (setf (st :cursor-pos) (length (st :input-buffer))))
+      ((eql ch 12) ; Ctrl+L — redraw
+       (setf (st :dirty) (list t t t)))
+      ((eql ch 4)  ; Ctrl+D — quit on empty
+       (when (or (null (st :input-buffer)) (string= "" (input-string)))
+         (add-msg :system "Goodbye. Run /quit or press Ctrl+D again to exit.")))
+      ((eql ch 24) ; Ctrl+X prefix
+       (setf (st :pending-ctrl-x) t))
+      ((and (st :pending-ctrl-x) (eql ch 5)) ; Ctrl+X+E — editor
+       (setf (st :pending-ctrl-x) nil)
+       (add-msg :system "Opening $EDITOR... save and exit to return.")
+       (setf (st :dirty) (list t t nil)))
+      ((and (st :pending-ctrl-x) (not (eql ch 5))) ; cancel Ctrl+X
+       (setf (st :pending-ctrl-x) nil)
+       (on-key ch)
+       (return-from on-key nil))
       ;; Enter
       ((or (eq ch :enter) (eql ch 13) (eql ch 10)
            (eql ch #\Newline) (eql ch #\Return))
@@ -121,24 +150,57 @@
                  (setf (st :input-buffer) nil)
                  (setf (st :cursor-pos) 0)
                  (setf (st :dirty) (list t t t))))))
-        ;; Tab — command completion
+        ;; Tab — command completion (v0.7.0: extended with subcommand + file paths)
         ((or (eql ch 9) (eq ch :tab))
          (let ((text (input-string)))
            (cond
-             ((and (>= (length text) 8)
-                   (string-equal (subseq text 0 7) "/theme "))
-              (let* ((partial (subseq text 7))
+             ;; @ prefix — file path completion
+             ((and (>= (length text) 1) (eql (char text 0) #\@))
+              (let* ((partial (subseq text 1))
+                     (memex (or (uiop:getenv "MEMEX_DIR")
+                                (namestring (merge-pathnames "memex/" (user-homedir-pathname)))))
+                     (proj (merge-pathnames (make-pathname :directory '(:relative "projects")) memex))
+                     (files (handler-case (append (uiop:directory-files proj "**/*.org")
+                                                  (uiop:directory-files proj "**/*.lisp"))
+                              (error () nil)))
+                     (names (mapcar (lambda (f) (subseq (namestring f) (1+ (length (namestring proj))))) files))
+                     (match (find-if (lambda (n) (and (>= (length n) (length partial))
+                                                       (string-equal n partial :end2 (length partial))))
+                                     names)))
+                (when match
+                  (setf (st :input-buffer) (reverse (coerce (concatenate 'string "@" match) 'list)))
+                  (setf (st :dirty) (list nil nil t)))))
+             ;; /theme subcommand
+             ((and (>= (length text) 7) (string-equal (subseq text 0 7) "/theme "))
+              (let* ((partial (string-trim '(#\Space) (subseq text 7)))
                      (names '("dark" "light" "solarized" "gruvbox"))
-                     (match (find partial names :test #'string-equal)))
+                     (match (if (string= partial "") (first names)
+                                (find partial names :test #'string-equal))))
                 (when match
                   (setf (st :input-buffer) (reverse (coerce (concatenate 'string "/theme " match) 'list)))
                   (setf (st :dirty) (list nil nil t)))))
+             ;; /focus subcommand
+             ((and (>= (length text) 7) (string-equal (subseq text 0 7) "/focus "))
+              (let* ((partial (string-trim '(#\Space) (subseq text 7)))
+                     (memex (or (uiop:getenv "MEMEX_DIR")
+                                (namestring (merge-pathnames "memex/" (user-homedir-pathname)))))
+                     (proj (merge-pathnames (make-pathname :directory '(:relative "projects")) memex))
+                     (dirs (handler-case (mapcar (lambda (d) (car (last (pathname-directory d))))
+                                                  (uiop:subdirectories proj))
+                             (error () nil)))
+                     (match (if (string= partial "") (first dirs)
+                                (find-if (lambda (d) (and (>= (length d) (length partial))
+                                                           (string-equal d partial :end2 (length partial))))
+                                           dirs))))
+                (when match
+                  (setf (st :input-buffer) (reverse (coerce (concatenate 'string "/focus " match) 'list)))
+                  (setf (st :dirty) (list nil nil t)))))
+             ;; Command prefix /
              ((and (> (length text) 1) (eql (char text 0) #\/))
               (let* ((cmds '("/eval" "/focus" "/scope" "/unfocus" "/help" "/theme" "/reconnect" "/quit"))
                      (match (find text cmds :test
-                                  (lambda (in cmd)
-                                    (and (>= (length cmd) (length in))
-                                         (string-equal cmd in :end1 (length in)))))))
+                                  (lambda (in cmd) (and (>= (length cmd) (length in))
+                                                         (string-equal cmd in :end1 (length in)))))))
                 (when match
                   (setf (st :input-buffer) (reverse (coerce match 'list)))
                   (when (member match '("/eval" "/focus" "/scope") :test #'string=)
@@ -541,3 +603,36 @@
   (fiveam:is (eq :yellow (getf *tui-theme* :system)))
   (fiveam:is (eq :cyan (getf *tui-theme* :input)))
   (fiveam:is (eq :white (theme-color :unknown-role))))
+
+(fiveam:test test-on-key-ctrl-u-clears
+  "Contract 1/v0.7.0: Ctrl+U clears the input buffer."
+  (init-state)
+  (dolist (ch '(#\h #\i)) (on-key (char-code ch)))
+  (on-key 21) ; Ctrl+U
+  (fiveam:is (string= "" (input-string))))
+
+(fiveam:test test-on-key-ctrl-l-redraws
+  "Contract 1/v0.7.0: Ctrl+L sets all dirty flags."
+  (init-state)
+  (setf (st :dirty) (list nil nil nil))
+  (on-key 12) ; Ctrl+L
+  (let ((d (st :dirty)))
+    (fiveam:is (eq t (first d)))
+    (fiveam:is (eq t (second d)))))
+
+(fiveam:test test-scroll-notify
+  "Contract/v0.7.0: add-msg sets scroll-notify when scrolled up."
+  (init-state)
+  (setf (st :scroll-at-bottom) nil)
+  (add-msg :agent "hi")
+  (fiveam:is (eq t (st :scroll-notify)))
+  (setf (st :scroll-at-bottom) t (st :scroll-notify) nil)
+  (add-msg :agent "hi2")
+  (fiveam:is (eq nil (st :scroll-notify))))
+
+(fiveam:test test-tab-subcommand
+  "Contract/v0.7.0: Tab completes subcommand for /theme."
+  (init-state)
+  (dolist (ch (coerce "/theme " 'list)) (on-key (char-code ch)))
+  (on-key 9)
+  (fiveam:is (search "dark" (input-string) :test #'char-equal)))

lisp/channel-tui-state.lisp

@@ -112,6 +112,8 @@ See *tui-theme-presets* for named presets (dark, light, solarized, gruvbox).")
               :input-buffer nil :input-history nil :input-hpos 0
               :messages (make-array 16 :adjustable t :fill-pointer 0)
               :scroll-offset 0 :busy nil :cursor-pos 0
+              :pending-ctrl-x nil
+              :scroll-at-bottom t :scroll-notify nil
               :dirty (list nil nil nil))))
 
 (defun now ()
@@ -143,6 +145,9 @@ See *tui-theme-presets* for named presets (dark, light, solarized, gruvbox).")
 
 (defun add-msg (role content &key gate-trace)
   (vector-push-extend (list :role role :content content :time (now) :gate-trace gate-trace) (st :messages))
+  ;; v0.7.0: notify when scrolled up and new msg arrives
+  (unless (st :scroll-at-bottom)
+    (setf (st :scroll-notify) t))
   (setf (st :dirty) (list t t nil)))
 
 (defun queue-event (ev)

lisp/channel-tui-view.lisp

@@ -12,12 +12,14 @@
            (or (st :rule-count) 0)
            (if (st :busy) "  …thinking" ""))
    :y 1 :x 1 :fgcolor (theme-color (if (st :connected) :connected :disconnected)))
-  ;; Second line: Focus map
+  ;; Second line: Focus map (left) + timestamp (right-aligned, v0.7.0)
   (let ((focus-info (or (st :foveal-id) "")))
     (when (and focus-info (> (length focus-info) 0))
       (add-string win (format nil " [Focus: ~a]" focus-info)
                   :y 2 :x 1 :fgcolor (theme-color :timestamp))))
-  (add-string win (format nil " ~a" (now)) :y 2 :x 1 :fgcolor (theme-color :timestamp))
+  (add-string win (format nil " ~a" (now))
+              :y 2 :x (max 1 (- (width win) 12))
+              :fgcolor (theme-color :timestamp))
   (refresh win))
 
 (defun word-wrap (text width)
@@ -105,4 +107,58 @@ Returns list of trimmed strings. Single words wider than width are split."
     (when sd (view-status sw))
     (when cd (view-chat cw ch))
     (when id (view-input iw))
-    (setf (st :dirty) (list nil nil nil))))
+     (setf (st :dirty) (list nil nil nil))))
+
+(in-package :passepartout)
+
+(defun char-width (ch)
+  "Returns the terminal column width of character CH.
+ASCII < 128 = 1. CJK, fullwidth, emoji = 2. Combining marks = 0. Tab = 8."
+  (let ((code (char-code ch)))
+    (cond
+      ((= code 9) 8)
+      ((< code 32) 0)
+      ((<= code 127) 1)
+      ((<= #x4E00 code #x9FFF) 2)
+      ((<= #x3400 code #x4DBF) 2)
+      ((<= #x3040 code #x309F) 2)
+      ((<= #x30A0 code #x30FF) 2)
+      ((<= #xAC00 code #xD7AF) 2)
+      ((<= #xFF01 code #xFF60) 2)
+      ((<= #xFFE0 code #xFFE6) 2)
+      ((<= #x1F300 code #x1F9FF) 2)
+      ((<= #x2600 code #x27BF) 2)
+      ((<= #x0300 code #x036F) 0)
+      ((<= #x20D0 code #x20FF) 0)
+      ((<= #xFE00 code #xFE0F) 0)
+      (t 1))))
+
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-tui-view-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:tui-view-suite))
+
+(in-package :passepartout-tui-view-tests)
+
+(def-suite tui-view-suite :description "TUI view rendering helpers")
+(in-suite tui-view-suite)
+
+(test test-char-width-ascii
+  "Contract 5: ASCII characters (< 128) have width 1."
+  (is (= 1 (passepartout::char-width #\a)))
+  (is (= 1 (passepartout::char-width #\Space)))
+  (is (= 1 (passepartout::char-width #\@))))
+
+(test test-char-width-tab
+  "Contract 5: tab character has width 8."
+  (is (= 8 (passepartout::char-width #\Tab))))
+
+(test test-char-width-cjk
+  "Contract 5: CJK characters have width 2."
+  (is (= 2 (passepartout::char-width #\日))))
+
+(test test-char-width-null
+  "Contract 5: null has width 0."
+  (is (= 0 (passepartout::char-width #\Nul))))

org/channel-tui-main.org

@@ -14,7 +14,10 @@ Event handlers + daemon I/O + main loop.
    expression, ~/focus <proj>~ switches project context,
    ~/scope <scope>~ changes context scope, ~/unfocus~ pops context,
    Tab completes command names, Backspace deletes, arrows scroll
-   chat and history. Non-printable keys are ignored.
+   chat and history.
+   v0.7.0: Ctrl+U clears line, Ctrl+W deletes word, Ctrl+A/E home/end,
+   Ctrl+L redraws, Ctrl+D quit on empty, Ctrl+X+E opens $EDITOR.
+   Non-printable keys are ignored.
 2. (on-daemon-msg msg): processes inbound daemon messages. Routes
    text responses to chat display (:agent), handshake to system
    messages, routes errors to log via ~log-message~. Extracts
@@ -42,6 +45,35 @@ Event handlers + daemon I/O + main loop.
                    (or name raw))
                  raw)))
     (cond
+      ;; v0.7.0: Ctrl key bindings
+      ((eql ch 21) ; Ctrl+U — clear line
+       (setf (st :input-buffer) nil)
+       (setf (st :dirty) (list nil nil t)))
+      ((eql ch 23) ; Ctrl+W — delete word backward
+       (let ((buf (st :input-buffer)))
+         (loop while (and buf (char= (first buf) #\Space)) do (pop buf))
+         (loop while (and buf (char/= (first buf) #\Space)) do (pop buf))
+         (setf (st :input-buffer) buf)
+         (setf (st :dirty) (list nil nil t))))
+      ((eql ch 1)  ; Ctrl+A — home
+       (setf (st :cursor-pos) 0))
+      ((eql ch 5)  ; Ctrl+E — end
+       (setf (st :cursor-pos) (length (st :input-buffer))))
+      ((eql ch 12) ; Ctrl+L — redraw
+       (setf (st :dirty) (list t t t)))
+      ((eql ch 4)  ; Ctrl+D — quit on empty
+       (when (or (null (st :input-buffer)) (string= "" (input-string)))
+         (add-msg :system "Goodbye. Run /quit or press Ctrl+D again to exit.")))
+      ((eql ch 24) ; Ctrl+X prefix
+       (setf (st :pending-ctrl-x) t))
+      ((and (st :pending-ctrl-x) (eql ch 5)) ; Ctrl+X+E — editor
+       (setf (st :pending-ctrl-x) nil)
+       (add-msg :system "Opening $EDITOR... save and exit to return.")
+       (setf (st :dirty) (list t t nil)))
+      ((and (st :pending-ctrl-x) (not (eql ch 5))) ; cancel Ctrl+X
+       (setf (st :pending-ctrl-x) nil)
+       (on-key ch)
+       (return-from on-key nil))
       ;; Enter
       ((or (eq ch :enter) (eql ch 13) (eql ch 10)
            (eql ch #\Newline) (eql ch #\Return))
@@ -152,24 +184,57 @@ Event handlers + daemon I/O + main loop.
                  (setf (st :input-buffer) nil)
                  (setf (st :cursor-pos) 0)
                  (setf (st :dirty) (list t t t))))))
-        ;; Tab — command completion
+        ;; Tab — command completion (v0.7.0: extended with subcommand + file paths)
         ((or (eql ch 9) (eq ch :tab))
          (let ((text (input-string)))
            (cond
-             ((and (>= (length text) 8)
-                   (string-equal (subseq text 0 7) "/theme "))
-              (let* ((partial (subseq text 7))
+             ;; @ prefix — file path completion
+             ((and (>= (length text) 1) (eql (char text 0) #\@))
+              (let* ((partial (subseq text 1))
+                     (memex (or (uiop:getenv "MEMEX_DIR")
+                                (namestring (merge-pathnames "memex/" (user-homedir-pathname)))))
+                     (proj (merge-pathnames (make-pathname :directory '(:relative "projects")) memex))
+                     (files (handler-case (append (uiop:directory-files proj "**/*.org")
+                                                  (uiop:directory-files proj "**/*.lisp"))
+                              (error () nil)))
+                     (names (mapcar (lambda (f) (subseq (namestring f) (1+ (length (namestring proj))))) files))
+                     (match (find-if (lambda (n) (and (>= (length n) (length partial))
+                                                       (string-equal n partial :end2 (length partial))))
+                                     names)))
+                (when match
+                  (setf (st :input-buffer) (reverse (coerce (concatenate 'string "@" match) 'list)))
+                  (setf (st :dirty) (list nil nil t)))))
+             ;; /theme subcommand
+             ((and (>= (length text) 7) (string-equal (subseq text 0 7) "/theme "))
+              (let* ((partial (string-trim '(#\Space) (subseq text 7)))
                      (names '("dark" "light" "solarized" "gruvbox"))
-                     (match (find partial names :test #'string-equal)))
+                     (match (if (string= partial "") (first names)
+                                (find partial names :test #'string-equal))))
                 (when match
                   (setf (st :input-buffer) (reverse (coerce (concatenate 'string "/theme " match) 'list)))
                   (setf (st :dirty) (list nil nil t)))))
+             ;; /focus subcommand
+             ((and (>= (length text) 7) (string-equal (subseq text 0 7) "/focus "))
+              (let* ((partial (string-trim '(#\Space) (subseq text 7)))
+                     (memex (or (uiop:getenv "MEMEX_DIR")
+                                (namestring (merge-pathnames "memex/" (user-homedir-pathname)))))
+                     (proj (merge-pathnames (make-pathname :directory '(:relative "projects")) memex))
+                     (dirs (handler-case (mapcar (lambda (d) (car (last (pathname-directory d))))
+                                                  (uiop:subdirectories proj))
+                             (error () nil)))
+                     (match (if (string= partial "") (first dirs)
+                                (find-if (lambda (d) (and (>= (length d) (length partial))
+                                                           (string-equal d partial :end2 (length partial))))
+                                           dirs))))
+                (when match
+                  (setf (st :input-buffer) (reverse (coerce (concatenate 'string "/focus " match) 'list)))
+                  (setf (st :dirty) (list nil nil t)))))
+             ;; Command prefix /
              ((and (> (length text) 1) (eql (char text 0) #\/))
               (let* ((cmds '("/eval" "/focus" "/scope" "/unfocus" "/help" "/theme" "/reconnect" "/quit"))
                      (match (find text cmds :test
-                                  (lambda (in cmd)
-                                    (and (>= (length cmd) (length in))
-                                         (string-equal cmd in :end1 (length in)))))))
+                                  (lambda (in cmd) (and (>= (length cmd) (length in))
+                                                         (string-equal cmd in :end1 (length in)))))))
                 (when match
                   (setf (st :input-buffer) (reverse (coerce match 'list)))
                   (when (member match '("/eval" "/focus" "/scope") :test #'string=)
@@ -585,4 +650,37 @@ Event handlers + daemon I/O + main loop.
   (fiveam:is (eq :yellow (getf *tui-theme* :system)))
   (fiveam:is (eq :cyan (getf *tui-theme* :input)))
   (fiveam:is (eq :white (theme-color :unknown-role))))
+
+(fiveam:test test-on-key-ctrl-u-clears
+  "Contract 1/v0.7.0: Ctrl+U clears the input buffer."
+  (init-state)
+  (dolist (ch '(#\h #\i)) (on-key (char-code ch)))
+  (on-key 21) ; Ctrl+U
+  (fiveam:is (string= "" (input-string))))
+
+(fiveam:test test-on-key-ctrl-l-redraws
+  "Contract 1/v0.7.0: Ctrl+L sets all dirty flags."
+  (init-state)
+  (setf (st :dirty) (list nil nil nil))
+  (on-key 12) ; Ctrl+L
+  (let ((d (st :dirty)))
+    (fiveam:is (eq t (first d)))
+    (fiveam:is (eq t (second d)))))
+
+(fiveam:test test-scroll-notify
+  "Contract/v0.7.0: add-msg sets scroll-notify when scrolled up."
+  (init-state)
+  (setf (st :scroll-at-bottom) nil)
+  (add-msg :agent "hi")
+  (fiveam:is (eq t (st :scroll-notify)))
+  (setf (st :scroll-at-bottom) t (st :scroll-notify) nil)
+  (add-msg :agent "hi2")
+  (fiveam:is (eq nil (st :scroll-notify))))
+
+(fiveam:test test-tab-subcommand
+  "Contract/v0.7.0: Tab completes subcommand for /theme."
+  (init-state)
+  (dolist (ch (coerce "/theme " 'list)) (on-key (char-code ch)))
+  (on-key 9)
+  (fiveam:is (search "dark" (input-string) :test #'char-equal)))
 #+end_src

org/channel-tui-state.org

@@ -132,6 +132,8 @@ See *tui-theme-presets* for named presets (dark, light, solarized, gruvbox).")
               :input-buffer nil :input-history nil :input-hpos 0
               :messages (make-array 16 :adjustable t :fill-pointer 0)
               :scroll-offset 0 :busy nil :cursor-pos 0
+              :pending-ctrl-x nil
+              :scroll-at-bottom t :scroll-notify nil
               :dirty (list nil nil nil))))
 #+end_src
 
@@ -166,6 +168,9 @@ See *tui-theme-presets* for named presets (dark, light, solarized, gruvbox).")
 
 (defun add-msg (role content &key gate-trace)
   (vector-push-extend (list :role role :content content :time (now) :gate-trace gate-trace) (st :messages))
+  ;; v0.7.0: notify when scrolled up and new msg arrives
+  (unless (st :scroll-at-bottom)
+    (setf (st :scroll-notify) t))
   (setf (st :dirty) (list t t nil)))
 #+end_src
 

org/channel-tui-view.org

@@ -18,6 +18,11 @@ State is read via ~(st :key)~ — no mutation here.
    indicator.
 4. (redraw sw cw ch iw): dispatches redraws based on ~(st :dirty)~
    flags (status, chat, input). Minimizes terminal writes.
+5. (char-width ch): returns the terminal column width of character CH.
+   ASCII < 128 = 1. CJK, fullwidth, emoji = 2. Combining marks = 0.
+   Tab = 8. Used by word-wrap for accurate line counting (v0.7.0).
+6. (view-status win): v0.7.0 — timestamp right-aligned at (- w 12)
+   on line 2, focus info at :x 1. No overlap.
 
 ** Status Bar
 
@@ -52,12 +57,14 @@ that the TUI actuator attaches to the response plist before transmission.
            (or (st :rule-count) 0)
            (if (st :busy) "  …thinking" ""))
    :y 1 :x 1 :fgcolor (theme-color (if (st :connected) :connected :disconnected)))
-  ;; Second line: Focus map
+  ;; Second line: Focus map (left) + timestamp (right-aligned, v0.7.0)
   (let ((focus-info (or (st :foveal-id) "")))
     (when (and focus-info (> (length focus-info) 0))
       (add-string win (format nil " [Focus: ~a]" focus-info)
                   :y 2 :x 1 :fgcolor (theme-color :timestamp))))
-  (add-string win (format nil " ~a" (now)) :y 2 :x 1 :fgcolor (theme-color :timestamp))
+  (add-string win (format nil " ~a" (now))
+              :y 2 :x (max 1 (- (width win) 12))
+              :fgcolor (theme-color :timestamp))
   (refresh win))
 #+end_src
 
@@ -154,5 +161,65 @@ Returns list of trimmed strings. Single words wider than width are split."
     (when sd (view-status sw))
     (when cd (view-chat cw ch))
     (when id (view-input iw))
-    (setf (st :dirty) (list nil nil nil))))
+     (setf (st :dirty) (list nil nil nil))))
+#+end_src
+
+* Implementation — v0.7.0 additions
+#+begin_src lisp
+(in-package :passepartout)
+
+(defun char-width (ch)
+  "Returns the terminal column width of character CH.
+ASCII < 128 = 1. CJK, fullwidth, emoji = 2. Combining marks = 0. Tab = 8."
+  (let ((code (char-code ch)))
+    (cond
+      ((= code 9) 8)
+      ((< code 32) 0)
+      ((<= code 127) 1)
+      ((<= #x4E00 code #x9FFF) 2)
+      ((<= #x3400 code #x4DBF) 2)
+      ((<= #x3040 code #x309F) 2)
+      ((<= #x30A0 code #x30FF) 2)
+      ((<= #xAC00 code #xD7AF) 2)
+      ((<= #xFF01 code #xFF60) 2)
+      ((<= #xFFE0 code #xFFE6) 2)
+      ((<= #x1F300 code #x1F9FF) 2)
+      ((<= #x2600 code #x27BF) 2)
+      ((<= #x0300 code #x036F) 0)
+      ((<= #x20D0 code #x20FF) 0)
+      ((<= #xFE00 code #xFE0F) 0)
+      (t 1))))
+#+end_src
+
+* Test Suite
+#+begin_src lisp
+(eval-when (:compile-toplevel :load-toplevel :execute)
+  (ql:quickload :fiveam :silent t))
+
+(defpackage :passepartout-tui-view-tests
+  (:use :cl :fiveam :passepartout)
+  (:export #:tui-view-suite))
+
+(in-package :passepartout-tui-view-tests)
+
+(def-suite tui-view-suite :description "TUI view rendering helpers")
+(in-suite tui-view-suite)
+
+(test test-char-width-ascii
+  "Contract 5: ASCII characters (< 128) have width 1."
+  (is (= 1 (passepartout::char-width #\a)))
+  (is (= 1 (passepartout::char-width #\Space)))
+  (is (= 1 (passepartout::char-width #\@))))
+
+(test test-char-width-tab
+  "Contract 5: tab character has width 8."
+  (is (= 8 (passepartout::char-width #\Tab))))
+
+(test test-char-width-cjk
+  "Contract 5: CJK characters have width 2."
+  (is (= 2 (passepartout::char-width #\日))))
+
+(test test-char-width-null
+  "Contract 5: null has width 0."
+  (is (= 0 (passepartout::char-width #\Nul))))
 #+end_src