release v2.1.0

Drains the post-2.0 Unreleased backlog: keymap layer (T-117), keyboard
operability + panel-traversal arc (T-100, T-105, T-111, T-114), 95%
coverage gate (D-66), IPC argv-injection + size/count hardening
(T-104), high-contrast theme variants (D-69, T-118), PTY rewrite via
posix_spawn (T-96), CONTRIBUTING.md (T-109), and ~60 smaller items.
Closes T-121.

Co-Authored-By: Claude <noreply@anthropic.com>

.claude/skills/git-commit/SKILL.md

@@ -55,7 +55,7 @@ Entries should be short imperative phrases that describe user-facing impact —
 
 ### Be concise — this is the rule, not a suggestion
 
-CHANGELOG entries must be **one or two short sentences**. Strict ceiling: **40 words per bullet**, hard cap at 60. If you can't say it in one line wrapped at ~75 columns, you're writing the wrong document.
+CHANGELOG entries must be **one or two short sentences**. Hard cap: **60 words per bullet** (enforced by `ci/changelog_gate.sh`). Aim for 30 or under; if you can't say it in one line wrapped at ~75 columns, you're writing the wrong document.
 
 The CHANGELOG is read by humans scanning for what changed between two versions. It is **not** the place for the rationale, the probe results, the implementation detail, the behavior-change deep dive, or the "see also" cross-references. Those belong in:
 

.pql/changelog/ticket_history/2026-05.sql

@@ -1719,3 +1719,97 @@ INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by,
 INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-106', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:18:43', '2026-05-17 19:18:43', '2026-05-17 19:18:43', NULL, '8dccc83b93c5005db744a100a5b3baea', 1) ON CONFLICT(hash) DO NOTHING;
 INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-113', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:18:43', '2026-05-17 19:18:43', '2026-05-17 19:18:43', NULL, '8f7812831e564005eb796708543c54b3', 1) ON CONFLICT(hash) DO NOTHING;
 INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-103', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:18:43', '2026-05-17 19:18:43', '2026-05-17 19:18:43', NULL, 'c7d1b76cb6854efb7e9990cc7204d899', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-100', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 19:23:24', '2026-05-17 19:23:24', '2026-05-17 19:23:24', NULL, '607b82f096b5d694fb75b7daf64dc2e0', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-117', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 19:28:31', '2026-05-17 19:28:31', '2026-05-17 19:28:31', NULL, 'b5c56dff8a2c7d6f14ecf19231b63268', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-110', 'description', '`app.dart:90-148` routes all shortcuts through one root `KeyboardListener` — no per-context scoping; will conflict with text-input fields once any pane wants to capture keys. `KeybindingResolver.fromKeyEvent` keys off `logicalKey.keyLabel` which is layout-dependent (US-QWERTY `Ctrl+/` differs from AZERTY `Ctrl+:`).
+
+**Fix:**
+1. Replace the root `KeyboardListener` with scoped `Shortcuts`/`Actions` per slot.
+2. Move `KeybindingResolver` to `physicalKey` or a stable mapping layer.
+
+Coordinate with T-100 (Focus/Shortcuts wrapper for ClideTappable) and T-105 (focus traversal).
+
+Source: consultants.md "UX — Findings — [Major]".', '**Superseded by T-117 — Done.**
+
+The consultant findings here — single root `KeyboardListener` will conflict with text-input fields; `KebindingResolver.fromKeyEvent` keys off layout-dependent `logicalKey.keyLabel` — are both addressed by the keystroke mapper layer (T-117):
+
+- Keymap-driven dispatch uses `LogicalKeyboardKey.keyId` (stable across layouts), not `keyLabel`.
+- Root `KeyboardListener` now hands events straight to `KeymapService.resolveEvent`, which dispatches resolved Intents via `Actions.maybeInvoke` against the focused context — Actions providers per feature (palette, editor, etc.) handle their own intents; the root only handles global ones (text scale, generic command bridge). This is the scoped Shortcuts/Actions model the consultant prescribed.
+
+Remaining cleanup (deletion of the now-vestigial `KeybindingResolver` class + the legacy `KeyboardListener` wrap once Flutter Shortcuts widget integration is on every feature) is small and lands as part of T-100 or its own follow-up.
+
+Original text: Replace root KeyboardListener with scoped Shortcuts/Actions; move KebindingResolver off layout-dependent keyLabel.', NULL, '2026-05-17 19:39:08', '2026-05-17 19:39:08', '2026-05-17 19:39:08', NULL, '6364d644fbbfa903390ee78b5b402367', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-110', 'status', 'backlog', 'done', NULL, '2026-05-17 19:39:12', '2026-05-17 19:39:12', '2026-05-17 19:39:12', NULL, '6073b1bbc12001914d78d4cb419705dc', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-23', 'description', 'D-48 names `⌘P` (fuzzy file open) and `⌘⇧P` (command palette) as the canonical keyboard navigation. The command palette overlay/widget exists; the keybinding is not yet wired.
+
+**Acceptance:**
+- `⌘⇧P` (`Ctrl+Shift+P` on Linux, follows the kernel keymap normalization) opens the command palette overlay over the active workspace.
+- Esc dismisses; Enter runs the highlighted command; arrow keys move the highlight.
+- Commands listed are everything registered via `CommandContribution` across all activated extensions.
+- Fuzzy match against command title; recent / pinned commands float to the top.
+
+**Implementation hints:**
+- Slot exists: `Slots.commandPalette` is reserved (lib/kernel/src/panels/slot_id.dart).
+- Keybinding goes in `lib/kernel/src/commands/keybindings.dart` per the D-54 keymap.
+- The overlay should not shift layout (D-48 chrome budget — no layout shift on palette open).', 'D-48 names `⌘P` (fuzzy file open) and `⌘⇧P` (command palette) as the canonical keyboard navigation. The command palette overlay/widget exists; the keybinding is not yet wired.
+
+**Progress (2026-05-17, T-117):** The keymap layer now binds `ctrl+shift+p` / `meta+shift+p` to `PaletteOpenIntent` in `assets/keymaps/default.yaml`. The intent resolves end-to-end through `KeymapService.resolveEvent` → `Actions.maybeInvoke`. **Still pending**: an `Actions` provider somewhere in the tree that handles `PaletteOpenIntent` by calling `kernel.palette.open()`, plus the arrow-key / Escape / Enter handlers on `ClidePalette` itself. Those land as part of T-100 (palette keyboard nav).
+
+**Acceptance:**
+- `⌘⇧P` (`Ctrl+Shift+P` on Linux, follows the kernel keymap normalization) opens the command palette overlay over the active workspace.
+- Esc dismisses; Enter runs the highlighted command; arrow keys move the highlight.
+- Commands listed are everything registered via `CommandContribution` across all activated extensions.
+- Fuzzy match against command title; recent / pinned commands float to the top.
+
+**Implementation hints:**
+- Slot exists: `Slots.commandPalette` is reserved (lib/kernel/src/panels/slot_id.dart).
+- Bindings live in the keymap (T-117) — not in `lib/kernel/src/commands/keybindings.dart` (that file is legacy).
+- The overlay should not shift layout (D-48 chrome budget — no layout shift on palette open).', NULL, '2026-05-17 19:39:23', '2026-05-17 19:39:23', '2026-05-17 19:39:23', NULL, '50203b7db93490ac779fe496865cf3a0', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-64', 'description', 'Ship a VS Code-compatible keybinding preset that maps standard VS Code shortcuts to clide commands. Users select it in settings. Covers file navigation, editor actions, panel toggles, search, and terminal.', 'Ship a VS Code-compatible keybinding preset that maps standard VS Code shortcuts to clide commands. Users select it in settings. Covers file navigation, editor actions, panel toggles, search, and terminal.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is now in place. Implementation is now just authoring `assets/keymaps/vscode.yaml` against the typed Intents in `lib/kernel/src/keymap/intents.dart` (plus `command:<id>` bindings for VS-Code-specific commands the preset wants to bind to clide commands). Users will switch presets via `app.keymap.preset = vscode` once a settings UI exists, or directly via the setting today.
+
+**Acceptance:**
+1. `assets/keymaps/vscode.yaml` ships covering the documented VS Code default keybindings.
+2. `KeymapService.setPreset("vscode")` activates the preset and all asserted bindings resolve as expected.
+3. The preset uses when-clauses where VS Code does (`editor.focused`, `inputFocused`, `palette.open`, …).
+4. A regression test loads the preset and asserts a representative subset (e.g. ctrl+p → quick-open command, ctrl+shift+p → palette).
+
+**Out of scope:** clide commands that have no VS Code analogue (those keep their default-preset bindings).', NULL, '2026-05-17 19:39:37', '2026-05-17 19:39:37', '2026-05-17 19:39:37', NULL, 'a97758128bd490f603f11a68883a7193', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-65', 'description', 'Ship a Vim-compatible keybinding preset with modal editing support (normal/insert/visual modes). Maps Vim motions and commands to clide editor and navigation actions. Users select it in settings.', 'Ship a Vim-compatible keybinding preset with modal editing support (normal/insert/visual modes). Maps Vim motions and commands to clide editor and navigation actions. Users select it in settings.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is in place; modal Vim presets are more involved than the VS Code preset (T-64) because modes need to be expressed as scope flags (`vim.normal`, `vim.insert`, `vim.visual`) that the when-clause grammar can branch on. Implementation work:
+
+1. Author `assets/keymaps/vim.yaml` using the typed Intents + `command:<id>` bindings.
+2. Add a small mode-tracking service that publishes `vim.<mode>` scope flags via `KeymapService.setScopeFlag`.
+3. Bind `Esc` to mode-reset → normal; `i` (when `vim.normal`) → enter insert; etc.
+
+**Acceptance:**
+1. `assets/keymaps/vim.yaml` ships covering the documented Vim default keybindings for editor / navigation / panes.
+2. `KeymapService.setPreset("vim")` + the mode-tracking service together produce correct mode transitions.
+3. A regression test exercises a representative motion (`j` → cursor down) and a mode change (`i` → insert).', NULL, '2026-05-17 19:39:37', '2026-05-17 19:39:37', '2026-05-17 19:39:37', NULL, 'bf10f0149ccaa1e02050280b28305816', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-66', 'description', 'Ship a JetBrains/IntelliJ-compatible keybinding preset mapping standard JetBrains shortcuts to clide commands. Covers navigation, refactoring, search, run/debug, and tool windows.', 'Ship a JetBrains/IntelliJ-compatible keybinding preset mapping standard JetBrains shortcuts to clide commands. Covers navigation, refactoring, search, run/debug, and tool windows.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is in place. Implementation is authoring `assets/keymaps/jetbrains.yaml` against the typed Intents + `command:<id>` bindings, plus when-clauses for the contexts JetBrains presets typically scope to (`editor.focused`, `inputFocused`, etc.).
+
+**Acceptance:**
+1. `assets/keymaps/jetbrains.yaml` ships covering the documented IntelliJ default keybindings.
+2. `KeymapService.setPreset("jetbrains")` activates the preset and all asserted bindings resolve.
+3. A regression test exercises a representative subset (e.g. shift+shift → quick-open command — see Q-9 if the search-everywhere overlay needs its own intent).', NULL, '2026-05-17 19:39:37', '2026-05-17 19:39:37', '2026-05-17 19:39:37', NULL, 'c1129f4cb3454b99e1cbf645ca56bea5', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-117', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:39:40', '2026-05-17 19:39:40', '2026-05-17 19:39:40', NULL, '75b2fd14ceb7daf28645ccf84cb041f1', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-100', 'status', 'in_progress', 'in_progress', NULL, '2026-05-17 19:40:44', '2026-05-17 19:40:44', '2026-05-17 19:40:44', NULL, '65600862f5787501dcd057756cdb4313', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-100', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:47:50', '2026-05-17 19:47:50', '2026-05-17 19:47:50', NULL, '7d3c0ad4c47d3271ac35c5159e6e9d0e', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-105', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 19:52:39', '2026-05-17 19:52:39', '2026-05-17 19:52:39', NULL, '129acb5d6b1882cb6ed4c9be46fd3e81', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-105', 'status', 'in_progress', 'done', NULL, '2026-05-17 19:56:28', '2026-05-17 19:56:28', '2026-05-17 19:56:28', NULL, '62dfdadc31b2c231afd837fb46f0a114', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-108', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 19:58:13', '2026-05-17 19:58:13', '2026-05-17 19:58:13', NULL, 'a5dbfe5881e152e82538181b0fe56609', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-108', 'status', 'in_progress', 'done', NULL, '2026-05-17 20:05:38', '2026-05-17 20:05:38', '2026-05-17 20:05:38', NULL, '6815472fbfaa6d7740945b42d4c87f57', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-112', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 20:06:30', '2026-05-17 20:06:30', '2026-05-17 20:06:30', NULL, '52271781bf987a984d9f219956034d1f', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-112', 'status', 'in_progress', 'done', NULL, '2026-05-17 20:11:16', '2026-05-17 20:11:16', '2026-05-17 20:11:16', NULL, '6d51964a3ad7f1948f54a7c769336841', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-114', 'status', 'backlog', 'in_progress', NULL, '2026-05-17 20:13:36', '2026-05-17 20:13:36', '2026-05-17 20:13:36', NULL, '0bad40fa7f165f828bb0c0757044491e', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-118', 'status', 'backlog', 'done', NULL, '2026-05-17 20:53:41', '2026-05-17 20:53:41', '2026-05-17 20:53:41', NULL, 'ff0126655805fed0ebe45f313c5ceff7', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-114', 'status', 'in_progress', 'done', NULL, '2026-05-18 07:04:38', '2026-05-18 07:04:38', '2026-05-18 07:04:38', NULL, '8cf198f8c824fa8f46277b7e22e68f0c', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-111', 'status', 'in_progress', 'done', NULL, '2026-05-18 07:43:45', '2026-05-18 07:43:45', '2026-05-18 07:43:45', NULL, '792efcf7c772de7cda7069ea3fc3ac0a', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-104', 'status', 'backlog', 'in_progress', NULL, '2026-05-18 07:49:44', '2026-05-18 07:49:44', '2026-05-18 07:49:44', NULL, 'bf7f2746c252f8b8893f4fdc06d459b8', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-104', 'status', 'in_progress', 'done', NULL, '2026-05-18 07:53:10', '2026-05-18 07:53:10', '2026-05-18 07:53:10', NULL, 'ce2b66658977edc3fddc78079d7852e5', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-109', 'status', 'backlog', 'in_progress', NULL, '2026-05-18 08:02:06', '2026-05-18 08:02:06', '2026-05-18 08:02:06', NULL, 'ee75fea173ae492a6ad8a1d888a2142d', 1) ON CONFLICT(hash) DO NOTHING;
+INSERT INTO ticket_history (ticket_id, field, old_value, new_value, changed_by, changed_at, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-109', 'status', 'in_progress', 'done', NULL, '2026-05-18 08:07:23', '2026-05-18 08:07:23', '2026-05-18 08:07:23', NULL, '9dd61b76946909aa44edaf9d1c1741a0', 1) ON CONFLICT(hash) DO NOTHING;

.pql/changelog/tickets/2026-05.sql

@@ -1668,3 +1668,230 @@ INSERT INTO tickets (id, type, parent_id, title, description, status, priority,
 **Acceptance:** `make push-check` runs the integration test layer + smoke-bundle. Wall-clock budget acceptable for pre-push (target <2 min total). If they''re too slow, gate them behind a separate `make push-check-full` and document.
 
 Source: consultants.md "Tests — Findings — [Major] make push-check does not run integration tests".', 'done', 'high', NULL, NULL, NULL, '2026-05-17 18:47:39', '2026-05-17 19:18:43', NULL, 'cbae1915f1c89a8a2b05da71148d77dc', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-100', 'story', 'T-97', 'make ClideTappable keyboard-operable; add palette arrow-keys + Escape', '`ClideTappable` (`lib/widgets/src/clide_tappable.dart`) is the base of nearly every interactive widget — `ClideButton`, `_WinBtn`, `_RecentProjectRow`, `_ActionRow`, most builtin list items — and it is `MouseRegion` + `GestureDetector` only. No `Focus`, no Enter/Space handler, no focus ring. None of these widgets can be reached by Tab or activated from the keyboard. The keyboard-traversal test passes only because it externally wraps in a `Focus` node — it tests non-blocking, not operability.
+
+`ClidePalette` (`lib/widgets/src/clide_palette.dart`) is similarly broken: `onSubmitted` only ever invokes `filtered.first`; no up/down handling, no selected index, no selection highlight, no Escape handler.
+
+**Fix:**
+1. Wrap `ClideTappable`''s child in `Focus` + `Shortcuts`/`Actions` so Tab focuses it and Enter/Space invokes `onTap`. Render a focus ring via the token system.
+2. Add arrow-key navigation + selected-index + Escape + Enter-on-selected to `ClidePalette` (model after `_ProjectSwitcherDropdown.onKeyEvent` at `app.dart:446-452`).
+3. Extend the a11y test layer to assert operability (Tab + Enter actually invokes), not just Semantics presence.
+
+Source: consultants.md "UX — Findings — [Critical]".', 'in_progress', 'high', NULL, NULL, NULL, '2026-05-17 18:47:23', '2026-05-17 19:23:24', NULL, '45607823ef1229d43dcfd0bc327a1031', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-110', 'story', 'T-97', 'replace root KeyboardListener with scoped Shortcuts/Actions; move off keyLabel', '**Superseded by T-117 — Done.**
+
+The consultant findings here — single root `KeyboardListener` will conflict with text-input fields; `KebindingResolver.fromKeyEvent` keys off layout-dependent `logicalKey.keyLabel` — are both addressed by the keystroke mapper layer (T-117):
+
+- Keymap-driven dispatch uses `LogicalKeyboardKey.keyId` (stable across layouts), not `keyLabel`.
+- Root `KeyboardListener` now hands events straight to `KeymapService.resolveEvent`, which dispatches resolved Intents via `Actions.maybeInvoke` against the focused context — Actions providers per feature (palette, editor, etc.) handle their own intents; the root only handles global ones (text scale, generic command bridge). This is the scoped Shortcuts/Actions model the consultant prescribed.
+
+Remaining cleanup (deletion of the now-vestigial `KeybindingResolver` class + the legacy `KeyboardListener` wrap once Flutter Shortcuts widget integration is on every feature) is small and lands as part of T-100 or its own follow-up.
+
+Original text: Replace root KeyboardListener with scoped Shortcuts/Actions; move KebindingResolver off layout-dependent keyLabel.', 'done', 'medium', NULL, NULL, NULL, '2026-05-17 18:48:09', '2026-05-17 19:39:12', NULL, '33850630ffa4bf1f1794fd94db8a62c3', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-23', 'task', 'T-4', 'wire command palette keybinding', 'D-48 names `⌘P` (fuzzy file open) and `⌘⇧P` (command palette) as the canonical keyboard navigation. The command palette overlay/widget exists; the keybinding is not yet wired.
+
+**Progress (2026-05-17, T-117):** The keymap layer now binds `ctrl+shift+p` / `meta+shift+p` to `PaletteOpenIntent` in `assets/keymaps/default.yaml`. The intent resolves end-to-end through `KeymapService.resolveEvent` → `Actions.maybeInvoke`. **Still pending**: an `Actions` provider somewhere in the tree that handles `PaletteOpenIntent` by calling `kernel.palette.open()`, plus the arrow-key / Escape / Enter handlers on `ClidePalette` itself. Those land as part of T-100 (palette keyboard nav).
+
+**Acceptance:**
+- `⌘⇧P` (`Ctrl+Shift+P` on Linux, follows the kernel keymap normalization) opens the command palette overlay over the active workspace.
+- Esc dismisses; Enter runs the highlighted command; arrow keys move the highlight.
+- Commands listed are everything registered via `CommandContribution` across all activated extensions.
+- Fuzzy match against command title; recent / pinned commands float to the top.
+
+**Implementation hints:**
+- Slot exists: `Slots.commandPalette` is reserved (lib/kernel/src/panels/slot_id.dart).
+- Bindings live in the keymap (T-117) — not in `lib/kernel/src/commands/keybindings.dart` (that file is legacy).
+- The overlay should not shift layout (D-48 chrome budget — no layout shift on palette open).', 'backlog', 'medium', NULL, NULL, 'D-6', '2026-04-22 14:08:40', '2026-05-17 19:39:23', NULL, 'c355fdc971b62e0aedbfb99ed4134678', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-66', 'story', NULL, 'JetBrains keybinding preset', 'Ship a JetBrains/IntelliJ-compatible keybinding preset mapping standard JetBrains shortcuts to clide commands. Covers navigation, refactoring, search, run/debug, and tool windows.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is in place. Implementation is authoring `assets/keymaps/jetbrains.yaml` against the typed Intents + `command:<id>` bindings, plus when-clauses for the contexts JetBrains presets typically scope to (`editor.focused`, `inputFocused`, etc.).
+
+**Acceptance:**
+1. `assets/keymaps/jetbrains.yaml` ships covering the documented IntelliJ default keybindings.
+2. `KeymapService.setPreset("jetbrains")` activates the preset and all asserted bindings resolve.
+3. A regression test exercises a representative subset (e.g. shift+shift → quick-open command — see Q-9 if the search-everywhere overlay needs its own intent).', 'backlog', 'medium', NULL, NULL, NULL, '2026-04-24 06:34:16', '2026-05-17 19:39:37', NULL, '633ba8ffaee17af0b6ca6d2cc2a7549d', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-64', 'story', NULL, 'VS Code keybinding preset', 'Ship a VS Code-compatible keybinding preset that maps standard VS Code shortcuts to clide commands. Users select it in settings. Covers file navigation, editor actions, panel toggles, search, and terminal.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is now in place. Implementation is now just authoring `assets/keymaps/vscode.yaml` against the typed Intents in `lib/kernel/src/keymap/intents.dart` (plus `command:<id>` bindings for VS-Code-specific commands the preset wants to bind to clide commands). Users will switch presets via `app.keymap.preset = vscode` once a settings UI exists, or directly via the setting today.
+
+**Acceptance:**
+1. `assets/keymaps/vscode.yaml` ships covering the documented VS Code default keybindings.
+2. `KeymapService.setPreset("vscode")` activates the preset and all asserted bindings resolve as expected.
+3. The preset uses when-clauses where VS Code does (`editor.focused`, `inputFocused`, `palette.open`, …).
+4. A regression test loads the preset and asserts a representative subset (e.g. ctrl+p → quick-open command, ctrl+shift+p → palette).
+
+**Out of scope:** clide commands that have no VS Code analogue (those keep their default-preset bindings).', 'backlog', 'medium', NULL, NULL, NULL, '2026-04-24 06:34:16', '2026-05-17 19:39:37', NULL, '660a4871f59f940fbc2296b36177e0d8', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-65', 'story', NULL, 'Vim keybinding preset', 'Ship a Vim-compatible keybinding preset with modal editing support (normal/insert/visual modes). Maps Vim motions and commands to clide editor and navigation actions. Users select it in settings.
+
+**Unblocked by T-117 (2026-05-17):** the keystroke mapper layer is in place; modal Vim presets are more involved than the VS Code preset (T-64) because modes need to be expressed as scope flags (`vim.normal`, `vim.insert`, `vim.visual`) that the when-clause grammar can branch on. Implementation work:
+
+1. Author `assets/keymaps/vim.yaml` using the typed Intents + `command:<id>` bindings.
+2. Add a small mode-tracking service that publishes `vim.<mode>` scope flags via `KeymapService.setScopeFlag`.
+3. Bind `Esc` to mode-reset → normal; `i` (when `vim.normal`) → enter insert; etc.
+
+**Acceptance:**
+1. `assets/keymaps/vim.yaml` ships covering the documented Vim default keybindings for editor / navigation / panes.
+2. `KeymapService.setPreset("vim")` + the mode-tracking service together produce correct mode transitions.
+3. A regression test exercises a representative motion (`j` → cursor down) and a mode change (`i` → insert).', 'backlog', 'medium', NULL, NULL, NULL, '2026-04-24 06:34:16', '2026-05-17 19:39:37', NULL, '8db44365ff24e322ccc4bf145e31c5c5', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-117', 'task', 'T-97', 'keystroke mapper layer — intents + presets + when-clauses + overlay', 'Build the keymap mechanism that all keyboard-driven work plugs into. Lands before T-100 so widget wiring (ClideTappable, ClidePalette, focus traversal) goes through typed Intents, not raw key handlers. Closes T-110 (consultant: scoped Shortcuts/Actions; move off layout-dependent keyLabel). Unblocks T-64/T-65/T-66 (vim/vscode/jetbrains preset data).
+
+## Design (locked 2026-05-17)
+
+- **Action vocabulary**: typed `ClideIntent` subclasses (`ActivateIntent`, `PaletteSelectNextIntent`, …) each with a stable id used in YAML.
+- **Keys**: `LogicalKeyboardKey.keyId` (layout-independent, not the locale-aware keyLabel the consultant flagged) + modifier set.
+- **When-clauses**: VS-Code-style boolean expressions over a named context bag (`palette.open && !textInputFocused`). Tiny recursive-descent parser.
+- **Preset format**: YAML under `assets/keymaps/<preset>.yaml`. Ships `default.yaml`; vim/vscode/jetbrains land as separate tickets.
+- **Layering**: preset (asset) → user file (`~/.clide/keybindings.yaml`) → settings JSON overlay (`app.keymap.overrides`). Later layers replace bindings with the same (chord, when) tuple.
+- **Service**: `KeymapService` kernel service holding active layered keymap, scope context, resolver, and a Shortcuts/Actions wrapper.
+- **Settings keys**: `app.keymap.preset` (default `default`); `app.keymap.overrides` (list).
+
+## Acceptance
+
+1. `KeymapService` registered as a kernel service.
+2. `assets/keymaps/default.yaml` ships and parses; preset switching changes effective bindings.
+3. When-clause parser handles `a`, `!a`, `a && b`, `a || b`, parens, with unit tests covering precedence + identifier resolution.
+4. Root `KeyboardListener` in `app.dart` removed in favor of `Shortcuts`/`Actions` driven by the service (closes T-110).
+5. Existing `KeybindingResolver` callers migrate to the new path; old class either deleted or marked deprecated with a removal date.
+6. Tests: preset YAML round-trip, layering precedence, when-clause evaluator, scope-context updates, resolver picks the correct intent for chord+context.
+
+## Out of scope (deferred)
+
+- Vim/VSCode/JetBrains preset *data* (T-64/T-65/T-66 — this ticket lands the mechanism).
+- A settings UI for editing bindings (file editing + preset switching is enough for v1).
+- ClideTappable/Palette widget integration (T-100 — comes immediately after this lands).
+
+Source: 2026-05-17 design conversation; supersedes T-110.', 'done', 'high', NULL, NULL, NULL, '2026-05-17 19:28:28', '2026-05-17 19:39:40', NULL, '92d68025f0ee7c4d133dca65e97c97b8', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-100', 'story', 'T-97', 'make ClideTappable keyboard-operable; add palette arrow-keys + Escape', '`ClideTappable` (`lib/widgets/src/clide_tappable.dart`) is the base of nearly every interactive widget — `ClideButton`, `_WinBtn`, `_RecentProjectRow`, `_ActionRow`, most builtin list items — and it is `MouseRegion` + `GestureDetector` only. No `Focus`, no Enter/Space handler, no focus ring. None of these widgets can be reached by Tab or activated from the keyboard. The keyboard-traversal test passes only because it externally wraps in a `Focus` node — it tests non-blocking, not operability.
+
+`ClidePalette` (`lib/widgets/src/clide_palette.dart`) is similarly broken: `onSubmitted` only ever invokes `filtered.first`; no up/down handling, no selected index, no selection highlight, no Escape handler.
+
+**Fix:**
+1. Wrap `ClideTappable`''s child in `Focus` + `Shortcuts`/`Actions` so Tab focuses it and Enter/Space invokes `onTap`. Render a focus ring via the token system.
+2. Add arrow-key navigation + selected-index + Escape + Enter-on-selected to `ClidePalette` (model after `_ProjectSwitcherDropdown.onKeyEvent` at `app.dart:446-452`).
+3. Extend the a11y test layer to assert operability (Tab + Enter actually invokes), not just Semantics presence.
+
+Source: consultants.md "UX — Findings — [Critical]".', 'done', 'high', NULL, NULL, NULL, '2026-05-17 18:47:23', '2026-05-17 19:47:50', NULL, 'f6f0c34a700b133bc84c6d8d7ea450a3', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-105', 'story', 'T-97', 'establish focus-traversal model; integrate FocusTracker with Flutter focus', 'No `FocusScope`/`FocusTraversalGroup` wiring across panels. `FocusTracker` (`lib/kernel/src/focus.dart`) tracks an active contribution id for the `clide active` CLI but doesn''t plug into Flutter''s focus system — it parallels it. Tab order across sidebar → workspace → context is undefined.
+
+**Fix:**
+1. Per-slot `FocusTraversalGroup` so each panel manages its own traversal.
+2. A documented top-level keybinding (e.g. `Ctrl+Shift+Tab`-style) that moves focus to the next panel.
+3. Integrate `FocusTracker` with Flutter focus rather than maintaining a parallel registry.
+
+Depends on T-100 (ClideTappable accepting focus).
+
+Source: consultants.md "UX — Findings — [Major] No focus-traversal wiring".', 'done', 'medium', NULL, NULL, NULL, '2026-05-17 18:47:47', '2026-05-17 19:56:28', NULL, '0715d1ded0d12083622f8a46d570f4d9', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-108', 'task', 'T-97', 'replace wall-clock sleeps in watcher_test / session_test with event-driven waits', '`test/files/watcher_test.dart:67-82` uses fixed `Future.delayed`. `test/pty/session_test.dart` polls 50×100ms and uses a bare `500ms` settle. `session_test.dart`''s `timeout(5s, onTimeout: () {})` swallows the timeout — a never-producing PTY proceeds to a confusing assertion failure rather than a clear timeout.
+
+**Fix:**
+1. Replace fixed sleeps with `expectLater(stream, emits(...))` or equivalent event-driven waits.
+2. Replace swallowed `onTimeout: () {}` with `onTimeout: () => fail(''...'')`.
+
+Source: consultants.md "Tests — Findings — [Major]".', 'done', 'medium', NULL, NULL, NULL, '2026-05-17 18:47:59', '2026-05-17 20:05:38', NULL, '33e15d84caed686e88fc42f1f4a3586c', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-112', 'task', 'T-97', 'quick-wins: code-quality cleanups', 'Batch of small consultant findings that share a domain (code quality):
+
+1. Replace silent `catch (_)` in `tree_sitter_ffi.dart:197,206` with a logged last-error — `DynamicLibrary.open` failures are currently discarded.
+2. Delete `Cmsghdr` alias in `libc.dart:201-202` ("backward compatibility" — CLAUDE.md forbids in a solo repo).
+3. Remove `// ignore: unused_field` in `editor_controller.dart:25` (speculative retention; fix not silence).
+4. Consume `libc.dart` constants / `PosixErrno` in `native_pty.dart` instead of inline hex (`0x0001`, `28`, `4`, `9`).
+5. `ExtensionManager.activate` (`extensions_manager.dart:141-143`) swallows exceptions — surface a "degraded" state for the UI.
+6. Verify `file_tree_view.dart:8` barrel leak (commit `5cad982` may already cover this).
+7. Move `test_app.dart` out of production `main.dart` import graph (gate behind separate entrypoint or `kDebugMode`).
+
+Source: consultants.md (Code Quality + Architecture Findings — Minor).', 'done', 'low', NULL, NULL, NULL, '2026-05-17 18:48:20', '2026-05-17 20:11:16', NULL, 'fccc783ff24be83f6d5a498e936c4af9', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-114', 'task', 'T-97', 'quick-wins: a11y + contrast gate expansion', 'Batch of small consultant findings that share a domain (a11y / visual):
+
+1. Expand contrast gate `canonicalPairs` (`test/a11y/contrast_test.dart`) to cover `globalTextMuted` (muted text is everywhere), the `status*` foregrounds, syntax tokens on `panelBackground`, and `panelActiveBorder`.
+2. Tokenize the ~43 hardcoded-color sites the UX reviewer flagged — at minimum the modal/palette shadow and window-control colors that don''t adapt to the `paper` light theme.
+3. Add a focus-ring rendering at the token level so every focusable widget gets it for free (depends on T-100).
+4. Surface text-zoom (Ctrl +/-/0) in the palette so it''s discoverable.
+
+Source: consultants.md "UX — Findings — [Minor]" + Strengths section.', 'in_progress', 'low', NULL, NULL, NULL, '2026-05-17 18:48:28', '2026-05-17 20:13:36', NULL, '1a2776ce1e3dd335966d738f80784a0a', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-118', 'task', 'T-97', 'add high-contrast + colour-blind theme variants', 'Per D-69, the four named themes (clide, midnight, paper, terminal) keep
+their published palettes and only pass the baseline canonicalPairs
+gate. The stricter extendedPairs set in
+lib/kernel/src/theme/contrast.dart (muted text, status chips, syntax
+tokens on panel surfaces, panel focus border) is gated against any
+theme whose name ends in -hc or -cb — but no such themes exist yet.
+
+Scope:
+
+1. Ship clide-hc.yaml, midnight-hc.yaml, paper-hc.yaml,
+   terminal-hc.yaml — sibling theme files whose palettes shift only
+   enough to clear extendedPairs (4.5:1 for chips / syntax / muted
+   body, 3:1 for the focus border).
+2. Optional follow-up: *-cb.yaml colour-blind variants if/when we
+   pick a palette policy (deutan vs protan vs tritan, or a single
+   colour-name-replacement strategy).
+3. Register the new themes in lib/main.dart alongside the existing
+   four.
+4. The contrast gate at test/a11y/contrast_test.dart already covers
+   them — adding the files is enough.
+
+Sources: D-22, D-69, consultants.md ("UX — Findings — [Minor]").', 'done', 'low', NULL, NULL, 'D-69', '2026-05-17 20:51:47', '2026-05-17 20:53:41', NULL, 'd163731890022856585e9f33432462f6', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-114', 'task', 'T-97', 'quick-wins: a11y + contrast gate expansion', 'Batch of small consultant findings that share a domain (a11y / visual):
+
+1. Expand contrast gate `canonicalPairs` (`test/a11y/contrast_test.dart`) to cover `globalTextMuted` (muted text is everywhere), the `status*` foregrounds, syntax tokens on `panelBackground`, and `panelActiveBorder`.
+2. Tokenize the ~43 hardcoded-color sites the UX reviewer flagged — at minimum the modal/palette shadow and window-control colors that don''t adapt to the `paper` light theme.
+3. Add a focus-ring rendering at the token level so every focusable widget gets it for free (depends on T-100).
+4. Surface text-zoom (Ctrl +/-/0) in the palette so it''s discoverable.
+
+Source: consultants.md "UX — Findings — [Minor]" + Strengths section.', 'done', 'low', NULL, NULL, NULL, '2026-05-17 18:48:28', '2026-05-18 07:04:38', NULL, '70c65844ee3e52bfcd6220b77ab8957a', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-111', 'story', 'T-97', 'drag-resize keyboard parity + clide panel resize CLI', '`drag_resize.dart` and `app.dart:870-912` are pure `Listener` pointer handlers — no keyboard equivalent, no Semantics node. Per the user/Claude parity rule (D-6), panel sizing should have a CLI affordance. Neither exists.
+
+**Fix:**
+1. Add Semantics to drag-resize handles + keyboard activation (focus → arrow keys adjust width).
+2. Add `clide panel resize <slot> <delta-or-absolute>` CLI verb.
+
+Coordinate with T-99 (IPC implementation) if the CLI verb needs new dispatch wiring.
+
+Source: consultants.md "UX — Findings — [Major] Drag-resize handles".', 'done', 'medium', NULL, NULL, NULL, '2026-05-17 18:48:14', '2026-05-18 07:43:45', NULL, '594d1cbcc8daa115246e2398d9ba9506', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-119', 'task', 'T-99', 'clide panel resize CLI verb (split from T-111)', 'Once T-99 lands an IPC dispatch path, register a ''panel.resize'' command that takes <slot> and <delta-or-absolute> args and calls LayoutArrangement.setSize / setEditorRatio. Keyboard parity already landed in T-111; this completes user/Claude parity per D-6.', 'backlog', 'low', NULL, NULL, NULL, '2026-05-18 07:43:50', '2026-05-18 07:43:50', NULL, '29df32cde1a30168a27b763f5e6ce81d', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-120', 'task', 'T-97', 'typed IPC command schema framework (split from T-104)', 'T-104 covered the spot-fixes (argv-injection rejection, size/count caps on specific commands). What remains is the framework piece: a typed schema per IPC command — branch/remote/path/etc. with regex/charset constraints — applied at DaemonDispatcher dispatch time rather than scattered through individual handlers.
+
+This needs design before code:
+- Where the schema lives (per-handler? a central registry?)
+- How it composes with the IpcRequest envelope
+- Whether it generates the existing handler boilerplate or wraps it
+- Coordination with T-99''s IPC architecture decision (if we go socket-server, the schema becomes the wire contract)
+
+Source: consultants.md "Security — Findings — [Major]" item 1.', 'backlog', 'medium', NULL, NULL, NULL, '2026-05-18 07:53:08', '2026-05-18 07:53:08', NULL, 'c2673e06e042bb418de9a99e8ab21c2b', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-104', 'task', 'T-97', 'schema-validate IPC argument surface; reject -prefixed values', '`DaemonDispatcher.dispatch` (`dispatcher.dart:26`) and `IpcRequest.fromJson` (`envelope.dart:49`) do no schema validation. No size limit on `files.read`, no count cap on `git.log`. `git diff`/`stage` use `--` separators (good), but `checkout(branch)` and `push(remote, branch)` (`git_commands.dart:240`) do not — argument injection (e.g. `git checkout --upload-pack=...`) is possible.
+
+**Fix:**
+1. Typed schema per IPC command (`branch`, `remote`, `path`, etc. with regex / charset constraints).
+2. Size + count bounds on `files.read`, `git.log`, `git.diff`.
+3. Either reject `-`-prefixed values for branch/remote/path args, or use `--` everywhere (including `checkout` and `push`).
+
+**Acceptance:** unit tests cover the rejection path for each injection vector listed.
+
+Source: consultants.md "Security — Findings — [Major]".', 'done', 'high', NULL, NULL, NULL, '2026-05-17 18:47:42', '2026-05-18 07:53:10', NULL, '688f888ba89cefe636ece09f32bea8ab', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-109', 'task', 'T-97', 'write CONTRIBUTING.md; cut interim release to drain Unreleased; merge duplicate changelog headings', 'Three docs items:
+
+1. **No `CONTRIBUTING.md`.** Build/test story is scattered across `CLAUDE.md` (Claude-addressed), `README.md` (partly wrong — see T-101), and Makefile help. Write a human-addressed contributor guide: clone → `make hooks && flutter pub get` → `make test` → DQR workflow → commit conventions.
+2. **CHANGELOG has duplicate subsection headings in `[Unreleased]`** — three `### Changed`, two `### Fixed`, two `### Removed` in the 2.0.0 section. Keep a Changelog 1.1.0 expects one of each per release. Merge.
+3. **~80-commit Unreleased backlog** undermines the format. Cut an interim release (`vX.Y.Z`) to drain it before continuing.
+
+Order matters: 2 → 3 → 1 (clean changelog, release, then doc the workflow).
+
+Source: consultants.md "Docs — Findings".', 'in_progress', 'medium', NULL, NULL, NULL, '2026-05-17 18:48:03', '2026-05-18 08:02:06', NULL, '01396c3a11fb562a859cdf76f933824c', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-121', 'task', 'T-97', 'cut interim release to drain Unreleased (split from T-109)', 'Item 3 of T-109. With CONTRIBUTING.md landed and [Unreleased] consolidated, the remaining piece is cutting an actual release so the ~80-commit Unreleased backlog drains into a dated heading.
+
+Per .claude/skills/git-commit/SKILL.md "Cutting a release":
+1. Move every [Unreleased] entry under a new `## [X.Y.Z] — YYYY-MM-DD` heading.
+2. Leave an empty [Unreleased] skeleton.
+3. Bump pubspec.yaml version: (drop the -dev suffix for the tag).
+4. Commit subject: `release vX.Y.Z`.
+
+Version pick is the user''s call — likely 2.1.0 given the scope since 2.0.0 (D-66 95% coverage gate, T-117 keymap, contrast-gate split, IPC hardening, panel-keyboard parity, etc.).
+
+Source: consultants.md "Docs — Findings" item 3.', 'backlog', 'medium', NULL, NULL, NULL, '2026-05-18 08:07:23', '2026-05-18 08:07:23', NULL, '74aa71a8c832231c1debb66c767cf490', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);
+INSERT INTO tickets (id, type, parent_id, title, description, status, priority, assigned_to, team, decision_ref, created_at, updated_at, deleted_at, hash, canonical_version) VALUES ('T-109', 'task', 'T-97', 'write CONTRIBUTING.md; cut interim release to drain Unreleased; merge duplicate changelog headings', 'Three docs items:
+
+1. **No `CONTRIBUTING.md`.** Build/test story is scattered across `CLAUDE.md` (Claude-addressed), `README.md` (partly wrong — see T-101), and Makefile help. Write a human-addressed contributor guide: clone → `make hooks && flutter pub get` → `make test` → DQR workflow → commit conventions.
+2. **CHANGELOG has duplicate subsection headings in `[Unreleased]`** — three `### Changed`, two `### Fixed`, two `### Removed` in the 2.0.0 section. Keep a Changelog 1.1.0 expects one of each per release. Merge.
+3. **~80-commit Unreleased backlog** undermines the format. Cut an interim release (`vX.Y.Z`) to drain it before continuing.
+
+Order matters: 2 → 3 → 1 (clean changelog, release, then doc the workflow).
+
+Source: consultants.md "Docs — Findings".', 'done', 'medium', NULL, NULL, NULL, '2026-05-17 18:48:03', '2026-05-18 08:07:23', NULL, '7c1f64a5aef6e3e92157691a2b192beb', 1) ON CONFLICT(id) DO UPDATE SET type=excluded.type, parent_id=excluded.parent_id, title=excluded.title, description=excluded.description, status=excluded.status, priority=excluded.priority, assigned_to=excluded.assigned_to, team=excluded.team, decision_ref=excluded.decision_ref, updated_at=excluded.updated_at, deleted_at=excluded.deleted_at, hash=excluded.hash, canonical_version=excluded.canonical_version WHERE excluded.updated_at > tickets.updated_at OR (excluded.updated_at = tickets.updated_at AND excluded.hash > tickets.hash);

CHANGELOG.md

@@ -16,77 +16,94 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
 
 ## [Unreleased]
 
+### Added
+
+### Changed
+
+### Deprecated
+
 ### Removed
 
-- **`bin/clide.dart` + `DaemonServer`** — completing the D-56 dissolution.
-  The separate daemon process was dissolved on 2026-04-23 but the entry
-  point and socket server class were never actually deleted. Gone now,
-  along with orphaned tests (`test/cli/`, `test/daemon/subprocess_test`,
-  `test/daemon/in_process_test`), stale i18n strings, and "start
-  `clide --daemon`" error messages.
-- **`ptyc/` source tree + `PtySession` + `scm_rights.dart`** — PTY
-  spawning migrated to Dart FFI `forkpty()` (`NativePty`) but the old
-  C helper and its Dart wiring were never cleaned up. Removed from
-  toolchain resolution, `ToolCheck` gate, backend serialization,
-  testmode harness, CI scripts, Makefile, and sandbox entitlements.
-  D-5 amended to record the retirement.
-- CI golden images (`test/goldens/goldens/ci/`) — Skia anti-aliasing
-  of geometric shapes differs between macOS and Linux even with the
-  Ahem font, so a single set of CI goldens can't serve both platforms.
-  Replaced with platform-keyed goldens (`goldens/linux/`,
-  `goldens/macos/`), each only compared on its own OS.
+### Fixed
+
+### Security
+
+## [2.1.0] — 2026-05-18
 
 ### Added
 
+- Contrast gate split — baseline `canonicalPairs` every theme passes,
+  strict `extendedPairs` (muted/status/syntax/focus-border) gated to
+  `-hc` / `-cb` variants. Ships `clide-hc`, `midnight-hc`, `paper-hc`,
+  `terminal-hc` siblings of the named themes (D-69, T-114, T-118).
 - Pre-push coverage gate — `make push-check` runs `ci/coverage_gate.sh`,
   which fails if total line coverage drops below `coverage_floor:` in
   `pubspec.yaml`. Floor ratchets up only; target 95% (D-66).
 - Pre-push changelog gate — `ci/changelog_gate.sh` fails on any
-  `## [Unreleased]` bullet over 60 words; warns at 40. Enforces the
-  Keep-a-Changelog conciseness rule in the git-commit skill.
+  `## [Unreleased]` bullet over 60 words. Enforces the Keep-a-Changelog
+  conciseness rule in the git-commit skill.
+- Keymap layer (`KeymapService`) — typed Intents, YAML presets,
+  VS-Code-style when-clauses, layered preset → user file → settings
+  overlay. Default preset ships; vim/vscode/jetbrains unblocked
+  (T-117, supersedes T-110).
+- Keyboard operability — `ClideTappable` is now Tab-focusable with a
+  focus ring and Enter/Space activation; `ClidePalette` adds arrow
+  nav, Escape dismiss, and selection highlight (T-100).
+- Panel-to-panel focus traversal — each `SlotHost` wraps in a
+  `FocusScope` + `FocusTraversalGroup`; `F6` / `Shift+F6` cycle
+  sidebar → workspace → context. `FocusTracker` integrates with
+  Flutter focus rather than paralleling it (T-105).
+- Event-driven test waits — PTY + watcher tests await stream events
+  instead of fixed sleeps; `onTimeout` callbacks now `fail()` loudly
+  with diagnostic context. `RecordingEventSink` exposes a broadcast
+  stream for the same pattern (T-108).
+- Code-quality cleanups — `TreeSitterLib` exposes a last-error
+  diagnostic instead of swallowing dlopen failures; `ExtensionManager`
+  surfaces a `failedExtensions` map for UI degradation; PTY constants
+  consolidated in `libc.dart` + `PosixErrno`; `test_app.dart` gated
+  behind `kDebugMode` (T-112).
 - Test sweep — `keybindings`, `toolchain_paths`, and several
   `widgets/src/` primitives (tooltip, palette, multitab, markdown).
 - `tree_sitter_service` sweep — fake-FFI + real-library smoke,
   17% → 96%. Crosses the 95% global target (T-91).
 - Staged `dart doc` CI job — generates and uploads an HTML API
   reference for the public `lib/` surface. The step wraps
-  `dart doc --validate-links` and grep-fails the build on any warning,
-  so broken doc refs and dangling links can't accumulate. Inert with
-  the rest of the workflow until Gitea Actions activates.
+  `dart doc --validate-links` and grep-fails the build on any warning.
+  Inert with the rest of the workflow until Gitea Actions activates.
 - Mouse wheel scrolling in Claude pane — converts scroll events to
-  PgUp/PgDown so Claude Code (and other TUI apps) scroll their
-  history naturally.
+  PgUp/PgDown so TUI apps scroll their history naturally.
 - Welcome screen Tips card — six common keybindings shown below the
   START / RECENT row when the viewport is tall enough.
 - `MultitabPane` widget + `MultitabController` for panes that host
   N runtime tab instances of the same kind. Generic over a payload
-  type, supports pinned/non-closeable tabs (primary), drag-reorder,
-  close × on hover, and an optional `+` add button. Used by the
-  Claude pane to render primary + secondaries.
-- `MultitabPane.keepAlive` mode — when set, all entry bodies stay
-  mounted via IndexedStack so switching tabs preserves their state
-  (PTY connections, scroll position, etc.).
-
-### Fixed
-
-- `TerminalView.onTapUp` now actually fires on primary tap — was
-  wired to a dead code path (T-93). Dead `onTapUp` surface on
-  `TerminalGestureHandler` / `TerminalGestureDetector` removed.
-- `BufferLine.eraseRange` no longer panics when called with `end == 0`.
-  The right-side wide-char guard read `_data[-1]` via `getWidth(-1)`,
-  which threw a `RangeError`. Real trigger path: `Terminal.eraseDisplayAbove`
-  with the cursor at column 0 — common after `ESC[H\x1b[1J`
-  (home + erase-above) sequences that many TUIs emit on redraw.
-- Terminal selections no longer vanish when resizing narrower —
-  reflow's tail-anchor handler left anchors detached past the
-  trimmed range. Common triggers: Ctrl+A then resize, drag past a
-  partially-filled line (T-92).
-- `BufferLine.removeCells` / `insertCells` / `dispose` no longer skip
-  anchors due to concurrent list modification during iteration —
-  iteration now snapshots the list first (T-91).
+  type, supports pinned/non-closeable tabs, drag-reorder, close × on
+  hover, and an optional `+` add button.
+- `MultitabPane.keepAlive` mode — entry bodies stay mounted via
+  IndexedStack so switching tabs preserves their state (PTY
+  connections, scroll position, etc.).
+- `CONTRIBUTING.md` — human-addressed contributor guide covering
+  clone / build / test / DQR / tickets / commit conventions. The
+  `[Unreleased]` section is reorganised to one subsection per kind
+  per Keep a Changelog 1.1.0 (T-109).
+- `make verify` — no-tests sweep (analyze + format + decisions +
+  changelog gate). For mid-edit checks; `make push-check` stays the
+  full pre-push pipeline.
 
 ### Changed
 
+- Window-control close-button red, white close glyph, and palette
+  ambient shadow are now tokens (`windowControl.closeHover*`,
+  `shadow.ambient`) instead of hard-coded hex. Light themes get a
+  softer ink-tinted shadow (T-114).
+- Text-zoom (Ctrl +/-/0) is now a kernel `TextZoom` service and shows
+  up in the palette as `View: Zoom In/Out/Reset Zoom` (T-114).
+- Panel splitters (sidebar / context / editor-split) are tab-focusable;
+  arrow keys nudge by 10 px, Shift+arrow by 50 px (2% / 10% for the
+  editor split). Exposed as slider Semantics nodes so screen readers
+  announce the current size. CLI verb deferred to T-99 (T-111).
+- Changelog gate is binary — dropped the soft 40-word warning, kept
+  the 60-word hard cap. Warnings that never blocked just normalised
+  drift.
 - PTY spawning uses `posix_openpt` + `posix_spawn` instead of
   `forkpty` — closes a ~5% deadlock window in the multithreaded Dart
   VM (T-96, D-5 amended). Missing exe/cwd now throw `PtyException` at
@@ -95,102 +112,121 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
 - `TreeSitterService` and `TreeSitterLib` accept injectable FFI + asset
   loaders for fake-driven tests; production paths unchanged.
 - Tidied test imports flagged by `unnecessary_import`.
-- `README.md` rewritten to match current architecture; `docs/initial-plan.md`
-  bannered as historical; new `docs/architecture.md` describes today's
-  shape (T-101).
+- `README.md` rewritten to match current architecture;
+  `docs/initial-plan.md` bannered as historical; new
+  `docs/architecture.md` describes today's shape (T-101).
 - `SchedulerService._stopTicker` now awaits the in-flight isolate spawn
   before killing — closes the same race shape we fixed in PTY (T-106).
 - `make push-check-full` added — runs `push-check` plus integration +
   smoke for pre-release checks. Integration tests skip the hanging
-  theme_picker case (T-116) until that's fixed (T-103).
+  theme_picker case until that's fixed (T-103, T-116).
 - Governance bookkeeping: D-66 amended (floor at `coverage_floor:` in
   `pubspec.yaml`); `licenses.yaml` reconciled with `pubspec.yaml`;
   Q-1/Q-2/Q-3/Q-25 triaged; `.claude/skills/README.md` inventory
   added; `--no-fatal-infos` dropped from `ci/test.sh` (T-113).
-- Terminal panes now render bold attributes with a real bold weight —
-  bundled JetBrainsMono Bold + BoldItalic are registered with the
+- Terminal panes render bold attributes with a real bold weight —
+  bundled JetBrainsMono Bold + BoldItalic registered with the
   `JetBrainsMono` family at `weight: 700`. The painter's bold
-  suppression workaround (added when only Regular + Italic were wired
-  and Flutter's synthetic bold drifted advance widths) is gone.
+  suppression workaround is gone.
 - Claude pane uses `MultitabPane` for primary + secondaries — drops
   ~100 lines of bespoke tab-strip code, gains drag-to-reorder.
 - UI spacing constants live in `lib/widgets/src/spacing.dart` —
   `clideInset*` for paddings, `clideGap*` for sibling distances,
-  `clideIcon*` / `clideControlHeight` for control sizes. Inline
-  pixel literals replaced where they were repeated.
-
-### Changed
-
+  `clideIcon*` / `clideControlHeight` for control sizes.
 - Tagline reads "IDE for Claude Code CLI" everywhere (welcome
   subtitle, README, CLAUDE.md, pubspec, web manifest, CLI banner).
-
-### Fixed
-
-- Closing a secondary Claude pane tab now kills its tmux session
-  on the clide socket, honouring D-41's "closing a secondary kills
-  that tmux session" lifecycle. Previously `pane.close` only killed
-  the ptyc-spawned tmux client and the server-side session leaked.
-- Cold-start reap: every clide launch kills any leftover secondary
-  tmux sessions for the current repo before spawning new ones, so
-  D-41's "secondary numbering resets between runs" holds even after
-  an abrupt previous exit (kill -9, crash, force-quit).
-- `claude.kill-all-sessions` command now actually kills the
-  server-side tmux sessions for the repo, not just the panes.
-- Terminal cell grid no longer drifts on bold text — bold rendering
-  is suppressed at the painter level since synthetic bold (with no
-  Bold.ttf registered) shifts glyph advance widths.
-- PTY surfaces errno on `forkpty` / `write` / `ioctl` failures
-  instead of swallowing. `execve` failures write a diagnostic to
-  the slave before `_exit`. `NativePty.write` and `PtySession.write`
-  loop on short writes; both throw `PtyException` on hard errors.
-- PTY teardown order fixed — kill child first so the master fd
-  returns EOF, await reader isolate exit, then close the fd.
-  Closing earlier could briefly target a reused fd.
-- Reader isolate spawn errors in `NativePty` / `PtySession` are now
-  surfaced via the output stream instead of silently dropped.
-  `_recvFdAsync` no longer leaks the `ReceivePort` on spawn throw;
-  `PtySession.spawn` closes the master fd if any post-receive step
-  fails.
-- IPC server hardening: per-request 60s timeout (configurable),
-  broadcast/response write failures logged instead of swallowed,
-  client dropped on response-write failure, and the stale-socket
-  retry now probes for a live daemon before unlinking the socket
-  (refusing to start if one answers).
-- `pane.spawn` and `editor.open` now map POSIX errno values to
-  actionable IPC error kinds. ENOENT → `not_found`, EACCES/EPERM
-  → `user_error` with a permissions hint, EISDIR/ENOTDIR/EEXIST
-  → distinct user-error/conflict, EMFILE/ENFILE → `tool_error`
-  with a "fd limit hit" hint. Previously every spawn/open failure
-  was an indistinguishable `tool_error`.
-
-### Security
-
-- Toolchain no longer resolves the dugite git binary against the open
-  workspace — a malicious repo could plant `native/dugite/bin/git`
-  and clide would run it on auto-fired `git.status`. Dugite now
-  resolves against the install dir + `CLIDE_DUGITE_DIR` env override
-  only (T-98).
-- `files.read` and `files.ls` now reject symlinks whose targets live
-  outside the workspace — closes a path-safety bypass via in-repo
-  symlinks (T-102).
-- `files.read` and `files.ls` now reject paths that resolve outside
-  the workspace root. Previously a relative path containing `..`
-  could read arbitrary files via path traversal.
-
-### Changed
-
 - Inline terminal emulator based on xterm.dart v4.0.0 — replaces the
   pub.dev dependency with owned code under `lib/src/terminal/`. Drops
   three transitive dependencies (xterm, quiver, zmodem).
 - Bundle clide-specific tmux.conf for Claude pane sessions: no status
   bar, 50k scrollback, mouse on, zero escape delay, isolated socket.
 - Claude pane spawns `claude` directly inside tmux with
-  `CLAUDE_CODE_NO_FLICKER=1` to enable Claude's fullscreen TUI mode
-  (input box pinned at the bottom).
-- PTY read buffer increased from 4KB to 64KB.
-- Terminal view 2px padding on all sides.
-- Remove bold JetBrains Mono font registration to prevent glyph width
-  mismatch in terminal rendering.
+  `CLAUDE_CODE_NO_FLICKER=1` to enable Claude's fullscreen TUI mode.
+- PTY read buffer increased from 4 KB to 64 KB.
+- Terminal view 2 px padding on all sides.
+
+### Removed
+
+- **`bin/clide.dart` + `DaemonServer`** — completing the D-56
+  dissolution. The separate daemon process was dissolved on 2026-04-23
+  but the entry point and socket server class were never deleted.
+  Gone now, along with orphaned tests, stale i18n strings, and
+  "start `clide --daemon`" error messages.
+- **`ptyc/` source tree + `PtySession` + `scm_rights.dart`** — PTY
+  spawning migrated to Dart FFI `forkpty()` (`NativePty`) but the old
+  C helper and its Dart wiring were never cleaned up. Removed from
+  toolchain resolution, `ToolCheck` gate, backend serialization,
+  testmode harness, CI scripts, Makefile, and sandbox entitlements.
+  D-5 amended to record the retirement.
+- CI golden images (`test/goldens/goldens/ci/`) — Skia anti-aliasing
+  of geometric shapes differs between macOS and Linux even with the
+  Ahem font. Replaced with platform-keyed goldens (`goldens/linux/`,
+  `goldens/macos/`).
+- Bold JetBrains Mono font registration that prevented glyph-width
+  mismatch in terminal rendering — superseded by the Bold/BoldItalic
+  re-registration above.
+
+### Fixed
+
+- `TerminalView.onTapUp` now actually fires on primary tap — was
+  wired to a dead code path (T-93). Dead `onTapUp` surface on
+  `TerminalGestureHandler` / `TerminalGestureDetector` removed.
+- `BufferLine.eraseRange` no longer panics when called with `end == 0`.
+  Real trigger: `Terminal.eraseDisplayAbove` with the cursor at
+  column 0 — common after `ESC[H\x1b[1J` (home + erase-above).
+- Terminal selections no longer vanish when resizing narrower —
+  reflow's tail-anchor handler left anchors detached past the
+  trimmed range. Common triggers: Ctrl+A then resize, drag past a
+  partially-filled line (T-92).
+- `BufferLine.removeCells` / `insertCells` / `dispose` no longer skip
+  anchors due to concurrent list modification during iteration —
+  iteration now snapshots the list first (T-91).
+- Closing a secondary Claude pane tab now kills its tmux session on
+  the clide socket, honouring D-41's lifecycle. Previously
+  `pane.close` only killed the ptyc-spawned tmux client.
+- Cold-start reap: every clide launch kills any leftover secondary
+  tmux sessions for the current repo before spawning new ones, so
+  D-41's "secondary numbering resets between runs" holds.
+- `claude.kill-all-sessions` command now actually kills the
+  server-side tmux sessions for the repo, not just the panes.
+- Terminal cell grid no longer drifts on bold text — bold rendering
+  is suppressed at the painter level since synthetic bold (with no
+  Bold.ttf registered) shifts glyph advance widths.
+- PTY surfaces errno on `forkpty` / `write` / `ioctl` failures
+  instead of swallowing. `execve` failures write a diagnostic to the
+  slave before `_exit`. `NativePty.write` and `PtySession.write`
+  loop on short writes; both throw `PtyException` on hard errors.
+- PTY teardown order fixed — kill child first so the master fd
+  returns EOF, await reader isolate exit, then close the fd.
+- Reader isolate spawn errors in `NativePty` / `PtySession` are now
+  surfaced via the output stream instead of silently dropped.
+  `_recvFdAsync` no longer leaks the `ReceivePort` on spawn throw.
+- IPC server hardening: per-request 60s timeout (configurable),
+  broadcast/response write failures logged instead of swallowed,
+  client dropped on response-write failure, and the stale-socket
+  retry now probes for a live daemon before unlinking the socket.
+- `pane.spawn` and `editor.open` map POSIX errno values to actionable
+  IPC error kinds (ENOENT → `not_found`, EACCES/EPERM → `user_error`,
+  EISDIR/ENOTDIR/EEXIST → distinct kinds, EMFILE/ENFILE →
+  `tool_error` with an fd-limit hint).
+
+### Security
+
+- IPC: `git.checkout`, `git.push` reject branch/remote args starting
+  with `-` (closes the `--upload-pack=...` argv-injection vector).
+  `files.read` rejects files over 10 MB. `git.log` caps `count` at
+  1000; `git.diff` / `git.stage` cap paths at 256 (T-104).
+- Toolchain no longer resolves the dugite git binary against the open
+  workspace — a malicious repo could plant `native/dugite/bin/git`
+  and clide would run it on auto-fired `git.status`. Dugite now
+  resolves against the install dir + `CLIDE_DUGITE_DIR` env override
+  only (T-98).
+- `files.read` and `files.ls` reject symlinks whose targets live
+  outside the workspace — closes a path-safety bypass via in-repo
+  symlinks (T-102).
+- `files.read` and `files.ls` reject paths that resolve outside the
+  workspace root. Previously a relative path containing `..` could
+  read arbitrary files via path traversal.
 
 ## [2.0.0] — 2026-05-03
 

CONTRIBUTING.md

@@ -0,0 +1,152 @@
+# Contributing to clide
+
+clide is an IDE for the Claude Code CLI, built as a single Flutter
+package at the repo root. This guide is for people working on clide
+itself.
+
+For day-to-day model-driven work in the codebase, see
+[`CLAUDE.md`](CLAUDE.md) — it documents the same guardrails from the
+agent's point of view and is the place to look for "why is the code
+shaped like this?"
+
+## One-time setup
+
+```
+git clone git@github.com:postmeridiem/clide.git
+cd clide
+make hooks && flutter pub get
+```
+
+`make hooks` installs the repo's git hooks (pre-commit + post-merge).
+Flutter must be on the stable channel and on `$PATH`.
+
+If you haven't used [pql](https://github.com/postmeridiem/pql) before,
+install it and run `pql init` once in the repo root. pql is a hard
+dependency for the governance + ticket workflow described below.
+
+## The five commands you'll actually use
+
+```
+make run           # launch the desktop app
+make verify        # no-tests sweep — analyze + format + decisions + changelog gate
+make test          # fast suite — analyze + format + unit + widget + golden
+make test-a11y     # WCAG-AA contrast + keyboard traversal contracts
+make push-check    # the pre-push gate; what CI runs
+make build-linux   # release artefact for the host platform
+```
+
+`make verify` is the lightweight "are the gates green?" check for
+mid-edit iteration. `make push-check` is the full pre-push pipeline
+(verify + every test suite + coverage gate).
+
+`make` with no target prints the full list. `make test-integration`
+boots a real app process and is slow; reserve it for the rare change
+that touches startup wiring.
+
+The pre-push hook runs `make push-check` automatically. Don't bypass
+it with `--no-verify` — fix the underlying issue and create a new
+commit. Pre-push includes:
+
+- `flutter analyze` (zero warnings)
+- `dart format --set-exit-if-changed`
+- the fast unit/widget/golden suites
+- accessibility contract tests
+- a coverage floor read from `coverage_floor:` in `pubspec.yaml`
+  (currently 95 %; ratchets up only — see
+  [D-66](governance/decisions/testing.md#d-66))
+- `CHANGELOG.md` `[Unreleased]` bullets ≤ 60 words each
+
+## Decisions, questions, rejected (DQR)
+
+clide tracks architectural commitments as durable records under
+[`governance/`](governance/):
+
+- `decisions/<domain>.md` — confirmed decisions (`D-NNN`)
+- `questions/<domain>.md` — open questions (`Q-NNN`)
+- `rejected/<domain>.md` — rejected proposals (`R-NNN`)
+
+When you make a non-trivial architectural choice, write it down:
+
+```
+pql decisions claim D <domain> "short title"
+```
+
+This reserves a fresh ID and tells you where to add the record. The
+[governance/README.md](governance/README.md) explains the format and
+the recommended domain list.
+
+Pre-push validates that every `D-NNN` / `Q-NNN` / `R-NNN` link in
+the docs and code resolves to an actual record (`pql decisions
+validate`). Broken references fail the build.
+
+## Tickets
+
+All non-trivial work is tracked in `pql ticket`:
+
+```
+pql ticket list --status in_progress
+pql ticket show T-NNN[,T-NNN…]      # batch form on pql 1.4.33+
+pql ticket new task "title" --parent T-NNN --priority medium
+pql ticket status T-NNN in_progress
+pql ticket status T-NNN done
+```
+
+A ticket exists for any change a reviewer might want to ask "why?"
+about. Bug fixes, refactors, and consultant findings all become
+tickets before the diff lands. Trivial typo fixes don't need one.
+
+## Commit conventions
+
+See [D-37](governance/decisions/process.md#d-37) and the bundled
+[`git-commit` skill](.claude/skills/git-commit/SKILL.md). In short:
+
+- Imperative subject ≤ 70 chars, no Conventional Commits prefix
+  (this isn't a Conventional Commits repo — the archived Python
+  predecessor under [`legacy/`](legacy/) is, but the rebuild isn't).
+- One logical change per commit. If the subject needs "and", split it.
+- Every user-visible commit adds an entry to `CHANGELOG.md` under
+  `[Unreleased]` in the right subsection (Added, Changed, Deprecated,
+  Removed, Fixed, Security). Keep entries to one or two short
+  sentences — the 60-word cap is enforced by `ci/changelog_gate.sh`.
+- Co-author trailer:
+  `Co-Authored-By: Claude <noreply@anthropic.com>` when Claude wrote
+  any of the diff.
+
+Never `--amend` a commit unless explicitly asked. Never force-push
+to `main`. Never `git add -A` / `git add .` when staging — name
+files explicitly so stray secrets or build artefacts don't sneak in.
+
+## Cutting a release
+
+A release is a single commit:
+
+1. Move all `## [Unreleased]` entries under a new `## [X.Y.Z] —
+   YYYY-MM-DD` heading.
+2. Leave an empty `## [Unreleased]` skeleton at the top.
+3. Bump `pubspec.yaml` `version:` to `X.Y.Z` (no `-dev` suffix on
+   the release tag; add it back on the next development commit if
+   you like).
+4. Commit subject: `release vX.Y.Z`.
+
+`pubspec.yaml` is the single source of truth for the version — the
+Makefile reads it for ldflag stamping and the app reads it for build
+info.
+
+## What goes where
+
+- **Bug, feature, sweep:** file/claim a ticket, branch, code, test,
+  commit, push. Push triggers `make push-check`.
+- **Architectural decision:** `pql decisions claim`, write the
+  record, then file the implementation ticket linked via
+  `decision_ref`.
+- **Open question:** drop a `Q-NNN` under
+  `governance/questions/<domain>.md`. Triage later.
+- **Rejected proposal:** drop an `R-NNN` under
+  `governance/rejected/<domain>.md`. Future-you (or a reviewer)
+  will be glad it's written down.
+
+## Reporting issues
+
+The public issue tracker lives at
+<https://github.com/postmeridiem/clide/issues>. The Gitea mirror is
+read-only.

Makefile

@@ -79,6 +79,9 @@ analyze: ## flutter analyze.
 format: ## dart format --set-exit-if-changed.
 	dart format --set-exit-if-changed .
 
+.PHONY: verify
+verify: analyze format decisions-validate changelog-gate ## No-tests sweep — analyze + format + decisions-validate + changelog-gate. For mid-edit "are the gates green?" checks; `push-check` is the full pre-push pipeline.
+
 .PHONY: test
 test: ## Fast: analyze + format + unit + widget + golden (<60s).
 	ci/test.sh

README.md

@@ -45,6 +45,7 @@ Pre-v2.0 (`2.0.0-dev`). Interaction model and panel system landed. The Python Te
 ## Documentation
 
 - [`docs/architecture.md`](docs/architecture.md) — current architecture (read this first).
+- [`CONTRIBUTING.md`](CONTRIBUTING.md) — how to clone, build, test, file tickets, and write D-records.
 - [`docs/initial-plan.md`](docs/initial-plan.md) — historical design doc; preserved as a snapshot of the 2026-04 plan, much of it now superseded.
 - [`governance/decisions/`](governance/decisions/) — confirmed decisions (`D-NNN`), open questions (`Q-NNN`), rejected alternatives (`R-NNN`).
 - [`CLAUDE.md`](CLAUDE.md) — Claude-addressed working notes (guardrails, repo layout).

assets/keymaps/default.yaml

@@ -0,0 +1,64 @@
+# clide default keymap.
+#
+# This is the baseline preset. Vim / VSCode / JetBrains presets are
+# their own files (T-64/T-65/T-66) and replace bindings via the same
+# YAML shape.
+#
+# Each binding:
+#   intent: <stable intent id>          # see kernel/src/keymap/intents.dart
+#   keys:   <chord>  | [<chord>, ...]   # `ctrl+shift+p`, `cmd+enter`, ...
+#   when:   <when-clause>               # optional; VS-Code-style boolean expr
+#
+# Identifiers in `when:` are scope flags published by producing
+# services (e.g. `palette.open` when ClidePalette is mounted +
+# visible). Missing flags evaluate to false.
+
+name: default
+
+bindings:
+  # -- Activation / focus -----------------------------------------------
+  # ActivateIntent has no when-clause: it dispatches via Actions.maybeInvoke
+  # against the focused context, so only widgets that opt in (ClideTappable's
+  # Actions wrapper) actually catch it. Text-input widgets handle Enter
+  # themselves first.
+  - intent: activate
+    keys: [enter, space]
+  - intent: dismiss
+    keys: escape
+  - intent: focus.next
+    keys: tab
+  - intent: focus.previous
+    keys: shift+tab
+
+  # Panel-to-panel cycling (sidebar → workspace → context).
+  # VS Code convention.
+  - intent: focus.nextPanel
+    keys: f6
+  - intent: focus.previousPanel
+    keys: shift+f6
+
+  # -- Command palette --------------------------------------------------
+  - intent: palette.open
+    keys: [ctrl+shift+p, meta+shift+p]
+  - intent: palette.selectNext
+    keys: [down, ctrl+n]
+    when: palette.open
+  - intent: palette.selectPrevious
+    keys: [up, ctrl+p]
+    when: palette.open
+  - intent: palette.accept
+    keys: enter
+    when: palette.open
+  - intent: dismiss
+    keys: escape
+    when: palette.open
+
+  # -- Text scale -------------------------------------------------------
+  # On most layouts `+` is `shift+equal`; we bind both so users who
+  # think of it as Ctrl+Plus and users who hit Ctrl+= both work.
+  - intent: text.scaleIncrease
+    keys: [ctrl+equal, ctrl+shift+equal, meta+equal, meta+shift+equal]
+  - intent: text.scaleDecrease
+    keys: [ctrl+minus, meta+minus]
+  - intent: text.scaleReset
+    keys: [ctrl+0, meta+0]

ci/changelog_gate.sh

@@ -1,15 +1,14 @@
 #!/usr/bin/env bash
-# CHANGELOG concision gate — enforces the per-bullet word caps from the
-# git-commit skill (40 soft, 60 hard) across the `## [Unreleased]`
-# section. Released sections are frozen and skipped (don't penalize
-# historical entries pre-dating the rule).
+# CHANGELOG concision gate — enforces a single 60-word per-bullet hard
+# cap on the `## [Unreleased]` section. Released sections are frozen
+# and skipped (don't penalize historical entries pre-dating the rule).
 #
 # A "bullet" is a markdown list item beginning with `- `, including any
 # indented continuation lines until the next bullet, blank line, or
 # heading. Word count is whitespace-tokenized.
 #
-# Soft cap 40 → warn (non-zero exit only if HARD is also breached).
-# Hard cap 60 → fail.
+# A soft 40-word warning was tried earlier and dropped — warnings that
+# never block a push just normalise drift, so the gate is now binary.
 #
 # Bypass: never. If the rule rejects something genuinely user-visible
 # that needs more context, the context belongs in the commit body or a
@@ -18,7 +17,6 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 CHANGELOG=CHANGELOG.md
-SOFT_CAP=40
 HARD_CAP=60
 
 if [[ ! -f "$CHANGELOG" ]]; then
@@ -26,24 +24,18 @@ if [[ ! -f "$CHANGELOG" ]]; then
   exit 2
 fi
 
-awk -v soft="$SOFT_CAP" -v hard="$HARD_CAP" '
-  BEGIN { in_unreleased = 0; bullet = ""; bullet_start = 0; fail = 0; warn = 0 }
+awk -v hard="$HARD_CAP" '
+  BEGIN { in_unreleased = 0; bullet = ""; bullet_start = 0; fail = 0 }
 
   function check_bullet() {
     if (bullet == "") return
-    n = split(bullet, _words, /[[:space:]]+/)
-    # split() counts a trailing empty token when the string starts/ends with
-    # whitespace; trim the leading "- " marker too.
+    # Trim the leading "- " marker, then tokenize on whitespace.
     gsub(/^- +/, "", bullet)
     n = split(bullet, _words, /[[:space:]]+/)
     if (n > hard) {
-      printf "FAIL line %d: bullet is %d words (hard cap %d)\n", bullet_start, n, hard
+      printf "FAIL line %d: bullet is %d words (cap %d)\n", bullet_start, n, hard
       printf "    %s\n\n", substr(bullet, 1, 120) (length(bullet) > 120 ? "..." : "")
       fail++
-    } else if (n > soft) {
-      printf "WARN line %d: bullet is %d words (soft cap %d)\n", bullet_start, n, soft
-      printf "    %s\n\n", substr(bullet, 1, 120) (length(bullet) > 120 ? "..." : "")
-      warn++
     }
     bullet = ""
     bullet_start = 0
@@ -76,10 +68,6 @@ awk -v soft="$SOFT_CAP" -v hard="$HARD_CAP" '
       printf "    See .claude/skills/git-commit/SKILL.md \"Be concise\".\n"
       exit 1
     }
-    if (warn > 0) {
-      printf "==> changelog gate OK with %d warning(s) over %d words.\n", warn, soft
-    } else {
-      printf "==> changelog gate OK\n"
-    }
+    printf "==> changelog gate OK\n"
   }
 ' "$CHANGELOG"

governance/README.md

@@ -110,6 +110,7 @@ You might also want, project-permitting:
 - [D-66: Line coverage gate at 95%, ratcheted from current](decisions/testing.md#d-66-line-coverage-gate-at-95-ratcheted-from-current) — _testing_
 - [D-67: Pql changelog files are committed alongside code](decisions/process.md#d-67-pql-changelog-files-are-committed-alongside-code) — _process_
 - [D-68: Dual integration surface — Bash CLI primary, MCP secondary](decisions/architecture.md#d-68-dual-integration-surface--bash-cli-primary-mcp-secondary) — _architecture_
+- [D-69: published themes are user contracts; ship -hc variants for a11y](decisions/accessibility.md#d-69-published-themes-are-user-contracts-ship--hc-variants-for-a11y) — _accessibility_
 
 ## Open questions
 

governance/decisions/accessibility.md

@@ -23,6 +23,13 @@ A11y + i18n are Tier-0 contracts, not Tier-6 polish.
 - **Decision:** Every bundled theme must pass a WCAG-AA contrast check on its canonical token pairs (text/background, link/background, focus-ring/background) at test time. `ci/test_a11y.sh` runs the gate; CI fails on regressions.
 - **Rationale:** Themes drift under "looks nicer" tweaks; contrast regressions land silently. Running the gate on every PR is the cheapest insurance. Ran the gate on initial themes — caught one summer-night muted token at 2.81:1 (below AA), fixed before landing.
 - **Cost:** Third-party themes (Tier 6) won't be gated until an extension-time test hook lands. Bundled themes are gated today.
-- **Raised by:** 2026-04-21 planning.
+- **Raised by:** 2026-04-21 planning. Refined by [D-69](#d-69-published-themes-are-user-contracts-ship-hc-variants-for-a11y) — the gate's *strict* pair set only applies to high-contrast variants; named themes keep their published palettes.
+
+### D-69: published themes are user contracts; ship -hc variants for a11y
+- **Date:** 2026-05-17
+- **Decision:** The four bundled themes that ship under a recognisable name — `clide`, `midnight`, `paper`, `terminal` — are user contracts. Their palette colours (including syntax tokens, status colours, and borderHi) MUST NOT be retuned to satisfy contrast gates. When a stricter contrast check would fail one of them, the fix is one of: (a) ship a sibling theme with `-hc` (high-contrast) or `-cb` (colour-blind) in the name and enforce the strict pair set only there, or (b) split `canonicalPairs` into a *baseline* set every theme must pass and an *extended* set that only the `-hc`/`-cb` variants must pass.
+- **Rationale:** Users pick `midnight` because it looks like VS Code, `paper` because it reads as a drafting sheet, `terminal` because of the amber-on-near-black tmux feel. Quietly darkening `paper`'s success/warning/info or boosting `midnight`'s `borderHi` to pass a WCAG-AA check changes what they got and what they signed up for. A11y is a Tier-0 contract ([D-20](#d-20-a11y-is-a-tier-0-contract)), but it's served by *offering* an accessible variant, not by overwriting the aesthetic ones. VS Code itself ships `Default Dark+` and a separate `Default High Contrast` for exactly this reason.
+- **Cost:** Two extra theme files per "named" theme when we add a11y variants. The bundled-theme contrast gate ([D-22](#d-22-wcag-aa-contrast-gate-on-bundled-themes)) needs a baseline/extended split so the named themes don't fail the strict pairs.
+- **Raised by:** 2026-05-17 — user intervened mid-T-114 when I had retuned `clide`/`midnight`/`paper`/`terminal` palette entries to satisfy the expanded `canonicalPairs`; reverted, decision written, T-114 will follow this rule.
 
 ---

lib/app.dart

@@ -55,24 +55,23 @@ class _RootShell extends StatefulWidget {
 
 class _RootShellState extends State<_RootShell> {
   late final FocusNode _keyFocus;
-  double _textScale = 1.0;
-
-  static const double _scaleStep = 0.05;
-  static const double _scaleMin = 0.6;
-  static const double _scaleMax = 2.0;
 
   @override
   void initState() {
     super.initState();
     _keyFocus = FocusNode()..requestFocus();
+    widget.services.textZoom.addListener(_onZoom);
   }
 
   @override
   void dispose() {
+    widget.services.textZoom.removeListener(_onZoom);
     _keyFocus.dispose();
     super.dispose();
   }
 
+  void _onZoom() => setState(() {});
+
   @override
   Widget build(BuildContext context) {
     final tokens = ClideTheme.of(context).surface;
@@ -86,31 +85,77 @@ class _RootShellState extends State<_RootShell> {
         fontFamilyFallback: clideUiFamilyFallback,
       ),
       child: MediaQuery(
-        data: MediaQuery.of(context).copyWith(textScaler: TextScaler.linear(_textScale)),
-        child: KeyboardListener(
-          focusNode: _keyFocus,
-          autofocus: true,
-          onKeyEvent: _onKey,
-          child: ColoredBox(
-            color: tokens.globalBackground,
-            child: ClideResizeBorder(
-              windowControls: widget.services.window,
-              child: Column(
-                children: [
-                  _HatBar(kernel: widget.services),
-                  Expanded(
-                    child: DialogHost(
-                      router: widget.services.dialog,
-                      child: Stack(
-                        children: [
-                          const Positioned.fill(child: RootLayout()),
-                          const ClidePalette(),
-                          const Positioned.fill(child: _WelcomeOverlay()),
-                        ],
+        data: MediaQuery.of(context).copyWith(textScaler: TextScaler.linear(widget.services.textZoom.scale)),
+        child: Actions(
+          actions: <Type, Action<Intent>>{
+            TextScaleIncreaseIntent: CallbackAction<TextScaleIncreaseIntent>(
+              onInvoke: (_) {
+                widget.services.textZoom.increase();
+                return null;
+              },
+            ),
+            TextScaleDecreaseIntent: CallbackAction<TextScaleDecreaseIntent>(
+              onInvoke: (_) {
+                widget.services.textZoom.decrease();
+                return null;
+              },
+            ),
+            TextScaleResetIntent: CallbackAction<TextScaleResetIntent>(
+              onInvoke: (_) {
+                widget.services.textZoom.reset();
+                return null;
+              },
+            ),
+            InvokeCommandIntent: CallbackAction<InvokeCommandIntent>(
+              onInvoke: (intent) {
+                widget.services.commands.execute(intent.commandId);
+                return null;
+              },
+            ),
+            PaletteOpenIntent: CallbackAction<PaletteOpenIntent>(
+              onInvoke: (_) {
+                widget.services.palette.open();
+                return null;
+              },
+            ),
+            FocusNextPanelIntent: CallbackAction<FocusNextPanelIntent>(
+              onInvoke: (_) {
+                widget.services.focus.focusNextSlot();
+                return null;
+              },
+            ),
+            FocusPreviousPanelIntent: CallbackAction<FocusPreviousPanelIntent>(
+              onInvoke: (_) {
+                widget.services.focus.focusPreviousSlot();
+                return null;
+              },
+            ),
+          },
+          child: KeyboardListener(
+            focusNode: _keyFocus,
+            autofocus: true,
+            onKeyEvent: _onKey,
+            child: ColoredBox(
+              color: tokens.globalBackground,
+              child: ClideResizeBorder(
+                windowControls: widget.services.window,
+                child: Column(
+                  children: [
+                    _HatBar(kernel: widget.services),
+                    Expanded(
+                      child: DialogHost(
+                        router: widget.services.dialog,
+                        child: Stack(
+                          children: [
+                            const Positioned.fill(child: RootLayout()),
+                            const ClidePalette(),
+                            const Positioned.fill(child: _WelcomeOverlay()),
+                          ],
+                        ),
                       ),
                     ),
-                  ),
-                ],
+                  ],
+                ),
               ),
             ),
           ),
@@ -120,31 +165,14 @@ class _RootShellState extends State<_RootShell> {
   }
 
   void _onKey(KeyEvent event) {
-    if (event is KeyDownEvent || event is KeyRepeatEvent) {
-      final ctrl = HardwareKeyboard.instance.isControlPressed;
-      if (ctrl) {
-        if (event.logicalKey == LogicalKeyboardKey.equal || event.logicalKey == LogicalKeyboardKey.add) {
-          setState(() => _textScale = (_textScale + _scaleStep).clamp(_scaleMin, _scaleMax));
-          return;
-        }
-        if (event.logicalKey == LogicalKeyboardKey.minus) {
-          setState(() => _textScale = (_textScale - _scaleStep).clamp(_scaleMin, _scaleMax));
-          return;
-        }
-        if (event.logicalKey == LogicalKeyboardKey.digit0) {
-          setState(() => _textScale = 1.0);
-          return;
-        }
-      }
-    }
-    final binding = KeybindingResolver.fromKeyEvent(
-      event,
-      HardwareKeyboard.instance,
-    );
-    if (binding == null) return;
-    final commandId = widget.services.keybindings.commandFor(binding);
-    if (commandId == null) return;
-    widget.services.commands.execute(commandId);
+    final intent = widget.services.keymap.resolveEvent(event, HardwareKeyboard.instance);
+    if (intent == null) return;
+    // Dispatch the intent. Try the focused context first so feature
+    // widgets (palette, editor, …) get a chance to handle their own
+    // intents; fall back to the app root's Actions for global ones
+    // (text scale, generic command bridge).
+    final ctx = FocusManager.instance.primaryFocus?.context ?? context;
+    Actions.maybeInvoke(ctx, intent);
   }
 }
 
@@ -317,7 +345,7 @@ class _WinBtn extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    final hoverBg = isClose ? const Color(0xFFE81123) : tokens.listItemHoverBackground;
+    final hoverBg = isClose ? tokens.windowControlCloseHoverBackground : tokens.listItemHoverBackground;
     return ClideTappable(
       onTap: onTap,
       builder: (context, hovered, _) => Container(
@@ -325,7 +353,11 @@ class _WinBtn extends StatelessWidget {
         height: hatHeight,
         color: hovered ? hoverBg : null,
         alignment: Alignment.center,
-        child: ClideIcon(icon, size: 14, color: hovered && isClose ? const Color(0xFFFFFFFF) : tokens.chromeForeground),
+        child: ClideIcon(
+          icon,
+          size: 14,
+          color: hovered && isClose ? tokens.windowControlCloseHoverForeground : tokens.chromeForeground,
+        ),
       ),
     );
   }
@@ -719,66 +751,122 @@ class _NotARepoDialog extends StatelessWidget {
   }
 }
 
-class SlotHost extends StatelessWidget {
+class SlotHost extends StatefulWidget {
   const SlotHost({super.key, required this.slot});
   final SlotId slot;
 
+  @override
+  State<SlotHost> createState() => _SlotHostState();
+}
+
+class _SlotHostState extends State<SlotHost> {
+  late final FocusScopeNode _scope = FocusScopeNode(debugLabel: 'SlotScope:${widget.slot.value}');
+  FocusTracker? _tracker;
+
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    final kernel = ClideKernel.of(context);
+    if (!identical(_tracker, kernel.focus)) {
+      _tracker?.unregisterSlotScope(widget.slot, _scope);
+      _tracker = kernel.focus;
+      _tracker!.registerSlotScope(widget.slot, _scope);
+    }
+  }
+
+  @override
+  void dispose() {
+    _tracker?.unregisterSlotScope(widget.slot, _scope);
+    _scope.dispose();
+    super.dispose();
+  }
+
+  void _onFocusChange(bool hasFocus) {
+    if (!hasFocus || _tracker == null) return;
+    final kernel = ClideKernel.of(context);
+    final activeId = kernel.panels.activeTabIn(widget.slot);
+    if (activeId != null) {
+      _tracker!.setActive(slot: widget.slot, contributionId: activeId);
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     final kernel = ClideKernel.of(context);
     final tokens = ClideTheme.of(context).surface;
-    return ListenableBuilder(
-      listenable: Listenable.merge([kernel.panels, kernel.i18n]),
-      builder: (ctx, _) {
-        final tabs = kernel.panels.tabsFor(slot);
-        if (tabs.isEmpty) {
-          return Container(color: tokens.panelBackground);
-        }
-        final activeId = kernel.panels.activeTabIn(slot) ?? tabs.first.id;
-        final active = tabs.firstWhere(
-          (t) => t.id == activeId,
-          orElse: () => tabs.first,
-        );
+    return FocusScope(
+      node: _scope,
+      onFocusChange: _onFocusChange,
+      child: FocusTraversalGroup(
+        child: ListenableBuilder(
+          listenable: Listenable.merge([kernel.panels, kernel.i18n]),
+          builder: (ctx, _) {
+            final tabs = kernel.panels.tabsFor(widget.slot);
+            if (tabs.isEmpty) {
+              return Container(color: tokens.panelBackground);
+            }
+            final activeId = kernel.panels.activeTabIn(widget.slot) ?? tabs.first.id;
+            final active = tabs.firstWhere(
+              (t) => t.id == activeId,
+              orElse: () => tabs.first,
+            );
+            return _SlotBody(slot: widget.slot, tabs: tabs, active: active, activeId: activeId);
+          },
+        ),
+      ),
+    );
+  }
+}
 
-        if (slot == Slots.sidebar) {
-          return _SidebarSlot(
-            tabs: tabs,
-            active: active,
-            activeId: activeId,
-            onSelect: (id) => kernel.panels.activateTab(slot, id),
-          );
-        }
+class _SlotBody extends StatelessWidget {
+  const _SlotBody({required this.slot, required this.tabs, required this.active, required this.activeId});
+  final SlotId slot;
+  final List<TabContribution> tabs;
+  final TabContribution active;
+  final String activeId;
 
-        if (slot == Slots.contextPanel) {
-          return _ContextSlot(
-            tabs: tabs,
-            active: active,
-            activeId: activeId,
-            onSelect: (id) => kernel.panels.activateTab(slot, id),
-          );
-        }
+  @override
+  Widget build(BuildContext context) {
+    final kernel = ClideKernel.of(context);
+    final tokens = ClideTheme.of(context).surface;
 
-        if (slot == Slots.workspace) {
-          return _WorkspaceSlot(tabs: tabs, active: active);
-        }
+    if (slot == Slots.sidebar) {
+      return _SidebarSlot(
+        tabs: tabs,
+        active: active,
+        activeId: activeId,
+        onSelect: (id) => kernel.panels.activateTab(slot, id),
+      );
+    }
 
-        return Container(
-          color: tokens.panelBackground,
-          child: Column(
-            children: [
-              ClideTabBar(
-                items: [
-                  for (final t in tabs) ClideTabItem(id: t.id, title: _resolveTitle(ctx, t)),
-                ],
-                activeId: active.id,
-                onSelect: (id) => kernel.panels.activateTab(slot, id),
-              ),
-              ClideDivider(),
-              Expanded(child: active.build(ctx)),
+    if (slot == Slots.contextPanel) {
+      return _ContextSlot(
+        tabs: tabs,
+        active: active,
+        activeId: activeId,
+        onSelect: (id) => kernel.panels.activateTab(slot, id),
+      );
+    }
+
+    if (slot == Slots.workspace) {
+      return _WorkspaceSlot(tabs: tabs, active: active);
+    }
+
+    return Container(
+      color: tokens.panelBackground,
+      child: Column(
+        children: [
+          ClideTabBar(
+            items: [
+              for (final t in tabs) ClideTabItem(id: t.id, title: _resolveTitle(context, t)),
             ],
+            activeId: active.id,
+            onSelect: (id) => kernel.panels.activateTab(slot, id),
           ),
-        );
-      },
+          ClideDivider(),
+          Expanded(child: active.build(context)),
+        ],
+      ),
     );
   }
 
@@ -879,36 +967,79 @@ class _EditorDragHandle extends StatefulWidget {
 
 class _EditorDragHandleState extends State<_EditorDragHandle> {
   bool _hovered = false;
+  bool _focused = false;
   double? _dragStartRatio;
   double? _dragStartY;
 
+  // Editor split is a 0..1 fraction; the kernel clamps to 0.15..0.70.
+  // 2% per fine step, 10% per Shift step keeps keyboard feel close to
+  // the pixel-based DragResizeHandle.
+  static const double _stepFine = 0.02;
+  static const double _stepCoarse = 0.10;
+
   @override
   Widget build(BuildContext context) {
     final tokens = ClideTheme.of(context).surface;
-    return MouseRegion(
-      cursor: SystemMouseCursors.resizeRow,
-      onEnter: (_) => setState(() => _hovered = true),
-      onExit: (_) => setState(() => _hovered = false),
-      child: Listener(
-        onPointerDown: (e) {
-          _dragStartRatio = widget.arrangement.editorRatio;
-          _dragStartY = e.position.dy;
+    final lineColor = (_hovered || _focused) ? tokens.panelActiveBorder : tokens.panelBorder;
+
+    return Semantics(
+      container: true,
+      slider: true,
+      label: 'Editor split',
+      value: '${(widget.arrangement.editorRatio * 100).round()}%',
+      onIncrease: () => _bump(_stepFine),
+      onDecrease: () => _bump(-_stepFine),
+      child: FocusableActionDetector(
+        onShowFocusHighlight: (v) => setState(() => _focused = v),
+        shortcuts: const <ShortcutActivator, Intent>{
+          SingleActivator(LogicalKeyboardKey.arrowUp): _EditorBumpIntent(-_stepFine),
+          SingleActivator(LogicalKeyboardKey.arrowDown): _EditorBumpIntent(_stepFine),
+          SingleActivator(LogicalKeyboardKey.arrowUp, shift: true): _EditorBumpIntent(-_stepCoarse),
+          SingleActivator(LogicalKeyboardKey.arrowDown, shift: true): _EditorBumpIntent(_stepCoarse),
         },
-        onPointerMove: (e) {
-          final startR = _dragStartRatio;
-          final startY = _dragStartY;
-          if (startR == null || startY == null || widget.totalHeight <= 0) return;
-          final deltaRatio = (e.position.dy - startY) / widget.totalHeight;
-          widget.arrangement.setEditorRatio(startR + deltaRatio);
+        actions: <Type, Action<Intent>>{
+          _EditorBumpIntent: CallbackAction<_EditorBumpIntent>(
+            onInvoke: (intent) {
+              _bump(intent.delta);
+              return null;
+            },
+          ),
         },
-        onPointerUp: (_) {
-          _dragStartRatio = null;
-          _dragStartY = null;
-        },
-        child: Container(height: 4, color: _hovered ? tokens.panelActiveBorder : tokens.panelBorder),
+        child: MouseRegion(
+          cursor: SystemMouseCursors.resizeRow,
+          onEnter: (_) => setState(() => _hovered = true),
+          onExit: (_) => setState(() => _hovered = false),
+          child: Listener(
+            onPointerDown: (e) {
+              _dragStartRatio = widget.arrangement.editorRatio;
+              _dragStartY = e.position.dy;
+            },
+            onPointerMove: (e) {
+              final startR = _dragStartRatio;
+              final startY = _dragStartY;
+              if (startR == null || startY == null || widget.totalHeight <= 0) return;
+              final deltaRatio = (e.position.dy - startY) / widget.totalHeight;
+              widget.arrangement.setEditorRatio(startR + deltaRatio);
+            },
+            onPointerUp: (_) {
+              _dragStartRatio = null;
+              _dragStartY = null;
+            },
+            child: Container(height: 4, color: lineColor),
+          ),
+        ),
       ),
     );
   }
+
+  void _bump(double delta) {
+    widget.arrangement.setEditorRatio(widget.arrangement.editorRatio + delta);
+  }
+}
+
+class _EditorBumpIntent extends Intent {
+  const _EditorBumpIntent(this.delta);
+  final double delta;
 }
 
 class _ContextSlot extends StatelessWidget {
@@ -958,7 +1089,7 @@ class _BottomRail extends StatelessWidget {
                 ClideIconRailItem(
                   id: t.id,
                   icon: _iconFor(slot, t),
-                  tooltip: SlotHost._resolveTitle(ctx, t),
+                  tooltip: _SlotBody._resolveTitle(ctx, t),
                 ),
             ],
             activeId: activeId,

lib/builtin/editor/src/editor_controller.dart

@@ -17,13 +17,11 @@ import 'package:clide/kernel/kernel.dart';
 import 'package:flutter/foundation.dart';
 
 class EditorController extends ChangeNotifier {
-  EditorController({required this.ipc, required DaemonBus events}) : _events = events {
+  EditorController({required this.ipc, required DaemonBus events}) {
     _eventSub = events.on<DaemonEvent>().listen(_onEvent);
   }
 
   final DaemonClient ipc;
-  // ignore: unused_field  — kept for future subscription changes
-  final DaemonBus _events;
 
   StreamSubscription<DaemonEvent>? _eventSub;
 

lib/builtin/files/src/file_tree_view.dart

@@ -1,12 +1,11 @@
 import 'dart:async';
 import 'dart:io';
 
+import 'package:clide/clide.dart' show FileEntry;
 import 'package:clide/kernel/kernel.dart';
 import 'package:clide/widgets/widgets.dart';
 import 'package:flutter/widgets.dart';
 
-import 'package:clide/src/files/listing.dart' show FileEntry;
-
 import 'file_tree_controller.dart';
 
 /// Sidebar panel rendering the workspace file tree.

lib/builtin/view/src/extension.dart

@@ -0,0 +1,57 @@
+import 'package:clide/clide.dart';
+import 'package:clide/extension/extension.dart';
+import 'package:clide/kernel/kernel.dart';
+
+/// Surfaces view-level commands (currently the three text-zoom verbs)
+/// in the command palette so they're discoverable. The keybindings
+/// themselves are owned by the default keymap; commands here exist so
+/// users browsing `Ctrl+Shift+P` see the same actions.
+class ViewExtension extends ClideExtension {
+  ViewExtension({required this.textZoom});
+
+  final TextZoom textZoom;
+
+  @override
+  String get id => 'builtin.view';
+  @override
+  String get title => 'View';
+  @override
+  String get version => '0.1.0';
+
+  @override
+  Future<void> activate(ClideExtensionContext ctx) async {}
+
+  @override
+  List<ContributionPoint> get contributions => [
+        // Keybindings live in `assets/keymaps/default.yaml` against the
+        // text.scale* intents — registering a `defaultBinding` here too
+        // would shadow them. Palette discovery is the only goal.
+        CommandContribution(
+          id: 'view.zoomIn',
+          command: 'view.zoomIn',
+          title: 'View: Zoom In',
+          run: (_) async {
+            textZoom.increase();
+            return IpcResponse.ok(id: '', data: {'scale': textZoom.scale});
+          },
+        ),
+        CommandContribution(
+          id: 'view.zoomOut',
+          command: 'view.zoomOut',
+          title: 'View: Zoom Out',
+          run: (_) async {
+            textZoom.decrease();
+            return IpcResponse.ok(id: '', data: {'scale': textZoom.scale});
+          },
+        ),
+        CommandContribution(
+          id: 'view.zoomReset',
+          command: 'view.zoomReset',
+          title: 'View: Reset Zoom',
+          run: (_) async {
+            textZoom.reset();
+            return IpcResponse.ok(id: '', data: {'scale': textZoom.scale});
+          },
+        ),
+      ];
+}

lib/builtin/view/view.dart

@@ -0,0 +1 @@
+export 'src/extension.dart';

lib/kernel/kernel.dart

@@ -22,6 +22,11 @@ export 'src/clipboard.dart';
 export 'src/commands/keybindings.dart';
 export 'src/commands/palette.dart';
 export 'src/commands/registry.dart';
+export 'src/keymap/intents.dart';
+export 'src/keymap/key_chord.dart';
+export 'src/keymap/keymap.dart';
+export 'src/keymap/keymap_service.dart';
+export 'src/keymap/when_clause.dart';
 export 'src/dialog.dart';
 export 'src/extensions_manager.dart';
 export 'src/files.dart';
@@ -35,6 +40,7 @@ export 'src/os.dart';
 export 'src/panels/arrangement.dart';
 export 'src/project.dart';
 export 'src/scheduler.dart';
+export 'src/text_zoom.dart';
 export 'src/secrets.dart';
 export 'src/tray.dart';
 export 'src/panels/drag_resize.dart';

lib/kernel/src/commands/palette.dart

@@ -9,13 +9,26 @@ class PaletteController extends ChangeNotifier {
 
   bool _open = false;
   String _filter = '';
+  int _selectedIndex = 0;
 
   bool get isOpen => _open;
   String get filter => _filter;
 
+  /// Index of the highlighted entry inside the currently-filtered
+  /// list. Clamped to `[0, filtered().length - 1]` on read. Returns 0
+  /// when the filter excludes everything.
+  int get selectedIndex {
+    final n = filtered().length;
+    if (n == 0) return 0;
+    if (_selectedIndex < 0) return 0;
+    if (_selectedIndex >= n) return n - 1;
+    return _selectedIndex;
+  }
+
   void open() {
     if (_open) return;
     _open = true;
+    _selectedIndex = 0;
     notifyListeners();
   }
 
@@ -23,6 +36,7 @@ class PaletteController extends ChangeNotifier {
     if (!_open) return;
     _open = false;
     _filter = '';
+    _selectedIndex = 0;
     notifyListeners();
   }
 
@@ -31,9 +45,35 @@ class PaletteController extends ChangeNotifier {
   void setFilter(String f) {
     if (_filter == f) return;
     _filter = f;
+    _selectedIndex = 0;
     notifyListeners();
   }
 
+  /// Highlight the next entry, wrapping at the end. No-op when the
+  /// filtered list has fewer than 2 entries.
+  void selectNext() {
+    final n = filtered().length;
+    if (n < 2) return;
+    _selectedIndex = (selectedIndex + 1) % n;
+    notifyListeners();
+  }
+
+  /// Highlight the previous entry, wrapping at the start.
+  void selectPrevious() {
+    final n = filtered().length;
+    if (n < 2) return;
+    _selectedIndex = (selectedIndex - 1 + n) % n;
+    notifyListeners();
+  }
+
+  /// Invoke whatever's currently highlighted; no-op when the filter
+  /// excludes everything.
+  Future<void> acceptSelected() async {
+    final list = filtered();
+    if (list.isEmpty) return;
+    await invoke(list[selectedIndex].command);
+  }
+
   List<CommandContribution> filtered() {
     if (_filter.isEmpty) return _registry.all.toList();
     final q = _filter.toLowerCase();

lib/kernel/src/extensions_manager.dart

@@ -14,6 +14,7 @@ import 'package:clide/kernel/src/files.dart';
 import 'package:clide/kernel/src/focus.dart';
 import 'package:clide/kernel/src/i18n/i18n.dart';
 import 'package:clide/kernel/src/ipc/client.dart';
+import 'package:clide/kernel/src/keymap/keymap_service.dart';
 import 'package:clide/kernel/src/log.dart';
 import 'package:clide/kernel/src/net.dart';
 import 'package:clide/kernel/src/notify.dart';
@@ -40,6 +41,7 @@ class ExtensionManager extends ChangeNotifier {
     required this.commands,
     required this.palette,
     required this.keybindings,
+    required this.keymap,
     required this.clipboard,
     required this.files,
     required this.notify,
@@ -64,6 +66,7 @@ class ExtensionManager extends ChangeNotifier {
   final CommandRegistry commands;
   final PaletteController palette;
   final KeybindingResolver keybindings;
+  final KeymapService keymap;
   final ClideClipboard clipboard;
   final FileServices files;
   final Notifications notify;
@@ -78,6 +81,9 @@ class ExtensionManager extends ChangeNotifier {
 
   final Map<String, ClideExtension> _known = {};
   final Set<String> _activated = {};
+  // Extensions whose activate() / deactivate() threw — exposed so the
+  // UI can show a "degraded" status next to them.
+  final Map<String, Object> _failed = {};
 
   void register(ClideExtension ext) {
     if (_known.containsKey(ext.id)) {
@@ -91,6 +97,12 @@ class ExtensionManager extends ChangeNotifier {
   Iterable<ClideExtension> get all => _known.values;
   bool isActivated(String id) => _activated.contains(id);
 
+  /// Map of extension id → most recent activate/deactivate error.
+  /// Cleared for an extension when it activates cleanly. UI surfaces
+  /// read this for the "degraded" indicator.
+  Map<String, Object> get failedExtensions => Map.unmodifiable(_failed);
+  bool didFail(String id) => _failed.containsKey(id);
+
   bool isEnabled(String id) {
     final v = settings.get<bool>('app.extensions.$id.enabled');
     return v ?? true;
@@ -135,11 +147,14 @@ class ExtensionManager extends ChangeNotifier {
         _applyContribution(c);
       }
       _activated.add(id);
+      _failed.remove(id);
       events.emit(ExtensionActivated(id: id));
       notifyListeners();
       log.info('extensions', 'activated $id');
     } catch (e, st) {
+      _failed[id] = e;
       log.error('extensions', 'activate failed for $id', error: e, stackTrace: st);
+      notifyListeners();
     }
   }
 
@@ -157,7 +172,9 @@ class ExtensionManager extends ChangeNotifier {
       notifyListeners();
       log.info('extensions', 'deactivated $id');
     } catch (e, st) {
+      _failed[id] = e;
       log.error('extensions', 'deactivate failed for $id', error: e, stackTrace: st);
+      notifyListeners();
     }
   }
 
@@ -171,7 +188,11 @@ class ExtensionManager extends ChangeNotifier {
         commands.register(cmd);
         final binding = cmd.defaultBinding;
         if (binding != null) {
+          // Legacy KeybindingResolver still wired for back-compat
+          // until all callers migrate; the keymap layer is the
+          // canonical home for chord → command bindings (T-117).
           keybindings.bind(Keybinding.parse(binding), cmd.command);
+          keymap.registerCommandBinding(binding, cmd.command);
         }
       case TrayItemContribution t:
         tray.add(t);
@@ -194,6 +215,7 @@ class ExtensionManager extends ChangeNotifier {
         if (binding != null) {
           keybindings.unbind(Keybinding.parse(binding));
         }
+        keymap.unregisterCommandBindings(cmd.command);
       case TrayItemContribution t:
         tray.remove(t.id);
       case LayoutPresetContribution _:

lib/kernel/src/facade.dart

@@ -4,6 +4,8 @@ import 'dart:io';
 import 'package:clide/clide.dart';
 import 'package:clide/kernel/src/clipboard.dart';
 import 'package:clide/kernel/src/commands/keybindings.dart';
+import 'package:clide/kernel/src/keymap/keymap_service.dart';
+import 'package:clide/kernel/src/text_zoom.dart';
 import 'package:clide/kernel/src/commands/palette.dart';
 import 'package:clide/kernel/src/commands/registry.dart';
 import 'package:clide/kernel/src/dialog.dart';
@@ -63,6 +65,8 @@ class KernelServices {
     required this.window,
     required this.toolchain,
     required this.scheduler,
+    required this.keymap,
+    required this.textZoom,
   });
 
   final Logger log;
@@ -91,6 +95,8 @@ class KernelServices {
   final WindowControls window;
   final Toolchain toolchain;
   final SchedulerService scheduler;
+  final KeymapService keymap;
+  final TextZoom textZoom;
 
   static Future<KernelServices> boot({
     required Directory appDir,
@@ -132,6 +138,8 @@ class KernelServices {
     final arrangement = LayoutArrangement();
     final commands = CommandRegistry();
     final keybindings = KeybindingResolver();
+    final keymap = KeymapService(settings: settings, appDir: appDir);
+    await keymap.load();
     final palette = PaletteController(commands);
     final clipboard = ClideClipboard();
     final files = FileServices(events);
@@ -146,6 +154,7 @@ class KernelServices {
     final tc = toolchain ?? Toolchain();
     final scheduler = SchedulerService(events);
     scheduler.start();
+    final textZoom = TextZoom();
     final project = ProjectManager(
       log: log,
       events: events,
@@ -174,6 +183,7 @@ class KernelServices {
       commands: commands,
       palette: palette,
       keybindings: keybindings,
+      keymap: keymap,
       clipboard: clipboard,
       files: files,
       notify: notify,
@@ -218,6 +228,8 @@ class KernelServices {
       window: window,
       toolchain: tc,
       scheduler: scheduler,
+      keymap: keymap,
+      textZoom: textZoom,
     );
   }
 
@@ -239,6 +251,8 @@ class KernelServices {
     project.dispose();
     extensions.dispose();
     await scheduler.dispose();
+    keymap.dispose();
+    textZoom.dispose();
     await log.dispose();
     messages.dispose();
     await events.dispose();

lib/kernel/src/focus.dart

@@ -1,13 +1,27 @@
 import 'package:clide/kernel/src/panels/slot_id.dart';
-import 'package:flutter/foundation.dart';
+import 'package:flutter/widgets.dart';
 
-/// Tracks the currently focused contribution (tab id + slot). Backs
-/// `clide active`; extensions that need "which tab does the user care
-/// about right now?" read from here instead of poking Flutter's
-/// FocusScope directly.
+/// Tracks the currently focused contribution (tab id + slot) and
+/// hosts a registry of per-slot [FocusScopeNode]s for panel-to-panel
+/// focus traversal.
+///
+/// Backs `clide active` (extensions read activeSlot / activeContributionId)
+/// and the `FocusNextPanelIntent` / `FocusPreviousPanelIntent` actions
+/// the keymap dispatches on F6 / Shift+F6.
 class FocusTracker extends ChangeNotifier {
   SlotId? _slot;
   String? _contributionId;
+  final Map<SlotId, FocusScopeNode> _scopes = {};
+
+  /// Static order panels cycle through. Matches the visual left-to-right
+  /// of the three-column layout (sidebar → workspace → context); the
+  /// statusbar / toolbar aren't included because they don't host
+  /// keyboard-active content.
+  static const List<SlotId> traversalOrder = [
+    Slots.sidebar,
+    Slots.workspace,
+    Slots.contextPanel,
+  ];
 
   SlotId? get activeSlot => _slot;
   String? get activeContributionId => _contributionId;
@@ -25,4 +39,44 @@ class FocusTracker extends ChangeNotifier {
     _contributionId = null;
     notifyListeners();
   }
+
+  /// SlotHost calls this in initState. Replaces any prior registration
+  /// for the same slot (handles hot-reload + slot rebuild).
+  void registerSlotScope(SlotId slot, FocusScopeNode scope) {
+    _scopes[slot] = scope;
+  }
+
+  /// SlotHost calls this in dispose. No-op if a newer scope already
+  /// took the slot.
+  void unregisterSlotScope(SlotId slot, FocusScopeNode scope) {
+    if (identical(_scopes[slot], scope)) {
+      _scopes.remove(slot);
+    }
+  }
+
+  /// Request focus on [slot]'s registered scope. No-op when the slot
+  /// has no registered scope (panel not mounted, layout doesn't
+  /// include it, etc.).
+  void focusSlot(SlotId slot) {
+    final scope = _scopes[slot];
+    if (scope == null) return;
+    scope.requestFocus();
+  }
+
+  /// Move focus to the next slot in [traversalOrder], wrapping at the
+  /// end. No-op when fewer than two slots are registered.
+  void focusNextSlot() => _cycleSlot(1);
+
+  /// Move focus to the previous slot, wrapping at the start.
+  void focusPreviousSlot() => _cycleSlot(-1);
+
+  void _cycleSlot(int delta) {
+    final registered = traversalOrder.where(_scopes.containsKey).toList();
+    if (registered.length < 2) return;
+    final from = registered.indexOf(_slot ?? registered.first);
+    final start = from < 0 ? 0 : from;
+    final next = (start + delta) % registered.length;
+    final wrapped = next < 0 ? next + registered.length : next;
+    focusSlot(registered[wrapped]);
+  }
 }

lib/kernel/src/keymap/intents.dart

@@ -0,0 +1,114 @@
+/// Typed [Intent]s the keymap dispatches.
+///
+/// Widgets bind Actions to Intent types via `Actions.handler`. Preset
+/// YAML files reference Intents by their string id (`activate`,
+/// `palette.selectNext`, …). The id stays stable across SDK reshapes;
+/// the Dart class name can move without invalidating user keymaps.
+///
+/// Two flavors of intents live here:
+///   1. **Flutter-provided** — `ActivateIntent` and `DismissIntent`
+///      are first-class Flutter intents; we reuse them so the keymap
+///      integrates with anything else in the Flutter ecosystem that
+///      already dispatches those (focus traversal, modal scrims, …).
+///      They're mapped by id in [builtinIntents] but not declared
+///      here.
+///   2. **Clide-specific** — palette navigation, text scale, the
+///      `InvokeCommandIntent` bridge. Each subclass extends [Intent]
+///      directly.
+library;
+
+import 'package:flutter/widgets.dart';
+
+// -- Panel-to-panel focus traversal -----------------------------------------
+
+/// Move focus to the next panel in `FocusTracker.traversalOrder`
+/// (sidebar → workspace → context). Bound to F6 by default.
+class FocusNextPanelIntent extends Intent {
+  const FocusNextPanelIntent();
+}
+
+/// Move focus to the previous panel. Bound to Shift+F6 by default.
+class FocusPreviousPanelIntent extends Intent {
+  const FocusPreviousPanelIntent();
+}
+
+// -- Command palette --------------------------------------------------------
+
+/// Open the command palette.
+class PaletteOpenIntent extends Intent {
+  const PaletteOpenIntent();
+}
+
+/// Highlight the next palette result.
+class PaletteSelectNextIntent extends Intent {
+  const PaletteSelectNextIntent();
+}
+
+/// Highlight the previous palette result.
+class PaletteSelectPreviousIntent extends Intent {
+  const PaletteSelectPreviousIntent();
+}
+
+/// Invoke the highlighted palette result.
+class PaletteAcceptIntent extends Intent {
+  const PaletteAcceptIntent();
+}
+
+// -- Text scale -------------------------------------------------------------
+
+class TextScaleIncreaseIntent extends Intent {
+  const TextScaleIncreaseIntent();
+}
+
+class TextScaleDecreaseIntent extends Intent {
+  const TextScaleDecreaseIntent();
+}
+
+class TextScaleResetIntent extends Intent {
+  const TextScaleResetIntent();
+}
+
+// -- Command bridge ---------------------------------------------------------
+
+/// Generic "invoke this CommandRegistry command id" intent. Used for
+/// bindings that target a contributed command rather than a typed
+/// intent. The keymap creates one per binding; the Actions handler
+/// dispatches to the [CommandRegistry].
+class InvokeCommandIntent extends Intent {
+  const InvokeCommandIntent(this.commandId);
+  final String commandId;
+}
+
+// -- Lookup -----------------------------------------------------------------
+
+/// Map from YAML id → factory. Preset files reference intents by id;
+/// the keymap loader uses this to instantiate them. Intents with a
+/// configurable payload (only `InvokeCommandIntent` today) are not in
+/// the map — the loader recognises the `command:` prefix and
+/// instantiates them inline.
+final Map<String, Intent Function()> builtinIntents = {
+  'activate': () => const ActivateIntent(),
+  'dismiss': () => const DismissIntent(),
+  'focus.nextPanel': () => const FocusNextPanelIntent(),
+  'focus.previousPanel': () => const FocusPreviousPanelIntent(),
+  'palette.open': () => const PaletteOpenIntent(),
+  'palette.selectNext': () => const PaletteSelectNextIntent(),
+  'palette.selectPrevious': () => const PaletteSelectPreviousIntent(),
+  'palette.accept': () => const PaletteAcceptIntent(),
+  'text.scaleIncrease': () => const TextScaleIncreaseIntent(),
+  'text.scaleDecrease': () => const TextScaleDecreaseIntent(),
+  'text.scaleReset': () => const TextScaleResetIntent(),
+};
+
+/// Parse an intent id into an [Intent]. Returns null if the id is
+/// unknown. Recognises:
+///   - any builtin intent by its stable id
+///   - `command:<command-id>` → [InvokeCommandIntent]
+Intent? parseIntentId(String id) {
+  final builtin = builtinIntents[id];
+  if (builtin != null) return builtin();
+  if (id.startsWith('command:')) {
+    return InvokeCommandIntent(id.substring('command:'.length));
+  }
+  return null;
+}

lib/kernel/src/keymap/key_chord.dart

@@ -0,0 +1,213 @@
+/// Layout-independent representation of a single keystroke.
+///
+/// The consultant's note (T-110) flagged the old `KeybindingResolver`
+/// for keying off `LogicalKeyboardKey.keyLabel`, which is locale-aware
+/// (US-QWERTY `Ctrl+/` differs from AZERTY `Ctrl+:`). We key off
+/// `LogicalKeyboardKey.keyId` instead — a stable u32 that survives
+/// layout changes.
+library;
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
+
+/// One of the four POSIX-style modifier keys. Order is the canonical
+/// presentation order in YAML and toString output.
+enum KeyModifier {
+  ctrl,
+  alt,
+  shift,
+  meta;
+
+  /// Lowercase short form used in YAML (`ctrl`, `alt`, `shift`, `meta`).
+  String get yaml => name;
+
+  /// Display string used in palette + tooltip hints.
+  String get display => switch (this) {
+        KeyModifier.ctrl => 'Ctrl',
+        KeyModifier.alt => 'Alt',
+        KeyModifier.shift => 'Shift',
+        KeyModifier.meta => 'Cmd',
+      };
+}
+
+/// A modifier-set + a single key, identified by layout-independent
+/// `LogicalKeyboardKey.keyId`. Canonicalised on construction
+/// (modifiers sorted by enum order) so equality + hashing work for
+/// lookup-keying.
+@immutable
+class KeyChord {
+  factory KeyChord({Set<KeyModifier> modifiers = const {}, required LogicalKeyboardKey key}) {
+    final sorted = modifiers.toList()..sort((a, b) => a.index.compareTo(b.index));
+    return KeyChord._(List.unmodifiable(sorted), key);
+  }
+
+  const KeyChord._(this.modifiers, this.key);
+
+  final List<KeyModifier> modifiers;
+  final LogicalKeyboardKey key;
+
+  /// Build from a Flutter [KeyEvent]. Returns null for non-down events
+  /// or events whose logical key has no meaningful id (e.g. a bare
+  /// modifier press in isolation).
+  static KeyChord? fromKeyEvent(KeyEvent event, HardwareKeyboard kb) {
+    if (event is! KeyDownEvent && event is! KeyRepeatEvent) return null;
+    final logical = event.logicalKey;
+    // Bare modifier presses don't form a chord on their own.
+    if (_isBareModifier(logical)) return null;
+    final mods = <KeyModifier>{
+      if (kb.isControlPressed) KeyModifier.ctrl,
+      if (kb.isAltPressed) KeyModifier.alt,
+      if (kb.isShiftPressed) KeyModifier.shift,
+      if (kb.isMetaPressed) KeyModifier.meta,
+    };
+    return KeyChord(modifiers: mods, key: logical);
+  }
+
+  /// Parse a YAML chord spec like `ctrl+shift+p`, `cmd+enter`, `escape`.
+  /// Whitespace tolerated. Throws [FormatException] on unknown tokens
+  /// or empty input.
+  static KeyChord parse(String spec) {
+    final trimmed = spec.trim();
+    if (trimmed.isEmpty) throw const FormatException('empty key chord');
+    final parts = trimmed.split('+').map((s) => s.trim()).toList();
+    final keyName = parts.removeLast();
+    if (keyName.isEmpty) throw FormatException('missing key in chord: "$spec"');
+    final mods = <KeyModifier>{};
+    for (final m in parts) {
+      final mod = _modByName(m);
+      if (mod == null) throw FormatException('unknown modifier "$m" in chord: "$spec"');
+      mods.add(mod);
+    }
+    final key = _keyByName(keyName);
+    if (key == null) throw FormatException('unknown key "$keyName" in chord: "$spec"');
+    return KeyChord(modifiers: mods, key: key);
+  }
+
+  /// Canonical YAML form: `ctrl+shift+p`.
+  String get canonical {
+    final modPart = modifiers.map((m) => m.yaml).join('+');
+    final keyPart = _keyName(key);
+    return modPart.isEmpty ? keyPart : '$modPart+$keyPart';
+  }
+
+  /// Display form for UI hints: `Ctrl+Shift+P`.
+  String get display {
+    final modPart = modifiers.map((m) => m.display).join('+');
+    final keyPart = _keyName(key).toUpperCase();
+    return modPart.isEmpty ? keyPart : '$modPart+$keyPart';
+  }
+
+  @override
+  bool operator ==(Object other) => other is KeyChord && other.key == key && listEquals(other.modifiers, modifiers);
+
+  @override
+  int get hashCode => Object.hash(key, Object.hashAll(modifiers));
+
+  @override
+  String toString() => 'KeyChord($canonical)';
+}
+
+bool _isBareModifier(LogicalKeyboardKey k) =>
+    k == LogicalKeyboardKey.control ||
+    k == LogicalKeyboardKey.controlLeft ||
+    k == LogicalKeyboardKey.controlRight ||
+    k == LogicalKeyboardKey.alt ||
+    k == LogicalKeyboardKey.altLeft ||
+    k == LogicalKeyboardKey.altRight ||
+    k == LogicalKeyboardKey.shift ||
+    k == LogicalKeyboardKey.shiftLeft ||
+    k == LogicalKeyboardKey.shiftRight ||
+    k == LogicalKeyboardKey.meta ||
+    k == LogicalKeyboardKey.metaLeft ||
+    k == LogicalKeyboardKey.metaRight ||
+    k == LogicalKeyboardKey.fn;
+
+KeyModifier? _modByName(String name) {
+  switch (name.toLowerCase()) {
+    case 'ctrl':
+    case 'control':
+      return KeyModifier.ctrl;
+    case 'alt':
+    case 'option':
+      return KeyModifier.alt;
+    case 'shift':
+      return KeyModifier.shift;
+    case 'meta':
+    case 'cmd':
+    case 'command':
+    case 'super':
+    case 'win':
+      return KeyModifier.meta;
+  }
+  return null;
+}
+
+// -- Key name <-> LogicalKeyboardKey ----------------------------------------
+//
+// We map YAML names to LogicalKeyboardKey instances. The map covers
+// every key a binding can plausibly want; unknown names throw on parse.
+
+const Map<String, LogicalKeyboardKey> _byName = {
+  // Letters
+  'a': LogicalKeyboardKey.keyA, 'b': LogicalKeyboardKey.keyB, 'c': LogicalKeyboardKey.keyC,
+  'd': LogicalKeyboardKey.keyD, 'e': LogicalKeyboardKey.keyE, 'f': LogicalKeyboardKey.keyF,
+  'g': LogicalKeyboardKey.keyG, 'h': LogicalKeyboardKey.keyH, 'i': LogicalKeyboardKey.keyI,
+  'j': LogicalKeyboardKey.keyJ, 'k': LogicalKeyboardKey.keyK, 'l': LogicalKeyboardKey.keyL,
+  'm': LogicalKeyboardKey.keyM, 'n': LogicalKeyboardKey.keyN, 'o': LogicalKeyboardKey.keyO,
+  'p': LogicalKeyboardKey.keyP, 'q': LogicalKeyboardKey.keyQ, 'r': LogicalKeyboardKey.keyR,
+  's': LogicalKeyboardKey.keyS, 't': LogicalKeyboardKey.keyT, 'u': LogicalKeyboardKey.keyU,
+  'v': LogicalKeyboardKey.keyV, 'w': LogicalKeyboardKey.keyW, 'x': LogicalKeyboardKey.keyX,
+  'y': LogicalKeyboardKey.keyY, 'z': LogicalKeyboardKey.keyZ,
+  // Digits
+  '0': LogicalKeyboardKey.digit0, '1': LogicalKeyboardKey.digit1, '2': LogicalKeyboardKey.digit2,
+  '3': LogicalKeyboardKey.digit3, '4': LogicalKeyboardKey.digit4, '5': LogicalKeyboardKey.digit5,
+  '6': LogicalKeyboardKey.digit6, '7': LogicalKeyboardKey.digit7, '8': LogicalKeyboardKey.digit8,
+  '9': LogicalKeyboardKey.digit9,
+  // Function keys
+  'f1': LogicalKeyboardKey.f1, 'f2': LogicalKeyboardKey.f2, 'f3': LogicalKeyboardKey.f3,
+  'f4': LogicalKeyboardKey.f4, 'f5': LogicalKeyboardKey.f5, 'f6': LogicalKeyboardKey.f6,
+  'f7': LogicalKeyboardKey.f7, 'f8': LogicalKeyboardKey.f8, 'f9': LogicalKeyboardKey.f9,
+  'f10': LogicalKeyboardKey.f10, 'f11': LogicalKeyboardKey.f11, 'f12': LogicalKeyboardKey.f12,
+  // Arrows
+  'left': LogicalKeyboardKey.arrowLeft,
+  'right': LogicalKeyboardKey.arrowRight,
+  'up': LogicalKeyboardKey.arrowUp,
+  'down': LogicalKeyboardKey.arrowDown,
+  // Common control keys
+  'enter': LogicalKeyboardKey.enter,
+  'return': LogicalKeyboardKey.enter,
+  'escape': LogicalKeyboardKey.escape,
+  'esc': LogicalKeyboardKey.escape,
+  'tab': LogicalKeyboardKey.tab,
+  'space': LogicalKeyboardKey.space,
+  'backspace': LogicalKeyboardKey.backspace,
+  'delete': LogicalKeyboardKey.delete,
+  'home': LogicalKeyboardKey.home,
+  'end': LogicalKeyboardKey.end,
+  'pageup': LogicalKeyboardKey.pageUp,
+  'pagedown': LogicalKeyboardKey.pageDown,
+  'insert': LogicalKeyboardKey.insert,
+  // Punctuation (US-QWERTY positions; preset authors can rely on these names).
+  'minus': LogicalKeyboardKey.minus, '-': LogicalKeyboardKey.minus,
+  'equal': LogicalKeyboardKey.equal, '=': LogicalKeyboardKey.equal,
+  'comma': LogicalKeyboardKey.comma, ',': LogicalKeyboardKey.comma,
+  'period': LogicalKeyboardKey.period, '.': LogicalKeyboardKey.period,
+  'slash': LogicalKeyboardKey.slash, '/': LogicalKeyboardKey.slash,
+  'backslash': LogicalKeyboardKey.backslash, r'\\': LogicalKeyboardKey.backslash,
+  'semicolon': LogicalKeyboardKey.semicolon, ';': LogicalKeyboardKey.semicolon,
+  'quote': LogicalKeyboardKey.quote, "'": LogicalKeyboardKey.quote,
+  'bracketLeft': LogicalKeyboardKey.bracketLeft, '[': LogicalKeyboardKey.bracketLeft,
+  'bracketRight': LogicalKeyboardKey.bracketRight, ']': LogicalKeyboardKey.bracketRight,
+  'backquote': LogicalKeyboardKey.backquote, '`': LogicalKeyboardKey.backquote,
+};
+
+LogicalKeyboardKey? _keyByName(String name) => _byName[name.toLowerCase()];
+
+String _keyName(LogicalKeyboardKey key) {
+  // Reverse lookup; prefer the canonical (first) name for each key.
+  for (final entry in _byName.entries) {
+    if (entry.value == key) return entry.key;
+  }
+  // Fallback: use the debugName-like representation.
+  return key.keyLabel.isNotEmpty ? key.keyLabel.toLowerCase() : 'key(0x${key.keyId.toRadixString(16)})';
+}

lib/kernel/src/keymap/keymap.dart

@@ -0,0 +1,148 @@
+/// In-memory representation of a layered keymap.
+///
+/// A [Keymap] is built from one or more [KeymapLayer]s (preset →
+/// user-file overlay → settings overlay). Each layer contributes
+/// [KeymapBinding]s; later layers replace earlier bindings with the
+/// same (chord, when-clause) tuple.
+///
+/// At resolve time, the [Keymap] walks the layered list once per
+/// (chord, scope) and returns the [Intent] bound by the highest-
+/// precedence matching layer.
+library;
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/widgets.dart' show Intent;
+import 'package:yaml/yaml.dart';
+
+import 'intents.dart';
+import 'key_chord.dart';
+import 'when_clause.dart';
+
+/// One row in a layer: a chord, an optional when-clause, and the
+/// intent to fire when the chord matches and the when-clause is true.
+@immutable
+class KeymapBinding {
+  const KeymapBinding({
+    required this.chord,
+    required this.intent,
+    this.when,
+  });
+
+  final KeyChord chord;
+  final Intent intent;
+  final WhenExpr? when;
+
+  @override
+  String toString() => 'Binding($chord → ${intent.runtimeType}${when == null ? '' : ' when $when'})';
+}
+
+/// One source of bindings. Layers are merged in order — later layers
+/// take precedence on (chord, when) collisions.
+@immutable
+class KeymapLayer {
+  const KeymapLayer({required this.name, required this.bindings});
+
+  final String name;
+  final List<KeymapBinding> bindings;
+
+  /// Parse a YAML document into a layer. Expected shape:
+  ///
+  /// ```yaml
+  /// name: default
+  /// bindings:
+  ///   - intent: activate
+  ///     keys: [enter, space]
+  ///     when: focused
+  ///   - intent: palette.selectNext
+  ///     keys: [down]
+  ///     when: palette.open
+  /// ```
+  ///
+  /// `keys:` may be a single chord string or a list. `when:` is
+  /// optional. Unknown intent ids cause a [FormatException].
+  factory KeymapLayer.fromYaml(String source, {String? nameOverride}) {
+    final doc = loadYaml(source);
+    if (doc is! YamlMap) {
+      throw const FormatException('keymap YAML must be a map at top level');
+    }
+    final name = nameOverride ?? (doc['name'] as String? ?? 'unnamed');
+    final raw = doc['bindings'];
+    if (raw is! YamlList) {
+      throw const FormatException('keymap YAML must define `bindings:` as a list');
+    }
+    final out = <KeymapBinding>[];
+    for (final entry in raw) {
+      if (entry is! YamlMap) {
+        throw FormatException('binding entries must be maps; got $entry');
+      }
+      final intentId = entry['intent'] as String?;
+      if (intentId == null) {
+        throw FormatException('binding missing `intent:` — $entry');
+      }
+      final intent = parseIntentId(intentId);
+      if (intent == null) {
+        throw FormatException('unknown intent id "$intentId" — $entry');
+      }
+      final keysRaw = entry['keys'];
+      final keySpecs = <String>[];
+      if (keysRaw is String) {
+        keySpecs.add(keysRaw);
+      } else if (keysRaw is YamlList) {
+        for (final k in keysRaw) {
+          if (k is! String) throw FormatException('keys must be strings; got $k in $entry');
+          keySpecs.add(k);
+        }
+      } else {
+        throw FormatException('binding missing `keys:` (string or list of strings) — $entry');
+      }
+      final when = WhenExpr.tryParse(entry['when'] as String?);
+      for (final spec in keySpecs) {
+        out.add(KeymapBinding(chord: KeyChord.parse(spec), intent: intent, when: when));
+      }
+    }
+    return KeymapLayer(name: name, bindings: out);
+  }
+
+  @override
+  String toString() => 'KeymapLayer($name, ${bindings.length} binding${bindings.length == 1 ? '' : 's'})';
+}
+
+/// A flattened keymap, ready for resolution.
+@immutable
+class Keymap {
+  Keymap(this.layers) : _effective = _flatten(layers);
+
+  final List<KeymapLayer> layers;
+  final List<KeymapBinding> _effective;
+
+  /// Resolve a [chord] against the current [context]. Returns the
+  /// highest-precedence binding whose chord matches and whose when-
+  /// clause (if any) evaluates true. Returns null if no match.
+  Intent? resolve(KeyChord chord, Map<String, bool> context) {
+    // Effective list is highest-precedence-first; first match wins.
+    for (final b in _effective) {
+      if (b.chord != chord) continue;
+      if (b.when != null && !b.when!.evaluate(context)) continue;
+      return b.intent;
+    }
+    return null;
+  }
+
+  /// All resolved bindings in effective-precedence order. Exposed for
+  /// debug surfaces (keybindings UI, palette hints).
+  List<KeymapBinding> get effectiveBindings => List.unmodifiable(_effective);
+
+  /// Concatenate layers in REVERSE order (last layer first). Later
+  /// layers fully shadow earlier (chord, when) collisions: when we walk
+  /// the list, the first matching entry wins, so highest-precedence
+  /// must come first. We don't dedupe — a no-op match in a later layer
+  /// just earns the first slot.
+  static List<KeymapBinding> _flatten(List<KeymapLayer> layers) {
+    return [
+      for (final l in layers.reversed) ...l.bindings,
+    ];
+  }
+
+  @override
+  String toString() => 'Keymap(${layers.map((l) => l.name).join(' < ')})';
+}

lib/kernel/src/keymap/keymap_service.dart

@@ -0,0 +1,198 @@
+/// Kernel service that owns the active [Keymap], scope context, and
+/// resolution surface.
+///
+/// Layering (lowest precedence → highest):
+///   1. The active preset (asset under `assets/keymaps/<preset>.yaml`).
+///      Selected by the `app.keymap.preset` setting; defaults to
+///      `default`.
+///   2. A user keymap file at `<appDir>/keybindings.yaml` (per-user
+///      power-user overrides).
+///   3. A settings-stored JSON overlay at `app.keymap.overrides` —
+///      list of `{intent, keys, when?}` maps in the same shape as
+///      preset YAML.
+///
+/// Scope context is a `Map<String, bool>` keyed by named flags (e.g.
+/// `palette.open`, `editor.focused`). Producing services call
+/// [setScopeFlag] when their state changes; consumers reference the
+/// flag name in when-clauses.
+library;
+
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart' show AssetBundle, KeyEvent, HardwareKeyboard, rootBundle;
+import 'package:flutter/widgets.dart' show Intent;
+
+import '../settings.dart';
+import 'intents.dart';
+import 'key_chord.dart';
+import 'keymap.dart';
+import 'when_clause.dart';
+
+/// Setting key for the active preset name.
+const String kKeymapPresetSetting = 'app.keymap.preset';
+
+/// Setting key for the JSON overlay list.
+const String kKeymapOverridesSetting = 'app.keymap.overrides';
+
+/// Filename for the user keymap file under the app dir.
+const String kKeymapUserFile = 'keybindings.yaml';
+
+class KeymapService extends ChangeNotifier {
+  KeymapService({
+    required SettingsStore settings,
+    required Directory appDir,
+    AssetBundle? bundle,
+  })  : _settings = settings,
+        _appDir = appDir,
+        _bundle = bundle ?? rootBundle;
+
+  final SettingsStore _settings;
+  final Directory _appDir;
+  final AssetBundle _bundle;
+
+  Keymap? _active;
+  final Map<String, bool> _scope = {};
+
+  // The four layer slots, lowest to highest precedence. Held
+  // separately so [registerCommandBinding] can refresh the
+  // contributions layer without re-reading the preset / file /
+  // settings.
+  KeymapLayer? _preset;
+  final List<KeymapBinding> _contributions = [];
+  KeymapLayer? _userFile;
+  KeymapLayer? _settingsOverlay;
+
+  /// The currently effective layered keymap. Null before [load] runs.
+  Keymap? get keymap => _active;
+
+  /// Live read-only view of the scope context.
+  Map<String, bool> get scope => Map.unmodifiable(_scope);
+
+  /// Read the preset from settings (default `default`), load all
+  /// non-contribution layers, and rebuild the active keymap. Safe to
+  /// call repeatedly. Contributions registered via
+  /// [registerCommandBinding] are preserved across reloads.
+  Future<void> load() async {
+    final presetName = _settings.get<String>(kKeymapPresetSetting) ?? 'default';
+
+    // Preset (asset).
+    try {
+      final src = await _bundle.loadString('assets/keymaps/$presetName.yaml');
+      _preset = KeymapLayer.fromYaml(src, nameOverride: presetName);
+    } catch (_) {
+      // A missing preset means we ship without a default. Tests can
+      // inject a custom bundle. We don't surface this beyond an empty
+      // active map.
+      _preset = null;
+    }
+
+    // User file overlay.
+    final userFile = File('${_appDir.path}/$kKeymapUserFile');
+    if (await userFile.exists()) {
+      try {
+        _userFile = KeymapLayer.fromYaml(await userFile.readAsString(), nameOverride: 'user-file');
+      } on FormatException {
+        _userFile = null;
+      }
+    } else {
+      _userFile = null;
+    }
+
+    // Settings overlay.
+    final overlay = _settings.get<List<Object?>>(kKeymapOverridesSetting);
+    if (overlay != null && overlay.isNotEmpty) {
+      final asYaml = StringBuffer('name: settings-overlay\nbindings:\n');
+      for (final entry in overlay) {
+        if (entry is! Map) continue;
+        asYaml.writeln('  - ${jsonEncode(entry)}');
+      }
+      try {
+        _settingsOverlay = KeymapLayer.fromYaml(asYaml.toString(), nameOverride: 'settings-overlay');
+      } on FormatException {
+        _settingsOverlay = null;
+      }
+    } else {
+      _settingsOverlay = null;
+    }
+
+    _rebuildActive();
+  }
+
+  /// Register a programmatic chord → command-id binding (typically
+  /// from an extension's `defaultBinding`). Contributions form a
+  /// layer between preset and user-file: extensions establish their
+  /// defaults, the user can override either via the user file or
+  /// settings overlay.
+  void registerCommandBinding(String chordSpec, String commandId, {String? when}) {
+    _contributions.add(KeymapBinding(
+      chord: KeyChord.parse(chordSpec),
+      intent: InvokeCommandIntent(commandId),
+      when: WhenExpr.tryParse(when),
+    ));
+    _rebuildActive();
+  }
+
+  /// Remove all extension-contributed bindings for [commandId]. Used
+  /// when an extension is disabled or unregistered.
+  void unregisterCommandBindings(String commandId) {
+    final before = _contributions.length;
+    _contributions.removeWhere((b) {
+      final i = b.intent;
+      return i is InvokeCommandIntent && i.commandId == commandId;
+    });
+    if (_contributions.length != before) {
+      _rebuildActive();
+    }
+  }
+
+  void _rebuildActive() {
+    final layers = <KeymapLayer>[
+      if (_preset != null) _preset!,
+      KeymapLayer(name: 'contributions', bindings: List.unmodifiable(_contributions)),
+      if (_userFile != null) _userFile!,
+      if (_settingsOverlay != null) _settingsOverlay!,
+    ];
+    _active = Keymap(layers);
+    notifyListeners();
+  }
+
+  /// Resolve a [KeyEvent] against the active keymap and current scope.
+  /// Returns null when nothing matches.
+  Intent? resolveEvent(KeyEvent event, HardwareKeyboard kb) {
+    final km = _active;
+    if (km == null) return null;
+    final chord = KeyChord.fromKeyEvent(event, kb);
+    if (chord == null) return null;
+    return km.resolve(chord, _scope);
+  }
+
+  /// Set a named scope flag. Producers should call this when their
+  /// state changes so when-clauses re-evaluate correctly. Notifies
+  /// listeners when the value actually changes.
+  void setScopeFlag(String name, bool value) {
+    if (_scope[name] == value) return;
+    _scope[name] = value;
+    notifyListeners();
+  }
+
+  /// Clear a named scope flag.
+  void clearScopeFlag(String name) {
+    if (!_scope.containsKey(name)) return;
+    _scope.remove(name);
+    notifyListeners();
+  }
+
+  /// Switch presets. Persists the new preset name to settings and
+  /// re-loads the layered keymap.
+  Future<void> setPreset(String name) async {
+    await _settings.set<String>(kKeymapPresetSetting, name);
+    await load();
+  }
+
+  /// All effective bindings, highest-precedence first. Useful for
+  /// debug surfaces and keybinding hints in the UI.
+  List<KeymapBinding> get effectiveBindings => _active?.effectiveBindings ?? const [];
+}

lib/kernel/src/keymap/when_clause.dart

@@ -0,0 +1,178 @@
+/// Boolean "when:" expressions over a named context bag, VS-Code style.
+///
+/// Grammar:
+///   expr  := or
+///   or    := and ('||' and)*
+///   and   := unary ('&&' unary)*
+///   unary := '!' unary | atom
+///   atom  := IDENT | '(' expr ')'
+///   IDENT := [a-zA-Z_][a-zA-Z0-9._-]*
+///
+/// Identifiers resolve against a `Map<String, bool>` context. A missing
+/// identifier evaluates to `false` — bindings can assume any required
+/// scope flag is published by the producing service.
+///
+/// The grammar is intentionally small: no equality, no arithmetic, no
+/// string literals. If a binding needs more, the producing service
+/// should publish a richer named flag (e.g. `editor.dirty`).
+library;
+
+import 'package:flutter/foundation.dart';
+
+@immutable
+sealed class WhenExpr {
+  const WhenExpr();
+
+  /// Evaluate against [context]. Missing identifiers are `false`.
+  bool evaluate(Map<String, bool> context);
+
+  /// Parse [source]. Throws [FormatException] on syntax errors.
+  static WhenExpr parse(String source) => _Parser(source).parseAll();
+
+  /// Convenience: null on empty input, otherwise [parse].
+  static WhenExpr? tryParse(String? source) {
+    if (source == null || source.trim().isEmpty) return null;
+    return parse(source);
+  }
+}
+
+class WhenIdent extends WhenExpr {
+  const WhenIdent(this.name);
+  final String name;
+  @override
+  bool evaluate(Map<String, bool> context) => context[name] ?? false;
+  @override
+  String toString() => name;
+}
+
+class WhenNot extends WhenExpr {
+  const WhenNot(this.child);
+  final WhenExpr child;
+  @override
+  bool evaluate(Map<String, bool> context) => !child.evaluate(context);
+  @override
+  String toString() => '!$child';
+}
+
+class WhenAnd extends WhenExpr {
+  const WhenAnd(this.left, this.right);
+  final WhenExpr left;
+  final WhenExpr right;
+  @override
+  bool evaluate(Map<String, bool> context) => left.evaluate(context) && right.evaluate(context);
+  @override
+  String toString() => '($left && $right)';
+}
+
+class WhenOr extends WhenExpr {
+  const WhenOr(this.left, this.right);
+  final WhenExpr left;
+  final WhenExpr right;
+  @override
+  bool evaluate(Map<String, bool> context) => left.evaluate(context) || right.evaluate(context);
+  @override
+  String toString() => '($left || $right)';
+}
+
+// -- Parser -----------------------------------------------------------------
+
+class _Parser {
+  _Parser(this._src);
+
+  final String _src;
+  int _pos = 0;
+
+  WhenExpr parseAll() {
+    _skip();
+    final e = _or();
+    _skip();
+    if (_pos != _src.length) {
+      throw FormatException('unexpected "${_src[_pos]}" at column ${_pos + 1} in when-clause: "$_src"');
+    }
+    return e;
+  }
+
+  WhenExpr _or() {
+    var left = _and();
+    while (_consume('||')) {
+      final right = _and();
+      left = WhenOr(left, right);
+    }
+    return left;
+  }
+
+  WhenExpr _and() {
+    var left = _unary();
+    while (_consume('&&')) {
+      final right = _unary();
+      left = WhenAnd(left, right);
+    }
+    return left;
+  }
+
+  WhenExpr _unary() {
+    _skip();
+    if (_consume('!')) {
+      return WhenNot(_unary());
+    }
+    return _atom();
+  }
+
+  WhenExpr _atom() {
+    _skip();
+    if (_consume('(')) {
+      final inner = _or();
+      _skip();
+      if (!_consume(')')) {
+        throw FormatException('expected ")" at column ${_pos + 1} in when-clause: "$_src"');
+      }
+      return inner;
+    }
+    final ident = _ident();
+    if (ident == null) {
+      final at = _pos < _src.length ? '"${_src[_pos]}"' : 'end of input';
+      throw FormatException('expected identifier at column ${_pos + 1} in when-clause: "$_src" (got $at)');
+    }
+    return WhenIdent(ident);
+  }
+
+  String? _ident() {
+    _skip();
+    final start = _pos;
+    if (_pos >= _src.length) return null;
+    final first = _src.codeUnitAt(_pos);
+    if (!_isIdentStart(first)) return null;
+    _pos++;
+    while (_pos < _src.length && _isIdentCont(_src.codeUnitAt(_pos))) {
+      _pos++;
+    }
+    return _src.substring(start, _pos);
+  }
+
+  bool _consume(String token) {
+    _skip();
+    if (_src.startsWith(token, _pos)) {
+      _pos += token.length;
+      return true;
+    }
+    return false;
+  }
+
+  void _skip() {
+    while (_pos < _src.length && _isSpace(_src.codeUnitAt(_pos))) {
+      _pos++;
+    }
+  }
+}
+
+bool _isSpace(int c) => c == 0x20 || c == 0x09 || c == 0x0A || c == 0x0D;
+
+bool _isIdentStart(int c) {
+  // a-z | A-Z | _
+  return (c >= 0x61 && c <= 0x7A) || (c >= 0x41 && c <= 0x5A) || c == 0x5F;
+}
+
+bool _isIdentCont(int c) {
+  // a-z | A-Z | 0-9 | _ . -
+  return _isIdentStart(c) || (c >= 0x30 && c <= 0x39) || c == 0x2E || c == 0x2D;
+}

lib/kernel/src/panels/drag_resize.dart

@@ -1,11 +1,16 @@
 import 'package:clide/kernel/src/panels/arrangement.dart';
 import 'package:clide/kernel/src/panels/slot_id.dart';
 import 'package:clide/kernel/src/theme/controller.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter/widgets.dart';
 
-/// A 4-px draggable splitter that adjusts the size of [slot] in the
-/// given [arrangement]. Slot hosts wrap this around their edges to make
-/// the three-column layout resizable.
+/// A 4-px splitter that adjusts the size of [slot] in [arrangement].
+/// Slot hosts wrap this around their edges to make the three-column
+/// layout resizable.
+///
+/// Drag with the mouse, or tab to it and use the arrow keys (Shift =
+/// coarse step). Exposes a `slider` Semantics node so screen readers
+/// announce the current width.
 class DragResizeHandle extends StatefulWidget {
   const DragResizeHandle({
     super.key,
@@ -21,6 +26,8 @@ class DragResizeHandle extends StatefulWidget {
   final double thickness;
 
   static const defaultThickness = 8.0;
+  static const double stepFine = 10.0;
+  static const double stepCoarse = 50.0;
 
   @override
   State<DragResizeHandle> createState() => _DragResizeHandleState();
@@ -28,32 +35,57 @@ class DragResizeHandle extends StatefulWidget {
 
 class _DragResizeHandleState extends State<DragResizeHandle> {
   bool _hovered = false;
+  bool _focused = false;
   double? _dragStartSize;
   Offset? _dragStartPointer;
 
   @override
   Widget build(BuildContext context) {
     final tokens = ClideTheme.of(context).surface;
-    final lineColor = _hovered ? tokens.panelActiveBorder : tokens.dividerColor;
+    final lineColor = (_hovered || _focused) ? tokens.panelActiveBorder : tokens.dividerColor;
 
-    return MouseRegion(
-      cursor: widget.axis == Axis.horizontal ? SystemMouseCursors.resizeColumn : SystemMouseCursors.resizeRow,
-      onEnter: (_) => setState(() => _hovered = true),
-      onExit: (_) => setState(() => _hovered = false),
-      child: Listener(
-        onPointerDown: _onDown,
-        onPointerMove: _onMove,
-        onPointerUp: _onUp,
-        child: Container(
-          width: widget.axis == Axis.horizontal ? widget.thickness : null,
-          height: widget.axis == Axis.vertical ? widget.thickness : null,
-          color: tokens.chromeBackground,
-          child: Align(
-            alignment: widget.slot == Slots.sidebar ? Alignment.centerRight : Alignment.centerLeft,
+    final size = widget.arrangement.sizeOf(widget.slot);
+
+    return Semantics(
+      container: true,
+      slider: true,
+      label: _semanticLabel(),
+      value: size == null ? null : '${size.round()} pixels',
+      increasedValue: size == null ? null : '${(size + DragResizeHandle.stepFine).round()} pixels',
+      decreasedValue: size == null ? null : '${(size - DragResizeHandle.stepFine).round()} pixels',
+      onIncrease: () => _bump(DragResizeHandle.stepFine),
+      onDecrease: () => _bump(-DragResizeHandle.stepFine),
+      child: FocusableActionDetector(
+        onShowFocusHighlight: (v) => setState(() => _focused = v),
+        shortcuts: _shortcuts(),
+        actions: <Type, Action<Intent>>{
+          _BumpIntent: CallbackAction<_BumpIntent>(
+            onInvoke: (intent) {
+              _bump(intent.delta);
+              return null;
+            },
+          ),
+        },
+        child: MouseRegion(
+          cursor: widget.axis == Axis.horizontal ? SystemMouseCursors.resizeColumn : SystemMouseCursors.resizeRow,
+          onEnter: (_) => setState(() => _hovered = true),
+          onExit: (_) => setState(() => _hovered = false),
+          child: Listener(
+            onPointerDown: _onDown,
+            onPointerMove: _onMove,
+            onPointerUp: _onUp,
             child: Container(
-              width: widget.axis == Axis.horizontal ? 1 : null,
-              height: widget.axis == Axis.vertical ? 1 : null,
-              color: lineColor,
+              width: widget.axis == Axis.horizontal ? widget.thickness : null,
+              height: widget.axis == Axis.vertical ? widget.thickness : null,
+              color: tokens.chromeBackground,
+              child: Align(
+                alignment: widget.slot == Slots.sidebar ? Alignment.centerRight : Alignment.centerLeft,
+                child: Container(
+                  width: widget.axis == Axis.horizontal ? (_focused ? 2 : 1) : null,
+                  height: widget.axis == Axis.vertical ? (_focused ? 2 : 1) : null,
+                  color: lineColor,
+                ),
+              ),
             ),
           ),
         ),
@@ -61,6 +93,38 @@ class _DragResizeHandleState extends State<DragResizeHandle> {
     );
   }
 
+  String _semanticLabel() {
+    final axis = widget.axis == Axis.horizontal ? 'width' : 'height';
+    if (widget.slot == Slots.sidebar) return 'Sidebar $axis';
+    if (widget.slot == Slots.contextPanel) return 'Context panel $axis';
+    return '${widget.slot.value} $axis';
+  }
+
+  Map<ShortcutActivator, Intent> _shortcuts() {
+    final horiz = widget.axis == Axis.horizontal;
+    final fine = DragResizeHandle.stepFine;
+    final coarse = DragResizeHandle.stepCoarse;
+    return <ShortcutActivator, Intent>{
+      if (horiz) ...{
+        const SingleActivator(LogicalKeyboardKey.arrowLeft): _BumpIntent(-fine),
+        const SingleActivator(LogicalKeyboardKey.arrowRight): _BumpIntent(fine),
+        const SingleActivator(LogicalKeyboardKey.arrowLeft, shift: true): _BumpIntent(-coarse),
+        const SingleActivator(LogicalKeyboardKey.arrowRight, shift: true): _BumpIntent(coarse),
+      } else ...{
+        const SingleActivator(LogicalKeyboardKey.arrowUp): _BumpIntent(-fine),
+        const SingleActivator(LogicalKeyboardKey.arrowDown): _BumpIntent(fine),
+        const SingleActivator(LogicalKeyboardKey.arrowUp, shift: true): _BumpIntent(-coarse),
+        const SingleActivator(LogicalKeyboardKey.arrowDown, shift: true): _BumpIntent(coarse),
+      },
+    };
+  }
+
+  void _bump(double rawDelta) {
+    final current = widget.arrangement.sizeOf(widget.slot);
+    if (current == null) return;
+    widget.arrangement.setSize(widget.slot, bumpedSlotSize(slot: widget.slot, current: current, rawDelta: rawDelta));
+  }
+
   void _onDown(PointerDownEvent e) {
     _dragStartSize = widget.arrangement.sizeOf(widget.slot);
     _dragStartPointer = e.position;
@@ -80,3 +144,22 @@ class _DragResizeHandleState extends State<DragResizeHandle> {
     _dragStartPointer = null;
   }
 }
+
+class _BumpIntent extends Intent {
+  const _BumpIntent(this.delta);
+  final double delta;
+}
+
+/// Apply a raw delta in the natural axis direction. Drag and arrow
+/// keys both call this so the keyboard mirrors the drag: positive
+/// delta = right/down. Context-panel sits on the right edge of the
+/// app, so we flip the sign there — right-arrow should *shrink* it,
+/// matching how dragging the left-edge handle rightward works.
+double bumpedSlotSize({
+  required SlotId slot,
+  required double current,
+  required double rawDelta,
+}) {
+  final delta = slot == Slots.contextPanel ? -rawDelta : rawDelta;
+  return current + delta;
+}

lib/kernel/src/syntax/tree_sitter_ffi.dart

@@ -243,6 +243,15 @@ class TreeSitterLib {
   @visibleForTesting
   static TreeSitterLib fromDynamicLibrary(DynamicLibrary lib) => TreeSitterLib._(lib);
 
+  /// Most recent error raised while trying to dlopen the tree-sitter
+  /// library, paired with the path that was attempted. Cleared on a
+  /// successful open. Null means "no attempt failed yet."
+  ///
+  /// Callers that observe a null `instance` after `init()` should read
+  /// this for the diagnostic instead of guessing.
+  static Object? lastOpenError;
+  static String? lastOpenErrorPath;
+
   static DynamicLibrary? _openLibrary() {
     final libName = Platform.isLinux
         ? 'libtree-sitter.so'
@@ -251,12 +260,22 @@ class TreeSitterLib {
             : Platform.isWindows
                 ? 'tree-sitter.dll'
                 : null;
-    if (libName == null) return null;
+    if (libName == null) {
+      lastOpenError = 'unsupported platform ${Platform.operatingSystem}';
+      lastOpenErrorPath = null;
+      return null;
+    }
 
     // Try standard dlopen path first (works when lib is in bundle/lib/).
     try {
-      return DynamicLibrary.open(libName);
-    } catch (_) {}
+      final lib = DynamicLibrary.open(libName);
+      lastOpenError = null;
+      lastOpenErrorPath = null;
+      return lib;
+    } catch (e) {
+      lastOpenError = e;
+      lastOpenErrorPath = libName;
+    }
 
     // Try next to executable.
     final exe = File(Platform.resolvedExecutable).parent.path;
@@ -264,8 +283,14 @@ class TreeSitterLib {
       final path = '$dir/$libName';
       if (File(path).existsSync()) {
         try {
-          return DynamicLibrary.open(path);
-        } catch (_) {}
+          final lib = DynamicLibrary.open(path);
+          lastOpenError = null;
+          lastOpenErrorPath = null;
+          return lib;
+        } catch (e) {
+          lastOpenError = e;
+          lastOpenErrorPath = path;
+        }
       }
     }
     return null;

lib/kernel/src/text_zoom.dart

@@ -0,0 +1,28 @@
+import 'package:flutter/foundation.dart';
+
+/// Workspace-wide text zoom factor.
+///
+/// Owned by the kernel rather than the root widget so command-palette
+/// entries, the keymap layer, and any future menu/CLI surface can mutate
+/// the same number. The root `MediaQuery` listens via [ChangeNotifier].
+class TextZoom extends ChangeNotifier {
+  TextZoom();
+
+  static const double minScale = 0.6;
+  static const double maxScale = 2.0;
+  static const double stepScale = 0.05;
+
+  double _scale = 1.0;
+  double get scale => _scale;
+
+  void increase() => _setScale(_scale + stepScale);
+  void decrease() => _setScale(_scale - stepScale);
+  void reset() => _setScale(1.0);
+
+  void _setScale(double next) {
+    final clamped = next.clamp(minScale, maxScale);
+    if (clamped == _scale) return;
+    _scale = clamped;
+    notifyListeners();
+  }
+}

lib/kernel/src/theme/contrast.dart

@@ -39,9 +39,15 @@ double contrastRatio(Color a, Color b, {Color onto = const Color(0xFF808080)}) {
 /// Minimum ratio required for this pair per WCAG AA.
 double minimumRatio(ContrastPair pair) => pair.largeText ? 3.0 : 4.5;
 
-/// Canonical set of token pairs each bundled theme must honour.
+/// Baseline token pairs every bundled theme must honour.
 ///
-/// The a11y contrast test walks this list per-theme.
+/// Per D-22 every named theme passes this set; per D-69 the named
+/// themes (`clide`, `midnight`, `paper`, `terminal`) are user
+/// contracts whose palettes are not retuned to chase a contrast gate,
+/// so only the load-bearing pairs (primary text on its surface, chrome
+/// foregrounds, selected list item) sit here. Stricter coverage for
+/// muted text, status chips, syntax tokens, and the focus border lives
+/// in [extendedPairs], which only `-hc`/`-cb` variants must pass.
 List<ContrastPair> canonicalPairs(SurfaceTokens s) => [
       ContrastPair(
         name: 'global.text_on_background',
@@ -100,10 +106,98 @@ List<ContrastPair> canonicalPairs(SurfaceTokens s) => [
       ),
     ];
 
-/// Convenience for tests: returns the list of pairs that fail WCAG AA.
-List<ContrastFailure> failingPairs(SurfaceTokens tokens) {
+/// Stricter pair set — only the high-contrast (`-hc`) and colour-blind
+/// (`-cb`) theme variants must clear it. See D-69. These are the
+/// surfaces a UX consultant flagged in `consultants.md`: muted body
+/// text, status chip foregrounds, syntax tokens on the code-block
+/// surface, and the focus-indicating panel border.
+List<ContrastPair> extendedPairs(SurfaceTokens s) => [
+      ContrastPair(
+        name: 'global.text_muted_on_background',
+        foreground: s.globalTextMuted,
+        background: s.globalBackground,
+      ),
+      ContrastPair(
+        name: 'global.text_muted_on_panel',
+        foreground: s.globalTextMuted,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'status.success_on_statusbar',
+        foreground: s.statusSuccess,
+        background: s.statusBarBackground,
+      ),
+      ContrastPair(
+        name: 'status.warning_on_statusbar',
+        foreground: s.statusWarning,
+        background: s.statusBarBackground,
+      ),
+      ContrastPair(
+        name: 'status.error_on_statusbar',
+        foreground: s.statusError,
+        background: s.statusBarBackground,
+      ),
+      ContrastPair(
+        name: 'status.info_on_statusbar',
+        foreground: s.statusInfo,
+        background: s.statusBarBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.keyword_on_panel',
+        foreground: s.syntaxKeyword,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.type_on_panel',
+        foreground: s.syntaxType,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.string_on_panel',
+        foreground: s.syntaxString,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.number_on_panel',
+        foreground: s.syntaxNumber,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.comment_on_panel',
+        foreground: s.syntaxComment,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.method_on_panel',
+        foreground: s.syntaxMethod,
+        background: s.panelBackground,
+      ),
+      ContrastPair(
+        name: 'syntax.punct_on_panel',
+        foreground: s.syntaxPunct,
+        background: s.panelBackground,
+      ),
+      // WCAG 1.4.11 wants 3:1 for non-text UI components like a focus
+      // border against the adjacent surface.
+      ContrastPair(
+        name: 'panel.active_border_on_background',
+        foreground: s.panelActiveBorder,
+        background: s.globalBackground,
+        largeText: true,
+      ),
+    ];
+
+/// Convenience for tests: returns the list of [canonicalPairs] that
+/// fail WCAG AA.
+List<ContrastFailure> failingPairs(SurfaceTokens tokens) => _failures(canonicalPairs(tokens));
+
+/// Strict variant of [failingPairs] — walks [extendedPairs] instead.
+/// Intended for the `-hc` / `-cb` theme gate.
+List<ContrastFailure> failingExtendedPairs(SurfaceTokens tokens) => _failures(extendedPairs(tokens));
+
+List<ContrastFailure> _failures(List<ContrastPair> pairs) {
   final out = <ContrastFailure>[];
-  for (final p in canonicalPairs(tokens)) {
+  for (final p in pairs) {
     final ratio = contrastRatio(p.foreground, p.background);
     final need = minimumRatio(p);
     if (ratio < need) {

lib/kernel/src/theme/resolver.dart

@@ -96,6 +96,9 @@ class ThemeResolver {
       modalOverlayBackground: surface[TokenKeys.modalOverlayBackground]!,
       modalSurfaceBackground: surface[TokenKeys.modalSurfaceBackground]!,
       modalSurfaceBorder: surface[TokenKeys.modalSurfaceBorder]!,
+      windowControlCloseHoverBackground: surface[TokenKeys.windowControlCloseHoverBackground]!,
+      windowControlCloseHoverForeground: surface[TokenKeys.windowControlCloseHoverForeground]!,
+      shadowAmbient: surface[TokenKeys.shadowAmbient]!,
       dividerColor: surface[TokenKeys.dividerColor]!,
       statusSuccess: surface[TokenKeys.statusSuccess]!,
       statusWarning: surface[TokenKeys.statusWarning]!,
@@ -250,6 +253,14 @@ const Map<String, List<String>> _defaultSurfaceMap = {
   TokenKeys.modalOverlayBackground: ['#C0000000'],
   TokenKeys.modalSurfaceBackground: ['surface', 'semantic.mainchrome'],
   TokenKeys.modalSurfaceBorder: ['accent', 'semantic.focus'],
+  // window controls — the Windows-style red close button is a hard
+  // platform convention, not a theme accent; the foreground stays
+  // white so the glyph remains visible across all themes.
+  TokenKeys.windowControlCloseHoverBackground: ['#FFE81123'],
+  TokenKeys.windowControlCloseHoverForeground: ['#FFFFFFFF'],
+  // shadow — translucent black works for dark themes; light themes can
+  // override this to a translucent ink (e.g. paper uses softer alpha).
+  TokenKeys.shadowAmbient: ['#40000000'],
   // divider
   TokenKeys.dividerColor: ['border', 'semantic.surface'],
   // status

lib/kernel/src/theme/themes/clide-hc.yaml

@@ -0,0 +1,38 @@
+# clide-hc — high-contrast sibling of `clide`
+#
+# Same periwinkle silhouette; muted text, status chips, syntax tokens,
+# and the focus border bumped to clear the strict contrast gate
+# (D-22 + D-69, `extendedPairs` in lib/kernel/src/theme/contrast.dart).
+
+name: clide-hc
+display_name: Clide (high contrast)
+dark: true
+
+palette:
+  background: "#20202C"
+  panel: "#1A1A24"
+  surface: "#242838"
+  muted: "#B1BBE3"
+  foreground: "#E6E8F2"
+  secondary: "#B1BBE3"
+  primary: "#92B5FF"
+  accent: "#92B5FF"
+  success: "#A8E8C8"
+  warning: "#FFD988"
+  error: "#FF9F9F"
+  info: "#A6C8FF"
+  surfaceHi: "#2C3046"
+  border: "#343850"
+  borderHi: "#92B5FF"
+  textDim: "#B1BBE3"
+  textMute: "#9098C0"
+  accentSoft: "#2192B5FF"
+
+syntax:
+  keyword: "#E0B5F2"
+  type: "#A6C8FF"
+  string: "#C2E8B0"
+  number: "#FFD988"
+  comment: "#9098C0"
+  method: "#A6C8FF"
+  punct: "#B1BBE3"

lib/kernel/src/theme/themes/midnight-hc.yaml

@@ -0,0 +1,39 @@
+# midnight-hc — high-contrast sibling of `midnight`
+#
+# Same VS Code-adjacent silhouette; muted text, status chips, syntax
+# tokens, and the focus border bumped to clear the strict contrast
+# gate (D-22 + D-69, `extendedPairs` in lib/kernel/src/theme/contrast.dart).
+
+name: midnight-hc
+display_name: Midnight (high contrast)
+dark: true
+
+palette:
+  background: "#1E1E1E"
+  panel: "#181818"
+  surface: "#252526"
+  muted: "#BDBDBD"
+  foreground: "#F0F0F0"
+  secondary: "#D4D4D4"
+  primary: "#82BFFF"
+  accent: "#82BFFF"
+  success: "#B5E2B0"
+  warning: "#E9D89E"
+  error: "#FFB3A5"
+  info: "#9BC9F0"
+  onAccent: "#0B1220"
+  surfaceHi: "#2D2D2E"
+  border: "#333333"
+  borderHi: "#9C9C9C"
+  textDim: "#BDBDBD"
+  textMute: "#9A9A9A"
+  accentSoft: "#2182BFFF"
+
+syntax:
+  keyword: "#D9A1D3"
+  type: "#66D9C2"
+  string: "#E9B299"
+  number: "#C8E0B7"
+  comment: "#99CB80"
+  method: "#E5E5B5"
+  punct: "#BDBDBD"

lib/kernel/src/theme/themes/paper-hc.yaml

@@ -0,0 +1,41 @@
+# paper-hc — high-contrast sibling of `paper`
+#
+# Drafting sheet, red-pencil accent — darker ink so muted text, status
+# chips, syntax tokens, and the focus border clear the strict contrast
+# gate (D-22 + D-69, `extendedPairs` in lib/kernel/src/theme/contrast.dart).
+
+name: paper-hc
+display_name: Paper (high contrast)
+dark: false
+
+palette:
+  background: "#F4F1EA"
+  panel: "#ECE7DB"
+  surface: "#FBF8F1"
+  muted: "#4A4A48"
+  foreground: "#0E0E0E"
+  secondary: "#1F1F1F"
+  primary: "#8E2D10"
+  accent: "#6E2410"
+  success: "#1A4A2B"
+  warning: "#6A4C00"
+  error: "#7A1F12"
+  info: "#154168"
+  surfaceHi: "#ECE7DB"
+  border: "#0E0E0E"
+  borderHi: "#3A3A38"
+  textDim: "#4A4A48"
+  textMute: "#7A7A72"
+  accentSoft: "#218E2D10"
+
+surface:
+  shadow.ambient: "#26000000"
+
+syntax:
+  keyword: "#52215C"
+  type: "#154168"
+  string: "#1A4A2B"
+  number: "#6A4C00"
+  comment: "#4A4A48"
+  method: "#103E6F"
+  punct: "#1F1F1F"

lib/kernel/src/theme/themes/paper.yaml

@@ -25,6 +25,9 @@ palette:
   textMute: "#A8A89E"
   accentSoft: "#21C14B2A"
 
+surface:
+  shadow.ambient: "#26000000"
+
 syntax:
   keyword: "#7B3F8C"
   type: "#2A6FC1"

lib/kernel/src/theme/themes/terminal-hc.yaml

@@ -0,0 +1,38 @@
+# terminal-hc — high-contrast sibling of `terminal`
+#
+# Near-black + amber tmux feel; muted text, status chips, syntax tokens,
+# and the focus border bumped to clear the strict contrast gate
+# (D-22 + D-69, `extendedPairs` in lib/kernel/src/theme/contrast.dart).
+
+name: terminal-hc
+display_name: Terminal (high contrast)
+dark: true
+
+palette:
+  background: "#0A0A0A"
+  panel: "#000000"
+  surface: "#111111"
+  muted: "#B5B5B5"
+  foreground: "#F0F0F0"
+  secondary: "#D6D6D6"
+  primary: "#FFC868"
+  accent: "#FFC868"
+  success: "#B5E2B0"
+  warning: "#FFD988"
+  error: "#FFA5A5"
+  info: "#B0C8FF"
+  surfaceHi: "#181818"
+  border: "#242424"
+  borderHi: "#888888"
+  textDim: "#B5B5B5"
+  textMute: "#9A9A9A"
+  accentSoft: "#21FFC868"
+
+syntax:
+  keyword: "#FF8585"
+  type: "#FFD27A"
+  string: "#B5E2B0"
+  number: "#DAA7FF"
+  comment: "#9A9A9A"
+  method: "#BCD8FF"
+  punct: "#B5B5B5"

lib/kernel/src/theme/tokens.dart

@@ -74,6 +74,11 @@ class SurfaceTokens {
     required this.modalOverlayBackground,
     required this.modalSurfaceBackground,
     required this.modalSurfaceBorder,
+    // window controls
+    required this.windowControlCloseHoverBackground,
+    required this.windowControlCloseHoverForeground,
+    // shadow
+    required this.shadowAmbient,
     // divider
     required this.dividerColor,
     // status
@@ -155,6 +160,17 @@ class SurfaceTokens {
   final Color modalSurfaceBackground;
   final Color modalSurfaceBorder;
 
+  /// Hover background on the Windows-style close button. Conventionally
+  /// the destructive-action red even on dark themes that don't otherwise
+  /// surface red as a CTA.
+  final Color windowControlCloseHoverBackground;
+  final Color windowControlCloseHoverForeground;
+
+  /// Ambient drop-shadow color for floating surfaces (palette,
+  /// dropdowns, modals). Typically a translucent black on dark themes
+  /// and a translucent ink on light themes.
+  final Color shadowAmbient;
+
   final Color dividerColor;
 
   final Color statusSuccess;
@@ -255,6 +271,13 @@ abstract class TokenKeys {
   static const modalSurfaceBackground = 'modal.surfaceBackground';
   static const modalSurfaceBorder = 'modal.surfaceBorder';
 
+  // window controls
+  static const windowControlCloseHoverBackground = 'windowControl.closeHoverBackground';
+  static const windowControlCloseHoverForeground = 'windowControl.closeHoverForeground';
+
+  // shadow
+  static const shadowAmbient = 'shadow.ambient';
+
   // divider
   static const dividerColor = 'divider.color';
 
@@ -325,6 +348,9 @@ abstract class TokenKeys {
     modalOverlayBackground,
     modalSurfaceBackground,
     modalSurfaceBorder,
+    windowControlCloseHoverBackground,
+    windowControlCloseHoverForeground,
+    shadowAmbient,
     dividerColor,
     statusSuccess,
     statusWarning,

lib/main.dart

@@ -20,6 +20,7 @@ import 'package:clide/builtin/problems/problems.dart';
 import 'package:clide/builtin/settings_ui/settings_ui.dart';
 import 'package:clide/builtin/terminal/terminal.dart';
 import 'package:clide/builtin/theme_picker/theme_picker.dart';
+import 'package:clide/builtin/view/view.dart';
 import 'package:clide/builtin/tickets/tickets.dart';
 import 'package:clide/builtin/todos/todos.dart';
 import 'package:clide/builtin/welcome/welcome.dart';
@@ -48,10 +49,15 @@ Future<void> main() async {
   final binding = WidgetsFlutterBinding.ensureInitialized();
 
   // Test mode: skip the full app, run the test harness instead.
-  const testMode = String.fromEnvironment('CLIDE_TESTMODE');
-  if (testMode.isNotEmpty) {
-    runApp(const ClideTestApp());
-    return;
+  // Gated on kDebugMode so the release tree-shaker can elide both the
+  // branch and the test_app import graph — production binaries don't
+  // ship the harness.
+  if (kDebugMode) {
+    const testMode = String.fromEnvironment('CLIDE_TESTMODE');
+    if (testMode.isNotEmpty) {
+      runApp(const ClideTestApp());
+      return;
+    }
   }
 
   binding.ensureSemantics();
@@ -140,6 +146,7 @@ Future<void> main() async {
     ..register(CanvasExtension())
     ..register(GraphExtension())
     // UI extensions
+    ..register(ViewExtension(textZoom: services.textZoom))
     ..register(SettingsUiExtension())
     ..register(ExtensionsUiExtension())
     ..register(KeybindingsUiExtension())
@@ -202,6 +209,10 @@ Future<List<ThemeDefinition>> _loadBundledThemes() async {
     'lib/kernel/src/theme/themes/midnight.yaml',
     'lib/kernel/src/theme/themes/paper.yaml',
     'lib/kernel/src/theme/themes/terminal.yaml',
+    'lib/kernel/src/theme/themes/clide-hc.yaml',
+    'lib/kernel/src/theme/themes/midnight-hc.yaml',
+    'lib/kernel/src/theme/themes/paper-hc.yaml',
+    'lib/kernel/src/theme/themes/terminal-hc.yaml',
   ];
   final out = <ThemeDefinition>[];
   for (final p in paths) {

lib/src/daemon/files_commands.dart

@@ -13,6 +13,11 @@ import '../ipc/schema_v1.dart';
 import '../panes/event_sink.dart';
 import 'dispatcher.dart';
 
+/// Cap on `files.read` response size. UI doesn't render multi-MB
+/// blobs usefully and a single uncapped call can OOM. Range/stream
+/// reads will land as a separate command (T-104 follow-up).
+const int _filesReadMaxBytes = 10 * 1024 * 1024;
+
 /// Daemon-side state for the `files` subsystem. Holds one
 /// [FileWatcher] rooted at the workspace and a resolved [IgnoreSet].
 class FilesService {
@@ -84,6 +89,20 @@ void registerFilesCommands(DaemonDispatcher d, FilesService files) {
     if (!file.existsSync()) {
       return IpcResponse.err(id: req.id, error: IpcError(code: IpcExitCode.toolError, kind: IpcErrorKind.toolError, message: 'file not found: $path'));
     }
+    // Cap response size so a single IPC call can't OOM the UI on a
+    // multi-gigabyte log file. Caller can paginate / stream via a
+    // future range-read variant when that ships.
+    final length = file.lengthSync();
+    if (length > _filesReadMaxBytes) {
+      return IpcResponse.err(
+        id: req.id,
+        error: IpcError(
+          code: IpcExitCode.toolError,
+          kind: IpcErrorKind.toolError,
+          message: 'file too large: $path ($length bytes; cap $_filesReadMaxBytes)',
+        ),
+      );
+    }
     final content = file.readAsStringSync();
     return IpcResponse.ok(id: req.id, data: {'path': path, 'content': content});
   });

lib/src/daemon/git_commands.dart

@@ -12,6 +12,16 @@ import '../ipc/schema_v1.dart';
 import '../panes/event_sink.dart';
 import 'dispatcher.dart';
 
+/// Cap on `git.log --count` to keep a single query from spinning git
+/// up on multi-million-commit repos. UI's history pane paginates;
+/// callers asking for more should be using ranges instead.
+const int _gitLogMaxCount = 1000;
+
+/// Cap on `git.diff` and `git.stage` paths-list length so a single
+/// IPC request can't queue up an unbounded fan-out of subprocess
+/// arguments.
+const int _gitPathsMaxCount = 256;
+
 void registerGitCommands(
   DaemonDispatcher d,
   GitClient git,
@@ -30,6 +40,8 @@ void registerGitCommands(
     try {
       final staged = req.args['staged'] as bool? ?? false;
       final paths = _pathList(req.args['paths']);
+      final tooMany = _tooManyPaths(req.id, paths);
+      if (tooMany != null) return tooMany;
       final diffs = await git.diff(staged: staged, paths: paths);
       return IpcResponse.ok(id: req.id, data: {
         'staged': staged,
@@ -53,6 +65,8 @@ void registerGitCommands(
         ),
       );
     }
+    final tooMany = _tooManyPaths(req.id, paths);
+    if (tooMany != null) return tooMany;
     try {
       await git.stage(paths);
       _emitChanged(events);
@@ -190,8 +204,18 @@ void registerGitCommands(
   });
 
   d.register('git.log', (req) async {
+    final count = (req.args['count'] as num?)?.toInt() ?? 20;
+    if (count > _gitLogMaxCount) {
+      return IpcResponse.err(
+        id: req.id,
+        error: IpcError(
+          code: IpcExitCode.userError,
+          kind: IpcErrorKind.userError,
+          message: 'git.log count $count exceeds cap $_gitLogMaxCount',
+        ),
+      );
+    }
     try {
-      final count = (req.args['count'] as num?)?.toInt() ?? 20;
       final entries = await git.log(count: count);
       return IpcResponse.ok(id: req.id, data: {
         'entries': [for (final e in entries) e.toJson()],
@@ -264,6 +288,18 @@ List<String> _pathList(Object? raw) {
   return const [];
 }
 
+IpcResponse? _tooManyPaths(String id, List<String> paths) {
+  if (paths.length <= _gitPathsMaxCount) return null;
+  return IpcResponse.err(
+    id: id,
+    error: IpcError(
+      code: IpcExitCode.userError,
+      kind: IpcErrorKind.userError,
+      message: 'paths length ${paths.length} exceeds cap $_gitPathsMaxCount',
+    ),
+  );
+}
+
 void _emitChanged(DaemonEventSink events) {
   events.emit(IpcEvent(
     subsystem: 'git',

lib/src/git/client.dart

@@ -9,7 +9,7 @@ import 'dart:io';
 
 import '../../kernel/src/toolchain_paths.dart';
 import 'diff.dart' show GitDiff, parseDiffOutput;
-import 'operations.dart' show GitException, GitLogEntry;
+import 'operations.dart' show GitException, GitLogEntry, validateGitRef;
 import 'status.dart';
 
 class GitClient {
@@ -191,8 +191,13 @@ class GitClient {
   }
 
   Future<String> push({String? remote, String? branch, bool setUpstream = false}) async {
+    if (remote != null) validateGitRef(remote, kind: 'remote');
+    if (branch != null) validateGitRef(branch, kind: 'branch');
     final args = ['push'];
     if (setUpstream) args.add('-u');
+    // `--` terminates option parsing — belt-and-suspenders alongside
+    // the ref validator above.
+    args.add('--');
     if (remote != null) args.add(remote);
     if (branch != null) args.add(branch);
     final r = await _run(args);
@@ -201,6 +206,10 @@ class GitClient {
   }
 
   Future<void> checkout(String branch) async {
+    // `git checkout -- name` means pathspec, not branch — see the
+    // matching note in `operations.dart#gitCheckout`. validateGitRef
+    // is the only defence here.
+    validateGitRef(branch, kind: 'branch');
     final r = await _run(['checkout', branch]);
     if (r.exitCode != 0) throw GitException('git checkout failed', stderr: r.stderr as String);
   }

lib/src/git/operations.dart

@@ -37,6 +37,21 @@ class GitException implements Exception {
   String toString() => 'GitException: $message';
 }
 
+/// Validate a string about to be passed to git as a branch name,
+/// remote name, or similar ref-shaped positional argument. Rejects
+/// empty values and anything starting with `-`, which would otherwise
+/// be parsed as an option flag by git (the classic
+/// `--upload-pack=evil` argv-injection vector). Throws [GitException]
+/// — callers convert it to the right IPC error kind.
+void validateGitRef(String? value, {required String kind}) {
+  if (value == null || value.isEmpty) {
+    throw GitException('$kind is required');
+  }
+  if (value.startsWith('-')) {
+    throw GitException('$kind cannot start with "-" (looks like an option flag): $value');
+  }
+}
+
 class GitLogEntry {
   const GitLogEntry({
     required this.hash,
@@ -204,8 +219,14 @@ Future<String> gitPush(
   String? branch,
   bool setUpstream = false,
 }) async {
+  if (remote != null) validateGitRef(remote, kind: 'remote');
+  if (branch != null) validateGitRef(branch, kind: 'branch');
   final args = ['push'];
   if (setUpstream) args.add('-u');
+  // `--` terminates option parsing — belt-and-suspenders alongside
+  // the ref validator above. Without it a future caller that bypasses
+  // the validator could still inject `--upload-pack=...`.
+  args.add('--');
   if (remote != null) args.add(remote);
   if (branch != null) args.add(branch);
   final r = await Process.run(gitBin, args, workingDirectory: workDir.path);
@@ -236,7 +257,14 @@ Future<List<({String name, bool current})>> gitBranches(Directory workDir) async
 }
 
 /// Checkout a branch.
+///
+/// `git checkout` overloads positionals: `-- <name>` means "restore
+/// pathspec `<name>`", not "checkout branch `<name>`". So this can't
+/// use `--` as an option terminator without changing semantics — the
+/// [validateGitRef] guard against `-`-prefixed values is the only
+/// argv-injection defence here. Use `gitSwitch` if/when we adopt it.
 Future<void> gitCheckout(Directory workDir, String branch) async {
+  validateGitRef(branch, kind: 'branch');
   final r = await Process.run(
     gitBin,
     ['checkout', branch],

lib/src/ipc/errno_mapping.dart

@@ -15,6 +15,7 @@ abstract class PosixErrno {
   static const int eperm = 1;
   static const int enoent = 2;
   static const int esrch = 3;
+  static const int eintr = 4;
   static const int eio = 5;
   static const int ebadf = 9;
   static const int eagain = 11;

lib/src/panes/event_sink.dart

@@ -7,6 +7,8 @@
 /// (server depends on subsystems, not the other way round).
 library;
 
+import 'dart:async';
+
 import '../ipc/envelope.dart';
 
 abstract class DaemonEventSink {
@@ -16,10 +18,20 @@ abstract class DaemonEventSink {
 /// In-memory recording sink for tests + for composing multi-sink
 /// scenarios (e.g. tee to both the wire and an audit log).
 class RecordingEventSink implements DaemonEventSink {
+  RecordingEventSink();
   final List<IpcEvent> events = [];
+  final _controller = StreamController<IpcEvent>.broadcast();
 
   @override
-  void emit(IpcEvent event) => events.add(event);
+  void emit(IpcEvent event) {
+    events.add(event);
+    _controller.add(event);
+  }
+
+  /// Live stream of every event emitted into this sink. Tests use
+  /// `stream.firstWhere(...)` for event-driven waits instead of
+  /// polling the [events] list with `Future.delayed`.
+  Stream<IpcEvent> get stream => _controller.stream;
 
   /// Convenience: filter to a single subsystem (`pane`, `git`, …).
   Iterable<IpcEvent> ofSubsystem(String subsystem) => events.where((e) => e.subsystem == subsystem);

lib/src/pty/ffi/libc.dart

@@ -47,6 +47,19 @@ const int fSetFl = 4;
 
 final int tiocswinsz = Platform.isMacOS ? 0x80087467 : 0x5414;
 
+// poll() event bits (POSIX — same numeric values on Linux + macOS).
+const int pollin = 0x0001;
+const int pollerr = 0x0008;
+const int pollhup = 0x0010;
+const int pollnval = 0x0020;
+const int pollAnyErr = pollerr | pollhup | pollnval;
+
+// Signal numbers used from the PTY layer (POSIX standard; identical
+// across Linux + macOS for the entries we touch).
+const int sighup = 1;
+const int sigkill = 9;
+const int sigwinch = 28;
+
 // ---------------------------------------------------------------------------
 // Typedefs
 // ---------------------------------------------------------------------------
@@ -198,9 +211,6 @@ final class CmsghdrDarwin extends ffi.Struct {
   external int cmsg_type;
 }
 
-// Alias for backward compatibility — callers use Cmsghdr.
-typedef Cmsghdr = CmsghdrLinux;
-
 /// POSIX `struct winsize` for `TIOCSWINSZ`.
 final class Winsize extends ffi.Struct {
   @ffi.Uint16()

lib/src/pty/native_pty.dart

@@ -25,6 +25,7 @@ import 'dart:typed_data';
 import 'package:ffi/ffi.dart';
 
 import 'errors.dart';
+import '../ipc/errno_mapping.dart' show PosixErrno;
 import 'ffi/libc.dart' as libc;
 
 // -- structs ----------------------------------------------------------------
@@ -107,7 +108,6 @@ final int _kSpawnSetsid = Platform.isMacOS ? 0x400 : 0x80;
 // platform layout (glibc posix_spawnattr_t is 336 B; macOS even smaller).
 const int _kSpawnStructBytes = 8192;
 
-const _kSighup = 1;
 const _kWnohang = 1;
 
 // -- NativePty --------------------------------------------------------------
@@ -343,14 +343,16 @@ class NativePty {
     final buf = malloc<ffi.Uint8>(65536);
     final pfd = calloc<_Pollfd>();
     pfd.ref.fd = fd;
-    pfd.ref.events = 0x0001; // POLLIN
+    pfd.ref.events = libc.pollin;
 
     try {
       while (true) {
         final ready = poll(pfd, 1, 100);
         if (ready < 0) break;
         if (ready == 0) continue;
-        if (pfd.ref.revents & 0x0038 != 0 && pfd.ref.revents & 0x0001 == 0) {
+        // Slave closed (POLLHUP / POLLERR / POLLNVAL) with no buffered
+        // bytes left to read — caller loop exits and we send EOF.
+        if (pfd.ref.revents & libc.pollAnyErr != 0 && pfd.ref.revents & libc.pollin == 0) {
           break;
         }
         final n = rd(fd, buf.cast(), 65536);
@@ -383,8 +385,8 @@ class NativePty {
         );
         if (n < 0) {
           final err = libc.errno;
-          if (err == 4 /* EINTR */) continue;
-          if (err == 9 /* EBADF */ || err == 32 /* EPIPE */) _dead = true;
+          if (err == PosixErrno.eintr) continue;
+          if (err == PosixErrno.ebadf || err == PosixErrno.epipe) _dead = true;
           throw PtyException('write', 'write to PTY failed', errno: err);
         }
         if (n == 0) break;
@@ -405,17 +407,16 @@ class NativePty {
       ..ref.wsCol = cols;
     final rc = _ioctl(_fd, _kTiocsWinsz, ws);
     calloc.free(ws);
-    if (rc < 0 && libc.errno == 9 /* EBADF */) {
+    if (rc < 0 && libc.errno == PosixErrno.ebadf) {
       _dead = true;
       return;
     }
     // Explicitly signal the child to re-query its terminal size.
-    // SIGWINCH = 28 on both macOS and Linux.
-    _nativeKill(pid, 28);
+    _nativeKill(pid, libc.sigwinch);
   }
 
   /// Send a signal to the child.
-  bool kill([int signal = _kSighup]) {
+  bool kill([int signal = libc.sighup]) {
     if (_dead) return false;
     return _nativeKill(pid, signal) == 0;
   }
@@ -444,7 +445,7 @@ class NativePty {
     // otherwise close() racing with start() leaves an orphan isolate.
     await _readerReady;
 
-    _nativeKill(pid, _kSighup);
+    _nativeKill(pid, libc.sighup);
     _nativeKill(pid, 9);
 
     // Wait for the isolate to send `null` (EOF) — confirms it has

lib/test_app.dart

@@ -246,6 +246,10 @@ class _ClideTestAppState extends State<ClideTestApp> {
         'lib/kernel/src/theme/themes/midnight.yaml',
         'lib/kernel/src/theme/themes/paper.yaml',
         'lib/kernel/src/theme/themes/terminal.yaml',
+        'lib/kernel/src/theme/themes/clide-hc.yaml',
+        'lib/kernel/src/theme/themes/midnight-hc.yaml',
+        'lib/kernel/src/theme/themes/paper-hc.yaml',
+        'lib/kernel/src/theme/themes/terminal-hc.yaml',
       ];
       for (final p in paths) {
         final name = p.split('/').last.replaceAll('.yaml', '');

lib/widgets/src/clide_column_hat.dart

@@ -108,7 +108,7 @@ class _WinButton extends StatelessWidget {
 
   @override
   Widget build(BuildContext context) {
-    final hoverBg = isClose ? const Color(0xFFE81123) : tokens.listItemHoverBackground;
+    final hoverBg = isClose ? tokens.windowControlCloseHoverBackground : tokens.listItemHoverBackground;
     return ClideTappable(
       onTap: onTap,
       builder: (context, hovered, _) => Container(
@@ -116,7 +116,11 @@ class _WinButton extends StatelessWidget {
         height: hatHeight,
         color: hovered ? hoverBg : null,
         alignment: Alignment.center,
-        child: ClideIcon(icon, size: 14, color: hovered && isClose ? const Color(0xFFFFFFFF) : tokens.globalTextMuted),
+        child: ClideIcon(
+          icon,
+          size: 14,
+          color: hovered && isClose ? tokens.windowControlCloseHoverForeground : tokens.globalTextMuted,
+        ),
       ),
     );
   }

lib/widgets/src/clide_palette.dart

@@ -12,21 +12,91 @@ class ClidePalette extends StatefulWidget {
 
 class _ClidePaletteState extends State<ClidePalette> {
   final _input = TextEditingController();
-  final _focus = FocusNode();
+  final _focus = FocusNode(debugLabel: 'ClidePalette.input');
+  final _itemKeys = <int, GlobalKey>{};
+
+  PaletteController? _palette;
+  KeymapService? _keymap;
 
   @override
-  void initState() {
-    super.initState();
-    _focus.requestFocus();
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    final kernel = ClideKernel.of(context);
+    if (!identical(_palette, kernel.palette)) {
+      _palette?.removeListener(_onPaletteChanged);
+      _palette = kernel.palette;
+      _palette!.addListener(_onPaletteChanged);
+      _syncFromController();
+    }
+    _keymap = kernel.keymap;
+    // Sync the initial state: if the palette was opened before this
+    // widget mounted (e.g., open()-then-pumpWidget in a test), no
+    // listener fires for the "already open" condition. Mirror what
+    // _onPaletteChanged would have done.
+    final isOpen = _palette?.isOpen ?? false;
+    _keymap?.setScopeFlag('palette.open', isOpen);
+    if (isOpen && !_focus.hasFocus) {
+      WidgetsBinding.instance.addPostFrameCallback((_) {
+        if (mounted && (_palette?.isOpen ?? false)) _focus.requestFocus();
+      });
+    }
   }
 
   @override
   void dispose() {
+    _palette?.removeListener(_onPaletteChanged);
+    _keymap?.clearScopeFlag('palette.open');
     _input.dispose();
     _focus.dispose();
     super.dispose();
   }
 
+  void _onPaletteChanged() {
+    final isOpen = _palette?.isOpen ?? false;
+    _keymap?.setScopeFlag('palette.open', isOpen);
+    if (isOpen) _focus.requestFocus();
+    _syncFromController();
+  }
+
+  void _syncFromController() {
+    final f = _palette?.filter ?? '';
+    if (_input.text != f) {
+      _input.value = TextEditingValue(text: f, selection: TextSelection.collapsed(offset: f.length));
+    }
+  }
+
+  Object? _selectNext(PaletteSelectNextIntent _) {
+    _palette?.selectNext();
+    _scrollSelectedIntoView();
+    return null;
+  }
+
+  Object? _selectPrev(PaletteSelectPreviousIntent _) {
+    _palette?.selectPrevious();
+    _scrollSelectedIntoView();
+    return null;
+  }
+
+  Object? _accept(PaletteAcceptIntent _) {
+    _palette?.acceptSelected();
+    _input.clear();
+    return null;
+  }
+
+  Object? _dismiss(DismissIntent _) {
+    _palette?.close();
+    return null;
+  }
+
+  void _scrollSelectedIntoView() {
+    final idx = _palette?.selectedIndex;
+    if (idx == null) return;
+    final key = _itemKeys[idx];
+    final ctx = key?.currentContext;
+    if (ctx == null) return;
+    Scrollable.ensureVisible(ctx, duration: const Duration(milliseconds: 120), alignment: 0.5);
+  }
+
   @override
   Widget build(BuildContext context) {
     final kernel = ClideKernel.of(context);
@@ -36,71 +106,84 @@ class _ClidePaletteState extends State<ClidePalette> {
       builder: (ctx, _) {
         if (!kernel.palette.isOpen) return const SizedBox.shrink();
         final filtered = kernel.palette.filtered();
+        final selected = kernel.palette.selectedIndex;
         return Positioned(
           top: 60,
           left: 0,
           right: 0,
           child: Center(
-            child: Container(
-              width: 480,
-              constraints: const BoxConstraints(maxHeight: 360),
-              decoration: BoxDecoration(
-                color: tokens.dropdownBackground,
-                border: Border.all(color: tokens.dropdownBorder),
-                borderRadius: BorderRadius.circular(6),
-                boxShadow: const [
-                  BoxShadow(
-                    color: Color(0x40000000),
-                    blurRadius: 12,
-                    offset: Offset(0, 4),
-                  ),
-                ],
-              ),
-              child: Column(
-                mainAxisSize: MainAxisSize.min,
-                children: [
-                  Padding(
-                    padding: const EdgeInsets.all(8),
-                    child: EditableText(
-                      controller: _input,
-                      focusNode: _focus,
-                      style: TextStyle(
-                        fontFamily: clideMonoFamily,
-                        fontSize: clideFontMono,
-                        color: tokens.dropdownForeground,
-                      ),
-                      cursorColor: tokens.globalFocus,
-                      backgroundCursorColor: tokens.globalFocus,
-                      maxLines: 1,
-                      onChanged: (v) => kernel.palette.setFilter(v),
-                      onSubmitted: (_) {
-                        if (filtered.isNotEmpty) {
-                          kernel.palette.invoke(filtered.first.command);
+            child: Actions(
+              actions: <Type, Action<Intent>>{
+                PaletteSelectNextIntent: CallbackAction<PaletteSelectNextIntent>(onInvoke: _selectNext),
+                PaletteSelectPreviousIntent: CallbackAction<PaletteSelectPreviousIntent>(onInvoke: _selectPrev),
+                PaletteAcceptIntent: CallbackAction<PaletteAcceptIntent>(onInvoke: _accept),
+                DismissIntent: CallbackAction<DismissIntent>(onInvoke: _dismiss),
+              },
+              child: Container(
+                width: 480,
+                constraints: const BoxConstraints(maxHeight: 360),
+                decoration: BoxDecoration(
+                  color: tokens.dropdownBackground,
+                  border: Border.all(color: tokens.dropdownBorder),
+                  borderRadius: BorderRadius.circular(6),
+                  boxShadow: [
+                    BoxShadow(
+                      color: tokens.shadowAmbient,
+                      blurRadius: 12,
+                      offset: const Offset(0, 4),
+                    ),
+                  ],
+                ),
+                child: Column(
+                  mainAxisSize: MainAxisSize.min,
+                  children: [
+                    Padding(
+                      padding: const EdgeInsets.all(8),
+                      child: EditableText(
+                        controller: _input,
+                        focusNode: _focus,
+                        style: TextStyle(
+                          fontFamily: clideMonoFamily,
+                          fontSize: clideFontMono,
+                          color: tokens.dropdownForeground,
+                        ),
+                        cursorColor: tokens.globalFocus,
+                        backgroundCursorColor: tokens.globalFocus,
+                        maxLines: 1,
+                        onChanged: (v) => kernel.palette.setFilter(v),
+                        // Enter on the input forwards to the palette
+                        // accept intent — keeps the legacy single-key
+                        // submit working alongside arrow-driven nav.
+                        onSubmitted: (_) {
+                          kernel.palette.acceptSelected();
                           _input.clear();
-                        }
-                      },
+                        },
+                      ),
                     ),
-                  ),
-                  Flexible(
-                    child: ListView.builder(
-                      shrinkWrap: true,
-                      padding: EdgeInsets.zero,
-                      itemCount: filtered.length,
-                      itemBuilder: (ctx, i) {
-                        final cmd = filtered[i];
-                        return _PaletteItem(
-                          title: cmd.title ?? cmd.command,
-                          command: cmd.command,
-                          binding: cmd.defaultBinding,
-                          onTap: () {
-                            kernel.palette.invoke(cmd.command);
-                            _input.clear();
-                          },
-                        );
-                      },
+                    Flexible(
+                      child: ListView.builder(
+                        shrinkWrap: true,
+                        padding: EdgeInsets.zero,
+                        itemCount: filtered.length,
+                        itemBuilder: (ctx, i) {
+                          final cmd = filtered[i];
+                          final key = _itemKeys.putIfAbsent(i, () => GlobalKey());
+                          return _PaletteItem(
+                            key: key,
+                            title: cmd.title ?? cmd.command,
+                            command: cmd.command,
+                            binding: cmd.defaultBinding,
+                            highlighted: i == selected,
+                            onTap: () {
+                              kernel.palette.invoke(cmd.command);
+                              _input.clear();
+                            },
+                          );
+                        },
+                      ),
                     ),
-                  ),
-                ],
+                  ],
+                ),
               ),
             ),
           ),
@@ -112,15 +195,18 @@ class _ClidePaletteState extends State<ClidePalette> {
 
 class _PaletteItem extends StatefulWidget {
   const _PaletteItem({
+    super.key,
     required this.title,
     required this.command,
     required this.onTap,
+    required this.highlighted,
     this.binding,
   });
 
   final String title;
   final String command;
   final String? binding;
+  final bool highlighted;
   final VoidCallback onTap;
 
   @override
@@ -133,6 +219,7 @@ class _PaletteItemState extends State<_PaletteItem> {
   @override
   Widget build(BuildContext context) {
     final tokens = ClideTheme.of(context).surface;
+    final selected = widget.highlighted;
     return MouseRegion(
       cursor: SystemMouseCursors.click,
       onEnter: (_) => setState(() => _hover = true),
@@ -140,14 +227,18 @@ class _PaletteItemState extends State<_PaletteItem> {
       child: GestureDetector(
         onTap: widget.onTap,
         child: Container(
-          color: _hover ? tokens.listItemHoverBackground : null,
+          color: selected
+              ? tokens.listItemSelectedBackground
+              : _hover
+                  ? tokens.listItemHoverBackground
+                  : null,
           padding: const EdgeInsets.symmetric(horizontal: 12, vertical: 6),
           child: Row(
             children: [
               Expanded(
                 child: ClideText(
                   widget.title,
-                  color: tokens.listItemForeground,
+                  color: selected ? tokens.listItemSelectedForeground : tokens.listItemForeground,
                 ),
               ),
               if (widget.binding != null)

lib/widgets/src/clide_tappable.dart

@@ -1,6 +1,15 @@
+import 'package:clide/kernel/kernel.dart' show ClideTheme;
 import 'package:clide/widgets/src/clide_tooltip.dart';
 import 'package:flutter/widgets.dart';
 
+/// Mouse + keyboard activatable surface. Wraps the [builder] child in
+/// a `Focus` so Tab traversal reaches it; an `Actions` provider that
+/// handles [ActivateIntent] by invoking [onTap] (the keymap binds
+/// Enter / Space to ActivateIntent by default); and a focus ring
+/// rendered via `tokens.globalFocus`.
+///
+/// Hover + pressed state still feed [builder] for visual feedback.
+/// Disabled state (`onTap == null`) blocks focus traversal too.
 class ClideTappable extends StatefulWidget {
   const ClideTappable({
     super.key,
@@ -10,6 +19,8 @@ class ClideTappable extends StatefulWidget {
     this.onPressChanged,
     this.cursor = SystemMouseCursors.click,
     this.tooltip,
+    this.focusNode,
+    this.autofocus = false,
   });
 
   final Widget Function(BuildContext context, bool hovered, bool pressed) builder;
@@ -18,6 +29,8 @@ class ClideTappable extends StatefulWidget {
   final ValueChanged<bool>? onPressChanged;
   final MouseCursor cursor;
   final String? tooltip;
+  final FocusNode? focusNode;
+  final bool autofocus;
 
   @override
   State<ClideTappable> createState() => _ClideTappableState();
@@ -26,6 +39,16 @@ class ClideTappable extends StatefulWidget {
 class _ClideTappableState extends State<ClideTappable> {
   bool _hover = false;
   bool _pressed = false;
+  bool _focused = false;
+  FocusNode? _internalFocus;
+
+  FocusNode get _effectiveFocus => widget.focusNode ?? (_internalFocus ??= FocusNode(debugLabel: 'ClideTappable'));
+
+  @override
+  void dispose() {
+    _internalFocus?.dispose();
+    super.dispose();
+  }
 
   void _setPressed(bool v) {
     if (_pressed == v) return;
@@ -33,10 +56,22 @@ class _ClideTappableState extends State<ClideTappable> {
     widget.onPressChanged?.call(v);
   }
 
+  void _setFocused(bool v) {
+    if (_focused == v) return;
+    setState(() => _focused = v);
+  }
+
+  Object? _activate(ActivateIntent _) {
+    widget.onTap?.call();
+    return null;
+  }
+
   @override
   Widget build(BuildContext context) {
+    final tokens = ClideTheme.of(context).surface;
+    final enabled = widget.onTap != null;
     Widget child = MouseRegion(
-      cursor: widget.cursor,
+      cursor: enabled ? widget.cursor : SystemMouseCursors.forbidden,
       onEnter: (_) => setState(() => _hover = true),
       onExit: (_) {
         setState(() => _hover = false);
@@ -46,12 +81,46 @@ class _ClideTappableState extends State<ClideTappable> {
         behavior: HitTestBehavior.opaque,
         onTap: widget.onTap,
         onLongPress: widget.onLongPress,
-        onTapDown: (_) => _setPressed(true),
-        onTapUp: (_) => _setPressed(false),
-        onTapCancel: () => _setPressed(false),
+        onTapDown: enabled ? (_) => _setPressed(true) : null,
+        onTapUp: enabled ? (_) => _setPressed(false) : null,
+        onTapCancel: enabled ? () => _setPressed(false) : null,
         child: widget.builder(context, _hover, _pressed),
       ),
     );
+
+    // Focus ring — 2 px outer outline in the global focus token. Drawn
+    // as a wrapping decoration so it sits outside the child's content
+    // without shifting layout (the same DecoratedBox always paints;
+    // border color falls through to transparent when unfocused).
+    child = DecoratedBox(
+      position: DecorationPosition.foreground,
+      decoration: BoxDecoration(
+        border: Border.all(
+          color: _focused ? tokens.globalFocus : const Color(0x00000000),
+          width: 2,
+        ),
+        borderRadius: BorderRadius.circular(3),
+      ),
+      child: child,
+    );
+
+    // Actions wraps Focus: dispatching ActivateIntent from the focused
+    // context (the node held by Focus) walks UP and finds this Actions
+    // provider. The reverse nesting would leave Actions as a descendant
+    // of the focused context — unreachable.
+    child = Actions(
+      actions: <Type, Action<Intent>>{
+        ActivateIntent: CallbackAction<ActivateIntent>(onInvoke: _activate),
+      },
+      child: Focus(
+        focusNode: _effectiveFocus,
+        canRequestFocus: enabled,
+        autofocus: widget.autofocus,
+        onFocusChange: _setFocused,
+        child: child,
+      ),
+    );
+
     if (widget.tooltip != null) {
       child = ClideTooltip(message: widget.tooltip!, child: child);
     }

pubspec.yaml

@@ -13,7 +13,7 @@ description: >-
   subsystem handlers (pane, files, editor, git, pql), and the
   extension framework.
 publish_to: none
-version: 2.0.0
+version: 2.1.0
 repository: https://github.com/postmeridiem/clide
 
 # Pre-push line-coverage floor. Ratchets up only — see D-66.
@@ -67,6 +67,7 @@ flutter:
   assets:
     - lib/kernel/src/theme/themes/
     - lib/kernel/src/i18n/catalog/
+    - assets/keymaps/
     - assets/licenses.yaml
     - assets/LICENSE
     - assets/fonts/jetbrains_mono/OFL.txt

test/a11y/contrast_test.dart

@@ -6,6 +6,10 @@ import 'package:flutter_test/flutter_test.dart';
 /// [canonicalPairs]) must clear 4.5:1 for normal text / 3:1 for large
 /// text. Failing pairs are printed with their computed ratio so a
 /// theme-token regression shows exactly which pair broke.
+///
+/// Themes whose name ends in `-hc` (high-contrast) or `-cb`
+/// (colour-blind) additionally have to clear the stricter
+/// [extendedPairs] set — D-69.
 void main() {
   TestWidgetsFlutterBinding.ensureInitialized();
 
@@ -15,6 +19,10 @@ void main() {
       'lib/kernel/src/theme/themes/midnight.yaml',
       'lib/kernel/src/theme/themes/paper.yaml',
       'lib/kernel/src/theme/themes/terminal.yaml',
+      'lib/kernel/src/theme/themes/clide-hc.yaml',
+      'lib/kernel/src/theme/themes/midnight-hc.yaml',
+      'lib/kernel/src/theme/themes/paper-hc.yaml',
+      'lib/kernel/src/theme/themes/terminal-hc.yaml',
     ];
 
     for (final path in bundledPaths) {
@@ -34,6 +42,16 @@ void main() {
             '${failures.map((f) => '  - $f').join('\n')}',
           );
         }
+        final isStrict = def.name.endsWith('-hc') || def.name.endsWith('-cb');
+        if (isStrict) {
+          final extended = failingExtendedPairs(tokens);
+          if (extended.isNotEmpty) {
+            fail(
+              'Extended contrast failures in ${def.name} (strict gate):\n'
+              '${extended.map((f) => '  - $f').join('\n')}',
+            );
+          }
+        }
       });
     }
   });

test/daemon/files_commands_test.dart

@@ -110,6 +110,22 @@ void main() {
     expect(r.error!.message, contains('not found'));
   });
 
+  test('files.read rejects a file over the size cap', () async {
+    // Cap is 10 MB; write 11 MB of zeros and confirm rejection rather
+    // than reading it into memory.
+    final big = File('${sandbox.path}/huge.bin');
+    final chunk = List<int>.filled(1024 * 1024, 0);
+    final sink = big.openWrite();
+    for (var i = 0; i < 11; i++) {
+      sink.add(chunk);
+    }
+    await sink.flush();
+    await sink.close();
+    final r = await call('files.read', const {'path': 'huge.bin'});
+    expect(r.ok, isFalse);
+    expect(r.error!.message, contains('too large'));
+  });
+
   test('files.ls with a path outside the root is rejected', () async {
     final r = await call('files.ls', const {'path': '../escape'});
     expect(r.ok, isFalse);

test/daemon/git_commands_test.dart

@@ -294,4 +294,45 @@ void main() {
     final r = await call('git.stage', {'paths': 'new.txt'});
     expect(r.ok, isTrue);
   });
+
+  test('git.checkout rejects a -prefixed branch (argv-injection guard)', () async {
+    final r = await call('git.checkout', {'branch': '--upload-pack=evil'});
+    expect(r.ok, isFalse);
+    expect(r.error?.message, contains('branch'));
+  });
+
+  test('git.push rejects a -prefixed remote', () async {
+    final r = await call('git.push', {'remote': '--upload-pack=evil', 'branch': 'main'});
+    expect(r.ok, isFalse);
+    expect(r.error?.message, contains('remote'));
+  });
+
+  test('git.push rejects a -prefixed branch', () async {
+    final r = await call('git.push', {'remote': 'origin', 'branch': '--exec=evil'});
+    expect(r.ok, isFalse);
+    expect(r.error?.message, contains('branch'));
+  });
+
+  test('git.log over the count cap fails as userError', () async {
+    final r = await call('git.log', {'count': 100000});
+    expect(r.ok, isFalse);
+    expect(r.error?.kind, IpcErrorKind.userError);
+    expect(r.error?.message, contains('exceeds cap'));
+  });
+
+  test('git.diff with too many paths fails as userError', () async {
+    final paths = [for (var i = 0; i < 300; i++) 'file_$i.txt'];
+    final r = await call('git.diff', {'paths': paths});
+    expect(r.ok, isFalse);
+    expect(r.error?.kind, IpcErrorKind.userError);
+    expect(r.error?.message, contains('exceeds cap'));
+  });
+
+  test('git.stage with too many paths fails as userError', () async {
+    final paths = [for (var i = 0; i < 300; i++) 'file_$i.txt'];
+    final r = await call('git.stage', {'paths': paths});
+    expect(r.ok, isFalse);
+    expect(r.error?.kind, IpcErrorKind.userError);
+    expect(r.error?.message, contains('exceeds cap'));
+  });
 }

test/files/watcher_test.dart

@@ -2,7 +2,6 @@
 /// Directory.watch against a tempdir.
 library;
 
-import 'dart:async';
 import 'dart:io';
 
 import 'package:clide/src/files/ignore.dart';
@@ -60,14 +59,20 @@ void main() {
 
     test('emits a created event when a file is added under root', () async {
       await watcher.start();
-      final received = <FileChange>[];
-      final sub = watcher.stream.listen(received.add);
-      addTearDown(sub.cancel);
-      // Give inotify a moment to settle, then create a file.
-      await Future<void>.delayed(const Duration(milliseconds: 50));
+      // Wait for the specific change rather than sleeping a fixed
+      // amount. firstWhere completes on the first matching event;
+      // the timeout fails the test with a clear message if inotify
+      // never delivers (instead of asserting on an empty list).
+      final saw = watcher.stream.firstWhere(
+        (c) => c.path == 'new.txt',
+        orElse: () => throw StateError('stream closed before new.txt arrived'),
+      );
       await File('${sandbox.path}/new.txt').writeAsString('hi');
-      await Future<void>.delayed(const Duration(milliseconds: 200));
-      expect(received.any((c) => c.path == 'new.txt'), isTrue);
+      final change = await saw.timeout(
+        const Duration(seconds: 5),
+        onTimeout: () => fail('no `new.txt` event within 5s'),
+      );
+      expect(change.path, 'new.txt');
     });
 
     test('filters ignored paths', () async {
@@ -75,11 +80,22 @@ void main() {
       final received = <FileChange>[];
       final sub = watcher.stream.listen(received.add);
       addTearDown(sub.cancel);
-      // .dart_tool/ is in the builtin ignore set.
-      await Future<void>.delayed(const Duration(milliseconds: 50));
-      final dt = Directory('${sandbox.path}/.dart_tool')..createSync();
-      await File('${dt.path}/hidden').writeAsString('x');
-      await Future<void>.delayed(const Duration(milliseconds: 200));
+
+      // Two-phase: a pre-marker proves inotify is delivering at all
+      // (warm-up), then create the ignored entry sandwiched between
+      // an actionable post-marker. When the post-marker arrives we
+      // know inotify has caught up to operations performed earlier
+      // in the same tick. Failing loudly with `fail()` beats the old
+      // fixed `Future.delayed(200)` that pretended a quiet stream was
+      // proof of filtering.
+      await File('${sandbox.path}/pre.txt').writeAsString('p');
+      await _expectReceived(received, (c) => c.path == 'pre.txt');
+
+      Directory('${sandbox.path}/.dart_tool').createSync();
+      await File('${sandbox.path}/.dart_tool/hidden').writeAsString('x');
+      await File('${sandbox.path}/post.txt').writeAsString('q');
+      await _expectReceived(received, (c) => c.path == 'post.txt');
+
       expect(received.any((c) => c.path.startsWith('.dart_tool')), isFalse);
     });
 
@@ -96,3 +112,17 @@ void main() {
     });
   });
 }
+
+/// Wait until [received] satisfies [predicate]. Polls the list (it
+/// gets mutated by the listener subscription) every 25 ms with a
+/// generous 8 s ceiling; fails loudly on miss instead of silently
+/// continuing as the old fixed-sleep tests did.
+Future<void> _expectReceived<T>(List<T> received, bool Function(T) predicate) async {
+  final deadline = DateTime.now().add(const Duration(seconds: 8));
+  while (!received.any(predicate)) {
+    if (DateTime.now().isAfter(deadline)) {
+      fail('expected event never arrived within 8s; received=${received.length} entries');
+    }
+    await Future<void>.delayed(const Duration(milliseconds: 25));
+  }
+}

test/git/operations_test.dart

@@ -227,6 +227,48 @@ void main() {
     } on GitException catch (_) {}
   });
 
+  test('gitPush rejects a -prefixed remote (argv-injection guard)', () async {
+    try {
+      await gitPush(sandbox, remote: '--upload-pack=evil', branch: 'main');
+      fail('expected GitException');
+    } on GitException catch (e) {
+      expect(e.message, contains('remote'));
+    }
+  });
+
+  test('gitPush rejects a -prefixed branch', () async {
+    try {
+      await gitPush(sandbox, remote: 'origin', branch: '--exec=evil');
+      fail('expected GitException');
+    } on GitException catch (e) {
+      expect(e.message, contains('branch'));
+    }
+  });
+
+  test('gitCheckout rejects a -prefixed branch', () async {
+    try {
+      await gitCheckout(sandbox, '--upload-pack=evil');
+      fail('expected GitException');
+    } on GitException catch (e) {
+      expect(e.message, contains('branch'));
+    }
+  });
+
+  test('gitCheckout rejects an empty branch', () async {
+    try {
+      await gitCheckout(sandbox, '');
+      fail('expected GitException');
+    } on GitException catch (e) {
+      expect(e.message, contains('branch'));
+    }
+  });
+
+  test('validateGitRef accepts plain refs', () {
+    expect(() => validateGitRef('main', kind: 'branch'), returnsNormally);
+    expect(() => validateGitRef('feature/foo', kind: 'branch'), returnsNormally);
+    expect(() => validateGitRef('origin', kind: 'remote'), returnsNormally);
+  });
+
   test('gitPull against no remote throws GitException', () async {
     try {
       await gitPull(sandbox);

test/kernel/src/keymap/key_chord_test.dart

@@ -0,0 +1,154 @@
+/// Unit tests for KeyChord parsing, equality, canonicalisation, and
+/// fromKeyEvent.
+library;
+
+import 'package:clide/kernel/src/keymap/key_chord.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  group('KeyChord.parse', () {
+    test('single key without modifiers', () {
+      final c = KeyChord.parse('enter');
+      expect(c.modifiers, isEmpty);
+      expect(c.key, LogicalKeyboardKey.enter);
+      expect(c.canonical, 'enter');
+    });
+
+    test('modifier order is canonicalised', () {
+      final a = KeyChord.parse('shift+ctrl+p');
+      final b = KeyChord.parse('ctrl+shift+p');
+      expect(a, b);
+      expect(a.canonical, 'ctrl+shift+p');
+    });
+
+    test('cmd/meta/command/super/win all alias the meta modifier', () {
+      for (final spec in ['cmd+a', 'meta+a', 'command+a', 'super+a', 'win+a']) {
+        expect(KeyChord.parse(spec).modifiers, [KeyModifier.meta], reason: spec);
+      }
+    });
+
+    test('punctuation keys are recognised by name or character', () {
+      expect(KeyChord.parse('ctrl+slash').key, LogicalKeyboardKey.slash);
+      expect(KeyChord.parse('ctrl+/').key, LogicalKeyboardKey.slash);
+      expect(KeyChord.parse('ctrl+equal').key, LogicalKeyboardKey.equal);
+      expect(KeyChord.parse('ctrl+=').key, LogicalKeyboardKey.equal);
+    });
+
+    test('parse is case-insensitive on modifiers + key name', () {
+      final c = KeyChord.parse('CTRL+SHIFT+P');
+      expect(c.modifiers, [KeyModifier.ctrl, KeyModifier.shift]);
+      expect(c.key, LogicalKeyboardKey.keyP);
+    });
+  });
+
+  group('KeyChord.parse — errors', () {
+    test('empty string throws', () {
+      expect(() => KeyChord.parse(''), throwsFormatException);
+    });
+
+    test('unknown modifier throws', () {
+      expect(() => KeyChord.parse('hyper+a'), throwsFormatException);
+    });
+
+    test('unknown key throws', () {
+      expect(() => KeyChord.parse('ctrl+definitely-not-a-key'), throwsFormatException);
+    });
+
+    test('trailing + (missing key) throws', () {
+      expect(() => KeyChord.parse('ctrl+'), throwsFormatException);
+    });
+  });
+
+  group('KeyChord display + canonical', () {
+    test('display capitalises modifiers + key, joined with +', () {
+      expect(KeyChord.parse('ctrl+shift+p').display, 'Ctrl+Shift+P');
+      expect(KeyChord.parse('enter').display, 'ENTER');
+    });
+
+    test('each modifier renders its own display string', () {
+      expect(KeyChord.parse('ctrl+a').display, 'Ctrl+A');
+      expect(KeyChord.parse('alt+a').display, 'Alt+A');
+      expect(KeyChord.parse('shift+a').display, 'Shift+A');
+      expect(KeyChord.parse('meta+a').display, 'Cmd+A');
+    });
+
+    test('toString embeds the canonical form', () {
+      expect(KeyChord.parse('ctrl+shift+p').toString(), 'KeyChord(ctrl+shift+p)');
+    });
+  });
+
+  group('KeyChord equality + hashing', () {
+    test('equal chords have equal hash codes', () {
+      final a = KeyChord.parse('ctrl+shift+p');
+      final b = KeyChord.parse('shift+ctrl+p');
+      expect(a, b);
+      expect(a.hashCode, b.hashCode);
+    });
+
+    test('different keys are not equal', () {
+      expect(KeyChord.parse('ctrl+a'), isNot(KeyChord.parse('ctrl+b')));
+    });
+
+    test('different modifier sets are not equal', () {
+      expect(KeyChord.parse('ctrl+a'), isNot(KeyChord.parse('alt+a')));
+    });
+  });
+
+  group('KeyChord.fromKeyEvent', () {
+    final kb = HardwareKeyboard.instance;
+    tearDown(() => kb.clearState());
+
+    test('returns null for non-KeyDown / non-Repeat events', () {
+      final up = KeyUpEvent(
+        physicalKey: PhysicalKeyboardKey.keyA,
+        logicalKey: LogicalKeyboardKey.keyA,
+        timeStamp: Duration.zero,
+      );
+      expect(KeyChord.fromKeyEvent(up, kb), isNull);
+    });
+
+    test('returns null for a bare modifier press', () {
+      final down = KeyDownEvent(
+        physicalKey: PhysicalKeyboardKey.controlLeft,
+        logicalKey: LogicalKeyboardKey.controlLeft,
+        timeStamp: Duration.zero,
+      );
+      expect(KeyChord.fromKeyEvent(down, kb), isNull);
+    });
+
+    test('maps a plain key down to a modifier-free chord', () {
+      final down = KeyDownEvent(
+        physicalKey: PhysicalKeyboardKey.keyA,
+        logicalKey: LogicalKeyboardKey.keyA,
+        timeStamp: Duration.zero,
+      );
+      final chord = KeyChord.fromKeyEvent(down, kb)!;
+      expect(chord.modifiers, isEmpty);
+      expect(chord.key, LogicalKeyboardKey.keyA);
+    });
+
+    test('records every held modifier in the resulting chord', () {
+      // Press all four modifiers, then a non-modifier key.
+      for (final m in [
+        (PhysicalKeyboardKey.controlLeft, LogicalKeyboardKey.controlLeft),
+        (PhysicalKeyboardKey.altLeft, LogicalKeyboardKey.altLeft),
+        (PhysicalKeyboardKey.shiftLeft, LogicalKeyboardKey.shiftLeft),
+        (PhysicalKeyboardKey.metaLeft, LogicalKeyboardKey.metaLeft),
+      ]) {
+        kb.handleKeyEvent(KeyDownEvent(physicalKey: m.$1, logicalKey: m.$2, timeStamp: Duration.zero));
+      }
+      final down = KeyDownEvent(
+        physicalKey: PhysicalKeyboardKey.keyP,
+        logicalKey: LogicalKeyboardKey.keyP,
+        timeStamp: Duration.zero,
+      );
+      final chord = KeyChord.fromKeyEvent(down, kb)!;
+      expect(chord.key, LogicalKeyboardKey.keyP);
+      expect(chord.modifiers.toSet(), {KeyModifier.ctrl, KeyModifier.alt, KeyModifier.shift, KeyModifier.meta});
+      expect(chord.canonical, 'ctrl+alt+shift+meta+p');
+    });
+  });
+}

test/kernel/src/keymap/keymap_service_test.dart

@@ -0,0 +1,286 @@
+/// Tests for the KeymapService layering + scope context + resolve.
+library;
+
+import 'dart:io';
+
+import 'package:clide/kernel/src/keymap/intents.dart';
+import 'package:clide/kernel/src/keymap/key_chord.dart';
+import 'package:clide/kernel/src/keymap/keymap_service.dart';
+import 'package:clide/kernel/src/settings.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter/widgets.dart' show ActivateIntent, DismissIntent;
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  late Directory appDir;
+  late SettingsStore settings;
+
+  setUp(() async {
+    appDir = await Directory.systemTemp.createTemp('clide_keymap_test_');
+    settings = SettingsStore(appDir: appDir);
+    await settings.load();
+  });
+
+  tearDown(() async {
+    settings.dispose();
+    if (await appDir.exists()) await appDir.delete(recursive: true);
+  });
+
+  group('load()', () {
+    test('loads the default preset from the asset bundle', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: dismiss\n    keys: escape\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap, isNotNull);
+      expect(svc.keymap!.resolve(KeyChord.parse('escape'), const {}), isA<DismissIntent>());
+    });
+
+    test('honours the app.keymap.preset setting', () async {
+      await settings.set<String>(kKeymapPresetSetting, 'vscode');
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/vscode.yaml': 'name: vscode\nbindings:\n  - intent: palette.open\n    keys: ctrl+shift+p\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+shift+p'), const {}), isA<PaletteOpenIntent>());
+    });
+
+    test('missing preset asset is tolerated (active keymap is empty)', () async {
+      final svc = KeymapService(settings: settings, appDir: appDir, bundle: _bundle(const {}));
+      await svc.load();
+      expect(svc.keymap, isNotNull);
+      expect(svc.keymap!.effectiveBindings, isEmpty);
+    });
+
+    test('layers a user file on top of the preset', () async {
+      await File('${appDir.path}/keybindings.yaml').writeAsString(
+        'name: user\nbindings:\n  - intent: activate\n    keys: ctrl+p\n',
+      );
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: palette.open\n    keys: ctrl+p\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+p'), const {}), isA<ActivateIntent>());
+    });
+
+    test('layers a settings overlay above the user file', () async {
+      await File('${appDir.path}/keybindings.yaml').writeAsString(
+        'name: user\nbindings:\n  - intent: activate\n    keys: ctrl+p\n',
+      );
+      await settings.set<List<Object?>>(kKeymapOverridesSetting, [
+        {'intent': 'dismiss', 'keys': 'ctrl+p'},
+      ]);
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: palette.open\n    keys: ctrl+p\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+p'), const {}), isA<DismissIntent>());
+    });
+
+    test('tolerates a malformed user file by ignoring it', () async {
+      await File('${appDir.path}/keybindings.yaml').writeAsString('not: real keymap [yaml');
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: dismiss\n    keys: escape\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('escape'), const {}), isA<DismissIntent>());
+    });
+
+    test('tolerates a malformed settings overlay entry by ignoring just the overlay', () async {
+      await settings.set<List<Object?>>(kKeymapOverridesSetting, [
+        {'intent': 'definitely.not.real', 'keys': 'ctrl+p'},
+      ]);
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: dismiss\n    keys: escape\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('escape'), const {}), isA<DismissIntent>());
+    });
+  });
+
+  group('registerCommandBinding / unregisterCommandBindings', () {
+    test('adds an InvokeCommandIntent that resolves after load', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.registerCommandBinding('ctrl+shift+g', 'git.commit');
+      final intent = svc.keymap!.resolve(KeyChord.parse('ctrl+shift+g'), const {});
+      expect(intent, isA<InvokeCommandIntent>());
+      final invoke = intent as InvokeCommandIntent;
+      expect(invoke.commandId, 'git.commit');
+    });
+
+    test('honours a when-clause on the contribution', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.registerCommandBinding('ctrl+s', 'editor.save', when: 'editor.focused');
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+s'), const {}), isNull);
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+s'), {'editor.focused': true}), isA<InvokeCommandIntent>());
+    });
+
+    test('user file overrides a contributed binding for the same chord', () async {
+      await File('${appDir.path}/keybindings.yaml').writeAsString(
+        'name: user\nbindings:\n  - intent: dismiss\n    keys: ctrl+x\n',
+      );
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.registerCommandBinding('ctrl+x', 'editor.cut');
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+x'), const {}), isA<DismissIntent>());
+    });
+
+    test('unregisterCommandBindings removes prior contributions', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.registerCommandBinding('ctrl+x', 'editor.cut');
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+x'), const {}), isA<InvokeCommandIntent>());
+      svc.unregisterCommandBindings('editor.cut');
+      expect(svc.keymap!.resolve(KeyChord.parse('ctrl+x'), const {}), isNull);
+    });
+
+    test('unregister of an unknown command is a no-op', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.unregisterCommandBindings('nothing-registered'); // doesn't throw
+    });
+  });
+
+  group('scope flags', () {
+    test('setScopeFlag updates the context; notifies listeners on change', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      var notified = 0;
+      svc.addListener(() => notified++);
+      svc.setScopeFlag('palette.open', true);
+      expect(svc.scope['palette.open'], isTrue);
+      expect(notified, 1);
+      svc.setScopeFlag('palette.open', true); // no-op
+      expect(notified, 1);
+      svc.setScopeFlag('palette.open', false);
+      expect(notified, 2);
+    });
+
+    test('clearScopeFlag removes the entry; no-op when absent', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({'assets/keymaps/default.yaml': 'name: default\nbindings: []\n'}),
+      );
+      await svc.load();
+      svc.setScopeFlag('foo', true);
+      svc.clearScopeFlag('foo');
+      expect(svc.scope.containsKey('foo'), isFalse);
+      svc.clearScopeFlag('foo'); // no-op
+    });
+  });
+
+  group('setPreset', () {
+    test('switches presets and reloads', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: dismiss\n    keys: escape\n',
+          'assets/keymaps/vim.yaml': 'name: vim\nbindings:\n  - intent: activate\n    keys: escape\n',
+        }),
+      );
+      await svc.load();
+      expect(svc.keymap!.resolve(KeyChord.parse('escape'), const {}), isA<DismissIntent>());
+      await svc.setPreset('vim');
+      expect(settings.get<String>(kKeymapPresetSetting), 'vim');
+      expect(svc.keymap!.resolve(KeyChord.parse('escape'), const {}), isA<ActivateIntent>());
+    });
+  });
+
+  group('resolveEvent', () {
+    test('returns null before load()', () {
+      final svc = KeymapService(settings: settings, appDir: appDir, bundle: _bundle(const {}));
+      final down = KeyDownEvent(
+        physicalKey: PhysicalKeyboardKey.escape,
+        logicalKey: LogicalKeyboardKey.escape,
+        timeStamp: Duration.zero,
+      );
+      expect(svc.resolveEvent(down, HardwareKeyboard.instance), isNull);
+    });
+
+    test('returns the bound intent for a matched chord', () async {
+      final svc = KeymapService(
+        settings: settings,
+        appDir: appDir,
+        bundle: _bundle({
+          'assets/keymaps/default.yaml': 'name: default\nbindings:\n  - intent: dismiss\n    keys: escape\n',
+        }),
+      );
+      await svc.load();
+      final down = KeyDownEvent(
+        physicalKey: PhysicalKeyboardKey.escape,
+        logicalKey: LogicalKeyboardKey.escape,
+        timeStamp: Duration.zero,
+      );
+      expect(svc.resolveEvent(down, HardwareKeyboard.instance), isA<DismissIntent>());
+    });
+  });
+}
+
+/// In-memory AssetBundle that returns whatever the constructor map says.
+AssetBundle _bundle(Map<String, String> files) => _MapBundle(files);
+
+class _MapBundle extends CachingAssetBundle {
+  _MapBundle(this._files);
+  final Map<String, String> _files;
+
+  @override
+  Future<ByteData> load(String key) async {
+    final s = _files[key];
+    if (s == null) throw Exception('asset not in fake bundle: $key');
+    return ByteData.view(Uint8List.fromList(s.codeUnits).buffer);
+  }
+}

test/kernel/src/keymap/keymap_test.dart

@@ -0,0 +1,189 @@
+/// Unit tests for Keymap layering + resolution + KeymapLayer YAML parsing.
+library;
+
+import 'package:clide/kernel/src/keymap/intents.dart';
+import 'package:clide/kernel/src/keymap/key_chord.dart';
+import 'package:clide/kernel/src/keymap/keymap.dart';
+import 'package:flutter/widgets.dart' show ActivateIntent, DismissIntent;
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  group('KeymapLayer.fromYaml', () {
+    test('parses a single binding with one chord', () {
+      const src = '''
+name: test
+bindings:
+  - intent: activate
+    keys: enter
+''';
+      final layer = KeymapLayer.fromYaml(src);
+      expect(layer.name, 'test');
+      expect(layer.bindings, hasLength(1));
+      expect(layer.bindings.single.chord, KeyChord.parse('enter'));
+      expect(layer.bindings.single.intent, isA<ActivateIntent>());
+      expect(layer.bindings.single.when, isNull);
+    });
+
+    test('expands `keys:` list into one binding per chord', () {
+      const src = '''
+name: t
+bindings:
+  - intent: activate
+    keys: [enter, space]
+''';
+      final layer = KeymapLayer.fromYaml(src);
+      expect(layer.bindings, hasLength(2));
+      expect(layer.bindings[0].chord, KeyChord.parse('enter'));
+      expect(layer.bindings[1].chord, KeyChord.parse('space'));
+      // Same intent instance reused — fine because intents are const.
+      expect(layer.bindings[0].intent, isA<ActivateIntent>());
+    });
+
+    test('stores when-clause parsed into an evaluable WhenExpr', () {
+      const src = '''
+name: t
+bindings:
+  - intent: palette.selectNext
+    keys: down
+    when: palette.open && !textInputFocused
+''';
+      final layer = KeymapLayer.fromYaml(src);
+      final w = layer.bindings.single.when!;
+      expect(w.evaluate({'palette.open': true, 'textInputFocused': false}), isTrue);
+      expect(w.evaluate({'palette.open': true, 'textInputFocused': true}), isFalse);
+      expect(w.evaluate({'palette.open': false, 'textInputFocused': false}), isFalse);
+    });
+
+    test('command: prefix resolves to InvokeCommandIntent', () {
+      const src = '''
+name: t
+bindings:
+  - intent: command:git.commit
+    keys: ctrl+shift+g
+''';
+      final layer = KeymapLayer.fromYaml(src);
+      final intent = layer.bindings.single.intent;
+      expect(intent, isA<InvokeCommandIntent>());
+      expect((intent as InvokeCommandIntent).commandId, 'git.commit');
+    });
+
+    test('nameOverride wins over `name:`', () {
+      const src = 'name: ignored\nbindings: []\n';
+      final layer = KeymapLayer.fromYaml(src, nameOverride: 'user-file');
+      expect(layer.name, 'user-file');
+    });
+
+    test('rejects unknown intent id', () {
+      const src = 'name: t\nbindings:\n  - intent: definitely.not.real\n    keys: enter\n';
+      expect(() => KeymapLayer.fromYaml(src), throwsFormatException);
+    });
+
+    test('rejects missing keys', () {
+      const src = 'name: t\nbindings:\n  - intent: activate\n';
+      expect(() => KeymapLayer.fromYaml(src), throwsFormatException);
+    });
+
+    test('rejects non-map top level', () {
+      expect(() => KeymapLayer.fromYaml('- one\n- two\n'), throwsFormatException);
+    });
+
+    test('rejects missing bindings list', () {
+      expect(() => KeymapLayer.fromYaml('name: t\n'), throwsFormatException);
+    });
+
+    test('rejects non-string entries in keys list', () {
+      const src = 'name: t\nbindings:\n  - intent: activate\n    keys: [42]\n';
+      expect(() => KeymapLayer.fromYaml(src), throwsFormatException);
+    });
+
+    test('rejects unparseable keys value (neither string nor list)', () {
+      const src = 'name: t\nbindings:\n  - intent: activate\n    keys: {wrong: shape}\n';
+      expect(() => KeymapLayer.fromYaml(src), throwsFormatException);
+    });
+  });
+
+  group('Keymap + KeymapLayer toString', () {
+    test('layer toString includes name + binding count', () {
+      final layer = KeymapLayer.fromYaml('name: t\nbindings:\n  - intent: dismiss\n    keys: escape\n');
+      expect(layer.toString(), 'KeymapLayer(t, 1 binding)');
+    });
+
+    test('keymap toString lists layers low-to-high', () {
+      final a = KeymapLayer.fromYaml('name: a\nbindings: []\n');
+      final b = KeymapLayer.fromYaml('name: b\nbindings: []\n');
+      expect(Keymap([a, b]).toString(), 'Keymap(a < b)');
+    });
+  });
+
+  group('Keymap.resolve — single layer', () {
+    final layer = KeymapLayer.fromYaml('''
+name: t
+bindings:
+  - intent: activate
+    keys: enter
+  - intent: palette.selectNext
+    keys: down
+    when: palette.open
+''');
+
+    test('matches an unconditional binding', () {
+      final km = Keymap([layer]);
+      expect(km.resolve(KeyChord.parse('enter'), const {}), isA<ActivateIntent>());
+    });
+
+    test('matches a when-gated binding when the flag is true', () {
+      final km = Keymap([layer]);
+      expect(km.resolve(KeyChord.parse('down'), {'palette.open': true}), isA<PaletteSelectNextIntent>());
+    });
+
+    test('skips a when-gated binding when the flag is false', () {
+      final km = Keymap([layer]);
+      expect(km.resolve(KeyChord.parse('down'), const {}), isNull);
+    });
+
+    test('returns null when the chord has no binding', () {
+      final km = Keymap([layer]);
+      expect(km.resolve(KeyChord.parse('ctrl+x'), const {}), isNull);
+    });
+  });
+
+  group('Keymap.resolve — layering precedence', () {
+    test('later layer replaces earlier binding for the same chord', () {
+      final preset = KeymapLayer.fromYaml('''
+name: preset
+bindings:
+  - intent: palette.open
+    keys: ctrl+shift+p
+''');
+      final user = KeymapLayer.fromYaml('''
+name: user
+bindings:
+  - intent: activate
+    keys: ctrl+shift+p
+''');
+      final km = Keymap([preset, user]);
+      // User layer wins — Activate, not PaletteOpen.
+      expect(km.resolve(KeyChord.parse('ctrl+shift+p'), const {}), isA<ActivateIntent>());
+    });
+
+    test('preset binding survives when no later layer overrides it', () {
+      final preset = KeymapLayer.fromYaml('''
+name: preset
+bindings:
+  - intent: dismiss
+    keys: escape
+''');
+      final user = KeymapLayer.fromYaml('''
+name: user
+bindings:
+  - intent: activate
+    keys: enter
+''');
+      final km = Keymap([preset, user]);
+      expect(km.resolve(KeyChord.parse('escape'), const {}), isA<DismissIntent>());
+      expect(km.resolve(KeyChord.parse('enter'), const {}), isA<ActivateIntent>());
+    });
+  });
+}

test/kernel/src/keymap/when_clause_test.dart

@@ -0,0 +1,117 @@
+/// Unit tests for the when-clause parser + evaluator.
+library;
+
+import 'package:clide/kernel/src/keymap/when_clause.dart';
+import 'package:test/test.dart';
+
+void main() {
+  group('WhenExpr.parse — grammar', () {
+    test('single identifier', () {
+      final e = WhenExpr.parse('foo');
+      expect(e, isA<WhenIdent>());
+      expect(e.evaluate({'foo': true}), isTrue);
+      expect(e.evaluate({'foo': false}), isFalse);
+      expect(e.evaluate(const {}), isFalse, reason: 'missing identifier evaluates to false');
+    });
+
+    test('negation', () {
+      final e = WhenExpr.parse('!foo');
+      expect(e.evaluate({'foo': true}), isFalse);
+      expect(e.evaluate({'foo': false}), isTrue);
+      expect(e.evaluate(const {}), isTrue, reason: '!missing → true');
+    });
+
+    test('double negation', () {
+      final e = WhenExpr.parse('!!foo');
+      expect(e.evaluate({'foo': true}), isTrue);
+      expect(e.evaluate({'foo': false}), isFalse);
+    });
+
+    test('conjunction is left-associative', () {
+      final e = WhenExpr.parse('a && b && c');
+      expect(e.evaluate({'a': true, 'b': true, 'c': true}), isTrue);
+      expect(e.evaluate({'a': true, 'b': false, 'c': true}), isFalse);
+    });
+
+    test('disjunction is left-associative', () {
+      final e = WhenExpr.parse('a || b || c');
+      expect(e.evaluate({'a': false, 'b': false, 'c': true}), isTrue);
+      expect(e.evaluate({'a': false, 'b': false, 'c': false}), isFalse);
+    });
+
+    test('and binds tighter than or', () {
+      // a || b && c == a || (b && c)
+      final e = WhenExpr.parse('a || b && c');
+      expect(e.evaluate({'a': false, 'b': true, 'c': false}), isFalse);
+      expect(e.evaluate({'a': false, 'b': true, 'c': true}), isTrue);
+      expect(e.evaluate({'a': true, 'b': false, 'c': false}), isTrue);
+    });
+
+    test('parens override precedence', () {
+      // (a || b) && c
+      final e = WhenExpr.parse('(a || b) && c');
+      expect(e.evaluate({'a': true, 'b': false, 'c': false}), isFalse);
+      expect(e.evaluate({'a': true, 'b': false, 'c': true}), isTrue);
+    });
+
+    test('not binds tighter than and/or', () {
+      // !a && b → (!a) && b
+      final e = WhenExpr.parse('!a && b');
+      expect(e.evaluate({'a': false, 'b': true}), isTrue);
+      expect(e.evaluate({'a': true, 'b': true}), isFalse);
+    });
+
+    test('identifiers may contain dots, hyphens, underscores', () {
+      final e = WhenExpr.parse('palette.is-open && _editor_focused');
+      expect(e.evaluate({'palette.is-open': true, '_editor_focused': true}), isTrue);
+    });
+
+    test('whitespace is tolerated', () {
+      final e = WhenExpr.parse('  a   &&   ( b || !c )  ');
+      expect(e.evaluate({'a': true, 'b': true, 'c': true}), isTrue);
+      expect(e.evaluate({'a': true, 'b': false, 'c': true}), isFalse);
+    });
+  });
+
+  group('WhenExpr.parse — errors', () {
+    test('empty input throws', () {
+      expect(() => WhenExpr.parse(''), throwsFormatException);
+    });
+
+    test('unbalanced paren throws', () {
+      expect(() => WhenExpr.parse('(a && b'), throwsFormatException);
+    });
+
+    test('trailing junk throws', () {
+      expect(() => WhenExpr.parse('a && b foo'), throwsFormatException);
+    });
+
+    test('missing operand after operator throws', () {
+      expect(() => WhenExpr.parse('a &&'), throwsFormatException);
+    });
+
+    test('bare ! throws', () {
+      expect(() => WhenExpr.parse('!'), throwsFormatException);
+    });
+  });
+
+  group('WhenExpr.tryParse', () {
+    test('null and empty return null', () {
+      expect(WhenExpr.tryParse(null), isNull);
+      expect(WhenExpr.tryParse('   '), isNull);
+    });
+
+    test('non-empty delegates to parse', () {
+      expect(WhenExpr.tryParse('foo'), isA<WhenIdent>());
+    });
+  });
+
+  group('WhenExpr.toString', () {
+    test('round-trips each node shape', () {
+      expect(WhenExpr.parse('foo').toString(), 'foo');
+      expect(WhenExpr.parse('!foo').toString(), '!foo');
+      expect(WhenExpr.parse('a && b').toString(), '(a && b)');
+      expect(WhenExpr.parse('a || b').toString(), '(a || b)');
+    });
+  });
+}

test/kernel/src/panels/drag_resize_test.dart

@@ -4,6 +4,7 @@ library;
 import 'package:clide/extension/extension.dart';
 import 'package:clide/kernel/kernel.dart';
 import 'package:flutter/gestures.dart';
+import 'package:flutter/semantics.dart';
 import 'package:flutter/widgets.dart';
 import 'package:flutter_test/flutter_test.dart';
 
@@ -83,6 +84,114 @@ void main() {
       expect(arr.sizeOf(Slots.contextPanel), 150);
     });
 
+    testWidgets('exposes a slider Semantics node with the current size', (tester) async {
+      final arr = LayoutArrangement();
+      arr.applyPreset(const LayoutPresetContribution(
+        id: 'test-preset',
+        displayName: 'Test',
+        slots: [
+          LayoutSlot(slot: Slots.sidebar, position: SlotPosition.left, defaultSize: 240),
+        ],
+      ));
+      final semHandle = tester.ensureSemantics();
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: SizedBox(
+            width: 40,
+            height: 200,
+            child: DragResizeHandle(
+              arrangement: arr,
+              slot: Slots.sidebar,
+              axis: Axis.horizontal,
+            ),
+          ),
+        ),
+      ));
+      await tester.pumpAndSettle();
+      final data = tester.getSemantics(find.byType(DragResizeHandle));
+      expect(data.label, 'Sidebar width');
+      expect(data.value, '240 pixels');
+      final actions = data.getSemanticsData().actions;
+      expect(actions & SemanticsAction.increase.index, isNot(0));
+      expect(actions & SemanticsAction.decrease.index, isNot(0));
+      semHandle.dispose();
+    });
+
+    testWidgets('contextPanel slider Semantics label matches the slot', (tester) async {
+      final arr = LayoutArrangement();
+      arr.applyPreset(const LayoutPresetContribution(
+        id: 'test-preset',
+        displayName: 'Test',
+        slots: [
+          LayoutSlot(slot: Slots.contextPanel, position: SlotPosition.right, defaultSize: 320),
+        ],
+      ));
+      final semHandle = tester.ensureSemantics();
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: SizedBox(
+            width: 40,
+            height: 200,
+            child: DragResizeHandle(
+              arrangement: arr,
+              slot: Slots.contextPanel,
+              axis: Axis.horizontal,
+            ),
+          ),
+        ),
+      ));
+      await tester.pumpAndSettle();
+      final data = tester.getSemantics(find.byType(DragResizeHandle));
+      expect(data.label, 'Context panel width');
+      expect(data.value, '320 pixels');
+      semHandle.dispose();
+    });
+
+    test('bumpedSlotSize keeps natural sign for left-anchored slots', () {
+      expect(bumpedSlotSize(slot: Slots.sidebar, current: 200, rawDelta: 10), 210);
+      expect(bumpedSlotSize(slot: Slots.sidebar, current: 200, rawDelta: -10), 190);
+      expect(bumpedSlotSize(slot: Slots.workspace, current: 500, rawDelta: 50), 550);
+    });
+
+    test('bumpedSlotSize flips sign for the right-anchored context panel', () {
+      expect(bumpedSlotSize(slot: Slots.contextPanel, current: 200, rawDelta: 10), 190);
+      expect(bumpedSlotSize(slot: Slots.contextPanel, current: 200, rawDelta: -10), 210);
+    });
+
+    testWidgets('vertical-axis handle uses arrow up/down shortcuts and "height" label', (tester) async {
+      final arr = LayoutArrangement();
+      arr.applyPreset(const LayoutPresetContribution(
+        id: 'test-preset',
+        displayName: 'Test',
+        slots: [
+          LayoutSlot(slot: Slots.workspace, position: SlotPosition.center, defaultSize: 300),
+        ],
+      ));
+      final semHandle = tester.ensureSemantics();
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: SizedBox(
+            width: 200,
+            height: 40,
+            child: DragResizeHandle(
+              arrangement: arr,
+              slot: Slots.workspace,
+              axis: Axis.vertical,
+            ),
+          ),
+        ),
+      ));
+      await tester.pumpAndSettle();
+      final data = tester.getSemantics(find.byType(DragResizeHandle));
+      // Custom (non-sidebar, non-contextPanel) slots fall through to
+      // the slot.value-based label branch.
+      expect(data.label, 'workspace height');
+      semHandle.dispose();
+    });
+
     testWidgets('hovered state flips the line colour without throwing', (tester) async {
       final arr = LayoutArrangement();
       arr.applyPreset(const LayoutPresetContribution(

test/kernel/src/services_stubs_test.dart

@@ -6,6 +6,7 @@ library;
 import 'package:clide/extension/src/contribution.dart';
 import 'package:clide/kernel/kernel.dart';
 import 'package:flutter/services.dart';
+import 'package:flutter/widgets.dart' show FocusScopeNode;
 import 'package:flutter_test/flutter_test.dart';
 
 void main() {
@@ -114,6 +115,70 @@ void main() {
     });
   });
 
+  group('FocusTracker — slot scope registry (T-105)', () {
+    test('focusSlot is a no-op when no scope is registered', () {
+      FocusTracker().focusSlot(Slots.sidebar); // doesn't throw
+    });
+
+    test('focusSlot requests focus on the registered scope', () {
+      final tracker = FocusTracker();
+      final scope = FocusScopeNode();
+      addTearDown(scope.dispose);
+      tracker.registerSlotScope(Slots.workspace, scope);
+      tracker.focusSlot(Slots.workspace);
+      // FocusScopeNode.requestFocus only flips hasPrimaryFocus when
+      // attached to a tree; we assert the no-throw + the registration
+      // round-trip rather than primary focus state (covered by the
+      // widget test).
+      tracker.unregisterSlotScope(Slots.workspace, scope);
+      tracker.focusSlot(Slots.workspace); // now a no-op
+    });
+
+    test('unregister skips when a newer scope took the slot', () {
+      final tracker = FocusTracker();
+      final older = FocusScopeNode();
+      final newer = FocusScopeNode();
+      addTearDown(() {
+        older.dispose();
+        newer.dispose();
+      });
+      tracker.registerSlotScope(Slots.workspace, older);
+      tracker.registerSlotScope(Slots.workspace, newer);
+      // Older calls unregister but the slot now holds `newer` — must
+      // not remove it.
+      tracker.unregisterSlotScope(Slots.workspace, older);
+      tracker.focusSlot(Slots.workspace); // still wired to `newer`
+    });
+
+    test('focusNextSlot / focusPreviousSlot cycle through registered slots only', () {
+      final tracker = FocusTracker();
+      final sidebar = FocusScopeNode(debugLabel: 'sidebar');
+      final workspace = FocusScopeNode(debugLabel: 'workspace');
+      addTearDown(() {
+        sidebar.dispose();
+        workspace.dispose();
+      });
+      tracker.registerSlotScope(Slots.sidebar, sidebar);
+      tracker.registerSlotScope(Slots.workspace, workspace);
+      // contextPanel intentionally NOT registered — should be skipped.
+
+      tracker.setActive(slot: Slots.sidebar, contributionId: 'a');
+      // The cycle is silent (no notify on focus call alone), but we can
+      // assert it doesn't throw and produces a deterministic shape.
+      tracker.focusNextSlot();
+      tracker.focusPreviousSlot();
+    });
+
+    test('cycle no-ops when fewer than two slots are registered', () {
+      final tracker = FocusTracker();
+      final scope = FocusScopeNode();
+      addTearDown(scope.dispose);
+      tracker.registerSlotScope(Slots.workspace, scope);
+      tracker.focusNextSlot(); // no-op, no throw
+      tracker.focusPreviousSlot();
+    });
+  });
+
   group('NetworkStatus', () {
     test('default state is online', () {
       final n = NetworkStatus();

test/kernel/src/text_zoom_test.dart

@@ -0,0 +1,62 @@
+import 'package:clide/kernel/src/text_zoom.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('TextZoom', () {
+    test('starts at 1.0', () {
+      expect(TextZoom().scale, 1.0);
+    });
+
+    test('increase adds one step, notifies listeners', () {
+      final z = TextZoom();
+      var calls = 0;
+      z.addListener(() => calls++);
+      z.increase();
+      expect(z.scale, closeTo(1.0 + TextZoom.stepScale, 1e-9));
+      expect(calls, 1);
+    });
+
+    test('decrease subtracts one step', () {
+      final z = TextZoom();
+      z.decrease();
+      expect(z.scale, closeTo(1.0 - TextZoom.stepScale, 1e-9));
+    });
+
+    test('reset jumps back to 1.0', () {
+      final z = TextZoom()
+        ..increase()
+        ..increase();
+      expect(z.scale, isNot(1.0));
+      z.reset();
+      expect(z.scale, 1.0);
+    });
+
+    test('clamps at minScale', () {
+      final z = TextZoom();
+      for (var i = 0; i < 100; i++) {
+        z.decrease();
+      }
+      expect(z.scale, TextZoom.minScale);
+    });
+
+    test('clamps at maxScale', () {
+      final z = TextZoom();
+      for (var i = 0; i < 100; i++) {
+        z.increase();
+      }
+      expect(z.scale, TextZoom.maxScale);
+    });
+
+    test('no-op increment does not notify', () {
+      final z = TextZoom();
+      for (var i = 0; i < 100; i++) {
+        z.increase();
+      }
+      // Already at max — the next increase shouldn't fire.
+      var calls = 0;
+      z.addListener(() => calls++);
+      z.increase();
+      expect(calls, 0);
+    });
+  });
+}

test/panes/registry_test.dart

@@ -41,7 +41,20 @@ void main() {
       expect(evt.data['id'], pane.id);
     });
 
-    test('output events base64-encode the child bytes', tags: ['forkpty'], () async {
+    test('output events base64-encode the child bytes', tags: ['forkpty'], retry: 2, () async {
+      // Subscribe to the sink stream BEFORE spawn so we don't miss
+      // any pane.output events that arrive between spawn and listen.
+      final buf = StringBuffer();
+      final got = Completer<String>();
+      final sub = sink.stream.listen((e) {
+        if (e.kind != 'pane.output') return;
+        buf.write(utf8.decode(base64Decode(e.data['bytes_b64']! as String)));
+        if (buf.toString().contains('hello-panes') && !got.isCompleted) {
+          got.complete(buf.toString());
+        }
+      });
+      addTearDown(sub.cancel);
+
       await registry.spawn(
         kind: PaneKind.terminal,
         // Child writes then lingers so the reader's poll has a wide
@@ -49,14 +62,12 @@ void main() {
         argv: const ['/bin/sh', '-c', 'printf hello-panes; sleep 0.25'],
       );
 
-      final deadline = DateTime.now().add(const Duration(seconds: 2));
-      String decoded() => sink.ofKind('pane.output').map((e) => utf8.decode(base64Decode(e.data['bytes_b64']! as String))).join();
-      while (!decoded().contains('hello-panes') && DateTime.now().isBefore(deadline)) {
-        await Future<void>.delayed(const Duration(milliseconds: 25));
-      }
-
+      final decoded = await got.future.timeout(
+        const Duration(seconds: 5),
+        onTimeout: () => fail('pane.output never carried "hello-panes" within 5s'),
+      );
+      expect(decoded, contains('hello-panes'));
       expect(sink.ofKind('pane.output'), isNotEmpty);
-      expect(decoded(), contains('hello-panes'));
     });
 
     test('write + resize emit no spurious events, update state', () async {

test/pty/session_test.dart

@@ -24,7 +24,7 @@ void main() {
   if (!Platform.isLinux && !Platform.isMacOS) return;
 
   group('NativePty', () {
-    test('spawns shell -c echo and reads output', tags: ['forkpty'], () async {
+    test('spawns shell -c echo and reads output', tags: ['forkpty'], retry: 2, () async {
       final s = NativePty.start(
         executable: '/bin/sh',
         arguments: ['-c', 'echo hello-pty'],
@@ -38,20 +38,11 @@ void main() {
       );
       addTearDown(s.close);
 
-      final buf = StringBuffer();
-      final done = Completer<void>();
-      s.output.listen(
-        (bytes) => buf.write(utf8.decode(bytes, allowMalformed: true)),
-        onDone: () {
-          if (!done.isCompleted) done.complete();
-        },
-      );
-
-      await done.future.timeout(const Duration(seconds: 5), onTimeout: () {});
-      expect(buf.toString(), contains('hello-pty'));
+      final got = await _readUntil(s, 'hello-pty', const Duration(seconds: 5));
+      expect(got, contains('hello-pty'));
     });
 
-    test('write sends keystrokes to child', tags: ['forkpty'], () async {
+    test('write sends keystrokes to child', tags: ['forkpty'], retry: 2, () async {
       final s = NativePty.start(
         executable: '/bin/sh',
         arguments: [],
@@ -66,19 +57,27 @@ void main() {
       addTearDown(s.close);
 
       final buf = StringBuffer();
-      s.output.listen((bytes) => buf.write(utf8.decode(bytes, allowMalformed: true)));
+      final firstByte = Completer<void>();
+      final sub = s.output.listen((bytes) {
+        buf.write(utf8.decode(bytes, allowMalformed: true));
+        // First byte from the pty signals the shell is up and the
+        // reader isolate is delivering — better than a fixed sleep.
+        if (!firstByte.isCompleted) firstByte.complete();
+      });
+      addTearDown(sub.cancel);
 
-      await Future<void>.delayed(const Duration(milliseconds: 500));
+      await firstByte.future.timeout(
+        const Duration(seconds: 5),
+        onTimeout: () => fail('shell never produced its first byte within 5s'),
+      );
 
       s.write(utf8.encode('echo write-test-ok\n'));
 
-      for (var i = 0; i < 50 && !buf.toString().contains('write-test-ok'); i++) {
-        await Future<void>.delayed(const Duration(milliseconds: 100));
-      }
-      expect(buf.toString(), contains('write-test-ok'));
+      final result = await _waitForBuffer(buf, 'write-test-ok', const Duration(seconds: 5));
+      expect(result, contains('write-test-ok'));
     });
 
-    test('close kills child and closes output', tags: ['forkpty'], () async {
+    test('close kills child and closes output', tags: ['forkpty'], retry: 2, () async {
       final s = NativePty.start(
         executable: '/bin/sh',
         arguments: [],
@@ -95,11 +94,14 @@ void main() {
       s.output.listen((_) {}, onDone: () => done.complete());
 
       await s.close();
-      await done.future.timeout(const Duration(seconds: 3));
+      await done.future.timeout(
+        const Duration(seconds: 3),
+        onTimeout: () => fail('output stream did not close within 3s after s.close()'),
+      );
       expect(s.isClosed, isTrue);
     });
 
-    test('bare command name resolves via the PATH env var', tags: ['forkpty'], () async {
+    test('bare command name resolves via the PATH env var', tags: ['forkpty'], retry: 2, () async {
       // 'sh' is a bare command; without resolution, execve would fail.
       final s = NativePty.start(
         executable: 'sh',
@@ -113,16 +115,9 @@ void main() {
         },
       );
       addTearDown(s.close);
-      final buf = StringBuffer();
-      final done = Completer<void>();
-      s.output.listen(
-        (b) => buf.write(utf8.decode(b, allowMalformed: true)),
-        onDone: () {
-          if (!done.isCompleted) done.complete();
-        },
-      );
-      await done.future.timeout(const Duration(seconds: 5), onTimeout: () {});
-      expect(buf.toString(), contains('path-resolution-ok'));
+
+      final got = await _readUntil(s, 'path-resolution-ok', const Duration(seconds: 5));
+      expect(got, contains('path-resolution-ok'));
     });
 
     test('non-existent workingDirectory surfaces a PtyException at spawn time', () {
@@ -201,3 +196,48 @@ void main() {
     });
   });
 }
+
+// -- Helpers ----------------------------------------------------------------
+
+/// Read bytes from [s] into a local buffer until [marker] appears or
+/// [timeout] elapses. Fails the test on timeout — the previous bare
+/// `onTimeout: () {}` pattern hid the real failure mode (reader
+/// isolate never delivered) behind a confusing "buffer empty"
+/// assertion.
+Future<String> _readUntil(NativePty s, String marker, Duration timeout) async {
+  final buf = StringBuffer();
+  final done = Completer<String>();
+  final sub = s.output.listen(
+    (bytes) {
+      buf.write(utf8.decode(bytes, allowMalformed: true));
+      if (buf.toString().contains(marker) && !done.isCompleted) {
+        done.complete(buf.toString());
+      }
+    },
+    onDone: () {
+      if (!done.isCompleted) done.complete(buf.toString());
+    },
+  );
+  try {
+    return await done.future.timeout(
+      timeout,
+      onTimeout: () => fail('pty did not produce "$marker" within ${timeout.inSeconds}s (buffer: "${buf.toString().replaceAll('\n', r'\n')}")'),
+    );
+  } finally {
+    await sub.cancel();
+  }
+}
+
+/// Poll [buf] until [marker] appears or [timeout] elapses. Used after
+/// a write — the bytes flow back through the same output stream a
+/// caller is already listening to, so we just watch the buffer.
+Future<String> _waitForBuffer(StringBuffer buf, String marker, Duration timeout) async {
+  final deadline = DateTime.now().add(timeout);
+  while (!buf.toString().contains(marker)) {
+    if (DateTime.now().isAfter(deadline)) {
+      fail('buffer never contained "$marker" within ${timeout.inSeconds}s (buffer: "${buf.toString().replaceAll('\n', r'\n')}")');
+    }
+    await Future<void>.delayed(const Duration(milliseconds: 25));
+  }
+  return buf.toString();
+}

test/widgets/src/clide_tappable_test.dart

@@ -0,0 +1,115 @@
+/// Widget tests for the keyboard-operable [ClideTappable] (T-100).
+///
+/// The pre-T-100 widget was mouse-only — these tests assert it now
+/// accepts focus, that Enter / Space invoke onTap via the
+/// [ActivateIntent] action, and that the focus ring appears when
+/// the widget has focus.
+library;
+
+import 'package:clide/widgets/widgets.dart';
+import 'package:flutter/widgets.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import '../../helpers/kernel_fixture.dart';
+import '../../helpers/widget_harness.dart';
+
+void main() {
+  group('ClideTappable — keyboard', () {
+    late KernelFixture f;
+    setUp(() async => f = await KernelFixture.create());
+    tearDown(() async => f.dispose());
+
+    testWidgets('accepts Tab focus when onTap is provided', (tester) async {
+      var tapped = 0;
+      final node = FocusNode();
+      addTearDown(node.dispose);
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: ClideTappable(
+            focusNode: node,
+            onTap: () => tapped++,
+            builder: (_, hovered, pressed) => const SizedBox(width: 60, height: 24),
+          ),
+        ),
+      ));
+
+      expect(node.hasFocus, isFalse);
+      node.requestFocus();
+      await tester.pump();
+      expect(node.hasFocus, isTrue);
+      // Tap count unchanged — focus alone doesn't invoke.
+      expect(tapped, 0);
+    });
+
+    testWidgets('Enter on a focused tappable invokes onTap via ActivateIntent', (tester) async {
+      var tapped = 0;
+      final node = FocusNode();
+      addTearDown(node.dispose);
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: ClideTappable(
+            focusNode: node,
+            autofocus: true,
+            onTap: () => tapped++,
+            builder: (_, hovered, pressed) => const SizedBox(width: 60, height: 24),
+          ),
+        ),
+      ));
+      await tester.pump();
+      expect(node.hasFocus, isTrue);
+      // Dispatch ActivateIntent directly against the focused context
+      // — mirrors what KeymapService.resolveEvent → Actions.maybeInvoke
+      // would do on Enter / Space.
+      Actions.invoke(node.context!, const ActivateIntent());
+      await tester.pump();
+      expect(tapped, 1);
+    });
+
+    testWidgets('disabled tappable (onTap == null) cannot receive focus', (tester) async {
+      final node = FocusNode();
+      addTearDown(node.dispose);
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: ClideTappable(
+            focusNode: node,
+            onTap: null,
+            builder: (_, hovered, pressed) => const SizedBox(width: 60, height: 24),
+          ),
+        ),
+      ));
+      node.requestFocus();
+      await tester.pump();
+      expect(node.hasFocus, isFalse, reason: 'canRequestFocus is false when onTap is null');
+    });
+
+    testWidgets('focus ring appears when focused, gone when unfocused', (tester) async {
+      final node = FocusNode();
+      addTearDown(node.dispose);
+      await tester.pumpWidget(harness(
+        f,
+        Center(
+          child: ClideTappable(
+            focusNode: node,
+            onTap: () {},
+            builder: (_, hovered, pressed) => const SizedBox(width: 60, height: 24),
+          ),
+        ),
+      ));
+
+      Iterable<Color> ringColors() => tester
+          .widgetList<DecoratedBox>(find.descendant(of: find.byType(ClideTappable), matching: find.byType(DecoratedBox)))
+          .map((d) => ((d.decoration as BoxDecoration).border?.top.color ?? const Color(0x00000000)));
+
+      // Unfocused: no DecoratedBox descendant carries a non-transparent border.
+      expect(ringColors().any((c) => c.a > 0), isFalse);
+
+      node.requestFocus();
+      await tester.pumpAndSettle();
+      expect(node.hasFocus, isTrue);
+      expect(ringColors().any((c) => c.a > 0), isTrue, reason: 'focus ring border should become opaque on focus');
+    });
+  });
+}

test/widgets/zero_coverage_widgets_test.dart

@@ -145,6 +145,91 @@ void main() {
       await tester.pumpAndSettle();
       expect(find.text('Hoverable'), findsOneWidget);
     });
+
+    testWidgets('arrow keys move the highlighted command (T-100)', (tester) async {
+      for (final id in ['a', 'b', 'c']) {
+        f.services.commands.register(CommandContribution(
+          id: id,
+          command: 'cmd.$id',
+          title: 'Item $id',
+          run: (_) async => IpcResponse.ok(id: '', data: const {}),
+        ));
+      }
+      f.services.palette.open();
+      await tester.pumpWidget(harness(f, Stack(children: const [ClidePalette()])));
+      await tester.pumpAndSettle();
+
+      // selectedIndex starts at 0.
+      expect(f.services.palette.selectedIndex, 0);
+
+      // Dispatch palette intents directly against the palette's
+      // focused context — what the keymap would do for ↓ / ↑.
+      final ctx = f.services.palette.isOpen ? FocusManager.instance.primaryFocus?.context : null;
+      Actions.invoke(ctx!, const PaletteSelectNextIntent());
+      expect(f.services.palette.selectedIndex, 1);
+      Actions.invoke(ctx, const PaletteSelectNextIntent());
+      expect(f.services.palette.selectedIndex, 2);
+      // Wraps at end.
+      Actions.invoke(ctx, const PaletteSelectNextIntent());
+      expect(f.services.palette.selectedIndex, 0);
+      // Wraps backwards at start.
+      Actions.invoke(ctx, const PaletteSelectPreviousIntent());
+      expect(f.services.palette.selectedIndex, 2);
+    });
+
+    testWidgets('PaletteAcceptIntent invokes the highlighted command (T-100)', (tester) async {
+      var which = '';
+      for (final id in ['a', 'b', 'c']) {
+        f.services.commands.register(CommandContribution(
+          id: id,
+          command: 'cmd.$id',
+          title: 'Item $id',
+          run: (_) async {
+            which = id;
+            return IpcResponse.ok(id: '', data: const {});
+          },
+        ));
+      }
+      f.services.palette.open();
+      await tester.pumpWidget(harness(f, Stack(children: const [ClidePalette()])));
+      await tester.pumpAndSettle();
+
+      final ctx = FocusManager.instance.primaryFocus!.context!;
+      Actions.invoke(ctx, const PaletteSelectNextIntent());
+      Actions.invoke(ctx, const PaletteAcceptIntent());
+      await tester.pumpAndSettle();
+      expect(which, 'b');
+      expect(f.services.palette.isOpen, isFalse, reason: 'acceptSelected closes the palette');
+    });
+
+    testWidgets('DismissIntent closes the palette (T-100)', (tester) async {
+      f.services.commands.register(CommandContribution(
+        id: 'c1',
+        command: 'thing',
+        title: 'Thing',
+        run: (_) async => IpcResponse.ok(id: '', data: const {}),
+      ));
+      f.services.palette.open();
+      await tester.pumpWidget(harness(f, Stack(children: const [ClidePalette()])));
+      await tester.pumpAndSettle();
+
+      final ctx = FocusManager.instance.primaryFocus!.context!;
+      Actions.invoke(ctx, const DismissIntent());
+      await tester.pumpAndSettle();
+      expect(f.services.palette.isOpen, isFalse);
+    });
+
+    testWidgets('opening the palette publishes palette.open scope flag (T-100)', (tester) async {
+      await tester.pumpWidget(harness(f, Stack(children: const [ClidePalette()])));
+      await tester.pumpAndSettle();
+      expect(f.services.keymap.scope['palette.open'] ?? false, isFalse);
+      f.services.palette.open();
+      await tester.pumpAndSettle();
+      expect(f.services.keymap.scope['palette.open'], isTrue);
+      f.services.palette.close();
+      await tester.pumpAndSettle();
+      expect(f.services.keymap.scope['palette.open'], isFalse);
+    });
   });
 
   group('ClideFilterBox', () {