chore(todo): group tasks into module projects and document statuses

I consolidated the loose top-level tasks under module "Open Work" parents for every module with four or more (Theme-Studio, Music, AI), and left tasks that already had subtasks as standalone projects. I marked the top-level container tasks PROJECT, top level only and never deeper, and demoted three PROJECT headings that were buried below the top level back to TODO. The priority scheme now documents every status keyword (TODO, PROJECT, DOING, WAITING, VERIFY, STALLED, DELEGATED, DONE, CANCELLED, FAILED), with PROJECT spelled out as a top-level container. I also routed the studio table-consistency task in from the roam inbox.

1 files changed, 1889 insertions, 1869 deletions

diff --git a/todo.org b/todo.org
index 150d23390..4f5f66102 100644
--- a/todo.org
+++ b/todo.org
@@ -21,6 +21,17 @@ tests, chores, and features can all be high or low priority.
   upstream/package tracking, optimizations without current pain, or deferred
   ideas that should not compete with active maintenance.
 
+The task status (the TODO keyword) tracks where a task sits in its lifecycle.
+The active keywords are:
+- =TODO= — open, not started.
+- =PROJECT= — a top-level task that groups several subtasks; the children are the real work, and the project closes when they do. PROJECT lives only at the top task level (a =**= heading under a section), never at the second level or below. A subtask that itself has children stays =TODO= / =DOING=; it does not become a nested PROJECT.
+- =DOING= — actively in progress.
+- =WAITING= — blocked on something external (a person, an upstream release).
+- =VERIFY= — the code is done; only Craig's hands-on check or a pending answer remains. VERIFY tasks wait on Craig and are never auto-implemented.
+- =STALLED= — blocked on an upstream issue outside our control.
+- =DELEGATED= — handed to someone else to carry.
+The done keywords (after the =|= in the sequence) are =DONE= (completed), =CANCELLED= (abandoned), and =FAILED= (attempted, could not be made to work).
+
 For =PROJECT= headings, use the highest priority of the meaningful child work
 inside the project. If a project only contains exploration or review, assign the
 priority by the expected decision value rather than the number of files touched.
@@ -44,45 +55,6 @@ Tags are additive. For example, a small wrong-behavior fix can be
 =:bug:quick:=, and a feature that requires internal restructuring can be
 =:feature:refactor:=.
 * Emacs Open Work
-** DONE [#C] theme-studio: open with the palette collapsed to base colors :feature:studio:next:
-CLOSED: [2026-06-16 Tue]
-Every time theme-studio opens, the palette shows all colors including the span tints. Instead it should open showing the base colors only, and the user expands the spans by clicking the left-side arrow menu. From the roam inbox 2026-06-16. Craig: "just do it. :)"
-Done 2026-06-16: initApp sets paletteShowFull=false before the first render, so the studio opens collapsed (arrow ▶); the existing toggle expands the spans. New #paldefaulttest gate asserts the opening collapsed state; #counttest and #paltoggletest now opt into full mode explicitly since they assert span tiles. Full suite green.
-** TODO [#C] theme-studio: custom view-assignment dropdown with lock indicators :feature:studio:next:
-The view-assignment dropdown is a plain HTML menu. Make it a custom menu colored like the other custom menus, and have it indicate which assignment views have all their elements locked, so the user knows when a view's assignments are done. From the roam inbox 2026-06-16.
-** DONE [#C] theme-studio: realistic markdown-mode preview :feature:studio:
-CLOSED: [2026-06-16 Tue]
-markdown-mode fell back to the generic preview (face names in their own colors). Built renderMarkdownPreview (app.js): a realistic README exercising 28 markdown faces in context (front matter, H1-H3, bold/italic, inline + fenced code with a language tag, links + bare URLs, lists + GFM checkboxes, blockquote + footnote, table, hr, strikethrough, highlight, math, inline HTML, comment). Routed via a PREVIEW_KEYS map in app_inventory.py (markdown-mode -> markdown). #mdtest gate validates every data-face is a real markdown face; full theme-studio suite green. Commit =0682b24f=, pushed. Visual sign-off is a VERIFY under Manual testing and validation.
-** TODO [#C] theme-studio: move the "clear palette" button :feature:studio:next:
-The clear-palette button is too easy to hit by accident (then re-import the JSON to recover). It currently rides with the update-color and palette-generation controls, not with the palette columns. Move it to be left-aligned at the same vertical level as the color-column names. Layout/CSS change in the palette area (app.js / styles.css); visual, so verify by eye. From the roam inbox 2026-06-16.
-** TODO [#C] buffer-differs save prompt: 4-way yes/no/diff/cancel :feature:next:
-The "buffer differs from file" confirmation currently gives only yes/no. Craig wants a 4-way choice with explicit consequences: yes (be explicit it overwrites), no (be explicit it discards this action and continues), diff (show a graphical difftastic diff, then return to this prompt), cancel (stop the action, leave the buffer untouched). Needs the exact prompt identified first (which save/overwrite path raises "buffer differs") and a design for the diff-then-return loop. difftastic + cj/diff-buffer-with-file infrastructure already exist. From the roam inbox 2026-06-16.
-** DOING [#B] Dashboard theming broken: font-lock strips faces; items + icons :bug:
-Investigated 2026-06-16. Three independent causes make the live dashboard render banner, headings, and items in the default face, with no file/section icons. Diagnosis grounded in live daemon inspection (face props, overlays, font-lock state).
-
-*** Cause A — banner + section headings render default ("Banner Text not gold")
-=global-font-lock-mode= (enabled at startup, =early-init.el:311=) fontifies the =*dashboard*= buffer. Dashboard applies the banner title (=dashboard-banner-logo-title=) and section headings (=dashboard-heading=) via the =face= TEXT PROPERTY. font-lock owns the =face= property and strips manually-applied ones it didn't set via keywords, so those faces get cleared on render (every line carries =fontified t=, the jit-lock fingerprint). The theme is fine: =dashboard-banner-logo-title= computes to #dab53d gold and =dashboard-heading= to #67809c — they're stripped at render, not missing. This is a regression of the 2026-05-22 fix "Dashboard navigator icons and section titles uncolored" (7496), which worked before font-lock ran in this buffer.
-FIX A — DONE 2026-06-16, commit =202cf430=: exclude dashboard-mode from global font-lock — =(setq font-lock-global-modes '(not dashboard-mode))= at top level in =dashboard-config.el= (top-level so it runs even though the use-package =:config= errors on a void nerd-icons symbol under the test harness). Banner is gold again and the headings pick up =dashboard-heading=. TDD test =tests/test-dashboard-config-font-lock.el=; full suite green; live in the daemon. Causes B and C still open below.
-
-*** Cause B — project/bookmark/recent items have no color
-Items and the navigator are painted by a =dashboard-items-face= button OVERLAY (overlays survive font-lock, which is why Cause A didn't touch them). But in =WIP-theme.el= =dashboard-items-face= is just =(:inherit widget-button)= — unspecified foreground, so it renders in the default color. 7496 had colored it (steel+2) in the now-retired Dupre theme; that color never carried into WIP. Per 7496, the navigator and items share =dashboard-items-face=, so coloring it colors both (separating them is the open task "Color dashboard navigator independently of list items", 7740).
-FIX B (per Craig 2026-06-16 — no hardcoded colors, theme it): the items already fall back to the default foreground (=dashboard-items-face= inherits =widget-button= -> unspecified -> default fg), which is the right default. To actually COLOR them, theme-studio must expose =dashboard-items-face= so the color comes from the theme, not a hardcoded hex in =WIP-theme.el=. That is the items half of task 2418. No config/theme change here; this routes to 2418.
-
-*** Cause C — no icons on items or section titles
-=dashboard-set-file-icons= and =dashboard-set-heading-icons= are both nil in the live config (=dashboard-config.el= sets =dashboard-display-icons-p t= + =dashboard-icon-type 'nerd-icons= but never the two enable toggles), so dashboard renders no file/section icons. Only the custom navigator row has icons.
-FIX C — file icons DONE 2026-06-16, commit =1c97cba7=: =(setq dashboard-set-file-icons t)= in =dashboard-config.el=. Items now show nerd-icons file icons colored per filetype (verified live: =todo.org= -> nerd-icons-lgreen, project dirs -> nerd-icons-yellow; bookmarks fall back to a generic uncolored icon, no filetype to map). Per Craig: per-filetype (the nerd-icons default). They render only because Fix A took the dashboard out of font-lock, which was stripping the icon faces too. OPEN (offered, not done): =dashboard-set-heading-icons t= would add icons to the section titles — left off pending Craig's call.
-
-*** Studio angle
-To set the item color from theme-studio instead of hand-editing =WIP-theme.el=, the studio's dashboard app must expose =dashboard-items-face= as editable — the "list items unthemed" half of task 2418 (theme-studio: dashboard preview icons missing, list items unthemed).
-
-*** Next
-Confirm Fix A to persist it; pick the item color (Fix B); decide the icon enable + color policy (Fix C).
-** VERIFY [#A] theme-studio: deploy-wip button on the browser page :feature:studio:next:
-Needs from Craig: a mechanism choice before I build it. The page is served from file://, so a button can't run make directly. Two options: (a) a tiny localhost helper the page POSTs to (it runs make deploy-wip), or (b) the page writes a watched trigger file that a small daemon/timer picks up. Pick (a) or (b) and I'll implement + test it.
-Add a button on the theme-studio page that runs the make deploy-wip target locally (build WIP.json into the theme, live-reload the daemon). The page is served from file://, so the browser can't run make directly. Needs a local bridge: a tiny localhost helper the button POSTs to, or a watched trigger file the page writes. Pick the mechanism before building. From the roam inbox 2026-06-15.
-** VERIFY [#A] theme-studio: cannot reassign fg color :bug:studio:next:
-Needs from Craig: the exact repro (palette JSON + click sequence, or a quick screen capture). I traced it and couldn't reproduce from the code: updateColor (the "update selected" path) already excludes the selected entry from its uniqueness check (j!==i), and the fg/bg chips are selectable — paletteChip wires d.onclick -> selectColor(i), with the lock only blocking removal, not selection. The "already exists" wording is addColor's message, which is only reached via applyEdit when selectedIdx is null (i.e. no chip selected). So the trigger is a state I can't see statically — selection getting lost before "update", or a second entry already named "fg". With the precise steps I can pin it; I won't guess-patch the palette-update path on an [#A] bug since a wrong fix there corrupts themes.
-Selecting the fg tile, changing its value, and clicking update errors that an fg already exists instead of updating it. The update path treats a reassign as an add. From the roam inbox.
 ** VERIFY [#A] calendar-sync drops final occurrences, resurrects cancelled meetings :bug:solo:next:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-13
@@ -100,8 +72,40 @@ RFC 5545 conformance holes in =modules/calendar-sync.el=, all agenda-visible (fr
 Needs from Craig: re-enabling native-comp config-wide is a stability/perf judgment, not a mechanical fix. Was it disabled deliberately (a crash, a build without native-comp, async-warning noise)? If you want it back on, confirm and I'll re-enable + raise the GC threshold and verify a clean full launch; otherwise this stays parked. I won't flip it blind.
 From the 2026-06 config audit (verified against the live daemon). =early-init.el:69= =(setq native-comp-deferred-compilation nil)= — the obsolete alias of =native-comp-jit-compilation= — turns JIT native compilation OFF entirely, not "synchronous" as the comment claims: 19 .eln files exist for 184 packages, ~100 of 121 modules run interpreted for the daemon's lifetime, and system-defaults.el:42-44's speed-3/8-jobs/always-compile settings are dead. Plus =early-init.el:113-116= restores =gc-cons-threshold= to the captured STOCK default (800000, verified) post-startup — frequent small GC pauses forever. Together these plausibly feed the filed org-capture 15-20s task more than anything in the capture path itself. Actions: retest the old "Selecting deleted buffer" race on 30.2 and re-enable JIT (or AOT sweep); set a deliberate 16-64MB threshold (or gcmh). Check both before burning time on the capture-perf debug task.
 
-** TODO [#A] Unified popup placement and dismissal rules :feature:
-All transient popups should follow one set of principles. Placement: when the Emacs frame is wider than tall, the popup rises from the right; when square or taller, from the bottom — settle the aspect-ratio threshold and the pop-out percentage. Dismissal: C-c C-c when there's an accept action, C-c C-k when there's a cancel, otherwise =q= closes the window. This generalizes two existing tasks — ai-term adaptive placement (the aspect-ratio docking) and the messenger window/key unification spec (the C-c C-c / C-c C-k dismissal) — into one config-wide policy. From the roam inbox.
+** VERIFY [#B] calendar-sync robustness: atomic writes, curl --fail, zero-event false errors :bug:solo:next:
+Deferred, pairs with the calendar-sync recurrence VERIFY above. The mechanical parts (write to a temp file + rename, add curl --fail, guard the zero-event case) are doable, but any calendar-sync change needs verification against a real .ics feed to avoid masking a genuine empty/failed sync. Do this together with the recurrence fix once you provide a fixture / confirm the live feed.
+From the 2026-06 config audit, =modules/calendar-sync.el=:
+- =:1309= — agenda file written via =with-temp-file= directly on the target (truncate-in-place); org-agenda/chime reading mid-write sees a partial calendar, hourly. Write temp + =rename-file= (atomic same-fs). Same for =--save-state= :258.
+- =:1284= — curl runs without =--fail=: an HTTP 404/500 error page exits 0 and the HTML proceeds into conversion.
+- =:1229-1233= — =--parse-ics= returns nil for both garbage and a valid calendar with zero in-window events, so healthy near-empty calendars report "parse failed" in =calendar-sync-status=. Distinguish the cases.
+
+** VERIFY [#B] org-roam :config triggers the 15-20s refile scan synchronously at first idle :bug:solo:next:
+Needs from Craig: this is measurement-first (perf), not a blind fix — it's the same bottleneck as the "optimize org-capture target building" debug task. Run /debug with debug-profiling to measure what actually costs the 15-20s (file count? regex? agenda rebuild?), then fix from the data. I won't restructure the refile/agenda scan without a profile. Say "let's debug it" and I'll profile + fix.
+=modules/org-roam-config.el:78-79= — org-roam is =:defer 1=, so its :config calls =cj/build-org-refile-targets= at 1s idle, BEFORE the 5s background timer (=org-refile-config.el:144-151=); on a cold cache the 30k-file scan runs inline and freezes Emacs at first idle. Drop the call — org-roam is loaded long before the 5s timer fires. Likely a player in the filed org-capture 15-20s perf task (=[#B] Optimize org-capture target building performance=) — check both together. From the 2026-06 config audit.
+
+** VERIFY [#B] transcription: stderr never reaches the log, video transcripts stranded in /tmp :bug:solo:next:
+Deferred from the batch (no blocker; needs a focused pass with live verification). Plan: (1) transcription-config.el:210 — make-process :stderr with a file path creates a buffer, not a file; route stderr into the process buffer and write the captured text out in the sentinel, then drop the leaked buffer. (2) :370-374 — derive the txt/log base from the VIDEO path, not the temp mp3's /tmp path, so transcripts land alongside the source. The path-derivation half is cleanly unit-testable; the stderr half needs a real transcription run to verify, which is why I held it for a focused session rather than the batch.
+From the 2026-06 config audit, =modules/transcription-config.el=:
+- =:210= — =make-process :stderr= with a file PATH creates a BUFFER named like the path (verified by probe); the "Errored. Logs in <file>" notification points at a log without the error text, and the hidden stderr buffer leaks per transcription. Route stderr into the process buffer or write it out in the sentinel.
+- =:370-374= — video path derives txt/log from the temp mp3's /tmp path; the transcript lands in /tmp and dies on reboot, contradicting the "alongside the source" docstring. Pass the video's path as the output base.
+
+** VERIFY [#C] Dirvish: free D for hard-delete, move duplicate :feature:quick:next:
+Needs from Craig: two confirmations before I wire this. (1) Which key for the moved duplicate command (your note said "duplicate on 2" — confirm 2)? (2) Binding D to sudo rm -rf is genuinely dangerous; confirm you want a forced hard-delete on a single capital key, and whether it should prompt (yes-or-no-p naming the target) before running. I won't bind an unguarded sudo rm -rf autonomously.
+In dirvish, keep =d= = delete (=dired-do-delete=), move duplicate (=cj/dirvish-duplicate-file=, currently =D=) to another key, and bind =D= = =sudo rm -rf= for a forced hard delete — capital for the more destructive op. Craig's note says "duplicate on 2"; confirm that's the intended key, and guard the sudo path carefully before wiring. From the roam inbox.
+
+** VERIFY [#C] page-signal pager account deregistered — re-registration needs your hands
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-12
+:END:
+Reported by .emacs.d 2026-06-12 01:01: the dedicated pager number (+15045173983, the Claude Pager Google Voice number on signal-cli) returns "User ... is not registered" on every send — Signal appears to have deregistered it (GV numbers get periodically re-verified). Re-registration requires captcha/SMS, which only you can do. Until then every page-signal call fails; .emacs.d's config-audit page fell back to email. Wrapper lives at claude-templates/bin/page-signal.
+
+** VERIFY [#C] Pull a fullscreen terminal window away with C-; b + arrow :feature:next:
+Needs from Craig: confirm the intended behavior. When a terminal fills the frame, C-; b + arrow should "pull a window away" — split off a new window in the arrow's direction and move focus there? Or pop the terminal out and restore the prior layout? The C-; b window family exists (resize lives there); I need the exact gesture + target before wiring it.
+When a terminal fills the frame, =C-; b= then a right or down arrow should shrink the window from that edge, reducing its width or height so another buffer can share the screen without leaving the terminal. Relates to the ai-term adaptive placement and unified-popup tasks. From the roam inbox.
+
+** VERIFY [#C] Remove unused system-power keybindings :refactor:quick:next:
+Needs from Craig: the task says "confirm the exact set to keep before unbinding." Under C-; ! the bindings are shutdown (s), reboot (r), restart-Emacs (e), and friends. Tell me which to keep bound and which to drop (the completing-read menu still reaches the rare ones), and I'll unbind the rest.
+=modules/system-commands.el= binds shutdown (=C-; ! s=), reboot (=C-; ! r=), restart-Emacs (=C-; ! e=) and friends under the =C-; != prefix. Craig rarely uses them and wants the key real-estate back. Drop the bindings he doesn't use; the completing-read menu can still reach the rare ones. Confirm the exact set to keep before unbinding. From the roam inbox.
 
 ** DOING [#B] mu4e: cmail can't trash, no account can refile :bug:quick:solo:
 :PROPERTIES:
@@ -110,17 +114,383 @@ All transient popups should follow one set of principles. Placement: when the Em
 =modules/mail-config.el:217-220= — the cmail context (primary account) sets only drafts/sent, so D falls back to default "/trash" which doesn't exist under ~/.mail (=/cmail/Trash= does); and NO context sets =mu4e-refile-folder=, so r targets nonexistent "/archive" everywhere. Accepting mu4e's offer to create the maildir strands mail in a directory mbsync never syncs — messages silently vanish from the server's view. Add =mu4e-trash-folder= to cmail + per-context =mu4e-refile-folder=. From the 2026-06 config audit.
 Fixed 2026-06-13: cmail gets =mu4e-trash-folder= "/cmail/Trash"; refile is a per-message function (=cj/mu4e--refile-folder=) instead of a per-context string — mu4e context :vars are sticky, so a per-context refile leaks one account's archive folder into another. cmail → "/cmail/Archive"; gmail/dmail signal a =user-error= rather than move mail into an unsynced phantom folder (Craig chose the fail-safe over syncing [Gmail]/All Mail — the All Mail option means a multi-GB pull + cross-folder duplicates; revisit if local Gmail archiving is wanted). Applies on next mu4e open; pure dispatch helper covered by tests.
 
-** VERIFY [#B] theme-studio: sort newest colors near the top :feature:studio:next:
+** DOING [#C] Lock screen silently fails — slock is X11-only :bug:quick:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+=modules/system-commands.el:105= binds the lockscreen command to =slock=, which can't grab a Wayland session; =cj/system-cmd= launches it detached with output silenced, so C-; ! l does nothing and the screen never locks. Security issue: Craig believes the screen locks when it doesn't. Fix: =hyprlock= (or =swaylock=), ideally resolved per session type via =env-wayland-p= so an X11 fallback survives for other machines. From the 2026-06 config audit.
+Fixed 2026-06-13: lockscreen-cmd resolves to =loginctl lock-session= on Wayland (logind Lock → hypridle → hyprlock, the path idle/sleep locking already uses), =slock= on X11; also added the missing =(require 'host-environment)=. Live in the daemon; manual lock test under the Manual testing parent.
+** PROJECT [#A] Manual testing and validation
+Exercised once the phases above land.
+*** VERIFY mu4e buffers are themed (headers, main, message view)
+What we're verifying: with the mu4e modes excluded from global font-lock, mu4e's manual face properties survive, so the buffers pick up the theme. The headers + main + view-headers are the ones global font-lock was stripping.
+- Restart Emacs (cleanest), or kill and reopen the mu4e buffers
+- Open mu4e, look at the headers list and the main menu
+- Open a message and read the body
+Expected: headers list shows unread/flagged/date/subject in their theme colors (mu4e-unread-face gold, mu4e-header-face green, etc.); the main menu and the message-view headers (From/To/Subject) are themed; the message body still renders correctly (gnus does the body, so it's unaffected). NOTE: a plain "g" refresh in an already-open *mu4e-headers* won't fix it on its own unless font-lock is off there; a restart is the reliable check.
+*** VERIFY C-c ; reaches the custom command family in a real terminal frame
+What we're verifying: the TTY mirror prefix C-c ; reaches the same cj/custom-keymap as the GUI C-; prefix, so the whole command family works in a terminal. The unit tests + a live daemon eval already confirm both prefixes resolve to the one keymap; this is the end-to-end in an actual TTY frame, which the batch harness can't drive.
+- Open a terminal Emacs frame: emacsclient -nw (or emacs -nw, or Emacs inside vterm/tmux)
+- Press C-c ; L (pearl), C-c ; a (AI), C-c ; g (calendar) — the same leaf keys you use under C-; in GUI
+- Confirm which-key shows the custom prefix under C-c ;
+Expected: each C-c ; <leaf> runs the same command its C-; <leaf> counterpart runs in GUI; which-key lists the family under C-c ;. C-; itself stays working in GUI frames (unchanged).
+*** VERIFY theme-studio gnus view package themes the article headers
+What we're verifying: gnus is now its own view package in theme-studio (it drives the mu4e article view), so the bright-green article headers can be themed and exported. #gnustest confirms the package is registered and its preview emits only real gnus faces; this is the visual read plus the live-green retirement.
+- Reload theme-studio (or make theme-studio-open)
+- Pick "gnus (mu4e article view)" from the view dropdown (sits among the g entries)
+- Confirm the preview shows a header block, an emphasized body, an 11-level quoted reply chain, and a signature
+- Theme a few gnus faces (e.g. gnus-header-name, gnus-header-from, gnus-cite-1) to obvious colors, export to WIP.json, then deploy
+#+begin_src sh :results output
+make -C /home/cjennings/.emacs.d deploy-wip
+#+end_src
+- Restart Emacs (or reload the theme), reopen a mu4e message
+Expected: the studio preview renders each gnus face in its theme color; after export + deploy, the *mu4e-article* From/Subject/To/Date headers show the themed colors instead of the gnus green defaults.
+*** VERIFY theme-studio markdown preview reads like a real README
+What we're verifying: selecting markdown-mode in the view dropdown shows a realistic README (not the generic face-name list), and the markdown faces render legibly in context. #mdtest already confirms the wiring + that every element's face is real; this is the visual read.
+- Reload theme-studio (or make theme-studio-open)
+- Pick "markdown-mode" from the view dropdown
+Expected: a README preview with headers, bold/italic, code, links, lists/checkboxes, blockquote, table, etc., each in its theme face. Clicking an element flashes its row in the faces table.
+*** VERIFY dashboard theming — banner gold, headings themed, items show per-filetype icons
+What we're verifying: with the dashboard out of global font-lock (Fix A) and file icons on (Fix C), the live dashboard shows the theme colors and icons. Eyeball it.
+- Open the dashboard (F1)
+Expected: the "Emacs:" banner title is gold, the "Projects:/Bookmarks:/Recent Files:" headings are themed blue, and the project/recent-file rows each show a colored per-filetype icon (org files greenish, dirs yellow; bookmarks a plain icon).
+*** VERIFY gptel C-; a B switches model without the modeline hang
+What we're verifying: cj/gptel-switch-backend (C-; a B) now sets gptel-model to an interned symbol, so the switch completes without the wrong-type-argument-symbolp redisplay hang. Unit tests + a live helper eval already cover the coercion; this is the interactive end-to-end.
+- Invoke cj/gptel-switch-backend (C-; a B)
+- Pick a backend, then a model from its list
+Expected: the modeline updates to the chosen model and Emacs stays responsive — no "Querying ..." hang, no wrong-type-argument backtrace.
+*** VERIFY org-faces color set in theme-studio reaches the agenda
+What we're verifying: editing an org-faces-* row in theme-studio, exporting, and deploying lands the new color on the real agenda's keyword/priority. The build-theme -> deftheme half and the live org-todo-keyword-faces / org-priority-faces wiring are already verified mechanically; this confirms the visual end-to-end with a human eye.
+- Open theme-studio in Chrome and pick "org-faces" from the application dropdown (it sits beside elfeed and mu4e)
+- Confirm the preview shows the focused agenda block over the auto-dim block, and that the rows read "todo", "priority a", etc.
+- Edit org-faces-todo to an obviously different color (e.g. bright magenta) and export the theme to WIP.json
+#+begin_src sh :results output
+make -C /home/cjennings/.emacs.d deploy-wip
+#+end_src
+- Open the org agenda (or any todo.org buffer) and look at a TODO keyword
+Expected: the TODO keyword renders in the color just set; the priority cookies and other keywords keep their own colors; an unfocused window shows the dimmed variants.
+*** VERIFY slack keys are safe before slack loads
+What we're verifying: the C-; S slack keys don't error before slack has started, and the prefix shows in which-key. Fixed in modules/slack-config.el; restart to apply (not reloaded into the live session).
+- Restart Emacs but do NOT run cj/slack-start
+- Press C-; S Q (close all), and C-; S w / @ / # (these previously void-function'd or void-variable'd before load)
+- Press C-; S and check which-key shows the "slack" prefix
+Expected: C-; S Q reports "Closed 0 Slack buffers" with no error; w/@/# either run or autoload slack cleanly (no void-function); the which-key popup lists the slack prefix.
+*** VERIFY ERC fires one mention notification and lists real servers
+What we're verifying: a mention pops a single desktop notification (not two), and cj/erc-connected-servers lists only live server connections. Fixed in modules/erc-config.el; takes effect after an Emacs restart (not reloaded into the live IRC session).
+- Restart Emacs and reconnect ERC
+- Have someone mention your nick in a channel (or trigger erc-text-matched-hook)
+- Run M-x cj/erc-connected-servers with one server connected and a few channels open
+Expected: exactly one desktop notification per mention; cj/erc-connected-servers reports just the connected server(s), not every channel/query buffer.
+*** VERIFY modeline still shows the git branch and state
+What we're verifying: the VC-cache simplification didn't change what the modeline shows on a normal repo. Fixed in modules/modeline-config.el (live in the daemon after reload).
+- Open a file inside a git repo
+- Glance at the mode-line VC segment
+Expected: the branch name and state still render as before (e.g. "main" with the usual state face). The change only drops a per-render stat and guards against git errors; normal display is unchanged.
+*** VERIFY info-mode open is non-destructive and cancels cleanly
+What we're verifying: opening a .info file no longer auto-kills the buffer, and the explicit cj/open-with-info-mode prompt cancels cleanly on decline. Fixed in modules/help-config.el; stale daemon state already cleared, so this also survives a fresh restart.
+- find-file a .info file (e.g. one under elpa) — it should open as an ordinary buffer, not vanish into Info
+- In that buffer, edit something, then M-x cj/open-with-info-mode; at the save prompt answer no
+- Repeat M-x cj/open-with-info-mode on an unmodified .info buffer
+Expected: find-file leaves the buffer intact (no auto-kill); declining the save prompt prints "Operation canceled" with no "No catch for tag" error; on an unmodified buffer it opens the file in Info.
+*** VERIFY dwim-shell zip/backup/menu-key behave
+What we're verifying: single-file zip makes a valid <name>.zip, the dated backup gets a real timestamp, and the dwim-shell menu is reachable on M-D in plain dired. Fixed in modules/dwim-shell-config.el, reloaded into the daemon.
+- In dired, mark a single file, run the dwim-shell menu (M-D), pick Zip
+- Mark a file, run the menu, pick "Backup with date"
+- Open a plain dired buffer (not dirvish) and press M-D
+Expected: zip produces foo.zip (a valid archive, openable); backup produces foo.ext.YYYYMMDD_HHMMSS.bak with a real date; M-D opens the dwim-shell command menu in plain dired (before the fix it did nothing there).
+*** VERIFY markdown live preview renders in the browser
+What we're verifying: F2 in a markdown buffer runs the custom cj/markdown-preview (not markdown-mode's own command) and the impatient-mode strapdown preview actually renders. Fixed in modules/markdown-config.el, reloaded into the daemon.
+- Open a .md file with some markdown content
+- M-x cj/markdown-preview-server-start (starts simple-httpd on :8080)
+- Press F2 in the markdown buffer
+Expected: a browser opens http://localhost:8080/imp showing the rendered markdown, and edits to the buffer update the preview live. Pressing F2 before starting the server gives a user-error telling you to start it.
+*** VERIFY orderless matching works inside a vertico session
+What we're verifying: vertico-prescient no longer overrides completion-styles, so orderless's space-separated, out-of-order matching is live in the minibuffer (prescient still sorts). Fixed in modules/selection-framework.el, applied live in the daemon.
+- Run a command with a vertico minibuffer (e.g. M-x, or C-x b)
+- Type two space-separated fragments out of order, e.g. "mode buf" to match "switch-to-buffer-other-... mode" style candidates
+Expected: candidates match on both fragments regardless of order (orderless), and the ordering still reflects prescient frecency. Before the fix, space-separated out-of-order input would not match.
+*** VERIFY C-; b d diffs, C-; b D deletes
+What we're verifying: the buffer-and-file keymap now puts diff on the easy lowercase key and the destructive delete on the capital. Swapped in modules/custom-buffer-file.el and re-bound live in the daemon.
+- Open a file buffer and edit it without saving
+- Press C-; b d
+- Press C-; b D, then cancel at the delete confirmation
+Expected: C-; b d runs the diff (buffer vs saved file); C-; b D starts delete-buffer-and-file (offers to delete the file). Before the swap these were reversed.
+*** TODO C-s C-s repeats the last search
+What we're verifying: the second consecutive C-s repeats the previous consult-line search instead of erroring "No Vertico session". Fix in modules/selection-framework.el (vertico-repeat-save now on minibuffer-setup-hook), live in the daemon.
+- Press C-s, type a search term, RET to dismiss (or just narrow then exit)
+- Press C-s again, then C-s a second time without any command in between
+Expected: the second C-s reopens the last search (vertico-repeat) rather than signalling "No Vertico session".
+*** TODO reconcile-open-repos includes dot-named repos
+What we're verifying: M-P (reconcile open repos) now visits repos whose directory name has a dot (mcp.el, capture.el, etc.), which the old "^[^.]+$" filter silently skipped. Fix in modules/reconcile-open-repos.el, live in the daemon; live-daemon check already confirmed discovery, this is the through-the-command spot-check.
+- Run M-P (or M-x cj/reconcile-open-repos)
+- Watch the per-repo progress / final summary
+Expected: dot-named repos under ~/code (mcp.el, gptel-mcp.el, capture.el, google-contacts.el, …) appear in the reconciliation pass, not just dot-free ones.
+*** 2026-06-15 Mon @ 12:10:06 -0500 org-capture popup single-Task into inbox verified
+Craig confirmed: Super+Shift+N pops straight into a Task capture (no menu), single full-frame window, files under "Inbox" in ~/org/roam/inbox.org, and the frame closes cleanly. Passed.
+*** TODO Lock screen actually locks on Wayland
+What we're verifying: C-; ! l locks the screen on Wayland. slock (X11-only) never worked here; the locker now runs loginctl lock-session, which logind turns into a Lock signal that hypridle handles by running hyprlock — the same path idle/sleep locking already uses. Fix in modules/system-commands.el, live in the daemon.
+- Press C-; ! l (or run M-x cj/system-cmd-lock)
+- The screen should lock with hyprlock
+- Unlock with your password
+Expected: the screen locks immediately and unlocks with your password. (Before the fix it printed "Running lockscreen-cmd..." and nothing happened.)
+*** TODO Irreversible actions require a typed "yes" after a daemon restart
+What we're verifying: the strong-confirm tier is restored for irreversible actions. The global (fset 'yes-or-no-p 'y-or-n-p) was removed and those sites now call cj/confirm-strong, which forces a typed "yes"/"no". The fset is baked into the running daemon and can't be cleared from Lisp, so this only takes effect after a restart. Ordinary yes-or-no-p prompts stay single-key (use-short-answers t).
+- Restart the Emacs daemon (clean state)
+- Trigger an irreversible action, e.g. M-x cj/system-cmd-shutdown (then abort), or attempt to overwrite a file via the rename/move commands
+Expected: the irreversible prompt requires typing the full word "yes" (not a single y); a benign yes-or-no-p prompt elsewhere still accepts a single keystroke.
+*** 2026-06-11 Thu @ 18:29:39 -0500 Verified UI-face preview and contrast survive a ground bg change
+Craig walked the repro: mode-line with its own fg/bg kept its preview bg and ratio through a ground change; ground-dependent rows re-rated; package-faces contrast column updated. Pass. Closed the [#A] contrast-cell and [#B] preview-bg parents.
+*** 2026-06-11 Thu @ 18:29:39 -0500 Verified seeded package-face defaults, with steel tuning
+Craig read org/magit/elfeed against the ground. Pass with tuning: steel reads a bit dark — flipped to steel+1 on magit (better), but org wanted darker; these are updated selections, NOT final — he expects to adjust many more before the theme ships. His export saved to scripts/theme-studio/theme.json (replaced the 2026-06-09 state, prior version in git at 4f2d00eb). Side find: the org preview's heading-three ↔ headline-todo flash linkage is cross-wired — filed as its own bug task.
+*** 2026-06-11 Thu @ 18:29:39 -0500 Verified large face tables stay usable
+Craig scrolled the org table, filtered on "agenda", reassigned a face — grouping, narrowing, and live preview update all behaved. Pass.
+*** 2026-06-11 Thu @ 18:29:39 -0500 Verified perceptual readouts in the picker
+Craig validated the readouts against computed reference values (default fg #f0fef0 on ground #000000: APCA Lc -104.7 / WCAG 20.14; keyword blue #67809c: Lc -33.7 / WCAG 5.14 — negative polarity correct for light-on-dark). Legible, uncrowded. Pass. Side find filed separately: the picker panel itself blends into the page background ([#C] picker-visibility task).
+*** 2026-06-11 Thu @ 18:29:39 -0500 Verified ΔE warnings read clearly
+Craig built a near-duplicate pair and a well-spread palette: the close pair was named with its ΔE, sorted closest-first with the cap behaving; no warning on the spread palette. Pass.
+*** TODO OKLCH editor feels right
+What we're verifying: the OKLCH sliders / C×L plane edit cleanly and clamping is visible.
+- Switch the picker to OKLCH mode and drag L, then C, then H
+- Push chroma past the sRGB gamut, then toggle the AA/AAA mask
+Expected: each axis moves independently; the C×L plane (once 4b lands) opens on the current color; "chroma clamped to sRGB" shows on clamp; toggling the mask does not reset OKLCH mode.
+*** TODO Generated ramp harmonizes
+What we're verifying: a ramp generated from a base color reads as one family, not a grab-bag (the aesthetic the math is meant to produce).
+- Open =scripts/theme-studio/theme-studio.html= in Chrome
+- Pick a mid-lightness base swatch (e.g. a blue) and generate its ramp at the defaults
+- Read the row of steps left to right, then try a near-black and a near-white base
+Expected: the steps share an obvious hue and step evenly in lightness; the chroma-ease keeps the extreme steps from going muddy or garish; nothing looks like it belongs to a different color.
+*** TODO Safe-lightness guidance reads clearly
+What we're verifying: the L_max marker and unsafe-band shade are legible and land in the right place when editing a covered face.
+- Open the picker in OKLCH mode on region (or hl-line), with syntax colors assigned
+- Read the L_max marker and the shaded unsafe band on the lightness slider
+- Drag lightness up toward and past the marker
+Expected: the marker is visible and correctly placed, the band above it reads as "unsafe," and crossing it is obvious; an out-of-scope face shows no marker.
+*** TODO Safe tint actually reads in real Emacs
+What we're verifying: a background tint the tool calls safe really keeps every token readable behind real syntax-colored text — the whole point of the worst-case floor.
+- In the tool, set a covered face (e.g. region) to a tint at or just below its L_max with the worst-case readout showing PASS
+- Build the theme and load it in Emacs, open a code buffer with varied syntax, and select a region spanning many token colors
+- Read every token through the region highlight, paying attention to the limiting foreground the tool named
+Expected: every token stays readable over the tint, including the limiting one; a tint pushed just past L_max (readout FAIL) shows a visibly strained or unreadable token, confirming the floor matches reality.
+*** TODO Color families group the way the eye reads them
+What we're verifying: the OKLCH hue clustering (25° gap) splits and merges families the way you'd expect, and renaming never moves a color.
+- Open =scripts/theme-studio/theme-studio.html= in Chrome and load a real theme (e.g. sterling)
+- Read the strips top to bottom: are "the blues" one strip, "the greens" another, neutrals and ground pinned at the top
+- Find a pair you'd consider one family that landed in two strips (or two you'd consider separate that merged)
+- Rename any swatch to something absurd and confirm it stays in the same strip
+Expected: families match your mental grouping; the few that don't are the cue to revisit the 25° gap; renaming never regroups.
+*** TODO Regenerate-replace reads as deliberate
+What we're verifying: the count control clearly signals it rewrites the whole family, so replacing hand-added same-hue colors isn't a surprise.
+- Add two unrelated colors at a similar hue so they share a strip
+- Set that strip's count to 2
+- Watch what happens to the two colors
+Expected: the strip becomes a clean base±2 ramp, the two loose colors are gone, and the control made it obvious that's what it would do before you committed.
+*** TODO Removed-step references read clearly as "(gone)"
+What we're verifying: lowering a family's count leaves a referencing face visibly stale, not silently re-pointed.
+- Assign a UI or syntax element to an outer step of a family (e.g. region = a blue+3)
+- Lower that family's count to 2 so blue+3 disappears
+- Read the assignment's dropdown
+Expected: the dropdown shows "(gone)" for the removed step, never a silent jump to a different color; re-pointing it is a deliberate choice.
+*** TODO Calibre bookmark default name is "Author, Title"
+What we're verifying: a new nov bookmark takes the "Author, Title" form parsed from the filename, not the raw EPUB filename.
+- Open an EPUB in Calibre (nov buffer).
+- Hit m to set a bookmark.
+Expected: the default bookmark name is "Author, Title" (underscores stripped, colon restored), e.g. "Agatha Christie, The A.B.C. Murders".
+
+*** TODO Calibre curated ? menu and docked description
+What we're verifying: the curated ? transient, the docked description, and the full dispatch all work in a live calibredb buffer.
+- In a calibredb search buffer, press ? and confirm the curated menu (library / filter / sort / open / describe) appears.
+- Press d or v to dock the selected book's description in a bottom-30% buffer; press q to dismiss it.
+- Press H and confirm calibredb's full dispatch opens.
+Expected: ? shows the curated menu, d/v dock the description (q dismisses), H opens the full calibredb dispatch.
+
+*** TODO Signel: real incoming message raises a toast through the notify script
+What we're verifying: the full receive path (signal-cli → signel --handle-receive → cj/signel--notify → notify script) fires on a real message.
+- Make sure you are NOT viewing the sender's chat buffer.
+- Have a real message sent to you on Signal (or send one from your phone to a second device thread that lands here).
+Expected: a transient info toast titled "Signal: <sender>" with the message text (one line, truncated if long), no sound.
+
+*** TODO Signel: actively-viewed chat stays quiet
+What we're verifying: the suppression predicate gates the toast when you're reading that chat.
+- Open the sender's chat buffer (=C-; M m=) and keep it the selected window in a focused frame.
+- Have the same sender message you again.
+Expected: the message renders in the buffer, but no desktop toast appears.
+
+*** TODO Project-aware capture files into the right todo.org
+What we're verifying: C-c c t and C-c c b file into the current projectile project's todo.org under its "<Project> Open Work" header, and fall back to the global inbox outside a project.
+- Inside a projectile project that has a todo.org, run C-c c t (Task), capture a test entry, and confirm it lands under "<Project> Open Work".
+- Run C-c c b (Bug) similarly and confirm it lands as "* TODO [#C] ..." under the same header.
+- Run a capture from outside any project (or a project with no todo.org) and confirm the global-inbox fallback with a warning.
+Expected: in-project captures land in that project's Open Work; out-of-project captures fall back to the global inbox with a warning.
+
+** PROJECT [#A] Theme-Studio Open Work
+Parent grouping the open theme-studio / theming issues; close each child independently.
+*** TODO [#A] theme-studio: consistent assignment-view table columns :feature:studio:next:
+All view-assignment tables should use one consistent column set and order, whatever view is selected: element name (sortable), lock, fg, bg, style, box (with a side expansion showing the selected color, as in UI faces), contrast, inheritance, size, preview text. No other columns at this design stage. When a view's elements can't take a given section, raise a signal and disable that section for that view; the disabled state is the visual cue. From the roam inbox 2026-06-16.
+*** TODO [#B] Route hardcoded theme colors through the theme :refactor:
+Config modules hardcode colors that should come from the theme (audit 2026-06-16, after removing the =*scratch*= background tint). Drive these from the theme, or expose them in theme-studio, instead of literal values.
+- Buffer-bg tints (same shape as the removed scratch tint): =music-config.el:794= and =org-noter-config.el:287= both face-remap =default :background "#1d1b19"= on the active window.
+- Hardcoded face colors that should ride the theme: =nerd-icons-config.el:32= =cj/nerd-icons-tint-color "darkgoldenrod"=; =prog-general.el:370-375= hl-todo keyword faces =#FF0000= / =#DAA520= / =#2C780E=; =eshell-config.el:78-86= prompt =:foreground "gray"/"white"=.
+- Reading-mode palettes (deliberate but hardcoded, confirm keep vs theme): =pdf-config.el:27= =pdf-view-midnight-colors=; =calibredb-epub-config.el:298-300= =:foreground "#E8DCC0"=.
+- =org-faces-config.el:38-103= defface defaults (~36 hex) — the themeable org-faces theme-studio already overrides; decide whether the defaults should derive from the palette too.
+*** TODO [#C] theme-studio: custom view-assignment dropdown with lock indicators :feature:studio:next:
+The view-assignment dropdown is a plain HTML menu. Make it a custom menu colored like the other custom menus, and have it indicate which assignment views have all their elements locked, so the user knows when a view's assignments are done. From the roam inbox 2026-06-16.
+*** TODO [#C] theme-studio: move the "clear palette" button :feature:studio:next:
+The clear-palette button is too easy to hit by accident (then re-import the JSON to recover). It currently rides with the update-color and palette-generation controls, not with the palette columns. Move it to be left-aligned at the same vertical level as the color-column names. Layout/CSS change in the palette area (app.js / styles.css); visual, so verify by eye. From the roam inbox 2026-06-16.
+*** VERIFY [#A] theme-studio: deploy-wip button on the browser page :feature:studio:next:
+Needs from Craig: a mechanism choice before I build it. The page is served from file://, so a button can't run make directly. Two options: (a) a tiny localhost helper the page POSTs to (it runs make deploy-wip), or (b) the page writes a watched trigger file that a small daemon/timer picks up. Pick (a) or (b) and I'll implement + test it.
+Add a button on the theme-studio page that runs the make deploy-wip target locally (build WIP.json into the theme, live-reload the daemon). The page is served from file://, so the browser can't run make directly. Needs a local bridge: a tiny localhost helper the button POSTs to, or a watched trigger file the page writes. Pick the mechanism before building. From the roam inbox 2026-06-15.
+*** VERIFY [#A] theme-studio: cannot reassign fg color      :bug:studio:next:
+Needs from Craig: the exact repro (palette JSON + click sequence, or a quick screen capture). I traced it and couldn't reproduce from the code: updateColor (the "update selected" path) already excludes the selected entry from its uniqueness check (j!==i), and the fg/bg chips are selectable — paletteChip wires d.onclick -> selectColor(i), with the lock only blocking removal, not selection. The "already exists" wording is addColor's message, which is only reached via applyEdit when selectedIdx is null (i.e. no chip selected). So the trigger is a state I can't see statically — selection getting lost before "update", or a second entry already named "fg". With the precise steps I can pin it; I won't guess-patch the palette-update path on an [#A] bug since a wrong fix there corrupts themes.
+Selecting the fg tile, changing its value, and clicking update errors that an fg already exists instead of updating it. The update path treats a reassign as an add. From the roam inbox.
+*** VERIFY [#B] theme-studio: sort newest colors near the top :feature:studio:next:
 Deferred from the no-approvals batch (no blocker, needs a focused studio session). Plan: the palette + gallery order comes from columnsFromPalette / sortColumns / paletteOptionList; newest entries currently sort low. Add a recency signal (palette insertion order) and surface recent columns near the front. Risk: the column sort is pinned by several browser gates (#sorttest etc.), so it needs careful test updates — which is why I held it rather than rush it here.
 Newly added colors currently land after the ground layer (bg/fg), low in the order. Surface them near the first entry instead, in both the palette color list and the gallery/dropdown, since the most recently added colors are usually the ones being worked on. From the roam inbox 2026-06-15.
-** TODO [#B] agenda sources: roam Projects missing, no existence filtering :bug:solo:
-From the 2026-06 config audit, =modules/org-agenda-config.el=:
-- =:182-191= — commentary and docstrings promise org-roam nodes tagged "Project" as agenda sources, but =cj/--org-agenda-scan-files= never scans them, and files added by the roam finalize-hook are wiped on the next =cj/build-org-agenda-list= cache rebuild (≤1h). Add a roam Project pass (mirror =org-refile-config.el:101-109=) or correct the docs.
-- =:186,456= — agenda file list built unconditionally (inbox/calendars may not exist on a fresh machine) and =org-agenda-skip-unavailable-files= is unset — the exact interactive-prompt class that once hung the chime daemon. Filter with =file-exists-p= + set the var as backstop.
+*** VERIFY [#B] theme-studio: dashboard preview icons missing, list items unthemed :bug:studio:next:
+Needs from Craig: an approach decision on the icon half. The navigator nerd-glyphs show as mojibake because the browser has no nerd font — fixing it means shipping/@font-face-ing a Symbols Nerd Font web font into the studio page (a real asset + licensing call), or substituting plain glyphs in the preview. The "list items unthemed" half is a separate studio-CSS fix I can do, but I'd rather settle the font approach and do both together. Tell me: embed the nerd font, or use substitute glyphs?
+Found while theme-testing the live dashboard against the preview.
+- The navigator icons don't render in the preview at all, showing as mojibake. The nerd-font glyphs have no font fallback in the browser.
+- No way to set the color of the project, bookmark, and recent-files list items. The preview renders those entries as plain unstyled text, and the dashboard app exposes no editable face for them.
+*** TODO [#B] theme-studio import organization workflow needs a spec :feature:studio:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+Design import handling for unstructured color sources such as Emacs themes, CSS palettes, screenshots, and generic palette files. Principles from the 2026-06-13 Theme Studio discussion:
+- Preserve declared structure whenever an imported entry has a =columnId=.
+- For unstructured legacy imports with no =columnId=, avoid silent hue clustering and avoid treating arbitrary =color-N= names as one long ramp; each =color-N= should become its own base column.
+- Keep meaningful generated ramp-name inference for names like =blue-1= / =blue= / =blue+1=.
+- Group external numeric color-name variants for compact display: =blue1= / =blue2= / =blue3= infer column =blue=; =grey80= / =grey81= infer column =grey=; =orchid3= infers =orchid=. This is display organization, not proof that the colors are an authored Theme Studio span.
+- If a numeric external base is spanned later, generate from the actual base name, e.g. =blue1-1= / =blue1= / =blue1+1=, while keeping those generated tiles in the inferred =blue= column.
+- Add explicit organization tools rather than hidden inference: group selected colors into a column, suggest hue groups as a preview/action, sort imported colors for inspection, and promote a color from an import bucket into a normal column.
+- Consider a compact imported/captured bucket UI for large unstructured imports while preserving per-color column ids internally.
+
+*** VERIFY [#B] theme-studio: org-agenda app + agenda preview :feature:theme-studio: :studio:next:
+Needs from Craig: this is a multi-phase feature, not a bug fix — it depends on the preview-locate feature (per the 2026-06-15 spec) and means breaking org-agenda-* / scheduling / deadline / calendar / clocking faces into their own theme-studio pane with a representative week-agenda preview. Too large to land inside this batch. Confirm you want it built now (and as its own focused session) and I'll start from the spec; otherwise it stays parked.
+Break the org-agenda-* plus scheduling / deadline / calendar / clocking / filter faces out of the overloaded org-mode app into a dedicated org-agenda pane (org-mode-line-clock* stay in org-mode), with a representative week-agenda preview at natural item frequency. Keywords, priorities, and tags render live via org-faces / org-mode through the locate registry (hover-only there). Same five-file bespoke-app pattern as org-faces. Depends on the preview-locate feature. Partly subsumes the "break org-mode preview into grouped subsections" task.
+*** TODO [#B] theme-studio UI face inheritance needs a spec  :feature:studio:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+Package faces model =inherit= explicitly, but UI faces currently expose only fg/bg/style fields in the table and generated theme output. Before implementing UI-face inheritance, write and review a small spec that defines: which UI faces get an inherit selector, how own defaults from =emacs-default-faces.json= appear versus effective inherited values, how export/import stores cleared vs inherited vs explicit values, how preview resolution follows UI inherit chains, and what browser gates prove the behavior. This touches the UI model, generated defaults, export format, preview rendering, and reset semantics, so it should not be slipped in as a refactor.
 
-** TODO [#B] ai-rewrite: chosen directive never reaches the request :bug:solo:
+*** TODO [#C] theme-studio: calibre package doesn't color properly :bug:studio:
+The calibre package preview has no elements to theme in the search list, and coloring switches to the string color on mismatched quotes. Investigate, then record a diagnosis and solution in this task before fixing. From the roam inbox 2026-06-15.
+*** TODO [#C] theme-studio: break org-mode preview into grouped subsections :feature:studio:
+Rather than cramming all org-mode preview into one pane, split into groups so each element is shown in a common, context-rich environment. From the roam inbox.
+*** TODO [#C] theme-studio: converter drops :inherit on UI faces :bug:studio:
+build-theme.el's UI tier passes inherit=nil to --attrs, so a UI face that relies only on its inherit field (no explicit fg/bg) loses the inheritance in the generated theme, while the studio preview shows the inherited color via resolveUiAttr. The package tier already emits :inherit; the UI tier should match. Surfaced while diagnosing why mode-line-inactive looked off in Emacs versus the preview (that case had explicit colors and turned out to be a stale deploy, but the inherit gap is real for any inherit-only UI face).
+*** TODO [#C] theme-studio: elfeed ignores theme assignments  :studio:studio:
+The preview shows theme colors, but elfeed itself renders all-white with no variation. Note: this may be the shr-rendered entry/article view (elfeed-show), where color often comes from the document rather than the theme — confirm whether the symptom is in the search list or the article view. From the roam inbox.
+*** VERIFY [#C] theme-studio face-consistency check     :feature:studio:next:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-10
+:END:
+Needs from Craig: this is an open-ended feature, not a bug — it needs a spec first (what "consistency" means: which faces are compared, what rule flags an inconsistency, how it's surfaced in the UI). Give me the check's definition (or say "brainstorm a spec") and I'll build it; parked until then.
+Rule taxonomy captured in [[file:docs/design/theme-studio-face-rules.org][docs/design/theme-studio-face-rules.org]] (Design Rules vs Fidelity Rules). The two checks below map to those two rule kinds. Both surface structural-attribute (weight/slant/underline/box/overline/height) issues; color is the theme's design and out of scope.
+
+1. Theme cross-cutting consistency (primary, per Craig 2026-06-09): the theme has deliberate cross-cutting rules — e.g. headings/titles are bold, links are underlined, errors/warnings/success are bold. Flag where the theme BREAKS ITS OWN rule (a heading that isn't bold, a link that isn't underlined). The designer declares the rules; the check finds the violators. This is the "tell me where I broke the rule" guardrail.
+
+2. defface-baseline divergence (secondary): flag where a face's structural attrs differ from its package =defface= so each divergence is deliberate, not an accidental drop. Would have caught the dropped underline/bold defaults and the contradictions (shr-h3 bold-vs-italic, erc-action italic-vs-bold) from the package-face audit as they were introduced.
+
+Bake into the tool (a lint surfaced in the UI) or run as a build-time check (seeds vs live deffaces via emacsclient).
+
+*** TODO [#C] theme-studio: restrict the cursor row to its background :bug:studio:
+The UI table gives the cursor face the full control set (fg, B/I/U/S, box), but Emacs only honors the cursor face's :background. Its shape is cursor-type, not a face attribute, so every other control on that row is a no-op once the theme loads. Restrict the cursor row to just its background swatch so the studio doesn't present controls Emacs drops.
+*** TODO [#C] theme-studio terminal/ANSI colors              :feature:studio:
+theme-studio represents GUI faces only; terminal colors aren't surfaced at all. Scope decided 2026-06-09: GUI-first faces, NOT full per-face display-class fallback. Two pieces:
+
+1. ANSI-16 panel. Map the 16 ANSI slots (black/red/green/yellow/blue/magenta/cyan/white + bright variants) to palette colors, with a preview, and export them so =build-theme.el= emits the =ansi-color-*= / =term-color-*= faces. This matters even in pure-GUI Emacs: colored shell output, compilation buffers, eshell, and vterm/eat all draw from these. Signals must line up with their ANSI slot (error red→ansi red, success→green, warning→yellow, info/link→blue) so a signal reads the same in a terminal.
+
+2. Core-face 16-color fallback. Only the ~10 faces that decide console legibility get a =(((class color) (min-colors 16)) ...)= clause plus a =(t ...)= floor: default/fg, bg, keyword, string, comment, constant, error, warning, region, mode-line, line-number. Tune these for contrast — push it UP, legibility over fidelity, because the only 16-color target is the bare Linux virtual console (an occasional emergency context). The long tail stays GUI-first and auto-approximates.
+
+Why this scope: the GUI and the normal terminal (foot + tmux, truecolor / ≥256-color) both render the GUI hexes fine; GUI-first is correct there. Only the Linux VT is 16-color, and a low-contrast palette approximates badly down to 16 — so a few core faces get a deliberately higher-contrast 16-color fallback rather than every face carrying a multi-spec. Tool work: the ANSI-16 panel + a flag on the core faces to also capture a 16-color value; =build-theme.el= emits multi-spec only for those. Full per-face fallback is revisited only if console work becomes regular.
+*** TODO [#D] theme-studio CIEDE2000 DeltaE option           :feature:studio:
+Deferred from the perceptual color metrics spec (vNext). v1 uses DeltaE-OK on its native scale with a 0.02 threshold (decided); revisit CIEDE2000 only if the native OKLab scale proves too unfamiliar or poorly calibrated for palette distinguishability. Spec: [[id:15db8ae3-fc14-49f3-9ed5-d5ff59790904][spec]] (vNext candidates; review folded in 2026-06-08).
+*** TODO [#D] theme-studio low-contrast preset/mask mode     :feature:studio:
+Deferred from the perceptual color metrics spec (vNext). After raw OKLCH/APCA/DeltaE readouts exist, decide whether to add a named low-contrast workflow: APCA Lc bands, a contrast ceiling/floor mask, or a "soft" sibling to the existing any/AA+/AAA picker mask. Spec: [[id:15db8ae3-fc14-49f3-9ed5-d5ff59790904][spec]] (vNext candidates; review folded in 2026-06-08).
+*** TODO [#D] theme-studio per-tier reseed controls          :feature:studio:
+Deferred from the seeding-engine spec (vNext). V1 reseeds all three guide-owned tiers at once; later consider separate "reseed syntax", "reseed UI", and "reseed package/org" controls if all-at-once proves too blunt. Spec: [[id:b70b37f2-37df-4c8e-ac2f-1f20d12e33dd][spec]] (vNext; review folded in 2026-06-08).
+*** VERIFY [#C] Palette-columns spec review
+SCHEDULED: <2026-06-12 Fri>
+Read [[file:docs/theme-studio-palette-columns-spec.org][docs/theme-studio-palette-columns-spec.org]] (Draft, from the 2026-06-10 design discussion) and bless or amend. Decisions 9 and 10 are the two session calls awaiting your word: strips flip to lightest→darkest top→bottom to match the dropdown, and each dropdown column run places the base at its natural lightness position (vs bg/fg bases leading before any steps). On "spec's good": mark Ready, file the phase breakdown, cancel the [#C] hint-override task, start Phase 1.
+
+*** TODO [#D] org-faces: dim variants and retire dupre-org-* :feature:theme-studio:
+vNext from the org-faces spec: org-faces-*-dim variants wired into auto-dim so keywords stay legible in unfocused windows, and migrate or retire the legacy dupre-org-* set. [[id:35578114-8c29-43af-97a2-fdfea01a802e][org-faces-spec-implemented.org]]
+*** TODO [#D] Face diagnostic popup — theme-studio bridge (vNext)   :feature:
+vNext for the face/font diagnostic tool: interactivity — "send this face to theme-studio", jump-to-theme-spec, any write path. Deferred per [[id:98f065cf-8bd5-46a0-ac24-da94d66855ad][the spec]]'s scope tiers.
+*** 2026-06-16 Tue @ 05:10:55 -0500 Alphabetized the assignment-view package dropdown
+The package-faces optgroup (below the @code/@ui editor entries) now lists apps alphabetically by display label. Root cause: =buildViewSel= iterated =for(const app in APPS)=, and =generate.py= builds APPS as bespoke apps first then inventory apps, so the combined list wasn't alphabetical. Fix is localized to the view-list build per the plan: added a pure =appViewKeysSorted(apps)= helper in =app-core.js= (sorts keys by label, case-insensitive, key fallback when a label is missing) and =buildViewSel= iterates it. TDD: 4 node tests in =test-app-core.mjs= (red->green); updated the #viewtest browser gate from asserting insertion order to asserting =appViewKeysSorted(APPS)=; full theme-studio suite green (Python + Node + all browser gates). Commit =afd2ddad=, pushed. Visual sign-off optional (gate already confirms the DOM order).
+*** 2026-06-16 Tue @ 06:11:30 -0500 Contrast cell: dropped PASS/FAIL, verdict moved to the hover
+Craig's call (option a + hover): the contrast cell now shows just the rating-colored number (green = passes AAA, grey = passes AA, red = fails AA), and the WCAG meaning lives in a hover. Added a pure =contrastTitle(r)= to =app-util.js= (4 node tests), changed =crHtml= (app.js) to drop the verdict word and set =title=, kept =verdictFor= for the covered-overlay worst-case readout (untouched, #contrasttest still green). New #crtest browser gate; full theme-studio suite green. Commit =9e99749d=, pushed.
+*** DOING [#B] Dashboard theming broken: font-lock strips faces; items + icons :bug:
+Investigated 2026-06-16. Three independent causes make the live dashboard render banner, headings, and items in the default face, with no file/section icons. Diagnosis grounded in live daemon inspection (face props, overlays, font-lock state).
+
+**** Cause A — banner + section headings render default ("Banner Text not gold")
+=global-font-lock-mode= (enabled at startup, =early-init.el:311=) fontifies the =*dashboard*= buffer. Dashboard applies the banner title (=dashboard-banner-logo-title=) and section headings (=dashboard-heading=) via the =face= TEXT PROPERTY. font-lock owns the =face= property and strips manually-applied ones it didn't set via keywords, so those faces get cleared on render (every line carries =fontified t=, the jit-lock fingerprint). The theme is fine: =dashboard-banner-logo-title= computes to #dab53d gold and =dashboard-heading= to #67809c — they're stripped at render, not missing. This is a regression of the 2026-05-22 fix "Dashboard navigator icons and section titles uncolored" (7496), which worked before font-lock ran in this buffer.
+FIX A — DONE 2026-06-16, commit =202cf430=: exclude dashboard-mode from global font-lock — =(setq font-lock-global-modes '(not dashboard-mode))= at top level in =dashboard-config.el= (top-level so it runs even though the use-package =:config= errors on a void nerd-icons symbol under the test harness). Banner is gold again and the headings pick up =dashboard-heading=. TDD test =tests/test-dashboard-config-font-lock.el=; full suite green; live in the daemon. Causes B and C still open below.
+
+**** Cause B — project/bookmark/recent items have no color
+Items and the navigator are painted by a =dashboard-items-face= button OVERLAY (overlays survive font-lock, which is why Cause A didn't touch them). But in =WIP-theme.el= =dashboard-items-face= is just =(:inherit widget-button)= — unspecified foreground, so it renders in the default color. 7496 had colored it (steel+2) in the now-retired Dupre theme; that color never carried into WIP. Per 7496, the navigator and items share =dashboard-items-face=, so coloring it colors both (separating them is the open task "Color dashboard navigator independently of list items", 7740).
+FIX B (per Craig 2026-06-16 — no hardcoded colors, theme it): the items already fall back to the default foreground (=dashboard-items-face= inherits =widget-button= -> unspecified -> default fg), which is the right default. To actually COLOR them, theme-studio must expose =dashboard-items-face= so the color comes from the theme, not a hardcoded hex in =WIP-theme.el=. That is the items half of task 2418. No config/theme change here; this routes to 2418.
+
+**** Cause C — no icons on items or section titles
+=dashboard-set-file-icons= and =dashboard-set-heading-icons= are both nil in the live config (=dashboard-config.el= sets =dashboard-display-icons-p t= + =dashboard-icon-type 'nerd-icons= but never the two enable toggles), so dashboard renders no file/section icons. Only the custom navigator row has icons.
+FIX C — file icons DONE 2026-06-16, commit =1c97cba7=: =(setq dashboard-set-file-icons t)= in =dashboard-config.el=. Items now show nerd-icons file icons colored per filetype (verified live: =todo.org= -> nerd-icons-lgreen, project dirs -> nerd-icons-yellow; bookmarks fall back to a generic uncolored icon, no filetype to map). Per Craig: per-filetype (the nerd-icons default). They render only because Fix A took the dashboard out of font-lock, which was stripping the icon faces too. OPEN (offered, not done): =dashboard-set-heading-icons t= would add icons to the section titles — left off pending Craig's call.
+
+**** Studio angle
+To set the item color from theme-studio instead of hand-editing =WIP-theme.el=, the studio's dashboard app must expose =dashboard-items-face= as editable — the "list items unthemed" half of task 2418 (theme-studio: dashboard preview icons missing, list items unthemed).
+
+**** Next
+Confirm Fix A to persist it; pick the item color (Fix B); decide the icon enable + color policy (Fix C).
+*** TODO [#B] theme-studio semantic theme architecture :feature:theme-studio:spec: :spec:studio:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-14
+:END:
+Spec draft: [[id:fe980b12-451a-4d8b-a550-d99f9ec49f45][theme-studio-semantic-theme-architecture-spec.org]].
+
+Design a Modus-inspired layered Theme Studio output path: palette data, semantic role mappings, face templates, and a generated theme wrapper. Keep the current flat JSON-to-theme converter as the compatibility/default path while proving a layered, self-contained generated theme. Include advisory semantic rules as a possible validation layer, not v1 enforcement.
+
+**** TODO [#B] theme-studio palette generator source modes for base-only vs ground-aware palettes :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-14
+:END:
+Tentative follow-up from walking through the generator algorithms. Consider splitting the current =source: palette= behavior into two explicit source modes, names TBD:
+- =base color palette= — current behavior; use non-ground base color columns only and ignore bg, fg, ground spans, and color spans.
+- =ground and base palette= — use bg/fg plus non-ground base color columns as generator anchors, useful when colored ground endpoints should shape fill-gap or harmony choices.
+
+This may be cancelled if the extra distinction makes the generator harder to understand. Before implementing, decide final names and whether ground-aware source should include only bg/fg or also ground span steps.
+
+*** TODO [#B] theme-studio seeding engine :feature:studio:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+Spec (Ready): [[id:b70b37f2-37df-4c8e-ac2f-1f20d12e33dd][spec]]. Role table → guide-correct defaults for syntax/UI/org; reseed dupre-revised.json to the compact mapping; opens seeded with an all-tier reseed button. Depends on the perceptual-metrics colormath.js core for OKLCH shade generation, so it runs after that feature's Phase 1.
+**** TODO Seed model + seed() + #seedtest :solo:
+Phase 1. Palette anchors + OKLCH shade generation (reusing colormath.js), the ROLES table, and the three face→role maps as data; pure seed(). Gate: #seedtest asserts representative syntax/UI/org faces resolve correctly (bi→blue-grey, fnd→gold+bold, region bg-only, link underlined, org-level-1 strongest, org-code literal lane) and a non-org bespoke package (magit) keeps its curated seed.
+**** TODO Open-seeded + reseed + dupre-revised regen :solo:
+Phase 2. Initial state from seed() plus seedPkgmap for the non-org packages; all-tier reseed button with a scope-named overwrite warning, resetting non-org to their APPS defaults; regenerate dupre-revised.json. Gate: #selftest PASS; default-on-open equals seed(); artifact round-trip (regenerated dupre-revised.json imports back to the same seeded state); Chrome eyeball.
+**** TODO Seeding-engine test surface :solo:test:
+Keep #seedtest, #selftest, the default-on-open check, the dupre-revised round-trip, node --check, and Chrome validation green.
+** PROJECT [#B] AI Open Work
+Parent grouping the open AI assistant / gptel issues; close each child independently.
+*** TODO [#B] ai-rewrite: chosen directive never reaches the request :bug:solo:
 =modules/ai-rewrite.el:64= — the directive is let-bound around =(call-interactively #'gptel-rewrite)=, but gptel-rewrite is a transient prefix that returns when the menu shows; the send resolves the directive AFTER the binding unwound (verified against ~/code/gptel/gptel-rewrite.el:780-799). The picker's choice is silently dropped — the module's core feature is inert. Set =gptel--rewrite-directive= buffer-locally (restore via =gptel-post-rewrite-functions=) or use a self-removing global hook entry. From the 2026-06 config audit.
 
+*** VERIFY [#B] Stale elpa gptel shadows the local fork — likely the gptel-magit root :bug:quick:solo:next:
+Needs from Craig: can't be done standalone. I tried deleting elpa/gptel-0.9.8.5 — the fork loaded fine and gptel-magit still worked via use-package autoloads, but package activation then printed "Unable to activate gptel-magit / Required gptel-0.9.8 unavailable" on every startup, so I reverted. To remove the shadow we must also resolve gptel-magit's package dependency: either drop gptel-magit's package dep (load it via load-path like the gptel fork), or repackage the fork into .localrepo as gptel. Tell me which and I'll do it; this pairs with the gptel-magit investigation.
+=elpa/gptel-0.9.8.5= is still installed alongside the =~/code/gptel= fork (=ai-config.el:383=); package activation puts the elpa dir + autoloads on load-path, so which copy wins depends on ordering, and a mixed load (fork .el + elpa .elc) produces "impossible" bugs. =gptel-magit= (elpa) declares gptel as a dependency, so IT may be pulling the stale copy — check this first when working the open "[#B] Investigate gptel-magit not working properly" task. Fix: =package-delete= the elpa gptel + remove from .localrepo so the fork is the only copy on disk. From the 2026-06 config audit.
+
+2026-06-15: tried deleting =elpa/gptel-0.9.8.5= standalone. The fork loaded correctly and gptel-magit still worked via use-package =:commands= autoloads, BUT package activation then printed "Unable to activate package gptel-magit / Required package gptel-0.9.8 unavailable" on every startup and test run (gptel-magit declares gptel as a package dependency that no longer resolves). Reverted. This can't be done standalone — it must be paired with the gptel-magit dependency fix (drop gptel-magit's package dep, or repackage the fork into .localrepo as gptel). Do it together with the gptel-magit investigation task.
+
+*** TODO [#C] ai-conversations: dead-buffer load, role flattening, non-atomic writes :bug:solo:
+From the 2026-06 config audit, =modules/ai-conversations.el=:
+- =:324= — load in a fresh session does =get-buffer-create "*AI-Assistant*"= (plain fundamental-mode buffer); =--ensure-ai-buffer= then sees it exists and never calls =(gptel)=. Sending doesn't work, autosave self-cancels (requires gptel-mode). Use =get-buffer= for the check; let ensure create. The browser RET/l path inherits this.
+- =:240= — persistence drops gptel's =response= text properties, so a reloaded history replays to the model as ONE user message (model re-reads its own answers as Craig's words). Adopt gptel's native bounds persistence or re-mark on load from the "* Backend:" headings.
+- =:248= — =write-region= straight at the target; crash mid-write truncates the only copy of the history (autosave hits this constantly). Temp + rename.
+- =:140= — three overlapping autosave mechanisms (after-send advice that fires before the response exists, post-response hook, 60s timer). Keep the hook; drop the advice (and likely the timer).
+
+*** VERIFY [#C] Dedup gptel model-switch commands — keep switch-backend or fold into change-model :bug:
+=cj/gptel-change-model= (C-; a m) already does backend+model switching and interns correctly, so =cj/gptel-switch-backend= (C-; a B) is arguably redundant now that its crash is fixed. Decision for Craig: keep both, or delete =cj/gptel-switch-backend= plus its C-; a B binding and keep one model-switch command. From the 2026-06 config-audit follow-up.
+
 ** PROJECT [#B] Architecture review follow-up from 2026-05-03 :refactor:
 
 High-level pass over =init.el=, =early-init.el=, and all 104 files in
@@ -351,7 +721,7 @@ Done 2026-05-15:
 - Focused tests passed for the new architecture smoke file and the affected
   agenda/refile helpers.
 
-*** PROJECT [#A] Un tangle the eager =init.el= load graph :refactor:
+*** TODO [#A] Un tangle the eager =init.el= load graph :refactor:
 
 =init.el= currently functions as the dependency graph by eagerly requiring
 almost every module in a fixed order. That makes modules harder to test in
@@ -414,7 +784,7 @@ Verified behavior-preserving by dumping every C-; binding before and after: iden
 
 Related existing task: [#B] "Review and rebind M-S- keybindings".
 
-*** PROJECT [#A] Move package bootstrap out of =early-init.el= where possible :refactor:
+*** TODO [#A] Move package bootstrap out of =early-init.el= where possible :refactor:
 
 =early-init.el= currently handles package archives, package refresh, installing
 =use-package=, and =use-package-always-ensure=. That is more than early startup
@@ -450,544 +820,7 @@ Expected outcome:
 - Add a note to the local repository docs so future package failures do not
   lead to permanent insecure defaults.
 
-** TODO [#B] Auto-dim: org headings, links, and tags do not dim in unfocused windows :bug:
-auto-dim-other-buffers-affected-faces (auto-dim-config.el) remaps font-lock and a few org faces to the flat dim face, but not org-level-1..8, org-link, or org-tag, so headings, links (seen in daily-prep.org), and tags like :solo: stay lit when the window loses focus. Decide the dim approach: a flat-dim remap like font-lock (quick) versus dedicated -dim variants surfaced through org-faces / theme-studio (richer, matches the keyword work; Craig flagged org-tags may want the org-faces treatment). Consolidates three roam-inbox captures.
-** VERIFY [#B] calendar-sync robustness: atomic writes, curl --fail, zero-event false errors :bug:solo:next:
-Deferred, pairs with the calendar-sync recurrence VERIFY above. The mechanical parts (write to a temp file + rename, add curl --fail, guard the zero-event case) are doable, but any calendar-sync change needs verification against a real .ics feed to avoid masking a genuine empty/failed sync. Do this together with the recurrence fix once you provide a fixture / confirm the live feed.
-From the 2026-06 config audit, =modules/calendar-sync.el=:
-- =:1309= — agenda file written via =with-temp-file= directly on the target (truncate-in-place); org-agenda/chime reading mid-write sees a partial calendar, hourly. Write temp + =rename-file= (atomic same-fs). Same for =--save-state= :258.
-- =:1284= — curl runs without =--fail=: an HTTP 404/500 error page exits 0 and the HTML proceeds into conversion.
-- =:1229-1233= — =--parse-ics= returns nil for both garbage and a valid calendar with zero in-window events, so healthy near-empty calendars report "parse failed" in =calendar-sync-status=. Distinguish the cases.
-
-** TODO [#B] "? = curated help menu" convention across modes :feature:
-From the calibredb keybindings work 2026-06-06. The pattern that worked: in a modal/major-mode buffer (calibredb), bind =?= to a curated transient of the frequent workflows, and move the package's own full dispatch to =H=. It fixes the "I can't discover the keys" problem that which-key can't help with (which-key only pops up after a prefix, not for top-level single keys in a mode-map).
-
-Task: survey the modes/modules Craig works in and identify where a =?= -> curated-help-menu (transient) makes sense. Candidates: any major-mode buffer with single-key bindings and no good discovery affordance -- calibredb (done), nov, dirvish, mu4e, ghostel/term, signel, pearl/linear, ELFeed, etc. For each, note whether =?= is free or already a help dispatch, and whether a curated menu (vs the package's own) adds value. Establish it as a convention (and maybe a small helper/macro to define a curated =?= menu consistently).
-
-** TODO [#B] Dupre diff-changed / diff-refine-changed legibility :bug:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-11
-:END:
-Surfaced 2026-06-07 from a pearl session designing its modified-ticket indicator (pearl marks a changed field by inheriting =diff-changed=). dupre's =diff-refine-changed= is bright gold (#ffd700) under near-white text (#f0fef0) -- WCAG contrast ~1.35, unreadable as a plain background. It only looks fine inside diff-mode because diff-mode overlays its own dark foreground. =diff-changed= (#875f00 amber) is ~5.49, readable but off the modus model. Every modus variant keeps both faces legible (contrast 9-16) by pairing a dark low-saturation background with a hue-matched foreground.
-
-Ask:
-1. Rework dupre's =diff-changed= and =diff-refine-changed= on modus lines: dark low-saturation background, legible foreground (plain default fg for simplicity, or hue-tinted per modus -- decide), and keep refine slightly stronger than changed (refine is the word-level emphasis inside a changed region; modus keeps them distinct).
-2. While there, audit dupre's broader diff/palette faces against modus conventions (background/foreground tinting, contrast targets) and flag where it diverges.
-
-Reference values -- modus-vivendi: refine-changed bg #4a4a00 fg #efef80, changed bg #363300 fg #efef80. modus-operandi: refine-changed bg #fac090 fg #553d00, changed bg #ffdfa9 fg #553d00.
-
-Side-by-side legibility render: [[file:assets/2026-06-07-dupre-diff-face-legibility-compare.png][assets/2026-06-07-dupre-diff-face-legibility-compare.png]].
-** TODO [#B] erc-yank silently publishes >5-line pastes as public gists :bug:
-=modules/erc-config.el:345= — C-y in any ERC buffer auto-creates a public gist for anything over 5 lines: clipboard content goes to a public URL with no confirmation, and no executable-find guard for =gist= (errors mid-send if absent). Privacy trap. Add a =yes-or-no-p= gate or drop the package for plain C-y. From the 2026-06 config audit.
-
-** TODO [#B] F7 diff-aware coverage classifies every changed file "not tracked" :bug:solo:
-=modules/coverage-core.el:252= — =cj/--coverage-intersect= joins covered×changed by exact string key, but simplecov.json keys are ABSOLUTE paths while the git-diff parser returns repo-RELATIVE ones — zero matches ever, so working-tree/staged/branch scopes report ":tracked nil" for everything and F7's main feature is inert (whole-project scope works, same-source keys). Unit tests hand-build matching keys so they pass; add one integration test feeding a real undercover report + real diff. Normalize both sides to repo-relative. From the 2026-06 config audit.
-
-** TODO [#B] Fix up test runner :bug:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-06
-:END:
-*** 2026-05-16 Sat @ 11:15:51 -0500 Ideas
-**** Current State
-=modules/test-runner.el= is a solid first pass for an Emacs-config-specific ERT
-workflow:
-- project-scoped focus lists
-- run all vs focused mode
-- run ERT test at point
-- load all test files
-- clear ERT tests from other project roots
-- keybindings under =C-; t=
-
-The universal test-running direction is currently split across modules:
-- =test-runner.el= owns ERT focus/state/UI.
-- =dev-fkeys.el= owns F6 language detection and command generation for Elisp,
-  Python, Go, and partial TypeScript.
-
-That split is the biggest architectural pressure point.  The test runner should
-eventually own runner discovery, scopes, command construction, result handling,
-and UI.  F6 should become a thin entry point into the runner.
-
-**** Critical Design Issues
-***** Too ERT-specific at the core
-The current state model is named generically, but most operations assume:
-- test files live in =test/= or =tests/=
-- files match =test-*.el=
-- tests are ERT forms
-- individual tests can be selected by ERT selector regex
-- loading tests into the current Emacs process is acceptable
-
-This makes the module hard to extend cleanly to pytest, Jest, Vitest, Go, Rust,
-or shell test runners.  The common abstraction should be "test run request" and
-"test runner adapter", not "ERT file list".
-
-***** In-process ERT causes state contamination
-=cj/test-load-all= and focused runs load test files into the current Emacs
-session.  This is fast and ergonomic, but it can leak:
-- global variables
-- advice
-- loaded features
-- overridden functions
-- ERT test definitions
-- load-path mutations
-
-The runner should support two ERT execution modes:
-- =interactive= / in-process for fast local TDD
-- =isolated= / batch Emacs for reliable verification
-
-The isolated path should be preferred for "before commit", CI parity, and
-agent-driven verification.
-
-***** Test discovery is regex-based and fragile
-=cj/test--extract-test-names= scans files with a regex for =ert-deftest=.
-That misses or mishandles:
-- macro-generated tests
-- commented forms in unusual shapes
-- multiline or reader-conditional forms
-- non-ERT Elisp tests such as Buttercup
-- stale ERT tests already loaded in the session
-
-Better approach:
-- for ERT in isolated mode, let ERT discover tests after loading files
-- for source navigation, use syntax-aware forms where possible
-- store discovered tests as structured records with file, line, name, framework,
-  tags, and runner
-
-***** Path containment has at least one suspicious edge
-=cj/test--do-focus-add-file= checks:
-
-#+begin_src elisp
-(string-prefix-p (file-truename testdir) (file-truename filepath))
-#+end_src
-
-That should use =cj/test--file-in-directory-p= or ensure the directory has a
-trailing slash.  Otherwise sibling paths with a shared prefix are a recurring
-class of bug.
-
-***** Runner commands are shell strings too early
-=cj/--f6-test-runner-cmd-for= returns shell command strings.  That makes it
-harder to:
-- inspect command parts
-- safely quote arguments
-- offer command editing
-- run via =make-process= / =compilation-start= without shell ambiguity
-- attach metadata
-- rerun exact invocations
-- convert commands into UI labels
-
-Prefer a structured command object:
-
-#+begin_src elisp
-(:program "pytest"
- :args ("tests/test_foo.py" "-q")
- :default-directory "/project/"
- :env (("PYTHONPATH" . "..."))
- :runner pytest
- :scope file)
-#+end_src
-
-Render to a shell string only at the final compilation boundary.
-
-***** F6 and =C-; t= workflows duplicate the same domain
-F6 already handles "all tests" and "current file's tests" for multiple
-languages.  =C-; t= handles ERT-only focus and run state.  These should converge
-on one runner service:
-- F6: quick entry point
-- =C-; t=: full runner menu
-- both call the same scope/adapter engine
-
-***** Test directory discovery is too narrow
-Current discovery prefers =test/= then =tests/=, with a global fallback.  Real
-projects often need:
-- Python: =tests/=, package-local =test_*.py=, =pytest.ini=, =pyproject.toml=
-- JS/TS: =package.json= scripts, =vitest.config.*=, =jest.config.*=,
-  =*.test.ts=, =*.spec.ts=
-- Go: package directories, =go.mod=
-- Rust: =Cargo.toml=, integration tests under =tests/=
-- Elisp packages: =Makefile=, =Eask=, =ert-runner=, Buttercup, =tests/=
-
-Discovery should be adapter-specific and project-config-aware.
-
-***** No structured result model
-=cj/test-last-results= exists but is not meaningfully populated.  A powerful
-runner needs a normalized result model:
-- run id
-- started/finished timestamps
-- status: passed/failed/errored/cancelled/skipped/xfail/xpass
-- command
-- runner adapter
-- scope
-- exit code
-- duration
-- failed test records
-- file/line locations
-- raw output buffer
-- coverage artifact paths
-
-This enables last-failed, failures-first, summaries, dashboards, and AI-assisted
-failure explanation.
-
-***** No failure parser / navigation layer
-Compilation buffers are useful, but the runner should parse common failure
-formats and provide:
-- next/previous failure
-- jump to source line
-- failure summary buffer
-- copy failure context
-- rerun failed test at point
-- annotate failing tests in source buffers
-
-Adapters can provide regexes/parsers for ERT, pytest, Jest/Vitest, Go, Rust,
-and shell.
-
-***** Missing watch/rerun modes
-Modern test runners optimize the feedback loop:
-- pytest supports selecting tests, markers, last-failed, failures-first,
-  stepwise, fixtures, xfail/skip, plugins, and cache state.
-- Jest/Vitest support watch workflows, changed-file selection, coverage,
-  snapshots, and rich interactive filtering.  Vitest also defaults to watch in
-  development and run mode in CI.
-- Go and Rust runners commonly support package-level runs, regex selection,
-  race/coverage flags, and cached test behavior.
-
-The Emacs runner should expose the subset that maps well to editor workflows:
-- current test
-- current file
-- related test file
-- focused set
-- last failed
-- failed first
-- changed since git base
-- watch current scope
-- full project
-- coverage for current scope
-
-**** Proposed Architecture
-***** Core Types
-Use plain plists initially; promote to =cl-defstruct= only if helpful.
-
-#+begin_src elisp
-;; Test runner adapter
-(:id pytest
- :name "pytest"
- :languages (python)
- :detect cj/test-pytest-detect
- :discover cj/test-pytest-discover
- :build-command cj/test-pytest-build-command
- :parse-results cj/test-pytest-parse-results
- :capabilities (:current-test :file :project :last-failed :coverage :watch))
-
-;; Test run request
-(:project-root "/repo/"
- :language python
- :framework pytest
- :scope file
- :file "/repo/tests/test_api.py"
- :test-name "test_create_user"
- :extra-args ("-q")
- :profile default)
-
-;; Test run result
-(:run-id "..."
- :status failed
- :exit-code 1
- :duration 2.14
- :failures (...)
- :output-buffer "*test pytest*"
- :artifacts (...))
-#+end_src
-
-***** Adapter Registry
-Create a registry like:
-
-#+begin_src elisp
-(defvar cj/test-runner-adapters nil)
-(cj/test-register-adapter 'pytest ...)
-(cj/test-register-adapter 'ert ...)
-(cj/test-register-adapter 'vitest ...)
-#+end_src
-
-Runner selection should consider:
-- buffer file extension
-- project files
-- explicit user override
-- available executables
-- package manager scripts
-- existing Makefile targets
-
-***** Scope Model
-Make scopes explicit and shared across languages:
-- =test-at-point=
-- =current-file=
-- =related-file=
-- =focused-files=
-- =last-failed=
-- =changed=
-- =package/module=
-- =project=
-- =coverage=
-- =watch=
-
-Each adapter can say which scopes it supports.  Unsupported scopes should produce
-clear user-errors with suggestions.
-
-***** Command Builder Pipeline
-1. Detect project.
-2. Detect language/framework candidates.
-3. Resolve user-requested scope.
-4. Build structured command object.
-5. Optionally let user edit command.
-6. Run via =compilation-start= or =make-process=.
-7. Parse output/result artifacts.
-8. Store normalized result.
-9. Update UI/modeline/messages/failure buffer.
-
-***** Keep Makefile Support But Do Not Require It
-For this Emacs config, =make test-file= and =make test-name= are useful and
-should remain the default Elisp isolated path.  But adapter detection should
-support:
-- direct =emacs --batch= ERT invocation
-- =make test=
-- =make test-file=
-- =make test-name=
-- Eask
-- Buttercup
-
-**** Elisp-Specific Improvements
-***** Add isolated ERT runs
-Support batch commands for:
-- all project tests
-- one test file
-- one test name
-- focused files
-- last failed, once result parsing exists
-
-Use the same Makefile targets in this repo, but design the adapter so other
-Elisp projects can run without this Makefile.
-
-***** Support Buttercup/Eask Later
-Buttercup uses BDD-style =describe= / =it= suites and is common in Elisp
-package testing.  Eask is often used to run package tests.  Add adapter slots
-for these instead of hard-coding ERT forever.
-
-***** Avoid unnecessary global ERT deletion
-=cj/ert-clear-tests= is a pragmatic fix for project contamination, but the
-stronger long-term answer is isolated runs plus project-scoped discovery.  Keep
-the cleanup command, but do not make correctness depend on deleting global ERT
-state.
-
-**** Python / pytest Ideas
-- Detect pytest by =pyproject.toml=, =pytest.ini=, =tox.ini=, =setup.cfg=, or
-  presence of =tests/=.
-- Build commands for:
-  - project: =pytest=
-  - file: =pytest path/to/test_file.py=
-  - test at point: =pytest path/to/test_file.py::test_name=
-  - class method: =pytest path::TestClass::test_method=
-  - marker: =pytest -m marker=
-  - last failed: =pytest --lf=
-  - failed first: =pytest --ff=
-  - stop after first: =pytest -x=
-  - coverage: =pytest --cov=...=
-- Parse output for failing node ids and =file:line= references.
-- Read pytest cache for last-failed where useful.
-- Offer marker completion by parsing =pytest --markers= or config files.
-- Surface xfail/skip separately from hard failures.
-
-**** TypeScript / JavaScript Ideas
-***** Detection
-Detect runner by project files and scripts:
-- =vitest.config.ts/js/mts/mjs=
-- =jest.config.ts/js/mjs/cjs=
-- =package.json= scripts: =test=, =test:watch=, =vitest=, =jest=
-- lockfile/package manager: =pnpm-lock.yaml=, =yarn.lock=, =package-lock.json=,
-  =bun.lockb=
-
-Prefer project scripts over raw =npx= when present:
-- =pnpm test -- path=
-- =npm test -- path=
-- =yarn test path=
-- =bun test path=
-
-***** Scopes
-- current file: =vitest run path= or =jest path=
-- test at point: use nearest =it= / =test= / =describe= string and pass =-t=
-- watch current file
-- changed tests where runner supports it
-- coverage current file/project
-- update snapshots
-
-***** Result Parsing
-Parse:
-- failing test names
-- file paths and line numbers
-- snapshot failures
-- coverage summary
-
-Treat snapshot updates as an explicit command, not an automatic side effect.
-
-**** Go Ideas
-- Detect =go.mod=.
-- Current file/source: run package =go test ./pkg=.
-- Test at point: nearest =func TestXxx= and run =go test ./pkg -run '^TestXxx$'=.
-- Bench at point: nearest =BenchmarkXxx= and run =go test -bench '^BenchmarkXxx$'=.
-- Add toggles for =-race=, =-cover=, =-count=1=, =-v=.
-- Parse =file.go:line:= output and package failure summaries.
-
-**** Rust Ideas
-- Detect =Cargo.toml=.
-- Use =cargo test= by default, optionally =cargo nextest run= when available.
-- Current test at point: nearest =#[test]= function.
-- Current file/module where possible.
-- Integration test file: =cargo test --test name=.
-- Support =-- --nocapture= toggle.
-- Parse compiler/test failures and =file:line= links.
-
-**** Shell / Generic Ideas
-- Adapter for Makefile targets:
-  - detect =make test=, =make check=, =make coverage=
-  - expose project-level commands even when language-specific detection fails
-- Adapter for arbitrary project command configured in dir-locals or a project
-  config plist.
-- Let users register custom command templates per project:
-
-#+begin_src elisp
-((:name "unit"
-  :command ("npm" "run" "test:unit" "--" "{file}"))
- (:name "integration"
-  :command ("pytest" "tests/integration" "-q")))
-#+end_src
-
-**** UI Ideas
-***** Transient Menu
-Replace or complement the raw keymap with a =transient= menu:
-- scope: current test/file/focused/last failed/project
-- runner: auto/ert/pytest/vitest/jest/go/cargo/make
-- toggles: watch, coverage, debug, fail-fast, verbose, update snapshots
-- actions: run, rerun, edit command, show failures, open report
-
-***** Result Buffer
-Create a normalized =*Test Results*= buffer:
-- latest status per project
-- command and duration
-- pass/fail/skip counts
-- failure list with clickable =file:line=
-- actions to rerun failed/current/all
-- links to coverage artifacts
-
-***** Modeline / Headerline Signal
-Show the last run status for the current project:
-- green passed
-- red failed
-- yellow running
-- gray no run
-
-Keep it quiet and optional.
-
-***** History
-Store recent run requests per project:
-- rerun last
-- rerun last failed
-- choose previous command
-- compare duration/status against previous run
-
-**** Configuration Ideas
-- =cj/test-runner-default-scope=
-- =cj/test-runner-prefer-isolated-elisp=
-- =cj/test-runner-project-overrides=
-- =cj/test-runner-known-adapters=
-- =cj/test-runner-enable-watch=
-- =cj/test-runner-result-retention=
-- per-project override through =.dir-locals.el=
-
-Example:
-
-#+begin_src elisp
-((nil . ((cj/test-runner-project-overrides
-          . (:adapter pytest
-             :default-args ("-q")
-             :coverage-args ("--cov=src"))))))
-#+end_src
-
-**** Safety And Robustness
-- Use structured commands until the final boundary.
-- Quote only at render time.
-- Avoid shell when =make-process= / =process-file= is sufficient.
-- Keep command preview/editing available for surprising cases.
-- Detect missing executables before running.
-- Add timeouts/cancel commands for long-running or hung tests.
-- Do not silently fall back from a missing runner to a different runner unless
-  the fallback is visible in the command preview.
-- Avoid mutating global =load-path= permanently.
-- Keep remote/TRAMP behavior explicit; do not accidentally run local commands
-  for remote projects.
-
-**** Coverage Integration
-Tie this into the existing coverage work:
-- run coverage for current file/scope
-- open latest coverage report
-- summarize uncovered lines for current file
-- support Elisp SimpleCov/Undercover, pytest-cov, Vitest coverage, Go cover,
-  and Rust coverage later
-- store coverage artifact paths in the normalized run result
-
-**** AI-Assisted Debugging Ideas
-- Summarize failing tests from the parsed failure records and raw output.
-- Include command, changed files, failure snippets, and relevant source/test
-  locations.
-- Redact env vars, tokens, Authorization headers, and secrets before sending to
-  =gptel=.
-- Add commands:
-  - =cj/test-runner-explain-failure=
-  - =cj/test-runner-suggest-related-tests=
-  - =cj/test-runner-summarize-coverage-gap=
-
-**** Migration Plan
-***** Phase 1: Internal cleanup
-- Fix the task typo and rename current ERT-specific functions or wrap them under
-  an ERT adapter.
-- Move F6 language detection/command construction from =dev-fkeys.el= into
-  =test-runner.el= or a new =test-runner-core.el=.
-- Replace shell-string command builders with structured command plists.
-- Fix path containment in =cj/test--do-focus-add-file=.
-- Make =cj/test-last-results= real for ERT runs.
-
-***** Phase 2: ERT adapter
-- Implement adapter registry.
-- Add ERT adapter with in-process and isolated modes.
-- Preserve all current keybindings by routing them through the adapter.
-- Add failure/result normalization for ERT.
-- Add "rerun last" and "rerun failed" for ERT.
-
-***** Phase 3: Python and JS/TS adapters
-- Add pytest adapter.
-- Add Vitest/Jest adapter with package-manager/script detection.
-- Support current file and test-at-point for both.
-- Add parser/navigation for common failures.
-
-***** Phase 4: UI and watch modes
-- Add transient menu.
-- Add result buffer.
-- Add cancellation and rerun history.
-- Add watch commands where supported.
-
-***** Phase 5: Coverage and AI
-- Connect coverage commands to adapter capabilities.
-- Add failure summarization with redaction.
-- Add coverage-gap summarization.
-
-**** Acceptance Criteria For First Fix-Up Pass
-- Existing ERT workflow still works.
-- F6 and =C-; t= use the same underlying runner API.
-- Current-file test command generation is covered for Elisp, Python, Go,
-  TypeScript, and JavaScript.
-- At least one isolated ERT command path exists.
-- Path containment checks are robust against sibling-prefix paths and symlinks.
-- Runner requests and results are represented as data, not only messages.
-- Missing runner/tool errors are clear and actionable.
-- Tests cover adapter detection, command building, scope resolution, result
-  storage, and key interactive paths.
-
-** TODO [#B] F-key Completion :feature:
+** PROJECT [#B] F-key Completion :feature:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-02
 :END:
@@ -1015,30 +848,6 @@ Add the buffer-local var, set it on each "Run a test..." selection, use it as th
 *** TODO [#B] TS/JS coverage status sync
 Update the =dev-fkeys.el= header comment (L33) — TS/JS is no longer punted; the cmd-builder at L384 emits vitest/jest. Document the prefer-vitest fallback.
 
-** TODO [#B] jumper: register collisions and dead-marker errors :bug:solo:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
-:END:
-Two related defects from the 2026-06 config audit:
-- =modules/jumper.el:155= — removal shifts the vector without renumbering registers, so a later store allocates a register still held by a surviving location and silently overwrites it. Allocate the first free register char in the live slice; =set-register nil= on removal so freed markers don't pin buffers.
-- =modules/jumper.el:117,132= — guards check =(markerp marker)= but not =(buffer-live-p (marker-buffer marker))=; after killing a buffer holding a location, M-SPC SPC and M-SPC j signal wrong-type errors. Treat dead entries as skippable/removable.
-Also =jumper.el:178= — the promised single-location toggle never toggles back ('already-there branch should =jump-to-register= z when set).
-
-** TODO [#B] Keymap consolidation — resolve decisions, run Phase 1-2 :feature:refactor:solo:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
-:END:
-Spec: [[id:540bf06b-16b8-46c6-b459-c40d1b9c795d][keybinding-console-safety-spec-doing.org]]. Phase 0 (revert 4a1ecf64) is done and pushed. Decisions D1-D5 are open TODOs in the spec; D2/D4/D5 gate the primary work (Phase 1 prune via Appendix D, Phase 2 consolidate + retire the translation block), while D1/D3 (the console-safe prefix) gate only the optional Phase 3 and can stay open indefinitely. Resolve D2/D4/D5, then run Phase 1-2. Appendix D is the keybinding pruning checklist. Add a =#+TODO: TODO | DONE SUPERSEDED CANCELLED= header line to the spec if adopting those decision keywords (rulesets convention update, 2026-06-12).
-
-** TODO [#B] ledger-config is orphaned — ledger-mode never configured :bug:quick:
-Nothing requires =modules/ledger-config.el= (verified by grep), so .dat/.ledger/.journal open without ledger-mode, reports, or flycheck-ledger. The module looks finished, not staged (unlike duet-config, which documents its pre-alpha orphaning). Decide: wire into init.el (+ =cj/executable-find-or-warn= for the ledger binary) or delete. From the 2026-06 config audit.
-
-** TODO [#A] Unify Signel and All Messengers into one UX :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-16
-:END:
-Spec: [[file:docs/specs/messenger-unification-spec.org][messenger-unification-spec.org]] ([[id:4bfc2011-8ffc-4765-8886-91df12141171][by id]], Draft, 2026-06-11; keybinding-alphabet section + smoke-first parity added 2026-06-16). One library (=cj-messenger-lib.el=) gives every messenger the same shape: chat windows rise from the bottom (the signel rule, generalized), C-c C-c confirms, C-c C-k cancels, C-c C-a attaches — dispatched per backend through a registry + minor mode. Signel already conforms (reference backend); telega and slack join in phases 2-3; ERC later. All eight decisions settled 2026-06-11 (cancel closes an idle window; telega's filter-cancel shadow accepted; slack rooms join the bottom rule). Spec held open — Craig has more ideas to fold in before it's marked Ready.
-
 ** PROJECT [#B] Migrate All Terminals From Vterm to Ghostel
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-04
@@ -1962,7 +1771,7 @@ Expected outcome:
 - Keep the current "interpreted markers win" behavior only if that remains the
   intentional UX after trying it in mixed Python/Node projects.
 
-**** PROJECT [#B] Consolidate LSP ownership across programming modules :refactor:
+**** TODO [#B] Consolidate LSP ownership across programming modules :refactor:
 
 LSP setup is currently split across =prog-general.el=, =prog-lsp.el=, and each
 language module. There are multiple =use-package lsp-mode= forms and some
@@ -2438,22 +2247,7 @@ configuration (=text-config=, =diff-config=, =ledger-config=,
 =games-config=, =mu4e-org-contacts-setup=, =telega-config=,
 =httpd-config=, =org-agenda-config-debug=).
 
-** VERIFY [#B] org-roam :config triggers the 15-20s refile scan synchronously at first idle :bug:solo:next:
-Needs from Craig: this is measurement-first (perf), not a blind fix — it's the same bottleneck as the "optimize org-capture target building" debug task. Run /debug with debug-profiling to measure what actually costs the 15-20s (file count? regex? agenda rebuild?), then fix from the data. I won't restructure the refile/agenda scan without a profile. Say "let's debug it" and I'll profile + fix.
-=modules/org-roam-config.el:78-79= — org-roam is =:defer 1=, so its :config calls =cj/build-org-refile-targets= at 1s idle, BEFORE the 5s background timer (=org-refile-config.el:144-151=); on a cold cache the 30k-file scan runs inline and freezes Emacs at first idle. Drop the call — org-roam is loaded long before the 5s timer fires. Likely a player in the filed org-capture 15-20s perf task (=[#B] Optimize org-capture target building performance=) — check both together. From the 2026-06 config audit.
-
-** VERIFY [#B] Stale elpa gptel shadows the local fork — likely the gptel-magit root :bug:quick:solo:next:
-Needs from Craig: can't be done standalone. I tried deleting elpa/gptel-0.9.8.5 — the fork loaded fine and gptel-magit still worked via use-package autoloads, but package activation then printed "Unable to activate gptel-magit / Required gptel-0.9.8 unavailable" on every startup, so I reverted. To remove the shadow we must also resolve gptel-magit's package dependency: either drop gptel-magit's package dep (load it via load-path like the gptel fork), or repackage the fork into .localrepo as gptel. Tell me which and I'll do it; this pairs with the gptel-magit investigation.
-=elpa/gptel-0.9.8.5= is still installed alongside the =~/code/gptel= fork (=ai-config.el:383=); package activation puts the elpa dir + autoloads on load-path, so which copy wins depends on ordering, and a mixed load (fork .el + elpa .elc) produces "impossible" bugs. =gptel-magit= (elpa) declares gptel as a dependency, so IT may be pulling the stale copy — check this first when working the open "[#B] Investigate gptel-magit not working properly" task. Fix: =package-delete= the elpa gptel + remove from .localrepo so the fork is the only copy on disk. From the 2026-06 config audit.
-
-2026-06-15: tried deleting =elpa/gptel-0.9.8.5= standalone. The fork loaded correctly and gptel-magit still worked via use-package =:commands= autoloads, BUT package activation then printed "Unable to activate package gptel-magit / Required package gptel-0.9.8 unavailable" on every startup and test run (gptel-magit declares gptel as a package dependency that no longer resolves). Reverted. This can't be done standalone — it must be paired with the gptel-magit dependency fix (drop gptel-magit's package dep, or repackage the fork into .localrepo as gptel). Do it together with the gptel-magit investigation task.
-
-** VERIFY [#B] theme-studio: dashboard preview icons missing, list items unthemed :bug:studio:next:
-Needs from Craig: an approach decision on the icon half. The navigator nerd-glyphs show as mojibake because the browser has no nerd font — fixing it means shipping/@font-face-ing a Symbols Nerd Font web font into the studio page (a real asset + licensing call), or substituting plain glyphs in the preview. The "list items unthemed" half is a separate studio-CSS fix I can do, but I'd rather settle the font approach and do both together. Tell me: embed the nerd font, or use substitute glyphs?
-Found while theme-testing the live dashboard against the preview.
-- The navigator icons don't render in the preview at all, showing as mojibake. The nerd-font glyphs have no font fallback in the browser.
-- No way to set the color of the project, bookmark, and recent-files list items. The preview renders those entries as plain unstyled text, and the dashboard app exposes no editable face for them.
-** TODO [#B] theme-studio guide-support features :feature:studio:
+** PROJECT [#B] theme-studio guide-support features :feature:studio:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-13
 :END:
@@ -2462,81 +2256,668 @@ From the color-assignment guide work (2026-06-08): make the tool support the gui
 [[id:b70b37f2-37df-4c8e-ac2f-1f20d12e33dd][theme-studio-seeding-engine-spec-doing.org]] — role table + face→role maps for syntax/UI/org, OKLCH shade generation, reseed dupre-revised to the compact mapping. Codex-reviewed, Ready. Implementation tracked under the seeding-engine parent below.
 *** TODO Guide-support views and advisories spec
 Five optional surfaces, all dismissible and non-blocking, in one collapsible panel where they advise: (1) CVD-simulation toggle on previews (deuteranopia/protanopia/tritanopia); (2) squint/blur preview toggle; (3) lightness-ramp view + palette advisories (accent count over 6-8, roles separated only by red/green) — depends on the OKLCH/ΔE core; (4) definition-vs-call / weight advisories; (5) state-over-syntax preview (region/search/diff tint over real syntax-colored text). Sequence: rewritten guide reviewed → seeding-engine spec → this. Advisories (3, 4) layer on the perceptual-metrics feature.
-** TODO [#B] theme-studio import organization workflow needs a spec :feature:studio:
+** PROJECT [#C] GPTel Feature Extension Brainstorm :feature:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
+:LAST_REVIEWED: 2026-06-01
 :END:
-Design import handling for unstructured color sources such as Emacs themes, CSS palettes, screenshots, and generic palette files. Principles from the 2026-06-13 Theme Studio discussion:
-- Preserve declared structure whenever an imported entry has a =columnId=.
-- For unstructured legacy imports with no =columnId=, avoid silent hue clustering and avoid treating arbitrary =color-N= names as one long ramp; each =color-N= should become its own base column.
-- Keep meaningful generated ramp-name inference for names like =blue-1= / =blue= / =blue+1=.
-- Group external numeric color-name variants for compact display: =blue1= / =blue2= / =blue3= infer column =blue=; =grey80= / =grey81= infer column =grey=; =orchid3= infers =orchid=. This is display organization, not proof that the colors are an authored Theme Studio span.
-- If a numeric external base is spanned later, generate from the actual base name, e.g. =blue1-1= / =blue1= / =blue1+1=, while keeping those generated tiles in the inferred =blue= column.
-- Add explicit organization tools rather than hidden inference: group selected colors into a column, suggest hue groups as a preview/action, sort imported colors for inspection, and promote a color from an import bucket into a normal column.
-- Consider a compact imported/captured bucket UI for large unstructured imports while preserving per-color column ids internally.
 
-** VERIFY [#B] theme-studio: org-agenda app + agenda preview :feature:theme-studio: :studio:next:
-Needs from Craig: this is a multi-phase feature, not a bug fix — it depends on the preview-locate feature (per the 2026-06-15 spec) and means breaking org-agenda-* / scheduling / deadline / calendar / clocking faces into their own theme-studio pane with a representative week-agenda preview. Too large to land inside this batch. Confirm you want it built now (and as its own focused session) and I'll start from the spec; otherwise it stays parked.
-Break the org-agenda-* plus scheduling / deadline / calendar / clocking / filter faces out of the overloaded org-mode app into a dedicated org-agenda pane (org-mode-line-clock* stay in org-mode), with a representative week-agenda preview at natural item frequency. Keywords, priorities, and tags render live via org-faces / org-mode through the locate registry (hover-only there). Same five-file bespoke-app pattern as org-faces. Depends on the preview-locate feature. Partly subsumes the "break org-mode preview into grouped subsections" task.
-** TODO [#B] theme-studio seeding engine :feature:studio:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
-:END:
-Spec (Ready): [[id:b70b37f2-37df-4c8e-ac2f-1f20d12e33dd][spec]]. Role table → guide-correct defaults for syntax/UI/org; reseed dupre-revised.json to the compact mapping; opens seeded with an all-tier reseed button. Depends on the perceptual-metrics colormath.js core for OKLCH shade generation, so it runs after that feature's Phase 1.
-*** TODO Seed model + seed() + #seedtest :solo:
-Phase 1. Palette anchors + OKLCH shade generation (reusing colormath.js), the ROLES table, and the three face→role maps as data; pure seed(). Gate: #seedtest asserts representative syntax/UI/org faces resolve correctly (bi→blue-grey, fnd→gold+bold, region bg-only, link underlined, org-level-1 strongest, org-code literal lane) and a non-org bespoke package (magit) keeps its curated seed.
-*** TODO Open-seeded + reseed + dupre-revised regen :solo:
-Phase 2. Initial state from seed() plus seedPkgmap for the non-org packages; all-tier reseed button with a scope-named overwrite warning, resetting non-org to their APPS defaults; regenerate dupre-revised.json. Gate: #selftest PASS; default-on-open equals seed(); artifact round-trip (regenerated dupre-revised.json imports back to the same seeded state); Chrome eyeball.
-*** TODO Seeding-engine test surface :solo:test:
-Keep #seedtest, #selftest, the default-on-open check, the dupre-revised round-trip, node --check, and Chrome validation green.
-** TODO [#B] theme-studio semantic theme architecture :feature:theme-studio:spec: :spec:studio:
+Categories below thematize the agent affordances the design doc
+[[file:docs/design/gptel-agentic-tool-ideas.org][gptel-agentic-tool-ideas.org]]
+points at -- Git, Org, messaging, file / buffer / workspace state,
+media, and the dev loop.  The shortlist's first-batch ADOPT tools
+(git_status / git_log / git_diff / web_fetch) already shipped; the
+themes below are next-tier work where the agent treats Emacs as a
+structured workspace, not a text terminal.  Per-theme spec lives in
+the task body once written; implementation tasks land as siblings
+of the spec heading once the spec is approved.  The magit-backend
+reimplementation of the shipped git tools is tracked separately in
+[[id:bd47c9a8-aae1-4a3d-ad5b-b8767f2fd580][gptel-git-tools-magit-backend-spec.org]].
+
+*** TODO [#C] Wire Up MCP.el so That GPTel Has Access to MCP Servers via GPTel Tools
+
+**** 2026-05-16 Sat @ 15:44:36 -0500 Spec
+
+Design doc: [[id:b4c274c5-8572-4a7b-b657-d315712bd6af][docs/specs/mcp-el-gptel-integration-spec-doing.org]]
+
+**** 2026-05-17 Sun @ 14:14:34 -0500 Landed ai-mcp.el pure-helper foundation
+
+Commit =54d231be=.  Sections 1 (constants + defcustoms) and 3 (pure helpers) of the seven-section outline.  41 ERT tests, all green.  Refactor audit caught two duplications during Phase 4 and folded them into the same commit (=cj/mcp--get-server-entry= and =cj/mcp--name-matches-p=).  Phase 1.5 (confirmation contract) is next.
+
+**** TODO [#C] Phase 1.5 -- GPTel confirmation contract
+
+*Goal:* flip =gptel-confirm-tool-calls= to ='auto= and gate the existing local tools that need it.
+
+*Entry:* Phase 1 module exists and helpers tested.
+
+*DECISION (cj):* which of the existing local tools register with =:confirm t= once ='auto= is in effect?  Reads (=read_buffer=, =read_text_file=, =list_directory_files=, =git_status=, =git_log=, =git_diff=) clearly stay =:confirm nil=.  Judgment calls:
+- =web_fetch= -- fetches arbitrary URLs the agent supplies.  Spec recommends gating.
+- =write_text_file= -- writes any path under =$HOME= with agent-supplied content.
+- =update_text_file= -- modifies an existing file with an agent-supplied transform.
+- =move_to_trash= -- moves a path to trash (reversible but disruptive).
+
+*Deliverables:*
+- =ai-mcp.el= setup section runs =(setq gptel-confirm-tool-calls 'auto)=.
+- Remove =(setq gptel-confirm-tool-calls nil)= from =modules/ai-config.el:386= with a comment pointing at =ai-mcp.el=.
+- For each tool the decision marks "gate," add =:confirm t= to its =gptel-make-tool= form.
+- Tests in =tests/test-ai-mcp-confirm-contract.el= asserting: =gptel-confirm-tool-calls= is ='auto= after load; write-classified stub MCP tool with =:confirm t= triggers the confirm branch in =gptel-send='s dispatch (stub the prompt); read-classified MCP tool with =:confirm nil= does not; =git_log= (=:confirm nil=) still runs without prompting; each newly-gated local tool does prompt.
+
+*Exit:* tests green.  Manual smoke: open GPTel, call a gated tool, confirm prompt appears.  Call =git_log=, no prompt.
+
+**** TODO [#B] Phase 2 -- Compat layer + registration pipeline (fake inventory)
+
+*Goal:* implement the mcp.el compat wrappers and the tool-registration pipeline against stubbed =mcp-server-connections=.
+
+*Entry:* Phase 1.5 proves gptel respects per-tool =:confirm= slot.
+
+*Deliverables:*
+- Section 4 of =ai-mcp.el= (compat layer): =cj/mcp--server-status=, =cj/mcp--server-tools=, =cj/mcp--server-name=, =cj/mcp--assert-capabilities=.  Each helper documents the upstream commit / file location it targets.
+- Section 5 of =ai-mcp.el= (registration pipeline): =cj/mcp--register-tool=, =cj/mcp--register-server-tools=, =cj/mcp--deregister-server-tools=, =cj/mcp--rewrite-plist=, =cj/mcp--registered-tools= hash.
+- All MCP tools register with =:async t=.
+- Tests in =tests/test-ai-mcp-registration.el=.
+
+*Exit:* with a stubbed =mcp-server-connections=, registration produces correctly prefixed =mcp__SERVER__TOOL= entries in =gptel-tools=; closures call =mcp-call-tool SERVER REMOTE-NAME= (verified by stubbing =mcp-async-call-tool=); deregistration removes only MCP-owned tools and leaves a pre-populated local =git_log= entry intact; re-registration replaces function pointer without duplicating menu entries; confirm overrides win over patterns.
+
+**** TODO [#B] Phase 3 -- Async state machine + timer-race timeout wrapper
+
+*Goal:* implement the lifecycle state machine and the per-call timer-race timeout.
+
+*Entry:* Phase 2 registration works against stubs.
+
+*Deliverables:*
+- Section 6 of =ai-mcp.el= (async state machine): =cj/mcp--state=, =cj/mcp--server-status= alist, =cj/mcp--stall-timer=, =cj/mcp-ensure-started=, =cj/mcp--on-hub-callback=, =cj/mcp--poll-status=, =cj/mcp--start-stall-timer=, =cj/mcp--build-status-from-specs=.
+- =cj/mcp--wrap-async-with-timeout= (timer/callback race; both branches set =done= before invoking gptel callback so late responses are ignored).
+- Tests in =tests/test-ai-mcp-async.el=.
+
+*Exit:* =cj/mcp-ensure-started= returns in <100 ms with delayed-callback stubs; stall timer fires for stuck servers; timer-race wrapper handles all three orderings (MCP-first, timer-first, late-MCP-after-timer); async error path (=:error-callback= without inited callback) reaches =failed= state via polling.
+
+**** TODO [#B] Phase 4 -- First real connection (drawio or slack-deepsat)
+
+*Goal:* wire one real no-auth server end-to-end against actual mcp.el and prove the stubbed Phase 3 behavior matches reality.
+
+*Entry:* Phase 3 async works against stubs.
+
+*Deliverables:*
+- Add =use-package mcp= to =ai-mcp.el= (MELPA active, =:load-path= for local checkout commented).
+- =cj/mcp--assert-capabilities= called at load time; signals clearly if mcp.el is too old.
+- Set =cj/mcp-enabled-servers= temporarily to =("drawio")= (or =("slack-deepsat")= if the local proxy is running).
+- First real =cj/mcp-ensure-started= invocation from =cj/toggle-gptel=.
+
+*Exit:* manual smoke -- =C-; a t= opens GPTel without blocking; within 30 s, drawio (or slack-deepsat) tools appear in =gptel-menu= grouped by category; calling a tool returns expected output; killing the subprocess externally surfaces as =failed= in =cj/mcp--server-status=.
+
+**** TODO [#B] Phase 5 -- Status UX + commands + doctor (static)
+
+*Goal:* ship the full server-management UX so partial-availability and failures are visible.
+
+*Entry:* Phase 4 proves a real connection works.
+
+*Deliverables:*
+- Section 7 of =ai-mcp.el= (UI).
+- Commands: =cj/mcp-status= (echo-area summary keyed off =cj/mcp--state=), =cj/mcp-list-tools= (tabulated buffer with failed servers at top in red face; keys =g r c RET q=), =cj/mcp-doctor= (static mode only -- capability, =npx=/=uvx=, Claude config, per-server env, local endpoints; output buffer keys =c r q=), =cj/mcp-wait-until-ready=, =cj/mcp-hub= (thin wrapper that ensures startup first), =cj/mcp-restart-failed=, =cj/mcp-restart-server=, =cj/mcp-stop-all=.
+- Keymap: =C-; a C= subprefix bound in =ai-config.el='s autoload section.  Keys =h s l r R S d w=.
+- which-key labels for every binding.
+- =kill-emacs-hook= registration for =cj/mcp-stop-all=.
+- Investigation: does =gptel-menu= refresh after mid-call tool registration?  Document the answer in =ai-mcp.el= commentary; if it requires close+reopen, add to known UX caveats.
+
+*Exit:* all keymap bindings work; audit buffer surfaces failed servers prominently; doctor identifies each scenario in the manual test matrix; status command shows the right state for each phase transition.
+
+**** TODO [#B] Phase 6 -- HTTP servers (linear, notion)
+
+*Goal:* add the two HTTP-transport servers with in-protocol OAuth.
+
+*Entry:* Phase 5 UX shipped.
+
+*Deliverables:*
+- Add =linear= and =notion= back to =cj/mcp-enabled-servers=.
+- Doctor gains live-auth-check mode (=C-u C-; a C d=): invokes a single safe read per auth class to verify OAuth tokens haven't silently expired.  Static checks first; live probe only fires after static passes.
+- OAuth recovery pattern matcher surfaces auth URLs in =cj/mcp-status= on first connect.
+
+*Exit:* first connect surfaces the OAuth URL through the recovery pattern; after browser handshake completes, subsequent connects succeed without prompt; live-auth-check correctly identifies a deliberately revoked token; both servers appear ready in the audit buffer.
+
+**** TODO [#B] Phase 7 -- Env-dependent stdio servers (figma, google-*)
+
+*Goal:* add the remaining five env-dependent servers.
+
+*Entry:* Phase 6 HTTP servers connect cleanly.
+
+*Deliverables:*
+- Add =figma=, =google-calendar=, =google-docs-personal=, =google-docs-work=, =google-keep= to =cj/mcp-enabled-servers=.
+- Verify env-merge from =~/.claude.json= for each (the mtime-cached reader from Phase 1).
+- Verify figma's =:secret-args= splicing places the API key correctly without echoing it.
+- Manual smoke: simulate token expiry on one Google server; recovery message points at "re-auth via Claude Code, then C-; a C r SERVER".
+
+*Exit:* all 9 servers reach =ready= state on a clean machine.  Sentinel-grep check across status / audit / hub / errors / audit-log shows zero secret leakage.  Doctor's live-auth covers each auth class (oauth, token, args-token, in-protocol, local, none).
+
+**** TODO [#B] Phase 8 -- Privacy + audit polish
+
+*Goal:* land the final UX polish and documentation.
+
+*Entry:* all 9 servers working.
+
+*Deliverables:*
+- Audit buffer privacy header: "Tool results land in =gptel-tools= responses; saved conversations persist them.  Use =cj/gptel-autosave-toggle= per buffer to opt out."
+- =cj/mcp-tool-audit-log-enabled= defcustom + log writer (=~/.emacs.d/data/mcp-tool-log/YYYY-MM-DD.log= -- metadata only, one line per call, daily rotation).
+- =ai-mcp.el= commentary updated with the code-organization outline as a table of contents.
+- Final pass on tests covering saved-conversation behavior (autosave persists MCP tool results; toggling off prevents persistence).
+
+*Exit:* all 10 acceptance criteria from the spec pass.  Manual matrix run end-to-end on a fresh Emacs.  Working tree clean.
+
+*** TODO [#C] Wrap the gh CLI as a GPTel tool
+
+**** 2026-05-16 Sat @ 16:20:00 -0500 Spec
+
+Design doc: [[id:a124dd0f-1f40-4533-aeb8-595d93e20865][docs/specs/gptel-gh-tool-spec.org]]
+
+*** TODO [#C] GPTel should autosave regularly after a conversation is saved
+*** TODO [#B] Org Workflow Related Tools
+
+Affordances that expose the Org workspace -- agenda state, capture
+targets, org-roam nodes and backlinks, dailies, drill review state --
+to the agent as structured context, not raw .org buffer text.
+
+**** TODO [#B] Agenda state tools :feature:
+
+Read scheduled / deadline / waiting tasks for a date range; query by
+tag, priority, or TODO keyword; list what's blocking today.  Lets the
+agent answer "what's on the critical path this week" without me
+pasting agenda output, and feeds the daily-prep / wrap-up workflows.
+
+**** TODO [#B] Org-roam node tools :feature:
+
+Resolve a topic to its node; return body + backlinks; list nodes by
+tag; surface dailies for a date range.  Lets the agent reason over
+the personal knowledge graph and write back into it via the capture
+tools below.
+
+**** TODO [#B] Capture creation tools :feature:
+
+Drive =org-capture= from a template key + body string.  Lets the
+agent file inbox items, reading notes, journal entries, or roam
+nodes without me leaving the chat.  Tight pairing with the
+=cj/org-capture= optimization task in todo.org.
+
+**** TODO [#B] Org-drill review tools :feature:
+
+Surface next-due drill cards in =drill-dir=; let the agent quiz on a
+topic and report performance.  Useful for prompted recall sessions
+("ask me five medical-Spanish cards") and for "did this card stick"
+analysis.
+
+*** TODO [#B] Git Related Tools
+
+Affordances that expose magit's structured view of a repo -- sections,
+staged-vs-unstaged, commit metadata, rebase / conflict state -- as
+first-class tools rather than asking the model to reason over raw
+diff text.
+
+**** TODO [#B] Section-aware git tools :feature:
+
+Expose Magit sections as first-class GPTel tools: current section type,
+heading, file, hunk range, and content; sibling sections under the same
+file; staged / unstaged / untracked status; commit metadata around the
+selected commit or branch; the exact staged patch that would be
+committed.  Lets prompts say "review the file section at point" or
+"explain this hunk in the context of adjacent hunks" without manual
+context-copying.
+
+**** TODO [#B] Commit intent workbench :feature:
+
+Transient that builds a commit intentionally:
+1. Agent reads unstaged + staged changes.
+2. Agent proposes coherent commit groups.
+3. User selects groups in a Magit-style buffer.
+4. Agent stages those paths or hunks only after confirmation.
+5. Agent generates a message reflecting the selected intent.
+
+Addresses the common case of two or three unrelated edits in one
+working tree -- a single commit-message generator can't handle that
+cleanly.
+
+**** TODO [#B] Patch narrative buffer :feature:
+
+Generate an Org buffer that explains a change set as a reviewable
+narrative:
+- "What changed" by subsystem.
+- "Why it appears to have changed" inferred from names, tests, and docs.
+- "Risk areas" with links back to Magit file sections.
+- "Suggested verification" using local Makefile targets when present.
+
+Reusable artifact: paste into a PR description, save with an AI
+session, or file into org-roam.
+
+**** TODO [#B] Review-thread simulator :feature:
+
+Before opening a PR, create a local review buffer with inline comments
+attached to Magit diff positions.  The agent writes comments as if
+reviewing someone else's patch:
+- Comments grouped by severity.
+- Each comment links to file and line.
+- Resolved comments check off in Org.
+- Accepted suggestions apply through the existing text-update tools.
+
+Makes "review my diff" less ephemeral and avoids losing useful findings
+inside a chat transcript.
+
+**** TODO [#B] Rebase and conflict coach :feature:
+
+When Magit enters a rebase, cherry-pick, merge, or conflict state,
+expose an agent command that reads:
+- Git operation state from =.git/=.
+- Conflict markers in the worktree.
+- Relevant commits from =git log --merge= or the rebase todo.
+- The current Magit status sections.
+
+The agent explains the conflict in domain terms and proposes a
+resolution patch; the actual edit and =git add= stay under explicit
+user control.
+
+**** TODO [#B] Regression archaeology :feature:
+
+Magit transient that runs a bisect-like reasoning workflow:
+- Ask for a symptom and a known-good / known-bad range.
+- Summarize candidate commits in small batches.
+- Use tests or user-provided repro commands when available.
+- Maintain a bisect journal in an Org buffer.
+
+Even when the agent can't run the whole bisect, it keeps the
+investigation structured and preserves why each commit was judged
+good or bad.
+
+**** TODO [#B] Messaging Related Tools
+
+Affordances over mu4e, Slack, Telegram, and ERC.  Same shape across
+protocols: read recent threads, search by sender / topic, compose a
+draft from a prompt + thread context, leave the send under explicit
+user control.
+
+***** TODO [#B] Mu4e thread and compose tools :feature:
+
+Read the message at point and surrounding thread (with attachments
+summarized); query the inbox by =from:= / =subject:= / date range;
+compose a draft from a prompt + thread context using =org-msg=.
+Pairs with the existing =mu4e-org-contacts-integration.el=.
+
+***** TODO [#B] Slack thread and compose tools :feature:
+
+Read channel / DM / thread history through =emacs-slack=; search by
+user or channel; compose a draft message but leave sending to me.
+Mirrors the mu4e shape so the agent's interface is uniform across
+messaging protocols.
+
+***** TODO [#B] Telegram and IRC read tools :feature:
+
+Same shape as Slack for =telega= (Telegram) and =erc= (IRC):
+recent-message reads, search, and draft compose.  Bundled because
+the API shape is identical even if the underlying clients differ.
+
+***** TODO [#B] Contact resolution tools :feature:
+
+Resolve a name to email / Slack ID / Telegram handle via
+=org-contacts= and the configured address books.  Removes the
+"who's this person again" friction from the compose flows above.
+
+**** TODO [#B] File and Buffer Related Tools
+
+Affordances that expose the user's actual workspace -- open buffers,
+narrowed regions, marked files, vterm / eshell sessions -- as
+structured context.  Stops the model from asking "what file are you
+looking at" or "what region is selected."
+
+***** TODO [#B] Buffer state tools :feature:
+
+List visible buffers with major-mode + file (when any); read the
+narrowed region instead of the whole buffer; report point + mark
+positions and the active region's text.  The single most-asked
+question between turns becomes a tool call.
+
+***** TODO [#B] Dirvish / Dired tools :feature:
+
+Read marked files, sort state, and filter state from a Dired or
+Dirvish buffer.  Lets the agent operate on "the files I just marked"
+rather than "files in this directory" -- a real distinction in any
+review or refactor workflow.
+
+***** TODO [#B] Vterm session tools :feature:
+
+Recent command output from a named vterm session; scroll-history
+search.  Pairs naturally with the =ai-vterm= design: the agent
+running in one project's vterm can read another project's vterm
+without leaving the chat.
+
+***** TODO [#B] Eshell session tools :feature:
+
+Same shape as the vterm tools for =eshell= sessions -- last-command
+output, history search, current directory.  Most useful for
+agent-driven inspection of long-running pipelines.
+
+**** TODO [#B] Filesystem Related Tools
+
+Affordances that let the agent operate on actual files on disk and
+run common CLI utilities -- pandoc, ffmpeg, imagemagick, ripgrep,
+fd, jq -- rather than relying on me to paste content or run
+commands by hand.
+
+*Design tension to resolve before any of these ship: one tool per
+utility, or one generic =run_shell_command=?*
+
+The shortlist's first pass DEFERRED a generic =run_shell_command=:
+sandboxing to HOME + /tmp with a denylist for destructive ops is
+straightforward, but the denylist can never be exhaustive, and
+"confirmation for everything else" becomes click-fatigue.
+
+The children below take the other path -- *one gptel tool per
+binary*, with a strictly-typed argv shape (e.g.
+=pandoc_convert(input_path, output_format)=, not
+=pandoc_convert(args_string)=).  Each tool:
+
+- Validates its own paths (must be under HOME, outputs in a
+  sandboxed dir).
+- Rejects dangerous flags explicitly (pandoc =--filter=, ffmpeg's
+  =-protocol_whitelist= chicanery, imagemagick's policy bypasses).
+- Runs via =call-process= with an argv list -- no shell parsing,
+  no string-interpolation injection.
+- Caps output and reports truncation inline.
+
+The trade-off is breadth: every new CLI tool means a new gptel tool
+file.  Acceptable because (a) the list of utilities I actually need
+agent access to is small (~8 below covers most of it), and (b) each
+wrapper gets type-checked argv and a focused description the model
+can reason over, which is genuinely better than a free-form
+=run_shell_command(string)=.
+
+The =eshell_submit= entry at the end is the escape hatch for one-
+off needs the wrappers don't cover -- =:confirm t= always.
+
+Adjacent categories: the existing =gptel-tools/= file CRUD
+(=read_text_file=, =write_text_file=, =update_text_file=,
+=list_directory_files=, =move_to_trash=) is the foundation this
+category extends.  =web_fetch= is the network-fetch counterpart.
+
+***** TODO [#B] Document conversion (pandoc) :feature:
+
+Convert between markdown, org, html, pdf, docx, latex, epub, plain
+text.  Most common use: "extract this docx to markdown so I can
+read it inline."  Strict argv: input path, output format, optional
+output path.  Reject =--filter= and =--lua-filter= (arbitrary code
+execution).  Output written to a sandbox dir unless explicit
+override.
+
+***** TODO [#B] Image manipulation (imagemagick) :feature:
+
+Resize, format-convert, get-metadata (=identify=), optionally crop /
+rotate / annotate.  Common use: "resize this PNG to a thumbnail" or
+"convert these HEICs to JPEGs."  Strict argv per operation.
+Reject pre-validated dangerous formats (the historical EXR / SVG /
+MVG CVE surface) unless explicitly enabled.  ImageMagick's
+=policy.xml= is the underlying defense; the wrapper enforces it at
+the tool boundary too.
+
+***** TODO [#B] Audio / video processing (ffmpeg) :feature:
+
+Trim, transcode, extract audio, get-metadata (=ffprobe=).  Paths
+under HOME only; reject network-protocol inputs (=http:= / =rtmp:=
+/ =rtsp:=) so the model can't pull from arbitrary sources.  Pairs
+with the existing transcription module -- the same "extract audio
+from video" path =cj/transcribe-media= uses internally.
+
+***** TODO [#B] Content search (ripgrep) :feature:
+
+=rg= wrapper with path / glob filtering, result-count cap, optional
+literal-vs-regex mode.  Pure read.  Was in the shortlist's ADOPT
+bucket as =search_in_files=.  Highest-leverage filesystem tool by
+expected call frequency -- "where in this repo is X" is the
+question I paste agent output for most often.
+
+***** TODO [#B] File discovery (fd) :feature:
+
+=fd= (or =find= fallback) wrapper, capped result count.  Pure
+read, lower stakes than =search_in_files= (filenames only, no
+content).  Common pairing: =find_file_by_name= then
+=read_text_file=.
+
+***** TODO [#B] Metadata extraction (file / exiftool) :feature:
+
+=file= for MIME-type detection; =exiftool= for image / video /
+audio metadata.  Lets the agent answer "what is this file" or
+"when was this photo taken" without me opening external tools.
+Pure read.
+
+***** TODO [#B] Structured data processing (jq / yq) :feature:
+
+=jq= for JSON, =yq= for YAML / TOML.  Filter / project / transform
+structured data into a smaller, more focused view before reading.
+Strictly read-only -- output goes to the chat, not to disk.  The
+agent often wants "the third element of .results" from a JSON file
+and this is much cheaper than pasting the whole thing.
+
+***** TODO [#B] Eshell command submission :feature:
+
+Submit a single eshell command line, return output (capped).
+=:confirm t= always -- this is the escape hatch where the
+strictly-typed wrappers above don't fit, so each invocation needs
+my eyeball.  Eshell parses in-process (no /bin/sh fork) so the
+security surface is narrower than a shell command runner, but it's
+still effectively arbitrary execution -- treat it as such.
+
+**** TODO [#B] Media and Reading Related Tools
+
+Affordances over non-code content: feeds, PDFs, EPUBs, music.  The
+agent's job here is summarize / extract / queue, not produce.
+
+***** TODO [#B] Elfeed entry tools :feature:
+
+Read entry body; list unread by feed or tag; mark read after a
+summary lands in a roam node or inbox.  Enables "give me the
+non-noise headlines from this week's feeds" flows.
+
+***** TODO [#B] PDF and EPUB text tools :feature:
+
+Extract plain text from a PDF page or page range (via =pdftotext=)
+and from an EPUB (via the existing nov-mode pipeline).  Lets the
+agent summarize / quote a research paper or book chapter without
+me pasting passages.
+
+***** TODO [#B] EMMS playback and queue tools :feature:
+
+Current track, queue contents, playback state; queue or play a
+path; compose a playlist from a prompt ("play something focusing
+that's not Nick Cave").  Light tools, but a frequent friction
+point.
+
+**** TODO [#B] Development Workflow Related Tools
+
+Affordances over the dev loop: compilation output, test invocation,
+coverage / profile data, flycheck / flymake diagnostics.
+
+***** TODO [#B] Compilation buffer tools :feature:
+
+Read the most recent =compile= buffer output; parse error locations
+to =file:line=; summarize what broke.  Pairs with the F6 test-runner
+flow -- "tell me what's failing" becomes a single agent turn
+instead of paste + parse.
+
+***** TODO [#B] Project test invocation tools :feature:
+
+Run =make test-file FILE=X= / =make test-name TEST=Y= /
+project-equivalent and return results.  Currently each agent guesses
+the project convention; expose the canonical invocation explicitly
+per project so the agent can run focused tests itself.
+
+***** TODO [#B] Coverage and profile tools :feature:
+
+Read the most recent SimpleCov JSON or profile dump.  Lets the
+agent answer "what's still uncovered after this push" or "what
+function dominates startup time" against real measured data.
+
+***** TODO [#B] Diagnostic tools (flycheck / flymake) :feature:
+
+Surface current-buffer or project-wide errors and warnings.  Useful
+both as a "what's broken right now" check and as input to the
+patch-narrative buffer / commit-intent workbench above.
+
+**** TODO [#C] gptel-magit activation fails on velox :bug:quick:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-14
+:LAST_REVIEWED: 2026-06-01
 :END:
-Spec draft: [[id:fe980b12-451a-4d8b-a550-d99f9ec49f45][theme-studio-semantic-theme-architecture-spec.org]].
+Surfaced 2026-05-25 while diagnosing an unrelated load failure over SSH. velox-specific — the workstation has a current gptel and does not show it.
 
-Design a Modus-inspired layered Theme Studio output path: palette data, semantic role mappings, face templates, and a generated theme wrapper. Keep the current flat JSON-to-theme converter as the compatibility/default path while proving a layered, self-contained generated theme. Include advisory semantic rules as a possible validation layer, not v1 enforcement.
+At startup (and reproducibly in batch) velox logs: "Unable to activate package `gptel-magit'. Required package `gptel-0.9.8' is unavailable." gptel-magit depends on gptel >= 0.9.8 and velox's installed gptel is older or missing, so it can't activate. A startup warning, not a blocker.
 
-*** TODO [#B] theme-studio palette generator source modes for base-only vs ground-aware palettes :feature:
+Reproduce:
+: emacs --batch --no-site-file -L . -L modules --eval "(package-initialize)" --eval "(message \"done\")" 2>&1 | grep -i gptel
+
+Next step: check the installed gptel version (=(assq 'gptel package-alist)= or =M-x package-list-packages=), update gptel to >= 0.9.8, then re-evaluate gptel-magit activation. If gptel was pinned/held on velox, reconcile the pin against the gptel-magit dependency.
+
+** PROJECT [#C] Music Open Work
+Parent grouping the open music / EMMS issues; close each child independently.
+*** VERIFY [#C] music: extract faces for music config :refactor:quick:solo:next:
+Needs from Craig: this is theme-side work, not a config edit — the music-config faces were already stripped (2026-06-14), so "extracting" them means DEFINING them in the theme (theme-studio JSON / build-theme) for playlist name, status, the per-button on/off pair, per-key symbol+text, and other labels. That needs the actual color choices and which theme(s) to add them to. Give me the palette intent (or say "pick sensible defaults in WIP") and I'll add the face definitions.
+Pull the music-config faces out to the theme (the config no longer defines faces directly): playlist name, status (paused, etc.), two mode colors per "button" (on vs off), a per-key symbol+text color, and a color for all other labels. Pairs with the 2026-06-14 face-stripping work (music-config faces were removed there and are currently undefined until the theme defines them). From the roam inbox 2026-06-15.
+*** TODO [#C] music: show song information in the modeline          :feature:
+Show basic song information in the modeline, with streaming-source support too. Write a spec for this one first. From the roam inbox 2026-06-15.
+*** TODO [#C] Internet radio now-playing  song                      :feature:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-14
+:LAST_REVIEWED: 2026-06-11
 :END:
-Tentative follow-up from walking through the generator algorithms. Consider splitting the current =source: palette= behavior into two explicit source modes, names TBD:
-- =base color palette= — current behavior; use non-ground base color columns only and ignore bg, fg, ground spans, and color spans.
-- =ground and base palette= — use bg/fg plus non-ground base color columns as generator anchors, useful when colored ground endpoints should shape fill-gap or harmony choices.
-
-This may be cancelled if the extra distinction makes the generator harder to understand. Before implementing, decide final names and whether ground-aware source should include only bg/fg or also ground span steps.
+Show the currently-playing song while streaming an internet radio station. Lives in =modules/music-config.el= (EMMS + MPV backend, M3U radio stations). The track title comes from the stream's ICY metadata — EMMS exposes it via =emms-track-description= / =emms-playing-time= and updates it on the metadata-change hook; MPV reports the ICY title too. Add an option to show the song in the minibuffer (e.g. echo on track change, or an on-demand command). Consider also a mode-line indicator as a second surface.
 
-** TODO [#B] theme-studio UI face inheritance needs a spec :feature:studio:
+*** VERIFY [#C] music-config option-combination audit + tests     :test:next:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
+:LAST_REVIEWED: 2026-06-06
 :END:
-Package faces model =inherit= explicitly, but UI faces currently expose only fg/bg/style fields in the table and generated theme output. Before implementing UI-face inheritance, write and review a small spec that defines: which UI faces get an inherit selector, how own defaults from =emacs-default-faces.json= appear versus effective inherited values, how export/import stores cleared vs inherited vs explicit values, how preview resolution follows UI inherit chains, and what browser gates prove the behavior. This touches the UI model, generated defaults, export format, preview rendering, and reset semantics, so it should not be slipped in as a refactor.
+Deferred from the batch — this is a sizable test-writing audit (pairwise option combinations + new ERT coverage for music-config), better as its own focused /add-tests or /pairwise-tests session than crammed into a bug-fix sweep. No blocker; say the word and I'll run /pairwise-tests over the option space.
 
-** VERIFY [#B] transcription: stderr never reaches the log, video transcripts stranded in /tmp :bug:solo:next:
-Deferred from the batch (no blocker; needs a focused pass with live verification). Plan: (1) transcription-config.el:210 — make-process :stderr with a file path creates a buffer, not a file; route stderr into the process buffer and write the captured text out in the sentinel, then drop the leaked buffer. (2) :370-374 — derive the txt/log base from the VIDEO path, not the temp mp3's /tmp path, so transcripts land alongside the source. The path-derivation half is cleanly unit-testable; the stderr half needs a real transcription run to verify, which is why I held it for a focused session rather than the batch.
-From the 2026-06 config audit, =modules/transcription-config.el=:
-- =:210= — =make-process :stderr= with a file PATH creates a BUFFER named like the path (verified by probe); the "Errored. Logs in <file>" notification points at a log without the error text, and the hidden stderr buffer leaks per transcription. Route stderr into the process buffer or write it out in the sentinel.
-- =:370-374= — video path derives txt/log from the temp mp3's /tmp path; the transcript lands in /tmp and dies on reboot, contradicting the "alongside the source" docstring. Pass the video's path as the output base.
+Two-part task surfaced 2026-05-28 during the Signel verify walk — generalized from the "are there combinations of options that we'd want to disallow together" question.
 
-** DONE [#B] TTY-accessible personal C-; keymap :feature:solo:quick:
-CLOSED: [2026-06-16 Tue]
+Part 1 — enumerate the configurable option surface of =modules/music-config.el=: every =defcustom=, every behavior toggle, every backend-selection variable, every cross-cutting flag (auto-play, repeat, shuffle, follow-cursor, side-window-height-fraction, etc.). Audit each option for valid value ranges. Capture the matrix in =docs/design/music-config-options.org= (or inline in the test file's header — judgment call when the matrix lands).
+
+Part 2 — combinatorial test coverage. Use the =/pairwise-tests= skill: identify parameters, value partitions, and inter-parameter constraints, build a PICT model, generate the minimal test matrix that hits every 2-way combination. For each problematic combination the matrix surfaces, decide: (a) validate at config-load time with a =user-error= that names the conflict, (b) runtime guard in the affected command, or (c) doc-only warning in the option's docstring. Disallow only the genuinely-broken pairs; doc-warn the merely-confusing ones.
+
+The recent F10 side-window-height-fraction work and the EMMS-free refactor candidate ("Implement EMMS-free music-config architecture" above) are both natural near-term touchpoints — best to land this audit before the EMMS swap so the new architecture inherits a clean option spec.
+
+*** TODO [#C] Implement EMMS-free music-config architecture :refactor:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-05
+:LAST_REVIEWED: 2026-06-01
 :END:
-Done 2026-06-16: keybindings.el binds cj/custom-keymap under C-c ; alongside C-;, so the whole command family is reachable in a terminal frame with the same leaf keys (the single-point fix the body describes; no env-terminal-p branch). Audited every leaf key registered into the family — all are TTY-safe (letters, digits, punctuation, SPC, and arrow keys under C-; b, which terminals do encode); no C-RET, super, or hyper bindings, so nothing needed remapping. TDD: tests/test-keybindings-tty-mirror.el (3 tests, both prefixes share one map); full suite green; live-reloaded and confirmed C-c ; resolves to the family in the daemon. Commit pending. TTY-frame sign-off is a VERIFY under Manual testing and validation.
-The personal prefix =C-;= (Control-semicolon) is GUI-only — terminals can't encode it, so the entire custom command family (=C-; g= calendar, =C-; a= AI, =C-; S= Slack, =C-; O= org, =C-; M= Signal, =C-; L= pearl, =C-; j= jump, …) is unreachable in a terminal frame (=emacsclient -nw=, Emacs inside vterm/tmux). Surfaced 2026-06-03 out of the pearl =C-; L= prefix discussion.
+**** 2026-05-15 Fri @ 19:17:01 -0500 Specification
+Implement the design in [[id:423bc355-18d3-4e39-9e7a-f768b865d95b][Design: music-config Without EMMS]].
 
-Goal: keep =C-;= in GUI and add a TTY-typable mirror prefix so the same leaf keys work in a terminal. The fix is a single point: =modules/keybindings.el= defines =cj/custom-keymap= once, binds it globally with =(keymap-global-set "C-;" cj/custom-keymap)=, and every module registers into it via =cj/bind-prefix= / =cj/bind-command=. Binding that one keymap under a second prefix mirrors the whole family for free — no per-module edits.
+The implementation should make =music-config.el= load without EMMS, introduce
+package-owned playlist and track state, add a =cj/music-playlist-mode= view,
+and route playback through a small backend protocol with an initial =mpv=
+backend.  Preserve the current F10 and =C-; m= user workflows where practical,
+and keep M3U load/save/edit/reload plus radio station creation working.
 
-Easy prefix candidates (home-row-leaning, TTY-safe), same leaf keys under each:
-- =C-c ;= (recommended) — keeps the semicolon mnemonic; =C-c= is the standard user prefix and always TTY-encodable, =;= is home row. =C-; L= becomes =C-c ; L=, zero leaf-key relearning. Bind it unconditionally alongside =C-;= so both GUI and TTY reach the identical map — no =env-terminal-p= branch needed.
-- =C-c SPC= — easy reach, but collides with =org-table-blank-field= (=C-c SPC=) inside org buffers.
-- Bare =C-c <leaf>= (the literal "C-c L" idea) — rejected: =C-c= is shared with org (=C-c l= = =org-store-link=, confirmed live), the LSP prefix (=lsp-keymap-prefix "C-c l"=), and pdf-view; binding the whole family under bare =C-c= would shadow/conflict with those.
+Complexity estimate: high.  This is a module rewrite with a new internal data
+model, package-owned playlist mode, backend protocol, mpv process management,
+and migration of existing EMMS-backed commands/tests.
 
-While in here, audit individual leaf chords for other non-TTY keys (any =C-RET=, super/hyper bindings — terminals can't send super/hyper either) and note or remap them. Verify the result in an actual =emacs -nw= / =emacsclient -nw= frame, not just GUI. Relates to the standing "org-mode keybinding consolidation" reminder.
+Time estimate: 2-4 focused days for an EMMS-free v1 with play/stop/next/previous,
+M3U persistence, playlist UI, and focused tests.  Add another 1-2 days if v1
+must include full mpv IPC support for pause, seek, and volume parity.
+
+Acceptance checks:
+- =music-config.el= can be required in batch with no EMMS package installed.
+- Existing focused music tests pass without EMMS preload or EMMS stubs except
+  where a compatibility adapter is explicitly under test.
+- New tests cover playlist state, backend command dispatch, M3U persistence,
+  and the EMMS-free load smoke path.
+
+**** TODO [#B] Pure helpers + state structs extraction :refactor:
+Lift EMMS-free pure code into standalone form: file validation, recursive
+collection, M3U parse/write, safe filenames, radio-station content, and
+URL/file track typing.  Introduce =cj/music-track= and =cj/music-playlist=
+cl-structs plus state-mutation helpers (=cj/music-playlist-*= predicates and
+setters).  Files: =modules/music-config.el=, possibly a new
+=modules/music-state.el= split.  Existing pure-helper tests should pass
+unchanged.
+
+Acceptance: structs defined, helpers callable in batch without EMMS loaded.
+
+Depends on: none (start here).
+
+**** TODO [#B] Backend protocol + fake test backend :refactor:test:
+Define the backend plist contract (=:available-p :play :pause :resume :stop
+:seek :volume :status :metadata=) and =cj/music-current-backend=.  Add
+=cj/music-state-change-functions= abnormal hook with the v1 event set
+(=started=, =paused=, =resumed=, =stopped=, =finished=, =error=,
+=playlist-changed=, =mode-changed=).  Create =tests/testutil-music-backend.el=
+exposing =cj/test-music-fake-backend= with an event ledger.
+
+Acceptance: fake backend installable in tests; ordered-event assertions work
+against a no-op playback flow.
+
+Depends on: pure helpers + state structs.
+
+**** TODO [#B] Read-side state API + characterization tests :test:refactor:
+Implement =cj/music-playing-p=, =cj/music-paused-p=, =cj/music-current-track=,
+=cj/music-playlist-state=, =cj/music-track-description=.  Before rewriting
+command bodies, add characterization tests against current behavior for
+=cj/music-next=, =cj/music-previous=, =cj/music-toggle-consume=,
+=cj/music-playlist-toggle=, =cj/music-playlist-load=, =cj/music-playlist-clear=
+so the migration has a safety net.
+
+Acceptance: read-side helpers covered; characterization tests green against
+the current EMMS-backed implementation.
+
+Depends on: backend protocol + fake test backend.
+
+**** TODO [#B] Playlist major mode + render-from-state :feature:
+Add =cj/music-playlist-mode= rendering the buffer as a view over
+=cj/music-current-playlist=.  Selected-track overlay + face, header reads
+package state, full keymap from design Section "Playlist Buffer" (RET/p, SPC,
+s, >/<, f/b, +/=/-, a, A, c/C, L/S/E/g, r/t/z/x, Z, i, o, q, S-up/down).
+Preserve the active-window background highlight.
+
+Acceptance: opening the playlist renders package state; reorder/shuffle/clear
+go through state mutations and re-render; tests cover header + overlay
+positioning.
+
+Depends on: read-side state API.
+
+**** TODO [#B] mpv backend implementation :feature:
+Implement =cj/music-mpv-*= backend functions.  Phase the work per migration
+plan §5: (a) process spawn, UID/PID-stamped socket under
+=temporary-file-directory=, stale-socket sweep, IPC connect via
+=make-network-process :family 'local=, state-hook plumbing.  (b) play/stop/
+next/previous + finished-track auto-advance with deliberate-stop tracking.
+(c) pause/resume, seek, volume over JSON IPC.  (d) metadata read on track
+start.  Add =cj/music-doctor= reporting platform capabilities; ship Windows
+degraded mode (play/stop/next/previous only via stdin/=call-process=).
+
+Acceptance: integration tests tagged =:slow= and skipped when =mpv= not on
+PATH; on Linux/macOS pause/seek/volume parity works; clean socket lifecycle
+across Emacs restart and exit.
 
-** TODO [#C] Calibre Open Work
+Depends on: backend protocol + fake test backend.
+
+**** TODO [#B] Command + Dired/Dirvish rewire :refactor:
+Migrate user-facing commands (=cj/music-play=, =cj/music-pause=,
+=cj/music-stop=, =cj/music-next=, =cj/music-previous=, seek/volume,
+random/repeat/consume/shuffle toggles) to operate on package state and call
+=cj/music-current-backend=.  Update Dired/Dirvish =+= add routing,
+M3U load/save/edit/reload, radio-station creation, F10 toggle, and =C-; m=
+keymap entries to drop EMMS symbols.  Migrate command-flow tests to the fake
+backend.
+
+Acceptance: full keymap functional end-to-end against the fake backend;
+characterization tests still green; Dirvish =+= add path covered.
+
+Depends on: playlist major mode + mpv backend.
+
+**** TODO [#B] EMMS removal + parity walk :test:
+Remove =cj/emms--setup=, the on-demand EMMS loader, and the =use-package emms=
+block.  Add the EMMS-free batch-load smoke test (=music-config.el= requires
+clean without EMMS installed).  Run the 22-step parity walk from design
+§"Parity Walk" against the new implementation; record measurements against
+the performance budget (1000-track load <500ms, reorder <50ms, IPC dispatch
+<100ms, header refresh <16ms) and note any deviations.
+
+Acceptance: =init.el= loads cleanly without EMMS; =make test= passes; parity
+walk recorded as a completion log entry under the parent task.
+
+Depends on: command + Dired/Dirvish rewire.
+
+** PROJECT [#C] Calibre Open Work
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-06
 :END:
@@ -2578,15 +2959,7 @@ Implemented 2026-06-06 in =modules/calibredb-epub-config.el=:
 *** TODO Embed Calibre DB metadata into the EPUB files
 Surfaced 2026-06-06 while building the bookmark naming: the metadata embedded in the EPUB files' OPF is worse than Calibre's database metadata. nov reads the embedded OPF and got truncated titles ("Frege" vs the filename's "Frege: A Guide for the Perplexed"), author-sort "Last, First" forms ("Christie, Agatha"), and lost punctuation ("A.B.C." -> "A B C"). The filenames (from Calibre's curated DB) are the good copy. Fix on the Calibre side: select all (or by library), run "Edit metadata -> Embed metadata into book files" so the DB metadata is written into each EPUB's OPF. Consider auditing author vs author_sort first. After embedding, the in-file metadata matches the library and any tool reading the files (nov, other readers, re-imports) gets the good data. Not an Emacs task; Calibre-side bulk maintenance.
 
-** DOING [#C] Lock screen silently fails — slock is X11-only :bug:quick:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-13
-:END:
-=modules/system-commands.el:105= binds the lockscreen command to =slock=, which can't grab a Wayland session; =cj/system-cmd= launches it detached with output silenced, so C-; ! l does nothing and the screen never locks. Security issue: Craig believes the screen locks when it doesn't. Fix: =hyprlock= (or =swaylock=), ideally resolved per session type via =env-wayland-p= so an X11 fallback survives for other machines. From the 2026-06 config audit.
-Fixed 2026-06-13: lockscreen-cmd resolves to =loginctl lock-session= on Wayland (logind Lock → hypridle → hyprlock, the path idle/sleep locking already uses), =slock= on X11; also added the missing =(require 'host-environment)=. Live in the daemon; manual lock test under the Manual testing parent.
-** TODO [#C] emacs: tag tasks by module name for sorting :refactor:studio:
-Replace topic tagging with single-word module tags: :studio: for everything under scripts/theme-studio/, module-named tags elsewhere, :multi: for cross-area work. Drop bug/enhancement-style tags since work should be chosen on other bases. This changes the current six-tag convention, so update the priority-scheme section to document it, rewrite the task-audit workflow to reconcile tasks against the module scheme, then run the audit. Queue for end of session. From the roam inbox.
-** TODO [#C] 2026-06 full config audit — findings backlog :refactor:
+** PROJECT [#C] 2026-06 full config audit — findings backlog :refactor:
 Module-by-module review of all 121 modules + init/early-init, holistic passes (startup/perf, stability, UX consistency, package strategy), and spin-offs into pearl, chime, emacs-wttrin. Method: parallel read-only review agents per module group; key claims spot-verified (incl. against the live daemon) before filing. Run 2026-06-11/12, COMPLETE. Tally: ~165 module findings + ~40 holistic + 30 spin-off ≈ 235 total; 40 high-impact bugs filed as standalone tasks above this parent; the rest live in the group children below. Spin-off findings delivered as inbox handoffs to pearl, chime, and emacs-wttrin (2026-06-12-0057). Start with the synthesis child below for the recommended attack order.
 
 *** Synthesis: the overall picture and attack order
@@ -2812,33 +3185,794 @@ Full findings delivered as handoffs to each repo's inbox/ (2026-06-12-0057-from-
 - chime (10 findings; suite green; the 2026-06-11 watchdog handoff VERIFIED landed in full): lookahead vars never injected into the async child (documented feature silently capped at 8 days — one-line fix); days-until-event nil crash on mixed timed/all-day events; stale-callback race after watchdog interrupt (generation counter needed); default test run prints green integration banner over "Ran 0 tests".
 - emacs-wttrin (10 findings; ~56 ERT files, CI; the face-flood reminder VERIFIED resolved — test 8f3c770 + fix c5e5e1d, reminder cleared from notes.org): no network timeouts (wttr.in stalls hang the loading buffer); error-path response-buffer leak; non-favorite cache never expires; 17 unreleased commits incl. two features — tag v0.4.0.
 
-** TODO [#C] ai-conversations: dead-buffer load, role flattening, non-atomic writes :bug:solo:
-From the 2026-06 config audit, =modules/ai-conversations.el=:
-- =:324= — load in a fresh session does =get-buffer-create "*AI-Assistant*"= (plain fundamental-mode buffer); =--ensure-ai-buffer= then sees it exists and never calls =(gptel)=. Sending doesn't work, autosave self-cancels (requires gptel-mode). Use =get-buffer= for the check; let ensure create. The browser RET/l path inherits this.
-- =:240= — persistence drops gptel's =response= text properties, so a reloaded history replays to the model as ONE user message (model re-reads its own answers as Craig's words). Adopt gptel's native bounds persistence or re-mark on load from the "* Backend:" headings.
-- =:248= — =write-region= straight at the target; crash mid-write truncates the only copy of the history (autosave hits this constantly). Temp + rename.
-- =:140= — three overlapping autosave mechanisms (after-send advice that fires before the response exists, post-response hook, 60s timer). Keep the hook; drop the advice (and likely the timer).
+** PROJECT [#C] Build cj/dev-setup-project helper (per docs/specs/dev-setup-project-spec.org) :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-01
+:END:
+*** 2026-05-15 Fri @ 19:17:37 -0500 Specification
 
-** DONE [#C] cj/gptel-switch-backend reintroduces the string-model crash :bug:quick:solo:
-CLOSED: [2026-06-16 Tue]
-=modules/ai-config.el:272= — =(setq gptel-model model)= with the raw completing-read STRING — the documented wrong-type-argument-symbolp modeline hang (CLAUDE.md gotcha), reachable from C-; a B today. =cj/gptel-change-model= (C-; a m) already does backend+model switching and interns correctly. Intern here, or delete switch-backend and keep one command. From the 2026-06 config audit.
+Interactive command that opens a review buffer with proposed per-subdirectory .dir-locals.el contents (projectile compile/run/test + cj/coverage-backend), optional starter Makefile when none exists, and gitignore updates. User edits inline, C-c C-c writes all files.
 
-Fixed 2026-06-16: added pure helper =cj/gptel--model-to-symbol= (mirrors =cj/gptel--model-to-string=) and coerced the completing-read value through it before =(setq gptel-model ...)= in =cj/gptel-switch-backend=. 7 ERT tests for the helper (=tests/test-ai-config-model-to-symbol.el=); the existing switch-backend test (=tests/test-ai-config-gptel-commands.el=) updated from asserting the raw string to asserting a symbol + a =symbolp= crash-guard. Full suite green; helper and the redefined command are live in the daemon. Chose "intern" over deleting the redundant command — the dedup is the VERIFY below.
+Design: [[id:596fce5d-1bab-46e7-8567-d4a2e0923091][docs/specs/dev-setup-project-spec.org]]
 
-** VERIFY [#C] Dedup gptel model-switch commands — keep switch-backend or fold into change-model :bug:
-=cj/gptel-change-model= (C-; a m) already does backend+model switching and interns correctly, so =cj/gptel-switch-backend= (C-; a B) is arguably redundant now that its crash is fixed. Decision for Craig: keep both, or delete =cj/gptel-switch-backend= plus its C-; a B binding and keep one model-switch command. From the 2026-06 config-audit follow-up.
+Scope of v1:
+- modules/dev-setup-config.el (command + review-buffer major mode)
+- Three-tier detection: existing Makefile, existing package.json/pyproject.toml scripts, fall-back starter Makefile generation.
+- Project shapes supported: pure Elisp, pure Go, pure Python, pure Node/TS, Docker Compose polyglot.
+- Re-run semantics: status banners (UNCHANGED / WILL UPDATE / WILL CREATE), idempotent gitignore append, never modifies an existing Makefile.
+- ERT tests for the pure helpers (Makefile parser, package.json parser, shape detection, target-to-role mapping, review-buffer parser).
 
-** 2026-06-16 Tue @ 05:10:55 -0500 Alphabetized the assignment-view package dropdown
-The package-faces optgroup (below the @code/@ui editor entries) now lists apps alphabetically by display label. Root cause: =buildViewSel= iterated =for(const app in APPS)=, and =generate.py= builds APPS as bespoke apps first then inventory apps, so the combined list wasn't alphabetical. Fix is localized to the view-list build per the plan: added a pure =appViewKeysSorted(apps)= helper in =app-core.js= (sorts keys by label, case-insensitive, key fallback when a label is missing) and =buildViewSel= iterates it. TDD: 4 node tests in =test-app-core.mjs= (red->green); updated the #viewtest browser gate from asserting insertion order to asserting =appViewKeysSorted(APPS)=; full theme-studio suite green (Python + Node + all browser gates). Commit =afd2ddad=, pushed. Visual sign-off optional (gate already confirms the DOM order).
-** TODO [#C] theme-studio: calibre package doesn't color properly :bug:studio:
-The calibre package preview has no elements to theme in the search list, and coloring switches to the string color on mismatched quotes. Investigate, then record a diagnosis and solution in this task before fixing. From the roam inbox 2026-06-15.
-** VERIFY [#C] music: extract faces for music config :refactor:quick:solo:next:
-Needs from Craig: this is theme-side work, not a config edit — the music-config faces were already stripped (2026-06-14), so "extracting" them means DEFINING them in the theme (theme-studio JSON / build-theme) for playlist name, status, the per-button on/off pair, per-key symbol+text, and other labels. That needs the actual color choices and which theme(s) to add them to. Give me the palette intent (or say "pick sensible defaults in WIP") and I'll add the face definitions.
-Pull the music-config faces out to the theme (the config no longer defines faces directly): playlist name, status (paused, etc.), two mode colors per "button" (on vs off), a per-key symbol+text color, and a color for all other labels. Pairs with the 2026-06-14 face-stripping work (music-config faces were removed there and are currently undefined until the theme defines them). From the roam inbox 2026-06-15.
-** TODO [#C] music: show song information in the modeline :feature:
-Show basic song information in the modeline, with streaming-source support too. Write a spec for this one first. From the roam inbox 2026-06-15.
-** 2026-06-16 Tue @ 06:11:30 -0500 Contrast cell: dropped PASS/FAIL, verdict moved to the hover
-Craig's call (option a + hover): the contrast cell now shows just the rating-colored number (green = passes AAA, grey = passes AA, red = fails AA), and the WCAG meaning lives in a hover. Added a pure =contrastTitle(r)= to =app-util.js= (4 node tests), changed =crHtml= (app.js) to drop the verdict word and set =title=, kept =verdictFor= for the covered-overlay worst-case readout (untouched, #contrasttest still green). New #crtest browser gate; full theme-studio suite green. Commit =9e99749d=, pushed.
+Deferred:
+- Rust (Cargo.toml), Java (pom.xml), other language shapes.
+- Project-wide override config file.
+- Auto-detecting external run scripts in conventional locations.
+
+Do this after the F-key rework ticket ships; don't want to churn project configs before the keys are stable.
+
+*** TODO [#B] Pure detection + parsing helpers :feature:
+Implement the four pure helpers the rest of the command composes on:
+- =cj/--dev-setup-parse-makefile-targets FILE= (.PHONY + bare target lines, skip pattern rules)
+- =cj/--dev-setup-parse-package-json-scripts FILE= (scripts block, JSON)
+- =cj/--dev-setup-detect-project-shape ROOT= (Elisp / Go / Python / Node-TS / Docker-Compose polyglot / unknown)
+- =cj/--dev-setup-map-targets-to-roles TARGETS= (best-guess compile/run/test mapping per design § Detection)
+
+Files: =modules/dev-setup-config.el= (new).  No interactive surface, no I/O
+beyond reading the named file.
+
+Acceptance: each helper callable in isolation with handcrafted fixtures;
+no command yet.
+
+Depends on: none -- start here.
+
+*** TODO [#B] ERT coverage for the pure helpers :feature:test:
+Normal/Boundary/Error tests for every helper from the prior sub-task,
+matching the design's testing section.
+
+Files: =tests/test-dev-setup-config.el=, plus
+=tests/testutil-dev-setup-config.el= for the temp-project fixture builder
+(writes Makefile / package.json / compose stub into =make-temp-file ... 'dir=).
+
+Acceptance: =make test-file FILE=tests/test-dev-setup-config.el= green;
+every helper has at least one Normal, one Boundary, one Error case.
+
+Depends on: pure detection + parsing helpers.
+
+*** TODO [#B] Starter-Makefile + .dir-locals.el proposal generator :feature:
+Pure function =cj/--dev-setup-build-proposal SHAPE ROOT= returning a
+structured plist of proposed blocks: one per subproject =.dir-locals.el=
+(projectile compile/run/test + =cj/coverage-backend=), the optional starter
+Makefile (only when none exists, adapted per shape per design § Tier 3),
+and the gitignore append lines.
+
+Files: =modules/dev-setup-config.el=.
+
+Acceptance: given a shape plist, returns deterministic block list ready for
+the review buffer; ERT cases cover each shape (Elisp / Go / Python / Node-TS
+/ polyglot) plus the Tier-1 "Makefile already exists, suppress Makefile
+block" branch.
+
+Depends on: pure detection + parsing helpers.
+
+*** TODO [#B] Review-buffer major mode + parser :feature:
+Define =cj/dev-setup-review-mode= (derived from =emacs-lisp-mode=) with =C-c
+C-c= / =C-c C-k= bindings, plus the pure parser
+=cj/--dev-setup-review-buffer-parse CONTENTS= that turns buffer text back
+into a block list.  Banner syntax per design § Review Buffer (=;; ==== <path>
+====[ <status>]==, gitignore special, Makefile special).
+
+Files: =modules/dev-setup-config.el=, =tests/test-dev-setup-config.el=
+(parser cases: well-formed multi-block, single block, empty body, missing
+banner, malformed elisp inside a dir-locals block).
+
+Acceptance: round-trip -- render proposal -> parse buffer -> equal block
+list.  Mode keybindings smoke-tested.
+
+Depends on: starter-Makefile + .dir-locals.el proposal generator.
+
+*** TODO [#B] Writer + status diff + projectile cache reset :feature:
+Implement the =C-c C-c= writer: diff each parsed block against the on-disk
+file to assign =UNCHANGED= / =WILL UPDATE= / =WILL CREATE=, write only the
+non-UNCHANGED ones, append gitignore idempotently, never touch an existing
+Makefile, honor the =;;; cj/dev-setup-project: ignore= escape hatch, clear
+projectile's per-project command cache, print the summary line.
+
+Files: =modules/dev-setup-config.el=, plus ERT cases for the diff +
+idempotent-append logic against temp dirs.
+
+Acceptance: re-run on an unchanged project writes nothing; renaming a
+Makefile target flips one block to =WILL UPDATE=; ignore-marked files stay
+untouched.
+
+Depends on: review-buffer major mode + parser.
+
+*** TODO [#B] Interactive command + smoke test :feature:test:
+Thin =cj/dev-setup-project= interactive wrapper: resolve project root via
+projectile, run detection, build proposal, render the review buffer, pop to
+it.  One smoke test against a prepared temp project asserting the expected
+files exist after a simulated =C-c C-c=.
+
+Files: =modules/dev-setup-config.el=, =tests/test-dev-setup-config.el=.  Add
+=(require 'dev-setup-config)= to =init.el= (or the appropriate aggregator).
+
+Acceptance: =M-x cj/dev-setup-project= on a fixture project opens the review
+buffer; =C-c C-c= writes the expected files.
+
+Depends on: writer + status diff + projectile cache reset.
+
+*** TODO [#B] Resolve open questions + design follow-ups
+Three design questions to close before / during implementation: (a) include
+=make coverage= target in starter Makefile? (b) project-wide override file
+=.cj-dev-setup.el=? (c) Cargo/pom detection.
+
+Body: park decisions inline in the design doc or run =arch-decide= if they
+turn out load-bearing.
+
+Depends on: none, but easiest after the writer sub-task surfaces real
+friction.
+
+** PROJECT [#C] Localrepo Documentation :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-05
+:END:
+
+Audit on 2026-05-27 found the localrepo build half is shipped (=.localrepo/= holds 185 entries; =early-init.el= L135–165 wires the priority-200 pin above the local ELPA-mirror tier at 120–125 and the online fallback). The remaining "document limitations" half splits into one docs-set plus four gap-fix follow-ups that the docs cross-reference.
+
+Docs land in three artifacts. =docs/design/localrepo.org= carries the full architecture (tier model, install path, refresh story, all four limitations with pointers to the follow-up tasks). =.localrepo/README.org= sits next to the artifact as the user-facing entry — a short summary that survives even if =early-init.el= moves. =early-init.el= grows a commentary header that points at the README, not at the design doc — the README is what future-Craig hits first.
+
+The four limitations the docs cover (each spun out below as its own task):
+- Treesitter grammars (downloaded by =treesit-auto= on first use; not in the localrepo)
+- Native-comp =.eln= cache (Emacs-version-specific; invalidated by version bumps)
+- System-tool deps (=ripgrep=, =fd=, =pandoc=, =prettier=, =pyright=, etc.; flagged at load by =cj/executable-find-or-warn=, not packageable via =package.el=)
+- Refresh / update story (no dedicated script today; ad-hoc =cp= from the elpa mirrors)
+*** TODO [#C] Design doc — docs/design/localrepo.org
+Write the design doc: tier model, priorities, install path, refresh story, all four limitations with cross-links to the follow-up tasks below.
+*** TODO [#C] README — .localrepo/README.org
+Write the README at the artifact: short prose entry point summarizing the tier model, pointing at =docs/design/localrepo.org= for full detail. This is what =early-init.el='s commentary header links to.
+*** TODO [#C] Commentary header in early-init.el
+Add a Commentary-section header in =early-init.el= pointing at =.localrepo/README.org= for usage and =docs/design/localrepo.org= for architecture. Sits at the top of the localrepo block (around L130).
+** PROJECT [#C] Migrate from Company to Corfu (with prescient integration) :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-02
+:END:
+
+Spec: [[id:68733ba2-37a7-4a7b-bfaa-b845d82ff1e7][docs/specs/company-to-corfu-migration-spec.org]]
+
+*** TODO [#C] Install corfu-side packages
+Add corfu, cape, kind-icon, corfu-prescient to the package list. corfu-popupinfo ships inside corfu. Spec step 1.
+
+*** TODO [#C] Rewrite selection-framework.el company block as corfu/cape stack
+Replace the three company-* use-package blocks (lines 192-226) and company-prescient (240-243) with corfu / cape / corfu-popupinfo / kind-icon / corfu-prescient. Rename the section header Company → Corfu in the same change. Spec steps 2 + 8.
+
+*** TODO [#C] Swap mail-compose completion disable to corfu
+Rewrite cj/disable-company-in-mu4e-compose to (corfu-mode -1) across mu4e-compose, org-msg-edit, and message modes (mail-config.el:319-333). Spec step 3.
+
+*** TODO [#C] Drop company-ledger for ledger's built-in capf
+ledger-config.el: remove company-ledger; verify ledger-complete-at-point registers on completion-at-point-functions, add a ledger-mode-hook capf push only if it doesn't. Spec step 4.
+
+*** TODO [#C] Drop company-auctex for AUCTeX capf + cape-tex
+latex-config.el: remove company-auctex and (company-auctex-init); add cape-tex on TeX-mode-hook. Spec step 5.
+
+*** TODO [#C] Rewire eshell completion to pcomplete capf
+eshell-config.el:163-171: drop company-shell and the company-mode activation; add cape-capf-buster around pcomplete-completions-at-point + corfu-mode. Spec step 6.
+
+*** TODO [#C] Remove company-mode calls from prog-go/python/webdev
+Delete (declare-function company-mode ...) and (company-mode) from the three mode hooks; global-corfu-mode covers them. Spec step 7.
+
+*** TODO [#C] Uninstall company packages + recompile
+After the rewrite is green: package-delete company, -quickhelp, -box, -prescient, -ledger, -auctex, -shell; make clean && make compile. Spec step 9.
+
+*** TODO [#C] Tests: corfu activation, mail-disable, capf registration
+New tests/test-selection-framework-corfu.el and tests/test-mail-config-corfu-disable.el; update ledger/latex tests to assert their capf registers. Spec Testing section.
+
+*** 2026-05-16 Sat @ 11:07:24 -0500 Goals
+Drop-in replacement for the in-buffer completion stack: =company= →
+=corfu=, =company-quickhelp= → =corfu-popupinfo=, =company-box= →
+=kind-icon=, =company-prescient= → =corfu-prescient=, plus =cape= for
+the file/keyword/dabbrev capfs that =company-files= / =company-keywords=
+used to handle.  Per-module fixups for ledger, AUCTeX, eshell, mu4e
+compose, and the three =prog-*= modules.  See the design doc for the
+full translation table, migration steps, tests, and risks.
+
+** PROJECT [#C] Terminal GPG pinentry Completion :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-05
+:END:
+
+Audit on 2026-05-27 found no trace of the =terminal-pinentry= branch on this machine: no local or remote ref, no reflog entry across 732 entries reaching back through January, no stash, no dangling commit, no sibling worktree. The 2026-01-24 session log says the branch was created that day, but the work either lived on another machine or was deleted before reaching here. The original task above (=Finish terminal GPG pinentry configuration=) is superseded by this one.
+
+Surviving footprint on this machine: one commented line at =modules/auth-config.el:83= (=;; (setq epa-pinentry-mode 'loopback)=). The hook point =env-terminal-p= exists in =modules/host-environment.el:97=. Everything else (terminal-vs-GUI branching in the epa =:config=, external pinentry wiring for GUI, =GPG_TTY= export, tests) is to be written fresh off main.
+
+Goal: in terminal Emacs, GPG passphrase prompts land in the minibuffer via loopback mode; in GUI Emacs, prompts go to the existing external pinentry.
+
+Open: confirm the GUI pinentry tool (2026-01-24 notes named =pinentry-dmenu=; current =auth-config.el= names no pinentry program, leaving it to =gpg-agent='s config). Also worth checking whether the =terminal-pinentry= branch survives on the laptop and should be pulled here rather than rewritten.
+
+*** TODO [#C] env-terminal-p branch in epa :config :feature:
+Inside the epa =use-package= =:config= in =modules/auth-config.el=, set =epa-pinentry-mode= to ='loopback= when =(env-terminal-p)=, else leave the external pinentry path active. Replace the lone commented line at =auth-config.el:83=.
+
+*** TODO [#C] GPG_TTY export for terminal sessions :feature:
+When =(env-terminal-p)=, =(setenv "GPG_TTY" (shell-command-to-string "tty"))= so gpg-agent can target the controlling tty. Guard against a non-tty stdin.
+
+*** TODO [#C] gpg-agent updatestartuptty refresh in terminal :feature:
+The current =call-process= to "gpg-connect-agent updatestartuptty /bye" runs unconditionally; keep it for GUI, and re-fire it on terminal entry so the agent re-binds to the current tty.
+
+*** TODO [#C] ERT tests for terminal vs GUI pinentry branching :test:
+Test that with =env-terminal-p= stubbed t, =epa-pinentry-mode= resolves to ='loopback= after =auth-config= loads; with it stubbed nil, the loopback setting is not applied. Use =cl-letf= around =env-terminal-p=; cover normal, boundary (=epa= already loaded), error (=gpg-connect-agent= missing).
+
+*** TODO [#C] Minibuffer prompt in real terminal Emacs
+=emacs -nw=, open an encrypted file or trigger an auth-source decrypt, confirm the passphrase prompt lands in the minibuffer rather than failing on missing pinentry.
+
+*** TODO [#C] External pinentry still fires in GUI Emacs
+Restart the daemon, open a GUI frame, trigger an encrypted decrypt, confirm =pinentry-dmenu= (or whatever GUI pinentry is configured) still appears.
+
+*** TODO [#C] Archive the original L3813 task
+After this work lands, mark the original "Finish terminal GPG pinentry configuration" task DONE with a =CLOSED:= stamp and a one-line note pointing at this parent task.
+
+** TODO [#A] Unified popup placement and dismissal rules :feature:
+All transient popups should follow one set of principles. Placement: when the Emacs frame is wider than tall, the popup rises from the right; when square or taller, from the bottom — settle the aspect-ratio threshold and the pop-out percentage. Dismissal: C-c C-c when there's an accept action, C-c C-k when there's a cancel, otherwise =q= closes the window. This generalizes two existing tasks — ai-term adaptive placement (the aspect-ratio docking) and the messenger window/key unification spec (the C-c C-c / C-c C-k dismissal) — into one config-wide policy. From the roam inbox.
+
+** TODO [#A] Unify Signel and All Messengers into one UX :feature:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-16
+:END:
+Spec: [[file:docs/specs/messenger-unification-spec.org][messenger-unification-spec.org]] ([[id:4bfc2011-8ffc-4765-8886-91df12141171][by id]], Draft, 2026-06-11; keybinding-alphabet section + smoke-first parity added 2026-06-16). One library (=cj-messenger-lib.el=) gives every messenger the same shape: chat windows rise from the bottom (the signel rule, generalized), C-c C-c confirms, C-c C-k cancels, C-c C-a attaches — dispatched per backend through a registry + minor mode. Signel already conforms (reference backend); telega and slack join in phases 2-3; ERC later. All eight decisions settled 2026-06-11 (cancel closes an idle window; telega's filter-cancel shadow accepted; slack rooms join the bottom rule). Spec held open — Craig has more ideas to fold in before it's marked Ready.
+
+** TODO [#B] agenda sources: roam Projects missing, no existence filtering :bug:solo:
+From the 2026-06 config audit, =modules/org-agenda-config.el=:
+- =:182-191= — commentary and docstrings promise org-roam nodes tagged "Project" as agenda sources, but =cj/--org-agenda-scan-files= never scans them, and files added by the roam finalize-hook are wiped on the next =cj/build-org-agenda-list= cache rebuild (≤1h). Add a roam Project pass (mirror =org-refile-config.el:101-109=) or correct the docs.
+- =:186,456= — agenda file list built unconditionally (inbox/calendars may not exist on a fresh machine) and =org-agenda-skip-unavailable-files= is unset — the exact interactive-prompt class that once hung the chime daemon. Filter with =file-exists-p= + set the var as backstop.
+
+** TODO [#B] Auto-dim: org headings, links, and tags do not dim in unfocused windows :bug:
+auto-dim-other-buffers-affected-faces (auto-dim-config.el) remaps font-lock and a few org faces to the flat dim face, but not org-level-1..8, org-link, or org-tag, so headings, links (seen in daily-prep.org), and tags like :solo: stay lit when the window loses focus. Decide the dim approach: a flat-dim remap like font-lock (quick) versus dedicated -dim variants surfaced through org-faces / theme-studio (richer, matches the keyword work; Craig flagged org-tags may want the org-faces treatment). Consolidates three roam-inbox captures.
+** TODO [#B] "? = curated help menu" convention across modes :feature:
+From the calibredb keybindings work 2026-06-06. The pattern that worked: in a modal/major-mode buffer (calibredb), bind =?= to a curated transient of the frequent workflows, and move the package's own full dispatch to =H=. It fixes the "I can't discover the keys" problem that which-key can't help with (which-key only pops up after a prefix, not for top-level single keys in a mode-map).
+
+Task: survey the modes/modules Craig works in and identify where a =?= -> curated-help-menu (transient) makes sense. Candidates: any major-mode buffer with single-key bindings and no good discovery affordance -- calibredb (done), nov, dirvish, mu4e, ghostel/term, signel, pearl/linear, ELFeed, etc. For each, note whether =?= is free or already a help dispatch, and whether a curated menu (vs the package's own) adds value. Establish it as a convention (and maybe a small helper/macro to define a curated =?= menu consistently).
+
+** TODO [#B] Dupre diff-changed / diff-refine-changed legibility :bug:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-11
+:END:
+Surfaced 2026-06-07 from a pearl session designing its modified-ticket indicator (pearl marks a changed field by inheriting =diff-changed=). dupre's =diff-refine-changed= is bright gold (#ffd700) under near-white text (#f0fef0) -- WCAG contrast ~1.35, unreadable as a plain background. It only looks fine inside diff-mode because diff-mode overlays its own dark foreground. =diff-changed= (#875f00 amber) is ~5.49, readable but off the modus model. Every modus variant keeps both faces legible (contrast 9-16) by pairing a dark low-saturation background with a hue-matched foreground.
+
+Ask:
+1. Rework dupre's =diff-changed= and =diff-refine-changed= on modus lines: dark low-saturation background, legible foreground (plain default fg for simplicity, or hue-tinted per modus -- decide), and keep refine slightly stronger than changed (refine is the word-level emphasis inside a changed region; modus keeps them distinct).
+2. While there, audit dupre's broader diff/palette faces against modus conventions (background/foreground tinting, contrast targets) and flag where it diverges.
+
+Reference values -- modus-vivendi: refine-changed bg #4a4a00 fg #efef80, changed bg #363300 fg #efef80. modus-operandi: refine-changed bg #fac090 fg #553d00, changed bg #ffdfa9 fg #553d00.
+
+Side-by-side legibility render: [[file:assets/2026-06-07-dupre-diff-face-legibility-compare.png][assets/2026-06-07-dupre-diff-face-legibility-compare.png]].
+** TODO [#B] erc-yank silently publishes >5-line pastes as public gists :bug:
+=modules/erc-config.el:345= — C-y in any ERC buffer auto-creates a public gist for anything over 5 lines: clipboard content goes to a public URL with no confirmation, and no executable-find guard for =gist= (errors mid-send if absent). Privacy trap. Add a =yes-or-no-p= gate or drop the package for plain C-y. From the 2026-06 config audit.
+
+** TODO [#B] F7 diff-aware coverage classifies every changed file "not tracked" :bug:solo:
+=modules/coverage-core.el:252= — =cj/--coverage-intersect= joins covered×changed by exact string key, but simplecov.json keys are ABSOLUTE paths while the git-diff parser returns repo-RELATIVE ones — zero matches ever, so working-tree/staged/branch scopes report ":tracked nil" for everything and F7's main feature is inert (whole-project scope works, same-source keys). Unit tests hand-build matching keys so they pass; add one integration test feeding a real undercover report + real diff. Normalize both sides to repo-relative. From the 2026-06 config audit.
+
+** TODO [#B] Fix up test runner :bug:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-06
+:END:
+*** 2026-05-16 Sat @ 11:15:51 -0500 Ideas
+**** Current State
+=modules/test-runner.el= is a solid first pass for an Emacs-config-specific ERT
+workflow:
+- project-scoped focus lists
+- run all vs focused mode
+- run ERT test at point
+- load all test files
+- clear ERT tests from other project roots
+- keybindings under =C-; t=
+
+The universal test-running direction is currently split across modules:
+- =test-runner.el= owns ERT focus/state/UI.
+- =dev-fkeys.el= owns F6 language detection and command generation for Elisp,
+  Python, Go, and partial TypeScript.
+
+That split is the biggest architectural pressure point.  The test runner should
+eventually own runner discovery, scopes, command construction, result handling,
+and UI.  F6 should become a thin entry point into the runner.
+
+**** Critical Design Issues
+***** Too ERT-specific at the core
+The current state model is named generically, but most operations assume:
+- test files live in =test/= or =tests/=
+- files match =test-*.el=
+- tests are ERT forms
+- individual tests can be selected by ERT selector regex
+- loading tests into the current Emacs process is acceptable
+
+This makes the module hard to extend cleanly to pytest, Jest, Vitest, Go, Rust,
+or shell test runners.  The common abstraction should be "test run request" and
+"test runner adapter", not "ERT file list".
+
+***** In-process ERT causes state contamination
+=cj/test-load-all= and focused runs load test files into the current Emacs
+session.  This is fast and ergonomic, but it can leak:
+- global variables
+- advice
+- loaded features
+- overridden functions
+- ERT test definitions
+- load-path mutations
+
+The runner should support two ERT execution modes:
+- =interactive= / in-process for fast local TDD
+- =isolated= / batch Emacs for reliable verification
+
+The isolated path should be preferred for "before commit", CI parity, and
+agent-driven verification.
+
+***** Test discovery is regex-based and fragile
+=cj/test--extract-test-names= scans files with a regex for =ert-deftest=.
+That misses or mishandles:
+- macro-generated tests
+- commented forms in unusual shapes
+- multiline or reader-conditional forms
+- non-ERT Elisp tests such as Buttercup
+- stale ERT tests already loaded in the session
+
+Better approach:
+- for ERT in isolated mode, let ERT discover tests after loading files
+- for source navigation, use syntax-aware forms where possible
+- store discovered tests as structured records with file, line, name, framework,
+  tags, and runner
+
+***** Path containment has at least one suspicious edge
+=cj/test--do-focus-add-file= checks:
+
+#+begin_src elisp
+(string-prefix-p (file-truename testdir) (file-truename filepath))
+#+end_src
+
+That should use =cj/test--file-in-directory-p= or ensure the directory has a
+trailing slash.  Otherwise sibling paths with a shared prefix are a recurring
+class of bug.
+
+***** Runner commands are shell strings too early
+=cj/--f6-test-runner-cmd-for= returns shell command strings.  That makes it
+harder to:
+- inspect command parts
+- safely quote arguments
+- offer command editing
+- run via =make-process= / =compilation-start= without shell ambiguity
+- attach metadata
+- rerun exact invocations
+- convert commands into UI labels
+
+Prefer a structured command object:
+
+#+begin_src elisp
+(:program "pytest"
+ :args ("tests/test_foo.py" "-q")
+ :default-directory "/project/"
+ :env (("PYTHONPATH" . "..."))
+ :runner pytest
+ :scope file)
+#+end_src
+
+Render to a shell string only at the final compilation boundary.
+
+***** F6 and =C-; t= workflows duplicate the same domain
+F6 already handles "all tests" and "current file's tests" for multiple
+languages.  =C-; t= handles ERT-only focus and run state.  These should converge
+on one runner service:
+- F6: quick entry point
+- =C-; t=: full runner menu
+- both call the same scope/adapter engine
+
+***** Test directory discovery is too narrow
+Current discovery prefers =test/= then =tests/=, with a global fallback.  Real
+projects often need:
+- Python: =tests/=, package-local =test_*.py=, =pytest.ini=, =pyproject.toml=
+- JS/TS: =package.json= scripts, =vitest.config.*=, =jest.config.*=,
+  =*.test.ts=, =*.spec.ts=
+- Go: package directories, =go.mod=
+- Rust: =Cargo.toml=, integration tests under =tests/=
+- Elisp packages: =Makefile=, =Eask=, =ert-runner=, Buttercup, =tests/=
+
+Discovery should be adapter-specific and project-config-aware.
+
+***** No structured result model
+=cj/test-last-results= exists but is not meaningfully populated.  A powerful
+runner needs a normalized result model:
+- run id
+- started/finished timestamps
+- status: passed/failed/errored/cancelled/skipped/xfail/xpass
+- command
+- runner adapter
+- scope
+- exit code
+- duration
+- failed test records
+- file/line locations
+- raw output buffer
+- coverage artifact paths
+
+This enables last-failed, failures-first, summaries, dashboards, and AI-assisted
+failure explanation.
+
+***** No failure parser / navigation layer
+Compilation buffers are useful, but the runner should parse common failure
+formats and provide:
+- next/previous failure
+- jump to source line
+- failure summary buffer
+- copy failure context
+- rerun failed test at point
+- annotate failing tests in source buffers
+
+Adapters can provide regexes/parsers for ERT, pytest, Jest/Vitest, Go, Rust,
+and shell.
+
+***** Missing watch/rerun modes
+Modern test runners optimize the feedback loop:
+- pytest supports selecting tests, markers, last-failed, failures-first,
+  stepwise, fixtures, xfail/skip, plugins, and cache state.
+- Jest/Vitest support watch workflows, changed-file selection, coverage,
+  snapshots, and rich interactive filtering.  Vitest also defaults to watch in
+  development and run mode in CI.
+- Go and Rust runners commonly support package-level runs, regex selection,
+  race/coverage flags, and cached test behavior.
+
+The Emacs runner should expose the subset that maps well to editor workflows:
+- current test
+- current file
+- related test file
+- focused set
+- last failed
+- failed first
+- changed since git base
+- watch current scope
+- full project
+- coverage for current scope
+
+**** Proposed Architecture
+***** Core Types
+Use plain plists initially; promote to =cl-defstruct= only if helpful.
+
+#+begin_src elisp
+;; Test runner adapter
+(:id pytest
+ :name "pytest"
+ :languages (python)
+ :detect cj/test-pytest-detect
+ :discover cj/test-pytest-discover
+ :build-command cj/test-pytest-build-command
+ :parse-results cj/test-pytest-parse-results
+ :capabilities (:current-test :file :project :last-failed :coverage :watch))
+
+;; Test run request
+(:project-root "/repo/"
+ :language python
+ :framework pytest
+ :scope file
+ :file "/repo/tests/test_api.py"
+ :test-name "test_create_user"
+ :extra-args ("-q")
+ :profile default)
+
+;; Test run result
+(:run-id "..."
+ :status failed
+ :exit-code 1
+ :duration 2.14
+ :failures (...)
+ :output-buffer "*test pytest*"
+ :artifacts (...))
+#+end_src
+
+***** Adapter Registry
+Create a registry like:
+
+#+begin_src elisp
+(defvar cj/test-runner-adapters nil)
+(cj/test-register-adapter 'pytest ...)
+(cj/test-register-adapter 'ert ...)
+(cj/test-register-adapter 'vitest ...)
+#+end_src
+
+Runner selection should consider:
+- buffer file extension
+- project files
+- explicit user override
+- available executables
+- package manager scripts
+- existing Makefile targets
+
+***** Scope Model
+Make scopes explicit and shared across languages:
+- =test-at-point=
+- =current-file=
+- =related-file=
+- =focused-files=
+- =last-failed=
+- =changed=
+- =package/module=
+- =project=
+- =coverage=
+- =watch=
+
+Each adapter can say which scopes it supports.  Unsupported scopes should produce
+clear user-errors with suggestions.
+
+***** Command Builder Pipeline
+1. Detect project.
+2. Detect language/framework candidates.
+3. Resolve user-requested scope.
+4. Build structured command object.
+5. Optionally let user edit command.
+6. Run via =compilation-start= or =make-process=.
+7. Parse output/result artifacts.
+8. Store normalized result.
+9. Update UI/modeline/messages/failure buffer.
+
+***** Keep Makefile Support But Do Not Require It
+For this Emacs config, =make test-file= and =make test-name= are useful and
+should remain the default Elisp isolated path.  But adapter detection should
+support:
+- direct =emacs --batch= ERT invocation
+- =make test=
+- =make test-file=
+- =make test-name=
+- Eask
+- Buttercup
+
+**** Elisp-Specific Improvements
+***** Add isolated ERT runs
+Support batch commands for:
+- all project tests
+- one test file
+- one test name
+- focused files
+- last failed, once result parsing exists
+
+Use the same Makefile targets in this repo, but design the adapter so other
+Elisp projects can run without this Makefile.
+
+***** Support Buttercup/Eask Later
+Buttercup uses BDD-style =describe= / =it= suites and is common in Elisp
+package testing.  Eask is often used to run package tests.  Add adapter slots
+for these instead of hard-coding ERT forever.
+
+***** Avoid unnecessary global ERT deletion
+=cj/ert-clear-tests= is a pragmatic fix for project contamination, but the
+stronger long-term answer is isolated runs plus project-scoped discovery.  Keep
+the cleanup command, but do not make correctness depend on deleting global ERT
+state.
+
+**** Python / pytest Ideas
+- Detect pytest by =pyproject.toml=, =pytest.ini=, =tox.ini=, =setup.cfg=, or
+  presence of =tests/=.
+- Build commands for:
+  - project: =pytest=
+  - file: =pytest path/to/test_file.py=
+  - test at point: =pytest path/to/test_file.py::test_name=
+  - class method: =pytest path::TestClass::test_method=
+  - marker: =pytest -m marker=
+  - last failed: =pytest --lf=
+  - failed first: =pytest --ff=
+  - stop after first: =pytest -x=
+  - coverage: =pytest --cov=...=
+- Parse output for failing node ids and =file:line= references.
+- Read pytest cache for last-failed where useful.
+- Offer marker completion by parsing =pytest --markers= or config files.
+- Surface xfail/skip separately from hard failures.
+
+**** TypeScript / JavaScript Ideas
+***** Detection
+Detect runner by project files and scripts:
+- =vitest.config.ts/js/mts/mjs=
+- =jest.config.ts/js/mjs/cjs=
+- =package.json= scripts: =test=, =test:watch=, =vitest=, =jest=
+- lockfile/package manager: =pnpm-lock.yaml=, =yarn.lock=, =package-lock.json=,
+  =bun.lockb=
+
+Prefer project scripts over raw =npx= when present:
+- =pnpm test -- path=
+- =npm test -- path=
+- =yarn test path=
+- =bun test path=
+
+***** Scopes
+- current file: =vitest run path= or =jest path=
+- test at point: use nearest =it= / =test= / =describe= string and pass =-t=
+- watch current file
+- changed tests where runner supports it
+- coverage current file/project
+- update snapshots
+
+***** Result Parsing
+Parse:
+- failing test names
+- file paths and line numbers
+- snapshot failures
+- coverage summary
+
+Treat snapshot updates as an explicit command, not an automatic side effect.
+
+**** Go Ideas
+- Detect =go.mod=.
+- Current file/source: run package =go test ./pkg=.
+- Test at point: nearest =func TestXxx= and run =go test ./pkg -run '^TestXxx$'=.
+- Bench at point: nearest =BenchmarkXxx= and run =go test -bench '^BenchmarkXxx$'=.
+- Add toggles for =-race=, =-cover=, =-count=1=, =-v=.
+- Parse =file.go:line:= output and package failure summaries.
+
+**** Rust Ideas
+- Detect =Cargo.toml=.
+- Use =cargo test= by default, optionally =cargo nextest run= when available.
+- Current test at point: nearest =#[test]= function.
+- Current file/module where possible.
+- Integration test file: =cargo test --test name=.
+- Support =-- --nocapture= toggle.
+- Parse compiler/test failures and =file:line= links.
+
+**** Shell / Generic Ideas
+- Adapter for Makefile targets:
+  - detect =make test=, =make check=, =make coverage=
+  - expose project-level commands even when language-specific detection fails
+- Adapter for arbitrary project command configured in dir-locals or a project
+  config plist.
+- Let users register custom command templates per project:
+
+#+begin_src elisp
+((:name "unit"
+  :command ("npm" "run" "test:unit" "--" "{file}"))
+ (:name "integration"
+  :command ("pytest" "tests/integration" "-q")))
+#+end_src
+
+**** UI Ideas
+***** Transient Menu
+Replace or complement the raw keymap with a =transient= menu:
+- scope: current test/file/focused/last failed/project
+- runner: auto/ert/pytest/vitest/jest/go/cargo/make
+- toggles: watch, coverage, debug, fail-fast, verbose, update snapshots
+- actions: run, rerun, edit command, show failures, open report
+
+***** Result Buffer
+Create a normalized =*Test Results*= buffer:
+- latest status per project
+- command and duration
+- pass/fail/skip counts
+- failure list with clickable =file:line=
+- actions to rerun failed/current/all
+- links to coverage artifacts
+
+***** Modeline / Headerline Signal
+Show the last run status for the current project:
+- green passed
+- red failed
+- yellow running
+- gray no run
+
+Keep it quiet and optional.
+
+***** History
+Store recent run requests per project:
+- rerun last
+- rerun last failed
+- choose previous command
+- compare duration/status against previous run
+
+**** Configuration Ideas
+- =cj/test-runner-default-scope=
+- =cj/test-runner-prefer-isolated-elisp=
+- =cj/test-runner-project-overrides=
+- =cj/test-runner-known-adapters=
+- =cj/test-runner-enable-watch=
+- =cj/test-runner-result-retention=
+- per-project override through =.dir-locals.el=
+
+Example:
+
+#+begin_src elisp
+((nil . ((cj/test-runner-project-overrides
+          . (:adapter pytest
+             :default-args ("-q")
+             :coverage-args ("--cov=src"))))))
+#+end_src
+
+**** Safety And Robustness
+- Use structured commands until the final boundary.
+- Quote only at render time.
+- Avoid shell when =make-process= / =process-file= is sufficient.
+- Keep command preview/editing available for surprising cases.
+- Detect missing executables before running.
+- Add timeouts/cancel commands for long-running or hung tests.
+- Do not silently fall back from a missing runner to a different runner unless
+  the fallback is visible in the command preview.
+- Avoid mutating global =load-path= permanently.
+- Keep remote/TRAMP behavior explicit; do not accidentally run local commands
+  for remote projects.
+
+**** Coverage Integration
+Tie this into the existing coverage work:
+- run coverage for current file/scope
+- open latest coverage report
+- summarize uncovered lines for current file
+- support Elisp SimpleCov/Undercover, pytest-cov, Vitest coverage, Go cover,
+  and Rust coverage later
+- store coverage artifact paths in the normalized run result
+
+**** AI-Assisted Debugging Ideas
+- Summarize failing tests from the parsed failure records and raw output.
+- Include command, changed files, failure snippets, and relevant source/test
+  locations.
+- Redact env vars, tokens, Authorization headers, and secrets before sending to
+  =gptel=.
+- Add commands:
+  - =cj/test-runner-explain-failure=
+  - =cj/test-runner-suggest-related-tests=
+  - =cj/test-runner-summarize-coverage-gap=
+
+**** Migration Plan
+***** Phase 1: Internal cleanup
+- Fix the task typo and rename current ERT-specific functions or wrap them under
+  an ERT adapter.
+- Move F6 language detection/command construction from =dev-fkeys.el= into
+  =test-runner.el= or a new =test-runner-core.el=.
+- Replace shell-string command builders with structured command plists.
+- Fix path containment in =cj/test--do-focus-add-file=.
+- Make =cj/test-last-results= real for ERT runs.
+
+***** Phase 2: ERT adapter
+- Implement adapter registry.
+- Add ERT adapter with in-process and isolated modes.
+- Preserve all current keybindings by routing them through the adapter.
+- Add failure/result normalization for ERT.
+- Add "rerun last" and "rerun failed" for ERT.
+
+***** Phase 3: Python and JS/TS adapters
+- Add pytest adapter.
+- Add Vitest/Jest adapter with package-manager/script detection.
+- Support current file and test-at-point for both.
+- Add parser/navigation for common failures.
+
+***** Phase 4: UI and watch modes
+- Add transient menu.
+- Add result buffer.
+- Add cancellation and rerun history.
+- Add watch commands where supported.
+
+***** Phase 5: Coverage and AI
+- Connect coverage commands to adapter capabilities.
+- Add failure summarization with redaction.
+- Add coverage-gap summarization.
+
+**** Acceptance Criteria For First Fix-Up Pass
+- Existing ERT workflow still works.
+- F6 and =C-; t= use the same underlying runner API.
+- Current-file test command generation is covered for Elisp, Python, Go,
+  TypeScript, and JavaScript.
+- At least one isolated ERT command path exists.
+- Path containment checks are robust against sibling-prefix paths and symlinks.
+- Runner requests and results are represented as data, not only messages.
+- Missing runner/tool errors are clear and actionable.
+- Tests cover adapter detection, command building, scope resolution, result
+  storage, and key interactive paths.
+
+** TODO [#B] jumper: register collisions and dead-marker errors :bug:solo:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+Two related defects from the 2026-06 config audit:
+- =modules/jumper.el:155= — removal shifts the vector without renumbering registers, so a later store allocates a register still held by a surviving location and silently overwrites it. Allocate the first free register char in the live slice; =set-register nil= on removal so freed markers don't pin buffers.
+- =modules/jumper.el:117,132= — guards check =(markerp marker)= but not =(buffer-live-p (marker-buffer marker))=; after killing a buffer holding a location, M-SPC SPC and M-SPC j signal wrong-type errors. Treat dead entries as skippable/removable.
+Also =jumper.el:178= — the promised single-location toggle never toggles back ('already-there branch should =jump-to-register= z when set).
+
+** TODO [#B] Keymap consolidation — resolve decisions, run Phase 1-2 :feature:refactor:solo:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-13
+:END:
+Spec: [[id:540bf06b-16b8-46c6-b459-c40d1b9c795d][keybinding-console-safety-spec-doing.org]]. Phase 0 (revert 4a1ecf64) is done and pushed. Decisions D1-D5 are open TODOs in the spec; D2/D4/D5 gate the primary work (Phase 1 prune via Appendix D, Phase 2 consolidate + retire the translation block), while D1/D3 (the console-safe prefix) gate only the optional Phase 3 and can stay open indefinitely. Resolve D2/D4/D5, then run Phase 1-2. Appendix D is the keybinding pruning checklist. Add a =#+TODO: TODO | DONE SUPERSEDED CANCELLED= header line to the spec if adopting those decision keywords (rulesets convention update, 2026-06-12).
+
+** TODO [#B] ledger-config is orphaned — ledger-mode never configured :bug:quick:
+Nothing requires =modules/ledger-config.el= (verified by grep), so .dat/.ledger/.journal open without ledger-mode, reports, or flycheck-ledger. The module looks finished, not staged (unlike duet-config, which documents its pre-alpha orphaning). Decide: wire into init.el (+ =cj/executable-find-or-warn= for the ledger binary) or delete. From the 2026-06 config audit.
+
+** TODO [#C] buffer-differs save prompt: 4-way yes/no/diff/cancel :feature:next:
+The "buffer differs from file" confirmation currently gives only yes/no. Craig wants a 4-way choice with explicit consequences: yes (be explicit it overwrites), no (be explicit it discards this action and continues), diff (show a graphical difftastic diff, then return to this prompt), cancel (stop the action, leave the buffer untouched). Needs the exact prompt identified first (which save/overwrite path raises "buffer differs") and a design for the diff-then-return loop. difftastic + cj/diff-buffer-with-file infrastructure already exist. From the roam inbox 2026-06-16.
+** TODO [#C] emacs: tag tasks by module name for sorting :refactor:studio:
+Replace topic tagging with single-word module tags: :studio: for everything under scripts/theme-studio/, module-named tags elsewhere, :multi: for cross-area work. Drop bug/enhancement-style tags since work should be chosen on other bases. This changes the current six-tag convention, so update the priority-scheme section to document it, rewrite the task-audit workflow to reconcile tasks against the module scheme, then run the audit. Queue for end of session. From the roam inbox.
 ** TODO [#C] Build an Org-native API workspace :feature:test:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-02
@@ -3176,131 +4310,6 @@ First pass can skip or mark as unsupported:
 6. Open scratch buffer (C-; R n), type a request manually, execute
 7. which-key shows "REST client" menu under C-; R
   
-** TODO [#C] Build cj/dev-setup-project helper (per docs/specs/dev-setup-project-spec.org) :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-01
-:END:
-*** 2026-05-15 Fri @ 19:17:37 -0500 Specification
-
-Interactive command that opens a review buffer with proposed per-subdirectory .dir-locals.el contents (projectile compile/run/test + cj/coverage-backend), optional starter Makefile when none exists, and gitignore updates. User edits inline, C-c C-c writes all files.
-
-Design: [[id:596fce5d-1bab-46e7-8567-d4a2e0923091][docs/specs/dev-setup-project-spec.org]]
-
-Scope of v1:
-- modules/dev-setup-config.el (command + review-buffer major mode)
-- Three-tier detection: existing Makefile, existing package.json/pyproject.toml scripts, fall-back starter Makefile generation.
-- Project shapes supported: pure Elisp, pure Go, pure Python, pure Node/TS, Docker Compose polyglot.
-- Re-run semantics: status banners (UNCHANGED / WILL UPDATE / WILL CREATE), idempotent gitignore append, never modifies an existing Makefile.
-- ERT tests for the pure helpers (Makefile parser, package.json parser, shape detection, target-to-role mapping, review-buffer parser).
-
-Deferred:
-- Rust (Cargo.toml), Java (pom.xml), other language shapes.
-- Project-wide override config file.
-- Auto-detecting external run scripts in conventional locations.
-
-Do this after the F-key rework ticket ships; don't want to churn project configs before the keys are stable.
-
-*** TODO [#B] Pure detection + parsing helpers :feature:
-Implement the four pure helpers the rest of the command composes on:
-- =cj/--dev-setup-parse-makefile-targets FILE= (.PHONY + bare target lines, skip pattern rules)
-- =cj/--dev-setup-parse-package-json-scripts FILE= (scripts block, JSON)
-- =cj/--dev-setup-detect-project-shape ROOT= (Elisp / Go / Python / Node-TS / Docker-Compose polyglot / unknown)
-- =cj/--dev-setup-map-targets-to-roles TARGETS= (best-guess compile/run/test mapping per design § Detection)
-
-Files: =modules/dev-setup-config.el= (new).  No interactive surface, no I/O
-beyond reading the named file.
-
-Acceptance: each helper callable in isolation with handcrafted fixtures;
-no command yet.
-
-Depends on: none -- start here.
-
-*** TODO [#B] ERT coverage for the pure helpers :feature:test:
-Normal/Boundary/Error tests for every helper from the prior sub-task,
-matching the design's testing section.
-
-Files: =tests/test-dev-setup-config.el=, plus
-=tests/testutil-dev-setup-config.el= for the temp-project fixture builder
-(writes Makefile / package.json / compose stub into =make-temp-file ... 'dir=).
-
-Acceptance: =make test-file FILE=tests/test-dev-setup-config.el= green;
-every helper has at least one Normal, one Boundary, one Error case.
-
-Depends on: pure detection + parsing helpers.
-
-*** TODO [#B] Starter-Makefile + .dir-locals.el proposal generator :feature:
-Pure function =cj/--dev-setup-build-proposal SHAPE ROOT= returning a
-structured plist of proposed blocks: one per subproject =.dir-locals.el=
-(projectile compile/run/test + =cj/coverage-backend=), the optional starter
-Makefile (only when none exists, adapted per shape per design § Tier 3),
-and the gitignore append lines.
-
-Files: =modules/dev-setup-config.el=.
-
-Acceptance: given a shape plist, returns deterministic block list ready for
-the review buffer; ERT cases cover each shape (Elisp / Go / Python / Node-TS
-/ polyglot) plus the Tier-1 "Makefile already exists, suppress Makefile
-block" branch.
-
-Depends on: pure detection + parsing helpers.
-
-*** TODO [#B] Review-buffer major mode + parser :feature:
-Define =cj/dev-setup-review-mode= (derived from =emacs-lisp-mode=) with =C-c
-C-c= / =C-c C-k= bindings, plus the pure parser
-=cj/--dev-setup-review-buffer-parse CONTENTS= that turns buffer text back
-into a block list.  Banner syntax per design § Review Buffer (=;; ==== <path>
-====[ <status>]==, gitignore special, Makefile special).
-
-Files: =modules/dev-setup-config.el=, =tests/test-dev-setup-config.el=
-(parser cases: well-formed multi-block, single block, empty body, missing
-banner, malformed elisp inside a dir-locals block).
-
-Acceptance: round-trip -- render proposal -> parse buffer -> equal block
-list.  Mode keybindings smoke-tested.
-
-Depends on: starter-Makefile + .dir-locals.el proposal generator.
-
-*** TODO [#B] Writer + status diff + projectile cache reset :feature:
-Implement the =C-c C-c= writer: diff each parsed block against the on-disk
-file to assign =UNCHANGED= / =WILL UPDATE= / =WILL CREATE=, write only the
-non-UNCHANGED ones, append gitignore idempotently, never touch an existing
-Makefile, honor the =;;; cj/dev-setup-project: ignore= escape hatch, clear
-projectile's per-project command cache, print the summary line.
-
-Files: =modules/dev-setup-config.el=, plus ERT cases for the diff +
-idempotent-append logic against temp dirs.
-
-Acceptance: re-run on an unchanged project writes nothing; renaming a
-Makefile target flips one block to =WILL UPDATE=; ignore-marked files stay
-untouched.
-
-Depends on: review-buffer major mode + parser.
-
-*** TODO [#B] Interactive command + smoke test :feature:test:
-Thin =cj/dev-setup-project= interactive wrapper: resolve project root via
-projectile, run detection, build proposal, render the review buffer, pop to
-it.  One smoke test against a prepared temp project asserting the expected
-files exist after a simulated =C-c C-c=.
-
-Files: =modules/dev-setup-config.el=, =tests/test-dev-setup-config.el=.  Add
-=(require 'dev-setup-config)= to =init.el= (or the appropriate aggregator).
-
-Acceptance: =M-x cj/dev-setup-project= on a fixture project opens the review
-buffer; =C-c C-c= writes the expected files.
-
-Depends on: writer + status diff + projectile cache reset.
-
-*** TODO [#B] Resolve open questions + design follow-ups
-Three design questions to close before / during implementation: (a) include
-=make coverage= target in starter Makefile? (b) project-wide override file
-=.cj-dev-setup.el=? (c) Cargo/pom detection.
-
-Body: park decisions inline in the design doc or run =arch-decide= if they
-turn out load-bearing.
-
-Depends on: none, but easiest after the writer sub-task surfaces real
-friction.
-
 ** TODO [#C] Build debug-profiling.el module :feature:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-02
@@ -3312,15 +4321,6 @@ Design: [[id:c713b431-ae14-498d-aba9-b84d52f981b6][docs/specs/debug-profiling-sp
 
 Implement via =/start-work= against the design — branch =feat/debug-profiling=, commits decomposed along the test-first split-for-testability boundary. Once shipped, use it as the v1 exercise on the queued [#B] org-capture target-building investigation.
 
-** TODO [#C] Consider consolidating/harmonizing the UI in all Message Clients
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-06
-:END:
-They should have the same UI paradigms and patters for consistency.
-** VERIFY [#C] Dirvish: free D for hard-delete, move duplicate :feature:quick:next:
-Needs from Craig: two confirmations before I wire this. (1) Which key for the moved duplicate command (your note said "duplicate on 2" — confirm 2)? (2) Binding D to sudo rm -rf is genuinely dangerous; confirm you want a forced hard-delete on a single capital key, and whether it should prompt (yes-or-no-p naming the target) before running. I won't bind an unguarded sudo rm -rf autonomously.
-In dirvish, keep =d= = delete (=dired-do-delete=), move duplicate (=cj/dirvish-duplicate-file=, currently =D=) to another key, and bind =D= = =sudo rm -rf= for a forced hard delete — capital for the more destructive op. Craig's note says "duplicate on 2"; confirm that's the intended key, and guard the sudo path carefully before wiring. From the roam inbox.
-
 ** TODO [#C] Evaluate jamescherti essential-emacs-packages list :quick:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-11
@@ -3351,726 +4351,9 @@ From the 2026-06-11 brainstorm. Goal: keep [[file:~/sync/org/contacts.org][conta
 ** TODO [#C] Google Voice in Emacs — SMS + dialer investigation :feature:
 From the 2026-06-11 messenger-unification brainstorm. Google Voice has no official API; the viable routes ride the Matrix bridge ecosystem's reverse engineering (mautrix-gvoice). Research pass to establish the 2026 state of play: (1) is mautrix-gvoice healthy and what does its auth flow look like now; (2) any better-maintained alternative (CLI/daemon) for the signel-pattern architecture (external daemon + JSON-RPC + thin Emacs chat client); (3) does call initiation (ring-linked-phone-then-connect, Emacs as dialer) survive in the current protocol — two-way audio in Emacs is out of scope (WebRTC); (4) ToS/account-flag risk assessment for Craig's account. Output: a recommendation doc in docs/design/ naming the architecture (signel-pattern daemon vs Matrix bridge + ement.el) or a no-go with reasons. If go, GV becomes a registered backend under the messenger-unification convention (see the [#B] task below).
 
-** TODO [#C] GPTel Work :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-01
-:END:
-
-Categories below thematize the agent affordances the design doc
-[[file:docs/design/gptel-agentic-tool-ideas.org][gptel-agentic-tool-ideas.org]]
-points at -- Git, Org, messaging, file / buffer / workspace state,
-media, and the dev loop.  The shortlist's first-batch ADOPT tools
-(git_status / git_log / git_diff / web_fetch) already shipped; the
-themes below are next-tier work where the agent treats Emacs as a
-structured workspace, not a text terminal.  Per-theme spec lives in
-the task body once written; implementation tasks land as siblings
-of the spec heading once the spec is approved.  The magit-backend
-reimplementation of the shipped git tools is tracked separately in
-[[id:bd47c9a8-aae1-4a3d-ad5b-b8767f2fd580][gptel-git-tools-magit-backend-spec.org]].
-
-*** TODO [#C] Wire Up MCP.el so That GPTel Has Access to MCP Servers via GPTel Tools
-
-**** 2026-05-16 Sat @ 15:44:36 -0500 Spec
-
-Design doc: [[id:b4c274c5-8572-4a7b-b657-d315712bd6af][docs/specs/mcp-el-gptel-integration-spec-doing.org]]
-
-**** 2026-05-17 Sun @ 14:14:34 -0500 Landed ai-mcp.el pure-helper foundation
-
-Commit =54d231be=.  Sections 1 (constants + defcustoms) and 3 (pure helpers) of the seven-section outline.  41 ERT tests, all green.  Refactor audit caught two duplications during Phase 4 and folded them into the same commit (=cj/mcp--get-server-entry= and =cj/mcp--name-matches-p=).  Phase 1.5 (confirmation contract) is next.
-
-**** TODO [#C] Phase 1.5 -- GPTel confirmation contract
-
-*Goal:* flip =gptel-confirm-tool-calls= to ='auto= and gate the existing local tools that need it.
-
-*Entry:* Phase 1 module exists and helpers tested.
-
-*DECISION (cj):* which of the existing local tools register with =:confirm t= once ='auto= is in effect?  Reads (=read_buffer=, =read_text_file=, =list_directory_files=, =git_status=, =git_log=, =git_diff=) clearly stay =:confirm nil=.  Judgment calls:
-- =web_fetch= -- fetches arbitrary URLs the agent supplies.  Spec recommends gating.
-- =write_text_file= -- writes any path under =$HOME= with agent-supplied content.
-- =update_text_file= -- modifies an existing file with an agent-supplied transform.
-- =move_to_trash= -- moves a path to trash (reversible but disruptive).
-
-*Deliverables:*
-- =ai-mcp.el= setup section runs =(setq gptel-confirm-tool-calls 'auto)=.
-- Remove =(setq gptel-confirm-tool-calls nil)= from =modules/ai-config.el:386= with a comment pointing at =ai-mcp.el=.
-- For each tool the decision marks "gate," add =:confirm t= to its =gptel-make-tool= form.
-- Tests in =tests/test-ai-mcp-confirm-contract.el= asserting: =gptel-confirm-tool-calls= is ='auto= after load; write-classified stub MCP tool with =:confirm t= triggers the confirm branch in =gptel-send='s dispatch (stub the prompt); read-classified MCP tool with =:confirm nil= does not; =git_log= (=:confirm nil=) still runs without prompting; each newly-gated local tool does prompt.
-
-*Exit:* tests green.  Manual smoke: open GPTel, call a gated tool, confirm prompt appears.  Call =git_log=, no prompt.
-
-**** TODO [#B] Phase 2 -- Compat layer + registration pipeline (fake inventory)
-
-*Goal:* implement the mcp.el compat wrappers and the tool-registration pipeline against stubbed =mcp-server-connections=.
-
-*Entry:* Phase 1.5 proves gptel respects per-tool =:confirm= slot.
-
-*Deliverables:*
-- Section 4 of =ai-mcp.el= (compat layer): =cj/mcp--server-status=, =cj/mcp--server-tools=, =cj/mcp--server-name=, =cj/mcp--assert-capabilities=.  Each helper documents the upstream commit / file location it targets.
-- Section 5 of =ai-mcp.el= (registration pipeline): =cj/mcp--register-tool=, =cj/mcp--register-server-tools=, =cj/mcp--deregister-server-tools=, =cj/mcp--rewrite-plist=, =cj/mcp--registered-tools= hash.
-- All MCP tools register with =:async t=.
-- Tests in =tests/test-ai-mcp-registration.el=.
-
-*Exit:* with a stubbed =mcp-server-connections=, registration produces correctly prefixed =mcp__SERVER__TOOL= entries in =gptel-tools=; closures call =mcp-call-tool SERVER REMOTE-NAME= (verified by stubbing =mcp-async-call-tool=); deregistration removes only MCP-owned tools and leaves a pre-populated local =git_log= entry intact; re-registration replaces function pointer without duplicating menu entries; confirm overrides win over patterns.
-
-**** TODO [#B] Phase 3 -- Async state machine + timer-race timeout wrapper
-
-*Goal:* implement the lifecycle state machine and the per-call timer-race timeout.
-
-*Entry:* Phase 2 registration works against stubs.
-
-*Deliverables:*
-- Section 6 of =ai-mcp.el= (async state machine): =cj/mcp--state=, =cj/mcp--server-status= alist, =cj/mcp--stall-timer=, =cj/mcp-ensure-started=, =cj/mcp--on-hub-callback=, =cj/mcp--poll-status=, =cj/mcp--start-stall-timer=, =cj/mcp--build-status-from-specs=.
-- =cj/mcp--wrap-async-with-timeout= (timer/callback race; both branches set =done= before invoking gptel callback so late responses are ignored).
-- Tests in =tests/test-ai-mcp-async.el=.
-
-*Exit:* =cj/mcp-ensure-started= returns in <100 ms with delayed-callback stubs; stall timer fires for stuck servers; timer-race wrapper handles all three orderings (MCP-first, timer-first, late-MCP-after-timer); async error path (=:error-callback= without inited callback) reaches =failed= state via polling.
-
-**** TODO [#B] Phase 4 -- First real connection (drawio or slack-deepsat)
-
-*Goal:* wire one real no-auth server end-to-end against actual mcp.el and prove the stubbed Phase 3 behavior matches reality.
-
-*Entry:* Phase 3 async works against stubs.
-
-*Deliverables:*
-- Add =use-package mcp= to =ai-mcp.el= (MELPA active, =:load-path= for local checkout commented).
-- =cj/mcp--assert-capabilities= called at load time; signals clearly if mcp.el is too old.
-- Set =cj/mcp-enabled-servers= temporarily to =("drawio")= (or =("slack-deepsat")= if the local proxy is running).
-- First real =cj/mcp-ensure-started= invocation from =cj/toggle-gptel=.
-
-*Exit:* manual smoke -- =C-; a t= opens GPTel without blocking; within 30 s, drawio (or slack-deepsat) tools appear in =gptel-menu= grouped by category; calling a tool returns expected output; killing the subprocess externally surfaces as =failed= in =cj/mcp--server-status=.
-
-**** TODO [#B] Phase 5 -- Status UX + commands + doctor (static)
-
-*Goal:* ship the full server-management UX so partial-availability and failures are visible.
-
-*Entry:* Phase 4 proves a real connection works.
-
-*Deliverables:*
-- Section 7 of =ai-mcp.el= (UI).
-- Commands: =cj/mcp-status= (echo-area summary keyed off =cj/mcp--state=), =cj/mcp-list-tools= (tabulated buffer with failed servers at top in red face; keys =g r c RET q=), =cj/mcp-doctor= (static mode only -- capability, =npx=/=uvx=, Claude config, per-server env, local endpoints; output buffer keys =c r q=), =cj/mcp-wait-until-ready=, =cj/mcp-hub= (thin wrapper that ensures startup first), =cj/mcp-restart-failed=, =cj/mcp-restart-server=, =cj/mcp-stop-all=.
-- Keymap: =C-; a C= subprefix bound in =ai-config.el='s autoload section.  Keys =h s l r R S d w=.
-- which-key labels for every binding.
-- =kill-emacs-hook= registration for =cj/mcp-stop-all=.
-- Investigation: does =gptel-menu= refresh after mid-call tool registration?  Document the answer in =ai-mcp.el= commentary; if it requires close+reopen, add to known UX caveats.
-
-*Exit:* all keymap bindings work; audit buffer surfaces failed servers prominently; doctor identifies each scenario in the manual test matrix; status command shows the right state for each phase transition.
-
-**** TODO [#B] Phase 6 -- HTTP servers (linear, notion)
-
-*Goal:* add the two HTTP-transport servers with in-protocol OAuth.
-
-*Entry:* Phase 5 UX shipped.
-
-*Deliverables:*
-- Add =linear= and =notion= back to =cj/mcp-enabled-servers=.
-- Doctor gains live-auth-check mode (=C-u C-; a C d=): invokes a single safe read per auth class to verify OAuth tokens haven't silently expired.  Static checks first; live probe only fires after static passes.
-- OAuth recovery pattern matcher surfaces auth URLs in =cj/mcp-status= on first connect.
-
-*Exit:* first connect surfaces the OAuth URL through the recovery pattern; after browser handshake completes, subsequent connects succeed without prompt; live-auth-check correctly identifies a deliberately revoked token; both servers appear ready in the audit buffer.
-
-**** TODO [#B] Phase 7 -- Env-dependent stdio servers (figma, google-*)
-
-*Goal:* add the remaining five env-dependent servers.
-
-*Entry:* Phase 6 HTTP servers connect cleanly.
-
-*Deliverables:*
-- Add =figma=, =google-calendar=, =google-docs-personal=, =google-docs-work=, =google-keep= to =cj/mcp-enabled-servers=.
-- Verify env-merge from =~/.claude.json= for each (the mtime-cached reader from Phase 1).
-- Verify figma's =:secret-args= splicing places the API key correctly without echoing it.
-- Manual smoke: simulate token expiry on one Google server; recovery message points at "re-auth via Claude Code, then C-; a C r SERVER".
-
-*Exit:* all 9 servers reach =ready= state on a clean machine.  Sentinel-grep check across status / audit / hub / errors / audit-log shows zero secret leakage.  Doctor's live-auth covers each auth class (oauth, token, args-token, in-protocol, local, none).
-
-**** TODO [#B] Phase 8 -- Privacy + audit polish
-
-*Goal:* land the final UX polish and documentation.
-
-*Entry:* all 9 servers working.
-
-*Deliverables:*
-- Audit buffer privacy header: "Tool results land in =gptel-tools= responses; saved conversations persist them.  Use =cj/gptel-autosave-toggle= per buffer to opt out."
-- =cj/mcp-tool-audit-log-enabled= defcustom + log writer (=~/.emacs.d/data/mcp-tool-log/YYYY-MM-DD.log= -- metadata only, one line per call, daily rotation).
-- =ai-mcp.el= commentary updated with the code-organization outline as a table of contents.
-- Final pass on tests covering saved-conversation behavior (autosave persists MCP tool results; toggling off prevents persistence).
-
-*Exit:* all 10 acceptance criteria from the spec pass.  Manual matrix run end-to-end on a fresh Emacs.  Working tree clean.
-
-*** TODO [#C] Wrap the gh CLI as a GPTel tool
-
-**** 2026-05-16 Sat @ 16:20:00 -0500 Spec
-
-Design doc: [[id:a124dd0f-1f40-4533-aeb8-595d93e20865][docs/specs/gptel-gh-tool-spec.org]]
-
-*** TODO [#C] GPTel should autosave regularly after a conversation is saved
-*** TODO [#B] Org Workflow Related Tools
-
-Affordances that expose the Org workspace -- agenda state, capture
-targets, org-roam nodes and backlinks, dailies, drill review state --
-to the agent as structured context, not raw .org buffer text.
-
-**** TODO [#B] Agenda state tools :feature:
-
-Read scheduled / deadline / waiting tasks for a date range; query by
-tag, priority, or TODO keyword; list what's blocking today.  Lets the
-agent answer "what's on the critical path this week" without me
-pasting agenda output, and feeds the daily-prep / wrap-up workflows.
-
-**** TODO [#B] Org-roam node tools :feature:
-
-Resolve a topic to its node; return body + backlinks; list nodes by
-tag; surface dailies for a date range.  Lets the agent reason over
-the personal knowledge graph and write back into it via the capture
-tools below.
-
-**** TODO [#B] Capture creation tools :feature:
-
-Drive =org-capture= from a template key + body string.  Lets the
-agent file inbox items, reading notes, journal entries, or roam
-nodes without me leaving the chat.  Tight pairing with the
-=cj/org-capture= optimization task in todo.org.
-
-**** TODO [#B] Org-drill review tools :feature:
-
-Surface next-due drill cards in =drill-dir=; let the agent quiz on a
-topic and report performance.  Useful for prompted recall sessions
-("ask me five medical-Spanish cards") and for "did this card stick"
-analysis.
-
-*** TODO [#B] Git Related Tools
-
-Affordances that expose magit's structured view of a repo -- sections,
-staged-vs-unstaged, commit metadata, rebase / conflict state -- as
-first-class tools rather than asking the model to reason over raw
-diff text.
-
-**** TODO [#B] Section-aware git tools :feature:
-
-Expose Magit sections as first-class GPTel tools: current section type,
-heading, file, hunk range, and content; sibling sections under the same
-file; staged / unstaged / untracked status; commit metadata around the
-selected commit or branch; the exact staged patch that would be
-committed.  Lets prompts say "review the file section at point" or
-"explain this hunk in the context of adjacent hunks" without manual
-context-copying.
-
-**** TODO [#B] Commit intent workbench :feature:
-
-Transient that builds a commit intentionally:
-1. Agent reads unstaged + staged changes.
-2. Agent proposes coherent commit groups.
-3. User selects groups in a Magit-style buffer.
-4. Agent stages those paths or hunks only after confirmation.
-5. Agent generates a message reflecting the selected intent.
-
-Addresses the common case of two or three unrelated edits in one
-working tree -- a single commit-message generator can't handle that
-cleanly.
-
-**** TODO [#B] Patch narrative buffer :feature:
-
-Generate an Org buffer that explains a change set as a reviewable
-narrative:
-- "What changed" by subsystem.
-- "Why it appears to have changed" inferred from names, tests, and docs.
-- "Risk areas" with links back to Magit file sections.
-- "Suggested verification" using local Makefile targets when present.
-
-Reusable artifact: paste into a PR description, save with an AI
-session, or file into org-roam.
-
-**** TODO [#B] Review-thread simulator :feature:
-
-Before opening a PR, create a local review buffer with inline comments
-attached to Magit diff positions.  The agent writes comments as if
-reviewing someone else's patch:
-- Comments grouped by severity.
-- Each comment links to file and line.
-- Resolved comments check off in Org.
-- Accepted suggestions apply through the existing text-update tools.
-
-Makes "review my diff" less ephemeral and avoids losing useful findings
-inside a chat transcript.
-
-**** TODO [#B] Rebase and conflict coach :feature:
-
-When Magit enters a rebase, cherry-pick, merge, or conflict state,
-expose an agent command that reads:
-- Git operation state from =.git/=.
-- Conflict markers in the worktree.
-- Relevant commits from =git log --merge= or the rebase todo.
-- The current Magit status sections.
-
-The agent explains the conflict in domain terms and proposes a
-resolution patch; the actual edit and =git add= stay under explicit
-user control.
-
-**** TODO [#B] Regression archaeology :feature:
-
-Magit transient that runs a bisect-like reasoning workflow:
-- Ask for a symptom and a known-good / known-bad range.
-- Summarize candidate commits in small batches.
-- Use tests or user-provided repro commands when available.
-- Maintain a bisect journal in an Org buffer.
-
-Even when the agent can't run the whole bisect, it keeps the
-investigation structured and preserves why each commit was judged
-good or bad.
-
-*** TODO [#B] Messaging Related Tools
-
-Affordances over mu4e, Slack, Telegram, and ERC.  Same shape across
-protocols: read recent threads, search by sender / topic, compose a
-draft from a prompt + thread context, leave the send under explicit
-user control.
-
-**** TODO [#B] Mu4e thread and compose tools :feature:
-
-Read the message at point and surrounding thread (with attachments
-summarized); query the inbox by =from:= / =subject:= / date range;
-compose a draft from a prompt + thread context using =org-msg=.
-Pairs with the existing =mu4e-org-contacts-integration.el=.
-
-**** TODO [#B] Slack thread and compose tools :feature:
-
-Read channel / DM / thread history through =emacs-slack=; search by
-user or channel; compose a draft message but leave sending to me.
-Mirrors the mu4e shape so the agent's interface is uniform across
-messaging protocols.
-
-**** TODO [#B] Telegram and IRC read tools :feature:
-
-Same shape as Slack for =telega= (Telegram) and =erc= (IRC):
-recent-message reads, search, and draft compose.  Bundled because
-the API shape is identical even if the underlying clients differ.
-
-**** TODO [#B] Contact resolution tools :feature:
-
-Resolve a name to email / Slack ID / Telegram handle via
-=org-contacts= and the configured address books.  Removes the
-"who's this person again" friction from the compose flows above.
-
-*** TODO [#B] File and Buffer Related Tools
-
-Affordances that expose the user's actual workspace -- open buffers,
-narrowed regions, marked files, vterm / eshell sessions -- as
-structured context.  Stops the model from asking "what file are you
-looking at" or "what region is selected."
-
-**** TODO [#B] Buffer state tools :feature:
-
-List visible buffers with major-mode + file (when any); read the
-narrowed region instead of the whole buffer; report point + mark
-positions and the active region's text.  The single most-asked
-question between turns becomes a tool call.
-
-**** TODO [#B] Dirvish / Dired tools :feature:
-
-Read marked files, sort state, and filter state from a Dired or
-Dirvish buffer.  Lets the agent operate on "the files I just marked"
-rather than "files in this directory" -- a real distinction in any
-review or refactor workflow.
-
-**** TODO [#B] Vterm session tools :feature:
-
-Recent command output from a named vterm session; scroll-history
-search.  Pairs naturally with the =ai-vterm= design: the agent
-running in one project's vterm can read another project's vterm
-without leaving the chat.
-
-**** TODO [#B] Eshell session tools :feature:
-
-Same shape as the vterm tools for =eshell= sessions -- last-command
-output, history search, current directory.  Most useful for
-agent-driven inspection of long-running pipelines.
-
-*** TODO [#B] Filesystem Related Tools
-
-Affordances that let the agent operate on actual files on disk and
-run common CLI utilities -- pandoc, ffmpeg, imagemagick, ripgrep,
-fd, jq -- rather than relying on me to paste content or run
-commands by hand.
-
-*Design tension to resolve before any of these ship: one tool per
-utility, or one generic =run_shell_command=?*
-
-The shortlist's first pass DEFERRED a generic =run_shell_command=:
-sandboxing to HOME + /tmp with a denylist for destructive ops is
-straightforward, but the denylist can never be exhaustive, and
-"confirmation for everything else" becomes click-fatigue.
-
-The children below take the other path -- *one gptel tool per
-binary*, with a strictly-typed argv shape (e.g.
-=pandoc_convert(input_path, output_format)=, not
-=pandoc_convert(args_string)=).  Each tool:
-
-- Validates its own paths (must be under HOME, outputs in a
-  sandboxed dir).
-- Rejects dangerous flags explicitly (pandoc =--filter=, ffmpeg's
-  =-protocol_whitelist= chicanery, imagemagick's policy bypasses).
-- Runs via =call-process= with an argv list -- no shell parsing,
-  no string-interpolation injection.
-- Caps output and reports truncation inline.
-
-The trade-off is breadth: every new CLI tool means a new gptel tool
-file.  Acceptable because (a) the list of utilities I actually need
-agent access to is small (~8 below covers most of it), and (b) each
-wrapper gets type-checked argv and a focused description the model
-can reason over, which is genuinely better than a free-form
-=run_shell_command(string)=.
-
-The =eshell_submit= entry at the end is the escape hatch for one-
-off needs the wrappers don't cover -- =:confirm t= always.
-
-Adjacent categories: the existing =gptel-tools/= file CRUD
-(=read_text_file=, =write_text_file=, =update_text_file=,
-=list_directory_files=, =move_to_trash=) is the foundation this
-category extends.  =web_fetch= is the network-fetch counterpart.
-
-**** TODO [#B] Document conversion (pandoc) :feature:
-
-Convert between markdown, org, html, pdf, docx, latex, epub, plain
-text.  Most common use: "extract this docx to markdown so I can
-read it inline."  Strict argv: input path, output format, optional
-output path.  Reject =--filter= and =--lua-filter= (arbitrary code
-execution).  Output written to a sandbox dir unless explicit
-override.
-
-**** TODO [#B] Image manipulation (imagemagick) :feature:
-
-Resize, format-convert, get-metadata (=identify=), optionally crop /
-rotate / annotate.  Common use: "resize this PNG to a thumbnail" or
-"convert these HEICs to JPEGs."  Strict argv per operation.
-Reject pre-validated dangerous formats (the historical EXR / SVG /
-MVG CVE surface) unless explicitly enabled.  ImageMagick's
-=policy.xml= is the underlying defense; the wrapper enforces it at
-the tool boundary too.
-
-**** TODO [#B] Audio / video processing (ffmpeg) :feature:
-
-Trim, transcode, extract audio, get-metadata (=ffprobe=).  Paths
-under HOME only; reject network-protocol inputs (=http:= / =rtmp:=
-/ =rtsp:=) so the model can't pull from arbitrary sources.  Pairs
-with the existing transcription module -- the same "extract audio
-from video" path =cj/transcribe-media= uses internally.
-
-**** TODO [#B] Content search (ripgrep) :feature:
-
-=rg= wrapper with path / glob filtering, result-count cap, optional
-literal-vs-regex mode.  Pure read.  Was in the shortlist's ADOPT
-bucket as =search_in_files=.  Highest-leverage filesystem tool by
-expected call frequency -- "where in this repo is X" is the
-question I paste agent output for most often.
-
-**** TODO [#B] File discovery (fd) :feature:
-
-=fd= (or =find= fallback) wrapper, capped result count.  Pure
-read, lower stakes than =search_in_files= (filenames only, no
-content).  Common pairing: =find_file_by_name= then
-=read_text_file=.
-
-**** TODO [#B] Metadata extraction (file / exiftool) :feature:
-
-=file= for MIME-type detection; =exiftool= for image / video /
-audio metadata.  Lets the agent answer "what is this file" or
-"when was this photo taken" without me opening external tools.
-Pure read.
-
-**** TODO [#B] Structured data processing (jq / yq) :feature:
-
-=jq= for JSON, =yq= for YAML / TOML.  Filter / project / transform
-structured data into a smaller, more focused view before reading.
-Strictly read-only -- output goes to the chat, not to disk.  The
-agent often wants "the third element of .results" from a JSON file
-and this is much cheaper than pasting the whole thing.
-
-**** TODO [#B] Eshell command submission :feature:
-
-Submit a single eshell command line, return output (capped).
-=:confirm t= always -- this is the escape hatch where the
-strictly-typed wrappers above don't fit, so each invocation needs
-my eyeball.  Eshell parses in-process (no /bin/sh fork) so the
-security surface is narrower than a shell command runner, but it's
-still effectively arbitrary execution -- treat it as such.
-
-*** TODO [#B] Media and Reading Related Tools
-
-Affordances over non-code content: feeds, PDFs, EPUBs, music.  The
-agent's job here is summarize / extract / queue, not produce.
-
-**** TODO [#B] Elfeed entry tools :feature:
-
-Read entry body; list unread by feed or tag; mark read after a
-summary lands in a roam node or inbox.  Enables "give me the
-non-noise headlines from this week's feeds" flows.
-
-**** TODO [#B] PDF and EPUB text tools :feature:
-
-Extract plain text from a PDF page or page range (via =pdftotext=)
-and from an EPUB (via the existing nov-mode pipeline).  Lets the
-agent summarize / quote a research paper or book chapter without
-me pasting passages.
-
-**** TODO [#B] EMMS playback and queue tools :feature:
-
-Current track, queue contents, playback state; queue or play a
-path; compose a playlist from a prompt ("play something focusing
-that's not Nick Cave").  Light tools, but a frequent friction
-point.
-
-*** TODO [#B] Development Workflow Related Tools
-
-Affordances over the dev loop: compilation output, test invocation,
-coverage / profile data, flycheck / flymake diagnostics.
-
-**** TODO [#B] Compilation buffer tools :feature:
-
-Read the most recent =compile= buffer output; parse error locations
-to =file:line=; summarize what broke.  Pairs with the F6 test-runner
-flow -- "tell me what's failing" becomes a single agent turn
-instead of paste + parse.
-
-**** TODO [#B] Project test invocation tools :feature:
-
-Run =make test-file FILE=X= / =make test-name TEST=Y= /
-project-equivalent and return results.  Currently each agent guesses
-the project convention; expose the canonical invocation explicitly
-per project so the agent can run focused tests itself.
-
-**** TODO [#B] Coverage and profile tools :feature:
-
-Read the most recent SimpleCov JSON or profile dump.  Lets the
-agent answer "what's still uncovered after this push" or "what
-function dominates startup time" against real measured data.
-
-**** TODO [#B] Diagnostic tools (flycheck / flymake) :feature:
-
-Surface current-buffer or project-wide errors and warnings.  Useful
-both as a "what's broken right now" check and as input to the
-patch-narrative buffer / commit-intent workbench above.
-
-*** TODO [#C] gptel-magit activation fails on velox :bug:quick:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-01
-:END:
-Surfaced 2026-05-25 while diagnosing an unrelated load failure over SSH. velox-specific — the workstation has a current gptel and does not show it.
-
-At startup (and reproducibly in batch) velox logs: "Unable to activate package `gptel-magit'. Required package `gptel-0.9.8' is unavailable." gptel-magit depends on gptel >= 0.9.8 and velox's installed gptel is older or missing, so it can't activate. A startup warning, not a blocker.
-
-Reproduce:
-: emacs --batch --no-site-file -L . -L modules --eval "(package-initialize)" --eval "(message \"done\")" 2>&1 | grep -i gptel
-
-Next step: check the installed gptel version (=(assq 'gptel package-alist)= or =M-x package-list-packages=), update gptel to >= 0.9.8, then re-evaluate gptel-magit activation. If gptel was pinned/held on velox, reconcile the pin against the gptel-magit dependency.
-
-** TODO [#C] Implement EMMS-free music-config architecture :refactor:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-01
-:END:
-*** 2026-05-15 Fri @ 19:17:01 -0500 Specification
-Implement the design in [[id:423bc355-18d3-4e39-9e7a-f768b865d95b][Design: music-config Without EMMS]].
-
-The implementation should make =music-config.el= load without EMMS, introduce
-package-owned playlist and track state, add a =cj/music-playlist-mode= view,
-and route playback through a small backend protocol with an initial =mpv=
-backend.  Preserve the current F10 and =C-; m= user workflows where practical,
-and keep M3U load/save/edit/reload plus radio station creation working.
-
-Complexity estimate: high.  This is a module rewrite with a new internal data
-model, package-owned playlist mode, backend protocol, mpv process management,
-and migration of existing EMMS-backed commands/tests.
-
-Time estimate: 2-4 focused days for an EMMS-free v1 with play/stop/next/previous,
-M3U persistence, playlist UI, and focused tests.  Add another 1-2 days if v1
-must include full mpv IPC support for pause, seek, and volume parity.
-
-Acceptance checks:
-- =music-config.el= can be required in batch with no EMMS package installed.
-- Existing focused music tests pass without EMMS preload or EMMS stubs except
-  where a compatibility adapter is explicitly under test.
-- New tests cover playlist state, backend command dispatch, M3U persistence,
-  and the EMMS-free load smoke path.
-
-*** TODO [#B] Pure helpers + state structs extraction :refactor:
-Lift EMMS-free pure code into standalone form: file validation, recursive
-collection, M3U parse/write, safe filenames, radio-station content, and
-URL/file track typing.  Introduce =cj/music-track= and =cj/music-playlist=
-cl-structs plus state-mutation helpers (=cj/music-playlist-*= predicates and
-setters).  Files: =modules/music-config.el=, possibly a new
-=modules/music-state.el= split.  Existing pure-helper tests should pass
-unchanged.
-
-Acceptance: structs defined, helpers callable in batch without EMMS loaded.
-
-Depends on: none (start here).
-
-*** TODO [#B] Backend protocol + fake test backend :refactor:test:
-Define the backend plist contract (=:available-p :play :pause :resume :stop
-:seek :volume :status :metadata=) and =cj/music-current-backend=.  Add
-=cj/music-state-change-functions= abnormal hook with the v1 event set
-(=started=, =paused=, =resumed=, =stopped=, =finished=, =error=,
-=playlist-changed=, =mode-changed=).  Create =tests/testutil-music-backend.el=
-exposing =cj/test-music-fake-backend= with an event ledger.
-
-Acceptance: fake backend installable in tests; ordered-event assertions work
-against a no-op playback flow.
-
-Depends on: pure helpers + state structs.
-
-*** TODO [#B] Read-side state API + characterization tests :test:refactor:
-Implement =cj/music-playing-p=, =cj/music-paused-p=, =cj/music-current-track=,
-=cj/music-playlist-state=, =cj/music-track-description=.  Before rewriting
-command bodies, add characterization tests against current behavior for
-=cj/music-next=, =cj/music-previous=, =cj/music-toggle-consume=,
-=cj/music-playlist-toggle=, =cj/music-playlist-load=, =cj/music-playlist-clear=
-so the migration has a safety net.
-
-Acceptance: read-side helpers covered; characterization tests green against
-the current EMMS-backed implementation.
-
-Depends on: backend protocol + fake test backend.
-
-*** TODO [#B] Playlist major mode + render-from-state :feature:
-Add =cj/music-playlist-mode= rendering the buffer as a view over
-=cj/music-current-playlist=.  Selected-track overlay + face, header reads
-package state, full keymap from design Section "Playlist Buffer" (RET/p, SPC,
-s, >/<, f/b, +/=/-, a, A, c/C, L/S/E/g, r/t/z/x, Z, i, o, q, S-up/down).
-Preserve the active-window background highlight.
-
-Acceptance: opening the playlist renders package state; reorder/shuffle/clear
-go through state mutations and re-render; tests cover header + overlay
-positioning.
-
-Depends on: read-side state API.
-
-*** TODO [#B] mpv backend implementation :feature:
-Implement =cj/music-mpv-*= backend functions.  Phase the work per migration
-plan §5: (a) process spawn, UID/PID-stamped socket under
-=temporary-file-directory=, stale-socket sweep, IPC connect via
-=make-network-process :family 'local=, state-hook plumbing.  (b) play/stop/
-next/previous + finished-track auto-advance with deliberate-stop tracking.
-(c) pause/resume, seek, volume over JSON IPC.  (d) metadata read on track
-start.  Add =cj/music-doctor= reporting platform capabilities; ship Windows
-degraded mode (play/stop/next/previous only via stdin/=call-process=).
-
-Acceptance: integration tests tagged =:slow= and skipped when =mpv= not on
-PATH; on Linux/macOS pause/seek/volume parity works; clean socket lifecycle
-across Emacs restart and exit.
-
-Depends on: backend protocol + fake test backend.
-
-*** TODO [#B] Command + Dired/Dirvish rewire :refactor:
-Migrate user-facing commands (=cj/music-play=, =cj/music-pause=,
-=cj/music-stop=, =cj/music-next=, =cj/music-previous=, seek/volume,
-random/repeat/consume/shuffle toggles) to operate on package state and call
-=cj/music-current-backend=.  Update Dired/Dirvish =+= add routing,
-M3U load/save/edit/reload, radio-station creation, F10 toggle, and =C-; m=
-keymap entries to drop EMMS symbols.  Migrate command-flow tests to the fake
-backend.
-
-Acceptance: full keymap functional end-to-end against the fake backend;
-characterization tests still green; Dirvish =+= add path covered.
-
-Depends on: playlist major mode + mpv backend.
-
-*** TODO [#B] EMMS removal + parity walk :test:
-Remove =cj/emms--setup=, the on-demand EMMS loader, and the =use-package emms=
-block.  Add the EMMS-free batch-load smoke test (=music-config.el= requires
-clean without EMMS installed).  Run the 22-step parity walk from design
-§"Parity Walk" against the new implementation; record measurements against
-the performance budget (1000-track load <500ms, reorder <50ms, IPC dispatch
-<100ms, header refresh <16ms) and note any deviations.
-
-Acceptance: =init.el= loads cleanly without EMMS; =make test= passes; parity
-walk recorded as a completion log entry under the parent task.
-
-Depends on: command + Dired/Dirvish rewire.
-
-** TODO [#C] Internet radio now-playing  song :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-11
-:END:
-Show the currently-playing song while streaming an internet radio station. Lives in =modules/music-config.el= (EMMS + MPV backend, M3U radio stations). The track title comes from the stream's ICY metadata — EMMS exposes it via =emms-track-description= / =emms-playing-time= and updates it on the metadata-change hook; MPV reports the ICY title too. Add an option to show the song in the minibuffer (e.g. echo on track change, or an on-demand command). Consider also a mode-line indicator as a second surface.
-
 ** TODO [#C] latexmk workflow never activates (two breaks) :bug:quick:solo:
 =modules/latex-config.el:66= — =:hook (TeX-mode-hook . ...)= gets use-package's =-hook= suffix appended (unbound symbol not ending in =-mode=), registering on nonexistent =TeX-mode-hook-hook=, so =TeX-command-default "latexmk"= is never set. Independently =:80= auctex-latexmk is =:defer t= with no trigger, so =auctex-latexmk-setup= never runs and "latexmk" isn't in TeX-command-list. Fix hook name to =TeX-mode=; change auctex-latexmk to =:after tex=. From the 2026-06 config audit.
 
-** TODO [#C] Localrepo Documentation :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-05
-:END:
-
-Audit on 2026-05-27 found the localrepo build half is shipped (=.localrepo/= holds 185 entries; =early-init.el= L135–165 wires the priority-200 pin above the local ELPA-mirror tier at 120–125 and the online fallback). The remaining "document limitations" half splits into one docs-set plus four gap-fix follow-ups that the docs cross-reference.
-
-Docs land in three artifacts. =docs/design/localrepo.org= carries the full architecture (tier model, install path, refresh story, all four limitations with pointers to the follow-up tasks). =.localrepo/README.org= sits next to the artifact as the user-facing entry — a short summary that survives even if =early-init.el= moves. =early-init.el= grows a commentary header that points at the README, not at the design doc — the README is what future-Craig hits first.
-
-The four limitations the docs cover (each spun out below as its own task):
-- Treesitter grammars (downloaded by =treesit-auto= on first use; not in the localrepo)
-- Native-comp =.eln= cache (Emacs-version-specific; invalidated by version bumps)
-- System-tool deps (=ripgrep=, =fd=, =pandoc=, =prettier=, =pyright=, etc.; flagged at load by =cj/executable-find-or-warn=, not packageable via =package.el=)
-- Refresh / update story (no dedicated script today; ad-hoc =cp= from the elpa mirrors)
-*** TODO [#C] Design doc — docs/design/localrepo.org
-Write the design doc: tier model, priorities, install path, refresh story, all four limitations with cross-links to the follow-up tasks below.
-*** TODO [#C] README — .localrepo/README.org
-Write the README at the artifact: short prose entry point summarizing the tier model, pointing at =docs/design/localrepo.org= for full detail. This is what =early-init.el='s commentary header links to.
-*** TODO [#C] Commentary header in early-init.el
-Add a Commentary-section header in =early-init.el= pointing at =.localrepo/README.org= for usage and =docs/design/localrepo.org= for architecture. Sits at the top of the localrepo block (around L130).
-** TODO [#C] Migrate from Company to Corfu (with prescient integration) :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-02
-:END:
-
-Spec: [[id:68733ba2-37a7-4a7b-bfaa-b845d82ff1e7][docs/specs/company-to-corfu-migration-spec.org]]
-
-*** TODO [#C] Install corfu-side packages
-Add corfu, cape, kind-icon, corfu-prescient to the package list. corfu-popupinfo ships inside corfu. Spec step 1.
-
-*** TODO [#C] Rewrite selection-framework.el company block as corfu/cape stack
-Replace the three company-* use-package blocks (lines 192-226) and company-prescient (240-243) with corfu / cape / corfu-popupinfo / kind-icon / corfu-prescient. Rename the section header Company → Corfu in the same change. Spec steps 2 + 8.
-
-*** TODO [#C] Swap mail-compose completion disable to corfu
-Rewrite cj/disable-company-in-mu4e-compose to (corfu-mode -1) across mu4e-compose, org-msg-edit, and message modes (mail-config.el:319-333). Spec step 3.
-
-*** TODO [#C] Drop company-ledger for ledger's built-in capf
-ledger-config.el: remove company-ledger; verify ledger-complete-at-point registers on completion-at-point-functions, add a ledger-mode-hook capf push only if it doesn't. Spec step 4.
-
-*** TODO [#C] Drop company-auctex for AUCTeX capf + cape-tex
-latex-config.el: remove company-auctex and (company-auctex-init); add cape-tex on TeX-mode-hook. Spec step 5.
-
-*** TODO [#C] Rewire eshell completion to pcomplete capf
-eshell-config.el:163-171: drop company-shell and the company-mode activation; add cape-capf-buster around pcomplete-completions-at-point + corfu-mode. Spec step 6.
-
-*** TODO [#C] Remove company-mode calls from prog-go/python/webdev
-Delete (declare-function company-mode ...) and (company-mode) from the three mode hooks; global-corfu-mode covers them. Spec step 7.
-
-*** TODO [#C] Uninstall company packages + recompile
-After the rewrite is green: package-delete company, -quickhelp, -box, -prescient, -ledger, -auctex, -shell; make clean && make compile. Spec step 9.
-
-*** TODO [#C] Tests: corfu activation, mail-disable, capf registration
-New tests/test-selection-framework-corfu.el and tests/test-mail-config-corfu-disable.el; update ledger/latex tests to assert their capf registers. Spec Testing section.
-
-*** 2026-05-16 Sat @ 11:07:24 -0500 Goals
-Drop-in replacement for the in-buffer completion stack: =company= →
-=corfu=, =company-quickhelp= → =corfu-popupinfo=, =company-box= →
-=kind-icon=, =company-prescient= → =corfu-prescient=, plus =cape= for
-the file/keyword/dabbrev capfs that =company-files= / =company-keywords=
-used to handle.  Per-module fixups for ledger, AUCTeX, eshell, mu4e
-compose, and the three =prog-*= modules.  See the design doc for the
-full translation table, migration steps, tests, and risks.
-
-** VERIFY [#C] music-config option-combination audit + tests :test:next:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-06
-:END:
-Deferred from the batch — this is a sizable test-writing audit (pairwise option combinations + new ERT coverage for music-config), better as its own focused /add-tests or /pairwise-tests session than crammed into a bug-fix sweep. No blocker; say the word and I'll run /pairwise-tests over the option space.
-
-Two-part task surfaced 2026-05-28 during the Signel verify walk — generalized from the "are there combinations of options that we'd want to disallow together" question.
-
-Part 1 — enumerate the configurable option surface of =modules/music-config.el=: every =defcustom=, every behavior toggle, every backend-selection variable, every cross-cutting flag (auto-play, repeat, shuffle, follow-cursor, side-window-height-fraction, etc.). Audit each option for valid value ranges. Capture the matrix in =docs/design/music-config-options.org= (or inline in the test file's header — judgment call when the matrix lands).
-
-Part 2 — combinatorial test coverage. Use the =/pairwise-tests= skill: identify parameters, value partitions, and inter-parameter constraints, build a PICT model, generate the minimal test matrix that hits every 2-way combination. For each problematic combination the matrix surfaces, decide: (a) validate at config-load time with a =user-error= that names the conflict, (b) runtime guard in the affected command, or (c) doc-only warning in the option's docstring. Disallow only the genuinely-broken pairs; doc-warn the merely-confusing ones.
-
-The recent F10 side-window-height-fraction work and the EMMS-free refactor candidate ("Implement EMMS-free music-config architecture" above) are both natural near-term touchpoints — best to land this audit before the EMMS swap so the new architecture inherits a clean option spec.
-
 ** TODO [#C] Org-noter custom workflow — fix and finish :feature:bug:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-02
@@ -4120,16 +4403,6 @@ The core functionality is implemented but needs debugging before it's production
 3. Refine toggle behavior based on testing
 4. Document the final keybindings and workflow
 
-** VERIFY [#C] page-signal pager account deregistered — re-registration needs your hands
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-12
-:END:
-Reported by .emacs.d 2026-06-12 01:01: the dedicated pager number (+15045173983, the Claude Pager Google Voice number on signal-cli) returns "User ... is not registered" on every send — Signal appears to have deregistered it (GV numbers get periodically re-verified). Re-registration requires captcha/SMS, which only you can do. Until then every page-signal call fails; .emacs.d's config-audit page fell back to email. Wrapper lives at claude-templates/bin/page-signal.
-
-** VERIFY [#C] Palette-columns spec review
-SCHEDULED: <2026-06-12 Fri>
-Read [[file:docs/theme-studio-palette-columns-spec.org][docs/theme-studio-palette-columns-spec.org]] (Draft, from the 2026-06-10 design discussion) and bless or amend. Decisions 9 and 10 are the two session calls awaiting your word: strips flip to lightest→darkest top→bottom to match the dropdown, and each dropdown column run places the base at its natural lightness position (vs bg/fg bases leading before any steps). On "spec's good": mark Ready, file the phase breakdown, cancel the [#C] hint-override task, start Phase 1.
-
 ** TODO [#C] Pick and wire a debug backend for F5 :feature:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-01
@@ -4154,14 +4427,6 @@ Evaluate against these projects' languages: elisp (edebug already works), Python
 
 Do this after the F-key rework ticket ships so F5 is the only hole left.
 
-** VERIFY [#C] Pull a fullscreen terminal window away with C-; b + arrow :feature:next:
-Needs from Craig: confirm the intended behavior. When a terminal fills the frame, C-; b + arrow should "pull a window away" — split off a new window in the arrow's direction and move focus there? Or pop the terminal out and restore the prior layout? The C-; b window family exists (resize lives there); I need the exact gesture + target before wiring it.
-When a terminal fills the frame, =C-; b= then a right or down arrow should shrink the window from that edge, reducing its width or height so another buffer can share the screen without leaving the terminal. Relates to the ai-term adaptive placement and unified-popup tasks. From the roam inbox.
-
-** VERIFY [#C] Remove unused system-power keybindings :refactor:quick:next:
-Needs from Craig: the task says "confirm the exact set to keep before unbinding." Under C-; ! the bindings are shutdown (s), reboot (r), restart-Emacs (e), and friends. Tell me which to keep bound and which to drop (the completing-read menu still reaches the rare ones), and I'll unbind the rest.
-=modules/system-commands.el= binds shutdown (=C-; ! s=), reboot (=C-; ! r=), restart-Emacs (=C-; ! e=) and friends under the =C-; != prefix. Craig rarely uses them and wants the key real-estate back. Drop the bindings he doesn't use; the completing-read menu can still reach the rare ones. Confirm the exact set to keep before unbinding. From the roam inbox.
-
 ** TODO [#C] Review and rebind M-S- keybindings :refactor:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-06-01
@@ -4195,77 +4460,6 @@ These may override useful defaults - review and pick better bindings:
 :END:
 Display slack.el message and thread buffers in a dedicated popup window (side or bottom) and reuse that one window instead of spawning a new window per buffer. Likely a =display-buffer-alist= rule (or popper integration) in =modules/slack-config.el=.
 
-** TODO [#C] Terminal GPG pinentry Completion :feature:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-05
-:END:
-
-Audit on 2026-05-27 found no trace of the =terminal-pinentry= branch on this machine: no local or remote ref, no reflog entry across 732 entries reaching back through January, no stash, no dangling commit, no sibling worktree. The 2026-01-24 session log says the branch was created that day, but the work either lived on another machine or was deleted before reaching here. The original task above (=Finish terminal GPG pinentry configuration=) is superseded by this one.
-
-Surviving footprint on this machine: one commented line at =modules/auth-config.el:83= (=;; (setq epa-pinentry-mode 'loopback)=). The hook point =env-terminal-p= exists in =modules/host-environment.el:97=. Everything else (terminal-vs-GUI branching in the epa =:config=, external pinentry wiring for GUI, =GPG_TTY= export, tests) is to be written fresh off main.
-
-Goal: in terminal Emacs, GPG passphrase prompts land in the minibuffer via loopback mode; in GUI Emacs, prompts go to the existing external pinentry.
-
-Open: confirm the GUI pinentry tool (2026-01-24 notes named =pinentry-dmenu=; current =auth-config.el= names no pinentry program, leaving it to =gpg-agent='s config). Also worth checking whether the =terminal-pinentry= branch survives on the laptop and should be pulled here rather than rewritten.
-
-*** TODO [#C] env-terminal-p branch in epa :config :feature:
-Inside the epa =use-package= =:config= in =modules/auth-config.el=, set =epa-pinentry-mode= to ='loopback= when =(env-terminal-p)=, else leave the external pinentry path active. Replace the lone commented line at =auth-config.el:83=.
-
-*** TODO [#C] GPG_TTY export for terminal sessions :feature:
-When =(env-terminal-p)=, =(setenv "GPG_TTY" (shell-command-to-string "tty"))= so gpg-agent can target the controlling tty. Guard against a non-tty stdin.
-
-*** TODO [#C] gpg-agent updatestartuptty refresh in terminal :feature:
-The current =call-process= to "gpg-connect-agent updatestartuptty /bye" runs unconditionally; keep it for GUI, and re-fire it on terminal entry so the agent re-binds to the current tty.
-
-*** TODO [#C] ERT tests for terminal vs GUI pinentry branching :test:
-Test that with =env-terminal-p= stubbed t, =epa-pinentry-mode= resolves to ='loopback= after =auth-config= loads; with it stubbed nil, the loopback setting is not applied. Use =cl-letf= around =env-terminal-p=; cover normal, boundary (=epa= already loaded), error (=gpg-connect-agent= missing).
-
-*** TODO [#C] Minibuffer prompt in real terminal Emacs
-=emacs -nw=, open an encrypted file or trigger an auth-source decrypt, confirm the passphrase prompt lands in the minibuffer rather than failing on missing pinentry.
-
-*** TODO [#C] External pinentry still fires in GUI Emacs
-Restart the daemon, open a GUI frame, trigger an encrypted decrypt, confirm =pinentry-dmenu= (or whatever GUI pinentry is configured) still appears.
-
-*** TODO [#C] Archive the original L3813 task
-After this work lands, mark the original "Finish terminal GPG pinentry configuration" task DONE with a =CLOSED:= stamp and a one-line note pointing at this parent task.
-
-** TODO [#C] theme-studio: break org-mode preview into grouped subsections :feature:studio:
-Rather than cramming all org-mode preview into one pane, split into groups so each element is shown in a common, context-rich environment. From the roam inbox.
-** TODO [#C] theme-studio: converter drops :inherit on UI faces :bug:studio:
-build-theme.el's UI tier passes inherit=nil to --attrs, so a UI face that relies only on its inherit field (no explicit fg/bg) loses the inheritance in the generated theme, while the studio preview shows the inherited color via resolveUiAttr. The package tier already emits :inherit; the UI tier should match. Surfaced while diagnosing why mode-line-inactive looked off in Emacs versus the preview (that case had explicit colors and turned out to be a stale deploy, but the inherit gap is real for any inherit-only UI face).
-** TODO [#C] theme-studio: elfeed ignores theme assignments :studio:studio:
-The preview shows theme colors, but elfeed itself renders all-white with no variation. Note: this may be the shr-rendered entry/article view (elfeed-show), where color often comes from the document rather than the theme — confirm whether the symptom is in the search list or the article view. From the roam inbox.
-** VERIFY [#C] theme-studio face-consistency check :feature:studio:next:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-10
-:END:
-Needs from Craig: this is an open-ended feature, not a bug — it needs a spec first (what "consistency" means: which faces are compared, what rule flags an inconsistency, how it's surfaced in the UI). Give me the check's definition (or say "brainstorm a spec") and I'll build it; parked until then.
-Rule taxonomy captured in [[file:docs/design/theme-studio-face-rules.org][docs/design/theme-studio-face-rules.org]] (Design Rules vs Fidelity Rules). The two checks below map to those two rule kinds. Both surface structural-attribute (weight/slant/underline/box/overline/height) issues; color is the theme's design and out of scope.
-
-1. Theme cross-cutting consistency (primary, per Craig 2026-06-09): the theme has deliberate cross-cutting rules — e.g. headings/titles are bold, links are underlined, errors/warnings/success are bold. Flag where the theme BREAKS ITS OWN rule (a heading that isn't bold, a link that isn't underlined). The designer declares the rules; the check finds the violators. This is the "tell me where I broke the rule" guardrail.
-
-2. defface-baseline divergence (secondary): flag where a face's structural attrs differ from its package =defface= so each divergence is deliberate, not an accidental drop. Would have caught the dropped underline/bold defaults and the contradictions (shr-h3 bold-vs-italic, erc-action italic-vs-bold) from the package-face audit as they were introduced.
-
-Bake into the tool (a lint surfaced in the UI) or run as a build-time check (seeds vs live deffaces via emacsclient).
-
-** DONE [#C] theme-studio picker panel blends into the page :bug:quick:solo:studio:
-CLOSED: [2026-06-16 Tue]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-06-11
-:END:
-Craig, 2026-06-11 manual-test walk: the color picker's background is hard to distinguish from the page background. Give the picker panel a visibly distinct background or a highlighted border so it stands out. Pin with a gate asserting the picker element carries the distinct style.
-Done 2026-06-16: the picker now carries the gold accent border (#e8bd30) and a lighter background (#1f1c19 vs the page's #0d0b0a). The #pickertest gate asserts the accent border and a per-channel background lift of ≥12 over the page, so the distinction can't silently regress.
-
-** TODO [#C] theme-studio: restrict the cursor row to its background :bug:studio:
-The UI table gives the cursor face the full control set (fg, B/I/U/S, box), but Emacs only honors the cursor face's :background. Its shape is cursor-type, not a face attribute, so every other control on that row is a no-op once the theme loads. Restrict the cursor row to just its background swatch so the studio doesn't present controls Emacs drops.
-** TODO [#C] theme-studio terminal/ANSI colors :feature:studio:
-theme-studio represents GUI faces only; terminal colors aren't surfaced at all. Scope decided 2026-06-09: GUI-first faces, NOT full per-face display-class fallback. Two pieces:
-
-1. ANSI-16 panel. Map the 16 ANSI slots (black/red/green/yellow/blue/magenta/cyan/white + bright variants) to palette colors, with a preview, and export them so =build-theme.el= emits the =ansi-color-*= / =term-color-*= faces. This matters even in pure-GUI Emacs: colored shell output, compilation buffers, eshell, and vterm/eat all draw from these. Signals must line up with their ANSI slot (error red→ansi red, success→green, warning→yellow, info/link→blue) so a signal reads the same in a terminal.
-
-2. Core-face 16-color fallback. Only the ~10 faces that decide console legibility get a =(((class color) (min-colors 16)) ...)= clause plus a =(t ...)= floor: default/fg, bg, keyword, string, comment, constant, error, warning, region, mode-line, line-number. Tune these for contrast — push it UP, legibility over fidelity, because the only 16-color target is the bare Linux virtual console (an occasional emergency context). The long tail stays GUI-first and auto-approximates.
-
-Why this scope: the GUI and the normal terminal (foot + tmux, truecolor / ≥256-color) both render the GUI hexes fine; GUI-first is correct there. Only the Linux VT is 16-color, and a low-contrast palette approximates badly down to 16 — so a few core faces get a deliberately higher-contrast 16-color fallback rather than every face carrying a multi-spec. Tool work: the ANSI-16 panel + a flag on the core faces to also capture a 16-color value; =build-theme.el= emits multi-spec only for those. Full per-face fallback is revisited only if console work becomes regular.
 ** TODO [#C] the preview splits an already split window into 3 temporarily. :bug:
 looks strange. potentially problematic for ai-terms.
 
@@ -4322,7 +4516,7 @@ Findings from the 2026-05-20 investigation:
   navigation commands.
 - Live experiment scratch file: =~/dashboard-overscroll-experiment.el=.
 
-** Emacs Packages — Curl-Friendly Web Service Wrappers
+** TODO [#D] Emacs Packages — Curl-Friendly Web Service Wrappers
 Ideas for new Emacs packages following the same pattern as wttrin: HTTP GET to a simple web service, render results in a buffer, optionally show summary in the mode-line. All of these share the async fetch + caching infrastructure already proven in wttrin.
 Captured On: [2026-04-04 Sat]
 *** TODO Stock Market / Finance Package (Finnhub or Alpha Vantage)
@@ -4576,218 +4770,12 @@ The individual queries are trivial. The interesting work is building a clean mul
 
 **** Effort: Medium
 If building from scratch. Low if extending or wrapping an existing package. The completion UX is where the effort goes.
-** TODO [#D] Face diagnostic popup — theme-studio bridge (vNext) :feature:
-vNext for the face/font diagnostic tool: interactivity — "send this face to theme-studio", jump-to-theme-spec, any write path. Deferred per [[id:98f065cf-8bd5-46a0-ac24-da94d66855ad][the spec]]'s scope tiers.
 ** TODO [#D] Localrepo refresh / update script :feature:
 No dedicated update path today — refreshing a pinned package means ad-hoc =cp= from the local elpa mirrors. Document the current shape and decide whether a =scripts/refresh-localrepo.sh= is worth writing. Cross-linked from =docs/design/localrepo.org=.
 
-** TODO Manual testing and validation
-Exercised once the phases above land.
-*** VERIFY mu4e buffers are themed (headers, main, message view)
-What we're verifying: with the mu4e modes excluded from global font-lock, mu4e's manual face properties survive, so the buffers pick up the theme. The headers + main + view-headers are the ones global font-lock was stripping.
-- Restart Emacs (cleanest), or kill and reopen the mu4e buffers
-- Open mu4e, look at the headers list and the main menu
-- Open a message and read the body
-Expected: headers list shows unread/flagged/date/subject in their theme colors (mu4e-unread-face gold, mu4e-header-face green, etc.); the main menu and the message-view headers (From/To/Subject) are themed; the message body still renders correctly (gnus does the body, so it's unaffected). NOTE: a plain "g" refresh in an already-open *mu4e-headers* won't fix it on its own unless font-lock is off there; a restart is the reliable check.
-*** VERIFY C-c ; reaches the custom command family in a real terminal frame
-What we're verifying: the TTY mirror prefix C-c ; reaches the same cj/custom-keymap as the GUI C-; prefix, so the whole command family works in a terminal. The unit tests + a live daemon eval already confirm both prefixes resolve to the one keymap; this is the end-to-end in an actual TTY frame, which the batch harness can't drive.
-- Open a terminal Emacs frame: emacsclient -nw (or emacs -nw, or Emacs inside vterm/tmux)
-- Press C-c ; L (pearl), C-c ; a (AI), C-c ; g (calendar) — the same leaf keys you use under C-; in GUI
-- Confirm which-key shows the custom prefix under C-c ;
-Expected: each C-c ; <leaf> runs the same command its C-; <leaf> counterpart runs in GUI; which-key lists the family under C-c ;. C-; itself stays working in GUI frames (unchanged).
-*** VERIFY theme-studio gnus view package themes the article headers
-What we're verifying: gnus is now its own view package in theme-studio (it drives the mu4e article view), so the bright-green article headers can be themed and exported. #gnustest confirms the package is registered and its preview emits only real gnus faces; this is the visual read plus the live-green retirement.
-- Reload theme-studio (or make theme-studio-open)
-- Pick "gnus (mu4e article view)" from the view dropdown (sits among the g entries)
-- Confirm the preview shows a header block, an emphasized body, an 11-level quoted reply chain, and a signature
-- Theme a few gnus faces (e.g. gnus-header-name, gnus-header-from, gnus-cite-1) to obvious colors, export to WIP.json, then deploy
-#+begin_src sh :results output
-make -C /home/cjennings/.emacs.d deploy-wip
-#+end_src
-- Restart Emacs (or reload the theme), reopen a mu4e message
-Expected: the studio preview renders each gnus face in its theme color; after export + deploy, the *mu4e-article* From/Subject/To/Date headers show the themed colors instead of the gnus green defaults.
-*** VERIFY theme-studio markdown preview reads like a real README
-What we're verifying: selecting markdown-mode in the view dropdown shows a realistic README (not the generic face-name list), and the markdown faces render legibly in context. #mdtest already confirms the wiring + that every element's face is real; this is the visual read.
-- Reload theme-studio (or make theme-studio-open)
-- Pick "markdown-mode" from the view dropdown
-Expected: a README preview with headers, bold/italic, code, links, lists/checkboxes, blockquote, table, etc., each in its theme face. Clicking an element flashes its row in the faces table.
-*** VERIFY dashboard theming — banner gold, headings themed, items show per-filetype icons
-What we're verifying: with the dashboard out of global font-lock (Fix A) and file icons on (Fix C), the live dashboard shows the theme colors and icons. Eyeball it.
-- Open the dashboard (F1)
-Expected: the "Emacs:" banner title is gold, the "Projects:/Bookmarks:/Recent Files:" headings are themed blue, and the project/recent-file rows each show a colored per-filetype icon (org files greenish, dirs yellow; bookmarks a plain icon).
-*** VERIFY gptel C-; a B switches model without the modeline hang
-What we're verifying: cj/gptel-switch-backend (C-; a B) now sets gptel-model to an interned symbol, so the switch completes without the wrong-type-argument-symbolp redisplay hang. Unit tests + a live helper eval already cover the coercion; this is the interactive end-to-end.
-- Invoke cj/gptel-switch-backend (C-; a B)
-- Pick a backend, then a model from its list
-Expected: the modeline updates to the chosen model and Emacs stays responsive — no "Querying ..." hang, no wrong-type-argument backtrace.
-*** VERIFY org-faces color set in theme-studio reaches the agenda
-What we're verifying: editing an org-faces-* row in theme-studio, exporting, and deploying lands the new color on the real agenda's keyword/priority. The build-theme -> deftheme half and the live org-todo-keyword-faces / org-priority-faces wiring are already verified mechanically; this confirms the visual end-to-end with a human eye.
-- Open theme-studio in Chrome and pick "org-faces" from the application dropdown (it sits beside elfeed and mu4e)
-- Confirm the preview shows the focused agenda block over the auto-dim block, and that the rows read "todo", "priority a", etc.
-- Edit org-faces-todo to an obviously different color (e.g. bright magenta) and export the theme to WIP.json
-#+begin_src sh :results output
-make -C /home/cjennings/.emacs.d deploy-wip
-#+end_src
-- Open the org agenda (or any todo.org buffer) and look at a TODO keyword
-Expected: the TODO keyword renders in the color just set; the priority cookies and other keywords keep their own colors; an unfocused window shows the dimmed variants.
-*** VERIFY slack keys are safe before slack loads
-What we're verifying: the C-; S slack keys don't error before slack has started, and the prefix shows in which-key. Fixed in modules/slack-config.el; restart to apply (not reloaded into the live session).
-- Restart Emacs but do NOT run cj/slack-start
-- Press C-; S Q (close all), and C-; S w / @ / # (these previously void-function'd or void-variable'd before load)
-- Press C-; S and check which-key shows the "slack" prefix
-Expected: C-; S Q reports "Closed 0 Slack buffers" with no error; w/@/# either run or autoload slack cleanly (no void-function); the which-key popup lists the slack prefix.
-*** VERIFY ERC fires one mention notification and lists real servers
-What we're verifying: a mention pops a single desktop notification (not two), and cj/erc-connected-servers lists only live server connections. Fixed in modules/erc-config.el; takes effect after an Emacs restart (not reloaded into the live IRC session).
-- Restart Emacs and reconnect ERC
-- Have someone mention your nick in a channel (or trigger erc-text-matched-hook)
-- Run M-x cj/erc-connected-servers with one server connected and a few channels open
-Expected: exactly one desktop notification per mention; cj/erc-connected-servers reports just the connected server(s), not every channel/query buffer.
-*** VERIFY modeline still shows the git branch and state
-What we're verifying: the VC-cache simplification didn't change what the modeline shows on a normal repo. Fixed in modules/modeline-config.el (live in the daemon after reload).
-- Open a file inside a git repo
-- Glance at the mode-line VC segment
-Expected: the branch name and state still render as before (e.g. "main" with the usual state face). The change only drops a per-render stat and guards against git errors; normal display is unchanged.
-*** VERIFY info-mode open is non-destructive and cancels cleanly
-What we're verifying: opening a .info file no longer auto-kills the buffer, and the explicit cj/open-with-info-mode prompt cancels cleanly on decline. Fixed in modules/help-config.el; stale daemon state already cleared, so this also survives a fresh restart.
-- find-file a .info file (e.g. one under elpa) — it should open as an ordinary buffer, not vanish into Info
-- In that buffer, edit something, then M-x cj/open-with-info-mode; at the save prompt answer no
-- Repeat M-x cj/open-with-info-mode on an unmodified .info buffer
-Expected: find-file leaves the buffer intact (no auto-kill); declining the save prompt prints "Operation canceled" with no "No catch for tag" error; on an unmodified buffer it opens the file in Info.
-*** VERIFY dwim-shell zip/backup/menu-key behave
-What we're verifying: single-file zip makes a valid <name>.zip, the dated backup gets a real timestamp, and the dwim-shell menu is reachable on M-D in plain dired. Fixed in modules/dwim-shell-config.el, reloaded into the daemon.
-- In dired, mark a single file, run the dwim-shell menu (M-D), pick Zip
-- Mark a file, run the menu, pick "Backup with date"
-- Open a plain dired buffer (not dirvish) and press M-D
-Expected: zip produces foo.zip (a valid archive, openable); backup produces foo.ext.YYYYMMDD_HHMMSS.bak with a real date; M-D opens the dwim-shell command menu in plain dired (before the fix it did nothing there).
-*** VERIFY markdown live preview renders in the browser
-What we're verifying: F2 in a markdown buffer runs the custom cj/markdown-preview (not markdown-mode's own command) and the impatient-mode strapdown preview actually renders. Fixed in modules/markdown-config.el, reloaded into the daemon.
-- Open a .md file with some markdown content
-- M-x cj/markdown-preview-server-start (starts simple-httpd on :8080)
-- Press F2 in the markdown buffer
-Expected: a browser opens http://localhost:8080/imp showing the rendered markdown, and edits to the buffer update the preview live. Pressing F2 before starting the server gives a user-error telling you to start it.
-*** VERIFY orderless matching works inside a vertico session
-What we're verifying: vertico-prescient no longer overrides completion-styles, so orderless's space-separated, out-of-order matching is live in the minibuffer (prescient still sorts). Fixed in modules/selection-framework.el, applied live in the daemon.
-- Run a command with a vertico minibuffer (e.g. M-x, or C-x b)
-- Type two space-separated fragments out of order, e.g. "mode buf" to match "switch-to-buffer-other-... mode" style candidates
-Expected: candidates match on both fragments regardless of order (orderless), and the ordering still reflects prescient frecency. Before the fix, space-separated out-of-order input would not match.
-*** VERIFY C-; b d diffs, C-; b D deletes
-What we're verifying: the buffer-and-file keymap now puts diff on the easy lowercase key and the destructive delete on the capital. Swapped in modules/custom-buffer-file.el and re-bound live in the daemon.
-- Open a file buffer and edit it without saving
-- Press C-; b d
-- Press C-; b D, then cancel at the delete confirmation
-Expected: C-; b d runs the diff (buffer vs saved file); C-; b D starts delete-buffer-and-file (offers to delete the file). Before the swap these were reversed.
-*** TODO C-s C-s repeats the last search
-What we're verifying: the second consecutive C-s repeats the previous consult-line search instead of erroring "No Vertico session". Fix in modules/selection-framework.el (vertico-repeat-save now on minibuffer-setup-hook), live in the daemon.
-- Press C-s, type a search term, RET to dismiss (or just narrow then exit)
-- Press C-s again, then C-s a second time without any command in between
-Expected: the second C-s reopens the last search (vertico-repeat) rather than signalling "No Vertico session".
-*** TODO reconcile-open-repos includes dot-named repos
-What we're verifying: M-P (reconcile open repos) now visits repos whose directory name has a dot (mcp.el, capture.el, etc.), which the old "^[^.]+$" filter silently skipped. Fix in modules/reconcile-open-repos.el, live in the daemon; live-daemon check already confirmed discovery, this is the through-the-command spot-check.
-- Run M-P (or M-x cj/reconcile-open-repos)
-- Watch the per-repo progress / final summary
-Expected: dot-named repos under ~/code (mcp.el, gptel-mcp.el, capture.el, google-contacts.el, …) appear in the reconciliation pass, not just dot-free ones.
-*** 2026-06-15 Mon @ 12:10:06 -0500 org-capture popup single-Task into inbox verified
-Craig confirmed: Super+Shift+N pops straight into a Task capture (no menu), single full-frame window, files under "Inbox" in ~/org/roam/inbox.org, and the frame closes cleanly. Passed.
-*** TODO Lock screen actually locks on Wayland
-What we're verifying: C-; ! l locks the screen on Wayland. slock (X11-only) never worked here; the locker now runs loginctl lock-session, which logind turns into a Lock signal that hypridle handles by running hyprlock — the same path idle/sleep locking already uses. Fix in modules/system-commands.el, live in the daemon.
-- Press C-; ! l (or run M-x cj/system-cmd-lock)
-- The screen should lock with hyprlock
-- Unlock with your password
-Expected: the screen locks immediately and unlocks with your password. (Before the fix it printed "Running lockscreen-cmd..." and nothing happened.)
-*** TODO Irreversible actions require a typed "yes" after a daemon restart
-What we're verifying: the strong-confirm tier is restored for irreversible actions. The global (fset 'yes-or-no-p 'y-or-n-p) was removed and those sites now call cj/confirm-strong, which forces a typed "yes"/"no". The fset is baked into the running daemon and can't be cleared from Lisp, so this only takes effect after a restart. Ordinary yes-or-no-p prompts stay single-key (use-short-answers t).
-- Restart the Emacs daemon (clean state)
-- Trigger an irreversible action, e.g. M-x cj/system-cmd-shutdown (then abort), or attempt to overwrite a file via the rename/move commands
-Expected: the irreversible prompt requires typing the full word "yes" (not a single y); a benign yes-or-no-p prompt elsewhere still accepts a single keystroke.
-*** 2026-06-11 Thu @ 18:29:39 -0500 Verified UI-face preview and contrast survive a ground bg change
-Craig walked the repro: mode-line with its own fg/bg kept its preview bg and ratio through a ground change; ground-dependent rows re-rated; package-faces contrast column updated. Pass. Closed the [#A] contrast-cell and [#B] preview-bg parents.
-*** 2026-06-11 Thu @ 18:29:39 -0500 Verified seeded package-face defaults, with steel tuning
-Craig read org/magit/elfeed against the ground. Pass with tuning: steel reads a bit dark — flipped to steel+1 on magit (better), but org wanted darker; these are updated selections, NOT final — he expects to adjust many more before the theme ships. His export saved to scripts/theme-studio/theme.json (replaced the 2026-06-09 state, prior version in git at 4f2d00eb). Side find: the org preview's heading-three ↔ headline-todo flash linkage is cross-wired — filed as its own bug task.
-*** 2026-06-11 Thu @ 18:29:39 -0500 Verified large face tables stay usable
-Craig scrolled the org table, filtered on "agenda", reassigned a face — grouping, narrowing, and live preview update all behaved. Pass.
-*** 2026-06-11 Thu @ 18:29:39 -0500 Verified perceptual readouts in the picker
-Craig validated the readouts against computed reference values (default fg #f0fef0 on ground #000000: APCA Lc -104.7 / WCAG 20.14; keyword blue #67809c: Lc -33.7 / WCAG 5.14 — negative polarity correct for light-on-dark). Legible, uncrowded. Pass. Side find filed separately: the picker panel itself blends into the page background ([#C] picker-visibility task).
-*** 2026-06-11 Thu @ 18:29:39 -0500 Verified ΔE warnings read clearly
-Craig built a near-duplicate pair and a well-spread palette: the close pair was named with its ΔE, sorted closest-first with the cap behaving; no warning on the spread palette. Pass.
-*** TODO OKLCH editor feels right
-What we're verifying: the OKLCH sliders / C×L plane edit cleanly and clamping is visible.
-- Switch the picker to OKLCH mode and drag L, then C, then H
-- Push chroma past the sRGB gamut, then toggle the AA/AAA mask
-Expected: each axis moves independently; the C×L plane (once 4b lands) opens on the current color; "chroma clamped to sRGB" shows on clamp; toggling the mask does not reset OKLCH mode.
-*** TODO Generated ramp harmonizes
-What we're verifying: a ramp generated from a base color reads as one family, not a grab-bag (the aesthetic the math is meant to produce).
-- Open =scripts/theme-studio/theme-studio.html= in Chrome
-- Pick a mid-lightness base swatch (e.g. a blue) and generate its ramp at the defaults
-- Read the row of steps left to right, then try a near-black and a near-white base
-Expected: the steps share an obvious hue and step evenly in lightness; the chroma-ease keeps the extreme steps from going muddy or garish; nothing looks like it belongs to a different color.
-*** TODO Safe-lightness guidance reads clearly
-What we're verifying: the L_max marker and unsafe-band shade are legible and land in the right place when editing a covered face.
-- Open the picker in OKLCH mode on region (or hl-line), with syntax colors assigned
-- Read the L_max marker and the shaded unsafe band on the lightness slider
-- Drag lightness up toward and past the marker
-Expected: the marker is visible and correctly placed, the band above it reads as "unsafe," and crossing it is obvious; an out-of-scope face shows no marker.
-*** TODO Safe tint actually reads in real Emacs
-What we're verifying: a background tint the tool calls safe really keeps every token readable behind real syntax-colored text — the whole point of the worst-case floor.
-- In the tool, set a covered face (e.g. region) to a tint at or just below its L_max with the worst-case readout showing PASS
-- Build the theme and load it in Emacs, open a code buffer with varied syntax, and select a region spanning many token colors
-- Read every token through the region highlight, paying attention to the limiting foreground the tool named
-Expected: every token stays readable over the tint, including the limiting one; a tint pushed just past L_max (readout FAIL) shows a visibly strained or unreadable token, confirming the floor matches reality.
-*** TODO Color families group the way the eye reads them
-What we're verifying: the OKLCH hue clustering (25° gap) splits and merges families the way you'd expect, and renaming never moves a color.
-- Open =scripts/theme-studio/theme-studio.html= in Chrome and load a real theme (e.g. sterling)
-- Read the strips top to bottom: are "the blues" one strip, "the greens" another, neutrals and ground pinned at the top
-- Find a pair you'd consider one family that landed in two strips (or two you'd consider separate that merged)
-- Rename any swatch to something absurd and confirm it stays in the same strip
-Expected: families match your mental grouping; the few that don't are the cue to revisit the 25° gap; renaming never regroups.
-*** TODO Regenerate-replace reads as deliberate
-What we're verifying: the count control clearly signals it rewrites the whole family, so replacing hand-added same-hue colors isn't a surprise.
-- Add two unrelated colors at a similar hue so they share a strip
-- Set that strip's count to 2
-- Watch what happens to the two colors
-Expected: the strip becomes a clean base±2 ramp, the two loose colors are gone, and the control made it obvious that's what it would do before you committed.
-*** TODO Removed-step references read clearly as "(gone)"
-What we're verifying: lowering a family's count leaves a referencing face visibly stale, not silently re-pointed.
-- Assign a UI or syntax element to an outer step of a family (e.g. region = a blue+3)
-- Lower that family's count to 2 so blue+3 disappears
-- Read the assignment's dropdown
-Expected: the dropdown shows "(gone)" for the removed step, never a silent jump to a different color; re-pointing it is a deliberate choice.
-*** TODO Calibre bookmark default name is "Author, Title"
-What we're verifying: a new nov bookmark takes the "Author, Title" form parsed from the filename, not the raw EPUB filename.
-- Open an EPUB in Calibre (nov buffer).
-- Hit m to set a bookmark.
-Expected: the default bookmark name is "Author, Title" (underscores stripped, colon restored), e.g. "Agatha Christie, The A.B.C. Murders".
-
-*** TODO Calibre curated ? menu and docked description
-What we're verifying: the curated ? transient, the docked description, and the full dispatch all work in a live calibredb buffer.
-- In a calibredb search buffer, press ? and confirm the curated menu (library / filter / sort / open / describe) appears.
-- Press d or v to dock the selected book's description in a bottom-30% buffer; press q to dismiss it.
-- Press H and confirm calibredb's full dispatch opens.
-Expected: ? shows the curated menu, d/v dock the description (q dismisses), H opens the full calibredb dispatch.
-
-*** TODO Signel: real incoming message raises a toast through the notify script
-What we're verifying: the full receive path (signal-cli → signel --handle-receive → cj/signel--notify → notify script) fires on a real message.
-- Make sure you are NOT viewing the sender's chat buffer.
-- Have a real message sent to you on Signal (or send one from your phone to a second device thread that lands here).
-Expected: a transient info toast titled "Signal: <sender>" with the message text (one line, truncated if long), no sound.
-
-*** TODO Signel: actively-viewed chat stays quiet
-What we're verifying: the suppression predicate gates the toast when you're reading that chat.
-- Open the sender's chat buffer (=C-; M m=) and keep it the selected window in a focused frame.
-- Have the same sender message you again.
-Expected: the message renders in the buffer, but no desktop toast appears.
-
-*** TODO Project-aware capture files into the right todo.org
-What we're verifying: C-c c t and C-c c b file into the current projectile project's todo.org under its "<Project> Open Work" header, and fall back to the global inbox outside a project.
-- Inside a projectile project that has a todo.org, run C-c c t (Task), capture a test entry, and confirm it lands under "<Project> Open Work".
-- Run C-c c b (Bug) similarly and confirm it lands as "* TODO [#C] ..." under the same header.
-- Run a capture from outside any project (or a project with no todo.org) and confirm the global-inbox fallback with a warning.
-Expected: in-project captures land in that project's Open Work; out-of-project captures fall back to the global inbox with a warning.
-
 ** TODO [#D] Native-comp .eln cache strategy :feature:
 The native-comp =.eln= cache is Emacs-version-specific; an Emacs upgrade invalidates everything. Document the cache location, what an upgrade triggers, and whether a warm-the-cache script is worth shipping. Cross-linked from =docs/design/localrepo.org=.
 
-** TODO [#D] org-faces: dim variants and retire dupre-org-* :feature:theme-studio:
-vNext from the org-faces spec: org-faces-*-dim variants wired into auto-dim so keywords stay legible in unfocused windows, and migrate or retire the legacy dupre-org-* set. [[id:35578114-8c29-43af-97a2-fdfea01a802e][org-faces-spec-implemented.org]]
 ** TODO [#D] Polish reveal.js presentation setup :feature:
 
 Three small reveal.js improvements; collected into one task because each on its own is too small to track separately.
@@ -4799,15 +4787,9 @@ Three small reveal.js improvements; collected into one task because each on its
 ** TODO [#D] System-tool dependency install script :feature:
 =ripgrep=, =fd=, =pandoc=, =prettier=, =pyright=, and other binaries that =cj/executable-find-or-warn= flags at module load are not in =package.el='s reach. Document the required-tool set and ship a setup script (or =pacman=/=apt= invocation set). Cross-linked from =docs/design/localrepo.org=.
 
-** TODO [#D] theme-studio CIEDE2000 DeltaE option :feature:studio:
-Deferred from the perceptual color metrics spec (vNext). v1 uses DeltaE-OK on its native scale with a 0.02 threshold (decided); revisit CIEDE2000 only if the native OKLab scale proves too unfamiliar or poorly calibrated for palette distinguishability. Spec: [[id:15db8ae3-fc14-49f3-9ed5-d5ff59790904][spec]] (vNext candidates; review folded in 2026-06-08).
-** TODO [#D] theme-studio low-contrast preset/mask mode :feature:studio:
-Deferred from the perceptual color metrics spec (vNext). After raw OKLCH/APCA/DeltaE readouts exist, decide whether to add a named low-contrast workflow: APCA Lc bands, a contrast ceiling/floor mask, or a "soft" sibling to the existing any/AA+/AAA picker mask. Spec: [[id:15db8ae3-fc14-49f3-9ed5-d5ff59790904][spec]] (vNext candidates; review folded in 2026-06-08).
-** TODO [#D] theme-studio per-tier reseed controls :feature:studio:
-Deferred from the seeding-engine spec (vNext). V1 reseeds all three guide-owned tiers at once; later consider separate "reseed syntax", "reseed UI", and "reseed package/org" controls if all-at-once proves too blunt. Spec: [[id:b70b37f2-37df-4c8e-ac2f-1f20d12e33dd][spec]] (vNext; review folded in 2026-06-08).
 ** TODO [#D] Treesitter grammar offline cache :feature:
 Treesitter grammars are downloaded by =treesit-auto= on first use and live outside the localrepo. For true offline reproducibility, cache the grammars next to the localrepo (a =.localrepo/treesitter/= tier, or a separate mirror script). Cross-linked from =docs/design/localrepo.org=.
-
+* Emacs Someday/Maybe
 * Emacs Resolved
 ** DONE [#B] Fix likely =elpa-mirror-location= path bug :bug:quick:
 CLOSED: [2026-05-03 Sun]
@@ -8505,3 +8487,41 @@ CLOSED: [2026-06-15 Mon 22:56]
 :LAST_REVIEWED: 2026-06-13
 :END:
 From the roam inbox: the =show= button for the raw JSON export does not fit the main theme-design workflow, but it may still be useful for debugging. Decide whether to hide it behind a debugging affordance, rename it, or remove it. Quick UI cleanup once the desired debugging surface is chosen; not marked solo because it is a workflow preference call.
+** DONE [#B] TTY-accessible personal C-; keymap :feature:solo:quick:
+CLOSED: [2026-06-16 Tue]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-05
+:END:
+Done 2026-06-16: keybindings.el binds cj/custom-keymap under C-c ; alongside C-;, so the whole command family is reachable in a terminal frame with the same leaf keys (the single-point fix the body describes; no env-terminal-p branch). Audited every leaf key registered into the family — all are TTY-safe (letters, digits, punctuation, SPC, and arrow keys under C-; b, which terminals do encode); no C-RET, super, or hyper bindings, so nothing needed remapping. TDD: tests/test-keybindings-tty-mirror.el (3 tests, both prefixes share one map); full suite green; live-reloaded and confirmed C-c ; resolves to the family in the daemon. Commit pending. TTY-frame sign-off is a VERIFY under Manual testing and validation.
+The personal prefix =C-;= (Control-semicolon) is GUI-only — terminals can't encode it, so the entire custom command family (=C-; g= calendar, =C-; a= AI, =C-; S= Slack, =C-; O= org, =C-; M= Signal, =C-; L= pearl, =C-; j= jump, …) is unreachable in a terminal frame (=emacsclient -nw=, Emacs inside vterm/tmux). Surfaced 2026-06-03 out of the pearl =C-; L= prefix discussion.
+
+Goal: keep =C-;= in GUI and add a TTY-typable mirror prefix so the same leaf keys work in a terminal. The fix is a single point: =modules/keybindings.el= defines =cj/custom-keymap= once, binds it globally with =(keymap-global-set "C-;" cj/custom-keymap)=, and every module registers into it via =cj/bind-prefix= / =cj/bind-command=. Binding that one keymap under a second prefix mirrors the whole family for free — no per-module edits.
+
+Easy prefix candidates (home-row-leaning, TTY-safe), same leaf keys under each:
+- =C-c ;= (recommended) — keeps the semicolon mnemonic; =C-c= is the standard user prefix and always TTY-encodable, =;= is home row. =C-; L= becomes =C-c ; L=, zero leaf-key relearning. Bind it unconditionally alongside =C-;= so both GUI and TTY reach the identical map — no =env-terminal-p= branch needed.
+- =C-c SPC= — easy reach, but collides with =org-table-blank-field= (=C-c SPC=) inside org buffers.
+- Bare =C-c <leaf>= (the literal "C-c L" idea) — rejected: =C-c= is shared with org (=C-c l= = =org-store-link=, confirmed live), the LSP prefix (=lsp-keymap-prefix "C-c l"=), and pdf-view; binding the whole family under bare =C-c= would shadow/conflict with those.
+
+While in here, audit individual leaf chords for other non-TTY keys (any =C-RET=, super/hyper bindings — terminals can't send super/hyper either) and note or remap them. Verify the result in an actual =emacs -nw= / =emacsclient -nw= frame, not just GUI. Relates to the standing "org-mode keybinding consolidation" reminder.
+
+** DONE [#C] theme-studio: open with the palette collapsed to base colors :feature:studio:next:
+CLOSED: [2026-06-16 Tue]
+Every time theme-studio opens, the palette shows all colors including the span tints. Instead it should open showing the base colors only, and the user expands the spans by clicking the left-side arrow menu. From the roam inbox 2026-06-16. Craig: "just do it. :)"
+Done 2026-06-16: initApp sets paletteShowFull=false before the first render, so the studio opens collapsed (arrow ▶); the existing toggle expands the spans. New #paldefaulttest gate asserts the opening collapsed state; #counttest and #paltoggletest now opt into full mode explicitly since they assert span tiles. Full suite green.
+** DONE [#C] theme-studio: realistic markdown-mode preview :feature:studio:
+CLOSED: [2026-06-16 Tue]
+markdown-mode fell back to the generic preview (face names in their own colors). Built renderMarkdownPreview (app.js): a realistic README exercising 28 markdown faces in context (front matter, H1-H3, bold/italic, inline + fenced code with a language tag, links + bare URLs, lists + GFM checkboxes, blockquote + footnote, table, hr, strikethrough, highlight, math, inline HTML, comment). Routed via a PREVIEW_KEYS map in app_inventory.py (markdown-mode -> markdown). #mdtest gate validates every data-face is a real markdown face; full theme-studio suite green. Commit =0682b24f=, pushed. Visual sign-off is a VERIFY under Manual testing and validation.
+** DONE [#C] cj/gptel-switch-backend reintroduces the string-model crash :bug:quick:solo:
+CLOSED: [2026-06-16 Tue]
+=modules/ai-config.el:272= — =(setq gptel-model model)= with the raw completing-read STRING — the documented wrong-type-argument-symbolp modeline hang (CLAUDE.md gotcha), reachable from C-; a B today. =cj/gptel-change-model= (C-; a m) already does backend+model switching and interns correctly. Intern here, or delete switch-backend and keep one command. From the 2026-06 config audit.
+
+Fixed 2026-06-16: added pure helper =cj/gptel--model-to-symbol= (mirrors =cj/gptel--model-to-string=) and coerced the completing-read value through it before =(setq gptel-model ...)= in =cj/gptel-switch-backend=. 7 ERT tests for the helper (=tests/test-ai-config-model-to-symbol.el=); the existing switch-backend test (=tests/test-ai-config-gptel-commands.el=) updated from asserting the raw string to asserting a symbol + a =symbolp= crash-guard. Full suite green; helper and the redefined command are live in the daemon. Chose "intern" over deleting the redundant command — the dedup is the VERIFY below.
+
+** DONE [#C] theme-studio picker panel blends into the page :bug:quick:solo:studio:
+CLOSED: [2026-06-16 Tue]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-06-11
+:END:
+Craig, 2026-06-11 manual-test walk: the color picker's background is hard to distinguish from the page background. Give the picker panel a visibly distinct background or a highlighted border so it stands out. Pin with a gate asserting the picker element carries the distinct style.
+Done 2026-06-16: the picker now carries the gold accent border (#e8bd30) and a lighter background (#1f1c19 vs the page's #0d0b0a). The #pickertest gate asserts the accent border and a per-channel background lift of ≥12 over the page, so the distinction can't silently regress.
+