@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/src/input/config-modal.ts

@@ -7,6 +7,7 @@ import type {
   ConfigModalView,
 } from './config-modal-types.ts';
 import type { ModalSectionStyle } from '../renderer/modal-factory.ts';
+import { truncateDisplay, wrapText } from '../utils/terminal-width.ts';
 
 export type {
   ConfigModalAction,
@@ -52,6 +53,26 @@ export interface ConfigModalRenderModel {
 
 const DEFAULT_VISIBLE_ROWS = 10;
 
+/**
+ * Default label wrap width for getRenderModel() callers that don't pass one
+ * (tests, mainly). Matches the renderer's real list-item wrap width at the
+ * common terminal sizes this codebase tests against: default box width 76,
+ * minus the 4-column text margin and 2-column selection indicator (see
+ * ModalFactory._renderListSection's `contentW - 2`). renderConfigModal()
+ * itself always computes and passes the ACTUAL width for the current
+ * terminal size — this constant only matters when getRenderModel() is
+ * called directly without going through the renderer.
+ */
+const DEFAULT_LABEL_WRAP_WIDTH = 70;
+
+/**
+ * Stable id for the synthesized "no matches" row DEBT-5 item 1 injects when a
+ * filter query excludes every selectable row in a tab. Non-selectable (info
+ * rows are never filtered — see ConfigModal's filter doc) so this id can
+ * never collide with a real surface row id.
+ */
+const FILTER_NO_MATCH_ROW_ID = '__config_modal_filter_no_match__';
+
 /**
  * ConfigModal — the single, generic, named config-modal host. One instance
  * lives on the InputHandler (like `settingsModal`); it renders whatever
@@ -75,6 +96,34 @@ export class ConfigModal {
   /** Pending destructive confirm: the action key awaiting a second press. */
   private pendingConfirmKey: string | null = null;
 
+  /**
+   * DEBT-5 item 1 — the host's own type-to-filter, armed with '/' (matching
+   * the pre-existing "'/' to filter" convention: scrollable-list-panel.ts's
+   * opt-in filter, and SettingsModal's own '/'-armed search). `filterActive`
+   * gates whether printable keys go to the query instead of nav/actions;
+   * `filterQuery` is the TEXT-CAPTURE buffer itself (a multi-char paste token
+   * appends in one shot — see handleConfigModalToken). Filtering only ever
+   * narrows the ACTIVE tab's rows and is reset on tab switch (a query typed
+   * against one tab's rows has no defined meaning against another's).
+   *
+   * FILTER-CONVENTION RULING (batch integration — where '/'-armed vs instant
+   * filtering is decided across the TUI's list UIs):
+   *   - '/'-ARMED here (config-modal host surfaces): these surfaces bind PLAIN
+   *     single keys to ACTION HOTKEYS (e.g. 'r' refresh, 'd' delete). A key
+   *     can't be both an action and a filter character, so filtering must be
+   *     explicitly armed with '/' first. This is DEBT-5's design.
+   *   - INSTANT filtering (pure pickers — help overlay, command palette,
+   *     selection-modal): these have no single-key actions, so every printable
+   *     key is unambiguously a filter character and narrows the list on the
+   *     first keystroke. This is UX-C's design (selection-modal-overlay.ts).
+   *   - Both keep single-Esc-close semantics. The only extra step is here: a
+   *     two-stage Esc (first Esc clears a NON-EMPTY query, second Esc closes)
+   *     — see the Esc branch in handleConfigModalToken. With an empty query,
+   *     one Esc closes, exactly like the instant pickers.
+   */
+  private filterActive = false;
+  private filterQuery = '';
+
   /**
    * Structure captured at the last interaction boundary (open / key press).
    * Renders overlay live values onto THIS so rows never reflow mid-interaction.
@@ -84,6 +133,15 @@ export class ConfigModal {
   private scrollOffset = 0;
   private visibleRows = DEFAULT_VISIBLE_ROWS;
 
+  /**
+   * False until the first token reaches the open modal. While false, renders
+   * may re-sync structure so an async onOpen load replaces the "Loading…"
+   * placeholder WITHOUT requiring a keypress; the freeze-to-interaction-
+   * boundary rule protects a cursor the user has engaged, and before the
+   * first interaction there is nothing to protect (refutation finding 3).
+   */
+  private interactedSinceOpen = false;
+
   // ── Lifecycle ──────────────────────────────────────────────────────────────
 
   open(surface: ConfigModalSurface, requestRender: () => void = () => {}): void {
@@ -95,6 +153,9 @@ export class ConfigModal {
     this.statusMessage = '';
     this.pendingConfirmKey = null;
     this.scrollOffset = 0;
+    this.filterActive = false;
+    this.filterQuery = '';
+    this.interactedSinceOpen = false;
     const view = surface.buildView();
     this.frozenView = view;
     this.activeTabId = view.tabs[0]?.id ?? '';
@@ -110,6 +171,8 @@ export class ConfigModal {
     this.frozenView = null;
     this.statusMessage = '';
     this.pendingConfirmKey = null;
+    this.filterActive = false;
+    this.filterQuery = '';
   }
 
   /** Re-activate the current surface after a nested modal closes (Esc stack). */
@@ -131,15 +194,22 @@ export class ConfigModal {
 
   // ── Interaction boundary ────────────────────────────────────────────────────
 
+  /** Token router calls this for every token the open modal receives. */
+  noteInteraction(): void {
+    this.interactedSinceOpen = true;
+  }
+
   /**
    * Re-capture the structure from the current live view. Called on every key
-   * press (never during a pure render tick) — this is what makes structural
-   * changes appear only at an interaction boundary. Selection + active tab are
-   * preserved by id and clamped if their target vanished.
+   * press (never during a pure render tick — with one exception: before the
+   * FIRST interaction, getRenderModel syncs so async loads paint) — this is
+   * what makes structural changes appear only at an interaction boundary.
+   * Selection + active tab are preserved by id and clamped if their target
+   * vanished.
    */
   syncStructure(): void {
     if (!this.surface) return;
-    const view = this.surface.buildView();
+    const view = this._applyFilter(this.surface.buildView());
     this.frozenView = view;
     if (!view.tabs.some((t) => t.id === this.activeTabId)) {
       this.activeTabId = view.tabs[0]?.id ?? '';
@@ -151,6 +221,58 @@ export class ConfigModal {
     this._clampScroll();
   }
 
+  // ── Filter (DEBT-5 item 1 — each mutation is an interaction boundary) ──────
+
+  isFilterActive(): boolean {
+    return this.filterActive;
+  }
+
+  getFilterQuery(): string {
+    return this.filterQuery;
+  }
+
+  /** Arm the filter (handleConfigModalToken calls this on '/'). Idempotent. */
+  activateFilter(): void {
+    if (this.filterActive) return;
+    this._clearConfirm();
+    this.filterActive = true;
+    this.syncStructure();
+  }
+
+  /**
+   * Append text to the query — the WHOLE token value in one call, so a
+   * multi-char paste token lands in the filter atomically rather than being
+   * split into per-char nav/action dispatch (the text-capture invariant this
+   * item's brief calls out). A no-op when the filter isn't armed.
+   */
+  appendFilterText(text: string): void {
+    if (!this.filterActive || text.length === 0) return;
+    this.filterQuery += text;
+    this.syncStructure();
+  }
+
+  backspaceFilter(): void {
+    if (!this.filterActive || this.filterQuery.length === 0) return;
+    this.filterQuery = this.filterQuery.slice(0, -1);
+    this.syncStructure();
+  }
+
+  /**
+   * Esc while filtering: a non-empty query is CLEARED (stays armed, ready to
+   * retype without pressing '/' again) and this returns true so the caller
+   * (handleConfigModalToken) stops here instead of closing the modal. An
+   * empty query returns false — the caller falls through to the ordinary
+   * close path, preserving single-Esc-close for the no-filter case (the one
+   * documented exception: two-stage Esc only when there is something to
+   * clear).
+   */
+  clearFilterOrFallthrough(): boolean {
+    if (!this.filterActive || this.filterQuery.length === 0) return false;
+    this.filterQuery = '';
+    this.syncStructure();
+    return true;
+  }
+
   // ── Navigation (each is an interaction boundary) ────────────────────────────
 
   moveDown(): void {
@@ -183,6 +305,10 @@ export class ConfigModal {
 
   private _switchTab(dir: 1 | -1): void {
     this._clearConfirm();
+    // A filter query is scoped to the tab it was typed against — switching
+    // tabs resets it (DEBT-5 item 1), same as statusMessage below.
+    this.filterActive = false;
+    this.filterQuery = '';
     this.syncStructure();
     const tabs = this.frozenView?.tabs ?? [];
     if (tabs.length <= 1) return;
@@ -229,6 +355,7 @@ export class ConfigModal {
       print: ctx.print,
       executeCommand: ctx.executeCommand,
       openModal: ctx.openModal,
+      submitInput: ctx.submitInput,
       requestRender: this.requestRender,
       setStatus: (m: string) => { this.statusMessage = m; },
       close: () => this.close(),
@@ -265,8 +392,20 @@ export class ConfigModal {
    * Compute the render model: frozen structure + live value overlay. Pure —
    * does NOT sync structure, so calling it repeatedly with only value mutations
    * yields byte-identical layout (the liveness contract).
+   *
+   * `labelWrapWidth` is the wrap column ModalFactory's list section will use
+   * for row labels (renderConfigModal computes and passes the real one for
+   * the current terminal size). It exists so the wrap-clamp below (DEBT-5
+   * item 2) can pre-empt a live label growing past ModalFactory's wrap width
+   * mid-tick — a structural change (an extra visible line) without an
+   * interaction — by measuring wrapped line counts here, before the label
+   * ever reaches the renderer.
    */
-  getRenderModel(): ConfigModalRenderModel {
+  getRenderModel(labelWrapWidth: number = DEFAULT_LABEL_WRAP_WIDTH): ConfigModalRenderModel {
+    // Pre-first-interaction: async onOpen loads may restructure freely (the
+    // user hasn't engaged a cursor yet) — sync so "Loading…" is replaced by
+    // real content on the load's own requestRender, not the next keypress.
+    if (this.active && !this.interactedSinceOpen) this.syncStructure();
     const live = this.surface?.buildView() ?? null;
     const frozen = this.frozenView;
     if (!frozen) {
@@ -295,7 +434,7 @@ export class ConfigModal {
       const src = lr ?? fr;
       return {
         id: fr.id,
-        label: src.label,
+        label: this._clampRowLabel(fr.label, src.label, labelWrapWidth),
         style: src.style,
         selected: fr.id === this.selectedRowId,
         selectable: fr.selectable !== false,
@@ -306,12 +445,27 @@ export class ConfigModal {
     const visible = this.visibleRows;
     const windowed = allRows.slice(this.scrollOffset, this.scrollOffset + visible);
 
-    const hints = [
-      ...(frozen.hints ?? []),
-      ...(frozenTab?.hints ?? []),
-      ...this._actionHints(),
-      'Esc close',
-    ];
+    // DEBT-5 item 1: while filtering, the surface's own action/tab hints are
+    // unreliable (their printable-letter keys are captured by the filter
+    // instead of firing — see handleConfigModalToken), so the footer swaps
+    // to just the filter status (query + a truthful match count) and the
+    // Esc contract for this mode. See getFilterQuery/isFilterActive callers.
+    const filtering = this.filterActive;
+    const hasQuery = filtering && this.filterQuery.length > 0;
+    const hints = filtering
+      ? [
+          this._filterStatusHint(
+            frozenRows.filter((r) => r.selectable !== false).length,
+            (liveTab?.rows ?? []).filter((r) => r.selectable !== false).length,
+          ),
+          hasQuery ? 'Esc clear · Esc close' : 'Esc close',
+        ]
+      : [
+          ...(frozen.hints ?? []),
+          ...(frozenTab?.hints ?? []),
+          ...this._actionHints(),
+          'Esc close',
+        ];
 
     return {
       title: live?.title ?? frozen.title,
@@ -328,6 +482,67 @@ export class ConfigModal {
 
   // ── internals ────────────────────────────────────────────────────────────────
 
+  /**
+   * DEBT-5 item 2 (wrap-clamp overlay): keep a live label within the FROZEN
+   * row's line footprint until the next interaction boundary re-freezes it.
+   * `frozenLabel` is what the row wrapped to when the structure was captured
+   * (open/nav/filter keystroke); `liveLabel` is this tick's value. If the
+   * live label would wrap into MORE lines than the frozen one, that is a
+   * structural change (an extra visible row) happening without a keypress —
+   * exactly the hazard this closes. Clamp to the frozen line count, ellipsis
+   * on the last line to signal truncation; a live label that wraps to the
+   * SAME or FEWER lines passes through untouched (not the documented hazard).
+   * Identical strings short-circuit (the common per-tick case: unchanged or
+   * non-selected/stale rows) without doing any wrap work.
+   */
+  private _clampRowLabel(frozenLabel: string, liveLabel: string, width: number): string {
+    if (liveLabel === frozenLabel) return liveLabel;
+    const frozenLineCount = Math.max(1, wrapText(frozenLabel, width).length);
+    const liveLines = wrapText(liveLabel, width);
+    if (liveLines.length <= frozenLineCount) return liveLabel;
+    const clamped = liveLines.slice(0, frozenLineCount);
+    const lastIdx = clamped.length - 1;
+    clamped[lastIdx] = `${truncateDisplay(clamped[lastIdx]!, Math.max(1, width - 1))}…`;
+    return clamped.join('\n');
+  }
+
+  /** Footer text for the active filter: the query + a truthful match count. */
+  private _filterStatusHint(matched: number, total: number): string {
+    const q = this.filterQuery;
+    if (q.length === 0) return `/ type to filter (${total} row${total === 1 ? '' : 's'})`;
+    return `/${q} — ${matched} of ${total} match${matched === 1 ? '' : 'es'}`;
+  }
+
+  /** Apply the active filter query to every tab's rows. A no-op passthrough when not filtering. */
+  private _applyFilter(view: ConfigModalView): ConfigModalView {
+    if (!this.filterActive || this.filterQuery === '') return view;
+    const query = this.filterQuery.toLowerCase();
+    return { ...view, tabs: view.tabs.map((tab) => this._filterTab(tab, query)) };
+  }
+
+  /**
+   * Narrow one tab's rows to those matching `query` (case-insensitive
+   * substring on the label). Non-selectable rows (section titles, honest
+   * empty-state copy, warning banners) always pass through unfiltered —
+   * they're context, not data. When the query excludes every selectable row
+   * but the tab genuinely had some, append the honest "no rows match" line
+   * (DEBT-5 item 1's empty-result case) instead of silently showing nothing
+   * or misleadingly falling back to the surface's own emptyText (which
+   * describes "no data at all", not "no data matches your filter").
+   */
+  private _filterTab(tab: ConfigModalTab, query: string): ConfigModalTab {
+    const kept = tab.rows.filter((r) => r.selectable === false || r.label.toLowerCase().includes(query));
+    const hadSelectable = tab.rows.some((r) => r.selectable !== false);
+    const stillMatched = kept.some((r) => r.selectable !== false);
+    if (hadSelectable && !stillMatched) {
+      return {
+        ...tab,
+        rows: [...kept, { id: FILTER_NO_MATCH_ROW_ID, label: `No rows match "${this.filterQuery}".`, selectable: false }],
+      };
+    }
+    return { ...tab, rows: kept };
+  }
+
   private _actionHints(): string[] {
     const actions = this.surface?.actions ?? [];
     const row = this.getSelectedRow();

package/src/input/feed-context-factory.ts

@@ -39,6 +39,7 @@ import type { ModelPickerTarget } from './model-picker.ts';
 import type { KillRing } from './kill-ring.ts';
 import type { PanelMouseLayout } from './handler-feed-routes.ts';
 import type { FocusTracker } from '../core/focus-tracker.ts';
+import type { PanelBurstGuardState } from './panel-paste-flood-guard.ts';
 
 /**
  * Initial mutable scalar values for InputFeedContext.
@@ -125,6 +126,8 @@ export interface FeedContextStableRefs {
   keybindingsManager: KeybindingsManager;
   killRing: KillRing;
   focusTracker: FocusTracker;
+  /** DEBT-5 item 5 — paste-flood guard state, mutated in place (never reallocated). */
+  panelBurstGuard: PanelBurstGuardState;
   getHistory: () => InfiniteBuffer;
   getViewportHeight: () => number;
   getScrollTop: () => number;

package/src/input/handler-command-route.ts

@@ -143,9 +143,16 @@ function withPanelFocusSync(context: CommandContext, state: CommandModeRouteStat
         }
       : undefined,
     showPanel: context.showPanel
-      ? (panelId, pane) => {
-          context.showPanel?.(panelId, pane);
-          state.panelFocused = true;
+      ? (panelId, pane, target, opts) => {
+          context.showPanel?.(panelId, pane, target, opts);
+          // UX-C: showPanel no longer transfers focus by default — the command
+          // path leaves the composer focused (ui-openers.ts's showPanel only
+          // calls focusPanels() when opts.focus is set). Only flip the local
+          // panelFocused mirror when the caller explicitly asked for focus;
+          // otherwise leave it exactly as it was (the composer, since you can
+          // only type a command from there in the first place). `target` is the
+          // DEBT-5 deep-link jump target, forwarded verbatim.
+          if (opts?.focus) state.panelFocused = true;
         }
       : undefined,
     focusPanels: context.focusPanels

package/src/input/handler-content-actions.ts

@@ -421,7 +421,7 @@ export function handleCtrlC(
   saveUndoState: () => void,
   setPrompt: (value: string) => void,
   setCursorPos: (value: number) => void,
-  cancelGeneration: (() => void) | undefined,
+  cancelGeneration: (() => boolean | void) | undefined,
   exitApp: () => void,
   requestRender: () => void,
   lastCtrlCTime: number,
@@ -436,7 +436,22 @@ export function handleCtrlC(
     setCursorPos(0);
     return;
   }
-  cancelGeneration?.();
+  // Stopping in-flight speech / aborting the turn must never prevent the quit
+  // double-press window from advancing. A throw from the async TTS-stop path
+  // (e.g. killing the audio subprocess) would otherwise swallow this press and
+  // strand the user unable to quit while TTS is speaking. Decouple the two: the
+  // press below is recorded no matter how speech-stop fares. (UX-B item 6b.)
+  let stoppedSpeech = false;
+  try {
+    stoppedSpeech = cancelGeneration?.() === true;
+  } catch {
+    // Non-fatal to the exit chord; the quit-window bookkeeping still runs.
+  }
+  // A press that silenced LIVE speech is consumed by that job (batch replay
+  // D5) — symmetric with the prompt-clearing press above. The quit chord
+  // ("Ctrl+C x2") starts from a quiet state; turn-aborts still count toward
+  // the double-press.
+  if (stoppedSpeech) return;
   const now = Date.now();
   // Clear any hide-timer pending from a prior press before deciding this
   // one's outcome, whichever branch below runs. Without this, a hide-timer

package/src/input/handler-feed-routes.ts

@@ -13,11 +13,13 @@ import {
 } from './handler-prompt-buffer.ts';
 import { cleanupMarkerRegistry, expandPrompt, findMarkerAtPos, registerPaste } from './handler-content-actions.ts';
 import type { PanelManager } from '../panels/panel-manager.ts';
-import { renderPanelWorkspaceBar } from '../renderer/panel-workspace-bar.ts';
-import type { TabHitRegion } from '../renderer/tab-strip.ts';
+import { getPanelUnderMouse, workspaceTabAtMouse } from './panel-mouse-geometry.ts';
+import type { PanelMouseLayout } from './panel-mouse-geometry.ts';
+export type { PanelMouseLayout };
 import type { KeybindingsManager } from './keybindings.ts';
 import type { KillRing } from './kill-ring.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { trackPanelPasteFloodGuard, type PanelBurstGuardState } from './panel-paste-flood-guard.ts';
 
 export type PanelFocusRouteState = {
   panelManager: PanelManager;
@@ -43,6 +45,9 @@ export type PanelFocusRouteState = {
    * no text capture (Invariant A: focus must not silently flip to the composer).
    */
   onPasteDropped?: (panelName: string) => void;
+  /** Wall-clock time (ms) for this token; `burstGuard` is DEBT-5 item 5's flood-guard state, mutated in place across tokens (see panel-paste-flood-guard.ts). */
+  now: number;
+  burstGuard: PanelBurstGuardState;
   /**
    * True while a turn is actively streaming; gates Escape's cancel-first
    * precedence (I6.1) ahead of the panel's own two-stage escape contract
@@ -87,20 +92,13 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
     // (e.g. dismiss a confirm dialog or clear search). Only unfocus if the
     // panel returns false (unconsumed) or there is no active panel.
     if (token.logicalName === 'escape') {
-      // I6.1: while a turn is streaming, a focused panel must not be able to
-      // swallow the only way to cancel it (replay R5) — Escape's first job is
-      // always cancel-turn. The panel's own two-stage consume-or-unfocus
-      // contract below only runs once no turn is active, so a *second*
-      // Escape (now with the turn already cancelled) falls through to it
-      // normally. panelFocused is left unchanged here (panel stays open and
-      // focused) — the panel close moves to that second Escape, or to
-      // Ctrl+X (panel-close, keybindings.ts), which is handled earlier in
-      // handleGlobalShortcutToken and is unaffected by this branch. This
-      // deliberately calls cancelGeneration() directly instead of routing
-      // through the shared handleEscape() (handler-modal-stack.ts) — that
-      // function's fallthrough order (modal-pop -> active-modal-close ->
-      // clear-nonempty-prompt -> cancelGeneration) is not guaranteed to reach
-      // cancelGeneration first in every state combination.
+      // I6.1/replay R5: while streaming, a focused panel must not swallow the
+      // only way to cancel — Escape's first job is always cancel-turn; the
+      // panel's own two-stage consume-or-unfocus contract only runs once no
+      // turn is active, so a *second* Escape falls through to it normally
+      // (panelFocused stays unchanged here). Calls cancelGeneration()
+      // directly rather than the shared handleEscape() (handler-modal-stack.ts),
+      // whose fallthrough order doesn't guarantee reaching it first.
       if (state.isTurnActive()) {
         state.cancelGeneration();
         state.requestRender();
@@ -119,13 +117,10 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
     }
     const kb = state.keybindingsManager;
     // NOTE: panel-tab-next/prev, panel-close, and panel-close-all are handled
-    // globally in handleGlobalShortcutToken, which runs earlier in the feed
-    // loop and consumes those tokens before they ever reach this focused-panel
-    // route. Their old copies lived here too and had drifted (this route never
-    // called pm.hide() on close-all); they were unreachable, so they are gone
-    // and close/close-all semantics now live in exactly one place. Only
-    // panel-focus-toggle stays here, because it is meaningful only while the
-    // panel workspace already owns focus (it swaps between the two panes).
+    // globally in handleGlobalShortcutToken (runs earlier in the feed loop) —
+    // their old, drifted copies here were unreachable and are gone. Only
+    // panel-focus-toggle stays, since it's meaningful only once the panel
+    // workspace already owns focus (it swaps between the two panes).
     if (kb.matches('panel-focus-toggle', token)) {
       // Switch keyboard focus between the top and bottom panes (no-op when
       // there is no visible, non-empty bottom pane).
@@ -153,20 +148,32 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
 
   if (token.type === 'text' && token.value) {
     const activePanel = state.panelManager.getActive();
-    // Invariant A/B (W6.2). A paste (isPasteToken: one multi-char text token)
-    // into a focused text-capturing panel (a `/`-search or steer-draft field —
-    // isCapturingTextBurst) is forwarded verbatim below; into any other focused
-    // panel it is DROPPED with a one-shot hint — never exploded into per-char
-    // hotkeys, and never a silent focus flip to the composer (what the old
-    // per-feed char-sum burst guard did, which also misfired on two quick nav
-    // keys in one feed). Focus moves only on an explicit transfer verb, so
-    // panelFocused is left unchanged. Discrete 1-char keystrokes are not pastes
-    // and fall through to the per-char dispatch below, one at a time.
+    // UX-C: '/' is an explicit transfer verb back to the composer (a capturing panel, isCapturingTextBurst, keeps '/' for itself).
+    if (token.value === '/' && !activePanel?.isCapturingTextBurst?.()) {
+      panelFocused = false;
+      return { handled: false, panelFocused };
+    }
+    // Invariant A/B (W6.2): a paste (isPasteToken, one multi-char token) into
+    // a capturing panel forwards verbatim below; elsewhere it is DROPPED with
+    // a one-shot hint (never exploded into hotkeys, never a silent focus
+    // flip — focus moves only on an explicit verb). Discrete keystrokes fall
+    // through to the per-char dispatch below.
     if (state.isPasteToken && !activePanel?.isCapturingTextBurst?.()) {
       state.onPasteDropped?.(activePanel?.name ?? 'the panel');
       state.requestRender();
       return { handled: true, panelFocused };
     }
+
+    // DEBT-5 item 5 — paste flood guard (rate-based; see panel-paste-flood-guard.ts).
+    if (!state.isPasteToken && !activePanel?.isCapturingTextBurst?.()) {
+      const guard = trackPanelPasteFloodGuard(state.burstGuard, state.now);
+      if (!guard.dispatch) {
+        if (guard.showHintNow) state.onPasteDropped?.(activePanel?.name ?? 'the panel');
+        state.requestRender();
+        return { handled: true, panelFocused };
+      }
+    }
+
     if (activePanel?.handleInput) {
       for (const ch of token.value) {
         activePanel.handleInput(ch);
@@ -204,8 +211,7 @@ export function handleIndicatorFocusToken(state: IndicatorFocusRouteState, token
     }
     if (token.logicalName === 'enter') {
       indicatorFocused = false;
-      // W2.2: repointed from the retired process modal (removed in W6.2) to the
-      // Fleet panel — F2 also opens the Fleet panel (handlePromptKeyToken f2).
+      // W2.2: opens the Fleet panel (see openFleetPanel's own doc, line ~352).
       state.openFleetPanel();
       state.requestRender();
       return { handled: true, indicatorFocused };
@@ -603,12 +609,11 @@ export function handlePromptKeyToken(state: KeyRouteState, token: InputToken): {
     return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
   }
 
+  // UX-C: F2 is now handled globally with toggle semantics (handler-shortcuts.ts)
+  // BEFORE it ever reaches this route; this branch is dead in the real
+  // pipeline but stays for panel-entry-points-reachable.test.ts's direct test.
   if (token.logicalName === 'f2') {
     indicatorFocused = false;
-    // W6.2 e: F2 opens AND focuses the Fleet panel, which subsumes the deleted
-    // process modal (ProcessModal/AgentDetailModal/LiveTailModal — removed in
-    // W6.1 once this repoint made them unreachable). openFleetPanel sets
-    // panelFocused on the shared context directly, so nothing more is returned.
     state.openFleetPanel();
     return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
   }
@@ -632,89 +637,6 @@ export type MouseRouteState = {
   handleCopy: () => void;
 };
 
-export type PanelMouseLayout = {
-  x: number;
-  y: number;
-  width: number;
-  height: number;
-  hasBottomPane: boolean;
-  verticalSplitRatio: number;
-};
-
-function clampRatio(value: number): number {
-  return Math.max(0.2, Math.min(0.8, value));
-}
-
-function getActivePanelInPane(panelManager: PanelManager, pane: 'top' | 'bottom') {
-  const target = pane === 'top' ? panelManager.getTopPane() : panelManager.getBottomPane();
-  return target.panels[target.activeIndex] ?? null;
-}
-
-function getPanelUnderMouse(
-  panelManager: PanelManager,
-  layout: PanelMouseLayout | null,
-  row: number,
-  col: number,
-) {
-  if (
-    layout === null
-    || !panelManager.isVisible()
-    || panelManager.getAllOpen().length === 0
-    || col < layout.x
-    || col >= layout.x + layout.width
-    || row < layout.y
-    || row >= layout.y + layout.height
-  ) {
-    return null;
-  }
-
-  const panelRow = row - layout.y;
-  if (!layout.hasBottomPane) {
-    return getActivePanelInPane(panelManager, 'top');
-  }
-
-  // Single consolidated workspace bar (row 0) + h-separator; the rest splits
-  // between the two panes' content.
-  const panelAreaRows = Math.max(0, layout.height - 1);
-  const contentRows = Math.max(0, panelAreaRows - 1);
-  const topContentRows = contentRows <= 1
-    ? contentRows
-    : Math.max(1, Math.floor(contentRows * clampRatio(layout.verticalSplitRatio)));
-  // panelRow 0 = workspace bar; rows 1..topContentRows = top pane; rest = bottom.
-  return panelRow <= topContentRows
-    ? getActivePanelInPane(panelManager, 'top')
-    : getActivePanelInPane(panelManager, 'bottom');
-}
-
-/**
- * If the mouse is over the consolidated workspace tab bar (the first panel
- * row), return the index of the tab under the cursor, else null. Recomputes the
- * tab hit regions by rendering the bar with a layout callback — cheap and keeps
- * the click geometry in lockstep with what was drawn.
- */
-function workspaceTabAtMouse(
-  panelManager: PanelManager,
-  layout: PanelMouseLayout | null,
-  row: number,
-  col: number,
-): number | null {
-  if (
-    layout === null
-    || !panelManager.isVisible()
-    || panelManager.getAllOpen().length === 0
-    || row !== layout.y // workspace bar is the first panel row
-    || col < layout.x
-    || col >= layout.x + layout.width
-  ) {
-    return null;
-  }
-  let regions: readonly TabHitRegion[] = [];
-  renderPanelWorkspaceBar(panelManager.getWorkspaceTabs(), layout.width, true, (r) => { regions = r; });
-  const relCol = col - layout.x;
-  const hit = regions.find((rg) => relCol >= rg.startCol && relCol < rg.endCol);
-  return hit ? hit.index : null;
-}
-
 function scrollPanelUnderMouse(
   state: MouseRouteState,
   token: Extract<InputToken, { type: 'mouse' }>,